1. Personal information we may collect
The information we collect depends on how you interact with Kurrent and the services we provide.
It may include:
- your name, email address, phone number and other contact details;
- your job title, business name and relationship to a business or entity;
- information you provide when making an enquiry or booking a meeting;
- information about your business, accounting systems, financial position and operations;
- transaction, bookkeeping and accounting information;
- payroll and employee information;
- tax and compliance information;
- tax file numbers and other government-related identifiers where required for our services;
- bank account and payment-related information where relevant;
- identity and verification information where required;
- correspondence, meeting notes, instructions and records of our dealings with you;
- information provided by your previous accountant, bookkeeper or other adviser with appropriate authority;
- information contained in documents, accounting systems or other records you give us access to;
- website usage and technical information described below.
Some of this information may be sensitive or require additional protection because of its financial, identity, payroll or tax-related nature.
We aim to collect only information that is reasonably necessary for our business or the services we provide.
2. How we collect information
We may collect personal information:
- directly from you;
- through our website;
- when you contact us or book a meeting;
- during discovery, onboarding or service delivery;
- through documents or accounting records you provide;
- through systems you authorise us to access;
- from employees, directors or other authorised representatives of your organisation;
- from your existing or previous accountants, bookkeepers or professional advisers with appropriate authority;
- from government agencies, regulators or publicly available records where appropriate;
- from third-party service providers used to support our services.
Where practical, we will collect personal information directly from the individual concerned.
3. Why we collect, use and hold information
We may collect, hold, use and disclose personal information where reasonably necessary to:
- respond to enquiries;
- determine whether Kurrent is suitable for your needs;
- assess, scope and price prospective work;
- onboard clients;
- provide accounting, bookkeeping, payroll, tax, compliance and related services;
- communicate with clients and authorised representatives;
- maintain accurate accounting and business records;
- manage client relationships;
- prepare reports, workpapers, returns and other deliverables;
- meet legal, professional and regulatory obligations;
- verify identity or authority where required;
- manage billing and payments;
- maintain and improve the operation, security and reliability of our systems;
- manage risk, quality assurance, complaints and incidents;
- administer our business;
- protect Kurrent, our clients and others from fraud, misuse or security threats.
We may also use de-identified, aggregated or abstracted information to improve our internal systems, processes and service delivery.
We do not use identifiable client information to train a general-purpose Kurrent AI model for use across unrelated clients.
5. Appointment bookings
Our website uses a third-party appointment-booking service.
When the booking interface is loaded, the provider may receive technical request information such as:
- IP address;
- browser and device information; and
- cookies or identifiers already associated with that provider.
If you make a booking, we may collect information such as:
- first and last name;
- email address;
- meeting date and time; and
- information you provide in any booking questions or notes.
Booking information is used to arrange and manage the appointment and may be added to Kurrent's business calendar and related systems.
Booking information is not automatically added to a marketing mailing list by the website.
6. Website hosting and technical logs
Our website is hosted using a third-party cloud hosting provider.
Like most websites, the hosting infrastructure processes technical information required to deliver and secure the website.
This may include:
- requested pages or paths;
- request time;
- response status;
- request identifiers;
- IP address;
- browser or device information; and
- user-agent information.
This information may be used for website operation, reliability, security, troubleshooting and system administration.
7. AI-assisted technology
Kurrent may use approved AI-assisted technology to support parts of our work.
This may include assisting with:
- analysing information;
- summarising documents or records;
- drafting;
- identifying patterns or anomalies;
- retrieving relevant client context;
- reducing repetitive administrative work;
- supporting internal workflows.
AI is used as a tool to assist Kurrent personnel. It does not remove Kurrent's responsibility for the services we provide or replace appropriate professional judgement and review.
Kurrent applies internal controls to determine which AI environments may be used, what information may be processed and when human review is required.
We aim to provide only the information reasonably necessary for the relevant task.
Passwords, authentication codes and similar credentials are not permitted in general AI workflows.
Tax file numbers, raw identity documents and other particularly sensitive information are subject to additional restrictions and are not intended for routine AI processing.
We do not use identifiable client information to train a general-purpose AI model for use across unrelated clients.
8. How we protect information
Kurrent uses technical and organisational controls designed to protect information from misuse, interference, loss and unauthorised access, modification or disclosure.
Depending on the information and system involved, these controls may include:
- individual user accounts;
- multi-factor authentication;
- role-based and least-privilege access;
- controlled client and system permissions;
- approved business systems;
- encryption provided by approved technology platforms;
- restricted handling of particularly sensitive information;
- limits on unnecessary duplication of information;
- access reviews;
- secure credential management;
- controlled sharing practices;
- staff and contractor confidentiality obligations;
- security incident and escalation processes.
Client records are not intended to be made publicly accessible through uncontrolled file-sharing links.
Particularly sensitive information may be subject to additional access restrictions.
No system can eliminate all security risk. Our approach is to reduce that risk through appropriate systems, controls and operating practices.
9. Tax file numbers and other restricted information
Kurrent may need to handle tax file numbers and other government-related identifiers when providing taxation, payroll, superannuation or related services.
We treat this information as restricted information.
We aim to:
- collect it only where required or appropriate;
- restrict access to people who need it;
- avoid unnecessary duplication;
- keep it in an appropriate system or restricted location; and
- destroy or de-identify it when it is no longer required and we are permitted to do so.
We do not use government identifiers as our own general client identifiers unless permitted by law.
11. Overseas processing and disclosure
Some of the technology and service providers used by Kurrent may operate infrastructure, personnel or service providers outside Australia.
As a result, personal information may in some circumstances be processed, accessed or stored outside Australia.
The countries involved can vary depending on the relevant provider, service and configuration.
Where practicable and relevant, additional information about material overseas processing or service-provider arrangements may be provided in our engagement materials or made available on request.
Before approving arrangements involving overseas access to client information, Kurrent's internal process requires consideration of the nature of the information, the recipient, the purpose of access and applicable privacy, confidentiality and professional obligations.
12. Contractors and outsourced services
Kurrent may use authorised contractors or external specialists to assist in providing or supporting our services.
Contractor access is not intended to provide unrestricted access to all Kurrent information.
Our operating approach is to provide access based on the work a person has been assigned and the information reasonably necessary to perform that work.
Where offshore personnel may be used, additional review, disclosure or client permission may be required before access is provided.
13. Direct marketing
The Kurrent website does not currently operate a newsletter subscription or automatically add appointment bookings to a marketing mailing list.
We may contact prospective or existing clients in connection with an enquiry, meeting, existing relationship or our services where permitted.
Where applicable, you may ask us to stop sending marketing communications to you.
Operational, engagement, billing, compliance and service communications are not treated as marketing communications.
14. Retention of information
We retain information for as long as reasonably necessary for:
- providing our services;
- maintaining appropriate business and professional records;
- meeting legal, taxation, regulatory or professional obligations;
- resolving disputes or complaints;
- managing risk; and
- legitimate business purposes.
Different types of information may have different retention requirements.
Where personal information is no longer required and there is no legal, professional or other legitimate reason to retain it, we aim to securely destroy or de-identify it.
Temporary local copies of client information are not intended to become permanent records.
15. Accuracy and correction
We take reasonable steps to maintain personal information that is accurate, complete and up to date for the purpose for which it is used.
If you believe information we hold about you is inaccurate, incomplete or out of date, you may ask us to correct it.
16. Access to your personal information
You may request access to personal information Kurrent holds about you.
We may need to verify your identity before providing access.
In some circumstances, access may be limited or refused where permitted or required by law. If that occurs, we will explain our position where appropriate.
17. Data breaches and security incidents
Kurrent maintains processes for identifying, escalating and responding to suspected privacy and security incidents.
If an incident involving personal information occurs, we will assess the circumstances and take appropriate steps to contain and investigate it.
Where the Notifiable Data Breaches scheme or another applicable requirement requires notification, we will notify affected individuals and relevant authorities as required.
18. Privacy complaints and concerns
If you have a question, concern or complaint about how Kurrent has handled your personal information, please contact our Privacy Officer.
Privacy Officer
Canopy Systems Pty Ltd trading as Kurrent
Email: jeb@kurrent.com.au
Please provide enough information for us to understand the issue and investigate it.
We will aim to acknowledge and respond to privacy concerns within a reasonable period.
If you are not satisfied with how we handle a privacy complaint, you may be able to contact the Office of the Australian Information Commissioner.
19. Third-party websites and services
Our website may contain links to, or embedded functionality provided by, third parties.
Those organisations may collect information directly from you and may operate under their own privacy policies and terms.
Kurrent is not responsible for the privacy practices of an unrelated third party merely because its website or service is linked from or integrated with our website.
20. Changes to this Privacy Policy
We may update this Privacy Policy as our services, technology, providers, legal obligations or information-handling practices change.
The current version will be published on our website with its effective or last-updated date.
We encourage you to review the policy periodically.
21. Contact us
For privacy questions, access or correction requests, or privacy complaints, contact:
Privacy Officer
Canopy Systems Pty Ltd trading as Kurrent
Email: jeb@kurrent.com.au