Privacy and
confidentiality.

Version 1.0 · Last updated 21 October 2026

We protect client confidentiality and handle personal, sensitive and commercially confidential information with strict professionalism, discretion and care. We use information only for legitimate, authorised purposes, apply safeguards appropriate to its sensitivity, and comply with the privacy laws, duties of confidence and contractual confidentiality obligations that apply to our work.

1 Our scope and responsibilities

This policy explains how Trinitas Business Management Services (Trinitas, we, us or our) handles information obtained through trinitasbms.com, enquiries and our business advisory, quality management, auditing, training and improvement services. It covers prospective and current clients, client representatives, suppliers and other people whose information we handle.

Our approach is informed by the Australian Privacy Principles. We comply with the Privacy Act 1988 (Cth), those Principles and other privacy requirements to the extent they apply to our activities. Our confidentiality commitments also cover business information that is not personal information and therefore may not be protected by privacy legislation.

2 Client confidentiality

We treat information as confidential when it is identified as confidential or when its nature or the circumstances reasonably indicate that it is confidential. This includes commercial plans, pricing, financial information, intellectual property, procedures, audit evidence and findings, nonconformances, personnel information, customer and supplier records, and information about a proposed engagement.

We protect this information through the applicable Australian legal duties of confidence, agreed confidentiality terms and the handling commitments in this policy. Access is limited to authorised people who need the information for a permitted purpose. We do not sell client information or disclose one client's confidential material to another client. Client names, logos, testimonials and identifiable case studies are used for promotion only with prior written permission.

Confidentiality continues after an enquiry or engagement ends, while the information remains confidential and for any longer period required by law or contract. Information lawfully public, already lawfully known to us without restriction, independently developed without using confidential material, or lawfully received from an unrestricted source is not confidential on that basis alone. These exceptions do not remove any privacy obligations that still apply. Permitted disclosures are explained in section 6.

3 Information we collect and how we collect it

We collect information reasonably needed to respond to enquiries, deliver agreed services and administer our business. It may include:

• Contact and enquiry details, including name, email, organisation, role, preferred contact method, telephone number if provided, service interest, message and timeframe.
• Engagement records, including proposals, agreements, instructions, correspondence, meeting notes, relevant business documents, audit records and deliverables.
• Administrative information, including billing contacts, invoice and payment records, and records needed for legal, accounting or dispute purposes.
• Technical information, including IP address, browser and device details, request times, pages requested and security or delivery logs processed by our website and service providers.

We usually collect information directly from you through forms, email, calls, meetings and agreed document exchanges. We may also receive relevant information from an authorised client representative, a referral, a service provider or a lawful public source. Where required, we provide an additional collection notice.

You may make a general enquiry anonymously or using a pseudonym where practicable, including by email instead of the website form. We may need your identity and contact details to provide personalised advice, enter an engagement, invoice you or meet a legal requirement. Withholding necessary information may limit the assistance we can provide.

4 Sensitive and restricted information

Sensitive personal information has a specific legal meaning and includes matters such as health, racial or ethnic origin, religious beliefs, certain biometric information and criminal history. We do not request this information through the general enquiry form. Where it is necessary for an agreed service, we seek the individual's consent unless collection without consent is permitted or required by applicable law, and agree suitable handling arrangements.

Please provide only information relevant to the matter. Before sharing another person's information, ensure you have authority to do so, give any required privacy notices and obtain any required consent. Where practicable, redact unnecessary identifiers or provide de-identified records. We assess unsolicited information and take reasonable steps to securely delete or de-identify it if it should not be retained and it is lawful to do so.

Do not send passwords, payment-card details, classified material, export-controlled technical information or other restricted records through the public form or ordinary email. Contact us first so we can assess whether we can accept the material and agree an authorised, appropriately secure transfer method. A confidentiality agreement does not itself authorise a restricted transfer.

5 How we use information

We use information to respond to enquiries, assess suitability and conflicts, prepare proposals, deliver and document agreed services, communicate with authorised contacts, manage billing, maintain appropriate business records, protect systems and respond to complaints or legal matters. We use or disclose personal information for another purpose only where consent or an applicable legal basis permits it.

Submitting an enquiry does not subscribe you to unrelated marketing. If we send promotional communications, we do so only with consent or another basis permitted by law and provide a simple way to opt out. Contact us at any time to stop marketing. Necessary service and administrative messages may still be sent.

We do not use client confidential material for unrelated research, publicity or general-purpose AI model training without specific prior written authorisation and any legally required individual consent.

6 When information may be disclosed

We disclose information only to the extent reasonably necessary for a lawful, permitted purpose. Recipients may include authorised client contacts; personnel or contractors assisting with an engagement; technology and email providers; and legal, accounting, insurance or other professional advisers. We require appropriate confidentiality or data-protection obligations for people and providers assisting us and take reasonable steps to assess their suitability.

Information may also be disclosed with your authority, as required by law or a court or tribunal order, or where another lawful exception permits disclosure, including to protect legal rights or address a serious safety risk. We assess the basis and limit the information disclosed. Where lawful and appropriate, we inform the affected client about a compulsory disclosure.

We do not promise secrecy against lawful disclosure requirements, prevent protected whistleblowing or restrict an individual's right to complain to a regulator. A disclosure permitted under privacy legislation must also respect any other confidentiality obligation that applies.

7 Website services and overseas processing

The website uses Cloudflare for hosting, delivery and security, and Resend to send enquiry emails to info@trinitasbms.com. Form content passes through these services and is retained in our receiving mailbox and relevant provider records. Google Fonts supplies website typography and receives technical request information, including an IP address and browser details, when fonts are loaded.

Our technology providers operate internationally. Information may be processed outside Australia, including in the United States. Resend states that its stored data is held in the United States; Cloudflare describes storage primarily in the United States and European Economic Area and access through its global operations. Other locations depend on the provider, routing, support arrangements and service configuration. We identify countries where reasonably practicable and can provide further available information on request.

Where applicable law requires safeguards for overseas disclosure, we take reasonable steps to meet those requirements, including assessing the provider and relevant contractual protections. We do not treat use of this website as blanket consent to waive those protections. If you require Australian-only storage or restricted access locations, raise this before providing information so suitable arrangements can be assessed and agreed in writing.

8 Website technology and your choices

The website does not include advertising pixels or behavioural marketing trackers. Hosting and security services may use technical logs, identifiers or essential cookies to operate and protect the website. You can manage cookies through your browser, although restricting them may affect some services. We will update this policy and obtain consent where required before introducing materially different tracking or uses.

Links to other websites are provided for convenience. Those operators manage their own information practices. Their privacy notices do not replace our responsibilities for information we handle.

9 Security and professional handling

We take reasonable technical, organisational and physical steps to protect information against misuse, interference, loss and unauthorised access, alteration or disclosure. Our handling requirements include access limited by role and need, appropriate account and device protection, secure storage and transfer, confidential handling of working papers, and secure disposal. Safeguards are selected according to the information's sensitivity, likely consequences of exposure and engagement requirements.

Particularly sensitive engagements require agreed controls before information is exchanged. We may decline, pause or redirect an exchange where suitable safeguards are unavailable. No transmission method or storage system can be guaranteed completely secure. This limitation does not exclude our legal responsibilities or any rights that cannot lawfully be excluded.

10 Retention and disposal

We retain information only for as long as reasonably needed for the purpose collected, a permitted related purpose, or an applicable legal or contractual recordkeeping requirement. Relevant factors include completion of the engagement, unresolved enquiries, accounting obligations, professional recordkeeping and the establishment, exercise or defence of legal claims. We do not apply one indefinite retention period to all information.

When information is no longer needed and retention is not required by law, we take reasonable steps to securely destroy it or, where appropriate, de-identify it. Client records may be returned or disposed of as agreed, subject to lawful retention needs. Copies in backups are restricted from ordinary use and removed through applicable deletion cycles; any restored copy remains subject to the same disposal requirements. Service-provider records are also subject to their applicable retention arrangements and our obligations.

11 Access correction and deletion requests

You may request access to personal information we hold about you, correction of inaccurate or outdated information, or deletion where retention is no longer necessary or required. Email info@trinitasbms.com with the subject Privacy request and describe the information concerned. We may take proportionate steps to verify your identity or authority before releasing or changing records.

We aim to respond within 30 days and will explain if more time is reasonably needed, subject to any applicable legal deadline. Requests and corrections are free. If a lawful, reasonable access charge is proposed, we explain it in advance. Access may be limited only where a lawful exception applies, such as another person's privacy or legal privilege. Deletion may be limited by a lawful retention requirement. Where we refuse a request, we explain the reason where lawful and the available complaint process. If correction is disputed, you may ask us to associate a statement of your position with the information.

12 Responding to incidents

If we become aware of a suspected loss, misuse or unauthorised disclosure, we act promptly to contain it, assess the circumstances and likely harm, and take appropriate remedial action. We notify affected clients in accordance with applicable law and agreed engagement requirements, and where reasonably necessary to help them reduce harm.

Where the Notifiable Data Breaches scheme or another notification law applies, we assess and notify eligible breaches to affected individuals and the relevant regulator within the required timeframes. Please report suspected incidents promptly to info@trinitasbms.com without sending further sensitive material through an insecure channel.

13 Engagement terms and mutual protection

This policy explains our information-handling commitments. It does not itself create an engagement, transfer intellectual property, or replace a signed service agreement or non-disclosure agreement. Engagement-specific instructions, confidentiality terms, disclosure permissions and security requirements should be recorded in writing. Additional protections agreed in writing apply alongside this policy, subject to mandatory law.

Clients should also protect Trinitas confidential proposals, methods and commercial information in accordance with any agreement and applicable law. Each party should identify restrictions and use authorised channels when sharing information. Nothing in this policy removes statutory privacy rights, non-excludable consumer protections, lawful reporting rights or an existing duty of confidence.

14 Questions complaints and policy updates

Contact the Privacy Contact, Trinitas Business Management Services, at info@trinitasbms.com. Describe your concern, the relevant events and the outcome you seek. We aim to acknowledge complaints within five business days and provide a substantive response within 30 days. If more time is needed, we explain why and provide an expected response date. We consider complaints fairly and confidentially, involving only those needed to investigate or respond.

If you remain dissatisfied, you may contact the Office of the Australian Information Commissioner through www.oaic.gov.au/privacy/privacy-complaints where the matter falls within its jurisdiction, or another relevant regulator. We can assist with identifying an appropriate complaint pathway. Contact us if you need a free copy of this policy in another accessible format.

We review this policy as services, information practices and legal requirements change. The current version is published on our website with its revision date. Where required, we provide further notice or obtain consent for a material change. A policy update does not retrospectively authorise an incompatible use of information or remove an existing contractual confidentiality obligation.

Privacy contact: info@trinitasbms.com