Privacy Policy

Our commitment

Copeland Estates Legal is committed to protecting your privacy. We only collect, use, share and keep Personal Information when we reasonably need it to provide our legal services and run our practice.

This policy explains what Personal Information we collect, why we collect it, who we share it with, how we keep it safe, and how you can access it or make a complaint.

What does this Privacy Policy cover?

This policy covers all Personal Information we handle, including information we collect:

• when we prepare Wills, Powers of Attorney, Enduring Guardianship appointments and testamentary trusts;
• when we help executors and administrators with probate and deceased estates;
• to meet our obligations under the AML/CTF Framework; and
• when you visit our website, contact us, attend one of our talks or sign up to our newsletter.

We also handle all client information confidentially under the legal profession legislation (as defined in section 3A of the Legal Profession Uniform Law Application Act 2014 (NSW)), including the Legal Profession Uniform Law Australian Solicitors’ Conduct Rules 2015 (NSW). Nothing in this policy reduces our duty of confidentiality or client legal privilege.

Meaning of words used in this Privacy Policy

In this Privacy Policy the terms listed have the following meanings:

AML/CTF Act

Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth).

AML/CTF Framework

AML/CTF Act, AML/CTF Rules and AUSTRAC-issued guidance.

AML/CTF Rules

Anti-Money Laundering and Terrorism Financing Rules 2025 (Cth) made under the AML/CTF Act.

APP/s

The Australian Privacy Principles in Schedule 1 of the Privacy Act.

AUSTRAC

Australian Transaction Reports and Analysis Centre.

Designated Services

All the services described as Professional Services in Table 6 of section 6 of the AML/CTF Act and its relevant subsections. Not every service we provide is a Designated Service. Designated Services include:

• Assisting a person to plan, execute, or act on their behalf to buy, sell, or transfer real estate (unless ordered by a court or tribunal).
• Assisting a person to plan, execute, or act on their behalf to buy, sell, or transfer a body corporate or legal arrangement (unless ordered by a court or tribunal).
• Receiving, holding, controlling, or managing a person’s money, accounts, securities, virtual assets, or other property while assisting them with, or acting on their behalf in, a transaction.
• Assisting a person to plan, organise, execute, or act on their behalf in a transaction for equity or debt financing related to a body corporate or legal arrangement.
• Selling or transferring a shelf company.
• Assisting a person to plan, execute, or act on their behalf in the creation or restructuring of a body corporate or legal arrangement.
• Acting as, or arranging for someone else to act as, a company director or secretary, a power of attorney, a partner, a trustee, or an equivalent position on behalf of a nominator.
• Acting as, or arranging for someone else to act as, a nominee shareholder for a body corporate or legal arrangement on behalf of a nominator.
• Providing a registered office or principal place of business address for a body corporate or legal arrangement.

We, us, our

Copeland Estates Legal Pty Ltd ABN 41 647 589 393, trading as Copeland Estates Legal.

KYC Information

Information sufficient to:

1. establish initial customer due diligence matters on reasonable grounds as required by the AML/CTF Act; or
2. fulfil our ongoing customer due diligence obligations under the AML/CTF Act.

including:

• the identity of our customer;
• the identity of any person on whose behalf our customer is receiving the service;
• the identity of any person acting on behalf of the customer including their authority to act;
• if the customer is not an individual, the identity of any beneficial owners;
• whether the customer, beneficial owner, or any person acting on their behalf is a politically exposed person or a person designated for targeted financial sanctions;
• information regarding source of wealth and source of funds;
• the nature and purpose of the business relationship or transaction; and
• any other matter specified in the AML/CTF Rules.

OAIC

Office of the Australian Information Commissioner.

Personal Information

Information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information or opinion is true or not, and whether it is recorded in a material form or not.

Privacy Act

Privacy Act 1988 (Cth).

Sensitive Information

Personal Information that is information or an opinion about an individual’s:

• racial or ethnic origin
• political opinions
• membership of a political association
• religious beliefs or affiliations
• philosophical beliefs
• membership of a professional or trade association
• membership of a trade union
• sexual orientation or practices
• criminal record

It also includes health information, genetic information that is not otherwise health information, biometric information used for automated biometric verification or identification, and biometric templates.

What privacy law applies to our relationship

We are a “small business operator” under s 6D of the Privacy Act. Because we are a reporting entity under the AML/CTF Act, the Privacy Act (including the APPs) applies to how we handle Personal Information for our AML/CTF obligations, by operation of s 6E(1A) of the Privacy Act.

The information we collect for AML/CTF purposes is often the same information we need to advise you. So, as a matter of good practice, we apply the APPs to all Personal Information we handle, not just AML/CTF information.

Under APP 2 you may deal with us anonymously, or using a made-up name (a pseudonym), where this is lawful and practical, for example when you make a general enquiry. This is not possible once we act for you, because we need to know who we act for (for example, to check for conflicts of interest) and, where the AML/CTF Framework applies, we must verify your identity.

What Personal Information do we collect?

The Personal Information we collect depends on how you deal with us. It may include:

• contact details, such as your name, address, email address and phone numbers;
• identity details, such as your date of birth and the details of your identity documents (for example, your driver licence or passport);
• KYC Information we must collect and verify under the AML/CTF Act, including whether you are a politically exposed person or subject to sanctions, your source of wealth and source of funds, and who owns or controls any company or trust involved;
• family and relationship details, such as details of your spouse or partner, children, former partners, beneficiaries, executors, trustees, attorneys and guardians;
• financial details, such as your assets, debts, superannuation, insurance, companies and trusts, and bank account details for payments to or from our trust account;
• information about a deceased person and their estate, where we act for an executor or administrator;
• health information, where it is relevant to your legal matter, for example information about your capacity to make a Will, or your medical treatment wishes in an Enduring Guardianship appointment;
• recordings of Microsoft Teams meetings, if you ask us to record a meeting (for example, when we witness your documents by video);
• information from our website, such as your IP address, device and browser type and the pages you visit (see “Our website, cookies and analytics” below); and
• records of our communications with you, and your attendance at our talks and events.

We may collect Sensitive Information where it is needed to comply with the AML/CTF Framework (for example, information about membership of a political association, to check whether someone is a politically exposed person), or where it is relevant to your legal matter. We only collect Sensitive Information with your consent, or where the law requires or allows us to collect it without consent.

We may infer information about you from your dealings with us. We may also carry out ongoing monitoring of matters and client information to comply with our AML/CTF obligations.

Information about other people

Estate planning often involves information about other people, such as your family members, beneficiaries, executors and attorneys. If you give us someone else’s Personal Information, please tell them you have done so and let them know about this policy.

How do we collect Personal Information?

We only collect Personal Information by lawful and fair means.

Where we can, we collect Personal Information directly from you. We may collect it from someone else if:

• you have agreed to this;
• it is unreasonable or impractical to collect it from you, for example when a client gives us details of their family members, or of the owners of a company or trust; or
• the law requires or allows us to collect it from someone else.

We may collect Personal Information when you, or someone acting for you:

• meet with us in person, by phone or on Microsoft Teams;
• contact us by email, post, phone, text message, social media or our website;
• complete our online forms, such as our Will instruction form;
• register for or attend one of our talks, seminars or events;
• sign up to our newsletter; or
• engage us to act for you, including when you give us KYC Information.

We may also collect Personal Information from others, such as your accountant or financial adviser (with your permission), the person who referred you to us, banks, share registries, superannuation funds, government registries, the courts, and identity verification and screening services.

Identity verification

Where the AML/CTF Framework applies, we must identify you and verify your identity before we provide a Designated Service. We may do this by sighting your original identity documents (in person or over Microsoft Teams), or by using an electronic identity verification service.

If we use a credit reporting body for electronic identity verification, we will first tell you about the process, get your express consent, and offer you another way to verify your identity (for example, certified copies of identification documents), as the law requires.

If a verification service we use compares a photo or video of your face with your identity document, this involves biometric information, which is Sensitive Information. We will ask for your consent before we do this.

We record the details from your identity documents that we need for our record-keeping obligations (such as your name, date of birth, address, document type, number and expiry date), together with what we did to verify your identity and the result. The AML/CTF Act does not require us to keep full copies of your identity documents. Once we no longer need a copy of a full identity document, we take reasonable steps to destroy or de-identify it.

Collection notice

We will give you a collection notice at or before the time we collect your Personal Information for AML/CTF purposes or, if that is not practicable, as soon as practicable afterwards.

What happens if you don’t provide us with requested Personal Information?

If you do not give us the Personal Information we ask for, we may not be able to act for you, provide Designated Services or comply with our legal obligations. Where the law requires us to verify your identity and we cannot do so, we may be prohibited by law from providing the Designated Service.

Purposes of collection of Personal Information

We collect, hold, use and disclose Personal Information to:

• respond to your enquiries;
• check for conflicts of interest;
• provide our legal services, including preparing your estate planning documents and helping executors and administrators to manage deceased estates;
• identify you, verify your identity and carry out customer due diligence and ongoing monitoring under the AML/CTF Framework;
• keep our files, trust account records and accounts, and bill for our services;
• meet our professional and legal obligations, and deal with our professional indemnity insurer, regulators and auditors;
• handle complaints and legal claims;
• tell you about legal updates, talks and services that may interest you (you can opt out at any time); and
• understand how people use our website, and improve our services.

Laws and rules that require or allow us to collect and use your Personal Information include the AML/CTF Act and AML/CTF Rules, the Legal Profession Uniform Law and its related rules, including the Legal Profession Uniform Law Australian Solicitors’ Conduct Rules 2015 (NSW) and the Legal Profession Uniform General Rules 2015 (NSW), the Duties Act 1997 (NSW), the Australian Registrars’ National Electronic Conveyancing Council’s Model Participation Rules (for example, when we transfer real estate to an estate beneficiary), and the court rules that apply when we apply for a grant of probate or letters of administration.

Unless you consent to us doing so otherwise, we will only use your Personal Information for the primary purpose for which it was collected, and for any secondary purpose if you would reasonably expect, and the purpose is related to, the primary purpose of collection. Examples of secondary purposes you might reasonably expect are listed in the previous paragraph.

In the case of Sensitive Information, any secondary purpose will be one that you would reasonably expect and directly related to the primary purpose of collection.

Disclosure of Personal Information

Third parties

Subject to our duty of confidentiality and legal requirements, we may share relevant Personal Information with:

• people and organisations involved in your matter, as you instruct us or as reasonably needed to carry out your instructions, for example your executors, attorneys, guardians, trustees and beneficiaries, banks, share registries, superannuation funds, government agencies, NSW Land Registry Services and the courts;
• your accountant, financial adviser or other professional advisers, with your permission;
• barristers, other lawyers (including lawyers in other states or countries) and experts we engage for your matter, with your permission;
• medical practitioners, if you ask us to arrange a capacity assessment;
• our professional indemnity insurer, our auditors and our trust account external examiner; and
• contracted service providers who help us run our practice, such as our practice management software, IT and cloud services, InfoTrack (for identity verification and screening), bookkeeping, Mailchimp (for email newsletters) and website providers (see “Can your Personal Information be accessed offshore?” below).

We take reasonable steps to make sure our service providers protect your Personal Information and do not use or disclose it for any other purpose, except as required by law.

Legal requirements

We may use or disclose your Personal Information in circumstances where required by law and/or expressly permitted by the Privacy Act, including if:

• it is not reasonable or practical to obtain consent and we reasonably believe use or disclosure is necessary to lessen or prevent a serious threat to life, health, or safety of any individual or public health and safety;
• we have reason to suspect that unlawful activity or misconduct of a serious nature that relates to our activities or functions is being or has been engaged in, and we believe the collection, use or disclosure is necessary to take appropriate action in relation to the matter;
• we reasonably believe that the collection, use or disclosure is reasonably necessary to assist with the location of a person reported missing; or
• we are compelled by law including:
  • by warrant or subpoena;
  • where we are required by request under statute or lawful order of a government agency or authority including law enforcement, courts and tribunals and regulators; and/or
  • to AUSTRAC and other government agencies without your knowledge or consent, including where we form a suspicion about a matter or transaction under the AML/CTF Framework.

Nothing in this Privacy Policy limits our obligations of confidentiality or client legal privilege. However, there may be circumstances where we are compelled to disclose confidential information to AUSTRAC under the AML/CTF Framework.

We are prohibited from notifying you of disclosures to AUSTRAC and may be prohibited from notifying you of disclosures to other government agencies or authorities.

Business transactions

If we are involved in a merger, acquisition or asset sale, your Personal Information may be disclosed in confidence as part of a due diligence process and may be transferred to the new owner. We will provide notice before your Personal Information is transferred and becomes subject to a different Privacy Policy.

Our website, cookies and analytics

When you visit our website, copelandlegal.com.au, small files called cookies (and similar tools) may be stored on your device. We use:

• Google Analytics, to understand how many people visit our website and how they use it; and
• the Meta Pixel, to measure how well our Facebook and Instagram advertising works, and to show our ads to people who have visited our website.

These tools may collect online identifiers, such as your IP address and device information. This information is sent to Google and Meta and may be processed overseas, including in the United States. Google and Meta handle it under their own privacy policies.

You can block or delete cookies in your browser settings. You can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on, and you can change how Meta uses your information for ads in your Facebook or Instagram ad settings. If you block cookies, parts of our website may not work properly.

Our website is hosted by GoDaddy. It may contain links to other websites. We are not responsible for the privacy practices of those websites.

Marketing and newsletters

We may send you newsletters, legal updates and invitations to our talks and events. We do this in line with the Spam Act 2003 (Cth) and the Privacy Act.

You can opt out at any time by clicking the “unsubscribe” link at the bottom of any marketing email, or by contacting our Privacy Officer. We do not sell your Personal Information.

Artificial intelligence and automated decisions

We may use artificial intelligence (AI) tools to help us draft and review documents and correspondence. A solicitor checks all AI output. All legal advice and decisions about your matter are made by a person.

We set up our AI tools so that your Personal Information is not used to train the provider’s AI models.

We use computer programs to help us verify your identity and to check whether you, or anyone connected with your matter, is a politically exposed person or subject to sanctions. These programs use information such as your name, date of birth, address and identity document details. The results help us decide whether we can act for you, and what level of customer due diligence we need to carry out. A solicitor always reviews the results and makes the final decision. We do not make decisions about you using a fully automated process.

How do we protect your information?

We hold Personal Information mainly in electronic form, and sometimes in hard copy (for example, original Wills and signed documents). We take reasonable steps to protect it from misuse, interference and loss, and from unauthorised access, change or disclosure. These steps include:

• secure, cloud-based practice management and document storage systems;
• two-step login (multi-factor authentication) on our systems;
• encryption on our devices;
• limiting access to Personal Information to staff who need it for their work;
• keeping any original documents we hold for you in secure safe custody; and
• training our staff about their privacy and confidentiality duties.

Where a data breach is likely to result in serious harm, we will comply with the Notifiable Data Breaches scheme in the Privacy Act, including notifying the OAIC and affected individuals, as required. We have a data breach response plan to help us act quickly.

How long we keep your information

We keep Personal Information only for as long as we need it for a lawful purpose, or as the law or a court order requires. In particular:

• we keep KYC Information and AML/CTF records for seven years after our business relationship with you ends, or after the transaction is completed, as required by the AML/CTF Framework;
• we keep client files for as long as we need them to meet our legal and professional obligations; and
• if we hold your original Will, Power of Attorney or other documents in safe custody, we keep them until you collect them, ask us to send them to someone else, or they are needed after your death.

When we no longer need Personal Information, we take reasonable steps to destroy or de-identify it.

Can your Personal Information be accessed offshore?

We are based in Australia and keep your Personal Information in Australia where we can. However, some service providers we use store or process information overseas, or have staff overseas who may access it to provide their services. These include:

• Smokeball (practice management software): servers and group companies in Australia, the United Kingdom and the United States, with some service providers in Japan;
• Microsoft 365, including Outlook and Teams: our core email, file and Teams data is stored in Australia, but some services may process information overseas, including in the United States;
• InfoTrack (searches, identity verification, and politically exposed person and sanctions screening): stores information in Australia, but its software developers in Vietnam may have read-only access;
• Google (Google Forms and Google Analytics): may process information in the United States and other countries where Google operates;
• Meta (Meta Pixel and Facebook): may process information in the United States and other countries;
• GoDaddy (website hosting): may process information in the United States;
• Mailchimp (email newsletters): stores information in the United States, and some of its service providers are in other countries; and
• Anthropic (Claude AI tools): processes information in the United States.

Some of these providers also use other companies located overseas. Their privacy policies give more detail.

We do not otherwise send your Personal Information overseas, unless you ask us to (for example, to a lawyer in another country about assets you own there) or the law requires or allows it.

We take reasonable steps to ensure overseas recipients do not breach the APPs.

How you can access and correct your Personal Information

We will respond to inquiries from an individual regarding whether we hold any Personal Information relating to that individual and will allow access to and correction of any such Personal Information subject to our contractual arrangements where Personal Information is held by a third party, and the conditions and limitations set out in the Privacy Act, including:

• if we reasonably believe that giving access would pose a serious threat to the life, health or safety of any individual, or to public health or public safety;
• giving access would have an unreasonable impact on the privacy of other individuals;
• the request for access is frivolous or vexatious;
• the information relates to existing or anticipated legal proceedings between the organisation and the individual, and would not be accessible by the process of discovery in those proceedings;
• giving access would reveal the intentions of the organisation in relation to negotiations with the individual in such a way as to prejudice those negotiations;
• giving access would be unlawful;
• denying access is required or authorised by or under an Australian law or a court/tribunal order;
• the organisation has reason to suspect that unlawful activity, or misconduct of a serious nature, that relates to the organisation’s functions or activities has been, is being or may be engaged in and giving access would be likely to prejudice the taking of appropriate action in relation to the matter;
• giving access would be likely to prejudice one or more enforcement related activities conducted by, or on behalf of, an enforcement body; or
• giving access would reveal evaluative information generated within the organisation in connection with a commercially sensitive decision‑making process.

If giving you access would break the law, for example the “tipping off” offence in section 123 of the AML/CTF Act, we will not give you access, and we may not be able to tell you why.

If you believe that the Personal Information we, or our contracted third party, hold about you is inaccurate, out-of-date, incomplete, irrelevant, or misleading, you may request that we correct it by contacting our Privacy Officer. We may ask you to verify your identity before giving you access or making corrections, and we may charge a reasonable fee for providing access (but not for making a correction).

You can contact our Privacy Officer by email at [email protected] (please mark it “Privacy query”), by phone on 1300 034 487, or by post at PO Box 160, Bonville NSW 2450.

We will take reasonable steps to correct your information to ensure it is accurate, complete, and up-to-date within a reasonable period (usually within 30 days) of receiving your request.

How you can complain about our information handling practices

All privacy-related inquiries and complaints are handled by our Privacy Officer. If you have any concerns regarding our management of your Personal Information, or if you believe we have breached the APP/s, please contact our Privacy Officer in writing setting out the details of your complaint.

We are committed to achieving a fair and equitable resolution of any privacy concerns. When you lodge a complaint, we will follow this internal review process:

1. We will acknowledge receipt of your written complaint within a reasonable time (usually within seven days).
2. Our Privacy Officer will conduct an internal investigation into your complaint. This will involve reviewing the circumstances of the collection, use, or disclosure of your information and assessing our compliance with our internal procedures and the Privacy Act. We may contact you to request further information to assist with our investigation.
3. We will endeavour to complete our investigation and provide you with a written response outlining the outcome of our review, our decision, and any corrective actions we propose to take within 30 days of receiving your complaint.

If you are not satisfied with our response, or if we do not resolve your complaint within 30 days, you are entitled to escalate your complaint by lodging a complaint with the Office of the Australian Information Commissioner (OAIC) online on the OAIC website

If you require a copy of this Privacy Policy in a particular form (e.g. large print, accessible PDF) please contact our Privacy Officer.

Changes to this policy

We may update this policy from time to time. The current version is always available on our website, and we will give you a copy free of charge if you ask.