Privacy policy

What we collect

We collect personal information reasonably needed for our work. This may include names, contact details, professional roles, correspondence, billing details, training participation, and information in project documents, interviews, and review findings.

We usually collect information directly from you through email, meetings, and our work together. We may also receive relevant information from clients, other participants, and publicly available professional sources.

We will only seek sensitive information where reasonably necessary, with consent unless the law permits otherwise. Please avoid sending personal information that is unnecessary for the work.

You may make a general enquiry without identifying yourself, although we may need your details to respond or provide services.

How we use and share information

We use personal information to respond to enquiries, prepare proposals, deliver advice, reviews, and training, administer engagements and invoices, maintain records, and meet legal obligations.

We may share relevant information with commissioning clients, people engaged to assist our work, IT and business service providers, professional advisers, and authorities where required or authorised by law. We will limit sharing to what is reasonably needed for the purpose.

For interviews and reviews, we will explain how contributions will be used and reported, including any agreed confidentiality arrangements.

Plain Governance, Plain Strategy, and Plain Risk tools

This policy covers our browser-based tools at PlainGovernance.com, PlainStrategy.com.au, and PlainRisk.com.au. In their current versions, these tools process your case entries, locally opened work files, and generated reports or other outputs in your browser. The tools do not transmit that content to The Governance Practice or store it on our servers.

Plain Governance temporarily saves work in browser-tab session storage so it can remain available when you reload that tab. Plain Strategy and Plain Risk hold working entries in browser memory while the tool is open. Their work is not automatically saved to an account or an online case record. Save a local file, or print or save a report where the tool offers those options, if you want to keep a copy.

You control the files you save and any printed copies. To remove temporary work, use the tool’s reset or clear control where available and close the relevant tabs. You can also clear the site’s stored data in your browser settings. Browser session restoration may retain or restore some work, so closing a tab is not a guarantee of permanent deletion. Browser extensions, device backups, synchronisation, printing services, and other software you use are outside the tools’ control.

Our policy is to keep tool content in your browser and not collect it through these tools. No optional usage analytics are currently installed on these sites. If we introduce usage analytics, we will update this policy before doing so and limit them to action counts, such as how often a tool is opened or a save button is used. We will not collect field contents, case details, reports, or session recordings through analytics.

If you choose to email us a case, report, work file, or other material for an enquiry or consultancy engagement, we receive that information because you sent it to us. The collection, use, sharing, security, and retention provisions elsewhere in this policy then apply. Using a tool does not automatically submit its contents as an enquiry.

Website visits and technical information

Enquiries are made by email. Hosting and security providers process technical information, such as IP addresses, requested page addresses, and request details, to deliver and protect our websites. This technical processing is separate from the browser-based handling of case entries described above.

Search terms on Plain Risk can appear in the page address (URL), so they may be included in technical request information and browser history. Do not put confidential case details or unnecessary personal information into site searches.

Storage and overseas providers

We hold information in correspondence, project files, and business records. Our business systems include Microsoft 365 and MYOB. Our website is hosted through OpenAI Sites using Cloudflare infrastructure.

Providers may store, process, or access information overseas. MYOB identifies New Zealand, the Philippines, and the United States. Microsoft publishes worldwide remote-access locations, including India, Ireland, Singapore, the United Kingdom, and the United States. Cloudflare reports primary storage in the United States and European Economic Area, with global access and transfers. Locations depend on the service and support arrangements.

Further details are available in Microsoft’s remote-access country list, MYOB’s privacy policy, and Cloudflare’s privacy policy.

We will consider providers’ privacy arrangements and take reasonable steps to protect personal information and meet applicable legal requirements.

Security and retention

We will take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification, or disclosure.

We will retain information only as long as reasonably needed for the purposes described here or legal obligations, then take reasonable steps to securely destroy or de-identify it.

Access, correction, and complaints

To request access to or correction of your personal information, or raise a privacy concern, contact julien@thegovernancepractice.com.au.

We may verify your identity. We will respond within a reasonable time and explain any refusal, subject to legal restrictions.

For a complaint, please describe the issue and outcome you are seeking. We will acknowledge it, investigate, and respond, keeping you informed if more time is needed.

If unresolved, the Office of the Australian Information Commissioner can advise whether it can consider your complaint.

Changes

We will update this policy when our practices change and publish the current version on our website.