This Privacy Policy sets out how EN—SEMBLELaw (Isabella Royce ABN 90 491 815 365) (“we”, “us”, or “our”) collects, uses, holdsand discloses your personal information when you engage us, visit our website, applyto work with us, or interact with us in any way.
If you give us personal information, we willhandle it in accordance with this Policy and you agree to its terms. We mayupdate this Policy from time to time — the date at the end tells you when itlast changed.
If you ever have questions or concerns aboutyour privacy, please contact us using the details at the end of this policy.
We are committed to protecting your privacyand handling your personal information with care. We comply with the PrivacyAct 1988 (Cth) and the Australian Privacy Principles (APPs), which set outhow personal information must be collected, used, stored and disclosed. We alsofollow the Notifiable Data Breaches scheme.
Our professional duties — including our dutyof confidentiality and the protection of legal professional privilege — sitalongside this Policy. Where they are stricter, they prevail. Nothing in thisPolicy allows us to disclose privileged or confidential client information.
You can make a general enquiry withouttelling us who you are. Once we act for you, we need to know who you are — tocheck for conflicts of interest, to verify your identity, and to meet ourprofessional and legal obligations.
In this Privacy Policy, “personalinformation” means any information or opinion that identifies you or couldreasonably identify you. This includes things like your name, contact details,date of birth, financial or employment information, details about your legalmatter, identification documents, and any other information that is reasonablylinked to you. It also includes “sensitive information”, such as healthinformation or information about your background or personal circumstances,which we only collect where necessary and permitted by law.
The types of personal information we maycollect include:
—Your name and contact details(address, phone number, email)
—Date of birth or identificationdetails where needed for your matter
—Information about your legal issue orcircumstances
—Financial, business or employmentinformation relevant to your matter
—Information we need to verify youridentity (e.g., driver licence or passport details)
—Payment information (not stored by usif you pay via third-party platforms)
—Communications between you and us(emails, letters, file notes, and notes or transcripts of meetings where youhave agreed to them)
—Information about third parties thatyou give us in the course of your matter
—Information about your source of funds andsource of wealth
—The results of the identity, sanctions,politically exposed person and adverse media checks we carry out, and the riskassessment we record for your matter
—Website usage information such asyour IP address or browser type
Because we provide legal services, we mayalso handle sensitive information, such as health information orinformation about a person’s background or personal relationships. We onlycollect this information where it is directly relevant to your legal matter andwhere you consent or the law allows us to collect it.
We do not intentionally collect personalinformation of individuals under 18 unless it is necessary for a legal matter.In those cases, we will assess whether the young person can give informedconsent or seek consent from a parent or guardian.
We may collect personal information inseveral ways, including when you:
—Contact us by phone, email or via ourwebsite
—Engage us to provide legal services
—Complete forms or provide documentsduring your matter
—Communicate with us on social media(including LinkedIn and Instagram)
—Use our website — if you contact usthrough the form on our website, the details you enter are sent to our email.Our website host may record basic technical information, such as your IPaddress, for security and performance purposes
—We may also receive information fromthird parties where relevant to your matter, including other law firms;government agencies; accountants; financial advisers or other professionaladvisers; opposing parties or representatives; courts, tribunals, or regulators;and publicly available sources.
We record, transcribe or take automated notesof a meeting only where we have told you beforehand and you have agreed. Wherewe do, we use the notetaking features built into the video conferencingplatform we use.
We collect and use your personal informationto:
—Provide legal advice and services toyou
—Communicate with you about yourmatter
—Check for conflicts of interest andverify your identity
—Manage and administer our practice(including billing)
—Comply with legal and professionalobligations
—Improve our website, services andclient experience
—Send you updates or insights (you mayunsubscribe at any time)
—Assess employment applications, ifapplicable
If you choose not to provide certaininformation, we may not be able to act for you or provide the level of serviceyou require.
We use technology, including artificialintelligence (AI) tools, to help us work well. We use it deliberately, withinlimits we set ourselves, and never as a substitute for legal judgement.
Where we use AI, it assists with tasks suchas:
—Drafting, formatting and proofreadingdocuments
—Legal and background research
—Reviewing, comparing and summarisingdocuments and correspondence
—Transcribing or taking notes ofmeetings, where you have agreed to it
—Administrative work such asscheduling, correspondence and file management
These are the commitments we make about it:
* A lawyer is always responsible: AI doesnot advise you and does not decide anything about your matter. Every piece ofadvice and every document we deliver is prepared, reviewed and settled by alawyer.
* Your information is not used to train AImodels: We use AI tools under business terms that exclude the informationwe put in, and the material they produce, from being used to train or improveany third-party AI model.
* Your information is not made public: Wedo not publish client information, use it in our marketing, or otherwise makeit publicly available, unless you have asked us to or agreed.
* We limit what goes in: We input only whatis necessary, and remove identifying details where we reasonably can. We takeparticular care with sensitive information and with anything confidential orprivileged.
* We choose our tools carefully: Beforeusing an AI tool in client work, we consider its security, confidentiality,data retention and data location terms. The AI tools we use process informationoutside Australia — see Overseas disclosure below.
We do not use computer programs — includingAI — to make decisions about you, or to do anything substantially and directlyrelated to making a decision about you, where that decision could reasonably beexpected to significantly affect your rights or interests. Decisions in yourmatter are made by a person.
If that ever changes, we will update thisPolicy to set out the kinds of personal information used and the kinds ofdecisions involved, as the Privacy Act requires.
As a normal part of providing legal services,we may share your personal information with trusted third parties, including:
—Barristers, mediators or expertsengaged for your matter
—Courts, tribunals, government bodiesor regulators
—Other parties involved in your matterand their legal representatives
—Professional advisers such asaccountants or financial specialists
—Document management services, ITproviders, AI tools and secure cloud-storage platforms
—External service providers thatassist us with administration or compliance
We ensure that third parties only receive theinformation they need and that they handle it securely and in accordance withapplicable privacy laws.
We do not sell your personal information orallow third parties to use it for their own marketing.
Some of our technology or storage providers arelocated outside Australia. In general:
—The documents and files we hold foryou are stored at rest in Australia
—Our email is provided by a globalprovider, and may be stored or processed in the United States and in othercountries in which that provider operates
—Where we use AI tools, requests maybe processed in the United States, Europe, Asia or Australia, and theassociated data is stored in the United States
If personal information is transferredoverseas, we take reasonable steps to ensure that the recipient will handle itin a manner consistent with Australian privacy law.
If your specific legal matter requiresoverseas disclosure, we will discuss this with you where appropriate.
Some legal work is a “designated service”under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006(Cth) — for example, work involving the buying or selling of a business orcompany, setting up or restructuring a company or trust, acting as (orarranging for someone to act as) a director, secretary, nominee shareholder ortrustee, or handling client money. Where we provide a designated service toyou, we are required to:
—Verify your identity and, whererelevant, the identity of the people who own or control you
—Collect information about yourbusiness structure, source of funds and the purpose of your matter
—Keep those records for at least sevenyears
—Report certain matters to AUSTRAC. Insome circumstances the law prevents us from telling you that a report has beenmade
If you do not provide the information we askfor, we cannot act for you on that matter.
We take reasonable steps to ensure yourpersonal information is secure and protected from misuse or unauthorisedaccess. Our information technology systems are password protected, and we use arange of administrative and technical measures to protect these systems.However, we cannot guarantee the security of your personal information.
If we suspect a data breach, we willinvestigate promptly and take steps to contain it. Where a breach is likely toresult in serious harm, we will notify the people affected and the Office ofthe Australian Information Commissioner, as the Notifiable Data Breaches schemerequires.
You may request access to the personalinformation we hold about you, or ask us to correct it if it’s inaccurate,incomplete or out of date.
To make a request, please contact us usingthe details below. We may ask you to verify your identity for your security. Inrare cases where we cannot provide access — for example where legalprofessional privilege, confidentiality or another person’s privacy is involved— we will explain why.
We aim to respond to all requests within areasonable timeframe.
As a law firm, we are required to retainclient records for a minimum period (usually 7 years after a matter iscompleted). After this time, we securely destroy or de-identify yourinformation unless the law requires us to keep it longer.
Information collected for employmentapplications is destroyed if your application is unsuccessful.
If you have concerns about how we havehandled your personal information, please contact us. We take all privacycomplaints seriously and will investigate promptly.
If you are not satisfied with our response,you can contact the Office of the Australian Information Commissioner (OAIC)at www.oaic.gov.au or 1300 363 992.
We are an Australian practice and this Policyis written around Australian law. Where the EU or UK General Data ProtectionRegulation applies to our handling of your personal data, we will handle itconsistently with those laws.
That includes your rights to ask us foraccess to your data and for it to be corrected, erased or restricted, to objectto how we use it, to ask for it in a portable form, and to withdraw consentwhere we have relied on it. Some of these rights are limited where we arerequired to keep records, or where confidentiality or legal professionalprivilege applies.
Where we transfer personal data outside theEuropean Economic Area or the United Kingdom, we do so under an adequacydecision or standard contractual clauses. You may also complain to your localdata protection supervisory authority.
For questions, requests or privacy concerns,please contact:
Email: hello@en-semble.com.au
Website: www.en-semble.com.au
Last updated: 1 October 2026