Privacy Policy

1. About this policy

1.1 This policy explains how Digital Law Lab Pty Ltd ABN 27 699 222 716 (DLL) collects, holds, uses and discloses personal information.

1.2 It applies to personal information DLL handles through its website at https://digitallawlab.com.au, its Legal Tech Drop-in sessions, its training workshops and its advisory services, and in its other dealings with clients, prospective clients and members of the public.

1.3 DLL may currently be exempt from the Privacy Act 1988 (Cth) (Privacy Act) as a small business. Even so, DLL aims to handle personal information in accordance with the Australian Privacy Principles in the Privacy Act (APPs), and this policy describes how it does so.

1.4 In this policy, personal information has the meaning given in the Privacy Act.

2. What personal information DLL collects

2.1 DLL collects only the personal information it needs for its services and business. Depending on how an individual deals with DLL, this may include:

• (a) contact details, such as name, email address, phone number, and the firm or organisation the individual works for;
• (b) enquiries, being anything an individual tells DLL in the website contact form, by email, by phone or through social media;
• (c) booking details for a Legal Tech Drop-in session, such as the session time, and the answers given to the booking questions (including what the individual would like help with);
• (d) payment and billing details, such as amounts paid, the date of payment, and the last four digits and type of a payment card. DLL does not receive or store full card numbers;
• (e) training details, such as the names and email addresses of workshop attendees provided by a client, the training accounts set up for them, and attendance records; and
• (f) technical information about visits to DLL’s website, such as IP address, browser type and the pages requested, which DLL’s website host records automatically.

2.2 DLL does not ask for sensitive information (such as health information) and asks individuals not to provide it. If DLL receives sensitive information it has not asked for, DLL will delete it unless it is needed and the individual consents.

3. How DLL collects personal information

3.1 DLL collects personal information directly from the individual wherever practicable, for example when the individual:

• (a) completes the contact form on DLL’s website;
• (b) books and pays for a Legal Tech Drop-in session;
• (c) emails, phones or messages DLL, or meets DLL in person; or
• (d) engages DLL for training or advisory services.

3.2 DLL also collects personal information from third parties where that is reasonable, for example when a client provides a list of workshop attendees, or when someone refers an individual to DLL. Where DLL collects personal information about an individual from someone else, DLL relies on that person to tell the individual about this policy.

3.3 Individuals may deal with DLL anonymously or under a pseudonym when making a general enquiry. DLL cannot take a booking, accept a payment or provide its services anonymously.

4. Information seen during Legal Tech Drop-in sessions

4.1 During a Legal Tech Drop-in session, DLL may see information on a practitioner’s devices or accounts, including information about the practitioner’s own clients. DLL does not collect or keep that information. Such information is dealt with under clause 10 of the Legal Tech Drop-in Terms and Conditions, which provide that DLL views it only as far as necessary, keeps it confidential, and does not copy, record or retain it.

4.2 Practitioners should not include information about their own clients in the booking form or in messages to DLL.

5. How DLL uses personal information

5.1 DLL uses personal information to:

• (a) respond to enquiries;
• (b) take and manage bookings, and provide its sessions, workshops and advisory services;
• (c) set up and remove training accounts for workshop attendees;
• (d) issue tax invoices, take payments and keep financial records;
• (e) run, maintain and secure its website and systems;
• (f) tell clients and contacts about DLL’s services, as described in clause 7; and
• (g) meet its legal obligations, including tax and record-keeping obligations.

5.2 DLL does not sell personal information, and does not use or disclose it for any other purpose unless the individual consents or the use or disclosure is required or authorised by law.

6. Who DLL discloses personal information to

6.1 DLL uses reputable third-party service providers to run its business. They hold or process personal information on DLL’s behalf, and only for the purpose of providing their services to DLL. They include:

Purpose	Provider	Where information is held or processed
Website hosting, and processing contact form submissions	Vercel	United States and other countries
Sending contact form submissions to DLL by email	Amazon Web Services (Amazon SES)	Australia
Email	DLL’s own mail server, hosted by BinaryLane	Australia
Booking Legal Tech Drop-in sessions	Cal.com	United States
Card payments	Stripe	Australia, the United States and other countries
Invoicing and accounting	Xero	United States and other countries
Training accounts for workshops	Microsoft (Microsoft 365)	Australia and other countries
AI tools that help DLL with administration, drafting and reviewing documents	Anthropic, Microsoft	United States and other countries

6.2 DLL only uses providers whose terms require them to keep information confidential and secure. DLL does not use AI tools that are allowed to use the information it gives them to train their models. A person at DLL reviews all AI-assisted work, and AI tools do not make decisions about individuals.

6.3 DLL may also disclose personal information to its professional advisers (such as its accountant, lawyers and insurers), or where the disclosure is required or authorised by law.

7. Direct marketing

7.1 DLL may send clients and contacts information about its services, workshops and events, where the individual would reasonably expect it or has agreed to receive it.

7.2 Individuals can ask DLL to stop sending marketing at any time, by using the unsubscribe option in the message or by emailing DLL. DLL will act on the request promptly and at no cost.

8. Cookies and website analytics

8.1 DLL’s website does not set cookies, and does not currently use analytics or tracking tools.

8.2 The booking and payment pages, which are provided by Cal.com and Stripe, and websites DLL links to (such as LinkedIn and GitHub), have their own privacy policies and may set their own cookies. DLL is not responsible for those websites.

9. Holding and securing personal information

9.1 DLL holds personal information electronically, in its email, document storage and business systems and with the providers listed in clause 6.1.

9.2 DLL takes reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification and disclosure. These steps include multi-factor authentication, encryption, restricted access, keeping systems up to date, and security monitoring.

9.3 DLL keeps personal information only for as long as it needs it, then deletes or de-identifies it. In particular:

• (a) booking, payment and invoicing records are kept for at least five years, to meet tax record-keeping requirements;
• (b) workshop training accounts, and their contents, are deleted after the workshop; and
• (c) enquiries that do not lead to an engagement are generally deleted within two years of DLL’s last contact with the individual.

9.4 If DLL becomes aware of a data breach that is likely to result in serious harm to an individual, DLL will notify the affected individuals and, where appropriate, the Office of the Australian Information Commissioner (OAIC), in line with the Notifiable Data Breaches scheme.

10. Access and correction

10.1 An individual may ask DLL for access to the personal information DLL holds about them, or ask DLL to correct it, by contacting DLL under clause 12.

10.2 DLL will respond within 30 days. DLL will not charge for a request, but may ask the individual to verify their identity first. If DLL refuses a request, it will explain why in writing, as far as it reasonably can.

11. Complaints

11.1 An individual who believes DLL has mishandled their personal information may complain to DLL in writing under clause 12. DLL will acknowledge the complaint within seven days and aim to resolve it within 30 days.

11.2 If the individual is not satisfied with DLL’s response, they may be able to complain to the OAIC (https://www.oaic.gov.au, 1300 363 992).

12. Contact

12.1 Questions, requests and complaints about privacy should be sent to:

Privacy Officer
Digital Law Lab Pty Ltd
Suite 701, Level 7, Shell House, 170 North Terrace, Adelaide SA 5000
admin@digitallawlab.com.au

13. Changes to this policy

13.1 DLL may update this policy from time to time. The current version is published at https://digitallawlab.com.au/privacy, and shows its version number and the date it took effect.