About this Privacy Policy
Cream Legal Pty Ltd (Cream Legal, we, us or our) is an Australian legal practice. This Privacy Policy explains how Cream Legal collects, holds, uses and discloses personal information, and how you may request access or correction or make a privacy complaint.
Certain personal information handled by Cream Legal is subject to the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), including information handled in connection with Cream Legal's obligations under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth). Cream Legal has chosen to apply the standards reflected in the APPs to personal information across its practice, whether or not the Privacy Act applies to a particular activity.
This Privacy Policy does not limit Cream Legal's separate professional obligations concerning confidentiality or legal professional privilege.
Who this policy covers
This policy applies to personal information Cream Legal handles about:
- clients and prospective clients;
- directors, trustees, beneficial owners, authorised representatives and other people connected with a client or matter;
- counterparties, witnesses, professional advisers, referrers and other people encountered while providing legal services;
- suppliers, contractors, job applicants and other business contacts; and
- people who visit the Cream Legal website or submit an enquiry.
Personal and sensitive information
Personal information is information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether or not the information is true or recorded in a material form.
Sensitive information is a category of personal information that includes information about matters such as health, racial or ethnic origin, political opinions or associations, religious beliefs, sexual orientation, criminal records and certain biometric information. Cream Legal collects sensitive information only where it is reasonably necessary and with consent, or where collection is otherwise permitted or required by law.
Information Cream Legal may collect
The information collected will depend on the person, the matter and the services requested. It may include:
- identity and contact details, including a person's name, date and place of birth, residential or postal address, email address and telephone number;
- business and professional information, including occupation, role, qualifications, employer and the capacity in which a person is acting;
- records of enquiries, correspondence, telephone calls, video meetings, instructions and other communications;
- information relevant to legal services, including commercial, corporate, trust, property, estate-planning, financial, taxation and transaction information;
- information contained in contracts, certificates, searches, registers, identification documents and other records supplied to or obtained by Cream Legal;
- government-issued identifiers and identity-document details where necessary, such as driver's licence, passport, company, trust or taxation information;
- billing, payment and account information;
- information required for conflict checks, risk management, insurance, regulatory compliance and complaints;
- technical information generated when the website is used, such as IP address, browser and device information, request times, pages accessed and security events; and
- information concerning suppliers, contractors or prospective personnel where relevant to the business relationship.
AML/CTF and identity information
From 1 July 2026, certain legal services are designated services under Australia's anti-money laundering and counter-terrorism financing regime. Where the regime applies, Cream Legal may be required to undertake customer due diligence and related checks. The information required will depend on the service, the client and the circumstances.
This may include:
- identity information and evidence used to verify identity;
- information about a company, trust or other entity and the individuals who ultimately own or control it;
- information about authorised representatives and the authority under which they act;
- the nature, purpose and circumstances of a transaction or business relationship;
- politically exposed person and sanctions-screening information;
- information concerning source of funds or source of wealth where required; and
- additional information required to assess and manage money-laundering, terrorism-financing or proliferation-financing risk.
Cream Legal may use an external provider to verify identity or conduct sanctions and other compliance checks. Depending on the method used, the provider may process an image of an identity document, a photograph or limited biometric information for facial matching or liveness verification.
Cream Legal will seek to collect only the information reasonably necessary in the circumstances. Cream Legal will generally request sufficient information to confirm a client's identity. Additional information required specifically for AML/CTF purposes will only be requested where the regime applies or the circumstances otherwise require it.
How information is collected
Cream Legal generally collects personal information directly from the individual, including when the individual:
- submits a website enquiry;
- communicates by email, telephone, video conference, post or in person;
- asks Cream Legal to provide legal services;
- supplies instructions, documents or identification information; or
- makes a payment or otherwise deals with Cream Legal.
The website enquiry form requests a name, email address, an optional telephone number and a short description of the enquiry. It does not accept file attachments. People should not submit identity documents or confidential or highly sensitive information through the general enquiry form.
Cream Legal may also collect information from third parties or public sources, including:
- a client, prospective client, authorised representative or another person connected with a matter;
- another lawyer, accountant, broker, financial adviser, lender, bank or other professional adviser;
- a counterparty or the counterparty's adviser;
- courts, tribunals, regulators, law-enforcement bodies and government agencies;
- ASIC, Land Services Victoria and other public registers, databases and search providers; and
- identity-verification, AML/CTF, fraud-prevention or other service providers.
If Cream Legal receives personal information that it did not request, it will consider whether the information could lawfully have been collected. If not, Cream Legal will take reasonable steps to destroy or de-identify it where lawful and practicable.
Anonymity and pseudonyms
People may browse the Cream Legal website without identifying themselves. Cream Legal will generally need to know a client's identity before providing legal services, including to conduct conflict checks and meet its legal and professional obligations.
Why information is collected, held and used
Cream Legal may collect, hold and use personal information to:
- respond to enquiries and communicate with clients, prospective clients and other people;
- conduct conflict checks, assess whether Cream Legal can act and establish the solicitor-client relationship;
- obtain instructions and provide legal services;
- prepare, review, negotiate, sign, lodge, register or complete documents and transactions;
- verify identity and authority and comply with AML/CTF, professional and other legal obligations;
- manage billing, payments, accounting, taxation and business administration;
- manage professional indemnity insurance, complaints, legal claims, quality, security and risk;
- operate, protect and improve the website and Cream Legal's systems;
- engage and manage suppliers, contractors and professional advisers; and
- send legal updates or other communications where the recipient has consented or this is otherwise permitted by law.
If requested information is not provided, Cream Legal may be unable to assess an enquiry, accept or continue an engagement, provide a requested service, complete a transaction or satisfy its legal and professional obligations.
When information may be disclosed
Subject to professional confidentiality and legal professional privilege, Cream Legal may disclose personal information where reasonably necessary for the purposes described in this policy, including to:
- the individual's authorised representatives and professional advisers;
- barristers, experts, consultants, agents, search providers and other professionals engaged in connection with a matter;
- counterparties, their advisers and other participants in a transaction or proceeding;
- courts, tribunals, PEXA, Land Services Victoria, ASIC, government agencies and regulatory bodies;
- banks, lenders, payment providers, insurers, auditors and accounting providers;
- identity-verification, electronic-signing, AML/CTF, sanctions-screening and fraud-prevention providers;
- technology and cloud service providers supporting hosting, email, cybersecurity, document storage and processing, legal research, communications, administration and delivery of legal services;
- Cream Legal's professional indemnity insurer, legal advisers and regulatory authorities;
- AUSTRAC, law-enforcement bodies or other authorities where disclosure is authorised or required by law; and
- another person or organisation where the individual has consented or the disclosure is otherwise permitted or required by law.
Cream Legal remains responsible for its legal work and applies professional judgement to the final work product. Service providers are given access only as reasonably necessary for their functions, subject to appropriate contractual, confidentiality, privacy and security arrangements where practicable.
Cream Legal does not sell or rent personal information to third parties.
Website, cookies and technical information
The Cream Legal website is supported by third-party hosting and security providers. Those providers may process technical information needed to deliver and protect the website, such as IP addresses, browser and device information, network requests and security events.
At the date of this policy, Cream Legal does not use optional advertising trackers or behavioural analytics on the website. The website may use strictly necessary cookies or similar technologies for security, network operation, spam prevention and form protection. Browser settings can usually be used to control cookies, although disabling necessary technologies may affect website functionality.
The website may contain links to third-party websites. Cream Legal is not responsible for the privacy practices of those websites, and their own privacy policies will apply.
Direct marketing
Cream Legal may occasionally send legal updates, invitations or information about its services where the recipient has consented or this is otherwise permitted by law. A recipient may opt out at any time by using an unsubscribe facility or contacting hello@cream.legal. Service communications concerning an enquiry, engagement or legal matter are not marketing communications.
Overseas storage, processing and access
Cream Legal operates primarily through electronic records and uses third-party technology, cloud, identity-verification, electronic-signing and professional service providers. Personal information may be stored or processed using those providers' systems.
Personal information may be stored in Australia while also being processed or accessed from overseas. Depending on the provider and service used, overseas recipients or subprocessors may be located in the United States, United Kingdom, Canada, India, Japan, Singapore or countries within the European Economic Area. Provider locations and arrangements may change over time.
Security
Cream Legal takes reasonable technical, organisational and physical steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. Measures may include access controls, multi-factor authentication, encryption and security features offered by service providers, endpoint and threat protection, secure disposal practices and limiting access to those who need it.
Cream Legal operates primarily through electronic records but may hold limited physical records where necessary. Physical records are stored and disposed of using reasonable security measures.
No internet transmission or storage system can be guaranteed to be completely secure. Cream Legal maintains processes for responding to suspected data incidents and will make notifications where required by law.
Retention and destruction
Cream Legal retains personal information for as long as reasonably necessary for the purpose for which it was collected and to satisfy legal, professional, taxation, insurance, risk-management and regulatory obligations.
Client matter files are generally retained for at least seven years after the engagement is completed or terminated, subject to client instructions and any legal or professional obligation requiring a different period. Certain records may be kept longer because of the nature of the document, matter or potential claim.
Customer due diligence records are generally retained for seven years after the relevant business relationship ends or, for a one-off designated service, after the transaction is completed. Transaction records are generally retained for seven years after the transaction is completed. AML/CTF program records are retained for seven years after they cease to be relevant to demonstrating compliance. Cream Legal may retain a record of an identity-verification process without retaining a complete copy of the identity document. Copies of full identity documents will be destroyed or de-identified when no longer reasonably necessary, unless another lawful reason requires or permits them to be retained.
Information concerning unsuccessful or preliminary enquiries is retained only for a reasonable period, although limited information may be retained for conflict checking, complaint handling, security or risk management. When information is no longer required, Cream Legal takes reasonable steps to destroy it securely or de-identify it.
Access and correction
A person may request access to personal information Cream Legal holds about them or ask for it to be corrected. Cream Legal may need to verify the person's identity before responding. Requests should be directed to the Privacy Officer using the details below.
There is no charge for making an access or correction request. Cream Legal does not ordinarily charge for providing access, but may charge a reasonable, non-excessive amount for the cost of providing access where permitted by law. Any proposed charge will be explained beforehand. There is no charge for correction.
In some circumstances, access or correction may be refused or limited, including where providing access would unreasonably affect another person's privacy, reveal privileged or confidential information, prejudice legal proceedings or be otherwise permitted or required by law. Where appropriate, Cream Legal will explain the reason.
Privacy enquiries and complaints
Questions, requests and complaints concerning personal information should be sent to the Privacy Officer. A complaint should briefly describe the concern and include enough information for Cream Legal to investigate it.
Cream Legal will acknowledge and investigate a privacy complaint within a reasonable period and will ordinarily aim to provide a substantive response within 30 days. More complex matters may take longer, in which case Cream Legal will provide an update where practicable.
If the person is not satisfied with Cream Legal's response, they may complain to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or by telephone on 1300 363 992.
Privacy Officer
Privacy Officer
Cream Legal
PO Box 2927
Seaford VIC 3198
Email: hello@cream.legal
Changes to this policy
Cream Legal may update this Privacy Policy to reflect changes in law, technology, service providers or business practices. The current version will be published on the Cream Legal website and will display its last-updated date.