Somers & Blatt Lawyers

Privacy Policy

Legal services, website, client portals and mobile application

To delete your portal account and the data held only for it, use the account deletion page. You do not need the app installed.

Privacy contact

Peter Francis, General Counsel and Privacy Officer

privacy@blatt.com.au | 1300 733 911

At a glance. We collect only information reasonably necessary to provide legal services, operate and secure the Somers & Blatt Lawyers App and meet legal and professional obligations. We do not sell personal information, use advertising identifiers or engage in cross-app tracking. Client confidentiality and legal professional privilege remain separately protected.

Contents

1. About this Policy and who we are

Somersby & Finch Pty Ltd (ABN 88 672 863 197) trading as Somers & Blatt Lawyers (we, us, our) is committed to protecting personal information. This Privacy Policy explains how we collect, hold, use, disclose, secure, retain and delete personal information across our legal practice, website, client portals and the Somers & Blatt Lawyers App (App).

This Policy applies to clients, prospective clients, counterparties, witnesses, beneficiaries, executors, attorneys, directors, officers, beneficial owners, service providers, job applicants, website visitors and App users, and to other individuals whose information is handled in connection with our work.

This Policy does not create or reduce any duty of client confidentiality, legal professional privilege, fiduciary duty, duty to the court or other professional obligation. Those duties apply independently and may provide stronger protection than privacy law. Our terms of engagement and matter-specific collection notices may contain further information.

An employee record directly related to a current or former employment relationship may be outside the Privacy Act 1988 to the extent the employee records exemption applies. We nevertheless apply appropriate confidentiality and security controls and comply with applicable State and Territory health privacy laws.

2. Legal and professional framework

We manage personal information having regard to the following laws and professional obligations, as applicable:

• the Privacy Act 1988 (Cth), including the Australian Privacy Principles (APPs), and the Notifiable Data Breaches scheme;
• Part IIIA of the Privacy Act, the Privacy Regulation 2013 and the Privacy (Credit Reporting) Code 2025, if and to the extent we act as a credit provider or otherwise handle regulated credit information;
• State and Territory privacy and health-records laws, including the Health Records Act 2001 (Vic) and its Health Privacy Principles where applicable;
• the Spam Act 2003 (Cth), the Do Not Call Register Act 2006 (Cth) and related marketing rules;
• the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), its rules and AUSTRAC requirements where we provide designated services;
• the Legal Profession Uniform Law, the Australian Solicitors Conduct Rules and other professional conduct obligations; and
• the privacy, user-data, permission, account-deletion and store-disclosure requirements of Apple and Google for the App.

This Policy is our APP privacy policy. It is supplemented by concise notices presented when information is collected, including App permission notices, identity-verification notices, forms and engagement documents.

3. Key meanings

4. Personal information we collect

The information we collect depends on the person, matter, feature and legal obligation. It may include the following categories.

5. How we collect information

We collect information by lawful and fair means, including:

• directly from you in person, by telephone, email, post, online meeting, form, website, App or client portal;
• when you create or use an App account, upload content, send a message, request support, approve a transaction, use a feature or change a setting;
• from a client, employer, representative, agent, joint client, co-owner, executor, attorney, family member, counterparty, witness or other participant in a matter;
• from courts, tribunals, regulators, government agencies, law-enforcement bodies, professional advisers, barristers, experts, settlement platforms, identity-verification and screening providers, credit reporting bodies, credit providers, commercial credit-information or insolvency providers and other service providers, but only where access and collection are legally permitted;
• from public registers and sources, including ASIC, ABR, land-title, court, insolvency, sanctions and professional registers; and
• automatically from our website, App and security systems, including technical logs, device information, cookies and diagnostics described in this Policy.

If we receive unsolicited personal information, we assess whether we could lawfully have collected it. If not, and it is lawful and reasonable to do so, we destroy or de-identify it.

Where information is collected from someone other than the individual, we provide notice where required and reasonable. In legal matters it may be unreasonable, impracticable, contrary to instructions, prejudicial to proceedings or prohibited by law to notify every person whose information appears in a file.

6. Mobile App permissions and device data

The App follows a data-minimisation model. It requests a device permission only when the user invokes a feature that needs it and provides a clear purpose notice before or with the system request. Denying an optional permission does not prevent use of unrelated features. Where practicable, we provide a manual or assisted alternative.

You can change operating-system permissions at any time in device settings. Some device and platform information is also processed by Apple or Google under their own terms and privacy policies when you download or use the App.

7. Why we collect, hold, use and disclose information

We handle information for purposes reasonably necessary for our functions and activities, including to:

• assess whether we can act, identify conflicts, open and manage files and provide legal advice and services;
• communicate, receive instructions, prepare and execute documents, conduct due diligence, progress transactions and proceedings, and liaise with authorised persons;
• create, authenticate, support and secure App and portal accounts, provide requested features and maintain service continuity;
• verify identity, authority, ownership and source of funds, undertake sanctions and politically exposed person screening, monitor risk and comply with AML/CTF obligations;
• process invoices, payments, trust transactions, settlements and refunds and verify bank or payment instructions;
• assess payment risk or creditworthiness, set or review payment terms, manage accounts and recover overdue amounts using information we are legally permitted to handle;
• protect clients, personnel, systems and premises; prevent fraud, cyber incidents, unauthorised access and misuse; investigate incidents and enforce terms;
• manage service providers, insurance, audits, professional obligations, complaints, access and correction requests and legal claims;
• recruit and manage personnel and suppliers;
• improve services using de-identified or aggregated information and, where appropriate consent has been obtained, non-essential analytics;
• send legal updates, event invitations or other marketing in accordance with consent and applicable law; and
• comply with a law, court or tribunal order, regulatory requirement, professional duty or lawful request, and exercise or defend legal rights.

We do not use personal information for a materially different purpose unless the individual has consented or the use or disclosure is otherwise permitted or required by law. We do not sell personal information.

8. Sensitive information and identity verification

We collect sensitive information only where it is reasonably necessary for our functions or activities and the individual has consented, or where collection is otherwise required or authorised by law. Legal matters may necessarily include health, capacity, criminal, racial, religious, political, professional-membership or other sensitive information.

Before collecting a facial image, liveness result, identity-document image or other biometric information through the App, we provide a specific notice and seek the consent or other authority required by law and app-store rules. We restrict use to identity verification, security, fraud prevention and compliance. We do not use biometric information for advertising or to train general-purpose artificial-intelligence models.

An assisted verification option may be available where a person cannot or does not wish to use the App-based process, subject to legal and risk requirements.

8.1 Credit reporting and payment risk

We may obtain and use commercial credit information, payment-history information and insolvency information to assess payment risk, set or review payment terms, manage accounts or recover overdue amounts, where this is reasonably necessary and legally permitted. Commercial credit information is generally handled under the APPs. Different rules can apply where a consumer credit report is accessed for a commercial credit purpose.

An arrangement under which payment for services is deferred for at least seven days may cause an entity to be treated as a credit provider for Part IIIA of the Privacy Act. Before obtaining, using or disclosing consumer credit reporting information, we determine whether Part IIIA, the Privacy Regulation 2013 and the Privacy (Credit Reporting) Code 2025 apply and whether the particular handling is permitted.

The App is not intended to access a consumer credit report or report a default to a credit reporting body. Any such function is prohibited unless it has first been legally approved and implemented with the required notices, consent where applicable, data-security controls, access and correction processes, complaint handling and membership of a recognised external dispute-resolution scheme where required.

If we participate in the consumer credit reporting system, we will make a separate, clearly expressed credit reporting policy and statement of notifiable matters available before the relevant collection or disclosure. Those documents will identify the credit reporting bodies we use, explain the kinds of credit information handled, purposes, overseas disclosures, access and correction rights, complaint process and external dispute-resolution arrangements. This general Privacy Policy is not a substitute for those documents.

9. Anti-money laundering and counter-terrorism financing

Where we provide designated services or another applicable law requires it, we collect, verify, use and retain personal information to meet anti-money laundering and counter-terrorism financing obligations. This may include identity and contact details, government identification, authority and capacity, beneficial ownership and control, source of funds or wealth, transaction information, sanctions and politically exposed person screening, risk assessments and ongoing due-diligence information.

We may obtain this information from you, your organisation, authorised representatives, approved verification and screening providers, regulators, financial institutions, public registers and other lawful sources. If required information is not provided or cannot be verified, we may delay, restrict or decline to commence or continue services or transactions.

We may disclose information to AUSTRAC or another competent authority where required or authorised. The law may prohibit us from telling a person whether a suspicious matter report, related information or certain enquiries have been made. We retain AML/CTF records for at least the period required by law, generally seven years from the applicable statutory event.

Further information: Somers & Blatt Lawyers AML Collection Notice

10. Client confidentiality and legal professional privilege

A solicitor must not disclose information confidential to a client except to persons within or engaged by the practice for the purpose of delivering or administering legal services, with the client’s express or implied authority, where permitted or compelled by law, or in another recognised professional exception.

We limit access to client information to personnel and approved service providers who need it for authorised purposes and are subject to confidentiality, privacy and security obligations. Disclosure under this Policy is not intended to waive legal professional privilege. Privilege belongs to the client and can be waived only in accordance with law and authority.

Not every communication with a lawyer is privileged. Privilege depends on the applicable legal test and circumstances. Privacy rights may also be limited where providing access would reveal another person’s information, prejudice proceedings, breach confidentiality or privilege, or fall within another lawful exception.

11. Disclosure to third parties

We may disclose information, only as reasonably necessary and authorised, to:

• our directors, lawyers, employees, secondees, contractors and related or associated service entities;
• barristers, counsel, experts, investigators, interpreters, mediators, costs consultants, process servers and other persons engaged for a matter;
• courts, tribunals, counterparties, other lawyers, settlement and lodgement platforms, land registries, revenue authorities, banks and financial institutions, with instructions or lawful authority;
• identity-verification, sanctions, politically exposed person, fraud, commercial credit, insolvency and due-diligence providers;
• credit reporting bodies and other credit providers, but only where a disclosure is permitted under Part IIIA and after any required notice, consent, external dispute-resolution and other conditions have been satisfied;
• cloud hosting, practice-management, document-management, email, communications, electronic-signature, payment, secure file-transfer, support, diagnostics, archiving, printing and cybersecurity providers;
• professional indemnity insurers, auditors, accountants, regulators, professional bodies, external legal advisers and dispute-resolution bodies;
• AUSTRAC, law-enforcement bodies, government agencies and other persons where required or authorised by law; and
• another law practice or service provider involved in a transfer, merger or reorganisation, subject to due diligence, confidentiality and lawful authority.

We require service providers that receive personal information to protect it through contractual, confidentiality, privacy and security measures appropriate to the information and at least equivalent to the protections represented in this Policy, subject to applicable law. We assess their data use, retention, subprocessors and security before approval and periodically thereafter.

The App does not include third-party advertising networks. A third-party software development kit or web view is not permitted to collect or repurpose information beyond approved, disclosed and store-declared purposes.

12. Artificial intelligence and automated processing

We may use approved computer programs to assist with identity verification, sanctions and politically exposed person screening, fraud and cybersecurity detection, document processing, workflow triage, search, summarisation and quality control. Depending on the tool, the information used may include identity and account details, verification data, transaction or matter information, document content, technical logs and risk indicators.

These tools may assist decisions about account access, identity verification, enhanced due diligence, risk escalation, conflicts or workflow. A lawyer or authorised employee reviews material adverse results. We do not use a computer program as the sole decision-maker for legal advice, the determination of a client’s legal rights or a decision that could reasonably be expected to significantly affect a person’s rights or interests without appropriate human review and lawful safeguards.

We do not provide client confidential information to a public generative-AI service. Before personal information is sent to a third-party AI service, we assess confidentiality, privilege, privacy, security, retention, training and overseas-processing terms, provide any required notice and obtain any required consent or authority. Approved providers must not use client or App data to train a general-purpose model unless expressly authorised on an informed basis and legally permissible.

13. Overseas disclosures and storage

Some service providers, external lawyers, experts or counterparties may be located outside Australia or may use overseas personnel or infrastructure. Known recurring destinations include South Africa and New Zealand. The country for a particular matter may depend on the matter, client instructions and the provider engaged. Other countries are identified where practicable in a collection notice, provider register or matter communication once the relevant data flow is known.

Before disclosing personal information to an overseas recipient, we take reasonable steps required by APP 8, which may include due diligence, contractual controls, access restrictions, encryption, confidentiality undertakings and assessment of the recipient’s privacy and security practices. Exceptions may apply, including where the individual gives informed consent after being advised of the consequences, or where disclosure is required or authorised by law.

Use of a global cloud or communications provider may involve remote support, redundancy or subprocessing in other countries even where the primary data region is Australia. We maintain a service-provider and subprocessor review process and update disclosures when data flows materially change.

14. Direct marketing and notifications

We may send legal updates, service information, invitations or other direct marketing where the recipient has consented or where otherwise permitted by law. Marketing emails and SMS identify us, provide current contact details and include a functional unsubscribe method. We keep appropriate evidence of consent. An electronic-marketing unsubscribe facility remains functional for at least 30 days after the message and an unsubscribe request is ordinarily actioned within five working days, without requiring payment, an account login or additional personal information beyond what is necessary to identify the address to be suppressed.

Operational App notifications about security, account access, appointments, tasks or matter activity are service communications, not marketing. Their lock-screen text is designed to avoid substantive confidential content. A message that also has a promotional purpose may nevertheless be a commercial electronic message. Marketing push notifications are disabled unless the user separately opts in and can be turned off in the App or device settings without losing unrelated functionality.

An individual may opt out by using the unsubscribe facility, changing App preferences, changing device notification settings or contacting the Privacy Officer. We may retain a minimal suppression record so the opt-out continues to be respected. We screen telemarketing lists against the Do Not Call Register and, after a number has been registered for 30 days, call it only with consent or where an exemption applies. Consent to telemarketing may be withdrawn at any time, and permitted calls must comply with identification, calling-time, caller-ID and termination requirements.

15. Website, cookies and analytics

Our website, client portals and embedded web content may collect IP address, date and time, pages or features accessed, referring page, browser and device information, downloads, session and security events and cookie or similar identifier information. We use this information to operate, secure and improve services, prevent misuse and understand aggregate performance.

We use necessary session, security and preference cookies. Non-essential analytics or marketing cookies are used only where appropriate notice and consent have been provided. Browser or device settings can be used to block or delete cookies, but doing so may affect authentication or functionality.

A link to a third-party website or service does not make us responsible for that third party’s privacy or security practices. Information entered into an embedded service is handled as described in this Policy and any specific notice, while Apple, Google or another platform may also process information independently under its own policy.

16. Security

We take reasonable technical and organisational steps appropriate to the sensitivity, volume and risk of the information we hold. Measures may include:

• encryption in transit and, where appropriate, at rest; secure application programming and file-transfer methods;
• multi-factor authentication, strong authentication controls, role-based and least-privilege access, segregation of duties and periodic access review;
• audit logs, security monitoring, malware protection, vulnerability and patch management, secure configuration, testing and change control;
• data minimisation, controlled production access, secure backups, recovery testing, retention controls and secure destruction;
• vendor due diligence, contractual security requirements, software-development-kit governance and subprocessor review;
• physical security, secure paper-file storage, confidentiality obligations, staff screening where appropriate, privacy and cybersecurity training; and
• incident-response, legal-hold, business-continuity and data-breach procedures.

No internet transmission or storage method is completely secure. Users should protect their credentials, enable multi-factor authentication and device security, keep software updated, verify payment instructions independently and promptly report suspected compromise.

17. Retention and destruction

We retain information for no longer than reasonably necessary for the purpose for which it may lawfully be used or disclosed, subject to professional, taxation, trust-account, insurance, limitation, court, regulatory, AML/CTF, legal-hold and other retention requirements. When information is no longer required, we take reasonable steps to securely destroy or de-identify it.

A client file and legally required compliance records are not automatically deleted merely because an App account is deleted. Access to retained information is restricted and it is not used for unrelated purposes. Our general retention periods are summarised in Schedule 2; a longer period may apply where required by law, client instruction, a pending claim, a litigation hold, professional obligations or risk management.

18. App account deletion and withdrawal of consent

If the App permits account creation, a user can initiate deletion from Account settings > Privacy and security > Delete account. The user may be required to reauthenticate or complete a proportionate identity check to prevent unauthorised deletion. We explain what will be deleted, what must be retained and the expected timing before confirmation.

A deletion request may also be made through the account-deletion facility linked from our Privacy page or by contacting the Privacy Officer. The public web facility is available without requiring the user to reinstall the App.

Deleting an App account deletes or de-identifies the account profile, authentication credentials, preferences and other App-only personal data that is not required for another lawful purpose. It is not merely a freeze or temporary deactivation. We ordinarily complete the active-system deletion process within 30 days after verification. Residual encrypted backup copies may remain inaccessible in routine use until overwritten through a backup cycle, ordinarily within 90 days.

We may retain information required for a client file, conflict records, trust accounting, taxation, fraud and security prevention, professional indemnity, a legal claim, a court or regulatory requirement, or AML/CTF compliance. We tell the user the categories and reasons. Retained information is segregated or access-restricted and deleted when the lawful basis expires.

Consent for an optional feature or non-essential analytics may be withdrawn in App settings, device settings or by contacting us. Withdrawal does not affect prior lawful processing and may prevent the particular optional feature from operating. Core legal-service and compliance processing may rely on contract, legal obligation or another lawful basis rather than consent.

19. Access and correction

An individual may ask to access personal information we hold about them or to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading. Requests should be made to the Privacy Officer. We verify identity and authority before releasing or changing information.

We generally respond within 30 days. Access may be refused or limited where permitted by law, including where it would unreasonably affect another person’s privacy, reveal confidential or privileged information, prejudice negotiations or proceedings, be unlawful, or involve a frivolous or vexatious request. If access or correction is refused, we provide reasons and available complaint mechanisms to the extent required.

We do not charge for making a request. We may charge reasonable costs of providing access where permitted and will advise the amount in advance. Users can update some account information directly in the App, but changes to verified identity or client records may require further evidence and professional review.

If Part IIIA applies to credit information or credit eligibility information we hold, the statutory credit-reporting access and correction rules apply. We do not impose a charge where Part IIIA prohibits one, and we provide the required reasons and external dispute-resolution information if a request is refused.

20. Privacy complaints

A privacy concern or complaint should be sent to the Privacy Officer using the contact details in section 24. Please describe the conduct, relevant dates, affected information and the outcome sought. We aim to acknowledge a complaint within five business days and ordinarily investigate and respond within 30 days. A complex matter may take longer; if so, we will explain why and provide an updated timeframe.

If the complaint is a credit reporting complaint governed by Part IIIA or the Privacy (Credit Reporting) Code 2025, we acknowledge it within seven days and decide it within 30 days, unless the individual agrees in writing to a reasonable extension. We provide details of any recognised external dispute-resolution scheme and the Office of the Australian Information Commissioner that may receive the complaint.

If another privacy complaint is not resolved, the individual may contact the Office of the Australian Information Commissioner. Depending on the subject, another regulator may also be relevant, including the Victorian Health Complaints Commissioner or the Australian Communications and Media Authority. We will provide current referral details with our response.

21. Data breaches

We maintain procedures to identify, contain, assess, remediate and learn from suspected data breaches. A suspected eligible data breach is assessed promptly and, where the Privacy Act requires, within the statutory assessment period. We notify the Office of the Australian Information Commissioner and affected individuals where an eligible data breach is likely to result in serious harm and no exception applies.

A notification may describe the incident, affected information, recommended protective steps and our response. We also comply with professional, court, insurer, client, contractual, health-records, AML/CTF and app-platform notification obligations where applicable, while preserving confidentiality and privilege.

22. Children and young people

The App and our legal services are not directed to children as an independent consumer service. A person under 18 should use the App only where the person has legal capacity or the account and instructions are authorised and supervised by a parent, guardian, litigation guardian, executor, attorney or other person recognised by law and by us.

We do not knowingly collect more information about a child than is reasonably necessary. We apply heightened safeguards to a child’s information, provide age-appropriate explanations where practicable and assess consent, capacity, best interests and professional obligations. We will review any feature likely to be accessed by children against the Children’s Online Privacy Code and other applicable requirements before release or material change.

23. Anonymity and pseudonymity

A person may browse public website content and make a general enquiry without identifying themselves where practicable. Legal services, App accounts, conflicts checks, transactions, court processes, identity verification and AML/CTF obligations ordinarily require accurate identity and contact information. A pseudonym cannot be used where identification is required or where it would be impracticable for us to act.

24. Changes and contact details

We review this Policy at least annually and before a material change to the App, information handling, third-party providers, overseas processing, AI use or law. We publish the current version on our website and make it accessible within the App and app-store metadata. Material changes are communicated before they take effect where required.

Schedule 1 - App data and permissions summary

This schedule provides a concise summary for App users. A feature-specific notice presented in the App prevails where it provides more specific information and is consistent with this Policy.

Schedule 2 - Retention summary

This Policy is Version 2.0 and is effective from 11 August 2026.