Privacy Policy

1. About this policy

1.1 This policy explains how Mark Ferraretto Pty Ltd ABN 97 668 831 436, trading as Mark Ferraretto Legal Practice (MFLP), collects, holds, uses and discloses personal information.

1.2 It applies to personal information MFLP handles through its website at https://mflp.law, including the contact and client intake forms, and in providing legal services. It covers clients, prospective clients, other parties to a matter, witnesses and anyone else whose personal information MFLP handles.

1.3 MFLP may currently be exempt from most of the Privacy Act 1988 (Cth) (Privacy Act) as a small business. However, the Privacy Act applies to MFLP’s handling of personal information for the purposes of the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) (AML/CTF Act). In any event, MFLP aims to handle all personal information in accordance with the Australian Privacy Principles in the Privacy Act (APPs), and this policy describes how it does so.

1.4 MFLP’s legal practitioners also owe a professional duty to keep clients’ information confidential, and much of that information is protected by legal professional privilege. This policy does not limit those obligations.

1.5 In this policy, personal information and sensitive information have the meanings given in the Privacy Act.

2. What personal information MFLP collects

2.1 MFLP collects only the personal information it needs to provide its legal services and run its practice. Depending on how an individual deals with MFLP, this may include:

• (a) contact and identity details, such as name, date of birth, address, email address and phone number, and the individual’s preferred way of being contacted;
• (b) identity documents, such as a driver’s licence or other photo identification, used to verify a client’s identity;
• (c) details of the legal matter, such as the subject of the matter, the individual’s account of what has happened, and documents the individual provides;
• (d) details of other people involved in a matter, such as the names and contact details of other parties, which MFLP needs to check for conflicts of interest and to act in the matter;
• (e) financial information, such as information relevant to a property settlement, a legal aid application, a funding application or the payment of MFLP’s fees, and bank account details for trust deposits and refunds;
• (f) records of communications, such as emails, letters, file notes and, where the individual has been told, recordings and transcripts of meetings and calls (see clause 3.3); and
• (g) technical information about visits to MFLP’s website, such as IP address, browser type and the pages requested, which MFLP’s website host records automatically.

2.2 Because of the work MFLP does, it often needs to collect sensitive information, such as information about an individual’s criminal record or alleged offences, health (including mental health), family relationships, children, and racial or ethnic origin. MFLP collects sensitive information only where it is reasonably necessary to provide legal services, and with the individual’s consent or where otherwise permitted by law. MFLP takes particular care with information about children.

3. How MFLP collects personal information

3.1 MFLP collects personal information directly from the individual wherever practicable, for example when the individual:

• (a) completes the contact form or a client intake form on MFLP’s website (see clause 4);
• (b) phones, emails, writes to or meets MFLP; or
• (c) engages MFLP and provides instructions and documents.

3.2 In the course of a matter, MFLP also collects personal information from other people, including other parties and their lawyers, courts and tribunals, police and prosecuting authorities, government departments and agencies (such as the Department for Child Protection), the Legal Services Commission of South Australia, experts and witnesses, and public registers. Where MFLP collects information about someone who is not its client, it may not be practicable or appropriate (for example, because of legal professional privilege) for MFLP to tell that person about the collection.

3.3 MFLP may record meetings and calls with clients so that they can be transcribed and summarised for its file notes (see clause 7). MFLP will tell the client when it is recording, and the client may ask MFLP not to.

3.4 An individual may make a general enquiry without giving their name. However, MFLP cannot provide legal services to an individual anonymously or under a pseudonym, because it must check for conflicts of interest, verify identity and keep proper records.

4. The website contact and client intake forms

4.1 MFLP’s website has a contact form and two client intake forms (a general form, and a form for criminal matters). The information entered in a form is sent to MFLP by email.

4.2 Documents and photographs uploaded with an intake form are sent directly to private, encrypted storage in Australia. MFLP receives a link to each file, which expires after seven days, and each uploaded file is automatically deleted from that storage after 30 days. Documents MFLP needs for a matter are saved to the matter’s file.

4.3 The general intake form asks for the name and contact details of the other party, so that MFLP can check for conflicts of interest before acting. MFLP uses those details only for that check and, if MFLP acts in the matter, for the matter.

4.4 Submitting a form does not make the individual a client of MFLP. MFLP acts for an individual only once it has confirmed that it can act and the terms of the engagement have been agreed. Individuals should not rely on a form for anything urgent or subject to a deadline, and should call MFLP instead.

5. How MFLP uses personal information

5.1 MFLP uses personal information to:

• (a) respond to enquiries, and decide whether it can act;
• (b) check for conflicts of interest;
• (c) verify identity, and meet its obligations under the AML/CTF Act;
• (d) provide legal services, including advising, preparing documents, corresponding and acting in court and tribunal proceedings;
• (e) apply for legal aid or other funding on a client’s behalf, where the client asks MFLP to;
• (f) issue bills, receive payments, operate its trust account and keep financial records;
• (g) run, maintain and secure its website and systems;
• (h) deal with complaints, and with its professional indemnity insurer; and
• (i) meet its legal and professional obligations, including record-keeping, trust accounting and tax obligations.

5.2 MFLP does not sell personal information, and does not use or disclose it for any other purpose unless the individual consents or the use or disclosure is required or authorised by law.

5.3 MFLP does not use clients’ personal information to send them marketing.

6. Who MFLP discloses personal information to

6.1 In acting for a client, MFLP discloses personal information as the client instructs, or as the matter reasonably requires. This may include disclosure to courts and tribunals, other parties and their lawyers, barristers, experts, process servers, the Legal Services Commission of South Australia, and, where a client applies for funding, the funding provider (such as JustFund).

6.2 MFLP may also disclose personal information:

• (a) to its regulators and other bodies with oversight of legal practitioners, such as the Law Society of South Australia, the Legal Profession Conduct Commissioner and MFLP’s trust account examiner;
• (b) to its professional indemnity insurer and its professional advisers (such as its accountant);
• (c) to the Australian Transaction Reports and Analysis Centre (AUSTRAC) where the AML/CTF Act requires it; and
• (d) where the disclosure is otherwise required or authorised by law.

6.3 MFLP also uses reputable third-party service providers to run its practice. They hold or process personal information on MFLP’s behalf, and only for the purpose of providing their services to MFLP. They include:

Purpose	Provider	Where information is held or processed
Website hosting, and processing website form submissions	Vercel	United States and other countries
Sending website form submissions to MFLP by email, and storing documents uploaded with intake forms	Amazon Web Services (Amazon SES and Amazon S3)	Australia
Email	MFLP’s own mail server, hosted by BinaryLane, with outgoing mail sent through Amazon SES	Australia
Practice management, client records, billing and electronic signing	Clio	Australia
Document storage	MFLP’s own document server, with encrypted backups	Australia
Accounting	Xero	United States and other countries
Transcribing and summarising meetings, calls and dictation	Microsoft (Azure AI services)	Australia
AI tools that help MFLP with administration, drafting and reviewing documents	Anthropic	United States and other countries
Identity verification and searches	InfoTrack	Australia

6.4 MFLP only uses providers whose terms require them to keep information confidential and secure. MFLP does not use AI tools that are allowed to use the information it gives them to train their models. A legal practitioner reviews all AI-assisted work and remains responsible for it, and AI tools do not make decisions about any individual or matter.

6.5 Some of these providers store or process information outside Australia, as shown in the table. Clients are asked to consent to this in MFLP’s Terms of Engagement or engagement letter. A client who would prefer that MFLP does not use AI tools, or services outside Australia, for their matter should tell MFLP, and MFLP will discuss alternatives.

7. Cookies and website analytics

7.1 MFLP’s website does not set cookies, and does not currently use analytics or tracking tools.

7.2 Websites MFLP links to (such as JustFund) have their own privacy policies and may set their own cookies. MFLP is not responsible for those websites.

8. Holding and securing personal information

8.1 MFLP holds personal information electronically, in its email, document storage and practice management systems and with the providers listed in clause 6.3, and in some cases on paper at its office.

8.2 MFLP takes reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification and disclosure. These steps include multi-factor authentication, encryption, restricted access, keeping systems up to date, security monitoring and secure storage of paper files.

8.3 MFLP keeps personal information only for as long as it needs it, or as long as the law or its professional obligations require, then securely destroys or de-identifies it. In particular:

• (a) client files are generally kept for seven years after the matter ends;
• (b) wills, and the files relating to them, are kept indefinitely, unless the client instructs otherwise;
• (c) trust account, billing and financial records are kept for at least seven years;
• (d) records kept under the AML/CTF Act are kept for as long as that Act requires;
• (e) where an enquiry does not lead to an engagement, MFLP keeps a record of it, including the names of the parties, for up to seven years, so that it can check for conflicts of interest; and
• (f) documents uploaded with a website intake form are deleted from the website’s storage after 30 days, as described in clause 4.2.

8.4 If MFLP becomes aware of a data breach that is likely to result in serious harm to an individual, MFLP will notify the affected individuals and, where appropriate, the Office of the Australian Information Commissioner (OAIC), in line with the Notifiable Data Breaches scheme.

9. Access and correction

9.1 An individual may ask MFLP for access to the personal information MFLP holds about them, or ask MFLP to correct it, by contacting MFLP under clause 11.

9.2 MFLP will respond within 30 days. MFLP will not charge for a request, but may ask the individual to verify their identity first.

9.3 MFLP may refuse access where the law permits, for example where giving access would disclose information subject to legal professional privilege, would unreasonably affect another person’s privacy, or would prejudice legal proceedings. If MFLP refuses a request, it will explain why in writing, as far as it reasonably can.

10. Complaints

10.1 An individual who believes MFLP has mishandled their personal information may complain to MFLP in writing under clause 11. MFLP will acknowledge the complaint within seven days and aim to resolve it within 30 days.

10.2 If the individual is not satisfied with MFLP’s response, they may be able to complain to the OAIC (https://www.oaic.gov.au, 1300 363 992). A complaint about the conduct of a legal practitioner may also be made to the Legal Profession Conduct Commissioner (https://www.lpcc.sa.gov.au).

11. Contact

11.1 Questions, requests and complaints about privacy should be sent to:

Privacy Officer
Mark Ferraretto Legal Practice
Suite 701, Level 7, Shell House, 170 North Terrace, Adelaide SA 5000
PO Box 2019, Hilton SA 5033
admin@mflp.law · +61 481 821 497

12. Changes to this policy

12.1 MFLP may update this policy from time to time. The current version is published at https://mflp.law/privacy, and shows its version number and the date it took effect.