Privacy policy

Current as at 1 July 2026

Stumm Law Pty Ltd ABN 48 690 083 553 (‘we‘, ‘us‘, or ‘our’) is an incorporated legal practice based in Brisbane, Queensland. We collect, hold, use and disclose personal information in carrying on our business. We respect your privacy and we are committed to safeguarding and managing your personal information responsibly. As part of our commitment to doing so, we have chosen to subject ourselves to the Privacy Act 1988 (Cth) (‘Privacy Act‘). We also have obligations of confidentiality to clients and other parties arising from sources other than the Privacy Act.

This policy contains information about how we manage personal information. We will update this policy if there is any change in how we manage personal information. The current version of our privacy policy can be accessed free of charge at www.stummlaw.com.au/privacy or by contacting us at privacy@stummlaw.com.au. If you would like a copy of this privacy policy in a particular form (such as audio), then please contact us and we will accommodate any reasonable request.

In this policy, a reference to ‘you’ or ‘your’ is a reference to a person who has provided, or may provide, their personal information to us, or whose personal information we have otherwise collected.

What is personal information?

‘Personal information’ is defined in the Privacy Act as meaning information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information or opinion is true or is recorded in a material form.

Why we collect, hold, use and disclose personal information

The reason we collect, hold, use and disclose personal information will depend on the nature of our relationship and may include to:

• conduct conflict checks and verify your identity;
• contact you;
• provide legal services and carry out our functions and activities as a provider of legal services;
• seek to engage you, either as a client or as a service provider, and to manage contractual or other arrangements between us on an ongoing basis; or
• comply with and fulfil our legal, regulatory, reporting, risk management, auditing or professional obligations, needs or requirements.

The nature of our business and the services we provide mean that, generally, you will have to identify yourself when dealing with us. There may be some circumstances where you may be able to deal with us anonymously or by using a pseudonym. While you do not have to identify yourself or provide your personal information to us, if you do not do so, our interactions will be limited, and we will generally not be able to provide any services to you. We will not be able to provide legal services to you unless you identify yourself.

Further, depending on the services we are engaged by a client to provide or that we are instructed to provide, we have obligations under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) (‘AML/CTF Act’) that may require us to collect certain information and documentation relating to individuals other than the client. If such an individual does not provide the information or documentation we request in order for us to comply with our obligations under the AML/CTF Act, then we may be unable to provide legal services to such a client and may need to terminate our engagement by them.

We also collect personal information about people who are our contractors, suppliers, business partners and service providers, or people who are employed by or representatives or contractors of such people. We may do so in order to establish, maintain, evaluate and conduct a business relationship with such people.

Types of personal information we collect

We collect various kinds of personal information in carrying on our business. We only collect personal information that is reasonably necessary for, or directly related to, one or more of our functions or activities.

The kinds of personal information we collect about you will depend on the nature of your relationship with us, such as whether you are a client, a representative of a client, a counterparty, or otherwise. The types of personal information we may collect includes the following, and other information of a similar nature:

• identity information – name, date of birth, gender, signature, photographic identification, offices or directorships held, location and residency information;
• contact information – residential and postal addresses, email addresses, telephone numbers;
• professional and business information – current and former occupations, employers, job titles, professional qualifications, business holdings and structures, and professional memberships;
• financial information – bank account details, billing information, payment card details, and sources of funds and wealth;
• matter-related information – information relevant to your legal matter or the legal matter of our client;
• transaction information – details of services provided to you or your organisation;
• communication records – records of correspondence and communications with you;
• website and technical data – IP address, pages visited, and request timestamps;
• recruitment information – employment history, employment information, qualifications, references, right to work status, background check results; and
• sensitive information – including criminal history and bankruptcy records.

How we collect personal information

We hold all personal information we collect and all information we collect is held securely and in accordance with the Privacy Act. We hold personal information for the same purposes for which we collect it. All personal information and confidential data we collect is held by us subject to our duty of confidentiality under the Australian Solicitor’s Conduct Rules and any applicable undertakings or court rules.

We may hold personal information in hard copy or electronically, including by using Australian based cloud services. We have adopted and will maintain administrative, technical and physical safeguards designed to protect the personal information held by us from unauthorised access, accidental loss and unauthorised modification. All service providers we use are required to hold personal information in accordance with the Privacy Act and to comply with appropriate information security standards.

We cannot provide any assurance regarding the security of information transmitted to us electronically as the internet is inherently insecure. Information you transmit to us electronically is at your own risk. In the event of any loss, or unauthorised access or disclosure of your personal information that is likely to result in serious harm to you, we will investigate and notify you and the Australian Information Commissioner as soon as practicable in accordance with the Privacy Act.

We will only retain your personal information for as long as is reasonably necessary to:

• fulfil the purposes for which it was collected;
• comply with our legal and professional obligations; and
• ensure that pertinent evidence remains available if reasonable required.

We will take reasonable steps to return, securely destroy or de-identify personal information when it is no longer to be retained by us.

We do not hold or store personal information outside of Australia.

Disclosure of personal information

The people to whom we may disclose or share your personal information may include:

• our clients and their representatives;
• our professional advisers, auditors and insurers;
• counterparties to a transaction of which our client is or intends to be a party and their representatives;
• our current or prospective service providers, including cloud service and data storage providers and providers or mailing house, marketing, research, data analysis, banking, payment, client contact, data processing, insurance, forensic, litigation support, data room, marketing and security services;
• people with whom we have co-promotional arrangements (such joint event sponsors) or third parties assisting us with events;
• professional bodies, such as the Queensland Law Society;
• regulatory authorities (such as AUSTRAC), courts, tribunals, government agencies, law enforcement agencies and other third parties; or
• people you have authorised to receive your personal information or who we are otherwise permitted to provide your personal information.

We will disclose information to overseas recipients where this is reasonably necessary for the performance of one or more of our functions or activities, including as part of our provision of legal services and our carrying out of functions and activities as a provider of legal services. We may, for example, disclose personal information to an overseas recipient when dealing with an overseas office of a client, a party to a transaction that is located overseas, or a service provider located overseas (such as an overseas law firm or legal practitioner).

Direct marketing

We may use your personal information to send you direct marketing communications, regulatory or industry alerts, and other information that we believe you may be interested in. These communications may be sent in various forms, including by posted mail or email. If we use your personal information for the purpose of direct marketing, we will provide you with a simple means by which you may ‘opt out’ or request not to receive direct marketing from us.

Accessing and correcting your personal information

We will endeavour to ensure the personal information we hold about you is accurate, up to date, complete, relevant and not misleading. You have a right to request access to, or a correction of, the personal information held by us. If you feel your personal information needs to be corrected, such as by being inaccurate, incomplete or outdated, or if you wish to access or correct any personal information we may hold about you, then please contact us using the details set out below.

Complaints or concerns

If you have a complaint or any concerns about our handling of your personal information, then you may make a complaint to us using the contact details set out below. We will take any privacy complaint seriously and our Privacy Officer will investigate all complaints received. We aim to respond to complaints in a timely and efficient manner and our target response time is within 30 days. We request that you cooperate with us during this process and provide us with relevant information we may require.

If you are not satisfied with our response, we request you contact us so that we may discuss your concerns and seek to address them. However, you can also lodge a complaint with the Office of the Australian Information Commissioner and information on how to do so is available on their website, https://www.oaic.gov.au/privacy/privacy-complaints/. You may also contact the Queensland Law Society.

Contact us

If you have any questions relating to our management of personal information, then please contact our Privacy Officer by the following means:

© Stumm Law Pty Ltd ABN 48 690 083 553. Liability limited by a scheme approved under professional standards legislation.