Privacy Policy

Effective date: 30th July 2026

1. Introduction

Skopeo SMSF Pty Ltd (ABN 11 695 103 783) (“Skopeo SMSF”, “we”, “our”, “us”) is committed to protecting personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

This Privacy Policy explains how we collect, use, disclose, store and protect personal information in connection with our website (skopeosmsf.com.au) and our Products, including Document Toolkits (such as the Practice Essentials: Quality Management Suite) and SaaS Applications (such as the SMSF Document Analyser).

Our SaaS Applications may process documents containing personal information of SMSF members and trustees, including names, tax file numbers (TFNs), financial information and superannuation account details. We recognise this information is sensitive and have designed our privacy practices accordingly.

By using our website or purchasing a Product, you acknowledge that you have read and understood this Privacy Policy.

2. What Personal Information We Collect

2.1 Account and Purchase Information (Information You Provide)

Name, email address and business contact details when you create an account, make a purchase or contact us.
Firm name, ABN, role and professional registration details when you register for a Product.
Payment information (processed by Stripe; we do not store your credit card details).
Communications you send to us, including support requests and feedback.

2.2 Information Collected Automatically

Device information, browser type, operating system and IP address.
Website usage data, including pages visited, time spent on pages and referring URLs.
Cookies and similar tracking technologies (see section 9 below).

2.3 SMSF Data Processed by SaaS Applications

If you use a SaaS Application such as the SMSF Document Analyser, you may upload or submit documents that contain personal information of third parties, including SMSF members, trustees, directors and beneficiaries. This information may include:

Names, addresses and dates of birth of SMSF members and trustees.
Tax file numbers (TFNs) and Australian Business Numbers (ABNs).
Superannuation account balances, contribution details and pension information.
Financial statements, investment holdings and transaction records.
Trust deed provisions and related-party details.
Any other personal or financial information contained in documents you upload.

This information is classified as sensitive information under the Privacy Act 1988 (Cth) to the extent it includes TFNs and financial details. We handle this information with a heightened level of care in accordance with the APPs, as described in sections 3, 4, 5 and 7 below.

Important: You remain responsible for ensuring you have appropriate authority and consent to upload documents containing third-party personal information to our SaaS Applications. You must comply with your own obligations under the Privacy Act 1988 (Cth), the Taxation Administration Act 1953 (Cth) (in relation to TFNs) and any other applicable laws when using our Products.

2.4 SMSF Data Processed Through Quality Review Services

If you purchase a Quality Review Service, you will provide Skopeo SMSF with access to one nominated SMSF audit file, which may contain personal information of SMSF members, trustees, directors and beneficiaries — including names, addresses, dates of birth, tax file numbers, superannuation account balances, financial statements, trust deed provisions and related-party details. This information is provided by one of two methods, depending on the product purchased and the audit software platform you use:

(a) Reviewer Access: a read-only or equivalent reviewer-level user role granted to Skopeo SMSF within your own audit software platform (e.g. CloudOffis). No copy of the fund file is taken by Skopeo SMSF except where reasonably necessary to prepare the Quality Review Report, and any such extract is deleted in accordance with section 5.3A below.

(b) Secure Transfer Service: where Reviewer Access is not available (for example, your platform doesn't support it, or the file isn't held electronically), a copy of the fund file uploaded by you to a Secure Transfer Service, using a link provided for that purpose.

As with SMSF Data processed by SaaS Applications, this information is classified as sensitive information under the Privacy Act 1988 (Cth) to the extent it includes TFNs and financial details, and is handled with the same heightened level of care described in sections 3, 4, 5 and 7. You remain responsible for ensuring you have appropriate authority and consent to share documents containing third-party personal information with Skopeo SMSF for a Quality Review Service.

3. How We Use Personal Information (APP 6)

Australian Privacy Principle 6 requires that personal information is only used or disclosed for the primary purpose for which it was collected, or for a directly related secondary purpose that you would reasonably expect.

3.1 Primary Purposes

We use your personal information for the following primary purposes:

To process your purchases and Subscriptions and to provide the Products you have ordered.
To create and manage your account.
To communicate with you about your purchases, account or support requests.
To provide, operate and maintain our SaaS Applications, including processing the documents you upload.

3.2 Use of SMSF Data within SaaS Applications

When you upload documents to a SaaS Application, any personal information contained in those documents is processed solely for the purpose of providing you with the service functionality of the application (the primary purpose). Specifically:

SMSF member and trustee data is processed only to analyse, review or generate outputs as part of the application’s core functionality.
We do not use SMSF member or trustee data for any purpose other than providing the SaaS Application service to you.
We do not use SMSF data for marketing, profiling, data aggregation, research or any secondary purpose.
We do not access the content of your uploaded documents except to provide the service, provide support at your request, to resolve a technical issue, or as required by law.

3.3 Related Secondary Purposes

We may use your account and purchase information (but not SMSF member or trustee data) for the following secondary purposes, which are directly related to the primary purpose and which you would reasonably expect:

To send you product updates, new releases and relevant information about our Products (you may opt out at any time).
To improve our website, Products and customer experience (using de-identified and aggregated data only).
To comply with our legal and regulatory obligations.
To protect our rights, property and safety, and the rights, property and safety of our users and the public.

3.4 Use of TFN Information

To the extent that documents uploaded to a SaaS Application contain tax file numbers (TFNs), TFN information is handled in accordance with the Taxation Administration Act 1953 (Cth) and the Privacy (Tax File Number) Rule 2015. TFN information is used solely for the purpose of providing the SaaS Application service. We do not record, extract, store or use TFN information for any purpose other than processing the documents you upload as part of the application’s functionality.

3.5 Use of Personal Information in Quality Review Services

Personal information contained in a Nominated Fund's file is accessed and used solely to conduct the Quality Review Service — that is, to review file processing, documentation and workflow practices, and to prepare the Quality Review Report and conduct the debrief session. It is accessed only by the individual reviewer(s) assigned to the engagement via compliance@skopeosmsf.com.au, is not used for marketing, profiling, product development, or any other secondary purpose, and is not incorporated into any Skopeo SMSF product, dataset or system.

4. How We Share Personal Information (APP 6 and APP 8)

4.1 Disclosure to Third Parties (APP 6)

We do not sell your personal information or SMSF data. We may share your account and purchase information with:

Stripe, for the purpose of processing payments securely.
Wix, which hosts our website and e-commerce platform.
Xero, for the purpose of issuing invoices and managing our accounts.
Microsoft, for email communications (Microsoft 365).
Any service provider engaged by us to support the operation of our website or Products, subject to obligations of confidentiality.
Law enforcement, regulatory authorities or courts, as required or authorised by Australian law.

SMSF member and trustee data: We do not disclose SMSF member or trustee data (including data contained in documents you upload to a SaaS Application, or fund files shared with us for a Quality Review Service) to any third party, except:

to a cloud infrastructure provider solely for the purpose of hosting the SaaS Application, or, for a Quality Review Service, the Secure Transfer Service used to receive and store fund files during the engagement;
where disclosure is required or authorised by or under an Australian law or a court or tribunal order; or (
where you provide explicit, informed consent to a specific disclosure.

4.2 Cross-Border Disclosure (APP 8)

Australian Privacy Principle 8 requires us to take reasonable steps to ensure that any overseas recipient of personal information handles it consistently with the APPs.

Some of our service providers (including Stripe, Wix and Microsoft) may store or process personal information on servers located outside Australia, including in the United States. Where personal information is disclosed to an overseas recipient, we take reasonable steps to ensure the recipient handles the information in a manner consistent with the APPs, including by:

entering into contractual arrangements that require the recipient to handle personal information in accordance with obligations substantially similar to the APPs;
assessing the recipient’s privacy and security practices before engagement; and
conducting ongoing monitoring of compliance with these arrangements.

SMSF data hosting: We will clearly disclose the hosting location of any SaaS Application that processes SMSF data. Where SMSF data is stored on servers located outside Australia, we will inform you of the countries involved and the steps we have taken to ensure the data is handled in accordance with the APPs. Where practicable, we will offer Australian-based hosting for SaaS Applications that process SMSF member and trustee data.

5. Ownership and Control of Your Data

5.1 Your Data Remains Yours

Any data, documents or information you upload to or create within a SaaS Application (“Your Data”) remains your property. Skopeo SMSF does not claim any ownership of Your Data, including any SMSF member or trustee personal information contained within it.

5.2 Data Portability

You may export Your Data at any time using the export functionality within the SaaS Application (where available). We support your right to data portability and will provide Your Data in a commonly used, machine-readable format upon request.

5.3 Data Deletion

Upon cancellation or termination of your Subscription, Your Data will be retained for 30 days to allow you to export it. After this period, Your Data (including all SMSF member and trustee personal information) will be permanently deleted from our production systems.

You may request deletion of specific data at any time by contacting info@skopeosmsf.com.au. We will action deletion requests within 30 days.

5.3A Retention and Deletion — Quality Review Services

Fund file data accessed or received for a Quality Review Service is used only for the duration of that engagement. Skopeo SMSF's Reviewer Access is revoked, and any locally held extracts or copies (including files received via a Secure Transfer Service) are permanently deleted, within 10 business days of the debrief session for that engagement. You may request earlier deletion at any time by contacting info@skopeosmsf.com.au.

6. How We Protect Personal Information (APP 11)

Australian Privacy Principle 11 requires us to take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification and disclosure, and to destroy or de-identify information we no longer need.

Given that our SaaS Applications may process sensitive financial information including TFNs and superannuation account details, we implement security measures proportionate to the sensitivity of the data, including:

6.1 Technical Measures

Encryption of data in transit (TLS/SSL) and at rest (AES-256 or equivalent).
Secure hosting infrastructure with access controls, firewalls and intrusion detection.
Regular security assessments and vulnerability scanning.
Automated logging and monitoring of access to SMSF data.
Separation of customer data environments to prevent cross-contamination between accounts.

6.2 Organisational Measures

Access to SMSF data is restricted to personnel who require it to provide the service, on a need-to-know basis.
All personnel with access to SMSF data are subject to confidentiality obligations.
Regular review of access permissions and security practices.
Incident response procedures for identifying, containing and responding to data breaches.

6.3 Data Minimisation

We collect and retain only the personal information that is reasonably necessary for the purposes described in this Privacy Policy. Documents uploaded to SaaS Applications are processed for the duration necessary to provide the service functionality and are not retained beyond the period described in section 5.3.

6.4 Destruction and De-identification (APP 11.2)

When personal information is no longer needed for any purpose for which it may be used or disclosed under the APPs, we take reasonable steps to destroy or de-identify it. This includes:

Permanent deletion of SMSF data from production and backup systems following account termination (see section 5.3).
Secure destruction of any temporary copies created during processing.
De-identification of data used for service improvement, where aggregated or anonymised data is sufficient.

6.5 No Absolute Guarantee

While we take reasonable steps to protect personal information, no method of electronic storage or transmission is completely secure. We cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials and for maintaining your own backups of Your Data.

7. Notifiable Data Breaches

In the event of a data breach that is likely to result in serious harm to any individual whose personal information is involved — including personal information contained in a fund file shared with us for a Quality Review Service — we will comply with the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act 1988 (Cth). This includes:

Conducting a reasonable and expeditious assessment of the breach.
Notifying the Office of the Australian Information Commissioner (OAIC) if the breach meets the threshold of likely serious harm.
Notifying affected individuals as soon as practicable.
Notifying you (as the SaaS Application customer) immediately if the breach involves SMSF data you uploaded, so that you can meet your own notification obligations to SMSF members and trustees.

8. Your Obligations When Using SaaS Applications

When you upload documents containing personal information of SMSF members, trustees or other individuals to a SaaS Application, you acknowledge and agree that:

You have collected the personal information in accordance with the APPs, including APP 3 (collection) and APP 5 (notification of collection).
You have appropriate authority, consent or legal basis to disclose the personal information to Skopeo SMSF for processing through the SaaS Application.
You are responsible for complying with your own obligations under the Privacy Act 1988 (Cth), the Taxation Administration Act 1953 (Cth) and any other applicable laws in relation to the personal information you upload.
You will not upload personal information that you are not authorised to disclose.
You will inform SMSF members and trustees, as part of your own privacy notices, that their information may be processed by third-party tools and applications used by your firm.
If you purchase a Quality Review Service, the same obligations in this section apply to the Nominated Fund file you provide, whether by Reviewer Access or a Secure Transfer Service upload.
You will only share fund files for a Quality Review Service via the access method specified by Skopeo SMSF at the time of purchase, and will not send fund files containing personal information by unencrypted email or any other insecure method.

9. Cookies

Our website uses cookies and similar technologies to improve your experience, analyse website usage and support our operations. You can manage cookie preferences through your browser settings. Disabling cookies may affect your experience of the website, including the checkout process.

10. Your Rights

Under the APPs, you have the right to:

Request access to the personal information we hold about you (APP 12).
Request correction of personal information that is inaccurate, out of date, incomplete or misleading (APP 13).
Opt out of marketing communications at any time by using the unsubscribe link in our emails or contacting us.
Request deletion of your account and associated data.
Complain about a breach of the APPs.

To exercise any of these rights, contact us at info@skopeosmsf.com.au.

Note for SMSF members and trustees: If you are an SMSF member or trustee and your personal information has been processed through one of our SaaS Applications by your auditor, your primary privacy relationship is with your auditor (our customer). Requests for access, correction or deletion of your personal information should be directed to your auditor in the first instance. If your auditor is unable to assist, you may contact us at info@skopeosmsf.com.au.

11. Retention

We retain personal information for as long as necessary to fulfil the purposes for which it was collected, to comply with our legal obligations (including tax, accounting and record-keeping requirements), and to resolve disputes.

Specific retention periods:

Account and purchase records: retained for 7 years from the date of purchase for tax and accounting purposes.
SaaS Application data (Your Data): retained during your active Subscription plus 30 days following cancellation. Permanently deleted after 30 days of cancellation.
Support communications: retained for 1 year from the date of the communication.
Website analytics data: retained in de-identified or aggregated form only.

When personal information is no longer needed, we take reasonable steps to destroy or de-identify it in accordance with APP 11.

12. Changes to This Policy

We may update this Privacy Policy from time to time. The updated version will be posted on this website with a revised effective date. For active SaaS Application subscribers, material changes to this Privacy Policy will be communicated by email at least 14 days before they take effect. We encourage you to review this page periodically.

13. Complaints

If you believe we have breached the APPs or have a complaint about our handling of personal information, please contact us at info@skopeosmsf.com.au. We will acknowledge your complaint within 5 business days and provide a substantive response within 30 days.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or by calling 1300 363 992.

14. Contact

Skopeo SMSF Pty Ltd
ABN: 11 695 103 783

Privacy Officer: info@skopeosmsf.com.au

Website: skopeosmsf.com.au