Privacy Policy.

Who this policy is from, and what it covers

This policy is issued by Neil Collins, an Australian sole trader (ABN 38 843 685 676) based in Sydney, New South Wales. In this policy, "I", "me" and "my" refer to Neil Collins; "you" refers to the visitor, subscriber, client or contact.

It covers personal information I handle in three ways:

• This website - neilcollins.com.au, including the contact form, newsletter and capability assessment.
• Email and direct correspondence - enquiries, proposals, and the day to day exchange that comes with consulting work.
• Client engagements - information I receive while delivering fractional CMO, advisory, marketing and capability work.

I work with clients and contacts in Australia, the United Kingdom, Europe and the United States. I apply the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth) as my baseline standard, together with the Spam Act 2003 (Cth) and the Australian Consumer Law, and I extend the core rights described below to everyone regardless of where they are. Where the UK GDPR, EU GDPR or a United States state privacy law applies to a particular engagement, the additional sections further down set out how that works.

What I collect

Depending on how you use the site, I may collect:

• Contact details you give me - name, email address, phone number, company and any message you send via the contact form, newsletter signup or capability assessment.
• Capability assessment responses - your answers to the assessment questions and the report generated for you.
• Correspondence - the content of emails, messages and calls between us, along with names, job titles, contact details and any business information you choose to share. This includes proposals, scoping notes and meeting records created during an enquiry or engagement.
• Engagement records - the working material that comes with consulting: contracts, briefs, invoices, project documentation and the notes I keep to deliver the work and meet my record keeping obligations.
• Newsletter preferences - the email address you subscribe with, your double opt-in confirmation, and any preference or unsubscribe actions.
• Usage data - first-party analytics events such as page views, clicks on calls-to-action, referrer, approximate device type and coarse location (country/region), collected only if you accept the on-site consent banner. I do not use third-party advertising cookies or cross-site trackers.
• Technical logs - standard server logs (IP address, user agent, timestamp, request path) kept short-term for security, abuse prevention and debugging.

I do not knowingly collect information from children under 16 and the site is not directed at children.

Why I collect it

• To respond to enquiries and deliver the services you ask for.
• To send the newsletter you opted in to, and to email your capability assessment report.
• To understand which content and calls-to-action work, so I can improve the site.
• To keep the site secure, prevent spam and abuse, and meet legal obligations.

Client information I handle on your behalf

Consulting work often means I am given access to information that belongs to a client rather than to me. Customer lists, CRM exports, campaign and analytics data, subscriber files and platform logins are common examples.

When that happens I am handling the information on the client's instructions, not for my own purposes. In UK and EU terms, the client is the data controller and I act as a processor. I do not use that information for anything beyond the agreed engagement, I do not add it to my own marketing lists, and I return or delete it at the end of the work unless there is a legal reason to retain it.

How that information is handled is governed by the engagement terms, confidentiality agreement or data processing agreement we sign, not by this policy. If your organisation needs specific data processing terms in place before we start, tell me early and we will get them signed as part of the engagement paperwork.

Email is convenient but it is not a secure channel. Please do not send customer records, personal data sets, credentials or other sensitive material by ordinary email. Ask me first and we will agree a secure transfer method.

Legal bases

I rely on your consent (newsletter, analytics cookies, capability assessment), the performance of a contract or steps at your request (responding to enquiries, delivering engagements), and my legitimate interests in running a secure, functional website.

Cookies and analytics

The site uses a small number of first-party cookies and browser storage items - for example to remember your consent choice and to keep an admin session active. Analytics events are only recorded after you click "Allow" on the consent banner, and are stored in my own backend rather than sent to a third-party ad network. You can withdraw consent at any time by clearing the nc_consent_v1 value from your browser storage or by contacting me.

How the newsletter works

Newsletter signup uses double opt-in: you enter your email, receive a confirmation email, and are only added once you click the confirm link. Every newsletter email includes a one-click unsubscribe link and links to a preference centre. This complies with the Spam Act 2003 (Cth).

Who I share information with

I do not sell your personal information. I share it only with the service providers I need to run the site and my business, under contracts that require them to protect it:

• Lovable Cloud - website hosting, database, authentication, storage and email delivery for transactional and newsletter emails.
• Google Search Console and Bing Webmaster (IndexNow) - search indexing and site health signals.
• My professional advisers (accountant, legal) where reasonably needed.
• Law enforcement or regulators where I am required by Australian law to disclose information.

Some of these providers may store or process data outside Australia (for example in the United States or the European Union). Where that happens, I take reasonable steps to ensure the recipient handles the information consistently with the Australian Privacy Principles.

How long I keep it

• Contact enquiries that do not become engagements: up to 24 months after our last correspondence.
• Newsletter subscribers: until you unsubscribe or ask me to delete you.
• Capability assessment records: up to 24 months, then anonymised or deleted.
• Analytics events: up to 24 months in aggregate form.
• Server logs: typically 30 to 90 days.
• Client engagement records, correspondence and financial records: seven years from the end of the engagement, to meet Australian tax and business record keeping requirements and to cover any professional liability period. Client data held on a client's behalf is returned or deleted at the end of the engagement as described above, separately from these records.

How I protect it

Data is stored in access-controlled databases with row-level security, HTTPS in transit, and admin access protected by authentication and role checks. No online service is perfectly secure, but I take reasonable steps to protect personal information from loss, misuse and unauthorised access.

Your rights

You can ask me to:

• Access the personal information I hold about you.
• Correct anything that is inaccurate or out of date.
• Delete your information (subject to any legal record-keeping obligations).
• Unsubscribe from the newsletter or update your preferences.
• Withdraw consent for analytics tracking.

Email nc@neilcollins.com.au with your request and I will respond within a reasonable time, usually within 30 days.

If you are in the United Kingdom or the European Union

Where the UK GDPR or EU GDPR applies to information I hold about you, you have the right to access it, have it corrected, have it erased, restrict or object to how it is used, and receive it in a portable format. Where I rely on your consent, you can withdraw it at any time without affecting anything done before you withdrew it.

I am based in Australia, and Australia does not currently hold an adequacy decision from the UK or the European Commission. Where I receive personal information from the UK or the EU, I rely on standard contractual clauses within the engagement terms, or on the contractual necessity basis where the transfer is needed to deliver services you have asked for. In either case I apply the protections in this policy to that information.

You can raise a concern with me at nc@neilcollins.com.au. You also have the right to complain to your local supervisory authority, which in the United Kingdom is the Information Commissioner's Office at ico.org.uk.

If you are in the United States

I am a sole trader operating from Australia and I fall well below the revenue and volume thresholds that trigger the California Consumer Privacy Act and the comparable state privacy laws. I extend the core protections anyway, as a matter of practice rather than obligation.

You can ask me what personal information I hold about you, ask for a copy, ask me to correct it, and ask me to delete it. I do not sell personal information, I do not share it for cross context behavioural advertising, and I do not use it to profile you or make automated decisions about you. There is nothing to opt out of because none of it happens.

Complaints

If you are unhappy with how I have handled your personal information, please contact me first at nc@neilcollins.com.au so I can try to resolve it.

If you are still not satisfied, you can escalate. In Australia, contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au. In the United Kingdom, contact the Information Commissioner's Office at ico.org.uk. In the European Union, contact the supervisory authority in your member state.

Changes to this policy

I may update this policy from time to time to reflect changes in the site, tools I use, or the law. The "Last updated" date at the top will always show when it was last revised. Material changes will be highlighted on the site or via the newsletter where appropriate.

Contact

Neil Collins - Sydney, NSW, Australia
Email: nc@neilcollins.com.au
Phone: +61 (0) 430 901 747