Privacy Policy

1. Who this covers

This policy explains how Jordan Ong, ABN 63 990 880 663, trading as Offsider Agency, handles personal information. It applies to visitors to this website, people who enquire with us, and our clients.

It also explains how we handle information about our clients' customers — the people who call, text or fill in a form on a website we run. That's covered separately in section 6, because it's the part most people don't think about.

We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

2. What we collect

When you enquire with us: your name, business name, trade, phone number, email address, current website, service area, and whatever you write in the message field.

When you become a client: the above, plus your billing details, ABN, licence and registration numbers, insurance details, business photographs, and access credentials for accounts we manage on your behalf.

When you visit this website: standard technical information including IP address, browser type, pages visited and referring site. See section 8.

When you ring us: your phone number and the details of your enquiry. [[PLACEHOLDER: state clearly whether Offsider Agency records its own inbound calls. If yes, callers must be told at the start of the call.]]

We don't collect sensitive information as defined in the Privacy Act, and we don't ask for it.

3. Why we collect it

To answer your enquiry and provide a quote.
To build, host, maintain and support your website.
To run the call tracking, automation and reporting you've subscribed to.
To invoice you and keep the records the ATO requires.
To contact you about your account and the services you're using.

We do not sell personal information. We do not share it with other businesses for their marketing. We don't add enquirers to a mailing list — if you fill in the form asking for a quote, you get a reply about a quote.

4. Call tracking, recording and AI answering

This section matters, so it's in plain language.

Call tracking. Websites we build use a dedicated phone number that forwards to the business's real phone. We record the calling number, the time, the duration and which page or source the call came from. This tells the business which of their marketing actually produced a phone call. The call itself is forwarded normally.

Call recording and transcription. On the AI Front Desk tier, calls are answered by an automated voice agent, and are recorded and transcribed. Callers are informed at the start of every call that they are speaking to an automated assistant and that the call is being recorded. Recording without informing all parties is unlawful in Victoria under the Surveillance Devices Act 1999 (Vic), and we do not configure a system that does it.

If a caller does not consent to being recorded, they can say so and the call is transferred or ended without a recording being kept. [[PLACEHOLDER: confirm exactly what the AI voice agent does when a caller objects to recording, and make sure the announcement script matches what is written here]]

What's in a transcript. Whatever the caller said, which for a trade business usually includes their name, phone number, address and a description of a problem at their property. That's treated as confidential and is only made available to the business the caller was ringing.

5. SMS and automated messages

Missed-call text-back sends an automated SMS to a person who has just rung the business and not been answered. Speed-to-lead replies respond to someone who has just submitted a form. Review requests go to customers after a completed job. Quote-chase messages go to people who have asked for a quote.

Every one of these goes only to someone who initiated contact with the business or engaged it to do work. Every message identifies the business it's from and includes a way to opt out, as required by the Spam Act 2003 (Cth).

We do not send messages to purchased lists, scraped numbers, or anyone who hasn't contacted the business. Our terms prohibit clients from using these systems that way, and we switch the service off if they do.

6. Information belonging to our clients' customers

When you're a member of the public calling a plumber whose website we run, your information is collected on that plumber's behalf. The business you rang is responsible for it. We handle it for them, under their instructions, and we don't use it for anything else.

Specifically, we don't market to our clients' customers, don't merge customer lists between clients, and don't use one client's customer data to benefit another. When a client leaves, we hand their customer data back to them and remove it from our systems on the timeline in section 10.

If you're a member of the public and you want to know what a business holds about you, contact the business directly. If you can't reach them, contact us using the details in section 14 and we'll help you get to the right place.

[[PLACEHOLDER: put a written data-processing agreement in place with each client covering this relationship. This section describes the intent; the agreement is what makes it enforceable, and it is genuinely required once AI Front Desk is live.]]

We use third-party services to deliver what we sell. Personal information may be handled by:

Our website hosting provider. [[PLACEHOLDER: name the host and the country its servers are in]]
Our call tracking and SMS carriage provider. [[PLACEHOLDER: name the provider]]
Our CRM and marketing automation platform. [[PLACEHOLDER: name the platform — likely GoHighLevel — and where it stores data]]
Our AI voice and chat provider, on the AI Front Desk tier. [[PLACEHOLDER: name the provider, and state whether call audio or transcripts are used to train their models. This is the single most important disclosure on this page — get a written answer from the vendor.]]
Google, for analytics and Google Business Profile management.
Our accounting and invoicing software. [[PLACEHOLDER: name it]]

Some of these store data outside Australia. [[PLACEHOLDER: list which providers store data overseas and in which countries — APP 8 requires this disclosure]]

We'll also disclose information where the law requires it.

8. Cookies and analytics

This site uses [[PLACEHOLDER: confirm what is actually running once GA4/GTM are switched on. If no analytics are installed, say so plainly — that is a legitimate and increasingly attractive answer.]]

Where Google Analytics 4 is in use, it collects aggregate information about how people use the site: which pages get visited, roughly where visitors are, and which device they're on. It's configured to anonymise IP addresses. We use it to work out which pages are doing their job, not to identify individuals.

This site does not use advertising or retargeting cookies. You can block cookies in your browser and the site will still work.

9. Where it's stored and how it's protected

We protect personal information with access controls, encryption in transit (every page on this site is served over HTTPS), multi-factor authentication on the accounts we manage, and by keeping access limited to the two of us.

No system is perfectly secure. If a data breach occurs that's likely to cause serious harm, we'll notify affected people and the Office of the Australian Information Commissioner as required under the Notifiable Data Breaches scheme.

10. How long we keep it

Enquiries that don't become clients: [[PLACEHOLDER: retention period, e.g. 24 months]], then deleted.
Client records and financial records: at least five years, as the ATO requires.
Call recordings and transcripts: [[PLACEHOLDER: retention period — be specific, and shorter is better. Recordings of members of the public discussing their homes are sensitive in practice even if not in the statutory sense.]]
Client customer data after cancellation: handed back on request, then removed from our systems within [[PLACEHOLDER: period, e.g. 90 days]].

11. Accessing, correcting and deleting your information

You can ask us what personal information we hold about you, ask us to correct it, or ask us to delete it. Email the address in section 14 and we'll respond within 30 days.

There's no charge. We may need to verify your identity first, and there are some things we can't delete — financial records we're legally required to keep, for example. If we can't do what you've asked, we'll tell you why.

12. Complaints

If you think we've mishandled your personal information, contact us first using the details in section 14. We'll acknowledge it within [[PLACEHOLDER: acknowledgement period, e.g. 5 business days]] and give you a written response within 30 days.

If you're not satisfied, you can take it to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

13. Changes to this policy

We'll update this policy when what we do changes. The date at the top of the page tells you when it last changed. If a change materially affects how we handle your information, we'll tell our clients directly.

14. Contact

Offsider Agency
ABN 63 990 880 663
Put "Privacy" in the subject line and it gets to the right one of us.
Email: hello@offsider.agency
Phone: 0481 321 269
5 Seminary Crescent, Scoresby VIC 3179