What I collect, and what happens to it.

Winsor Advisory is a sole trader turning over less than $3 million a year, so the small business exemption in the Privacy Act 1988 (Cth) applies to me. I follow the Australian Privacy Principles anyway. A business that hands me access to its customer records deserves that regardless of where a turnover threshold sits, and the threshold is under review.

The contact form. Your name, your email address, the topic you pick, and whatever you write in the message. You choose all of it. There is no requirement to use the form at all, and an email to me does the same job.

Server logs. The site is hosted on Vercel, which records the ordinary things a web server records: IP address, browser, the pages requested and when. I use those to keep the site running and to see if something is broken or being attacked.

Form rate limiting. When you submit the form, your IP address is held in memory for sixty seconds so the same address cannot fire off dozens of submissions. It is never written to disk and never reaches me.

The map on one page. One case study shows a delivery route on a map. The map tiles come from OpenStreetMap, so opening that page sends your IP address to them. Every other page loads only from my own domain, fonts included.

To read what you sent and reply to it, and to keep the thread while we are talking. Nothing else. I do not run a mailing list, I do not add you to one, and I have never sold or rented anyone's details.

Three services sit between you and my inbox, and all three are based in the United States, so your enquiry leaves Australia:

• Vercel hosts the site and holds the server logs.
• Resend delivers the form submission to me as an email.
• My email provider stores that email in my inbox.

OpenStreetMap serves the map tiles described above, from servers in Europe. Nobody else receives anything, and no third party gets your details for their own purposes.

A project usually means access to a system that holds other people's information. I ask for the narrowest access that lets me do the work, I use it only for the job we agreed, and at handover you revoke it. I would suggest you do exactly that.

Client data never goes into a repository, a public example, or anything used to train a model. Where you have your own privacy obligations, I work inside them and follow your instructions about the data. If something goes wrong and your information is exposed, you will hear it from me as soon as I know.

Enquiries stay in my inbox while there is a conversation to have and for a while after, because people come back months later and it helps to have the history. Ask me to delete yours and I will. Project files and correspondence are kept for as long as I need them for the work and for the records the tax office requires.

Email me and ask. I will tell you what I hold, send you a copy, correct it or delete it, at no charge, within 30 days. If there is a reason I cannot do one of those, I will tell you what the reason is.

Tell me first, at jacob@winsoradvisory.com.au. I will come back to you within 30 days. If that does not resolve it, the Office of the Australian Information Commissioner takes complaints at oaic.gov.au or on 1300 363 992.

When what I do changes, this page changes with it, and the date at the top moves. There is no notification list, so the date is how you tell.

Jacob Winsor, trading as Winsor Advisory. ABN 16 421 529 680. Perth, Western Australia. jacob@winsoradvisory.com.au.

Terms of use