We only keep personal information for as long as it is necessary. The amount of time that
we hold the personal information for (retention period) varies, depending on the nature of the
personal information. Our records are systematically checked [through our CRM software]
to ensure that personal information is only kept while there is a lawful or legitimate business
purpose.

Most of the data we collect through our business (including most personal information we
collect) is stored electronically. We take all reasonable steps to keep it secure and prevent
unauthorised disclosure. Employees and contractors also play an important role in keeping
the information safe. All our employees and contractors are required to adhere to CoDrive
Financial’s policies, processes and controls to help meet our Privacy Act 2020 obligations.
This includes keeping passwords and devices secure, adhering to email and internet usage
guidelines and being subject to employee monitoring, as set out in our IT and cybersecurity
policies.

​

Privacy and remote working (working from home)

Remote working introduces additional risks in relation to potential breaches of privacy. We
take all reasonable steps to ensure personal information is protected in these circumstances,
including:

• Requiring a trusted WiFi network to be used (e.g. home WiFi);

• Having multifactor authentication enabled;

• Locking out a user after numerous failed logins;

• Ensuring staff can only access information they need;

• Storing devices in a safe location;

• Ensuring work conversations are not overheard by other members of the household;

• Locking devices when they are not in use; and

• Increased vigilance of unexpected emails.

​

If there is a privacy breach

We work hard to keep all personal information safe. However, despite applying strict security
measures and following industry standards to protect personal information, there is still a
possibility that our security could be breached. If you are aware of a privacy breach, where
there is a loss or unauthorised access or disclosure of personal information, whether or not
you think it is likely to cause serious harm, you must notify a manager as soon as you
become aware of the breach. This will allow us to:

• Seek to quickly identify and secure the breach to prevent any further breaches and reduce the harm caused by the breach;

• Assess the nature and severity of the breach, including the type of personal information involved and the risk of harm to affected individuals;

• Advise and involve the appropriate authorities where criminal activity is suspected;

• Where appropriate, notify any individuals who are affected by the breach (where possible, directly);

• Where appropriate, put a notice on our website advising our clients of the breach;

• Notify the Privacy Commissioner.

All employees receive training to enable them to identify a privacy breach, how to reduce the
risk of a privacy breach occurring and how to respond to a privacy breach if one does occur.
We maintain a Breaches Register (Appendix C) to record all privacy breaches that occur in
our business, whether or not they pose a risk of serious harm or require us to notify any
external parties. It is important that you notify the Privacy Officer as soon as you become
aware of any privacy breach, so that the breach can be logged on the Breaches Register
and any necessary further action can be considered.

Use of AI tools, recording and other record keeping tools and providers
We may use AI-powered tools to record, transcribe, and summarise meetings (including
phone/video/in-person). This may involve audio recordings and transcripts of discussions
about your financial situation. The Purpose of this use is:

• To improve accuracy of advice records

• To ensure compliance with regulatory requirements

• To reduce administrative errors

We use Third-party service providers for various aspects of our business. They are all
contractually bound to protect your information. Data may be stored overseas. Some examples of categories for third party providers are:

• CRM System

• IT Provider

• AI Note-Taker

• Accounting and Bookkeeping Services

• Accounting and Bookkeeping Software

​

Retention and Security: Recordings, transcripts and general records will be kept for a
minimum of 7 years (as that is our regulatory requirement), or longer if deemed necessary. All client records, including recordings and transcripts are protected in the same way that all other electronic files are safeguarded within our system.