Privacy Policy and Collection Notice

About this policy

New World Circle Pty Ltd (ABN 96 693 210 347; ACN 693 210 347) operates the New World Circle business and website. This policy explains how we collect, hold, use and disclose personal information and how an individual can request access, correction or make a complaint.

It applies to business contacts, prospective and current clients, suppliers, contractors, website visitors and other individuals whose information we handle. We aim to handle personal information consistently with the Australian Privacy Principles where they apply and as a matter of good practice where an exemption applies.

We do not intentionally collect sensitive information unless it is reasonably necessary for a specified function, permitted by law, and appropriate consent or another lawful basis applies. Clients must not provide sensitive, identity, health or restricted information unless New World Circle has agreed the need and controls in advance.

Personal information we collect

Identity and business-contact details: individual or legal business name, trading name, role, organisation, Tax ID, ABN or other registration number, email, telephone number, country, street address, city, state or region, postal code and professional profile.
Business records: enquiries, proposals, contracts, approvals, correspondence, support and complaints.
Billing and transactions: invoice email, billing entity and currency, payment account, due date, purchase-order or vendor number, invoice memo, remittance information, payment references, subscription and payment-recovery status and credit-note information.
Internal customer records: account nickname, description and limited key-value metadata used for administration, reconciliation, reporting or another recorded business purpose.
Website and technical information: IP address, device or browser information, page activity, referral source, form submissions, security events and cookie identifiers where configured.
Client-service information: objectives, business processes, account identifiers, system permissions, campaign data, customer or lead information supplied for a service, content, recordings, AI inputs and outputs, workflow records and reports.
Import, export and supply information: representatives, supplier contacts, product specifications, quotations, orders, shipment and transaction records.
Other operational information: marketing preferences, event participation, responses to communications, recruitment, contractor and supplier information.

How we collect, use and disclose information

How we collect information

We usually collect personal information directly through website forms, email, telephone or video meetings, proposals, contracts, onboarding, approved secure workspaces, service delivery, events and support interactions.

We may also collect information from a client organisation, referral partner, supplier, factory, distributor, logistics provider, professional adviser, advertising or technology platform, public business source, social network, registry or another person authorised to provide it. If we receive information we did not request, we assess whether it may lawfully be kept and delete or de-identify it where appropriate.

Billing and customer records

For client and invoice setup, we may collect the details needed to identify a business or agreed individual customer, issue an accurate invoice, receive payment, maintain accounting records and communicate about billing. The nominated billing email is used for invoice delivery and billing communications.

Our internal customer record may contain an account nickname, description, selected billing entity and currency, payment account, invoice-specific memo and limited metadata. Metadata is used only for a recorded internal business purpose and must not contain passwords, payment-card details, sensitive information or unnecessary personal information. Optional billing fields are collected only when relevant to an engagement, invoice, tax treatment, payment, client instruction or reasonable account administration.

Why we use and disclose information

Responding to enquiries, preparing proposals and establishing client or supplier relationships.
Delivering, administering, measuring and improving consulting, advertising, digital, AI-supported, automation, content, import/export, sourcing and related services.
Managing accounts, approvals, budgets, invoicing, supplier payments, reconciliation and debt recovery.
Coordinating with authorised personnel, contractors, suppliers, factories, distributors, logistics providers, platforms, professional advisers and regulators.
Protecting systems, detecting misuse, investigating incidents, maintaining records and complying with law, contracts and insurance requirements.
Sending service communications and, with consent or as otherwise permitted, relevant marketing.
Analysing and improving operations using aggregated or de-identified information where practical.

We do not sell personal information. We do not disclose a client contact list to another business for that business's unrelated marketing.

Service providers, systems and overseas handling

Service providers and recipients

We may disclose personal information where reasonably required to approved hosting, communications, security, analytics, professional, payment, advertising, production, inspection, logistics and support providers; personnel and contractors; transaction counterparties and client-authorised recipients; and regulators, courts or law-enforcement bodies where authorised or required.

Where a client approves an AI-supported service involving personal information, an approved AI provider or integration may process the minimum information reasonably required. The provider, purpose, permitted information and material overseas handling are recorded in the Service Schedule, project record or a specific notice where appropriate.

For international work, relevant business-contact, product, order or shipment information may be disclosed to recipients in the countries involved. We limit disclosure to what is reasonably necessary for the authorised purpose.

Provider roles and protections

A provider may act as our processor for service data and as an independent controller for its own account, billing, security and usage information. Provider privacy policies govern information the provider controls. A provider data-processing addendum governs customer data processed on our behalf where it forms part of, or applies to, our provider account.

An integrated enterprise cloud provider supplies our CRM, files, communications, workflow and other core business systems. A global network and website-security provider supports DNS, website delivery, performance, traffic management and security and may process request, device, security, cookie and form-traffic information.

Provider assurance standards and controls

Depending on the provider, selected service and current audit scope, material infrastructure services may be covered by ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 27018, ISO/IEC 27701, ISO/IEC 20000-1, ISO 22301, ISO 9001, SOC 1 Type II, SOC 2 Type II or CSA STAR assurance.

Technical and contractual controls may include TLS transport encryption, encryption at rest where supported, role-based access, multi-factor authentication, logging, backup and continuity controls, confidentiality, data-processing terms, subprocessor obligations, cross-border safeguards, incident notification, rights-request assistance and return or deletion processes.

These certifications, attestations and controls belong to the relevant providers and apply only to the entities, services, systems, locations and audit periods identified by those providers. They do not mean New World Circle itself is ISO-certified, SOC-audited or otherwise covered by a provider's assurance program. Provider documents, audit scopes and subprocessors may change.

Storage and overseas handling

Our core business systems are configured and administered from Australia. Depending on account configuration, support, backup and continuity arrangements, core business records may be stored or processed in Australia and Cyprus (European Union).

Our website-delivery and security provider may process limited website, network, request, device and security information in Australia, the United States, the European Economic Area, the United Kingdom, Singapore, India, Japan, Canada and other locations required for global network delivery and support. International project information may also be disclosed to recipients in client-selected origin, destination or project countries. Where practicable, those countries and recipients are identified in a service schedule, project file or collection notice. We take reasonable steps required by applicable law before cross-border disclosure.

Security, retention and data incidents

Security and retention

Our controls are designed around the nature, volume and sensitivity of the information handled. Where appropriate, they include data minimisation, named-user access, role-based permissions, multi-factor authentication, access reviews, encryption where supported, secure configuration, logging, backups, malware and abuse controls, incident-response procedures, confidentiality obligations and provider review.

No internet or storage system is completely secure, and we cannot guarantee absolute security. We retain information for as long as reasonably needed for the purpose collected, to provide and defend services, meet legal, tax, accounting, security and insurance requirements, resolve disputes and enforce agreements. When no longer required, information is deleted, destroyed or de-identified where reasonably practicable, subject to backup cycles and lawful retention.

Client-controlled personal information

Where a client controls personal information and New World Circle processes it only to provide agreed services, the client remains responsible for lawful collection, required notices and permissions, the accuracy of its instructions and deciding what information is necessary. We process that information on documented client instructions except where law requires otherwise.

Clients must not provide sensitive, identity, health, payment-card or other restricted information unless the need, authorised systems, recipients, access controls, retention and incident process have been agreed in writing. We may refuse or isolate information outside the agreed purpose or presenting an unreasonable risk. Subject to legal retention duties and provider capabilities, we will reasonably assist with access, correction, export, return, deletion and breach-response requests relating to client-controlled information.

Data incidents and notifiable breaches

We assess suspected data incidents promptly and take reasonable steps to contain the incident, preserve relevant evidence, identify affected information and people, reduce further harm and coordinate remediation.

Where the Notifiable Data Breaches scheme applies, we assess whether an incident is likely to result in serious harm. If an eligible data breach occurs and no exception applies, we notify the Office of the Australian Information Commissioner and affected individuals in accordance with the Privacy Act. We also notify an affected client where required by contract or where the incident is likely to materially affect the client or individuals connected with its data.

Cookies, direct marketing, AI and automation

Cookies and website analytics

The website may use cookies and similar technologies for essential operation, security, preferences and, where configured and disclosed through consent controls, analytics or marketing measurement. Browser settings can restrict cookies, although some functions may not work correctly. We update this policy if analytics, advertising pixels or consent configuration changes materially.

Direct marketing

We send commercial electronic messages only where consent or another lawful permission applies. Messages identify New World Circle and provide a functional unsubscribe method. We action unsubscribe requests within the period required by law and do not require an individual to create or log in to an account to opt out.

AI, automation and personal information

We may use approved AI and automation to route enquiries, schedule work, create reminders, summarise or classify information, assist research, draft or review content, support data analysis, translation, transcription, coding, campaigns, CRM records and agreed service workflows. These tools support our personnel; they do not remove our responsibility for personal information or the work we deliver.

Personal information may appear in an AI input, retrieved context, system log or generated output. Inferred, incorrect or artificially generated information about an identified or reasonably identifiable person is handled as personal information. We take reasonable steps appropriate to the risk to check accuracy before using or disclosing AI-supported information.

Controls for approved AI use

Confirm the use is reasonably necessary, lawful and consistent with the collection purpose.
Record the approved purpose, system, accountable person and permitted data.
Minimise, de-identify or mask information where practicable.
Use approved business accounts, access restrictions, retention settings and controls intended to prevent provider training on submitted business data where available.
Prohibit passwords, authentication secrets, payment-card data, sensitive information and highly confidential records from public or unapproved AI tools.
Test and monitor material systems for accuracy, bias, security, privacy and unintended outcomes.
Apply meaningful human review before a material action, publication or decision.
Maintain records and processes for complaints, correction, suspension and incident response.

We do not use Client Confidential Information or bespoke Client Materials to train a general-purpose model for unrelated customers. Model training, fine-tuning or retrieval using client information requires specific written authority and documented data, security, ownership, retention and deletion arrangements.

At the effective date, we do not ordinarily arrange for a computer program to act as the sole decision-maker on a decision using personal information that could reasonably be expected to significantly affect an individual's rights or interests. We do not permit a high-impact AI decision without documented authority, testing, an accountable human reviewer, an appropriate explanation and a review path. If those practices change, we will update this policy as required, including for the automated-decision privacy-policy obligations commencing 10 December 2026.

Access, correction, complaints and changes

An individual may request access to or correction of personal information, ask a privacy question or make a complaint by emailing [email protected]. A request does not need to use a particular form. We may need to verify identity before releasing or changing information.

Privacy contact: [email protected]
Registered office and postal address: Level 2, 457–459 Elizabeth Street, Surry Hills NSW 2010, Australia
Response approach: We acknowledge and investigate complaints fairly and aim to respond within 30 days where practicable.

If a person is not satisfied after giving us a reasonable opportunity to respond, they may contact the Office of the Australian Information Commissioner where the Privacy Act applies. Other contractual or statutory complaint rights may also apply.

Changes to this policy

We may update this policy when our services, systems, data flows or legal obligations change. The website version shows the current effective date. Material changes affecting an active client service will be communicated where reasonably appropriate. A copy in another accessible form may be requested through the privacy contact.

Collection notice for enquiries and onboarding

Short notice. New World Circle Pty Ltd collects contact, business, project, billing and technical information through enquiries and onboarding to assess and administer an engagement, provide services, maintain security, invoice and comply with law.

Billing information may include customer type, legal business or individual name, Tax ID or registration number, nominated billing email, telephone number, country and billing address, currency, invoice references and limited internal account metadata.

We may share information with personnel, approved enterprise cloud, billing, website-security, project-specific AI or other technology providers where authorised, advisers, client-authorised platforms, suppliers and project participants. Core business records may be stored or processed in Australia or Cyprus (European Union). Website security, technical, approved AI-workflow and international project information may also be processed in the United States, other current provider locations and client-selected project countries.

If required information is not provided, we may be unable to respond, open the customer record, issue an accurate invoice or provide services. Contact [email protected] for access, correction or complaints.