Privacy Notice Draft
Kellridge — kellridge.com/privacy Version: Draft 0.2 — not yet approved or published (updated 27 Oct 2026) Last updated: [to confirm — date of publication]
DRAFT FOR LEGAL REVIEW. Items marked [to confirm] must be completed or checked before publication.
1. About this notice
This notice explains how Kellridge collects, uses, shares and protects personal information when you visit kellridge.com, email us, or deal with us as a client, prospective client, partner or supplier contact.
We have written it to meet the requirements of:
- the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR");
- the UK GDPR and Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003 ("PECR"), as amended by the Data (Use and Access) Act 2025;
- the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles ("APPs"); and
- the New Zealand Privacy Act 2020 and its Information Privacy Principles ("IPPs").
Where these laws differ, we aim to apply the higher standard.
2. Who we are
The organisation responsible for your personal information (the "controller" under GDPR/UK GDPR, the "APP entity" under Australian law, and the "agency" under NZ law) is:
- Legal name: Kellridge Pty Ltd, a proprietary company incorporated in New South Wales, Australia
- ACN / ABN: ACN 703 624 202 / ABN 39 703 624 202
- Privacy contact: privacy@kellridge.com
All our email addresses (hello@, privacy@, legal@ and security@) go to one mailbox, which is read by Kellridge's MD.
We do not have offices outside Australia. [to confirm]
EU and UK representative
If GDPR Article 27 or UK GDPR Article 27 requires us to appoint a representative in the EU or UK, their details will appear here:
- EU representative: [to confirm on legal advice under Art 27]
- UK representative: [to confirm on legal advice under Art 27]
3. The personal information we collect
We collect only what we need.
| Category | What it includes | How we get it |
|---|---|---|
| Email enquiries | Your name, email address, any organisation or role you mention, and the content of your message and attachments | From you, when you email us at hello@ or another Kellridge address |
| Contact form submissions | Your name, email address, organisation (if you give it) and message, plus your IP address and approximate country, which are used only to check the submission for spam and attacks | From you, when you use the form on our contact page. FormSubmit delivers the message to us by email; the website does not keep a copy |
| Client and business contacts | Name, job title, organisation, work email, phone number, and records of our communications and engagements | From you, your organisation, or publicly available professional sources (for example, an organisation's website) |
| Website server logs | IP address, date and time of request, page requested, browser and device type (user agent), referring page | Automatically, by our hosting provider Cloudflare, at its network edge when your browser loads a page. We do not run analytics on these logs |
| Bot detection | Your IP address and approximate location; browser, device, screen size and time zone; pages you visit, referring page, clicks, and when you start, submit or abandon a form (never what you type into it). A random identifier kept in your browser links these visits together | Automatically, by the HLD analytics script on our pages, which sends this to HLD Group. It is not collected if your browser sends a Do Not Track signal. We do not link it to your name or email address |
| Accessibility choices (on your device only) | Text size, high contrast, reduced motion and readable spacing settings | Saved in your browser's local storage only when you choose them in the Accessibility menu. They never leave your device and we cannot see them |
We do not ask for sensitive information (such as health, racial or ethnic origin, political opinions or biometric data). Please do not send it to us unless we have specifically asked for it in connection with an engagement.
Information we collect from other people (NZ IPP3A, APP 5, GDPR Art 14)
Sometimes we receive your details from someone else, for example a colleague who introduces you, or your organisation when it engages us. When this happens we will tell you, as soon as reasonably practicable, that we hold your information, why, who we may share it with, and how to access and correct it, unless an exception applies (for example, you already know).
4. Why we use your information and our lawful bases
| Purpose | Information used | Lawful basis (GDPR / UK GDPR) |
|---|---|---|
| Replying to your enquiry | Email enquiries; contact form submissions | Legitimate interests (responding to people who contact us); or steps before entering a contract at your request (Art 6(1)(b)) |
| Providing and managing our services, including engagements, invoicing and records | Client and business contacts | Performance of a contract (Art 6(1)(b)); legitimate interests in managing business relationships (Art 6(1)(f)) |
| Meeting legal, tax, accounting and professional obligations | Client and business contacts; relevant correspondence | Legal obligation (Art 6(1)(c)) |
| Keeping the website secure and working, and preventing abuse, including screening contact form submissions for spam and attacks | Server logs; contact form submissions and the IP address they were sent from; website analytics used by HLD Sentinel to detect bots and attacks | Legitimate interests in security and service reliability (Art 6(1)(f)) |
| Establishing, exercising or defending legal claims | Any relevant information | Legitimate interests (Art 6(1)(f)) |
Where we rely on legitimate interests, we have considered that our interests are not overridden by your rights. You can ask us for details.
For Australia and New Zealand, we collect and use personal information only for these purposes, or for directly related purposes you would reasonably expect, or as permitted by law.
Marketing: we do not currently send marketing emails. If we start, we will only do so with your consent where the law requires it, and you will always be able to opt out. [to confirm]
5. Who we share it with
We do not sell, rent or trade personal information.
We share it only with:
- Microsoft (Microsoft 365), which hosts our email and documents, as our processor/service provider;
- Cloudflare, Inc., which hosts the website, runs the contact form's server code and processes server logs, as our processor/service provider;
- FormSubmit (formsubmit.co), which delivers contact form messages to our inbox, as our service provider. It receives your name, email address, organisation and message. [to confirm — FormSubmit operator, location, retention and terms; FormSubmit is a free service without a signed data processing agreement]
- HLD Group (HLD Sentinel and HLD Website Analytics), which receives website analytics from every visit and uses them only to detect bots and attacks; and which screens contact form submissions for spam and attacks, as our processor/service provider. It receives the text you type into the form and your IP address. It keeps your IP address only as a keyed hash and records which security rules were triggered, not the text you sent. [to confirm — HLD legal entity name, location and data processing terms]
- professional advisers such as lawyers, accountants and insurers, where needed;
- subcontractors or specialist partners working on a client engagement, only where the client has agreed and under confidentiality obligations [to confirm]; and
- authorities, where the law requires it.
Our processors may only use your information on our instructions and must keep it secure under written terms (GDPR Art 28 data processing terms). [to confirm that Microsoft and Cloudflare DPAs are accepted for the Kellridge accounts]
6. International transfers
Kellridge is based in Australia, so information you send us from the UK, EU or New Zealand will be handled in Australia. Our providers may also process it in other countries, including the United States and the European Economic Area. [to confirm — Microsoft 365 data location for the Kellridge tenant; Cloudflare log processing locations]
When personal information is transferred out of the UK or EU, we rely on one of the following safeguards:
- an adequacy decision (for example, for New Zealand, or for US companies certified under the EU-US Data Privacy Framework and the UK Extension) [to confirm current certification status of Microsoft and Cloudflare];
- Standard Contractual Clauses approved by the European Commission, and the UK International Data Transfer Addendum, in our providers' data processing terms; or
- another lawful mechanism under GDPR Chapter V / UK GDPR.
[to confirm on legal advice — the transfer analysis where Kellridge itself, an Australian controller subject to GDPR under Art 3(2), receives data directly from individuals in the EU/UK. Australia does not currently have an EU or UK adequacy decision.]
For Australian information sent overseas, we take reasonable steps to make sure recipients handle it consistently with the APPs (APP 8). For NZ information, we disclose it overseas only where IPP12 permits.
You can ask us for more information about the safeguards we use.
7. How long we keep it
| Information | Retention |
|---|---|
| Email enquiries that do not lead to an engagement | Up to [to confirm — e.g. 2 years] after our last contact, then deleted |
| Client engagement records and related correspondence | For the length of the engagement and then [to confirm — e.g. 7 years] for legal, tax and professional reasons |
| Contact form security records | Our rate-limit counters hold only a keyed hash of your IP address and email address and expire within about two hours. HLD Sentinel keeps security event records (rule identifiers, field names and a hashed IP address) for [to confirm — HLD retention period] |
| Website server logs | As set by Cloudflare's standard retention for our plan [to confirm period] |
When we no longer need information, we delete or de-identify it securely.
8. How we protect it
We use reasonable technical and organisational measures appropriate to the risk, including:
- multi-factor authentication and least-privilege access to email and hosting accounts;
- encryption in transit (HTTPS/TLS) for the website and email services;
- a mostly static website with one contact form and no databases, logins or cookies. Fonts are self-hosted, a strict Content Security Policy is in place, and the only third-party script is HLD's analytics and bot-detection script. Form submissions are rate-limited, screened by HLD Sentinel, and not stored on the website; and
- keeping client information separate from other business activities.
No system is completely secure. If a data breach is likely to result in serious harm or a risk to your rights, we will notify you and the relevant regulator as the law requires (including the OAIC Notifiable Data Breaches scheme, NZ Privacy Act Part 6, and GDPR/UK GDPR Arts 33-34).
We do not claim any security or privacy certification.
9. Cookies and similar technologies
We do not use cookies, tracking pixels or advertising tags on kellridge.com.
Every page loads HLD's bot-detection script from hldgroup.org. It records how the page is interacted with (clicks, and when a form is started, submitted or abandoned, never what you type) so HLD Sentinel can tell people from automated attacks. It does not record scroll depth, heatmaps, performance or errors, and the data is used only for security. It keeps one item in your browser's local storage (hlda.v1), holding a random identifier and session details. If your browser sends a Do Not Track signal, the script records nothing.
The site also stores your Accessibility menu choices in local storage, only after you select them. They are not sent to us or anyone else.
Our hosting provider, Cloudflare, may process technical information such as your IP address to deliver the site securely and protect it from attacks. [to confirm — whether Cloudflare sets any security cookie on our plan/configuration; if so, list it here as strictly necessary]
See our Cookies and storage page for details.
10. Automated decision-making
Contact form submissions are checked automatically. A submission that looks like an attack is refused, and one that looks like spam or comes from a bot is discarded. This affects only whether that message reaches us; it does not affect your rights, and you can always email us at hello@kellridge.com instead.
We do not make decisions about you using solely automated processing, including profiling, that produce legal or similarly significant effects (GDPR/UK GDPR Art 22).
For the Australian Privacy Act (APP 1.7-1.9, which applies from 10 December 2026): we do not use computer programs to make, or do anything substantially and directly related to making, decisions that could reasonably be expected to significantly affect your rights or interests using your personal information. If this changes, we will update this notice and explain the kinds of personal information used and the kinds of decisions involved.
11. Your rights
You can contact privacy@kellridge.com at any time to exercise your rights. We will respond within the legal time limit (generally one month under GDPR/UK GDPR, 30 days under the Australian Privacy Act, and 20 working days under the NZ Privacy Act). We may need to confirm your identity first. We do not charge a fee unless the law allows it.
If you are in the EU or UK, you have the right to:
- access your personal information;
- correct inaccurate information;
- have your information erased;
- restrict how we use it;
- object to our use of it based on legitimate interests, and to any direct marketing;
- data portability; and
- withdraw consent at any time, where we rely on consent.
If you are in Australia, you can ask to access and correct the personal information we hold about you (APPs 12 and 13). You can deal with us anonymously or using a pseudonym where that is practical (APP 2).
If you are in New Zealand, you can ask to access and correct the personal information we hold about you (IPPs 6 and 7). We follow all 13 IPPs, including IPP3A (telling you when we collect your information from someone else, in force from 1 May 2026) and IPP12 (sending information overseas).
If you are in Canada, the Personal Information Protection and Electronic Documents Act (PIPEDA) may apply to our handling of your information. You can access and ask us to correct it, withdraw consent (subject to legal or contractual limits), and complain to the Office of the Privacy Commissioner of Canada (https://www.priv.gc.ca/en/report-a-concern/). [to confirm on legal advice whether PIPEDA applies]
If you are in the United States, we do not sell or share personal information for targeted (cross-context behavioural) advertising, and we do not use sensitive personal information. We do not believe US state privacy laws (such as the California Consumer Privacy Act) currently apply to Kellridge because of their size and activity thresholds, but we will give the same rights to access, correct and delete on request. [to confirm on legal advice]
12. How to complain
Please contact us first at privacy@kellridge.com so we can try to fix the problem. We aim to respond within [to confirm — e.g. 30 days].
You can also complain to a regulator:
| Where you are | Regulator | Website |
|---|---|---|
| United Kingdom | Information Commissioner's Office (ICO) | https://ico.org.uk/make-a-complaint/ |
| European Union / EEA | The data protection supervisory authority in your country (where you live, work, or where the issue arose) | List of authorities: https://www.edpb.europa.eu/about-edpb/about-edpb/members_en |
| Australia | Office of the Australian Information Commissioner (OAIC) | https://www.oaic.gov.au/privacy/privacy-complaints |
| New Zealand | Office of the Privacy Commissioner (OPC) | https://www.privacy.org.nz/your-rights/making-a-complaint/ |
| Canada | Office of the Privacy Commissioner of Canada | https://www.priv.gc.ca/en/report-a-concern/ |
The OAIC usually expects you to complain to us first and allow 30 days for a response. [to confirm current OAIC and OPC complaint URLs before publication]
13. Children
Our website and services are for businesses and professionals. They are not directed at children, and we do not knowingly collect personal information from anyone under 16 (or the relevant age in your country).
14. Links to other websites
Our site may link to other websites. We are not responsible for their privacy practices, so please read their privacy notices.
15. Changes to this notice
We will update this notice when our practices or the law change. We will show the new date at the top. If a change significantly affects you, we will take reasonable steps to tell you.
16. Contact us
Privacy enquiries: privacy@kellridge.com General enquiries: hello@kellridge.com Legal notices: legal@kellridge.com