We take privacy seriously
When you trust Cotchy with your business, you trust us with your information too. This page explains what information we collect, how we use it, and the steps we take to keep it secure.
No funny business. Just responsible data handling.
This Privacy Policy sets out the approach which Cotchy will take in relation to the treatment of Personal Information. It includes information on how Cotchy collects, uses, discloses and keeps secure, individuals’ Personal Information. It also covers how Cotchy makes the Personal Information it holds available for access to and correction by the individual.
Effective Date: 3 July 2026 | Last Reviewed: 3 July 2026
This Privacy Policy applies to all personal information collected by Cotchy Pty Ltd (ABN 96 633 381 754) through its website, marketing activities, and professional services.
1. About Us
Cotchy Pty Ltd (‘Cotchy’, ‘we’, ‘us’, ‘our’) is an Australian accounting, bookkeeping, business advisory, and Virtual CFO (VCFO) services firm based in Melbourne, Victoria. We are committed to protecting the privacy and security of your personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
This policy explains how we collect, use, disclose, store, and protect your personal information, including through the third-party services and technologies we use to operate our business. A full list of the specific third-party services we use is set out in Section 16 of this policy and is updated whenever our technology stack changes.
2. What Personal Information We Collect
2.1 Information You Provide – Leads and Enquirers
When you submit an enquiry or complete a quiz or assessment on our website, we may collect:
- Name, email address, phone number, and business name
- Business turnover and other financial indicators
- Details about your business structure, challenges, or service needs
This information is collected for lead qualification and to tailor our service recommendations to your business. It is stored in our CRM platform and is not used for any purpose other than assessing your suitability for our services and following up on your enquiry.
Business turnover and related financial information collected at the enquiry stage is treated with the same care as client financial data, and is only accessible to authorised Cotchy staff involved in the sales and onboarding process.
2.2 Information You Provide – Clients
Once you engage Cotchy for services, we collect additional information required to deliver those services, including:
- Financial and accounting records (including ABN, tax file information, bank details, and transaction records)
- Business entity documents and corporate records
- Billing and payment information
- Ongoing correspondence and instructions
2.3 Information Collected Automatically
When you visit our website (cotchy.com.au), we and our third-party technology partners may automatically collect:
- IP address and approximate location
- Browser type, device type, and operating system
- Pages visited, time on site, and referring URL
- Cookie identifiers and similar tracking technologies
- Events and interactions on our website (e.g. form submissions, button clicks, page views)
3. How We Collect Personal Information
We collect personal information through the following means:
- Direct submission via our website contact forms and enquiry pages
- Completion of quizzes and assessments hosted on our website via third-party form tools
- Email, phone, or in-person communication
- Our client engagement and onboarding process
- Cookies, pixels, and server-side tracking technologies on our website (see Section 5)
- Referrals from third parties or business partners
4. Why We Collect and Use Your Information
We collect and use personal information for the following purposes:
- Qualifying leads and assessing suitability for our services, including through quiz and assessment tools on our website
- Using business financial information (such as turnover) provided at the enquiry stage to tailor service recommendations
- Providing accounting, bookkeeping, taxation, business advisory, and Virtual CFO (VCFO) services
- Managing your client account, including billing and correspondence
- Responding to enquiries and providing quotes or proposals
- Sending service-related communications and updates
- Sending marketing communications, including email newsletters, SMS messages, and promotional material (where you have consented or where permitted by law)
- Running targeted advertising campaigns on social media platforms
- Improving our website, services, and marketing effectiveness
- Complying with our legal and regulatory obligations, including under the Corporations Act 2001 and tax legislation
- Internal business administration, planning, and reporting
5. Cookies, Tracking Technologies, and Third-Party Services
We use cookies and other tracking technologies on our website. Some of these are operated by third-party service providers who may collect and process your personal information on our behalf or for their own purposes. The categories of third-party services we use include:
5.1 Customer Relationship Management (CRM)
We use a CRM platform to manage enquiries, client records, and marketing communications. When you submit a form or enquiry on our website, your contact details and interaction history are stored within this system. The CRM provider may place cookies on your browser to track your website interactions and email engagement. Data is stored on servers located overseas, primarily in the United States.
5.2 Server-Side Tag Management
We use a server-side tag management solution to control and route data from our website to third-party platforms such as our advertising providers. This service processes data including IP addresses, browser and device information, website event data, and cookie identifiers on our behalf. Server-side tagging gives us greater control over what data is shared with third parties. Data may be processed on servers located in the European Union or United States.
5.3 Social Media Advertising
We run paid advertising campaigns on social media platforms including Meta (Facebook and Instagram) and LinkedIn. These tools are used for two purposes: lead generation and qualification (to attract prospective clients who match our target profile) and retargeting (to re-engage people who have previously visited our website or interacted with our content).
When you visit our website, these platforms may collect your IP address, browser information, and event data (such as page views and form completions) via tracking pixels and server-side conversion APIs. This information may be matched to your profile on those platforms if you are logged in.
We may also use Custom Audience and Matched Audience features, which involve uploading hashed (encrypted) contact information – such as email addresses – to these platforms to identify existing contacts for advertising purposes.
Data collected via these tools may be used by the platforms for their own purposes, including showing you advertisements beyond our website. Data is stored on the platforms’ servers, primarily in the United States.
You can manage your advertising preferences directly within each platform. Opt-out links for each provider are listed in Section 16 of this policy.
5.4 Website Analytics
We use website analytics tools to understand how visitors use our website, including which pages are visited and how users navigate the site. Analytics data is collected in aggregate and is used to improve our website and services. Data may be processed on servers located in the United States.
5.5 Forms and Quiz Tools
We use a third-party form and quiz platform to host lead qualification assessments on our website. When you complete a quiz, your responses – including name, email address, phone number, business name, and business turnover – are collected and stored by that platform before being transferred to our CRM via our workflow automation tool.
This financial information is collected solely to assess your business needs and tailor our service recommendations. It is not used for any other purpose and is not shared beyond our CRM and authorised Cotchy staff.
Data collected via our quiz platform may be processed on servers located in the United States. The specific provider is listed in Section 16 of this policy.
5.6 Cookies
Our website uses cookies – small text files stored on your device – to enable certain functionality, analyse website usage, and support our marketing activities. We use the following categories of cookies:
Strictly Necessary Cookies
These cookies are essential for the website to function and cannot be switched off. They are set in response to actions you take, such as setting your privacy preferences or filling in forms. No personal information is stored in these cookies beyond what is needed to operate the site.
Functional Cookies
These cookies allow the website to remember choices you have made (such as your cookie consent preferences) and provide enhanced, personalised features.
Analytics Cookies
These cookies help us understand how visitors interact with our website by collecting and reporting information in aggregate. We use analytics cookies via Google Analytics. Data collected is used to improve our website and is not used to identify individual users.
Marketing and Advertising Cookies
These cookies are set by our advertising partners – including Meta (Facebook and Instagram) and LinkedIn – to build a profile of your interests and show you relevant advertisements on other platforms. They work by uniquely identifying your browser and device. We also use server-side tracking via Stape to route some of this data, which gives us greater control over what is shared.
Our CRM provider (HubSpot) also sets cookies to track your interactions with our website and emails, and to attribute form submissions to marketing activity.
Cookie Consent and Your Choices
When you first visit our website, you will be presented with a cookie consent notice allowing you to:
- Accept all cookies, including analytics and marketing cookies
- Reject all non-essential cookies
- Customise your preferences by category
If you reject non-essential cookies, analytics and marketing tracking tools – including Meta Pixel, LinkedIn Insight Tag, HubSpot tracking, and Stape-routed events – will not be activated during your visit.
You can update your cookie preferences at any time using the cookie settings link in our website footer. You can also manage cookies directly in your browser settings, or opt out of interest-based advertising via your social media platform settings.
5.7 Third-Party Services – Full List
The specific third-party platforms we currently use are listed in Section 16 of this Privacy Policy. Each entry includes the provider name, purpose, data location, and a link to their privacy policy. We update that section whenever we add, remove, or change a provider.
6. Disclosure of Personal Information
6.1 Third-Party Service Providers
We disclose personal information to third-party service providers who assist us in operating our business. These providers fall into the following categories:
- CRM and marketing automation providers
- Form and quiz platform providers
- Server-side tag management providers
- Social media advertising platforms
- Website analytics providers
- Accounting, bookkeeping, and financial reporting software providers
- Client engagement and proposal platforms
- Workflow automation tools
- Phone system and SMS communications providers
- Payment processors and banking institutions
- Professional indemnity insurers (where required)
All providers are required to handle your information in accordance with our instructions and applicable privacy laws. The full list of specific providers is in Section 16 of this policy.
6.2 Legal and Regulatory Disclosure
We may disclose personal information to government agencies, regulatory bodies, courts, or law enforcement where required or permitted by law, including obligations under Australian taxation legislation and the Corporations Act 2001 (Cth).
6.3 Business Transfers
In the event of a merger, acquisition, or sale of all or part of our business, your personal information may be transferred to the relevant third party. We will take reasonable steps to ensure your information remains protected.
7. Overseas Disclosure of Personal Information
Some of the third-party service providers we use store and process data on servers located outside Australia, primarily in the United States and the European Union. The countries applicable to each provider are listed in Section 16 of this policy.
Before disclosing personal information to overseas recipients, we take reasonable steps to ensure those recipients handle your information in a manner consistent with the Australian Privacy Principles, including through Data Processing Agreements and recognised data transfer mechanisms such as Standard Contractual Clauses.
By using our website and consenting to cookies, you consent to the transfer of relevant personal information to overseas recipients for the purposes described in this policy.
Where we are unable to ensure an overseas recipient will comply with the APPs, we will seek your express consent before making the disclosure, or rely on a permitted exception under the Privacy Act.
8. Marketing Communications
8.1 Email Marketing
We may send you marketing communications by email, including newsletters, service updates, and promotional offers. We will only do so where you have:
- Opted in at the time of enquiry or engagement (express consent); or
- Engaged with our services and the communication relates to similar services we provide (inferred consent under the Spam Act 2003)
Every marketing email will include a clear unsubscribe link. You can opt out at any time by clicking that link or emailing support@cotchy.com.au. Opting out of marketing emails does not affect service-related communications such as invoices or engagement letters.
8.2 SMS Communications
We may send you an SMS in response to an enquiry or action you have taken – for example, to acknowledge a form submission or let you know someone from our team will be in touch shortly. These messages are transactional in nature and are a direct response to contact you have initiated with us.
We do not send unsolicited marketing SMS messages. If we ever expand our SMS use to include marketing content, we will obtain your express consent before doing so, as required under the Spam Act 2003.
SMS is delivered via our third-party phone system provider, details of which are in Section 16 of this policy. Our sending number is registered with the Australian Communications and Media Authority (ACMA).
If you would prefer not to receive SMS from us, just let us know by emailing support@cotchy.com.au or by replying STOP to any message we send.
9. Social Media Advertising and Lead Generation
We run paid advertising campaigns on Meta (Facebook and Instagram) and LinkedIn for two purposes: lead generation and qualification, and retargeting. These ads may be shown to:
- People who match the profile of our target client base, based on demographic and interest data held by the platform (lead generation)
- Website visitors who have previously interacted with our site (retargeting)
- Lookalike or Similar Audiences created from our existing client or contact lists
On LinkedIn specifically, we may use Lead Gen Forms, which allow prospective clients to submit their contact details directly within LinkedIn. Any information submitted via a LinkedIn Lead Gen Form is governed by LinkedIn’s own privacy policy in the first instance, before being transferred to our CRM.
To opt out of seeing our ads on Meta, visit https://www.facebook.com/ads/preferences. To opt out on LinkedIn, visit your LinkedIn ad settings at linkedin.com/psettings/. You can also contact us to request removal from any Custom or Matched Audiences we have created using your contact information.
10. Data Quality and Retention
We take reasonable steps to ensure the personal information we hold is accurate, complete, and up to date. If you believe we hold incorrect information about you, please contact us and we will correct it as soon as practicable.
We retain personal information for as long as necessary to fulfil the purposes for which it was collected, including:
- Client records: for a minimum of 7 years from the end of the client relationship, as required under Australian taxation and corporate legislation
- Lead and enquiry records: for up to 3 years from the date of last contact, unless you request earlier deletion
- Website and marketing data: in accordance with the retention policies of the relevant third-party platforms
Certain third-party platforms maintain their own retention schedules that may be outside our direct control. We will assist you in making removal requests to those platforms where applicable.
11. Security of Personal Information
We take reasonable steps to protect the personal information we hold from misuse, interference, loss, and unauthorised access, modification, or disclosure. Our measures include:
- Restricting access to personal information to authorised staff and contractors with a legitimate need
- Using password-protected and encrypted systems for storing client data
- Requiring third-party service providers to maintain appropriate security standards
- Regularly reviewing our information security practices
No method of electronic transmission or storage is 100% secure. In the event of a data breach likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required under the Notifiable Data Breaches scheme.
12. Your Rights - Access and Correction
Under the Privacy Act 1988, you have the right to:
- Request access to the personal information Cotchy holds about you
- Request correction of information that is inaccurate, out of date, incomplete, or misleading
- Lodge a complaint about how we have handled your personal information
- Request deletion of your information from our marketing and CRM records (subject to legal retention requirements)
- Request removal from any social media Custom Audiences we have created using your contact information
To exercise these rights, contact us at support@cotchy.com.au. We will respond within 30 days. In limited circumstances we may decline a request, in which case we will provide written reasons.
We do not charge a fee for access requests unless the request is unusually complex or resource-intensive.
13. Complaints
If you believe we have breached the Australian Privacy Principles, please contact us at support@cotchy.com.au in the first instance. We will investigate and respond within 30 days.
If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):
- Website: www.oaic.gov.au
- Phone: 1300 363 992
- Post: GPO Box 5218, Sydney NSW 2001
14. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will post the updated policy on our website and update the effective date. We encourage you to review this policy periodically.
15. Contact Us
For privacy-related enquiries, please contact:
Cotchy Pty Ltd
ABN 96 633 381 754
Email: support@cotchy.com.au
Phone: 1800 268 249
Website: cotchy.com.au
16. Third-Party Services - Platform Directory
The following table lists all third-party platforms currently used by Cotchy, the purpose for which they are used, where data is stored, and a link to each provider’s privacy policy. This section is updated whenever we add, remove, or change a provider.
16.1 CRM and Marketing Automation
Provider: HubSpot, Inc.
Purpose: Customer relationship management, contact records, marketing emails, and website form capture
Data Location: United States
Privacy Policy: https://legal.hubspot.com/privacy-policy
16.2 Server-Side Tag Management
Provider: Stape
Purpose: Server-side processing and routing of website tracking events to advertising and analytics platforms
Data Location: European Union / United States (depending on configuration)
Privacy Policy: https://stape.io/privacy-policy
16.3 Social Media Advertising – Meta
Provider: Meta Platforms, Inc. (Facebook and Instagram)
Purpose: Lead generation and qualification advertising, retargeting website visitors, and Custom Audience creation using hashed contact data. Data is collected via the Meta Pixel and Meta Conversions API (routed through Stape).
Data Location: United States
Privacy Policy: https://www.facebook.com/privacy/policy/
Ad Preferences: https://www.facebook.com/ads/preferences
You can manage your Meta advertising preferences at the link above.
16.4 Social Media Advertising – LinkedIn
Provider: LinkedIn Ireland Unlimited Company
Purpose: Lead generation and qualification advertising, retargeting website visitors, and Matched Audience creation using hashed contact data. May include LinkedIn Lead Gen Forms to capture enquiries directly within LinkedIn.
Data Location: United States / European Union
Privacy Policy: https://www.linkedin.com/legal/privacy-policy
Ad Preferences: https://www.linkedin.com/psettings/
By submitting a LinkedIn Lead Gen Form, you are also subject to LinkedIn’s privacy policy.
16.5 Website Analytics
Provider: Google LLC (Google Analytics and Google Tag Manager)
Purpose: Website traffic analysis, user behaviour reporting, and management of tracking scripts
Data Location: United States
Privacy Policy: https://policies.google.com/privacy
16.6 Accounting Software
Provider: Xero Limited
Purpose: Accounting records, bookkeeping, financial reporting, and management reporting for client accounts
Data Location: Australia / New Zealand
Privacy Policy: https://www.xero.com/au/about/terms/privacy/
Provider: Intuit Inc. (QuickBooks)
Purpose: Accounting records, bookkeeping, and financial reporting for clients using QuickBooks
Data Location: United States
Privacy Policy: https://www.intuit.com/privacy/statement/
16.7 ATO Document Processing
Provider: ATOmate (Business Automation Works Pty Ltd)
Purpose: Automated capture, processing, and distribution of ATO correspondence to clients. Integrates with the ATO as an approved Digital Service Provider. TFNs are automatically redacted before documents are shared.
Data Location: Australia
Privacy Policy: https://atomate.com.au/privacy-policy/
16.8 Corporate Compliance
Provider: NowInfinity Pty Ltd (a Class Ltd company)
Purpose: Corporate compliance, ASIC form lodgement, company and trust establishment, legal document generation, and entity management
Data Location: Australia (Amazon Web Services)
Privacy Policy: https://www.nowinfinity.com.au/privacy
16.9 Client Engagement and Proposals
Provider: Ignition (formerly Practice Ignition)
Purpose: Client engagement letters, service proposals, and recurring billing management
Data Location: Australia / United States
Privacy Policy: https://www.ignitionapp.com/privacy
16.10 Workflow Automation
Provider: Zapier, Inc.
Purpose: Automated workflows connecting our platforms (e.g. form submissions to CRM, notifications)
Data Location: United States
Privacy Policy: https://zapier.com/privacy
16.11 Forms and Quiz Tools
Provider: Fillout (by Zite)
Purpose: Lead qualification quizzes collecting name, email, phone, business name, and business turnover. Responses pass to HubSpot via Zapier.
Data Location: United States
Privacy Policy: https://www.fillout.com/privacy
Business turnover collected via this tool is used solely to assess suitability for Cotchy’s services and is stored in HubSpot only.
16.12 Phone System and SMS
Provider: VXT Limited
Purpose: Business phone system for inbound and outbound calls, voicemail, call recording, transcription, and SMS communications
Data Location: New Zealand / Google Cloud Platform, Amazon Web Services, Microsoft Azure (international)
Privacy Policy: https://www.vxt.ai/legal/privacy-policy
VXT may collect call recordings and transcripts which could capture personal information about third parties. We do not send marketing SMS – SMS is used for transactional responses only. Recipients may opt out by replying STOP.
See what Cotchy can do for you
Whether you’re behind on your books or just ready for better support, we’re here to help.