Russell Kennedy Privacy Policy

The Russell Kennedy Privacy Policy explains in general terms how our organisation protects personal information in compliance with Australian privacy laws. Our Privacy Policy lays down the principles by which we collect, store, use and disclose any personal information you provide to us or we collect from other sources. Our Privacy Policy also informs people how they can access their personal information, correct personal information held by us and lodge complaints.

Russell Kennedy may modify, amend or replace this Privacy Policy from time to time to take account of new laws and technology, changes to our operations and practices and to make sure it remains appropriate to the changing legal environment. The modified, amended or replaced policy will be posted to our website.

This Privacy Policy applies to all personal information collected by or on behalf of Russell Kennedy, including personal information about any of our clients, suppliers, job applicants and other contacts of the firm, as well other people relevant to the legal services we provide to our clients. It applies to any person who contacts Russell Kennedy via telephone, email or letter, subscribes (electronically or otherwise) to any of our publications, accessing our websites or other online platforms or when contacting us in person.

The handling of employee records by a private sector employer is exempt from the Privacy Act if it is directly related to the employee’s current or former employment relationship. However, generally, personal information of employees will be handled in accordance with this Privacy Policy. If you have questions regarding the handling of your information as an employee, you can contact our Privacy Officer on the details below for assistance.

Policy

Words in this policy

Set out below are some specific terms we use in this policy along with their meaning:

Russell Kennedy means the Russell Kennedy Partnership, Russell Kennedy Pty Ltd as nominee for the Russell Kennedy Partnership, Russell Kennedy Pty Ltd as trustee for the RKNSW Unit Trust, R K& C Services Pty Ltd as trustee for the R K& C Services Trust, RK DocsConnect Pty Ltd and any of their related or associated entities.

we and us refer to Russell Kennedy and our has a similar meaning.

personal information means information or an opinion about an identified individual, or a reasonably identifiable individual.

sensitive information means personal information relating to a person’s racial or ethnic origin, political opinions, membership of a political association, religious beliefs or affiliations, membership of a trade union or other professional or trade association membership, philosophical beliefs, sexual orientation or practices, or criminal record. It also includes health or genetic information about an individual or biometric information used for specific purposes.

We will only:

• collect sensitive information where you agree and it is reasonably necessary for our functions and activities;
• use and disclose sensitive information for the purpose for which it was collected or a directly related secondary purpose that you would reasonably expect unless you agree otherwise,

or the collection, use or disclosure of the sensitive information is otherwise authorised or required by law.

Privacy Act refers to the Privacy Act 1988 (Cth).
APPs refer to the Australian Privacy Principles incorporated in the Privacy Act.

What kinds of personal information does Russell Kennedy collect and hold?

Russell Kennedy collects and holds a range of personal information about clients, suppliers, job applicants and other contacts of the firm, as well other people relevant to the legal services we provide to our clients.

For most people, this may include your personal or business contact details, such as your name, mailing address, telephone number and email address.

If you have applied to work at Russell Kennedy or provide services as a contractor, this may include resumes, employment histories and qualifications, training records and competency assessments, references, and professional development history.

If we have been engaged to provide legal services on a matter for you or that pertains to you, we may collect other personal information that is relevant to the matter.

We may also collect some sensitive information where necessary or appropriate, for example, health or medical information, racial or ethnic background, religious background, sexual orientation, professional memberships or criminal record.

(a) Verification of Identity (VOI)

In accordance with our legal and regulatory obligations, including under the ARNECC Model Participation Rules, relevant conveyancing legislation, and the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 as in force from 1 July 2026, we are required to verify the identity of particular clients. To facilitate this process, we may use LiveSign, or other secure digital platforms that enable remote VOI checks. This involves collecting and storing personal and some sensitive information and identity documents such as passports, driver licences, and facial biometric data. The information collected through LiveSign or such platform is used solely for the purpose of verifying your identity and is handled in accordance with the APPs. We ensure that any third-party providers we engage adhere to strict data protection standards, and we take all reasonable steps to safeguard your information and limit disclosure to circumstances required by law or authorised by you.

(b) RK DocsConnect

The associated entity RK DocsConnect Pty Ltd (RKDC),also offers template documents, including for providers of aged care and disability services. RKDC will collect and use your personal information when you sign up to use its services and purchase its templates. The personal information may include basic contact information provided to register your account.

(c) Credit Reporting

Russell Kennedy may collect and disclose personal information to credit reporting bodies for the purpose of assessing creditworthiness or managing overdue accounts, in accordance with the Privacy Act and the Privacy (Credit Reporting) Code 2024. Please see our Credit Policy available here for more information.

How Russell Kennedy collects your personal information

In all cases Russell Kennedy collects personal information by lawful and fair means. We may collect your personal information when you or the business you work for:

• make an enquiry with us;
• engage us to provide legal or other services for you;
• are related to and involved in legal services we provide to a client;
• subscribe to any of our publications, register to attend an in-person or online event, or access our website or other online platforms;
• have business dealings with us, such as supplying goods or services to us; or
• apply for employment with us.

Generally, we endeavour to collect personal information directly from the individual concerned. However, if this is not practicable, we may collect personal information about individuals from third parties, including from publicly available sources, for example, if the information pertains to legal services we are providing to a client.

(a) Russell Kennedy's use of cookies

When you visit our website, our server attaches a small data file called a “cookie” to your computer’s memory.

Cookies are pieces of information that may be transferred to your computer’s memory when you visit a website for record keeping purposes. Most web browsers are set by default to accept cookies. If you do not wish to receive any cookies from us, you should set your web browser to refuse cookies.

At Russell Kennedy, we use cookies to provide us with aggregate (anonymous) information on how people use our website, and to help us to know what they find interesting and useful on our website. We do not link this information to your identity or to any other information provided by you. There is no information identifying you stored inside any cookies.

As most website owners and operators do, Russell Kennedy tracks usage patterns on our website on an anonymous aggregate basis. Each time you visit our website a web server makes a record of your visit.

Specifically, it records your:

• internet Service Provider;
• date and time of your visit;
• pages accessed and the documents downloaded;
• search items entered; and
• referring URLs (universal locators).

This information will not ordinarily be personal information, because you will not be identified, or reasonably identifiable from it.

The purposes for which Russell Kennedy may collect, hold, use and disclose information

Russell Kennedy collects personal information only where reasonably necessary for one or more of the functions and activities connected to the operations of our law firm and associated entities. We collect personal information for the primary purposes of:

• providing clients with legal advice and other products;
• considering making offers of employment or for contracted employment purposes;
• receiving services provided by you or your employer; and
• advising you of legal developments, seminars and events and in the conduct of marketing activities.

Generally, you will have the option of not identifying yourself or of using a pseudonym when you deal with us. However, if you or a related party are seeking legal advice or representation it is usually impracticable, and sometimes in breach of law, for us to provide that legal advice without knowing your true identity. If you or the related party choose to not give your personal information to us, we may not be able to provide you or them with legal advice. 

How Russell Kennedy uses or discloses your information

Generally, Russell Kennedy uses and discloses personal information only for the primary purpose for which we collect it. As an example, if you provide us with personal information in the course of instructing us to give legal advice or run litigation, we may disclose this information to:

• barristers or experts engaged in any matter to which you are a party;
• external service providers, including those who provide litigation support, IT and software, data storage, marketing and advertising services;
• courts, tribunals and regulatory authorities; or
• our insurers and professional advisors, including accountants.

We may also use personal information for a secondary purpose related to the primary purpose for which you would reasonably expect us to use the collected information, or where otherwise permitted or required by law, for example, where Russell Kennedy believes that the use or disclosure is reasonably necessary for the establishment, exercise or defence of a legal or equitable claim.

We will not disclose personal information collected by us to third parties for the purpose of allowing them to direct market any products and services to you without your express consent.

(a) Direct Marketing

We may use your personal information, and share it with our associated entities, to provide you with updates on areas of law and information about our services, unless you request not to receive such communications from us. You may also subscribe to our newsletters or specific industry alerts. Russell Kennedy makes sure that each subscriber is consenting and expects to receive such information from us.

All of our direct marketing communications contain a facility whereby you can opt out of receiving future communications. You may also at any time separately request not to receive direct marketing communications from us. We will comply with all such requests as soon as reasonably possible.

(b) Artifical Intelligence

We may use Artificial Intelligence (AI) technologies to enhance the delivery of our legal services, improve operational efficiency, and support client engagement. This may include the use of AI-powered tools for document review, legal research, identity verification, and administrative automation. In some cases, these tools may be provided by trusted third-party platforms. Any personal information processed by AI systems is handled in accordance with the APPs and our broader privacy obligations. We ensure that appropriate safeguards are in place to protect your data, and we do not use AI to make decisions that have legal or significant effects on individuals without human oversight.

(c) Automated Decision-Making

In limited circumstances, we may use systems that involve automated decision-making to support the delivery of legal and administrative services. These systems may assist with tasks such as identity verification, risk assessment, or document classification. However, we do not rely solely on automated processes to make decisions that have legal or significant effects on individuals. All such decisions are subject to human review and oversight. Any personal information processed through automated systems is handled in accordance with the Australian Privacy Principles (APPs), and we take reasonable steps to ensure transparency, fairness, and accuracy in the use of these technologies.

(d) Business Sale or Restructuring

In the event of a proposed sale, merger, acquisition, or restructuring of our business, we may need to disclose personal information to potential buyers, investors, or advisors as part of the transaction. Any such disclosure will be conducted under strict confidentiality arrangements and in accordance with the APPs. We will only share personal information to the extent necessary for the transaction and will take reasonable steps to ensure that any recipient handles the information securely and lawfully. If the transaction proceeds, personal information may be transferred to the new entity, which will be required to comply with this privacy policy or an equivalent standard.

Disclosure of your personal information to overseas recipients

Russell Kennedy may disclose personal information about an individual to overseas recipients, for instance, to an overseas law firm for the purpose of obtaining legal advice relevant to that jurisdiction, or require that you do so that we may comply with our legal obligations when providing you with certain legal services However, in both cases, personal information about an individual will not be sent outside Australia without obtaining the consent of the individual (in some cases this consent will be implied) or otherwise complying with the Australian Privacy Principles and other applicable privacy legislation.

Russell Kennedy may use online or ‘cloud’ service providers to store or back up personal information and to provide services to us that involve the use of personal information, such as services relating to email and data storage. This personal information may be stored in the ‘cloud’ which means that it may reside on a cloud service provider’s server that may be situated outside Australia.

If we send your personal information to an overseas recipient, or request that you do, Russell Kennedy will take reasonable precautions to ensure that the recipient complies with the Australian Privacy Principles (APPs) or is otherwise subject to laws or contractual obligations that protect your information in a manner substantially similar to the protections offered under Australian law.

(a) Disclosure to Ally Law Network

As a member of Ally Law, a global network of independent law firms, we may disclose limited personal information - such as client names - to Ally Law or its member firms when referring a matter internationally. This disclosure is necessary to facilitate the referral, coordinate legal services across jurisdictions, and support the network’s internal processes for monitoring and managing referrals. Any such disclosure is made in accordance with the APPs, and we take reasonable steps to ensure that the information is handled securely and only used for the intended purpose. We do not disclose sensitive or case-specific information without your prior consent.

(b) Your disclosure to third party providers

Pursuant to our obligations under the and the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 as in force from 1 July 2026, we are required to complete identification verification of some clients and related parties in order to provide certain legal services. We use third party providers to perform these services, who may have teams in other countries, and you are requested to provide the personal and sometimes sensitive information to the third parties and your explicit consent is obtained by them prior to you doing so. We ensure that any third-party providers we engage adhere to strict data protection standards.

How Russell Kennedy holds and secures your personal information

Russell Kennedy takes all reasonable steps to protect personal information it holds from misuse, interference and loss, as well as unauthorised access, modification or disclosure. We maintain a high level of both technical and organisational security over all data held by us.

Your personal information may be stored by us either in hard copy documents or as electronic data in our information technology systems. Russell Kennedy upholds physical security measures over our hard copy and electronic data stores and premises, such as locks, alarms and barrier systems. In respect of our electronic data, we maintain a high level of computer and network security.

Accuracy of information

Russell Kennedy commits to ensuring that all reasonable procedures are followed to ensure your personal information is accurate, complete, and up to date whenever we collect or use it. If we believe the information we hold is inaccurate, out-of-date, irrelevant, incomplete or misleading, we will take steps to correct the information.

If you suspect that any of your personal information held by Russell Kennedy is inaccurate, out-of-date, irrelevant, incomplete or misleading, please contact us immediately and we will take all reasonable steps to correct any such information. We reserve the right to verify your identity before processing a correction request.

Gaining access to personal information held by Russell Kennedy

You are entitled to access the personal information we hold about you. All enquiries should be directed to Russell Kennedy’s Director – Legal & Risk (see below).

We will respond to such requests within a reasonable period. We are entitled under the APPs to charge a reasonable fee to cover the costs we incur in providing access.

We reserve the right to refuse access where an exception applies, for example, where releasing the information would unreasonably impact the privacy of another individual. Alternatively, we reserve the right to redact the information made available, to protect the privacy of other individuals. We also reserve the right to verify the identity of the person requesting the information and their entitlement to access it. 

Lodging a complaint

If you wish to make a complaint to Russell Kennedy about how we handle your personal information we ask that you make the complaint in writing to our Director – Legal & Risk (see below).

We will promptly acknowledge receipt and will respond to you within a reasonable time period (generally within 30 days). Where the complaint requires a more detailed investigation, the complaint may take longer to resolve, and we will keep you updated as to progress.

We reserve the right to verify the identity of the individual making the complaint and to seek further information from the complainant about the circumstances of the complaint. We also reserve the right to refuse to investigate or to otherwise deal with a complaint where permitted under the Privacy Act. For example, we may refuse to investigate or to otherwise deal with a complaint if we consider the complaint to be vexatious or frivolous.

If you are not satisfied with our response to your complaint, or you consider that Russell Kennedy may have breached the APPs or the Privacy Act, you can make a complaint to the Office of the Australian Information Commissioner (OAIC).

Office of the Australian Information Commissioner
Postal address: GPO Box 5288 Sydney NSW 2001
Phone: 1300 363 992
Email: foi@oaic.gov.au
Website: www.oaic.gov.au

Contacting us

Should you wish to make any query related to your personal information held by Russell Kennedy or our Privacy Policy, please contact our privacy officer (Director – Legal & Risk):

Director – Legal & Risk
Russell Kennedy Pty Ltd
Level 18, 500 Bourke Street, Melbourne
Tel: 03 9609 1555
privacy@rk.com.au