Bare Digital Pty Ltd · Version 1.0 · Effective 4 September 2026 · ACN 641 067 923 · ABN 78 437 341 715
This policy covers two things: how we handle information about people who visit our website or contact us, and how we handle information belonging to our clients and their customers while we are doing work for them.
Bare Digital Pty Ltd (ACN 641 067 923, ABN 78 437 341 715) trading as Bare Digital (we, us, our) is a business-to-business digital agency based in Leederville, Western Australia.
This policy explains how we handle personal information in two situations: information about people who visit our website or contact us, covered in Part A, and information belonging to our clients and their own customers that we access while delivering work, covered in Part B.
Bare Digital is a small business and is not currently an APP entity under the Privacy Act 1988 (Cth). We handle personal information in accordance with the Australian Privacy Principles as a matter of policy, and we will comply with the Act in full if the small business exemption ceases to apply to us.
Personal information is information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether or not it is true and whether or not it is recorded in a material form. We use the meaning given in the Privacy Act 1988 (Cth).
Enquiry form. Our contact form collects your name, company, email address and the content of your message. All four are needed to answer you.
Email, phone and LinkedIn. If you contact us directly we hold whatever you choose to send, including your contact details and the content of the exchange.
Newsletter. If you subscribe we hold your email address and any name you give us.
Proposals and engagements. If we quote for work we hold the contact details of the people involved, along with the correspondence and documents relating to that engagement.
We do not collect sensitive information as defined in the Privacy Act, and we ask that you do not send it to us.
Our website uses Google Tag Manager and Google Analytics. These collect information about how the site is used, including pages viewed, approximate location derived from IP address, referring source, device and browser type, and time on page.
We use this to understand which pages are useful and where visitors come from. We do not use it to identify individual visitors, and we do not attempt to match analytics data to a named person.
Cookies. Analytics and tag management set cookies in your browser. You can block or delete cookies through your browser settings. The site will still work, and our analytics will simply not record your visit.
We may run advertising through Google, LinkedIn or Meta. Where we do, those platforms may set cookies or similar identifiers through our site. Their handling of that data is governed by their own privacy policies, which we link at clause 8.
We use personal information to respond to enquiries, prepare and issue proposals, deliver work we have been engaged to do, invoice and take payment, send our newsletter where you have asked for it, meet our record-keeping obligations, and improve the website.
We do not sell personal information, and we do not disclose it for another organisation's marketing.
We send our newsletter only to people who have asked for it or who have an existing business relationship with us. Every issue identifies us as the sender and carries a working unsubscribe link.
Unsubscribing takes effect immediately in our system and we act on any request sent to us directly within five business days. Unsubscribing from the newsletter does not affect correspondence about work we are doing for you.
The newsletter is sent through Mailchimp, which records whether an email was opened and which links were clicked.
Delivering our services means we are often given access to systems belonging to a client. Depending on the engagement this can include website and CMS administration, hosting and domain accounts, analytics and tag management, advertising accounts, mailing lists, form submissions from the client's own website, and documents shared with us for a project.
Those systems can contain personal information about the client's own customers, staff and contacts. We access it only to perform the work we have been engaged to do, and we act on the client's instructions.
The client remains the party responsible for its own obligations under the Privacy Act, including any notice, consent or privacy policy its own customers are entitled to. This mirrors clause 18.3 of our Terms & Conditions.
We do not subcontract client work. Where we are engaged as a subcontractor by another agency or consultancy, we take instructions from that party and treat the engagement as confidential.
We use established third-party platforms to deliver our services and run our business. Personal information may be stored or processed by them, and several are based outside Australia, principally in the United States.
The platforms we commonly use are Google (analytics, tag management, advertising and workspace), Microsoft, Mailchimp, Meta and LinkedIn (advertising), WordPress hosting providers, Xero (accounting), Proposify (proposals), and Anthropic (AI tools, see clause 9).
Each holds data under its own terms and privacy policy. Where a client requires that its data remain in Australia, that must be raised with us before an engagement is accepted so the work can be scoped accordingly.
We do not transfer personal information overseas for any purpose other than delivering the services described in this policy.
We use AI tools in the ordinary course of our work, including for research, drafting, design, code generation, analysis and reporting.
Client material may be processed by those tools where it is necessary to perform the work. We do not use client material to train any third-party AI model, and we select tools whose terms exclude training on business inputs.
AI tools may process and store data outside Australia. Where a client's policy restricts the use of AI tools, or requires processing to remain in Australia, that must be raised with us before an engagement is accepted.
Every deliverable is reviewed by a person before it is issued. This section corresponds to clause 15 of our Terms & Conditions.
We hold information on reputable, access-controlled platforms, use multi-factor authentication wherever a platform supports it, and limit access to the people performing the work.
No system is completely secure. We take reasonable steps appropriate to the sensitivity of what we hold, and we do not claim more than that.
If we become aware of unauthorised access to, or disclosure or loss of, information we hold for a client, we will notify that client without undue delay and in any event within seventy-two (72) hours of becoming aware, tell them what we know, and assist them in meeting any notification obligation they have. This corresponds to clause 18.4 of our Terms & Conditions.
Clients should tell us promptly when someone who held access through us leaves their business, so that access can be revoked.
We keep enquiry and proposal records for as long as there is a realistic prospect of working together, and for seven years after an engagement ends where the records relate to work performed or amounts invoiced, which is the period our tax and record-keeping obligations require.
Newsletter subscriptions are kept until you unsubscribe.
At the end of an engagement a client may ask us, in writing within thirty (30) days, to return or delete the material and credentials we hold. We will do so other than material we must retain by law or that sits in routine backups. This corresponds to clause 18.6 of our Terms & Conditions.
You may ask us what personal information we hold about you, ask us to correct it, or ask us to delete it. Write to rachel@bare.digital.
We will respond within thirty (30) days. There is no charge. We may ask you to verify your identity before we act on a request.
If we hold information as part of work for a client, and you are that client's customer rather than ours, we will refer your request to the client, because the information is theirs and they are the right party to answer you. We will tell you when we do this.
If you are not satisfied with how we have handled a privacy matter, tell us and we will work to resolve it. If it remains unresolved you may contact the Office of the Australian Information Commissioner at oaic.gov.au.
We update this policy as our services and the platforms we use change. The current version and its effective date are shown at the top of this page.
Where this policy and a signed agreement differ, the agreement applies to that engagement.
Privacy enquiries: rachel@bare.digital
Bare Digital Pty Ltd ATF Bare Digital Trust, Leederville, Western Australia.
This policy sits alongside our Terms & Conditions. Where the two differ on an engagement, the accepted Fee Proposal and its Terms apply.
Bare Digital Pty Ltd ATF Bare Digital Trust · Leederville, Western Australia · bare.digital