Privacy Policy

Effective date: 17 September 2026

This Privacy Policy explains how Alexander Amiss trading as Nothing Amiss (ABN 48 481 803 026) (“we”, “us”, “our”) collects, uses, discloses and protects personal information.

We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). We have chosen to do this whether or not we are legally required to under the small business exemption. Where applicable, we also comply with the Privacy Act 2020 (NZ) and, for individuals in the European Economic Area or United Kingdom, the EU General Data Protection Regulation and UK GDPR.

If you have any questions, contact us using the details in section 15.

1. What personal information we collect

Depending on how you interact with us, we may collect:

Identity and contact details: name, job title, employer, business email, phone number, business address, LinkedIn profile URL.
Enquiry and communication records: messages you send through our website forms, email, booking tools, video calls or social media, and notes from calls and meetings.
Client engagement information: information about your business, systems, processes and staff that you share with us so we can deliver services.
Billing information: billing contact, business name, ABN and payment records. We do not store full card numbers; payments are handled by third-party payment providers.
Technical and usage information: IP address, approximate location, browser and device type, pages viewed, referring site, time on site, and interactions with our emails (such as opens and clicks), collected through cookies and similar technologies. See our Cookie Policy.
Marketing preferences: whether you have subscribed to or unsubscribed from our communications.
Publicly available business information: information from sources such as company websites, LinkedIn, business directories and the Australian Business Register, used to identify and contact relevant businesses.

Client CRM data. When we deliver services, we may access personal information held in a client’s systems (for example contacts in a HubSpot portal). That information belongs to our client. We handle it only to perform the engagement, on the client’s instructions and under our Terms of Engagement. The client’s own privacy policy governs that data.

We do not intentionally collect sensitive information (such as health, racial or ethnic origin, political opinions or religious beliefs). Please do not send it to us. If we receive it unintentionally, we will delete it unless we are required to keep it.

2. How we collect personal information

We collect personal information:

directly from you, when you complete a form, book a meeting, email or call us, or engage our services;
automatically, through cookies, analytics and tracking technologies on our website and in our emails;
from your employer or colleagues, when they engage us and share your details for a project;
from third parties such as referral partners, event organisers and business data providers; and
from publicly available sources.

If we collect information about you from someone else, we take reasonable steps to make sure you are aware of it, unless doing so is impracticable or unnecessary.

3. Why we collect, use and disclose personal information

We use personal information to:

respond to enquiries and provide information you request;
assess, scope, quote for and deliver consulting services;
manage client relationships, invoicing and payments;
send service-related communications;
send marketing communications where permitted (see section 6);
operate, secure, analyse and improve our website and services;
identify and contact businesses that may benefit from our services;
meet legal, tax, accounting and insurance obligations; and
establish, exercise or defend legal claims.

Legal bases (EU/UK individuals). We rely on: performance of a contract; our legitimate interests in running and promoting a B2B consulting business (balanced against your rights); your consent (for non-essential cookies and some marketing); and compliance with legal obligations.

If you do not provide the information we request, we may be unable to respond to you or deliver our services.

4. Who we disclose personal information to

We may disclose personal information to:

Service providers who help us run the business, including website hosting (Cloudflare), CRM and marketing automation (such as HubSpot), email and productivity tools, scheduling tools, video conferencing, accounting and invoicing software, payment processors, and AI tools (see section 8);
Professional advisers such as accountants, lawyers and insurers;
Subcontractors engaged to help deliver a project, who are bound by confidentiality obligations;
A purchaser or successor of all or part of our business; and
Government authorities or others where required or authorised by law.

We do not sell personal information.

5. Overseas disclosure

Some of our service providers store or process information outside Australia. The countries most likely to be involved are the United States, the European Union, the United Kingdom, New Zealand, Singapore and Ireland, and our providers may use data centres in other locations.

Before disclosing personal information overseas, we take reasonable steps to ensure the recipient handles it consistently with the APPs, typically through contractual terms and by choosing reputable providers with appropriate security. For EU/UK personal information transferred outside those regions, we rely on adequacy decisions or standard contractual clauses where required.

6. Direct marketing

We may send you marketing about our services where:

you have consented; or
you would reasonably expect it (for example you are a current or recent client or have enquired with us); or
for business-to-business outreach, your work email address is conspicuously published and our message relates to your role.

Every marketing email identifies us, includes our contact details and contains a working unsubscribe link. You can opt out at any time by clicking unsubscribe or emailing xander@nothingamiss.com. We will action requests within 5 business days. We comply with the Spam Act 2003 (Cth) and the Unsolicited Electronic Messages Act 2007 (NZ).

7. Cookies, analytics and tracking

Our website uses cookies, pixels and similar technologies for essential site functions, analytics and marketing. Non-essential cookies are only set with your consent where the law requires it. You can change your choices at any time via Cookie Settings in our website footer. Full details are in our Cookie Policy.

Our emails may contain tracking that tells us whether an email was opened and which links were clicked.

8. Artificial intelligence and automated decision-making

We use AI tools to support our work, for example to draft content, summarise meeting notes, analyse data, research businesses and build automations. When we use AI tools:

a person reviews AI outputs before they are relied on in client work or communications;
we use business-grade tools or settings that do not use inputs to train publicly available models wherever that option is available;
we do not put a client’s confidential or personal information into AI tools unless it is needed for the engagement and consistent with our agreement with that client.

Automated decisions. Consistent with APP 1.7 to 1.9:

Kinds of personal information used by computer programs: business contact details, company and role information, website and email engagement data, and enquiry form responses.
Decisions made solely by computer programs: we may use automated rules to score or prioritise leads, route enquiries, and decide which marketing emails a contact receives. These decisions affect what communications you receive and how quickly we follow up. We do not make decisions solely by automated means that produce legal effects on you or similarly significantly affect you.
Decisions where a computer program substantially assists a person: we may use AI or scoring tools to help us research and select businesses to contact, and to assess fit for an engagement. A person makes the final decision.

You can ask us about any automated processing relating to you, and ask for a person to review it, by contacting xander@nothingamiss.com.

9. Security

We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification or disclosure. These include multi-factor authentication, access controls based on least privilege, encrypted connections, reputable cloud providers, device security and password management.

No method of transmission or storage is completely secure. If you believe your information has been compromised, contact us immediately.

10. Data breaches

If we experience a data breach likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme, and where applicable the New Zealand Office of the Privacy Commissioner and relevant EU/UK authorities. Where a breach involves client data we hold on a client’s behalf, we will notify the client promptly so they can meet their own obligations.

11. Retention

We keep personal information only for as long as needed for the purposes in this policy, including to meet legal, tax and accounting obligations (generally 5 to 7 years for financial records). Marketing contact records are kept until you unsubscribe or they become inactive, after which we suppress or delete them. When information is no longer needed, we securely destroy or de-identify it.

When an engagement ends, we return or delete client data in our possession in line with our Terms of Engagement.

12. Access and correction

You may request access to the personal information we hold about you and ask us to correct it. Contact xander@nothingamiss.com. We will respond within 30 days. We may need to verify your identity. If we refuse a request, we will explain why and how to complain. We do not charge for making a request, and we will only charge a reasonable fee for providing access in unusual cases, which we will tell you about first.

13. Additional rights for EU/UK individuals

If the GDPR or UK GDPR applies to you, you also have the right to: erasure; restriction of processing; object to processing (including direct marketing and profiling); data portability; withdraw consent at any time; and not be subject to decisions based solely on automated processing that produce legal or similarly significant effects. You may also lodge a complaint with your local data protection authority.

14. Anonymity and pseudonymity

You can browse our website and make general enquiries without identifying yourself. We will need your identity and contact details to respond meaningfully or provide services.

15. Contact and complaints

Privacy contact: Alexander Amiss Email: xander@nothingamiss.com Post: 247 Botany Street, Kingsford NSW 2032

If you have a complaint about how we have handled your personal information, please contact us first with details. We will acknowledge your complaint within 7 days and aim to resolve it within 30 days.

If you are not satisfied with our response, you can complain to:

Australia: Office of the Australian Information Commissioner, www.oaic.gov.au, 1300 363 992
New Zealand: Office of the Privacy Commissioner, www.privacy.org.nz
UK: Information Commissioner’s Office, ico.org.uk
EU: your local data protection supervisory authority

16. Changes to this policy

We may update this policy from time to time. The current version is always on our website with its effective date. Where changes are significant, we will take reasonable steps to let affected clients and subscribers know.