Privacy policy

H&Co Smart Admin (ABN 92 966 052 420) is a sole-trader business run by Heidi Frier in Queensland, Australia. In this policy, "we", "us" and "H&Co" mean that business. You can reach us at heidi@hcosmartadmin.com or 0459 968 616.

We are a small business. Even where the Privacy Act 1988 does not strictly require it of us, we follow the Australian Privacy Principles because our clients hand us their paperwork and we think that is the right standard.

This policy covers this website (hcosmartadmin.com), the free Tender Ready sessions list, and the emails, calls and messages you send us. Fishlee (fishlee.com.au) has its own privacy policy because it holds family information. Client work under a signed engagement is covered by that engagement and by this policy.

When you put yourself on the sessions list (hcosmartadmin.com/events) we collect your first name, email address, the area you chose and, if you tell us, your trade. We use it to email you when a free session is booked in your area, and for nothing else. You must tick the consent box for us to email you, and every email has an unsubscribe link.

When you email, call or message us on WhatsApp we receive whatever you send, including your name, contact details and anything about your business. We use it to reply and, if you become a client, to do the work. WhatsApp is run by Meta and has its own privacy policy.

When you book or buy a service we collect what we need to do the job and to invoice you: business name, ABN, contact details, and the records you give us to work on. Payment is by bank transfer; we do not store card details.

When you visit the site our hosting provider records standard technical information: pages visited, the page you came from, browser type, language, approximate country, and a random session identifier that expires after 30 minutes. This is used for simple visitor counts and to keep the site working. We do not run Google Analytics, advertising pixels or social media trackers. The 10 checks page remembers the council you pick on your own device only.

We do not collect sensitive information (such as health, religion or criminal record information) and ask that you do not send it to us.

We do not sell, rent or trade personal information. We do not use your details for anyone else's marketing. We only email you about sessions if you asked us to.

We do not use computer programs to make decisions about you that have a legal or similarly significant effect. A human reads every message and makes every decision about who we work with.

We use a small number of service providers to run the business. They can only use your information to provide their service to us:

• Lovable (website hosting and the secure database behind the sessions form), with servers in the United States and content delivery through Cloudflare's global network.
• Resend (sending our emails and holding the sessions list), with servers in Japan and the United States.
• Our email, calendar and document providers, which may store data outside Australia.
• Accounting and job software we set up for clients (such as Xero, MYOB, ServiceM8 or Tradify), under the client's own account and terms.
• Our registered tax or BAS agent, insurer, lawyer or accountant, where needed to run the business properly.
• Government bodies where the law requires it.

Because of the providers above, personal information is stored or processed in the United States and Japan, and may pass through other countries on Cloudflare's network. We choose providers with strong security practices, but overseas laws differ from Australian law. By using the site or the sessions list, you understand this.

We keep the sessions database private (no public access), use access-controlled accounts with two-factor authentication where available, and do not log email addresses or phone numbers in error reports. No system is perfectly secure. If a data breach is likely to cause you serious harm, we will tell you and the Office of the Australian Information Commissioner as the law requires.

• Sessions list: until you unsubscribe or ask us to remove you. We review the list once a year and remove anyone who has not opened an email in 24 months.
• Emails and messages: as long as reasonably needed to deal with your enquiry or client relationship.
• Client and financial records: 7 years, as Australian tax and business law requires, then securely deleted.

You can ask us at any time to:

• see the personal information we hold about you,
• correct it,
• delete it (unless we must keep it by law), or
• stop emailing you (or use the unsubscribe link).

Email heidi@hcosmartadmin.com. We will respond within 30 days and will not charge you.

This website and the sessions list are for business owners and are not directed at children. We do not knowingly collect information from anyone under 18 here. Fishlee is a separate app with its own rules about children.

If you think we have mishandled your information, email heidi@hcosmartadmin.com and we will look into it within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or 1300 363 992.

We will update this page when our practices change and show the date at the top. Big changes to how we use the sessions list will be emailed to the list first.