Privacy Policy

Effective Date: 29/06/2026

This Privacy Notice for Karina Nilson-Mills (doing business as BAS & Books for You, also referred to BB4u) (“we”, “us”, or “our”’), describes how and why we might access, collect, store, use, and/or share (“process”) your personal information when you use our services (“Services), including when you:

  • Visit our website at http://www.bb4u.au or any website of ours that links to this Privacy Notice

  • Use Tax and Business Services, BAS & Books for You (BB4u) offers Tax & business solutions for individuals & small businesses.

  • Engage with us in other related ways, including designated services under AUSTRAC Tranche 2, any sales, marketing, or events.

Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices. We are responsible for making decisions about how your personal information is processed. If you do not agree with our policies and practices, please do not use our Services. If you still have any questions or concerns, please contact us at [email protected].

1. Introduction

BB4u provides tax agent, BAS agent, ASIC registered agent, payroll and bookkeeping services to individuals, sole traders, companies and partnerships across Australia.

We are committed to protecting your privacy and handling your personal information responsibly. This policy explains what personal information we collect, why we collect it, how we use, store and disclose it, and how you can access or correct your information or make a complaint.

BB4u is committed to protecting your privacy in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), the Privacy (Tax File Number) Rule 2015, and the Anti‑Money Laundering and Counter‑Terrorism Financing Act 2006 (Cth) (AML/CTF Act) and associated AML/CTF Rules.

This Privacy Policy explains how we collect, use, disclose and safeguard your personal information when you visit our website, engage with our services, or otherwise interact with us.

2.What Information we collect

Wherever practical, we collect personal information directly from you — for example through our engagement forms, email, phone calls, meetings, or documents you upload to our client portal or send to us directly.

We may also collect personal information from other sources, including:

  • The Australian Taxation Office (ATO), ASIC, AUSTRAC and other government agencies

  • Your authorised representatives, business partners, co-directors, trustees or family members involved in your engagement

  • Publicly available sources (for example, ASIC registers, AUSTRAC and sanctions lists, or other public records) where this is necessary to meet our identity verification or due diligence obligations

  • Credit reporting bodies, solely for the purpose of verifying your identity where required under the AML/CTF Act

  • Your accounting software (for example Xero) and other systems you have linked to our practice

If we collect personal information about a third party from you (for example, a beneficial owner, co-director or family member), please make sure that person is aware of this policy.

3. How we collect Personal Information

We collect information in several ways, including:

  • When you fill in forms on our website

  • During client onboarding or consultation

  • Through email, phone or in-person communication

  • When you use our accounting or bookkeeping services

  • From third parties such as the ATO, your employer, or financial institutions (with your consent).

4. Why we collect, hold, use and disclose your Personal Information

We collect, hold, use and disclose personal information for the purposes of:

  • Preparing and lodging income tax returns, BAS statements and other ATO obligations

  • ASIC registered agent services, including company registers, annual statements and ASIC lodgements

  • Payroll setup and processing, including Single Touch Payroll reporting

  • Bookkeeping, financial reporting and management advice

  • Verifying your identity and meeting our customer due diligence obligations as a designated service provider under the AML/CTF Act (see section 5 below)

  • Complying with our other legal and regulatory obligations, including those under the Tax Agent Services Act 2009 and Corporations Act 2001

  • Communicating with you about your engagement, including reminders, updates and invoicing

  • Managing and improving our practice, including training and quality assurance

We will only use or disclose personal information for a purpose other than the one it was collected for where the Privacy Act permits this — for example, where you would reasonably expect it, where you have consented, or where we are required or authorised by law (including the AML/CTF Act).

5. Our AML/CTF obligations

From 1 July 2026, BB4U is a reporting entity under the AML/CTF Act because we provide certain “designated services” as a tax and BAS agent and company service provider (for example, certain services relating to company formation, structuring and ASIC compliance). This section explains how this affects your personal information.

What we collect for AML/CTF purposes:

Before we provide you with a designated service, the AML/CTF Act requires us to carry out customer due diligence (CDD). This means we must collect and verify certain information about you, including:

  • Your full name, date of birth and residential address

  • Identification document details (such as a driver’s licence or passport)

  • Where you are a company or partnership — information about beneficial owners, directors, partners and the nature of the entity

  • Information to assess whether you are a politically exposed person or subject to sanctions, where relevant to your risk profile.

We will only collect this information where it is reasonably necessary for a designated service we are providing or reasonably expect to provide to you — not as a matter of course for every client or every engagement.

How we use this information:

We use this information to:

  • Verify your identity before providing a designated service

  • Assess and monitor the money laundering and terrorism financing (ML/TF) risk associated with your engagement

  • Meet our ongoing customer due diligence and record-keeping obligations under the AML/CTF Act

  • Report to AUSTRAC where required — for example, lodging a suspicious matter report if circumstances require it

Tipping off. The AML/CTF Act makes it a criminal offence for us to disclose certain information that could prejudice an investigation, including the fact that we have formed a suspicion about a matter or made a report to AUSTRAC (known as “tipping off”). Where this applies, we are not able to tell you that we have made such a report, and we may not be able to explain certain decisions — for example, declining to act for you or pausing an engagement — without breaching this obligation.

Consequences if you don’t provide this information:

We are not permitted to provide a designated service to you until your identity has been verified in accordance with our AML/CTF Program. If you don’t provide the required information, we may not be able to act for you, or may need to pause or end an engagement.

Identification documents:

We do not retain copies of your identification documents (such as scanned driver’s licences or passports) for longer than is reasonably necessary. Once we have verified your identity, we retain only the details required for our record-keeping obligations — such as your name, date of birth, address, document type and expiry date, and the outcome of our verification — and we take reasonable steps to securely destroy or de-identify the source document copy.

6. Tax File Number

As a registered tax agent, we collect, hold, use and disclose Tax File Numbers (TFNs) in accordance with the Privacy (Tax File Number) Rule 2015, the Income Tax Assessment Act 1936 and the Taxation Administration Act 1953.

We only use your TFN for purposes connected with preparing and lodging your tax obligations, payroll obligations (where applicable), and other purposes permitted or required by tax law.

We do not use your TFN to identify you for any other unrelated purpose, and we take reasonable steps to protect TFN information from misuse, loss or unauthorised access.

7. Sensitive information

We do not generally collect sensitive information (such as health information, racial or ethnic origin, or criminal record information) unless it is necessary for the services we provide — for example, where relevant to assessing politically exposed person status or sanctions risk under our AML/CTF obligations, or where required to verify your identity.

Where we collect sensitive information, we will generally seek your consent, unless an exception under the Privacy Act applies (for example, where the collection is required or authorised by law).

8. Who we disclose information to

We may disclose your personal information to:

- The Australian Taxation Office, ASIC and other government and regulatory bodies, as required to deliver our services and meet our legal obligations

- AUSTRAC, where required under the AML/CTF Act — for example, suspicious matter reports or responses to formal notices

- Credit reporting bodies, solely for identity verification purposes under the AML/CTF Act, and only with your consent

- Software and technology providers we use to deliver our services (for example, practice management, accounting and payroll software providers)

- Other professionals involved in your matter with your authorisation — for example, your financial adviser, solicitor or mortgage broker

- Our professional indemnity insurer, auditors or professional advisers, where necessary

- Any other party where you have consented, or where disclosure is required or authorised by law.

We do not sell or trade your personal information.

9. Overseas disclosure

Some of the software and service providers we use to operate our practice (for example, cloud-based accounting, payroll or document management platforms) may store or process data on servers located overseas, including New Zealand and the United States.

Where this occurs, we take reasonable steps to ensure these providers handle your personal information in a way consistent with the Australian Privacy Principles.

Where a client engagement involves an overseas dimension — for example, an overseas pension, an offshore entity or an overseas family member — we may also need to disclose or receive personal information from overseas as part of delivering that service, with your knowledge and instruction.

10. Keeping Information accurate

We take reasonable steps to ensure the personal information we collect, hold, use and disclose is accurate, complete and up to date. We rely on you to let us know promptly if your details change, including your address, contact details or entity structure, and as part of our AML/CTF obligations we may periodically ask you to confirm or update your information.

11. Data Security e retention

We take reasonable technical and organisational steps to protect your personal information from misuse, interference, loss and unauthorised access, modification or disclosure. These steps include:

1. Secure, access-controlled practice management and document storage systems

Multi-factor authentication and strong password requirements

2. Restricting access to personal information to staff and contractors who need it to perform their role

3. Regular software updates and security patching

4. A documented data breach response plan

We retain personal information for as long as it is needed for the purpose it was collected, including to meet our obligations under tax law, the Corporations Act and the AML/CTF Act. For example, AML/CTF customer due diligence records are generally retained for 7 years after the end of our business relationship with you, or 7 years after a one-off transaction. Where personal information is no longer needed, we take reasonable steps to securely destroy or de-identify it.

12. Access and Correction

You can ask us to access or correct the personal information we hold about you at any time by contacting us using the details in section 15. We will usually respond within 30 days.

There are some circumstances in which we may need to refuse a request — for example, where giving access would be unlawful (including where it would breach our “tipping off” obligations under the AML/CTF Act), or where it would be likely to prejudice an investigation or enforcement action. If we refuse a request, we will explain why, except where doing so would itself be inconsistent with our legal obligations.

13. Cookies and Website Usage

Our website may use cookies and tracking tools to enhance your experience. These tools collect non-personally identifiable information such as browser type, device, and pages visited. You can disable cookies via your browser settings.

14. Third-Party Links

Our website may contain links to third-party sites. We are not responsible for the privacy practices of these websites. We recommend you review their privacy policies before sharing any personal information.

15. Changes to This Privacy Policy

We may update this policy from time to time to reflect changes in our practices or our legal obligations — including as AML/CTF Tranche 2 requirements come into effect and our AML/CTF Program evolves. The current version will always be available on our website, with the “last updated” date shown at the top of this page.

16. Complaints

If you believe we have breached your privacy or mishandled your personal information, please contact us first using the details in section 15, so we can investigate and respond. We aim to resolve complaints within 30 days.

If you are not satisfied with our response, you can lodge a complaint with the Office of the Australian Information Commissioner (OAIC):

Phone: 1300 363 992

Web: www.oaic.gov.au

17. Contact Us

If you have any questions, concerns, or complaints about this Privacy Policy or how we handle your personal information, please contact us:

Business: BAS & Books for You

Privacy contact: Karina Nilosn-Mills

Email: [email protected]

Phone: +61 422 703 936

Address: 2/12 Mollys Place Currumbin Waters QLD 4223

Registrations: Registered Tax Agent #26261566; ASIC Tax Registered #50657; AUSTRAC Reporting Entity #222818130

“Liability limited by a scheme approved under Professional Standards Legislation”