Privacy policy

1. About this policy

This policy applies to Hiroki Digital ("we", "us"), and to personal information we handle through this website, by email and phone, and while providing website design, digital marketing and SEO services.

We handle personal information in line with the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth). We have chosen to do this even where the Act's small business exemption might otherwise apply to us. When we deal with people in New Zealand, we also comply with the Information Privacy Principles in New Zealand's Privacy Act 2020.

"Personal information" means information or an opinion about an identified individual, or an individual who is reasonably identifiable.

2. The personal information we collect

When you contact us or fill in a form

• Your name and email address (required so we can reply).
• Optional details you choose to give: phone number, business name, website address, budget range and your message.
• The service you're interested in and the page you sent the form from.

Collected automatically when you send a form

• The page you first landed on during your visit and the website that referred you, if any.
• Advertising campaign tags (UTM parameters) and ad click identifiers (such as Google's gclid, Meta's fbclid or Microsoft's msclkid) if you arrived from an ad.

Your browser holds this campaign information only for the current visit. It is sent to us only if you submit a form.

When you become a client

• Contact details for you and your team, billing details and records of our work and communications.
• Access you give us to your website, Google Business Profile, ad, analytics and email accounts. We ask for user or manager access in our own name rather than your passwords.

From public sources

When we prepare a free audit, heatmap or plan, we review publicly available information about your business, such as your website, Google Business Profile, reviews and directory listings. For sole traders, some of this may be personal information.

What we don't collect

We don't ask for sensitive information such as health, racial or ethnic origin, religious or political information. Please don't include it in forms or messages. We don't collect government identifiers or payment card numbers through this website.

You can contact us using a pseudonym or just a first name, or ask general questions without identifying yourself. We do need a working email address or phone number to reply.

3. Why we collect it and how we use it

We collect, use and disclose personal information only for these purposes, or for related purposes you would reasonably expect:

• replying to your enquiry and preparing the free audit, concept or plan you asked for
• sending you quotes, proposals and follow-up messages about the services you asked about
• providing our services and managing our relationship with clients, including invoicing
• understanding which of our own pages and ad campaigns bring in enquiries, using aggregated figures
• keeping our systems secure and preventing spam and misuse
• meeting our legal, tax and accounting obligations

If you don't give us your name and a way to contact you, we won't be able to reply to your enquiry. We are not required by law to collect the information on our forms.

We do not use personal information to make decisions about you by automated processes. When we use AI writing tools to help draft content for clients, we keep personal information out of those tools wherever we can.

4. Who we share it with

We never sell or rent personal information. We share it only with these parties, and only as needed for the purposes above:

5. Overseas storage and disclosure

Some of our service providers store data outside Australia and New Zealand, most commonly in the United States. Before we use a provider, we take reasonable steps to make sure it protects personal information to a standard consistent with the APPs. We use established providers that offer contractual data protection and security commitments, and we limit what we send them to what's needed.

6. Direct marketing and emails

Replying to your enquiry, and following up about the services you asked about, is not a marketing list. We will only send you newsletters or promotional emails if you have agreed to receive them, as required by the Spam Act 2003 (Cth) and, for New Zealand, the Unsolicited Electronic Messages Act 2007.

Every marketing email identifies us and includes an unsubscribe link. We process unsubscribe requests within five business days. You can also ask us to stop contacting you at any time by emailing hello@hirokidigital.com.

7. Cookies, analytics and tracking

By default this website sets no cookies and loads no tracking tags. Fonts and images are served from our own website.

• Campaign information for your visit. Your browser's session storage remembers the ad or page that brought you here until you close the tab. It is only sent to us if you submit a form.
• Optional Google tags. If we turn on Google Tag Manager, you'll see a choice before anything loads. Only if you click Accept do we load Google tags that use cookies to measure visits and record when a form is sent, so we can see which ads work. We configure them to collect the minimum data needed and we never send the contents of your form to ad platforms. Your choice is saved in your browser, and you can change it with the "Cookie settings" link in the footer.
• Embedded Google map. If our homepage shows an embedded Google map, Google may set its own cookies when the map loads, under Google's privacy policy.
• Controlling ads. You can manage personalised Google ads at My Ad Center, and block or delete cookies in your browser settings.

8. How we store and protect it

We take reasonable technical and organisational steps to protect personal information from misuse, interference, loss, and unauthorised access, change or disclosure. These include:

• encrypting all traffic to this website with HTTPS, and setting browser security headers
• storing enquiries in a private Google Workspace spreadsheet that is not publicly shared, with two-step verification on our accounts
• limiting access to the people who need it to do their work
• filtering spam and protecting the spreadsheet against malicious input
• using manager access to client accounts instead of shared passwords, and removing our access when an engagement ends

No method of sending or storing data is completely secure, but we work to keep the risk low and review our safeguards regularly.

9. How long we keep it

• Enquiries that don't go ahead are deleted automatically 24 months after we receive them.
• Spam and junk submissions are deleted automatically after 30 days.
• Client records are kept for the length of our engagement and then for as long as we need them for tax and legal purposes, which for business records is at least five years under Australian tax law. After that we delete or de-identify them.

10. Accessing and correcting your information

You can ask for a copy of the personal information we hold about you, or ask us to correct it, at any time by emailing hello@hirokidigital.com. We'll confirm your identity, then respond within 30 days. We don't charge for requests. If we can't give you access or make a correction, we'll explain why in writing and tell you how to complain. You can also ask us to delete your enquiry.

11. Complaints

If you think we have mishandled your personal information, please email hello@hirokidigital.com with the details. We'll acknowledge your complaint within five business days and aim to resolve it within 30 days.

If you're not satisfied with our response, you can complain to the regulator:

• Australia: Office of the Australian Information Commissioner, oaic.gov.au, phone 1300 363 992.
• New Zealand: Office of the Privacy Commissioner, privacy.org.nz, phone 0800 803 909.

12. Data breaches

If personal information we hold is lost or accessed without authorisation, we will act quickly to contain it and assess the risk. Where a breach is likely to result in serious harm, we will notify the people affected and, where required, the Office of the Australian Information Commissioner or New Zealand's Privacy Commissioner.

13. Information we handle for clients

When we work on a client's website, Google Business Profile, ads, email platform or lead forms, we may be able to see personal information about that client's own customers. We use it only to deliver the services the client asked for, follow the client's instructions and our agreement, keep it confidential and don't use it for our own purposes. The client remains responsible for its own privacy obligations to its customers.

14. Children

Our services are for businesses, and this website is not directed at people under 18. We don't knowingly collect personal information from children.

15. Changes to this policy

We may update this policy as our services, the tools we use or the law change. The current version is always on this page, with the date it was last updated.

16. Contact us

For privacy questions, requests or complaints, contact us at:

Hiroki Digital Service area: Australia & New Zealand hello@hirokidigital.com