Privacy Policy

1. Who we are

ATO Connect is operated by Myaccountant Technology Pty Ltd (ABN 81 610 976 719) (we, us). We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Where tax file numbers (TFNs) pass through the Platform, we also comply with the Privacy (Tax File Number) Rule 2015.

2. Collection notice

We collect personal information in two ways.

About our customers' staff

When your organisation registers and uses the portal, we collect the names, work email addresses, phone numbers and roles of its users, and technical information such as IP addresses, sign-in times and audit records. We collect this from you directly to create and secure accounts, provide support, and meet our security obligations. If you do not provide it, we cannot give you access to the Platform.

In lodgment data

Software vendors send data through ATO Connect for lodgment with the ATO. That data may include personal information about their clients, employees and other individuals, such as names, addresses, dates of birth, income, superannuation details and TFNs. We receive it from the software vendor, not from the individual, and we handle it only to transmit it to the ATO and return the ATO's response. The software vendor and its client are responsible for telling those individuals how their information is handled.

3. Tax file numbers

We collect, use and disclose TFNs only for a purpose authorised by taxation, personal assistance or superannuation law, which for ATO Connect means transmitting them to the ATO as part of a lodgment or request. We do not use TFNs to identify individuals for any other purpose, do not use them as an account or record identifier, and do not match records using them. Access to TFN information is restricted, and it is encrypted at rest and securely deleted when it is no longer required.

4. Use and disclosure

We use and disclose personal information to:

• transmit lodgments and requests to the ATO and return its responses, which is the core of the service;
• operate, secure and support the Platform, including audit logging and fraud prevention;
• communicate with you about your account, the service and changes to it;
• meet our legal obligations, including those we have as a Digital Service Provider to the ATO.

We disclose personal information to the ATO when it is part of a lodgment or request, to service providers that host and operate the Platform for us (such as Amazon Web Services in Sydney), and where the law requires or authorises it. We do not sell personal information and do not use lodgment data for marketing.

5. Overseas disclosure

We do not disclose personal information to overseas recipients. ATO Connect is hosted in AWS ap-southeast-2 (Sydney) and data is stored and processed in Australia.

6. Security

We protect personal information with measures that include AES-256 encryption at rest, multi-factor authentication, access controls, audit logging and separation of test and production environments. Our information security management system is certified to ISO/IEC 27001. More detail is on our Security & Trust page.

7. Retention

We keep personal information only for as long as we need it to provide the service, to meet record-keeping obligations under the law and to the ATO, and to resolve disputes. After that we securely destroy or de-identify it.

8. Access and correction

You can ask for access to the personal information we hold about you, or ask us to correct it, by emailing support@myaccountant.com.au. We will respond within 30 days. If the information is in lodgment data, we may refer you to the software vendor or organisation that sent it, as they control that data. If we refuse a request, we will tell you why and how to complain.

9. Complaints

If you think we have breached the APPs or the TFN Rule, please contact us first at support@myaccountant.com.au. We will acknowledge your complaint and aim to respond within 30 days. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au (opens in a new tab).

10. Notifiable data breaches

If a data breach is likely to result in serious harm to individuals, we will notify the affected individuals and the OAIC as the Notifiable Data Breaches scheme requires. Where the breach involves data sent by a software vendor, we will also tell that vendor promptly so it can meet its own obligations, and we will notify the ATO where its requirements apply.

11. Changes to this policy

We may update this policy from time to time. The version and date at the top of this page show when it last changed.

12. Contact

Privacy Officer, Myaccountant Technology Pty Ltd, Level 1, 43 Stewart Street, Richmond VIC 3121. Email support@myaccountant.com.au.