Privacy policy. How we handle personal information.

Yak Advisory Private Limited ("Yak Advisory", "we", "us") is a company based in Kathmandu, Nepal. We provide bookkeeping, payroll, finance operations, process, reporting and website services to businesses and accounting firms in Australia and the United States. We are not a registered tax agent or BAS agent in Australia.

This policy explains how we collect, use, store, share and protect personal information when you use yakadvisory.com or engage us. We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth) and Nepal's Individual Privacy Act, 2075 (2018).

It covers personal information we collect through this website, including the contact and job application forms, and personal information we handle as a service provider to our clients.

It does not cover information our clients collect about their own customers, staff or NDIS participants. In those engagements the client is responsible for that information and we act as its service provider under a written agreement. It also does not cover other websites we link to.

When you contact us: your name, email address, business name (optional), the service you need, what kind of client you are, where you are based, how you found us, a preferred call time (optional), your message, and which page or button brought you to the form.

When you apply for a role: your name, email address, phone number, a link to your CV, your LinkedIn profile (optional), your message and the role you applied for.

Automatically: our website is hosted on Cloudflare, which processes technical information such as your IP address, browser type, the pages you request and the referring page, to deliver and protect the site. We count visits with Cloudflare Web Analytics, which uses no cookies or browser storage and does not identify you: it records the page, the referring site, browser type, country and how fast the page loaded, and we only see totals. Our fonts are served from our own website. We do not use advertising pixels or cross-site tracking.

When we deliver services: we may handle personal information about your staff, contractors, customers and, for NDIS providers, participants. We use only the information the job needs. Scope and protections are set out in the engagement letter and data processing addendum.

• To reply to your enquiry and arrange a call
• To deliver the services you engage us for and manage the engagement
• To assess job applications
• To meet our legal and professional obligations
• To improve our website and services, using aggregated information

We do not sell personal information, and we do not use it for third-party advertising.

• Cloudflare, Inc. (United States): website hosting, delivery, security and visitor statistics
• Web3Forms (United States): delivers website form submissions to our inbox
• Zoho Corporation (India and global): email and client records
• Microsoft Corporation (Australia and global): documents, collaboration and remote desktop
• Our clients' own platforms, such as Xero or QuickBooks, which we access inside the client's own accounts

We may also disclose personal information where the law requires it. A current list of service providers is available on request.

Our team works from Nepal. When you engage us, personal information may be accessed from Nepal by our staff. To support your obligations under Australian Privacy Principle 8, we:

• Bind every team member to written confidentiality obligations
• Give access only to the people and systems a job needs, with multi-factor login
• Work inside your own systems wherever we can, rather than copying data to ours
• Sign a data processing addendum with each client

An Australian client remains accountable for personal information it discloses to an overseas recipient; our agreements are designed to support that. For US accounting firms, we provide a written information security plan and a data protection addendum.

We protect personal information with controls that match its sensitivity: multi-factor login on every system, one named account per person with the lowest access the job needs, a remote desktop that stops files being saved to our own devices, and quarterly access reviews. No system is perfectly secure, but we work to reduce risk and respond quickly when something goes wrong. Our security page sets out the controls in more detail.

If we become aware of a data breach involving your information, we tell you in writing within 24 hours of becoming aware of it, and support your assessment and any notification under the Notifiable Data Breaches scheme (Part IIIC of the Privacy Act) or other laws that apply to you.

• Website enquiries: up to 24 months, then deleted
• Job applications: up to 12 months, so we can contact you about a matching role, unless you ask us to delete them sooner
• Data shared for a free check: deleted within 30 days of the readout unless you engage us, confirmed in writing
• Client data held in your systems or our workspace: returned or deleted within 5 business days of the engagement ending, confirmed in writing
• Our own engagement records, such as engagement letters, invoices and correspondence: for the engagement and 7 years after, for legal and tax record keeping

You can ask to see the personal information we hold about you, to correct it, or to delete it where we have no continuing reason to keep it. You can withdraw consent you have given, and you can complain to us or to a regulator.

If you are a customer, employee or participant of one of our clients, please contact that client first. We will help them respond.

We do not set advertising or tracking cookies. Your browser stores up to three small items for this website, and only after you use the control concerned: your light or dark theme choice; your Australia or US price choice; and, for the current visit only, the page and button that brought you to the contact form, which is sent with your message. None is shared with anyone else. Our visitor statistics use no cookies or browser storage. Cloudflare may set strictly necessary security cookies.

Our services are for businesses. We do not knowingly collect personal information from anyone under 16. If you think we have, contact us and we will delete it.

We may update this policy. The effective date at the top will change, and we will email active clients about material changes.

Email [email protected] with any privacy question or complaint. We acknowledge complaints within 5 business days and give a full response within 30 days. If you are not satisfied, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.