Compass Law

1. Introduction and Our Commitment

FIRSTCOUNSEL (AUSTRALIA) PTY LTD ABN 18 680 946 203, trading as Compass Law (Compass Law, we, us, our), is committed to protecting the privacy of individuals who interact with us. This Privacy Policy explains how we collect, use, hold, disclose, and otherwise handle Personal Information in accordance with the Privacy Act 1988 (Cth) (Privacy Act) and the Australian Privacy Principles (APPs).

Compass Law is an AI-native Australian litigation law firm. Our services are powered by the CaseReady litigation platform (www.caseready.au) and third-party AI tools and technology services. This Privacy Policy covers our collection and handling of Personal Information through:

• our website at www.compasslaw.au (Website);
• direct communications with prospective and existing clients;
• the provision of legal services; and
• our use of AI tools and third-party technology services.

This Privacy Policy does not cover the privacy practices of the CaseReady platform when used by clients directly. Clients who access the CaseReady platform are separately subject to the CaseReady Privacy Policy at www.caseready.au/privacy.

2. What Is Personal Information?

Personal Information means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information is true or not, and whether or not it is recorded in a material form. This includes information such as your name, contact details, and other information that identifies or could reasonably identify you.

Sensitive Information is a subset of Personal Information that includes information about your health, racial or ethnic origin, political opinions, religious or philosophical beliefs, sexual orientation or practices, criminal record, or membership of a professional or trade association. We handle Sensitive Information with heightened care and, in most cases, only collect it with your consent or where authorised or required by law.

3. What Personal Information We Collect

The Personal Information we collect depends on how you interact with us and the nature of the legal services we provide. It may include:

3.1 Information You Provide to Us

• Identity information: your full name, date of birth, and government-issued identifiers (such as a driver's licence or passport number) where required for identity verification;
• Contact information: postal address, email address, and telephone number;
• Enquiry and instructions information: information you provide when you contact us through our Website, including via contact forms, enquiry submissions, or direct email or phone communications;
• Matter information: facts, documents, records, and other information provided to us for the purposes of advising you or acting on your behalf in legal proceedings;
• Financial information: billing address, bank account details, and other payment information necessary for the administration of client fees and disbursements; and
• Other information: any other information you voluntarily provide to us in connection with our services.

3.2 Information We Collect Automatically

When you visit our Website, we may automatically collect certain technical and usage information, including:

• your IP address and device identifiers;
• browser type, operating system, and referring URL;
• pages visited, time and date of access, and duration of visit; and
• information collected via cookies and similar technologies (see clause 10 below).

3.3 Information from Third Parties

We may collect Personal Information about you from third parties in certain circumstances, including:

• from referrers (such as other law firms, financial advisers, or other professionals) who refer you to Compass Law;
• from publicly available sources (such as court registers, ASIC, PPSR, and land title databases) in connection with legal research or proceedings;
• from opposing parties, courts, or tribunals in the course of litigation; and
• from the CaseReady platform where you have used that platform and engaged us to act on your behalf.

4. How We Collect Personal Information

We collect Personal Information by lawful and fair means. We will generally collect Personal Information directly from you. However, as a litigation law firm, there are circumstances where it is not reasonably practicable to do so, and we may collect Personal Information from third-party sources such as those described in clause 3.3 above.

The primary means by which we collect Personal Information include:

• through our Website (including contact forms and enquiry submissions);
• by telephone, email, video conference, or in-person meetings;
• through our legal matter management systems and document platforms (including the CaseReady platform);
• by receiving documents, affidavits, statements, and other materials in the course of legal proceedings; and
• from courts, tribunals, regulators, and other parties in connection with litigation matters.

5. Purposes of Collection and Use

We collect and use Personal Information for the following primary and secondary purposes:

5.1 Primary Purposes

• Providing legal services: to provide litigation advice and representation, manage your legal matter, prepare and file court documents, conduct legal research, and communicate with courts, tribunals, and other parties on your behalf;
• Client relationship management: to establish and maintain our client relationship, conduct conflict checks, carry out client identification and verification (KYC/AML) procedures, and manage our client file;
• Communications: to respond to your enquiries, provide updates on your matter, and contact you in connection with our services;
• Billing and administration: to manage invoicing, payment, trust accounting, and other administrative functions; and
• Legal and regulatory compliance: to comply with our obligations under the Legal Profession Uniform Law, Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Privacy Act, and other Applicable Laws.

5.2 Secondary Purposes

• Improving our services: to analyse how our Website and services are used and to improve our service delivery, systems, and processes;
• Marketing and business development: to inform you about our services, updates, and publications that may be of interest to you (where you have consented or we are otherwise permitted to do so under Spam and Marketing Laws); and
• AI-assisted service delivery: to use AI tools and technology platforms (including the CaseReady platform) to assist in the preparation of legal documents, research, and analysis under appropriate professional supervision (see clause 8 below).

6. Disclosure of Personal Information

Compass Law may disclose your Personal Information to third parties in the following circumstances:

6.1 Courts, Tribunals, and Legal Proceedings

In the course of litigation, we will disclose your Personal Information and other matter information to courts, tribunals, arbitrators, mediators, and other dispute resolution bodies, as well as to opposing parties and their legal representatives, to the extent required or permitted by law or as directed by you.

6.2 Regulators and Law Enforcement

We may be required by law or court order to disclose your Personal Information to regulatory authorities, law enforcement agencies, government bodies, or other third parties. We will only do so to the extent required or permitted by Applicable Laws and, where possible, we will notify you before doing so.

6.3 Professional Advisers and Experts

We may disclose your Personal Information to barristers, expert witnesses, consultants, and other professional advisers engaged in connection with your legal matter.

6.4 Service Providers

We may disclose your Personal Information to Service Providers who assist us in delivering our services, including:

• IT and technology service providers (including cloud hosting, cybersecurity, and document management providers);
• AI service providers (including the CaseReady platform and its underlying AI technology providers — see clause 8 below);
• financial and accounting service providers;
• marketing and communications platforms (for the purposes described in clause 5.2); and
• professional indemnity insurers and legal advisers.

Where we engage Service Providers, we require them to handle your Personal Information only for the purposes we specify and in accordance with applicable Privacy and Data Protection Laws.

7. Overseas Disclosure of Personal Information

Some of our Service Providers, including AI technology providers and cloud infrastructure providers, may be located outside Australia or may store or process data on servers located outside Australia. These may include providers located in the United States of America, countries within the European Union, the United Kingdom, Singapore and other jurisdictions.

Before disclosing your Personal Information to an overseas recipient, we take reasonable steps to ensure that the recipient handles your Personal Information in a manner consistent with the APPs, including by entering into appropriate contractual data protection arrangements.

You acknowledge that, despite these measures, it may not always be practicable to ensure that overseas recipients comply with Australian privacy standards. By providing your Personal Information to us, you consent to its disclosure to overseas recipients in the circumstances described in this Privacy Policy.

8. Artificial Intelligence — Special Disclosures

Compass Law is an AI-native law firm. We use AI tools, including the CaseReady litigation platform, to assist our lawyers in delivering efficient, high-quality legal services. This clause sets out our specific disclosures regarding our use of AI and the handling of Personal Information in connection with AI Services.

8.1 How We Use AI in Our Practice

We use AI tools to assist with:

• Legal research: identifying and analysing relevant case law, legislation, and secondary sources;
• Document drafting: preparing drafts of court documents, correspondence, submissions, and other legal materials;
• Document review and analysis: reviewing contracts, pleadings, and other documents to identify key terms, issues, and risks;
• Workflow management: managing litigation workflows and tracking deadlines and procedural steps through the CaseReady platform; and
• Summarisation and analysis: summarising lengthy documents and extracting key information to assist our lawyers in advising clients.

8.2 AI Does Not Replace Professional Judgement

Professional Oversight

All AI Outputs generated in connection with your legal matter are subject to review, verification, and professional supervision by Compass Law's qualified legal practitioners. AI Outputs do not constitute legal advice.

8.3 What Data May Be Processed by AI

In the course of using AI tools to assist with your legal matter, some of your Personal Information and matter information may be processed by AI systems, including:

• your name and contact details (for identification in documents);
• factual information about your matter that you have provided to us; and
• information contained in documents you have provided to us for the purposes of document review or analysis.

We take steps to minimise the Personal Information input into AI systems and, where possible, to use pseudonymisation or redaction techniques. We generally do not input Sensitive Personal Data into third-party AI systems without your specific consent or where strictly necessary for the provision of legal services.

8.4 AI Outputs — Accuracy and Limitations

AI Outputs are generated by automated systems and may contain errors, inaccuracies, omissions, or hallucinations. Our lawyers independently verify all AI Outputs before relying upon them or using them in any document or advice provided to you. We do not use AI Outputs as a substitute for professional legal judgement.

8.5 Automated Decision-Making

Compass Law does not make legally significant decisions about clients using solely automated processing without human review. AI tools are used to assist our lawyers and support, not replace, their professional judgement.

8.6 Model Training — No Client Data

We will not use your Personal Information or matter data to train AI models without your express consent. We require our AI Service Providers to observe the same restriction.

9. Data Quality and Security

We take reasonable steps to ensure that the Personal Information we hold is accurate, up to date, complete, relevant, and not misleading. If you believe any information we hold about you is incorrect, please contact us using the details in clause 14.

We implement appropriate technical and organisational security measures to protect Personal Information from misuse, interference, loss, unauthorised access, modification, and disclosure. These measures include:

• encryption of data in transit and at rest;
• access controls and authentication requirements for our systems;
• use of cloud infrastructure providers that maintain industry-standard security certifications;
• regular review of our security practices; and
• staff training on privacy and data security obligations.

We store client files and matter records in secure document management systems. Physical documents are stored securely with appropriate access restrictions.

Despite these measures, no internet transmission or data storage system can be guaranteed to be completely secure. If you have reason to believe that your interaction with us is no longer secure, please contact us immediately.

If we become aware of a data breach that is likely to result in serious harm to individuals, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) in accordance with the Notifiable Data Breach (NDB) scheme under the Privacy Act.

10. Cookies and Website Analytics

Our Website uses cookies and similar tracking technologies to improve your browsing experience and to collect analytical information about how the Website is used.

10.1 Types of Cookies We Use

• Essential cookies: necessary for the Website to function correctly and to enable navigation and access to secure areas;
• Analytics cookies: used to collect information about how visitors use our Website (including pages visited, time spent, and referral sources) to help us improve the Website; and
• Preference cookies: used to remember your preferences and settings.

10.2 Third-Party Analytics

We may use third-party analytics services (such as Google Analytics) to analyse Website usage. These services may set their own cookies and may collect information about your use of other websites. These providers operate under their own privacy policies.

10.3 Managing Cookies

You can control cookies through your browser settings. Disabling cookies may affect the functionality of the Website. Most browsers allow you to refuse, delete, or be notified when cookies are set.

11. Retention and Destruction of Personal Information

We retain Personal Information for as long as necessary to fulfil the purposes for which it was collected, including:

• for the duration of our client relationship and any ongoing legal obligations;
• for the period required by law, including under the Legal Profession Uniform Law (which requires legal files to be retained for seven years after the conclusion of a matter) and applicable trust accounting legislation; and
• for as long as necessary to defend or bring any legal claims.

When Personal Information is no longer required, we take reasonable steps to destroy or de-identify it securely. Electronic records are deleted or rendered permanently inaccessible, and physical records are shredded.

12. Your Privacy Rights

Under the Privacy Act and APPs, you have the following rights in relation to your Personal Information:

12.1 Access

You have the right to request access to the Personal Information we hold about you. We will provide access within a reasonable time (and generally within 30 days) unless an exception applies under the Privacy Act. We may charge a reasonable fee for providing access in certain circumstances. We will notify you if we are unable to provide access and the reasons why.

12.2 Correction

If you believe that Personal Information we hold about you is inaccurate, out of date, incomplete, irrelevant, or misleading, you may request that we correct it. We will take reasonable steps to correct the information within 30 days of your request.

12.3 Complaints

If you believe we have breached the APPs, or you are otherwise dissatisfied with how we have handled your Personal Information, please contact us in the first instance using the details in clause 14. We will respond to your complaint within 30 days.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):

• Website: www.oaic.gov.au
• Phone: 1300 363 992
• Mail: GPO Box 5218, Sydney NSW 2001

12.4 Marketing Opt-Out

If you have consented to receive marketing communications from us and wish to opt out, you may do so at any time by clicking the unsubscribe link in any marketing email or by contacting us directly. We will action your opt-out request promptly and within 5 business days as required under the Spam Act 2003 (Cth).

13. Legal Professional Privilege

In our capacity as a law firm, certain communications and information we hold may be protected by legal professional privilege. The right to claim legal professional privilege belongs to our clients. Where a request for access to Personal Information involves information that may be privileged, we will seek your instructions before responding.

14. Contact and Privacy Enquiries

If you have any questions, concerns, or requests in relation to this Privacy Policy or our handling of your Personal Information, please contact us:

Privacy Officer
FIRSTCOUNSEL (AUSTRALIA) PTY LTD t/a Compass Law
ABN 18 680 946 203
Website: www.compasslaw.au
Email: privacy@compasslaw.au

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we update this Privacy Policy, we will post the revised version on our Website with a new effective date. We encourage you to review this Privacy Policy periodically.

Where required by the Privacy Act, we will notify you of any material changes to this Privacy Policy.

Schedule 1 — Definitions

In this Privacy Policy, unless the context otherwise requires:

AI Outputs

means any content, analysis, summaries, reports, recommendations, responses, or other outputs generated by AI Services, including outputs from AI Research, AI Contract Review, and AI Analysis.

AI Services

means the artificial intelligence and machine learning features and functionality used by Compass Law (including through the CaseReady platform), encompassing AI Research, AI Contract Review, AI Analysis, and any other AI-assisted tools or features used from time to time.

Applicable Laws

means any applicable local, state, national or international law or regulation, including the Privacy Act, the Australian Consumer Law, the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), the Legal Profession Uniform Law, and any other laws applicable to the operation of a law firm in Australia.

APPs

means the Australian Privacy Principles set out in Schedule 1 of the Privacy Act 1988 (Cth).

CaseReady

means the litigation platform operated by First Counsel (Australia) Pty Ltd and its affiliates, accessible at www.caseready.au.

Compass Law, we, us, our

means FIRSTCOUNSEL (AUSTRALIA) PTY LTD ABN 18 680 946 203, trading as Compass Law.

Personal Information

has the meaning given in the Privacy Act 1988 (Cth) — information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether true or not and whether or not recorded in a material form.

Privacy Act

means the Privacy Act 1988 (Cth), as amended from time to time.

Privacy and Data Protection Laws

means any applicable laws or regulations relating to the collection, use, disclosure, storage, processing, transfer, or protection of Personal Information, including the Privacy Act and the APPs.

Sensitive Information

has the meaning given in the Privacy Act 1988 (Cth), including information or an opinion about an individual's racial or ethnic origin, political opinions, religious or philosophical beliefs, sexual orientation, criminal record, or health information.

Service Providers

means third parties to whom Compass Law outsources certain functions, including IT and technology contractors, cloud service providers, AI model providers, data hosting providers, finance agencies, marketing partners, and professional advisers.

Spam and Marketing Laws

means the Spam Act 2003 (Cth), the Do Not Call Register Act 2006 (Cth), and any other applicable laws relating to electronic marketing or unsolicited communications.

Website

means the Compass Law website at www.compasslaw.au.