Privacy Policy
Fitzroy Associates Pty Ltd, trading as Surity360 (“Surity360”, “we”, “us”, “our”), operates Ask Arkie (askarkie.au) — the AI agent built on the Surity360 governed-data platform. We are committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and share Personal Information, in line with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (the “APPs”).
Ask Arkie reconciles data from an advice practice’s existing systems (such as XPlan, the practice CRM, HUB24, North, MyProsperity, an advice-document tool, and SharePoint) into a single auditable client record, and prepares structured evidence for the Best Interests Duty, Annual Advice Agreement, and ongoing fee-consent processes. This Policy applies to askarkie.au (the “Site”) and to the Ask Arkie / Surity360 platform.
Data sovereignty, in one line. Each practice’s reconciled client record lives in its own dedicated MongoDB Atlas cluster and Google Cloud project, in Sydney, Australia — provisioned for that practice alone. It is never pooled into a shared data lake, never co-located with another practice, and no client data leaves Australia. Your data is your asset, under your control, and yours to take with you.
This Privacy Policy may be updated periodically. All changes will be communicated by publishing the updated Policy on this page. We encourage you to review it from time to time.
Contents
- Introduction and scope
- What we mean by Personal Information
- What we collect, how, and why
- Anonymised and aggregated data
- Cookies and tracking
- How we keep information secure
- How long we keep your information
- Where your information is stored
- Who we share your information with
- Marketing communications
- If you choose not to provide information
- Contacting us and complaints
- Australian-specific clauses (NDBS & APP rights)
- Visitors from the EEA, UK, or elsewhere
1. Introduction and scope
1.1 We are Fitzroy Associates Pty Ltd, trading as Surity360, an Australian-registered company operating from Tasmania, Australia. Ask Arkie is the agent product of our Surity360 governed-data platform for Australian advice practices.
1.2 For the purposes of this Policy, references to “you” and “your” mean any visitor to the Site, any practice or individual who purchases or evaluates Ask Arkie, and any individual whose Personal Information we hold in the course of running our business.
1.3 In the language of Australian privacy law, Surity360 is the holder of Personal Information that we collect directly — for example, the email address you provide when you book a discovery call. Where the platform processes the personal information of an advice practice’s clients (for example, fact-find data ingested from MyProsperity, or holdings data from HUB24), the practice is the controller of that information and Surity360 is its data processor under the standard Data Processing Agreement that forms part of every contract.
2. What we mean by Personal Information
2.1 Under the Australian Privacy Act 1988 (Cth), “Personal Information” means “information or an opinion about an identified individual, or an individual who is reasonably identifiable”, whether the information is true or not and whether it is recorded in a material form or not.
2.2 Where the term “Personal Information” appears in this Policy, it has the meaning set out above. For visitors from the European Economic Area (“EEA”), the United Kingdom, or Switzerland, we treat “Personal Data” as defined in the EU and UK General Data Protection Regulation as having the equivalent meaning.
3. What we collect, how, and why
3.1 The Personal Information we collect from you, and how we collect it, depends on the way you interact with us. The table below summarises the main categories.
| What we collect | How we collect it | Why we use it |
|---|---|---|
| Name, email address, phone number, organisation, role — provided voluntarily by visitors to the Site. | When you book a discovery call, fill in a contact form, or otherwise contact us. | To respond to your enquiry and (with your consent) to keep you informed about Ask Arkie. |
| Technical data — IP address, user-agent string, request timing — collected by Cloudflare Pages as part of standard request logs. | Automatically when you browse the Site. | To deliver the Site, prevent abuse and fraud, monitor service integrity, and produce aggregated traffic measures. We run no advertising or remarketing scripts on the Site. |
| Usage and device data — pages viewed, referring URL, approximate (city-level) location derived from a truncated IP, browser and device type — collected by Google Analytics 4. | Automatically when you browse the Site, via the Google Analytics (gtag.js) script. | To understand, in aggregate, how visitors find and use the Site so we can improve it. Google Analytics is configured to use cookies and processes this data on our behalf; see section 5. We do not use it for advertising or remarketing. |
| Practice contact details — principal name, adviser names, business address, billing details — provided when you sign a pilot or subscription agreement. | Through the pilot agreement, the discovery call, or direct correspondence. | To deliver the platform to your practice, to invoice for the service, to provide technical support, and to keep you informed about platform updates. |
| Authentication data — bcrypt-hashed passwords, session tokens, audit log entries — for users of the platform. | When a practice user logs in to the platform. | To verify identity, enforce role-based access control, and produce per-action audit trails. |
| Practice client data — reconciled client records, holdings data, fact-find data, document references — ingested from the practice’s existing systems. | Through OAuth, API, SFTP, and authorised browser automation, in each case configured by the practice. | To deliver the platform to the practice. Surity360 is the data processor of this information; the practice remains the controller. |
3.2 We may also use your Personal Information to comply with a legal obligation — for example, recording your marketing preferences, responding to a lawful request from a regulator or law-enforcement agency, retaining records to support a legal claim, or notifying an eligible data breach.
4. Anonymised and aggregated data
4.1 We may anonymise Personal Information we hold (so it can no longer identify you) and combine it with other anonymous information to produce aggregated data — for example, average pilot duration, or the proportion of practices using a given platform connector. Australian and overseas data protection laws do not generally apply to aggregated data, and the rights described below do not apply to it.
5. Cookies and tracking
5.1 askarkie.au (the marketing site) uses Google Analytics 4 to measure aggregate traffic. Google Analytics sets cookies on your device and collects the usage and device data described in section 3 (including a truncated IP address for approximate, city-level location). We use it only to understand how the Site is used in aggregate; we do not run advertising pixels, remarketing tags, or any other third-party tracking. Apart from Google Analytics, the Site sets no cookies and runs no other client-side JavaScript, and is otherwise delivered as static HTML, CSS, and inline SVG over Cloudflare Pages.
5.2 Google Analytics processes this data as our service provider. Google may transfer and store the data outside Australia (including in the United States) under its own terms. You can opt out across all sites by installing the Google Analytics Opt-out Browser Add-on, or by blocking cookies in your browser. If we introduce any additional non-essential cookie in the future, we will update this section.
5.3 The platform itself (accessed via authenticated practice URLs, separate from this marketing site) uses session cookies that are strictly necessary for login and security. These are set only on authenticated platform domains and do not apply to public visitors of askarkie.au.
6. How we keep information secure
6.1 We take the security of your Personal Information seriously. The platform implements technical and organisational controls that include:
- Each practice in its own dedicated cluster: a practice’s reconciled client record lives in its own dedicated MongoDB Atlas cluster and Google Cloud project — physical isolation, not a logical partition of shared infrastructure. There are no shared databases and no cross-practice access paths.
- Australian-only hosting: compute on Google Cloud (australia-southeast1, Sydney); structured data on MongoDB Atlas (Sydney). No client data leaves Australia.
- Encryption: all data at rest is encrypted on the underlying cloud platforms; data in transit is protected by TLS 1.2 or 1.3.
- Independently certified infrastructure: Google Cloud and MongoDB Atlas are both certified to ISO 27001 and SOC 2 Type II.
- Two-layer authentication: Cloudflare Access guards the perimeter with mandatory two-factor authentication and email verification on every login. Application access is then gated by bcrypt-hashed passwords and role-based permissions.
- Secrets management: credentials and API keys live in Google Cloud Secret Manager, never in code or in environment files.
- Audit trails: per-user and per-action audit logs are retained for compliance and security review. Manual data overrides (for example, a sync from one source system to another) are tagged with the user identity that authorised them.
- Offshore administrative access: where a practice authorises offshore staff (for example, Manila-based paraplanning) to access the platform, those users are subject to the same Cloudflare two-factor authentication, role-based permissions, and per-action audit log as onshore users — aligned with ASIC’s October 2025 expectations on offshore outsourcing.
6.2 If we become aware of an incident affecting your Personal Information, we will investigate it, take steps to contain it, notify the appropriate regulator where required, and keep you informed where required under applicable data protection law.
7. How long we keep your information
7.1 We retain Personal Information only for as long as necessary to fulfil the purposes for which it was collected, including any legal or accounting obligations. To decide retention periods we consider the volume, nature, and sensitivity of the information, the potential harm from unauthorised use, whether we still need the information to achieve the original purpose, and any minimum retention periods set by law.
7.2 The platform maintains a compliance evidence chain — the dated, sourced record of changes to a client’s reconciled data — for seven years, consistent with the record-keeping expectations of the Corporations Act and ASIC RG 175. This evidence chain is held within the practice’s own cluster.
7.3 Marketing contact details are retained until you ask us to stop contacting you.
7.4 Practice client data ingested into the platform is retained while the practice subscription is active and for the period set out in the practice’s Data Processing Agreement, after which it is deleted or returned to the practice on request.
8. Where your information is stored
8.1 All Personal Information collected in connection with the platform is stored in Australia — on Google Cloud (australia-southeast1, Sydney) and MongoDB Atlas (Sydney), in the practice’s own dedicated project and cluster. No client data leaves Australia.
8.2 Marketing-site form submissions and direct contact are stored in the same Australian-hosted infrastructure.
8.3 A small number of operational sub-processors operate from outside Australia — for example, Cloudflare provides DNS, CDN, and edge protection from a global network. Where this is the case, the data exposed is limited to what is strictly necessary for the service (for example, the IP address of an inbound HTTP request) and is governed by the relevant sub-processor’s contractual commitments. A current list of sub-processors is available on request.
9. Who we share your information with
9.1 We share Personal Information with the following categories of third party, only where necessary and with appropriate contractual protections in place.
| Recipient | Purpose |
|---|---|
| Infrastructure providers — Google Cloud (australia-southeast1, Sydney) and MongoDB Atlas (Sydney) for compute, storage, and data services. Cloudflare for DNS, CDN, edge security, and the public marketing site (Cloudflare Pages). | To run the platform and the public Site. |
| Identity and access providers — Cloudflare Access for two-factor perimeter authentication. Google Cloud Secret Manager for secrets storage. | To verify user identity and protect access to the platform. |
| AI and language-model provider — Google Gemini, via Google AI Studio or Vertex AI (the Australian regional endpoint, australia-southeast1, for residency-sensitive practices). We use it only for narrowly scoped extraction and synthesis tasks initiated by the practice over its own governed data, reviewed by the adviser. We do not use any of your Personal Information, practice data, fact-find content, or uploaded documents to train any large language model. | To enable specific platform features (for example, extracting structured fields from a fact-find PDF or preparing a meeting brief). |
| Communication providers — Gmail SMTP (Google) for transactional and notification email; Microsoft Graph (M365) for ROA-email reading and document filing where the practice has authorised this. | To send and receive email on the practice’s behalf. |
| Practice-authorised third-party platforms — HUB24, North (AMP), Worksorted, MyProsperity, SharePoint, Sharesight, the practice CRM, and others where the practice has elected to integrate them. | To ingest and reconcile the practice’s own data on its behalf. |
| Professional advisers — auditors, accountants, lawyers, and other regulated professional consultants engaged by Surity360. | To obtain advice in running our business. |
| Authorities — any government, regulator, self-regulatory body, or law-enforcement agency. | Where we are under a legal obligation to disclose, or where disclosure is necessary to protect the rights, property, or safety of Surity360, our customers, or others. |
| Successors in a corporate transaction — a buyer, investor, or counterparty in a sale, merger, reorganisation, change of control, or similar transaction. | For the purposes of the relevant transaction. Any such successor is bound by the same Privacy Policy or an equivalent one. |
9.2 Where we share Personal Information with a third party for processing on our behalf, we put a Data Processing Agreement in place that sets out the purpose, security expectations, and retention obligations. The standard practice contract also includes a Data Processing Agreement that governs the practice’s data.
9.3 We do not sell your Personal Information.
10. Marketing communications
10.1 Where you have consented, we may send you occasional updates about Ask Arkie, including new product capabilities and relevant sector commentary. You can opt out at any time by clicking the unsubscribe link in any marketing email, or by emailing hello@askarkie.au.
10.2 We may still send you administrative messages (for example, a contract update or a security notice) even if you have unsubscribed from marketing.
11. If you choose not to provide information
11.1 Where we ask for Personal Information so that we can provide a service to you (for example, your name and email to arrange a discovery call), and you choose not to provide it, we may not be able to provide that service. We will tell you at the point of collection where this is the case.
12. Contacting us and complaints
12.1 If you have a question, request, or complaint about your Personal Information or this Policy, please contact us by email at hello@askarkie.au or by post at 9 St Johns Ave, New Town TAS 7008, Australia.
12.2 Our aim is to resolve your complaint as soon as possible and within five (5) business days. If we need more time, we will let you know. We will investigate the matter, keep you informed, and tell you in writing about the steps we have taken and the outcome.
12.3 Our privacy and complaints contact details are:
Ask Arkie — Privacy and Complaints
9 St Johns Ave, New Town TAS 7008
Email: hello@askarkie.au
12.4 Ask Arkie and the Surity360 platform are a data and software service; they do not give personal financial advice. A complaint about financial advice itself is a matter for your licensed financial adviser and their AFS licensee, who are responsible for the advice provided to you.
12.5 Under the Privacy Act 1988 (Cth) you may also complain to the Office of the Australian Information Commissioner (“OAIC”) if you are not satisfied with our response to, or our handling of, your complaint. We would encourage you to contact us first so that we have an opportunity to address your concerns directly.
12.6 The OAIC’s contact details are:
Office of the Australian Information Commissioner
GPO Box 5218, Sydney NSW 2001
Phone: 1300 363 992
Email: enquiries@oaic.gov.au
Online: oaic.gov.au
13. Australian-specific clauses
13.1 Notifiable Data Breach Scheme
If we become aware of a data breach that is likely to result in serious harm and that triggers the Notifiable Data Breach Scheme under the Australian Privacy Act, we will follow the process and timing set out by the OAIC: contain the breach where possible, complete a risk assessment within 30 days, and notify affected individuals and the OAIC where required.
13.2 Your rights under the Australian Privacy Principles
If you are an Australian resident, the APPs give you the following rights, subject to certain exceptions in the Privacy Act:
- You may request access to the Personal Information we hold about you.
- You may request that we correct any Personal Information that is inaccurate, out of date, incomplete, irrelevant, or misleading.
- You may request that we delete or de-identify Personal Information where we no longer have a lawful reason to hold it.
- You may ask us not to send you marketing material at any time. We may still send you administrative communications.
- If you are not satisfied with how we have handled your information, you may complain to the OAIC.
To exercise any of these rights, email hello@askarkie.au with the details of your request. We will respond within a reasonable period and, where required, explain any reason we are not able to comply in full.
13.3 Automated decision-making
Ask Arkie prepares structured evidence and surfaces compliance flags — for example, an Annual Advice Agreement nearing expiry, or a Best Interests Duty step that is missing evidence. These outputs are designed to be reviewed by a qualified human adviser, who remains solely responsible for the advice given. Ask Arkie does not make automated decisions about individuals that have legal or similarly significant effects on them.
14. Visitors from the EEA, UK, or elsewhere
14.1 We provide our platform to Australian advice practices, and our customer base is Australian. The Site is, however, accessible from anywhere in the world, and we may collect limited Personal Information (for example, name and email submitted on a contact form) from visitors based outside Australia.
14.2 If you are a resident of the EEA, the United Kingdom, or Switzerland, the EU and UK General Data Protection Regulation give you rights that are broadly equivalent to the Australian rights set out in section 13.2 — including the right to access, rectify, erase, restrict, port, and object to the processing of your Personal Data, and the right to withdraw consent at any time. To exercise any of these rights, email hello@askarkie.au. You may also lodge a complaint with your local supervisory authority, but we encourage you to contact us first.
14.3 Where we transfer Personal Data from the EEA, the UK, or Switzerland to Australia, the transfer is made on the basis of an adequacy decision, the relevant Standard Contractual Clauses, or another lawful transfer mechanism.
← Back to askarkie.au