Growth Huntr Pty Ltd ABN 21 631 756 584 (Growth Huntr, we, us, our)

Last updated: 7 October 2026

About this policy

This policy explains how Growth Huntr collects, uses, stores, discloses and protects personal information. It applies to our website, marketing, events and client services, including visitors to our website, people who enquire about our services, our clients and their personnel, and personal information we access when we provide Services to our clients.

Under clause 2.2 of our Master Services Agreement (MSA), a client who accepts the MSA also accepts this policy. Capitalised terms used in this policy (such as Agreement, Services, Ad Account, Ad Platform, Client System, Data Incident and SOW) have the meanings given in the MSA. If anything in this policy is inconsistent with an Agreement, the Agreement prevails.

Our commitment

We comply with the Privacy Act 1988 (Cth) (Privacy Act), including the Australian Privacy Principles (APPs). We have also agreed with our clients, in clause 19 of the MSA, to comply with the Privacy Act and to take all reasonable steps to protect and secure personal information.

Where the law requires consent, we collect and use personal information with consent. Otherwise, we collect and use it only where it is reasonably necessary for our functions and activities and consistent with the APPs.

Personal information is information or an opinion about an identified individual, or an individual who is reasonably identifiable. We do not ask for sensitive information (such as health information or information about racial or ethnic origin) and we handle it only where someone provides it voluntarily and it is needed for the purpose it was given.

Two kinds of information we handle

We handle personal information in two different capacities, and different rules apply to each.

1. Our own business information. This is personal information we collect for our own business purposes, such as the names and contact details of clients, prospective clients, suppliers and website visitors.
2. Client Data. This is personal information belonging to our clients that we access while providing the Services. It includes information about our clients' customers held in Client Systems such as Shopify, Klaviyo, analytics platforms and Ad Accounts, and customer lists a client asks us to use for advertising audiences. We handle Client Data only on our client's behalf and only to perform the relevant Agreement.

Our own business information

What we collect. We may collect:

• identity and contact information, such as name, email address, phone number, business name and role;
• commercial information, such as enquiry details, meeting notes, proposals, SOWs, billing contacts and payment and invoicing details;
• website and device information, such as IP address, device identifiers, browser type, pages visited, referral source and information collected by cookies and similar technologies.

How we collect it. We collect this information when you contact us, submit a form, request a proposal, sign up for updates, engage us for Services, communicate with our team or browse our website. We may also receive it from third parties where you would reasonably expect it, such as your colleagues or our service providers.

How we use it. We use this information to respond to enquiries, prepare proposals and SOWs, provide and manage the Services, issue invoices and collect payment, communicate with you, operate and improve our website and business, and meet our legal, accounting and risk management obligations.

Direct marketing. We may send marketing communications to our own contacts. You can opt out at any time using the unsubscribe link or by contacting us. We comply with the Spam Act 2003 (Cth) and the APPs on direct marketing. We never use Client Data for our own marketing.

Cookies. Our website uses cookies and similar technologies to operate and to understand how it is used. You can control cookies through your browser settings, although parts of the website may not work as intended if you disable them.

Client Data under our MSA

How we access Client Data. Under clause 6.1 of the MSA, clients give us access to the materials and data we need to perform the work, and under clause 9.2 clients authorise us to use, control and manage their Ad Accounts. We access Client Data through the access our clients grant us, using named user accounts wherever the platform supports them.

How we use Client Data. In line with clauses 19.2 and 19.3 of the MSA, we:

• access and use Client Data only in connection with performing the relevant Agreement;
• limit access to team members who need it to deliver that client's Services;
• do not disclose Client Data to unauthorised third parties;
• do not use Client Data for our own marketing, sell it, or combine one client's data with another client's data;
• do not use Client Data to train AI models; and
• handle Client Data as Confidential Information under clause 20 of the MSA.

Advertising audiences. Where a client asks us to use a customer list for advertising (for example, a Meta custom audience or a Google customer match list), we upload it to the relevant Ad Platform for that client's Ad Account only. Ad Platforms typically hash this data on upload. We delete any local copies of the list once the upload is complete.

Our clients' responsibilities. Our clients remain responsible for their own compliance with Applicable Laws, as clause 6.2 of the MSA requires. This includes giving their customers appropriate privacy notices and obtaining any consents needed for the advertising and tracking activities we carry out on their behalf, such as website pixels, conversion tracking and customer list matching. Clients are also responsible for maintaining their own backups of Client Systems and Client Data under clause 6.3 of the MSA.

Requests from our clients' customers. If one of our clients' customers asks us to access or correct their personal information, or makes a complaint about it, we will refer the request to the relevant client and help the client respond.

AI and automation tools

We use AI-enabled tools to support our work, including for drafting, summarising, transcription, analysis, reporting and workflow automation. We apply these safeguards:

• Approved tools only. Our team may use only AI tools and integrations we have approved. We approve tools that offer business terms under which our inputs and outputs are not used to train the provider's models, and we assess each tool's data retention, access controls and security before approval.
• Client Data limits. Client Data may be processed by an approved AI tool only in connection with performing the relevant Agreement, and never in a public or consumer AI tool.
• Data minimisation. We avoid putting personal information into AI tools where the task can be done without it, and we prefer aggregated or de-identified data, such as performance metrics, over customer-level records. We train our team not to enter unnecessary identifiers, such as names, email addresses, phone numbers, street addresses or account IDs.
• Human review. AI output can be wrong or incomplete. A team member reviews AI-assisted work before it is relied on, sent to a client or used to change an Ad Account.

Automated decisions. We do not use computer programs to make decisions that could reasonably be expected to significantly affect the rights or interests of an individual. If that changes, we will update this policy before we do so.

Who we disclose personal information to

We may disclose personal information to:

• our employees and contractors who need it to perform their role, all of whom are bound by confidentiality obligations consistent with clause 20 of the MSA;
• service providers we use to run our business, such as cloud hosting, email, project management, communication, analytics, accounting and approved AI tools;
• Ad Platforms and other third-party platforms, where this is part of the Services a client has asked us to provide;
• our professional advisers, such as lawyers, accountants, auditors and insurers; and
• regulators, courts, law enforcement or government agencies, where required or authorised by law.

We do not sell personal information.

Overseas disclosure

The data we hold is stored in Australia. Some of our team members work outside Australia, including in the Philippines, and access Client Data and our own business information remotely from there to deliver the Services.

Ad Platforms such as Meta, Google, TikTok and Pinterest operate globally and may process data outside Australia under their own terms. Where we upload or manage data in an Ad Platform, we do so in the client's own Ad Account and on the client's instructions.

Before personal information is disclosed overseas, we take reasonable steps to make sure the recipient handles it consistently with the APPs. These steps include the confidentiality obligations in our team members' letters of offer and contracts, contractual protections with service providers, and the security controls described in this policy.

Security

We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. We maintain an internal Cyber Security, Information Security and Privacy Policy that every team member must follow. Our controls include:

• multi-factor authentication and an approved password manager;
• encryption in transit, secure backups and monitoring;
• least-privilege access, with access reviewed when roles change and removed promptly when no longer needed;
• restrictions on storing information outside approved company systems;
• approval requirements for third-party applications and integrations; and
• mandatory cyber security training for all team members.

Data Incidents

If we become aware of, or have reasonable grounds to suspect, a Data Incident, we will act in line with clause 19.4 of the MSA. We will:

1. immediately take reasonable steps to contain the Data Incident;
2. immediately notify any affected client, with enough detail for the client to determine whether the Data Incident is an eligible data breach under the Privacy Act; and
3. give the client reasonable assistance and information, including in any investigation by the Office of the Australian Information Commissioner (OAIC) and in notifying affected individuals where required.

Where a Data Incident involves our own business information, we will assess it under the Notifiable Data Breaches scheme and notify affected individuals and the OAIC where required.

Retention and the end of an engagement

We keep our own business information only for as long as we need it for the purposes in this policy or as the law requires, for example tax and accounting records. We then delete or de-identify it.

When an Agreement or the MSA ends, the client is responsible for disconnecting its Ad Accounts from Growth Huntr under clause 21.4 of the MSA. We will also remove our own access to the client's Client Systems, and within 30 days we will delete Client Data held in our systems or return it to the client on request. We may keep information we are legally required to retain, and we will remove or de-identify personal information in any Working Files we retain under clause 14.2 of the MSA.

Access, correction and complaints

You may ask for access to the personal information we hold about you, or ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading. Requests about Client Data are handled as described under "Client Data under our MSA".

If you believe we have mishandled your personal information, please contact us. We will acknowledge your complaint promptly and aim to respond within 30 days. If you are not satisfied with our response, you may complain to the OAIC at www.oaic.gov.au.

Changes to this policy

We may update this policy from time to time and will publish the current version on our website and at https://growthhuntr.com/privacy with its version number and date. A change to this policy will not reduce the protections given to Client Data under an existing Agreement unless the client agrees in writing.

Contact us

If you have any questions about this policy or how we handle personal information, please contact us:

Growth Huntr Pty Ltd

Level 2/8 Innovation Parkway, Birtinya QLD 4575

Email: harry@ghuntr.com or jack@ghuntr.com