Privacy Policy

Arthur Regulatory Alerts

Last Updated: 26 October 2026

1. Introduction

ALG Pty Ltd (ACN 695 606 725), trading as Arthur Regulatory Alerts (“we”, “us” or “our”) understands that your privacy is important. This policy sets out how we handle your personal information. It applies to the Arthur Regulatory Alerts website at https://alag.com.au and the email alerts, digests and related services we provide through it (together, our “services”). Our services are also governed by our Terms of Use.

By using our services you consent to the handling, collection, use and disclosure of your personal information in accordance with this policy and as otherwise permitted or required by law.

We may modify or amend this policy from time to time by publishing an updated version on our website. We will notify you of any material changes at least 30 days before they take effect.

2. Collection of Personal Information

2.1 Circumstances of Collection

We may collect personal information about you when we deal with each other, including when:

• you subscribe to our alerts or digests, or change your delivery preferences;
• you contact us by any method, such as email;
• you visit our website; or
• otherwise as notified to you from time to time, including in any collection notice.

Our services do not require you to upload documents or other content, and we ask that you do not send us confidential or sensitive information.

2.2 Collection via Third Parties

We do not collect information about you from your other accounts, systems or services. We may receive technical information about the delivery of our emails (for example, that an email bounced or could not be delivered) from our email service provider. We may also collect information about you from our service providers and contractors that perform services for us in connection with our business.

2.3 Automated Collection

We and our hosting and technology providers may collect information through automated means when you visit our website or interact with our services, including:

1. your IP address;
2. the date, time and duration of your visit;
3. the pages or functions you accessed;
4. the browser, system or device you are using; and
5. performance metrics and error logs.

Cookies

We do not currently use cookies or similar technologies to track you across websites or to build profiles about you. Our hosting providers may use technically necessary technologies to deliver the website securely. Most browsers are set by default to accept cookies, and you can set your browser to prompt you or to reject them. If we introduce analytics or other cookies in future, we will update this policy.

2.4 Analytics Information

We do not currently use third-party analytics services on our website. Our hosting providers may produce aggregated technical statistics (for example, page views and error rates). If we introduce analytics services in future, we will update this policy and describe the services used.

2.5 Third Party Websites

Our website and emails contain links to regulators, legislative bodies, industry bodies and other third-party websites. We are not responsible for the privacy practices of those websites. We recommend that you review the privacy policy of each website that you visit.

2.6 Interacting with Us Anonymously or with a Pseudonym

You can browse our website anonymously. To receive our alerts and digests we need an email address, so we cannot provide those services to you anonymously. If you do not provide your personal information, we may not be able to provide our services to you or deal with you effectively.

3. Types of Personal Information We Collect

The personal information we collect may vary depending on the nature of your interaction with us, but is generally limited to:

Subscriber Information:

• your email address;
• your delivery preferences (for example, immediate alerts, a daily digest, or both, and any source or topic preferences we offer);
• the date and time you subscribed or changed your preferences, and your subscription status.

Communications:

• the content of messages you send us, and our responses; and
• information about the delivery of emails we send you (such as delivered, bounced or failed).

Technical Information:

• information collected automatically as described in section 2.3, such as IP address, browser type and error logs.

We do not intend to collect sensitive information (as defined in the Privacy Act 1988 (Cth)) about you, and we ask that you do not provide it to us. We do not collect payment card or billing information, and we do not collect compliance policies or other documents from you.

4. Using Your Personal Information

4.1 General Use

We collect and use your personal information for the purposes of providing, operating, maintaining and improving our services, and for related functions and activities, including assisting entities within our corporate group to carry out their functions and activities.

4.2 Specific Use

Without limiting the above, we may use personal information for the purposes for which it was collected, for related purposes which come within your reasonable expectations, for purposes outlined in this policy, for purposes to which you otherwise consent, or as otherwise permitted or required by law, including:

Service Delivery and Operations:

• to send you alerts, daily digests and summaries (prepared using automated tools, including artificial intelligence) according to your preferences;
• to manage your subscription and preferences, including processing unsubscribe requests;
• to provide support and respond to your inquiries; and
• to operate, maintain and troubleshoot our website and services.

Service Improvement:

• to monitor performance, reliability and email delivery, and to improve our services using aggregated or de-identified information.

Important limitation on AI: We use artificial intelligence to summarise public regulatory and legislative material. We do not send your email address or other personal information about you to our AI provider as part of generating summaries, and we do not use your personal information to train AI models.

Communications:

• to communicate with you about our services, including operational notices, security notices, updates and administrative messages; and
• to tell you about changes to Arthur Regulatory Alerts and related services we offer, in accordance with applicable laws and your preferences. You can opt out of these messages at any time.

Security and Compliance:

• to monitor, detect, prevent and investigate fraud, abuse, security incidents and other harmful activity;
• to enforce our terms and policies;
• to comply with our legal and regulatory obligations or as otherwise permitted or required by law; and
• to create de-identified or anonymised data (which we may use for any purpose).

4.3 Examples of Use

Subscribers: If you subscribe to our services, we use your email address and delivery preferences to send you alerts and digests, to manage your subscription, to respond to you if you contact us, and to keep our services secure and reliable.

Inquiries: If you contact us, we use the details you provide to respond to your inquiry and, if relevant, to keep a record of it.

5. Sharing Your Personal Information

5.1 Disclosure to Third Parties

We may disclose your personal information to other entities within our corporate group, for example in the context of our shared or related interests and operations. We do not sell your personal information.

We may disclose information to third-party service providers who help us conduct our business, including:

Technology and Infrastructure Providers:

• website hosting and serverless computing providers;
• database hosting providers (which store your subscriber information);
• email delivery providers (which receive your email address in order to send you our emails); and
• code hosting and workflow automation providers used to run the service (which do not receive your personal information except as needed to operate the service).

Professional Services:

• legal advisers, auditors, accountants and IT consultants and contractors.

AI Providers: We send the text of public regulatory and legislative material, not personal information about you, to a third-party AI provider (currently Anthropic) so it can generate summaries. That processing may occur outside Australia.

5.2 Offshoring

Some of our service providers are or may be located overseas. Given the number of providers, it is not practical to list all of the countries in which they are located, but they include the United States and may include the United Kingdom and the European Union. Your personal information may be disclosed to and stored in those locations in connection with our interactions with those providers.

We take reasonable steps to ensure that our overseas service providers handle your personal information in accordance with applicable privacy laws, including through contractual arrangements where appropriate.

5.3 Other Disclosures

We may also disclose your personal information to entities involved in connection with a potential or actual corporate merger, consolidation, restructuring, sale of substantially all of our interests or assets, or other corporate change requiring the transfer of assets, including during any due diligence process, to the purchaser or surviving entity.

We may also disclose your personal information:

• as required or permitted by law, including to comply with legal obligations, regulatory requirements, court orders, or lawful requests by public authorities;
• to protect our rights, property or safety, or the rights, property or safety of others;
• to investigate potential violations of our terms of use; and
• to detect, prevent or address fraud, security or technical issues.

6. Accessing Your Personal Information

6.1 Access and Correction

You may contact us using the contact form in section 9 to request access to the information we hold about you, including for the purpose of correcting or updating it. We take reasonable steps to ensure that your personal information is accurate, complete and up to date whenever we collect or use it.

We will provide access where required under the Privacy Act 1988 (Cth) or where we otherwise agree. In some circumstances we may not be able to provide you with access, such as where:

• providing access would pose a serious threat to the life, health or safety of any individual, or to public health or public safety;
• providing access would have an unreasonable impact on the privacy of others;
• the request is frivolous or vexatious;
• the information relates to existing or anticipated legal proceedings;
• providing access would be unlawful;
• denying access is required or authorised by law; or
• providing access would prejudice enforcement activities, negotiations or investigative functions.

If we deny your request for access, we will provide you with written reasons for the denial (unless it would be unreasonable to do so) and inform you of any complaint mechanisms available.

6.2 Copies and Deletion

You may ask us for a copy of the personal information we hold about you, or ask us to delete it, at any time by contacting us. We will provide your information in a commonly used format where technically feasible. Please note that we may need to retain certain information where required by law or to maintain a record that you unsubscribed.

7. Protecting Your Personal Information

7.1 Protection Measures

We understand the need to protect your personal information. We take reasonable steps, appropriate to the nature of the information we hold, to protect it from misuse, interference, loss and unauthorised access, modification or disclosure, including:

• using encrypted connections (HTTPS) for our website and for connections to our database;
• restricting access to subscriber information to people and systems that need it to operate the service;
• storing access credentials as protected secrets rather than in our published code; and
• selecting reputable technology providers and requiring appropriate security from them.

However, despite our security measures, we cannot guarantee absolute security. No method of transmission over the internet or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee its absolute security.

If we become aware of an eligible data breach, we will comply with the notification requirements of the Privacy Act 1988 (Cth).

7.2 Data Storage and Offshoring

We seek to store subscriber information in servers and facilities in Australia where our providers offer an Australian region. Some information (such as logs, email delivery data and information held by our providers) may also be transferred to and stored in servers and facilities in other countries, including the United States, where our hosting and service providers operate.

Important Notice Regarding Offshore Disclosure: You consent to the offshore disclosures contemplated by this privacy policy. You understand that:

• we may not be able to, and are not required to, take steps to monitor, control, prevent or determine whether overseas entities handle your personal information in accordance with the Australian Privacy Principles in the Privacy Act 1988 (Cth);
• if an overseas recipient breaches the Australian Privacy Principles, you may not be able to seek redress under the Privacy Act for the mishandling of your personal information by that overseas entity; and
• we take reasonable steps to ensure our overseas service providers comply with applicable privacy laws through contractual arrangements.

If you do not consent to such offshore disclosure, please do not use our services or provide us with your personal information.

7.3 Retention of Your Personal Information

We retain your personal information for as long as necessary to fulfil the purposes outlined in this privacy policy, unless a longer retention period is required or permitted by law.

Specific Retention Periods:

• Subscriber information (email address, delivery preferences and subscription status) is retained while you are subscribed. If you unsubscribe or ask us to delete your information, we will delete or de-identify it within 90 days, except that we may keep a minimal record (such as your email address and the date you unsubscribed) for as long as necessary to honour your unsubscribe request and to meet our legal obligations.
• Communications and support: messages you send us and our responses are retained for 3 years.
• Technical logs: server and error logs are retained by our providers for the periods they set, which are generally short.
• De-identified data: de-identified and anonymised data may be retained indefinitely for analytics and service improvement.

When we no longer require your information, we take reasonable steps to destroy it, de-identify it, or render it inaccessible.

8. Your Rights and Choices

8.1 Unsubscribing and Communications

You may unsubscribe from our alerts and digests, or opt out of any other communications from us, at any time by using the unsubscribe option in our emails or by contacting us through the contact form at https://alag.com.au/#contact. Please note that even if you unsubscribe, we may still send you a final confirmation and any message we are required by law to send.

8.2 Deletion

You may request deletion of your personal information at any time by contacting us through the contact form at https://alag.com.au/#contact. Deletion is permanent and cannot be undone. We may retain certain information where required by law or as described in section 7.3.

9. Contact Information

If you have any queries or complaints about our collection, use or management of your personal information, please contact us through the contact form at https://alag.com.au/#contact.

If you make a complaint, we will endeavour to respond within a reasonable time (usually 30 days). Our complaint handling process includes:

1. acknowledging your complaint within 5 business days;
2. investigating the matter;
3. providing a written response outlining our findings and any corrective action; and
4. working with you to resolve the issue.

If you are dissatisfied with our response, you may make a complaint to the Office of the Australian Information Commissioner:

• Phone: 1300 363 992
• Email: enquiries@oaic.gov.au
• Website: www.oaic.gov.au
• Mail: GPO Box 5218, Sydney NSW 2001

10. Disclaimer – Not Legal Advice; Information Purposes Only

Our services and their outputs are provided for general information and reference purposes only. They do not constitute, and must not be relied upon as, legal advice, compliance advice, financial product advice or any other form of professional advice. Using our services does not make you a client of any law firm or professional adviser, and does not create a solicitor-client relationship or any other professional relationship between you and us.

Our services use artificial intelligence to summarise public regulatory and legislative material. Outputs, including alerts, summaries, classifications and priority flags, may not always be accurate, complete or current. Nothing in our services or their outputs is warranted to be free of errors, and you are responsible for independently verifying any output against the source before acting on it.

Our services and all outputs are provided on an “as is” and “as available” basis. To the maximum extent permitted by law, we expressly disclaim all warranties, whether express or implied, including any implied warranty of merchantability, fitness for a particular purpose, accuracy or currency. Your use of information obtained through our services is at your own risk.

Information you send to us is not treated as legally privileged or confidential by reason of being sent alone.

11. Children’s Privacy

Our services are not directed to children under the age of 18, and we do not knowingly collect personal information from children under 18. If we become aware that we have collected personal information from a child under 18, we will take steps to delete it as soon as practicable. If you believe we have collected information from a child under 18, please notify us immediately through the contact form at https://alag.com.au/#contact.

12. Changes to This Privacy Policy

We may update this privacy policy from time to time to reflect changes in our practices, technology, legal requirements or other factors. When we make material changes, we will:

• update the “Last Updated” date at the top of this policy;
• provide notice through our website;
• notify you by email at least 30 days before the changes take effect; and
• where the change materially affects how we use your personal information, seek your consent where required by law.

We encourage you to review this privacy policy periodically. Your continued use of our services after the effective date of changes constitutes your acceptance of those changes. If you do not agree to the changes, you should stop using our services and unsubscribe.

13. Additional Information for Specific Jurisdictions

This privacy policy is designed to comply with Australian privacy laws, including the Privacy Act 1988 (Cth) and the Australian Privacy Principles. If you are located in other jurisdictions, additional rights may apply to you under local privacy laws.

For European Users (GDPR): If you are located in the European Economic Area, you may have additional rights under the General Data Protection Regulation (GDPR), including:

• the right to data portability;
• the right to restriction of processing;
• the right to object to processing; and
• rights related to automated decision-making.

For California Users (CCPA): If you are a California resident, you may have additional rights under the California Consumer Privacy Act (CCPA).

For information about rights specific to your jurisdiction, or to exercise those rights, please contact us through the contact form at https://alag.com.au/#contact.