Privacy Policy

Effective Date: 23 April 2025

Novaflow Digital (“we”, “us”, “our”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and share your personal information when you visit novaflowdigital.com.au. It is prepared in compliance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), the Spam Act 2003 (Cth), the Do Not Call Register Act 2006 (Cth), the Australian Consumer Law, and — where applicable — the EU General Data Protection Regulation (GDPR).

By using our website, you agree to the collection and use of your information as described in this Policy.

1. Who We Are

Novaflow Digital is an Australian digital marketing agency specialising in Google Ads, Meta Ads, and content creation for schools and educational institutions. We are the APP entity responsible for the personal information we handle, and where the GDPR applies, we act as the data controller.

Privacy Officer: James
Email: james@novaflowdigital.com.au
Phone: 0427 254 181
Location: Australia (Servicing Nationwide)

2. Information We Collect

We may collect the following types of personal information:

  • Identity & Contact Details: Name, job title, email address, phone number, and school or organisation name — provided when you complete a form, book a call, or contact us directly.
  • Enquiry & Form Data: Information submitted via our contact forms, free marketing audit form (Google Forms), or Calendly booking tool.
  • Usage & Technical Data: IP address, browser type, pages visited, time on site, and device information — collected automatically when you browse our website.
  • Cookie & Tracking Data: Information gathered via cookies and tracking pixels, including those from Google Analytics, Google Ads, Facebook (Meta), TikTok, and LinkedIn. See Section 7 for more detail.
  • General Location Data: Country, state, and city-level location derived from your IP address.

We do not intentionally collect sensitive information (such as health, racial, religious, or biometric data). If you voluntarily provide such information, we will handle it with additional care and will not use or disclose it without your explicit consent.

3. How We Use Your Information

We use your personal information only for the purposes for which it was collected or directly related purposes, including:

  • Delivering and managing our digital marketing services;
  • Responding to your enquiries and conducting onboarding;
  • Sending service-related communications and, where you have consented, marketing materials;
  • Running and measuring the performance of digital advertising campaigns;
  • Analysing website traffic and improving our website;
  • Complying with legal obligations and protecting our rights.

We will not use your information for any purpose incompatible with the reason it was collected unless we have your consent or are required to do so by law.

4. Legal Bases for Processing (GDPR)

Where the GDPR applies, we process your personal data on the following lawful bases:

  • Contract: To fulfil or prepare a contract with you (Article 6(1)(b)).
  • Legitimate Interests: For marketing, analytics, and business operations, where these do not override your rights (Article 6(1)(f)).
  • Consent: For non-essential cookies and direct marketing, where you have given prior consent (Article 6(1)(a)). You may withdraw consent at any time.
  • Legal Obligation: Where required by applicable law (Article 6(1)(c)).

5. Sharing Your Information

We do not sell, rent, or trade your personal information. We may share it with the following parties on a need-to-know basis:

  • Google LLC — for Google Ads, Google Analytics, and Google Forms. See Google’s Privacy Policy.
  • Meta Platforms, Inc. — for Facebook and Instagram advertising, including the Facebook Pixel. See Meta’s Privacy Policy.
  • TikTok Inc. — for TikTok advertising. See TikTok’s Privacy Policy.
  • Calendly LLC — for meeting scheduling. See Calendly’s Privacy Policy.
  • LinkedIn Corporation — for professional networking and advertising.
  • Website Hosting Provider — for storage and delivery of our website.
  • Professional Advisers — lawyers, accountants, and insurers, where necessary.
  • Regulators & Law Enforcement — where required or permitted by law.

Some of these parties are located outside Australia (including the United States and Singapore). Before disclosing personal information overseas, we take reasonable steps to ensure the recipient handles your information in accordance with the APPs (APP 8). Where the GDPR applies, we rely on Standard Contractual Clauses or other approved transfer mechanisms.

6. Storage & Retention

Your personal information may be stored on servers in Australia or overseas. We retain information only for as long as necessary for the purposes it was collected or as required by law:

  • Client and contract records: 7 years (as required by Australian tax law);
  • Enquiry and contact form data: 3 years from submission;
  • Marketing records: 3 years from last interaction or opt-out;
  • Website analytics data: Up to 26 months;
  • Cookie and tracking data: As specified in Section 7.

Once information is no longer required, we will securely destroy or de-identify it.

7. Cookies & Tracking Technologies

We use cookies and similar tracking technologies on our website, including:

  • Google Analytics — website traffic analysis (up to 26 months);
  • Google Ads Conversion Tracking — ad performance measurement (up to 90 days);
  • Facebook Pixel — ad targeting and retargeting via Meta (up to 90 days);
  • TikTok Pixel — TikTok ad targeting and measurement (up to 13 months);
  • LinkedIn Insight Tag — LinkedIn retargeting and analytics (up to 90 days);
  • Essential Site Cookies — required for basic website functionality.

You can manage or disable cookies through your browser settings. You can opt out of interest-based advertising via Google Ads Settings, Meta Ad Preferences, or the NAI opt-out tool. Note that disabling certain cookies may affect website functionality.

8. Security Measures

We implement reasonable technical and administrative safeguards to protect your personal information, including:

  • SSL/TLS encryption (HTTPS) for all data transmitted via our website;
  • Access controls limiting data access to authorised personnel only;
  • Regular software updates and security patching;
  • Confidentiality obligations for staff and contractors;
  • Assessment of third-party service providers’ data handling practices.

In the event of an eligible data breach, we will notify the Office of the Australian Information Commissioner (OAIC) and affected individuals in accordance with the Notifiable Data Breaches (NDB) scheme under the Privacy Act 1988 (Cth). Where GDPR applies, we will notify the relevant supervisory authority within 72 hours.

No method of electronic transmission or storage is completely secure. You provide your information at your own risk.

9. Your Rights

Depending on your location, you may have the following rights regarding your personal information:

  • Access (APP 12 / GDPR Art. 15): Request a copy of the personal information we hold about you.
  • Correction (APP 13 / GDPR Art. 16): Request correction of inaccurate, incomplete, or outdated information.
  • Erasure (GDPR Art. 17): Request deletion of your personal information where we no longer have a lawful basis to retain it.
  • Restriction (GDPR Art. 18): Request that we restrict processing of your information in certain circumstances.
  • Portability (GDPR Art. 20): Request your personal data in a structured, machine-readable format.
  • Object (GDPR Art. 21): Object to processing for direct marketing or where we rely on legitimate interests.
  • Withdraw Consent: Where we rely on consent, withdraw it at any time without affecting prior processing.

We will respond to access and correction requests within 30 days. To exercise any of these rights, please contact our Privacy Officer at james@novaflowdigital.com.au.

Opting Out of Direct Marketing

In accordance with the Spam Act 2003 (Cth), all marketing emails we send include an unsubscribe link. You can also email us at james@novaflowdigital.com.au with the subject line “Unsubscribe”. We will process opt-out requests within 5 business days.

Do Not Call Register

We respect the Do Not Call Register Act 2006 (Cth). If you are registered on the Do Not Call Register and we have contacted you, please let us know and we will remove your number from our calling records.

10. Children’s Privacy

Our website is directed at adults working in the education sector. We do not knowingly collect personal information from children under 15 years of age. If you believe we have inadvertently done so, please contact us immediately and we will delete the information.

11. Third-Party Links

Our website may contain links to third-party websites. This Policy does not apply to those sites and we are not responsible for their privacy practices. We encourage you to read the privacy policies of any external websites you visit.

12. Changes to This Policy

We may update this Policy from time to time. Any changes will be published on this page with an updated effective date. We encourage you to review this Policy periodically. Your continued use of our website after any update constitutes acceptance of the revised Policy.

13. Complaints & Contact

If you have a concern about how we have handled your personal information, please contact our Privacy Officer in the first instance:

James — Privacy Officer, Novaflow Digital
Email: james@novaflowdigital.com.au
Phone: 0427 254 181

We aim to acknowledge complaints within 5 business days and resolve them within 30 days.

If you are not satisfied with our response, you may escalate your complaint to:

  • Office of the Australian Information Commissioner (OAIC): oaic.gov.au | 1300 363 992
  • Australian Communications and Media Authority (ACMA): acma.gov.au (for spam or unsolicited communications complaints)
  • EU/UK Data Protection Supervisory Authority (if you are located in the EEA or UK): edpb.europa.eu

This Privacy Policy does not constitute legal advice. Novaflow Digital recommends seeking independent legal counsel to ensure ongoing compliance with applicable privacy laws.