The short version
The full policy below is long because the law asks us to be thorough, and because some people want every detail. This summary is the TLDR plain English version.
What we collect, and why. Good financial advice depends on knowing a fair bit about you. That means your name and contact details, what you earn, own and owe, your super and insurance, your tax position, and what you are actually trying to achieve.
Sometimes we will also ask about your health or family, where it matters to the advice, and we only collect that with your consent. Most of what we hold comes straight from you. The rest comes from places like your super fund or the ATO, with your permission, when we need it.
Who else sees it. We share your information with the people who help us run the business and look after you. That is our software and document storage providers, the compliance consultants who review our advice files, and the product providers we deal with on your behalf, like super funds and insurers. We do not sell your information, and we do not give it to anyone who does not need it to help look after you.
Where it is kept. Wherever possible, your information is stored and processed in Australia and the United States. Some of our providers operate in other countries. We identify where each one holds and processes information, record it in our vendor register, and hold them to the Australian Privacy standards as our benchmark.
How we use AI. We use AI to transcribe meetings, read the documents you send us, keep your information organised and help our advisers draft their work. AI never decides what we recommend. Every recommendation is reviewed and approved by a qualified adviser before it gets to you.
Keeping it safe. We protect your information with encryption, multi-factor authentication and access limited to the people who need it. We keep it only for as long as we need it, or for as long as the law requires, which for advice records is generally seven years.
What you can ask us for. You can ask for a copy of what we hold about you, or a correction if something is wrong. You can ask us to stop marketing to you, or to delete your Instagram conversations with us. And if you think we have got something wrong, you can make a complaint.
For any of these, just email [email protected] and we will sort it out. If you are not happy with how we handle a privacy complaint, you can take it to the Office of the Australian Information Commissioner (OAIC).
That is the short version. The full policy below covers the same ground in full detail.
1. Background
1.1 Overview
(a) Fish Tacos Pty Ltd (ABN 14 649 248 082, AFSL 533055) and its corporate authorised representatives Pivot Wealth Pty Ltd (ABN 36 606 946 730, AR number 1234035) and Black Hide Pty Ltd (together, we, us or our) adhere to the Australian Privacy Principles (APPs) and are bound by the Privacy Act 1988 (Cth) (Privacy Act), as amended by the Privacy and Other Legislation Amendment Act 2024 (Cth) (POLA Act). It is important to us that personal information collected by us is protected.
(b) If you want more information about this Privacy Policy, or if you want to inquire about any of personal information held by us, or if you believe personal information held by us is inaccurate, incomplete or out-of-date, please contact us.
(c) Our business is providing financial services to retail clients. When providing such services, we may have access to personal information relating to our clients.
(d) The purpose of this Privacy Policy is to outline how we collect, use, disclose and retain personal and sensitive information. It also sets out how you can make a complaint and how you can access the personal information we hold about you.
2. What is personal information?
2.1 What is personal information?
Personal information means information or an opinion about an identified individual, or an individual who is reasonably identifiable: (a) whether the information or opinion is true or not; and (b) whether the information or opinion is recorded in a material form or not.
2.2 What personal information could we collect?
In order for us to provide financial services to you, we may collect the following information about you:
(a) full name, date of birth, contact details and residential address
(b) financial position: assets, liabilities, income, expenses and cash flow
(c) superannuation and insurance details
(d) investment objectives, risk tolerance and time horizon
(e) health and medical information (for insurance advice), estate planning details and family circumstances
(f) tax file number, tax residency and relevant tax information
(g) employment, business activities and source of wealth
(h) identity document details – type, number, issuing authority and expiry
(i) politically exposed person (PEP) status and sanctions screening results
Collection of personal information
2.3 Collection of personal information
We collect your personal information to fulfil our obligations as a licensed financial services provider under the Corporations Act 2001, the Privacy Act and the Anti-Money Laundering and Counter-Terrorism Financing Act 2006. This includes our obligations to:
(a) verify your identity before providing financial services (AML/CTF customer due diligence)
(b) provide you with financial advice tailored to your personal circumstances, goals and financial situation
(c) manage your ongoing financial services including portfolio reviews, insurance and superannuation
(d) prepare and deliver Statements of Advice (SOAs) and ongoing advice documents
(e) meet record-keeping obligations under the Corporations Act, AML/CTF Act and ASIC regulatory requirements
(f) make reports required by AUSTRAC under the AML/CTF Act
(g) manage complaints and disputes in accordance with our internal dispute resolution obligations
(h) We may collect and hold personal information from you for the purposes of enabling us to provide our services to you. For example – when we provide financial services to you (eg. when we recommend a financial product to you or to arrange for you to invest in a financial product). When doing so, we may collect personal information about you as part of forming our recommendation or providing our arranging services.
(i) If you give us personal information about you, we will only use and disclose that information for the relevant purposes set out below. You can also access the information we hold about you.
(j) Any personal information held by us may be held in a number of ways including via hard copy, soft copy or offsite on electronic servers.
(k) Where we obtain sensitive information (e.g. racial or ethnic origin, political opinions, religious beliefs or affiliations or criminal record), we will only do so with your consent and where the collection of such information is reasonably necessary for us to perform our function.
2.4 How do we collect your information
We collect your personal information:
(a) directly from you through our client agreement, fact find, risk profile questionnaire and ongoing correspondence
(b) from third-party sources including financial institutions, superannuation funds, insurers, ATO, public registers (ASIC) and identity verification services, where reasonably necessary
(i) when you message us or comment on our posts on Instagram or our other social media channels, including where our AI assistant responds, as described below
2.5 Information we collect when you message us on Instagram
(a) We collect information when you engage with us on Instagram and our messaging assistant, Mercury, handles the conversation. Mercury only contacts people who have engaged with us on Instagram first, for example by sending us a message or commenting on one of our posts to ask for something we have offered. We do not use it to message people who have not engaged with us. When you message us, or Mercury messages you, we collect:
(i) your Instagram username and the account identifier Instagram provides to us;
(ii) your public profile information that Instagram makes available, such as your name; and
(iii) the content of the messages you send us and our replies, and any comment that prompted Mercury to message you, along with the time they were sent.
(b) We only collect what you send us through Instagram messaging, and any comment that prompted Mercury to message you. We do not collect your Instagram password, your contacts, your posts, or anything outside the conversation you have with us.
2.6 Dealing with unsolicited personal information
If we receive unsolicited personal information, we will within a reasonable period after receiving the information, determine whether or not we could have collected the information under Australian Privacy Principle 3. If the information could not have been obtained under APP 3, we will take steps to destroy or de-identify the information as soon as practicable, if it is lawful and reasonable to do so.
2.7 Notification of the collection of personal information
At or before the time we collect personal information from you, or if that is not practicable, as soon as practicable after, we will take reasonable steps to ensure you are aware of:
(a) who we are and our details;
(b) how we collect the personal information and whom from;
(c) whether the collection of the personal information is required or authorised by or under an Australian law or a court/tribunal order;
(d) the purposes for which we collect the personal information;
(e) the main consequences (if any) if we do not collect all or some of the personal information;
(f) any other person or body to whom we would disclose the personal information that we have collected;
(g) information about how you may access the personal information held by us about you and how you may seek correction of such information;
(h) how you may complain about a breach of the Australian Privacy Principles and how the entity will deal with such a complaint;
(i) whether we are likely to disclose the personal information to overseas recipients (if so where).
2.8 Anonymity and pseudonymity
Whilst you may wish to deal with us anonymously, this is likely to limit the services we provide to you as our principal business is the provision of financial services which is personal to you. Given the legal requirements around anti-money laundering and counter terrorism financing, we are required to identify our clients when we deal with them. We cannot therefore provide financial services to you on an anonymous basis.
2.9 If you don’t provide us with the information we request
It is your choice as to whether you wish to provide us with the information we request. However, we may not be able to provide you with the services you require if you don’t provide us with the relevant information to help us deliver the services.
3. Use or disclosure of personal information
3.1 Use or disclosure of personal information
Personal information collected by us is used to provide financial services to you and will not be disclosed unless required in the performance of those services or otherwise permitted under the Privacy Act. We may disclose your personal information to the following categories of third parties:
(a) Product issuers and platforms – where you invest in a financial product through us, including fund managers, superannuation trustees, insurance companies, managed investment scheme operators, and investment platforms, with your consent;
(b) Paraplanning service providers – who assist in preparing your financial advice documents (including Statements of Advice) on our behalf, located in Australia;
(c) Compliance and audit service providers – who conduct file reviews and compliance monitoring of our advice processes on our behalf, including external compliance consultants engaged by our licensee;
(d) Software and technology providers – including IT, document management, CRM platform providers and practice management system providers who host and manage our client records and systems;
(e) Professional advisers – including your legal, accounting, lending and audit advisers, where you have asked us to liaise with them or where it is necessary to provide you with coordinated financial services;
(f) Our AML/CTF reporting group – as required under our AML/CTF Program;
(g) Regulators – including ASIC, AUSTRAC and the ATO where required by law, court order or in connection with our regulatory obligations; and
(h) Artificial intelligence tools – where we use AI-assisted software to help prepare financial advice documents or record client meetings (see Section 3.4 below).
(i) Providers that operate our Instagram messaging assistant, Mercury – including Anthropic, whose Claude AI generates the replies and which acts only on our instructions to provide its service to us, and not for its own purposes. Your messages are carried by Meta Platforms through Instagram and the Messenger Platform, which handles them under its own terms and privacy policy;
(j) If we specify that personal information is collected for a specific purpose, we will not use or disclose the information for another purpose unless you consent to the use or disclosure of the information or an exception in the APPs applies.
3.2 Overseas disclosure
(a) Some of the providers we use to store and process personal information are located outside Australia, or store data on servers outside Australia. Wherever possible we store and process personal information in Australia and in the United States. Some of our providers operate in other countries, including the United Kingdom, Europe, Canada, Singapore and Japan. We identify the countries in which each provider stores and processes information and record them in our vendor register, which is available on request.
(b) These providers handle personal information under binding contracts that include data protection, confidentiality and security commitments. The artificial intelligence providers we use are not permitted to use your information to train their models. Some of our other software providers may, under their own terms, use information held in their systems to maintain and improve their services. We take reasonable steps to ensure the providers we use handle your information consistently with the Australian Privacy Principles, including by reviewing their terms and security practices and choosing plans and settings that protect your information accordingly. We remain accountable to you for how an overseas recipient handles your personal information.
3.3 Direct marketing
We may use and disclose your personal information to keep you informed about the range of services that we think may be relevant or of interest to you. You can opt out of receiving information from us at any time by contacting us.
3.4 Use of artificial intelligence
(a) We use secure software and artificial intelligence (AI) tools to answer messages sent to us on Instagram and other social media channels; to record, transcribe and summarise client meetings; to read and extract information from documents you provide, such as statements, payslips and policy documents; to organise that information in our client management systems; to assist our advisers in preparing, reviewing and tailoring your advice and communications, including Statements of Advice; and to assist in the preparation or review of compliance documentation. The AI tools we currently use are listed in our AI Register, which is available on request. These tools may be hosted by providers located overseas. Where AI tools are used, your personal information including your financial position, goals, personal circumstances, the contents of documents you provide and discussion transcripts may be processed by the AI system.
(b) We take reasonable steps to ensure:
(i) where we record or transcribe a meeting or call, we will tell you, either through an automatic notice or verbally, and you can ask us not to record;
(ii) human review is applied to all AI-assisted advice outputs before they are provided to you;
(iii) your personal information is not used to train AI models without your consent; and
(iv) AI tools used by us are subject to appropriate data handling and confidentiality obligations.
(c) Our Instagram messaging assistant, Mercury. Mercury is our own Instagram messaging assistant. It only contacts people who have engaged with us on Instagram first, and it does not provide financial advice of any kind. Anything it tells you is factual information about our services. Personal advice is provided only by a licensed adviser through our advice process, and never through social media messaging.
(d) We use the information from your Instagram conversation to:
(i) read your message and send you a relevant reply;
(ii) answer general questions about our services;
(iii) help you book an intro chat if you would like one, which is a short screening call at our cost to see whether we are the right fit to help you; and
(iv) pass the conversation to a member of our team when a person should respond, so they can follow up with you directly.
(e) To generate replies, your message content is processed by Anthropic (Claude), which acts only on our instructions to provide its service to us, and the overseas arrangements described under Overseas disclosure above apply to it. Your messages travel through Meta’s Instagram and Messenger Platform, which handles them under its own terms and privacy policy. You can ask us to stop messaging you at any time by telling us in the conversation, and you can ask us to delete your conversation data at any time.
(f) Artificial intelligence does not decide your financial advice. Our AI tools help our advisers gather, organise and draft. Every recommendation is made, reviewed and approved by a qualified human adviser before it reaches you, and no decision affecting you is made by a computer program without human review and approval.
(g) Where we use a computer program, including an AI tool, to make a decision, or to do a thing that is substantially and directly related to making a decision, that could reasonably be expected to significantly affect your rights or interests, we set out below the kinds of personal information used and the kinds of decisions involved:
(i) the kinds of personal information used: your financial position, including assets, liabilities, income and expenses; your superannuation and insurance details; your goals, investment objectives, risk tolerance and time horizon; your employment and family circumstances; and the contents of documents you provide to us; and
(ii) the kinds of decisions involved: the preparation and tailoring of financial advice recommendations, including recommendations contained in Statements of Advice and Records of Advice, each of which is reviewed and approved by a qualified adviser before it is provided to you.
4. Security and access
4.1 Information accuracy
We take reasonable steps to ensure that all personal data collected is accurate, up to date and complete. You can ask us to correct any inaccurate information we hold or have provided to others by contacting us using the details in this policy. If the information that is corrected is information we have provided to others, you can ask us to notify them of the correction.
4.2 Security of personal information
We take care to protect the security of your personal information. We may hold personal information in a combination of secure computer storage facilities, paper-based files and other formats. We take reasonable steps to protect personal information from misuse, loss, unauthorised access, modification or improper disclosure. In accordance with APP 11 as amended by the POLA Act 2024, our security measures include both technical measures (encryption of data at rest and in transit, multi-factor authentication, role-based access controls, regular security testing, and vendor security assessments for third-party providers) and organisational measures (staff privacy and security training, documented incident response procedures, periodic security reviews, and contractual data security obligations on our third-party service providers, including paraplanning and AI tool providers). We regularly review these measures to ensure they remain reasonable in the circumstances. Please note, we are required by law to retain your personal information for a specific amount of time. We will generally destroy or de-identify personal information if it is no longer required.
4.3 Access to and collection of personal information
(a) You can contact us to access or correct any personal information we hold about you. However, in certain situations, we are permitted to refuse access to personal information. These situations include where:
(i) giving access would have an unreasonable impact on the privacy of other individuals
(ii) giving access would be unlawful, or where denying access is required or authorised by an Australian law or a court order
(iii) giving access is likely to interfere with law enforcement activities.
For other situations, please consider Australian Privacy Principle 12.
(b) If we receive a request to access personal information, we aim to respond to that request in a reasonable timeframe. In general, we will not impose an access charge unless the request of access and correct personal information is excessively onerous.
(c) If we refuse access to personal information, we will provide you with reasons as to why access was refused and provide you with information on how to lodge a complaint about the refusal.
4.4 Retention of personal information
(a) We retain personal information only for as long as it is required for the purposes for which it was collected, or as required by law. We will take reasonable steps to destroy or de-identify personal information in accordance with APP 11.2 when the personal information we hold is no longer required.
(b) If we are required to hold the personal information, the applicable minimum retention periods for financial advice businesses is seven years.
4.5 How to request deletion of your Instagram (Mercury) conversation data
(a) If you have messaged us on Instagram and our messaging assistant, Mercury, handled the conversation, we keep a record of that conversation so we can help you and follow up. You can ask us for a copy of that information, or ask us to delete it, at any time.
(b) To request deletion:
(i) email us at [email protected], or message us on Instagram from the account you used; and
(ii) tell us you would like your Mercury conversation data deleted, and include the Instagram username you messaged us from so that we can find it.
(c) We will confirm your request and delete the conversation data we hold, usually within 30 days. Deleting your data will not stop you from messaging us again later. If you do, a new conversation record starts from that point.
(d) This applies to your Instagram conversation data. Where you are, or become, a client of ours, the records relating to the financial services and advice we provide to you are held separately and are subject to the retention periods described above, which we are required by law to observe. Deleting your Instagram conversation does not affect those records.
4.6 Data breach
(a) A data breach occurs when personal information held by us is lost or subjected to unauthorised access, modification, disclosure, or other misuse or interference. Examples of a data breach are when a device containing personal information of clients is lost or stolen, or when a database containing personal information is hacked or if we mistakenly provide personal information to the wrong person.
(b) Under the Privacy Amendment (Notifiable Data Breaches) Act 2017, we have an obligation to assess within 30 days whether a data breach amounts to an ‘eligible data breach’ if we become aware that there are reasonable grounds to suspect that data breach may have occurred.
(c) If we form the view that the data breach would likely result in serious harm to any of the individuals to whom the information relates despite any remedial action taken by us, then the data breach will constitute an ‘eligible data breach’. If an eligible data breach occurs, we have an obligation to notify you and the Office of the Australian Information Commissioner and of the details of the eligible data breach.
5. Complaint
5.1 Complaint
If you would like to make a complaint about this policy or the personal information held by us, please contact us on the contact details below. We will acknowledge your complaint within 5 business days and endeavour to resolve it within 30 days. If you are not satisfied with our response, you may escalate your complaint to the Office of the Australian Information Commissioner (OAIC) (see Section 6.2 below).
6. Contact us
6.1 Contact
(a) You may wish to contact us for the following:
(i) find out what personal information we hold about you;
(ii) update or correct the personal information we hold about you;
(iii) opt out of receiving direct marketing material
(iv) make a privacy related complaint.
(b) Should you wish to do so, please contact us at:
Privacy Officer, Pivot Wealth, Level M, 388 George Street, Sydney NSW 2000. Telephone 02 8091 6881. Email [email protected]
6.2 External Dispute Resolution
(a) If we are not able to satisfactorily resolve your complaint relating to your personal information, you can contact the Office of the Australian Information Commissioner (OAIC).
Office of the Australian Information Commissioner
GPO Box 5288
Sydney NSW 2001
1300 363 992
oaic.gov.au (complaints can be lodged using the online privacy complaint form)
Changes to this policy
We may update this policy from time to time. The current version is always available at pivotwealth.com.au/privacy and shows the date it was last updated.
Where we make a change that significantly affects how we handle your personal information, we will take reasonable steps to let you know.
Version 2.0. This policy was last updated on 9 October 2026.