privacy policy

---

1. About this Privacy Policy

Cameron Lindsay McDonald trading as Future Fit Leadership (ABN 77 647 823 721) (“Future Fit Leadership”, “we”, “us” or “our”) respects the privacy of the people and organisations with whom we work.

This Privacy Policy explains how we collect, hold, use, disclose, protect and otherwise manage Personal Information in connection with our business, including our:

• leadership coaching and executive coaching;
• business and strategic advisory services;
• leadership development programs;
• team development and culture work;
• workshops and facilitation;
• assessments and diagnostics;
• speaking and training;
• consulting engagements;
• digital resources and programs;
• website, communications and marketing activities; and
• related business operations.

We manage Personal Information in accordance with applicable Australian privacy law.

Where the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) apply to us or to a particular activity, we will comply with those requirements.

Where those requirements do not legally apply to a particular activity, we nevertheless seek to use the Australian Privacy Principles as a benchmark for responsible privacy practice.

This Privacy Policy should be read together with any specific privacy collection notice, engagement agreement, program terms, consent process or other notice we provide in connection with a particular service.

2. Key definitions

For the purposes of this Privacy Policy:

• Personal Information means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether or not the information is true or recorded in material form.
• Sensitive Information includes certain categories of Personal Information that attract additional protection under Australian privacy law, including information about health, racial or ethnic origin, political opinions, religious or philosophical beliefs, sexual orientation or practices, trade union or professional association membership, and certain biometric or genetic information.
• Client may refer to an individual who engages us directly or an organisation that engages us to provide services to its owners, leaders, employees, contractors, teams or other participants.
• Participant means an individual who participates in coaching, an assessment, a leadership program, workshop, consultation or other service, whether or not that individual is the person or organisation paying for the service.

3. The Personal Information we may collect

The Personal Information we collect will depend on the nature of our relationship with you and the services being provided. It may include:

Identity and contact information

This may include:

• name;
• email address;
• telephone number;
• postal or business address;
• organisation;
• job title;
• role;
• professional profile; and
• other contact information.

Professional and employment information

This may include information about your:

• role and responsibilities;
• employment or business history;
• professional experience;
• leadership responsibilities;
• team or organisational context;
• career goals;
• development goals;
• professional challenges;
• business ownership;
• organisational structure; and
• other professional circumstances relevant to our work.

Coaching, consulting and program information

In providing our services, we may collect information contained in:

• coaching conversations;
• questionnaires;
• intake forms;
• diagnostic tools;
• reflections;
• action plans;
• development plans;
• meeting notes;
• workshop materials;
• strategic plans;
• consultation records;
• participant feedback;
• correspondence;
• reports; and
• other information voluntarily provided in connection with an engagement.

Assessment and feedback information

Where relevant to an engagement, we may collect:

• leadership assessment results;
• strengths or behavioural assessment information;
• self-assessments;
• 360-degree feedback;
• survey responses;
• stakeholder observations;
• opinions about an individual’s leadership or professional performance; and
• related assessment information.

An opinion about an identifiable individual may itself constitute Personal Information.

Financial and transaction information

We may collect information relating to:

• invoices;
• payments;
• billing contacts;
• transaction records;
• contractual arrangements; and
• other information reasonably required to administer a commercial relationship.

Website and technical information

When you interact with our website or digital services, we may collect information such as:

• IP address;
• device type;
• browser type;
• operating system;
• pages viewed;
• referring website;
• approximate geographic information derived from technical data;
• dates and times of access;
• interactions with website content; and
• cookie or analytics information.

Meeting, audio, video and transcription information

Where disclosed to participants and permitted by applicable law, we may collect:

• audio recordings;
• video recordings;
• meeting transcripts;
• meeting summaries;
• notes;
• action items; and
• other information generated from a meeting or coaching session.

4. Sensitive Information

The nature of coaching, leadership development and consulting means that a Participant may occasionally choose to disclose information that constitutes Sensitive Information.

We do not seek to collect Sensitive Information merely because it may be useful or interesting.

We will only collect Sensitive Information where it is reasonably necessary for our functions or activities and where:

• you have consented to the collection where consent is required;
• the collection is otherwise authorised or required by law; or
• another applicable legal basis permits the collection.

We encourage Clients and Participants not to provide Sensitive Information unless it is reasonably relevant to the purpose of the engagement.

Where Sensitive Information is collected, we take additional care in relation to its use, disclosure and security.

5. How we collect Personal Information

We may collect Personal Information directly from you when you:

• contact or enquire with us;
• complete a website form;
• register for a workshop, event or program;
• enter into an engagement with us;
• participate in coaching, consulting, facilitation or training;
• complete an assessment or questionnaire;
• attend a meeting;
• provide feedback;
• communicate with us by telephone, email, video conference or messaging platform;
• subscribe to communications;
• make a payment; or
• otherwise interact with our business.

We may also collect Personal Information from third parties where reasonably appropriate, including:

• an organisation engaging us to work with you;
• your employer;
• a program sponsor;
• colleagues or stakeholders participating in a 360-degree assessment or consultation;
• referral partners;
• professional assessment providers;
• service providers;
• publicly available professional sources, including professional networking platforms; and
• other persons authorised to provide information to us.

Where required or appropriate, we will take reasonable steps to notify you of the circumstances in which Personal Information about you has been collected from another person.

6. Unsolicited Personal Information

We may occasionally receive Personal Information that we did not request.

Where Australian privacy law applies, we will consider whether we could lawfully have collected that information ourselves.

If not, and we are not otherwise required or authorised to retain it, we will take reasonable steps to destroy or de-identify it.

7. If you do not provide Personal Information

You are not generally required to provide Personal Information to us simply because we request it.

However, if information reasonably necessary for an engagement is not provided, we may be unable to:

• respond to an enquiry;
• properly understand your circumstances;
• provide particular services;
• administer an assessment;
• process a registration;
• enter into or perform a contract;
• issue an invoice;
• provide an appropriate recommendation; or
• otherwise fulfil the purpose for which the information was requested.

8. How we use Personal Information

We may use Personal Information where reasonably necessary to:

• provide coaching, consulting, advisory, facilitation, training and leadership development services;
• understand a Client’s or Participant’s needs;
• design and prepare engagements, workshops and programs;
• conduct assessments and diagnostics;
• provide reports, recommendations and agreed deliverables;
• facilitate coaching and professional development;
• communicate with Clients, Participants and prospective Clients;
• administer contracts, registrations, bookings and payments;
• maintain records of engagements;
• manage Client relationships;
• conduct research and analysis relevant to an engagement;
• improve our services, resources and programs;
• administer our website and technology systems;
• maintain the security and integrity of our systems;
• respond to enquiries, complaints or requests;
• manage legal, regulatory, contractual, insurance and risk obligations;
• establish, exercise or defend legal claims;
• maintain appropriate financial and business records;
• communicate relevant services, resources or opportunities where permitted by law; and
• conduct the ordinary operations of our business.

We will not use Personal Information for an unrelated purpose unless:

• you have consented;
• you would reasonably expect that use and it is permitted by law; or
• the use is otherwise required or authorised by law.

9. Organisation-sponsored coaching, leadership development and assessments

Some services are commissioned and paid for by an organisation but delivered to an individual Participant.

We recognise that effective coaching and leadership development require an appropriate degree of trust and confidentiality.

Where an organisation sponsors an engagement, Personal Information may be collected from both the sponsoring organisation and the Participant.

This may include:

• role and organisational information;
• development objectives;
• agreed coaching goals;
• leadership assessment results;
• professional feedback;
• performance-related context;
• stakeholder observations;
• 360-degree feedback;
• attendance and participation information; and
• agreed progress measures.

Before or at the commencement of an engagement, we may establish with the Client and Participant what information may be reported to the sponsoring organisation.

Depending on the engagement, this may include:

• participation or attendance;
• agreed objectives;
• progress against agreed goals;
• high-level themes;
• program outcomes;
• agreed actions;
• aggregate information; or
• other information expressly contemplated by the engagement.

Unless otherwise agreed, disclosed before collection, authorised by the Participant or required or permitted by law, we do not ordinarily provide a sponsoring organisation with detailed coaching notes or verbatim accounts of confidential coaching conversations.

Nothing in this section prevents us from disclosing information:

• with the Participant’s consent;
• where disclosure has been expressly agreed as part of the engagement;
• where required or authorised by law;
• where necessary to establish, exercise or defend legal rights;
• in circumstances involving a serious threat to life, health or safety where disclosure is permitted by law; or
• in another circumstance permitted under applicable privacy law.

10. Assessments, 360-degree feedback and stakeholder information

Our services may involve information provided by people other than the individual being assessed.

This may include confidential feedback, observations and opinions provided by colleagues, managers, direct reports, peers, clients or other stakeholders.

Where assessment or 360-degree feedback processes are used, we will seek to establish appropriate expectations about:

• the purpose of the assessment;
• who will receive the results;
• whether responses are identified, confidential or aggregated;
• how reports may be used; and
• how information will be retained or disclosed.

Where confidentiality or anonymity has been represented to a feedback provider, we will take reasonable steps to preserve that confidentiality subject to applicable law.

11. Confidential business information

Our work may also involve access to commercially sensitive information that is not Personal Information for the purposes of privacy legislation.

This may include:

• business strategy;
• financial information;
• commercial plans;
• intellectual property;
• organisational structures;
• board or executive discussions;
• proposed transactions;
• workforce planning;
• confidential reports;
• customer or supplier information; and
• other proprietary information.

We treat confidential business information with appropriate care and handle it in accordance with applicable contractual obligations, confidentiality commitments and information-security practices.

This Privacy Policy does not replace or limit any additional confidentiality obligations contained in an engagement agreement or other contract.

12. Artificial intelligence and technology-assisted processing

We may use artificial intelligence, machine learning and other technology-assisted tools to support the efficient delivery and administration of our services.

Depending on the circumstances, such tools may assist with:

• meeting transcription;
• note-taking;
• summarisation;
• document analysis;
• research;
• drafting;
• data organisation;
• administrative activities;
• workflow automation;
• development of educational or consulting materials; and
• preparation of preliminary insights or recommendations.

Where Personal Information is processed through an AI-enabled or technology-assisted service, we seek to ensure that the use is reasonably necessary or appropriate for the relevant business purpose and consistent with our privacy, confidentiality and contractual obligations.

We apply principles of data minimisation and seek to limit Personal Information provided to AI systems to what is reasonably required for the intended purpose.

Where appropriate, we may:

• remove identifying information;
• redact information;
• aggregate information;
• use pseudonyms;
• limit the information provided;
• use enterprise or business configurations with enhanced data protections; or
• use other safeguards designed to reduce privacy risk.

We do not use Personal Information with general-purpose AI services merely because those services are available.

We do not use Sensitive Information or confidential Client information with AI services unless the use is appropriate in the circumstances, reasonably necessary for the relevant purpose, and subject to suitable privacy, security, contractual or technical safeguards.

We will not knowingly use a third-party AI service in a manner that conflicts with an applicable Client agreement, confidentiality undertaking or agreed data-handling restriction.

We take reasonable steps to assess relevant AI and technology providers having regard to matters such as:

• privacy practices;
• security arrangements;
• data retention;
• access controls;
• provider use of submitted data;
• model-training practices where relevant;
• subprocessors;
• data location; and
• contractual protections.

Personal Information generated, inferred or summarised through an AI system is treated as Personal Information where applicable.

AI-generated information may be inaccurate, incomplete or misleading. Accordingly, AI-assisted outputs used in connection with our professional services remain subject to appropriate human review and professional judgement.

13. Automated decision-making

At the date of this Privacy Policy, Future Fit Leadership does not arrange for a computer program to make, or do a thing that is substantially and directly related to making, a decision that could reasonably be expected to significantly affect an individual's rights or interests where Personal Information about that individual is used in the operation of the computer program.

We may use artificial intelligence and other automated tools to assist with administrative, analytical, research, transcription, summarisation and drafting activities. These tools may support our work but are not currently used by Future Fit Leadership in the circumstances described above to make, recommend or materially guide decisions that could reasonably be expected to significantly affect an individual's rights or interests.

The involvement of human review does not, of itself, determine whether a use of a computer program constitutes automated decision-making for the purposes of applicable privacy law. We will assess our use of automated tools having regard to their actual role in any relevant decision-making process.

If our practices change and applicable privacy law requires us to disclose our use of automated decision-making, we will update this Privacy Policy to describe the kinds of Personal Information used and the kinds of decisions involved, and will update relevant collection notices where appropriate.

14. Meeting recording, transcription and AI-assisted note-taking

We may use recording, transcription or AI-assisted note-taking services in some meetings, coaching sessions or consulting engagements. Where we propose to do so, participants will be informed before or at the commencement of the relevant meeting. We will obtain consent where required by applicable law and, as a matter of practice, seek to provide participants with a reasonable opportunity to decline recording or transcription. Where reasonably practicable, an alternative form of note-taking may be used where a Participant does not wish to be recorded or transcribed. A recording or transcription service may process information including:

• participant names;
• email addresses;
• audio;
• video;
• spoken content;
• screen-shared information;
• transcripts;
• summaries;
• meeting metadata;
• action items; and
• information discussed during the meeting.

Participants should exercise appropriate judgement when sharing Personal Information, Sensitive Information or third-party confidential information during recorded or transcribed meetings.

Recordings, transcripts and summaries are retained only for as long as reasonably required having regard to the purpose of the engagement and our legal, contractual, operational and record-keeping requirements.

15. Disclosure of Personal Information

We may disclose Personal Information where reasonably necessary to:

• provide our services;
• administer an engagement;
• operate our business;
• comply with a legal or regulatory obligation;
• obtain professional advice;
• manage risk or insurance;
• protect our rights or the rights of another person; or
• carry out another purpose permitted by law.

Recipients may include:

• technology and cloud-service providers;
• website and hosting providers;
• email and productivity platforms;
• cloud-storage providers;
• customer relationship management systems;
• video-conferencing providers;
• transcription and AI-enabled productivity providers;
• professional assessment platforms;
• payment processors;
• accounting and bookkeeping providers;
• survey and form providers;
• analytics providers;
• marketing platforms;
• professional advisers, including accountants, lawyers and insurers;
• contractors or consultants assisting our business; and
• government, regulatory, law enforcement or other bodies where required or authorised by law.

We seek to disclose only the information reasonably necessary for the relevant purpose.

We do not sell Personal Information.

16. Third-party service providers

We rely on reputable third-party services to operate our business. Those providers may process information on our behalf or, in some circumstances, process information under their own privacy policies and terms. We take reasonable steps appropriate to the nature and sensitivity of the information involved to assess the privacy and security arrangements of key service providers. However, no third-party technology provider can be guaranteed to be entirely free from security or privacy risk. Where a third-party service operates independently of us, its collection and handling of Personal Information may also be governed by its own terms and privacy policy.

17. Overseas processing and disclosure 

Some of the technology providers we use operate globally. As a result, Personal Information may be stored, processed, backed up or accessed from locations outside Australia. Depending on the service and its configuration, these locations may include the United States, Canada and other jurisdictions in which our service providers or their authorised sub-processors operate. The countries involved may change as providers modify their infrastructure or sub-processor arrangements. 

Where practicable and required by applicable privacy law, we take reasonable steps to identify relevant overseas processing arrangements and to understand how Personal Information will be handled. Information about the location of particular key service providers may be made available on request where reasonably practicable. Where Australian privacy law imposes obligations relating to overseas disclosures, we will take reasonable steps to comply with those obligations.

18. Direct marketing

We may communicate with you about services, programs, events, resources, insights or opportunities that we reasonably consider may be relevant to you where:

• you have consented;
• consent may reasonably be inferred;
• you would reasonably expect to receive the communication; or
• the communication is otherwise permitted by law.

Where applicable, our commercial electronic communications will:

• appropriately identify us;
• include appropriate contact information; and
• provide a functional method of unsubscribing.

You may ask us at any time not to send you marketing communications. We will action unsubscribe requests within the period required by applicable law. Unsubscribing from marketing communications does not prevent us from sending communications that are reasonably necessary to:

• provide an existing service;
• administer a contract;
• issue an invoice;
• respond to you;
• communicate important service information; or
• comply with legal obligations.

19. Cookies, analytics and website technologies

Our website may use cookies, pixels and similar technologies. These technologies may be used to:

• operate the website;
• maintain website functionality;
• remember preferences;
• understand website usage;
• analyse website performance;
• measure engagement;
• improve content and services; and
• assess the effectiveness of marketing activities.

Information collected may include:

• IP address;
• browser and device information;
• pages viewed;
• links selected;
• approximate location derived from technical information;
• referral information;
• dates and times of visits; and
• interactions with website content.

Some cookies may be necessary for the website to operate. Other cookies may relate to analytics, functionality or marketing. You may be able to manage cookies through your browser or applicable cookie-management tools. Disabling certain cookies may affect website functionality. Third-party services used on our website may also use cookies or similar technologies and may process information in accordance with their own privacy policies.

20. Payment information

Payments may be processed by third-party financial institutions or payment service providers. Where payment card information is entered directly into a third-party payment platform, that information may be collected and processed directly by that provider rather than by Future Fit Leadership. We do not intentionally retain complete payment card information unless there is a legitimate need to do so and appropriate security arrangements are in place.

21. Security

We take reasonable steps to protect Personal Information from:

• misuse;
• interference;
• loss;
• unauthorised access;
• unauthorised disclosure; and
• unauthorised modification.

The measures we use will depend on the nature and sensitivity of the information and may include:

• reputable cloud-service providers;
• access controls;
• password protection;
• multi-factor authentication;
• secure devices;
• encryption where appropriate;
• role-based or restricted access;
• controlled file-sharing permissions;
• secure backup arrangements;
• software and system updates;
• provider due diligence; and
• appropriate administrative and contractual safeguards.

Access to Personal Information is limited to persons who reasonably require access for an authorised purpose. Despite these measures, no method of electronic transmission, cloud storage or digital security is completely secure. We therefore cannot guarantee the absolute security of Personal Information.

22. Data breaches

We take actual and suspected data breaches seriously.

If we become aware of a suspected data breach involving Personal Information under our control, we will take reasonable steps appropriate to the circumstances to:

1. contain the incident;
2. investigate what occurred;
3. assess the potential impact on affected individuals;
4. take remedial action where reasonably possible;
5. determine whether notification obligations apply; and
6. review the incident and our controls.

Where the Notifiable Data Breaches scheme or another applicable legal requirement applies, we will notify affected individuals and the relevant regulator where required. We may also notify Clients, insurers, technology providers, professional advisers, law enforcement authorities or other parties where notification is appropriate or contractually required.

23. Data retention and destruction

We retain Personal Information only for as long as reasonably necessary for:

• the purpose for which it was collected;
• delivery and administration of our services;
• reasonable business record-keeping;
• legal or contractual requirements;
• taxation and financial record-keeping;
• professional or insurance requirements;
• dispute management;
• establishment or defence of legal claims; or
• another legitimate purpose permitted by law.

Different categories of information may therefore be retained for different periods. Information such as raw meeting recordings may be retained for a shorter period than formal business, contractual or financial records.  

When Personal Information is no longer reasonably required and we are not legally or otherwise required to retain it, we will take reasonable steps to destroy it securely or de-identify it. Deletion from active systems may not result in immediate deletion from encrypted backups or other systems where deletion is technically impracticable. Where this occurs, information will remain subject to appropriate safeguards until it is overwritten or otherwise removed in the ordinary course.

24. Access to Personal Information

You may request access to Personal Information we hold about you. To protect privacy and security, we may require reasonable verification of your identity before responding. Where applicable law requires us to provide access, we will respond within a reasonable period. There may be circumstances in which access can lawfully be refused or limited, including where providing access would:

• unreasonably affect another person’s privacy;
• reveal information connected with legal proceedings;
• reveal commercially sensitive evaluative information in circumstances recognised by law;
• prejudice an investigation;
• be unlawful; or
• otherwise fall within an applicable exception.

Where required by law, we will provide reasons for refusing access and information about available complaint mechanisms. There is no charge to make an access request. Where legally permitted, reasonable costs associated with providing access may apply.

25. Correction of Personal Information

We seek to ensure that Personal Information we use is accurate, complete, current and relevant for the purpose for which it is used. You may ask us to correct Personal Information you believe is inaccurate, out of date, incomplete, irrelevant or misleading. We may take reasonable steps to verify the requested correction.

Where required by applicable privacy law, we will respond within a reasonable period and provide reasons if we decline to make a requested correction.

26. Anonymity and pseudonymity

Where lawful and reasonably practicable, you may interact with us anonymously or using a pseudonym.

However, identification may be necessary where, for example:

• you enter into a contract with us;
• we provide personalised coaching or assessment services;
• we need to verify your identity;
• you participate in an organisation-sponsored engagement;
• we are required to issue financial or taxation records;
• identification is required by law; or
• it would otherwise be impracticable to provide the relevant service without knowing your identity.

27. Privacy complaints

If you believe we have not handled your Personal Information appropriately, please contact us using the details at the end of this Privacy Policy.

Please provide sufficient information for us to understand:

• the nature of your concern;
• the Personal Information or interaction involved; and
• the outcome you are seeking, where relevant.

We will:

• acknowledge your complaint;
• assess the issues raised;
• investigate where appropriate; and
• seek to respond within a reasonable period.

We may contact you for further information where required. Where the Privacy Act applies and you are not satisfied with our response, you may have the right to make a complaint to the Office of the Australian Information Commissioner (OAIC).

28. Privacy collection notices

This Privacy Policy provides general information about how we manage Personal Information. For particular activities, we may provide an additional privacy collection notice explaining matters relevant to a specific collection of Personal Information.

This may occur in connection with:

• website forms;
• coaching intake;
• program registration;
• assessments;
• 360-degree feedback;
• surveys;
• workshop participation;
• meeting recording or transcription; or
• organisation-sponsored engagements.

A collection notice should be read together with this Privacy Policy.

29. Third-party websites and external services

Our website, resources or communications may contain links to third-party websites, platforms or services.

We do not control the privacy practices of those third parties and are not responsible for their independent handling of Personal Information.

We encourage you to review the privacy practices of a third party before providing Personal Information directly to that party.

30. Changes to this Privacy Policy

We may amend this Privacy Policy from time to time to reflect changes in:

• our services;
• our technology;
• our business operations;
• our information-handling practices;
• applicable laws or regulatory guidance; or
• our service providers.

The current version will be made available through our website and will identify the date on which it was last updated. If a change materially affects how we handle Personal Information already collected, we will consider whether additional notice or consent is required.

31. Contact details

For privacy enquiries, requests for access or correction, complaints, or questions about this Privacy Policy, please contact:

Cameron Lindsay McDonald
Future Fit Leadership
ABN 77 647 823 721

Email: contact@cameronlmcdonald.com

Please include “Privacy” in the subject line where appropriate.