1 About this policy

For Purpose Digital (ABN 42 543 582 827) is Matthew O'Brien trading as For Purpose Digital, a digital marketing consultancy based in Mount Egerton, Victoria, Australia. Services provided include Google Ad Grant management, local SEO, Google Business Profile optimisation, Google review generation, and website SEO audits, delivered to Australian charities and not-for-profit organisations.

This Privacy Policy explains how personal information is collected, used, stored, and disclosed, in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

By using the website at forpurposedigital.com.au or engaging For Purpose Digital, you agree to the collection and use of your information as described in this policy.

Plain English summary: For Purpose Digital collects the minimum information needed to deliver its services and communicate with you. Your information is never sold. It is not used for purposes you would not reasonably expect.

2 What information is collected

The following types of personal information may be collected.

Contact and identity information

  • Your name and the name of your organisation
  • Your email address
  • Your phone number, where provided
  • Your position or role within your organisation
  • Your physical or postal address, where provided

Business and service information

  • Your organisation's website address
  • Your Google Business Profile details
  • Information about your organisation's digital marketing goals and challenges
  • Information about your organisation's existing Google accounts and their performance
  • Information provided through the Grant Eligibility Checker, including organisation type, registration status, and revenue band

Communications

  • The content of emails, messages, and enquiries you send
  • Notes from calls and meetings
  • Feedback and responses provided during an engagement

Technical information

  • Browser type, device type, and operating system
  • Pages visited, time spent on the website, and referral source
  • General geographic region, derived from your connection

Google Analytics 4 does not retain IP addresses. Location is inferred at a regional level and the underlying address is discarded.

Information that is never collected

For Purpose Digital does not request, collect, store, or use the personal information of a client's service users or participants.

Where a client is a registered NDIS provider, no participant personal information is collected or used for review generation, campaign targeting, audience building, or reporting. Campaign audiences are built from search behaviour and do not use client-supplied personal information.

Sensitive information as defined under the Privacy Act, such as health information, racial or ethnic origin, or political opinions, is not intentionally collected. It may occasionally be provided voluntarily when describing an organisation's work or a personal connection to a cause. Where that happens, it is treated with additional care and used only for the purpose for which it was provided.

3 How it is collected

Personal information is collected in the following ways.

  • Visibility Review requests: when you request a free Visibility Review through the website, your name, organisation name, email address, and any information entered into the form fields are collected
  • Grant Eligibility Checker: when you complete the eligibility checker at forpurposedigital.com.au/eligibility-checker, your responses and contact details are collected and passed to an automation workflow that records the enquiry and sends your result
  • Email and direct enquiries: when you make contact by email or through the website contact form
  • Onboarding and review meetings: information shared during onboarding conversations and scheduled review meetings
  • Service delivery: information accessed or received while delivering services, including access to your Google Business Profile, Google Ads, Google for Nonprofits, Google Analytics 4, Google Tag Manager, and Google Search Console, where you grant that access
  • Review audience lists: contact lists you supply for review request sequences, drawn from donors, volunteers, corporate partners, staff, board members, and community supporters
  • The website: technical information collected automatically through Google Analytics 4
  • Referrals: contact details received where a colleague or referral partner refers you

Personal information is collected only by lawful and fair means, and only where reasonably necessary.

4 Why it is collected and how it is used

Your personal information is used for the following purposes.

  • To provide, manage, and improve the services delivered to you
  • To communicate with you about onboarding and ongoing service delivery
  • To run automated review request sequences on your behalf, as part of the review generation service
  • To deliver written reports and review meeting invitations at 30 day intervals during an engagement
  • To send service-related communications including invoices, agreements, and updates
  • To respond to enquiries, eligibility checks, and complaints
  • To comply with legal obligations
  • To improve the website and services based on usage data

Your personal information will not be used for any purpose you would not reasonably expect. It will not be used or disclosed for a secondary purpose without your consent, unless an exception under the Privacy Act applies.

5 Who it is shared with

Personal information may be disclosed to the following third parties where necessary to deliver services.

Platforms and service providers

  • Make.com: automation and workflow platform. Used to process website form submissions, record enquiries, and route lead information. Data is processed in Make.com's European Union region
  • Google: Google Analytics 4, Google Workspace, Google Business Profile, Google Ads, Google for Nonprofits, Google Tag Manager, and Google Search Console are used in the course of delivering services. Your information may be processed by Google in accordance with Google's privacy policy
  • Twilio: SMS delivery, using Australian phone numbers. Message content and recipient numbers are processed by Twilio
  • Loom: used to record and deliver video reports and reviews. Videos are shared by link and are not publicly searchable
  • Vercel: website hosting. The website and its form handling are hosted in Vercel's Sydney region
  • GitHub: website code repository. No personal information is stored in GitHub

Professional advisers

Accountants, lawyers, and other professional advisers, where necessary for legal or compliance purposes.

Personal information is never sold, rented, or traded to any third party for marketing or commercial purposes.

Information may also be disclosed where required or permitted by law, including to regulators, law enforcement agencies, or courts.

On request, For Purpose Digital will provide a client with a written list of the platforms used in their engagement, the data each holds, and where each stores it.

6 Overseas disclosure and data location

Where a platform offers a choice of hosting region, an Australian region is selected. The website, its forms, and its lead capture are hosted in Australia.

Some platforms do not offer an Australian region. Where that is the case, the personal information passed to that platform is limited to what the service requires.

Current data locations are as follows.

Platform Where data is processed
Vercel, website and forms Australia, Sydney region
Make.com, automation European Union
Google, advertising, analytics, and email Multiple countries, including the United States
Twilio, SMS May include processing outside Australia
Loom, video reports United States

Before disclosing personal information to overseas recipients, reasonable steps are taken to satisfy that they handle personal information in a manner consistent with the Australian Privacy Principles, through their own privacy commitments, contractual obligations, or the law of their jurisdiction.

Where you require that specific categories of personal information remain in Australia, raise this in writing before an engagement begins. For Purpose Digital will confirm in writing whether the services can be delivered on that basis.

7 How it is stored and protected

Reasonable steps are taken to protect personal information from misuse, interference, loss, unauthorised access, modification, or disclosure. These include:

  • Password-protected access to all accounts and systems
  • Two-factor authentication on Google Workspace, Make.com, and other platforms where available
  • HTTPS encryption across the website
  • Access limited to what is required to deliver the services
  • Client account access held at manager or delegated user level, and removed within 14 days of an engagement ending

No transmission of data over the internet is completely secure. While reasonable precautions are taken, the absolute security of personal information transmitted to or from the website cannot be guaranteed.

Data breach notification

Where For Purpose Digital becomes aware of unauthorised access to, unauthorised disclosure of, or loss of personal information it holds or controls, affected clients are notified in writing within 72 hours.

That notice describes the information involved, the circumstances, and the steps taken in response. For Purpose Digital will cooperate with a client's own assessment of the incident, including any assessment required under the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act 1988 (Cth).

Where an eligible data breach occurs, notification is made to the Office of the Australian Information Commissioner and to affected individuals as required by that scheme.

8 How long it is kept

Personal information is retained for as long as it is needed for the purpose it was collected, or as required by law.

  • Client contact and service records are retained for seven years after the end of an engagement, to meet tax and business record-keeping obligations
  • Enquiries, eligibility checker submissions, and Visibility Review records from organisations that do not proceed are retained for 12 months, then deleted
  • Review request contact lists are deleted or de-identified within 90 days of the end of an engagement, unless you request return or earlier deletion
  • Website analytics data in Google Analytics 4 is subject to Google's retention settings, set to 14 months

When personal information is no longer required, reasonable steps are taken to destroy or de-identify it securely.

9 Cookies and website analytics

The website uses Google Analytics 4 to collect information about how visitors use the site. This includes pages visited, time spent on the site, the device and browser used, and the general geographic region of the visitor. This information is aggregated and used to improve the site.

Google Analytics 4 uses cookies. A cookie is a small text file placed on your device by a website. Cookies can be disabled through your browser settings, though this may affect the functionality of some websites.

The website does not use advertising cookies or remarketing pixels, and does not run paid advertising to itself.

For more information about how Google collects and uses Analytics data, see Google's Privacy Policy.

10 Direct marketing

Service-related communications, including reports, review meeting invitations, invoices, and updates about your engagement, form part of the service agreement between you and For Purpose Digital.

Separately, marketing communications about services, resources, or sector information may be sent where you have given express consent, or where consent can reasonably be inferred under the Spam Act 2003 (Cth). Consent can reasonably be inferred where you have provided your contact details in the course of an enquiry about the services offered.

Every marketing communication includes a functional unsubscribe facility. You can opt out at any time by:

  • Using the unsubscribe link in any email sent to you
  • Contacting For Purpose Digital directly using the details in section 13

Opting out of marketing communications does not affect service-related communications necessary for the delivery of your services.

11 Your rights and how to access your information

Under the Privacy Act you have the right to:

  • Request access to the personal information held about you
  • Request correction of personal information that is inaccurate, out of date, incomplete, irrelevant, or misleading
  • Request deletion of personal information held about you, subject to legal retention obligations
  • Make a complaint about how your personal information has been handled

To make an access or correction request, use the details in section 13. A response will be provided within 30 days. Access is provided free of charge in most cases, though a reasonable fee may apply to complex requests.

A request for access or correction may be declined in circumstances permitted by the Privacy Act, including where providing access would be unlawful or would unreasonably affect the privacy of another individual. Where a request is declined, written reasons will be given.

12 Complaints

If you believe your personal information has been handled in a way that breaches the Australian Privacy Principles, make contact first using the details in section 13. The complaint will be investigated and a response provided within 30 days.

If you are not satisfied with that response, you may lodge a complaint with the Office of the Australian Information Commissioner:

  • Website: www.oaic.gov.au
  • Phone: 1300 363 992
  • Post: GPO Box 5218, Sydney NSW 2001

13 Contact

For any question about this policy, to make an access or correction request, or to make a privacy complaint, contact:

Matthew O'Brien
Privacy Officer, For Purpose Digital
ABN 42 543 582 827
Location Mount Egerton, Victoria, Australia

This policy was last updated in July 2026. It may be updated from time to time. The current version is always available at forpurposedigital.com.au/privacy-policy.