Privacy policy

Freeman & Marx Pty Ltd
ABN 53 624 478 057
Last updated: 17 October 2026

Our commitment

Freeman & Marx is a cultural heritage and archaeology consultancy. We respect the privacy of the people and organisations we work with and recognise that cultural knowledge can require protections beyond ordinary privacy law.

This policy explains how we collect, use, disclose, secure and retain personal information through our website, enquiries and professional services.

We align our privacy practices with the Australian Privacy Principles. When an applicable law, government contract, client requirement or community-approved cultural protocol provides stronger protection, we follow the stronger requirement.

Information we collect

The personal information we collect depends on how you deal with us. It may include:

• your name, organisation, role and contact details;
• the project location, service requested and information in your enquiry;
• project correspondence and records of meetings, consultation or participation;
• information needed for site access, safety, procurement, contracting, invoicing or insurance;
• professional details about clients, suppliers, contractors and project partners; and
• limited technical information recorded by our hosting or security services, such as an IP address, browser type, request time and error or security logs.

Heritage work may involve sensitive personal information, including information about Aboriginal or Torres Strait Islander identity, community relationships or cultural association. We collect sensitive personal information only when it is reasonably necessary for our work and we have consent, cultural authority, or another lawful basis to do so.

How we collect information

We may collect personal information:

• directly from you through our website, email, telephone, meetings, fieldwork or project activities;
• from the client or government agency that engages us;
• from an employer, project partner, specialist consultant or authorised community representative; or
• from public records or another source where collection is authorised or reasonably expected.

If we receive personal information that we did not request, we assess whether we are permitted and need to keep it. If not, we securely delete or de-identify it where lawful and practicable.

You may make an initial enquiry without providing more information than is reasonably needed. We need a name or other identifier, a reply address and enough project context to respond. We may need to verify identity or collect further information before providing professional services or handling a privacy request.

How we hold information

We hold information in authorised email, document, accounting and project systems, in client- or agency-approved systems where required, and sometimes in secured physical project records. Access is limited to people who need the information for an authorised purpose.

Project or cultural information is not moved into a general business system when a client contract, agency direction or community-approved protocol requires an approved location or tighter access controls.

Why we use information

We use personal information only where reasonably necessary to:

• assess and respond to enquiries, prepare proposals and communicate with you;
• plan and deliver cultural heritage, archaeology and related services;
• support authorised consultation, fieldwork, research, reporting and project decisions;
• coordinate with clients, communities, regulators and approved specialist partners;
• manage contracts, procurement, accounts, insurance, safety and business records;
• protect our people, systems and services, and respond to complaints or incidents; or
• meet legal, regulatory and contractual obligations.

We do not sell personal information. We do not use enquiry information or culturally restricted knowledge for advertising, marketing lists or training artificial intelligence models.

Website enquiries and cookies

Our website enquiry form collects your name, organisation, email address, project location and message so we can assess and respond to your enquiry. Organisation and project location are optional. You do not have to use the form, but without a name or other identifier, a reply address and a message, we cannot respond.

We use Formspree to receive, filter and store form submissions and send email notifications to our enquiry inbox. Our email is currently handled through Google Gmail. These providers may process information outside Australia. See Formspree's privacy policy and Google's privacy policy for their handling of information.

Please do not submit culturally restricted, sensitive, legally privileged or confidential project information through the public form. Contact us first so we can agree on an appropriate way to exchange it.

The website does not intentionally use advertising cookies or behavioural advertising tools. Our hosting and security providers may create limited technical logs needed to deliver and protect the site. If we introduce analytics or other cookies that materially change this position, we will update this policy and the website notice before doing so.

Cultural knowledge and community information

Privacy law does not by itself fully protect Indigenous Cultural and Intellectual Property, collective community interests or culturally restricted knowledge.

Before collecting or handling cultural knowledge, we seek to agree appropriate project protocols with the relevant community, knowledge holders, client and commissioning agency. Those protocols may address:

• who has authority to provide and make decisions about the information;
• who may access it and for what purpose;
• how it is attributed, stored, reproduced and reported;
• whether it may be shared, published or transferred; and
• when it must be returned, archived, deleted or otherwise managed.

We do not treat cultural knowledge as ours merely because it has been shared with us. Where an agreed cultural protocol provides stronger protection than this policy, the protocol prevails.

When we share information

We may share personal information only as reasonably necessary with:

• authorised Freeman & Marx personnel;
• approved archaeologists, scientists, consultants or subcontractors who need it for the project and are subject to appropriate confidentiality and privacy obligations;
• the client, commissioning government agency, relevant community governance body, regulator or project participant where the disclosure is authorised, expected for the project or required by contract;
• service providers that support email, hosting, storage, security, accounting or professional administration;
• professional advisers, insurers or auditors; or
• courts, regulators, law enforcement bodies or other parties where required or authorised by law.

We limit disclosures to what is reasonably necessary and apply project-specific restrictions to sensitive and culturally restricted material.

Government projects and access to records

When we work for a Commonwealth or NSW government body, the contract and the agency's privacy, security, records and information-access requirements may also apply. The commissioning agency may control, hold or have a lawful right to access specified project records.

This does not mean that all project information is automatically public. Privacy protections, cultural protocols, confidentiality obligations and lawful access restrictions continue to apply. Where appropriate, the commissioning agency's privacy notice should be read together with this policy.

Overseas processing

Some email, hosting and cloud service providers may store or process personal information outside Australia. Our current email service may involve processing in the United States and other countries in which its global provider operates. It is not practicable to list every provider location.

Before using an overseas provider for personal or project information, we assess the information involved and take reasonable steps to ensure the provider offers appropriate privacy and security protections. A client contract or cultural protocol may prohibit overseas storage or require prior approval; we follow those restrictions where they apply.

Security

We take reasonable administrative, technical and physical steps to protect personal information against loss, misuse, interference and unauthorised access, modification or disclosure. These steps include access controls, confidentiality obligations, secure transmission, account protection, service-provider review and procedures for secure return or deletion.

No internet or storage system is completely secure. If you believe information connected with Freeman & Marx may have been compromised, contact us promptly using the details below.

Retention and deletion

We keep personal information only for as long as it is reasonably needed for the purpose for which it was collected and to meet legal, contractual, insurance, professional and recordkeeping obligations.

Enquiries that do not become projects are ordinarily deleted or de-identified within 24 months after the last meaningful contact. Limited security logs are ordinarily kept for no more than 90 days unless needed to investigate an incident or meet a legal obligation.

Project records may need to be kept for longer under a client contract, agency direction, professional requirement or law. Cultural knowledge may instead be subject to an agreed return, archival, access or deletion protocol. When information is no longer required, we securely delete, de-identify, return or otherwise manage it as required.

Access and correction

You may ask to access personal information we hold about you or ask us to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading.

Contact the Freeman & Marx Privacy Contact at privacy@freemanandmarx.com.au with the subject line Privacy request. Tell us what information you are seeking or what should be corrected. We may need to verify your identity before acting on the request.

We respond within a reasonable period, ordinarily within 30 days. If a lawful exception prevents access or correction, we will explain the reason where we are permitted to do so and tell you how to complain.

Privacy complaints

Send a privacy complaint to the Freeman & Marx Privacy Contact at privacy@freemanandmarx.com.au with the subject line Privacy complaint. Please describe what happened and the outcome you are seeking.

We will acknowledge the complaint promptly, investigate it fairly and aim to respond within 30 days. If more time is needed, we will explain why and provide an updated timeframe.

If you are not satisfied and the Privacy Act 1988 applies, you may contact the Office of the Australian Information Commissioner. For information handled under a NSW government arrangement, you may also contact the commissioning agency or the Information and Privacy Commission NSW.

Data breaches

If we suspect a privacy or security breach, we act to contain it, assess the risk, preserve necessary evidence and reduce possible harm. We notify affected people, the commissioning agency, the Office of the Australian Information Commissioner or another regulator where required by applicable law or contract.

Changes to this policy

We may update this policy when our services, technology or legal and contractual obligations change. The current version will be published on our website with its last-updated date. Material changes will apply from the date they are published unless a different date is stated.

Contact

Freeman & Marx Pty Ltd
ABN 53 624 478 057
Jervis Bay, New South Wales
Attention: Privacy Contact
Email: privacy@freemanandmarx.com.au