MatterPath Privacy Notice

1. About MatterPath

MatterPath is operated by WD Ventures Pty Ltd, trading as MatterPath.

MatterPath is a technology platform that helps people identify and connect with participating Australian law firms based on information supplied through the platform.

MatterPath is not a law firm, does not provide legal advice and does not establish a lawyer-client relationship between MatterPath and a user.

2. Scope of this Notice

This Privacy Notice explains how MatterPath collects, holds, uses and discloses personal information.

It applies to:

• people seeking assistance with a legal matter
• representatives, parents, guardians and authorised support people
• law firms, lawyers and professional account users
• website visitors
• people contacting MatterPath
• people whose information is supplied in connection with another person's matter

Information given to MatterPath is not automatically protected by legal professional privilege. Whether privilege applies to later communications with a law firm depends on the circumstances and applicable law.

3. Personal information we collect

Depending on how MatterPath is used, we may collect:

• name, email address, phone number and contact preferences
• suburb, state, postcode and country
• age or date-of-birth information where reasonably necessary
• preferred language and accessibility requirements
• information describing a legal issue or requested assistance
• relevant dates, events, locations and parties
• assessment answers and matching preferences
• documents or files voluntarily uploaded
• correspondence with MatterPath
• information about law firms, lawyers, practising details, services, locations, languages and hourly rates
• account, authentication and verification information
• subscription, transaction, invoice and payment-status information
• the last four digits and type of a payment card where supplied by Stripe
• device, browser, IP, security, diagnostic and usage information
• consent, terms-acceptance and disclosure-authorisation records
• complaint, support, fraud-prevention and incident information

MatterPath does not store full payment-card details. Payments are processed by Stripe.

4. Sensitive information

A legal assessment may involve sensitive information, including information about:

• health, injury, disability or medical treatment
• racial or ethnic origin
• religious or philosophical beliefs
• sexual orientation, gender identity or sexual activity
• criminal history or alleged offending
• family violence, abuse, neglect or exploitation
• family relationships or parenting circumstances
• professional or trade-association membership
• other information treated as sensitive under applicable privacy law

MatterPath will only collect sensitive information where it is reasonably necessary to provide the requested assessment or matching service and the person has given specific consent, or where another lawful exception applies.

MatterPath will not treat acknowledgement of this Privacy Notice as consent to collect sensitive information. A separate, unchecked consent control is presented before sensitive information is collected.

5. Information about other people

Users should only provide information about another person where it is reasonably necessary and they are authorised or otherwise legally permitted to do so.

Users should avoid uploading unnecessary information about children, witnesses, opponents, family members, medical practitioners or other third parties.

MatterPath may remove, restrict or de-identify information that appears unnecessary or excessive.

6. How we collect information

MatterPath may collect information:

• directly through website forms and assessments
• when a user creates or verifies an account
• through uploaded documents
• through email, phone and support communications
• during subscription and payment processes
• from participating law firms
• from authorised representatives
• from publicly available professional registers
• from security, analytics and infrastructure systems
• from service providers acting on MatterPath's behalf

Where information is obtained from someone other than the person concerned, MatterPath will take reasonable steps to provide an appropriate privacy notification where required.

7. Why we collect, use and hold information

MatterPath may handle personal information to:

• provide assessments and matching functionality
• identify potentially relevant participating law firms
• prepare a concise matter summary
• obtain and record a user's instructions about disclosure
• send an authorised introduction to selected law firms
• allow law firms to assess whether they may be able to assist
• communicate with users and law firms
• operate accounts and authentication
• administer memberships, subscriptions and payments
• verify law-firm and professional information
• calculate permitted introduction fees
• prevent fraud, misuse, duplicate charges and security incidents
• investigate complaints and disputes
• maintain legally and operationally necessary records
• comply with laws, court orders and regulatory requirements
• monitor and improve the reliability, accessibility and security of the platform
• generate de-identified statistics and service insights
• send marketing communications where separate consent or another lawful basis exists

MatterPath will not use sensitive assessment information for unrelated advertising or targeted marketing.

8. Automated tools and matching

MatterPath may use software and automated tools to organise assessment answers, generate structured summaries, translate fixed MatterPath-authored interface text and assist with matching.

The current translation service receives fixed MatterPath-authored questions, options, headings and labels. It does not receive consumer answers, free-text descriptions or identifying matter details.

These tools:

• do not provide legal advice
• do not determine legal rights
• do not guarantee that a claim or matter has merit
• do not decide whether a law firm will accept a person as a client
• should not be relied on to calculate or protect a legal limitation period or filing deadline

Participating law firms independently decide whether they can assist. Users should seek urgent legal assistance directly where a deadline, court date, safety issue or limitation period may apply.

9. When information is disclosed to law firms

MatterPath will not disclose a consumer's identifying assessment information to a participating law firm merely because an automated match exists.

Before disclosure, MatterPath will show the consumer:

• the law firm or firms proposed to receive the information
• the categories of information to be sent
• whether documents are included
• the purpose of the disclosure

The consumer must actively authorise the disclosure. Only selected information reasonably necessary for the introduction should be disclosed.

After receiving information, the participating law firm is responsible for its own handling of that information under its privacy, professional and legal obligations.

10. Other disclosures

MatterPath may disclose personal information to:

• participating law firms expressly selected or authorised by the consumer
• hosting, database, authentication and infrastructure providers
• payment and subscription providers
• email, SMS and communication providers where those services are actually configured
• fraud-prevention and security providers
• analytics providers configured to avoid unnecessary sensitive information
• professional advisers, auditors and insurers
• courts, regulators, law-enforcement bodies and government agencies where required or authorised
• a purchaser or successor in connection with a genuine corporate restructure or business transaction, subject to appropriate confidentiality and privacy protections

MatterPath does not sell mailing lists or personal information for advertising.

MatterPath does not charge or receive an introduction fee for matter categories where payment for the referral or introduction may be prohibited.

11. Overseas processing and disclosure

Some technology and service providers may process or access information from outside Australia.

The current schedule identifies providers actually verified in MatterPath production code and configuration, their purpose, the information involved and the status of country verification. Service Provider and Overseas Processing Schedule.

MatterPath takes reasonable contractual, technical and organisational steps concerning overseas recipients and service providers. Where a provider's processing countries have not yet been verified, the schedule says so rather than guessing.

12. Security

MatterPath uses reasonable technical and organisational measures designed to protect information from misuse, interference, loss and unauthorised access, modification or disclosure.

Controls include, where appropriate:

• encryption in transit
• encryption at rest where supported
• role-based access controls
• least-privilege access
• multi-factor authentication for privileged users
• row-level database security
• secure secret management
• audit logging
• protected backups
• dependency and vulnerability monitoring
• incident-response procedures
• access reviews
• secure deletion and retention processes

No internet service can guarantee absolute security. Users should not submit information that is unnecessary for matching.

13. Retention and deletion

MatterPath's default retention policy is set out below. A longer period may apply where required by law, a genuine dispute, a fraud investigation or a legal hold:

• abandoned assessment drafts: delete after 30 days of inactivity
• active consumer assessments: retain while active
• closed or inactive assessment records: delete or de-identify after 12 months
• uploaded consumer documents: delete 90 days after the final authorised introduction or closure of the assessment
• account, subscription, invoice, payment, legal acceptance and consent records: retain for 7 years
• security, authentication and diagnostic logs: retain for no more than 24 months unless required for an active investigation
• de-identified and aggregated statistics: may be retained where individuals are not reasonably identifiable

A deletion request does not require deletion of records MatterPath must retain for legal, accounting, fraud-prevention or dispute purposes.

14. Access and correction

A person may request access to personal information MatterPath holds about them or request correction of inaccurate information.

Requests should be sent to info@matterpath.com.au. MatterPath may need to verify identity before responding.

MatterPath will respond within a reasonable period and uses an internal target of 30 days. Where access or correction is refused, MatterPath will provide written reasons where required and explain available complaint options.

15. Withdrawing consent

A person may withdraw consent for future collection, use or disclosure of sensitive information. Withdrawal will not make prior lawful handling invalid.

Where information has already been disclosed to a law firm, the person may also need to contact that law firm. Withdrawal may mean MatterPath cannot continue an assessment or matching process.

MatterPath records withdrawal as a new consent event rather than deleting or overwriting the original consent event.

16. Deletion and account closure

Users may request account closure and deletion of information that MatterPath is not required or permitted to retain.

Closing an account does not automatically cancel a law firm's paid subscription. Subscription cancellation must also be completed through the applicable billing controls.

17. Direct marketing

MatterPath may send marketing communications only where permitted. Marketing consent is separate from sensitive-information consent, terms acceptance and service communications.

Every marketing email contains a functional unsubscribe method. Withdrawing from marketing does not stop operational, security, billing or legally required messages.

18. Cookies and analytics

MatterPath may use necessary cookies for authentication, security, preferences and platform operation.

Non-essential analytics or advertising technologies must not collect assessment answers, uploaded documents or sensitive information. MatterPath obtains any consent required for non-essential tracking.

19. Children and vulnerable users

MatterPath accounts are intended for people aged 18 years or older.

A parent, guardian or authorised representative may provide information where legally permitted and reasonably necessary. MatterPath does not request information directly from a child through a child account.

Where a person may lack capacity to provide informed consent, the service should pause and request involvement from an appropriate authorised representative.

20. Data breaches

MatterPath maintains a data-breach response process. Where an eligible data breach occurs, MatterPath will assess and make notifications required under the Notifiable Data Breaches scheme.

21. Privacy complaints

MatterPath aims to acknowledge a privacy complaint within 7 days, investigate it and provide a substantive response within 30 days where reasonably practicable. MatterPath will explain any delay and advise the complainant of external complaint options where the issue is not resolved.

A person may also be entitled to complain to the Office of the Australian Information Commissioner. Office of the Australian Information Commissioner.

22. Changes to this Notice

MatterPath may update this Privacy Notice. Each version displays its effective date and remains available in the legal-document archive.

The public legal-document archive lists current and superseded versions. legal-document archive.

Material changes affecting existing users will be communicated and, where appropriate, require renewed consent or acceptance.