PRIVACY POLICY

Candy Murrell — Business Operations & Systems Strategy

Last updated: 25th August 2026

This Privacy Policy explains how Candy Murrell, trading as [Registered Business/Trading Name] ("we", "us", "our"), collects, holds, uses, and discloses personal information in connection with candymurrell.com (the "Website") and the services we provide, including The Client Journey Audit, the 30-Day Intensives, Systems to Scale, fractional COO engagements, and any digital products or resources (the "Services").

We are committed to handling personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

1. WHAT PERSONAL INFORMATION WE COLLECT

Depending on how you interact with us, we may collect:

- Contact details: name, email address, phone number, business name

- Payment and billing information (processed via our payment provider — we do not directly store full card details)

- Business information you share with us as part of an engagement, audit, or consulting relationship, which may include operational, financial, or team-related details relevant to the Services

- Booking and scheduling information (e.g. via Acuity)

- Communications you send us, including via email, contact forms, or Telegram

- Website usage data collected automatically (e.g. via cookies), such as IP address, browser type, pages visited, and referral source

We only collect sensitive information (as defined under the Privacy Act) where you have provided it voluntarily and it is reasonably necessary for delivering the Services.

2. HOW WE COLLECT PERSONAL INFORMATION

We collect personal information:

- Directly from you, when you complete a form, make a purchase, book a call, or communicate with us

- Automatically, through cookies and website analytics when you browse the Website

- From third-party platforms we use to operate our business (e.g. Squarespace, Fathom, Flodesk, Kajabi, Acuity), where you interact with those tools on our behalf

3. WHY WE COLLECT, HOLD, USE, AND DISCLOSE PERSONAL INFORMATION

We use personal information to:

- Provide, deliver, and manage the Services and any engagement with you

- Process payments and manage invoicing

- Communicate with you, including sending program materials, updates, and email marketing (with your consent, and with an option to unsubscribe at any time)

- Manage bookings, scheduling, and client communication

- Improve the Website, our Services, and our marketing

- Comply with legal and regulatory obligations

We do not sell your personal information.

4. DISCLOSURE TO THIRD PARTIES

We may disclose personal information to trusted third-party service providers who help us operate our business, including:

- Squarespace (website hosting and, where applicable, checkout)

- Flodesk (email marketing and communications)

- Kajabi (digital product delivery and course hosting)

- Acuity Scheduling (appointment booking)

- Telegram (client communication, where you choose to use this channel)

- Our payment processor (to process payments securely)

- Our accountant, bookkeeper, or other professional advisors, where reasonably necessary

These providers are only given the information needed to perform their function and are expected to handle it securely. We do not otherwise share your personal information with third parties except where required by law, to protect our rights, or with your consent.

5. OVERSEAS DISCLOSURE

Some of the third-party service providers listed above (including Squarespace, Flodesk, Kajabi, and Telegram) may store or process personal information on servers located outside Australia, including in the United States. Where this occurs, we take reasonable steps to ensure these providers handle personal information in a manner consistent with the Australian Privacy Principles, but we encourage you to review the privacy policies of these platforms for further detail.

6. COOKIES AND WEBSITE ANALYTICS

Our Website may use cookies and similar tracking technologies to improve your browsing experience, understand how visitors use the Website, and support marketing activities. You can adjust your browser settings to refuse cookies, though this may affect some functionality of the Website.

7. DATA SECURITY

We take reasonable steps to protect the personal information we hold from misuse, interference, loss, unauthorised access, modification, or disclosure. This includes using secure, reputable third-party platforms for storage and processing. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. HOW LONG WE KEEP YOUR INFORMATION

We retain personal information for as long as necessary to provide the Services, maintain our business records, and comply with legal, accounting, or reporting obligations. When information is no longer needed, we take reasonable steps to securely destroy or de-identify it.

9. ACCESS AND CORRECTION

You have the right to request access to the personal information we hold about you, and to request correction if it is inaccurate, out of date, or incomplete. To make a request, contact us using the details in Section 12. We will respond within a reasonable time and may need to verify your identity before providing access.

10. MAKING A COMPLAINT

If you believe we have breached the Australian Privacy Principles or mishandled your personal information, you can contact us using the details below to lodge a complaint. We will investigate and respond within a reasonable time. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

11. CONTACT US

For questions about this Privacy Policy, or to make an access, correction, or complaint request, contact:

info@candymurrell.com

12. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The updated version will be posted on the Website with a revised "Last updated" date.