1Who we are
This Privacy Policy explains how LAPM Services Pty Limited (ABN 58 660 970 141) and LAPM Technology Pty Limited (ABN 65 701 930 289) (“LAPM”, “we”, “us” or “our”) collects, uses, holds and discloses personal information in connection with LAPM OS and related LAPM products and services (the Platform).
We are committed to protecting personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
Contact
Email: support@lapm.com.au
Phone: 1300 808 935
Post: Suite 1009, Level 1, 241 Adelaide Street, Brisbane QLD 4000, Australia
2How LAPM handles information
LAPM provides the Platform to law firms and other legal practices (our Customers).
Customers generally determine what personal information is entered into the Platform and how that information is used in connection with their legal practice. Where LAPM handles information on behalf of a Customer, we do so as reasonably necessary to provide, maintain, secure and support the Platform and related services, and in accordance with the Customer's instructions and the applicable Agreement.
If you are a client, employee, contact or other person whose information has been entered into LAPM OS by a Customer, you should generally direct privacy enquiries and requests to that Customer in the first instance.
LAPM is responsible for personal information it collects and handles for its own purposes, including account administration, billing, support, security, Platform usage and communications.
3Information we collect
3.1 Account and user information
We may collect:
- name, work email address, telephone number, role and firm details;
- account and subscription information;
- authentication and security information, including password and multi-factor authentication settings; and
- communications and support information.
3.2 Firm, matter and client information
Customers may enter or upload information into the Platform, including:
- matter and client records;
- contacts and parties;
- documents and correspondence;
- notes and tasks;
- time entries and disbursements;
- billing information; and
- trust and other financial records.
This information may contain personal information and, depending on the nature of a matter, sensitive information.
LAPM handles this information on behalf of the Customer for the purposes described in this Policy and the applicable Agreement.
3.3 Connected email accounts
If a user connects a Microsoft or Google mailbox to the Platform, we may receive authentication tokens and other information necessary to provide the email functionality selected by the user.
The Platform is designed to request only the permissions required for the relevant functionality. Where the feature permits a user to send correspondence through a connected mailbox, the Platform may send email on the user's behalf and store a copy of that correspondence against the relevant matter.
We do not request general mailbox-reading access where it is not required for the relevant functionality.
3.4 Technical and usage information
We may collect information generated through use of the Platform, including:
IP address;
- timestamps and request identifiers;
- browser, device and operating-system information;
- login and authentication events;
- audit records of actions taken within the Platform; and
- information relating to errors, performance and security events.
3.5 How we collect information
We may collect personal information:
- directly from you;
- from your Customer or firm;
- when you use the Platform;
- through services or integrations you or your firm choose to connect;
- through communications with us; and
- from other persons or sources where reasonably necessary to provide the Platform or related services.
Where lawful and practicable, you may interact with us anonymously or using a pseudonym. This may not be practicable where we need to identify you to provide the Platform, manage an account, process a transaction, provide support or meet legal obligations.
4How we use personal information
We may use personal information to:
- provide, operate, maintain and support the Platform;
- manage accounts, subscriptions and billing;
- authenticate users and maintain account security;
- send email on a user's behalf where the relevant email functionality has been enabled;
- provide integrations and functionality selected by the Customer;
- provide document generation, bundling, accounting, payroll and other LAPM services;
- provide transactional and service communications, including password resets, notifications, reminders and scheduled reports;
- provide optional AI-assisted features;
- monitor, maintain and improve the security, reliability and performance of the Platform;
- detect, investigate and prevent misuse, fraud or security incidents;
- comply with legal, regulatory and professional obligations; and
- otherwise perform our obligations and exercise our rights under the applicable Agreement.
Marketing and communications
We may use personal information to send you information about LAPM products, services, events, webinars, updates, offers and other information that may be relevant to you. Where required by law, we will obtain your consent before sending direct marketing communications.
You can opt out of marketing communications at any time by using the unsubscribe option included in the communication or by contacting us. We may continue to send non-marketing communications that are necessary to provide the Platform or manage your account, such as security alerts, service notifications and transactional messages.
We do not sell personal information.
5Connected accounts and integrations
Customers may choose to connect third-party services to the Platform, including Microsoft, Google, accounting platforms and other services supported by LAPM.
Where a connection is enabled, LAPM may exchange information with the relevant third-party service to provide the functionality requested by the Customer or user.
We use authentication credentials and tokens only as reasonably necessary to provide the relevant integration. Where supported, users may disconnect a connected account through the relevant Platform functionality.
Third-party services may have their own privacy policies and terms. LAPM is not responsible for the privacy practices of third-party providers operating independently of LAPM.
6Who we share information with
We may disclose personal information to trusted service providers that assist us in operating the Platform and providing related services.
These may include:
Amazon Web Services (AWS) — hosting, infrastructure, database and document storage, including services hosted in the AWS Asia Pacific (Sydney) region;
Resend — delivery of transactional and service email;
Anthropic — provision of optional AI-assisted functionality;
Microsoft and Google — where a Customer or user chooses to connect the relevant services;
- accounting, payroll, document, bundling and other third-party service providers where a Customer enables the relevant integration; and
- professional advisers, contractors and other service providers where reasonably necessary to operate our business or provide the Platform.
We may also disclose personal information:
- where required or authorised by law;
- to protect our rights, property, users or the security of the Platform;
- where reasonably necessary to investigate or respond to suspected unlawful activity or security incidents; or
- in connection with a proposed or completed sale, merger, restructuring or transfer of all or part of our business, subject to applicable privacy requirements.
7Overseas disclosure
Some service providers we use may be located in, or process information from, countries outside Australia, including the United States and other jurisdictions in which those providers operate.
Where personal information is disclosed to an overseas recipient, we take reasonable steps to ensure that the disclosure and subsequent handling of the information is consistent with applicable Privacy Laws.
Some third-party services may also process information in accordance with their own privacy policies and terms.
8Storage and security
We take reasonable technical and organisational measures to protect personal information against misuse, interference, loss and unauthorised access, modification or disclosure.
Depending on the nature of the information and the Platform functionality involved, these measures may include:
- encryption in transit and at rest;
- access and authentication controls;
- role-based permissions;
- data isolation;
- audit logging and monitoring;
- secure storage of authentication credentials and tokens; and
- security processes designed to detect and respond to security incidents.
Platform data is generally hosted using infrastructure located in Australia, including the AWS Asia Pacific (Sydney) region. However, some third-party providers may process limited information outside Australia as described in this Policy.
No system or method of transmission or storage is completely secure. We cannot guarantee absolute security, but we take reasonable steps appropriate to the nature and sensitivity of the information we handle.
9Data retention
We retain personal information for as long as reasonably necessary to:
- provide the Platform and related services;
- fulfil our contractual obligations;
- comply with legal and regulatory requirements;
- maintain appropriate business, financial and security records;
- resolve disputes and enforce our agreements; and
- fulfil other lawful purposes.
Where LAPM handles Customer Data on behalf of a Customer, retention, return and deletion of that information will also be governed by the applicable Agreement and the Customer's instructions, subject to any legal or regulatory requirements that require LAPM to retain particular information.
When personal information is no longer required, we will take reasonable steps to delete or de-identify it, subject to applicable legal, regulatory, contractual and security requirements.
10Access and correction
You may request access to personal information we hold about you and request that inaccurate, incomplete or out-of-date information be corrected, subject to the Privacy Act and any applicable exceptions.
If you are a client, employee, contact or other person whose information has been entered into LAPM OS by one of our Customers, you should generally contact that Customer first.
Requests concerning personal information held directly by LAPM can be made using the contact details in this Policy.
We may need to verify your identity before responding to an access or correction request.
11Privacy complaints
If you have a concern or complaint about how LAPM has handled your personal information, please contact us using the details in this Policy.
We will acknowledge, investigate and respond to privacy complaints within a reasonable period and in accordance with applicable law.
If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC) through its website at oaic.gov.au.
12AI-assisted features
The Platform may include optional AI-assisted features.
When an AI feature is used, relevant information may be processed by our AI provider to generate a response or perform the requested task. Depending on the feature, this may include information provided directly by the user and relevant information from matters, documents or other Customer Data to which the user has authorised access.
LAPM uses AI providers under arrangements designed to protect Customer Data. Customer Data submitted to our AI provider is not permitted to be used to train the provider's general-purpose models.
AI-generated information may be incomplete, inaccurate or unsuitable for a particular purpose. AI output is not legal, accounting, tax, financial or other professional advice and should be reviewed by an appropriately qualified person before reliance or action.
13Cookies
We use cookies, session tokens and similar technologies where necessary to:
- keep users signed in;
- maintain sessions;
- secure the Platform; and
- support Platform functionality.
We do not use cookies within the Platform for third-party advertising.
14Changes to this Policy
We may update this Privacy Policy from time to time to reflect changes to our business, the Platform, applicable law or our privacy practices.
The updated Policy will be published on our website with a revised effective date. Where appropriate, we will notify Customers of material changes.
15Contact
If you have any questions about this Privacy Policy, wish to request access to or correction of personal information, or wish to make a privacy complaint, please contact:
LAPM Services Pty Ltd
Email: support@lapm.com.au
Phone: 1300 808 935
Post: Suite 1009, Level 1, 241 Adelaide Street, Brisbane QLD 4000, Australia