Privacy Policy

How we collect, hold, use and protect personal information

About this policy

Evolution Partners works closely with owner-operators and their leadership teams. That work generates information that is commercially sensitive, personally sensitive, or both.

This policy explains what personal information we collect, why we collect it, how we protect it, who we share it with, and what you can ask us to do about it. We handle personal information in accordance with the Privacy Act 1988 (Cth) and the thirteen Australian Privacy Principles, and this is our privacy policy for the purposes of Australian Privacy Principle 1.

It applies to everyone we deal with: people who visit our website or subscribe to what we publish, people who attend our events or listen to our podcast, people who apply to work with us, our clients, and the people who work in the businesses we coach.

If you are a client, or you are being coached by us as part of a client engagement, there is a second document that goes further. Our Client Information Handling Standard covers coaching confidentiality and the reporting boundary between an individual and their employer, how we consolidate client information, our position on artificial intelligence, and the rules we apply to any benchmarking across clients. Ask us for it.

If something here is unclear, or does not match what you expected, tell us and we will address it.

1. Who we are

2. The personal information we collect and hold

We hold four broad categories. Each carries different obligations and different protections.

We also hold employment and contractor records for our own people. Records about our own current and former employees are generally outside the Privacy Act under the employee records exemption. That exemption does not apply to information we hold about your employees, and we do not treat it as though it does.

Sensitive information

Coaching conversations sometimes move into health, including mental health, family circumstances, or other matters the Privacy Act treats as sensitive information. We do not seek that information.

Where you choose to share it, we collect and keep it only where it is reasonably necessary for the coaching relationship and you have consented. It is not shared with your employer. It is not entered into our consolidated client environment. It is not included in any dataset used for benchmarking or pattern analysis across clients.

Health information is separately regulated in Victoria, New South Wales and the Australian Capital Territory. We apply the strictest of those standards everywhere, rather than varying our practice by state.

3. How we collect it

• Directly from you, in coaching sessions, workshops, interviews and surveys.
• From the client organisation, where it provides information about its business or its people.
• From Metronome and other platforms used to run the engagement.
• From your interactions with our website, our emails and our events.
• From publicly available sources, for research and preparation.

Recording. We record some sessions so that we can prepare accurate summaries and artefacts. We record only where every person present has given express consent before the recording starts. You can decline, and the session will go ahead unrecorded. You can withdraw consent at any point, and we will stop recording and delete what was captured if you ask us to.

Information a client gives us about its people. Where a client provides us with personal information about the people in its business, the client is responsible for having a lawful basis to do so and for having told those people that their information may be shared with an external adviser. We make this a term of every engagement. Where we work with you directly, we will also give you a short notice at that point explaining what we collect and why.

4. Why we collect it

We use personal information for the purpose it was collected for, and for directly related purposes you would reasonably expect. In practice:

• Delivering the coaching, facilitation and advisory engagement.
• Preparing for sessions and following up on them.
• Tracking priorities, execution and metrics over time, so that progress compounds rather than resets each quarter.
• Responding to enquiries and sending you material you have asked for.
• Assessing applications to work with us.
• Running our own business, including contracts, billing and quality review.
• Meeting our legal and professional obligations.

Anything beyond these requires your consent.

5. Who we disclose it to

• Our own coaches, contractors and staff, on a need to know basis.
• Technology providers who host or process information on our behalf, including Metronome, cloud storage and file sharing, our email and CRM systems, and approved artificial intelligence tools.
• Professional advisers, including our lawyers, accountants and insurers.
• Anyone we are compelled to disclose to by law, or where there is a serious and imminent threat to a person’s life, health or safety.

6. Overseas recipients

Some of the providers we use store or process information outside Australia. At the date of this policy, the countries where this is likely to occur are the United States and Canada. Where a provider offers Australian data hosting, we elect to use it.

Under Australian Privacy Principle 8 we remain accountable for what happens to personal information after it leaves us. Before we engage a provider we assess where data is held, what the provider may do with it, whether it is used for training, how long it is retained, and what security and breach commitments apply. We keep a register of our providers and their data locations, and we will show it to you on request.

If you require your information to stay in Australia, tell us at the point of engagement. We will tell you what we can and cannot accommodate rather than agree to something we cannot deliver.

7. Our website

Our website uses cookies and similar technology to keep the site working, remember your preferences and understand how the site is used.

Most browsers let you refuse new cookies, alert you when one is set, or disable them altogether. Some parts of the site may not work as well if you do.

8. Marketing

If you subscribe to our material, attend an event, or ask us about our work, we may send you articles, podcast releases, event invitations and updates about what we do.

Every email we send has a working unsubscribe link, and we act on it promptly. You can also ask us to stop at any time by writing to our privacy officer. We do not use the information of people who apply to work with us for marketing.

9. Automated decisions

We use artificial intelligence tools to help us prepare for sessions, synthesise material and draft summaries. Every output is reviewed, corrected and owned by a named person. We do not use these tools in the room without the agreement of everyone present, and we do not enter sensitive information into them.

We do not use computer programs to make, or to substantially assist in making, decisions that could reasonably be expected to significantly affect your rights or interests. We do not use them to score, rank, screen or assess a person. A human makes the judgements.

If that position changes, we will update this policy to describe the information used and the decisions involved before any such use begins.

10. How we protect it

• Multi-factor authentication on the systems that hold client information.
• Encryption of information in transit and at rest.
• Access granted by role and by engagement, and removed when a person leaves or an engagement ends.
• Devices encrypted, screen-locked and able to be wiped remotely.
• Client material kept in firm systems, not on personal devices or personal cloud accounts.
• Confidentiality obligations in every employment and contractor agreement, which survive termination.

No system is perfectly secure. We take reasonable steps, we review them, and we tell you promptly if something goes wrong.

11. How long we keep it

We keep information only as long as we need it.

At the end of an engagement you can ask us in writing to return or delete client material earlier. We will do so, apart from records we are legally required to keep.

12. If something goes wrong

We maintain a data breach response plan. If a breach occurs we contain it, assess whether it is likely to result in serious harm, and act.

Where a breach affects a client’s information we will notify the client sponsor as soon as practicable, and in any event within seventy-two hours of becoming aware of it. That commitment is stricter than the law requires of us. Where a breach is an eligible data breach under the Notifiable Data Breaches scheme, we will notify the affected individuals and the Office of the Australian Information Commissioner as the Privacy Act requires.

We then review what caused it and change the control that failed.

13. Access and correction

You can ask us what personal information we hold about you, and you can ask us to correct it. Write to the privacy officer. We will respond within thirty days.

There are limited grounds on which we may decline, including where giving you access would unreasonably affect another person’s privacy, or would reveal information given to us in confidence by someone else. If we decline, we will tell you why and how to challenge it.

14. Complaints

If you are concerned about how we have handled your information, raise it with our Privacy Officer. We will acknowledge your complaint within five business days and respond substantively within thirty days.

Where your complaint concerns the Privacy Officer, or a decision he was party to, it is handled by our Deputy Privacy Officer instead. Say so when you write and it will be routed accordingly. You do not have to explain why.

If you are not satisfied with our response, you can take the matter to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992. Where your complaint concerns health information, you may also be able to take it to the privacy or health complaints body in your state.

15. Changes to this policy

We review this policy regularly, and whenever we make a material change to our systems, our tools or when the law changes. The current version is always the one published on our website, and the date it took effect is shown at the top.

Client Information Handling Standard

How we hold, protect and use information belonging to our clients and the people in their businesses

1. What this document is

Evolution Partners works closely with owner-operators and their leadership teams. That work depends on people telling us the truth about their business and about themselves. Strategy sessions, financial reviews, team assessments and one-on-one coaching all generate information that is commercially sensitive, personally sensitive, or both.

This document sets out what we hold, how we protect it, and the limits we place on ourselves. It covers the questions a client asks us: what goes back to the organisation and what does not, what happens when information from many clients sits in one place, and what we do and do not do with artificial intelligence.

We have written it so that you can read it. If something here is unclear, or does not match what you expected, tell us and we will address it in your engagement terms.

2. Who you are dealing with

Your contract is with Evolution Partners. Our coaches run their own businesses and work under a contracting arrangement with us. Your engagement is with Evolution Partners Pty Ltd, which means Evolution Partners holds your information and carries the obligations in this document, whichever coach is in the room. Coaches handle your information on our behalf and are bound by these standards through their agreement with us.

If your coach stops working with Evolution Partners, your information stays with Evolution Partners and their access to it ends.

3. The legal framework we work to

We handle personal information in accordance with the Privacy Act 1988 (Cth) and the thirteen Australian Privacy Principles. We have chosen to work to that standard in full rather than to the minimum our size requires.

Several other obligations apply to our work regardless of our size, and shape what is in this document.

• The statutory tort for serious invasions of privacy, in force since 10 June 2025, under which an individual can bring a claim directly.
• Health records legislation in Victoria, New South Wales and the Australian Capital Territory, which regulates health information separately from the Privacy Act.
• State surveillance and listening device legislation, which governs the recording of private conversations and differs between states. Section 5 sets out how we deal with it.
• The Spam Act 2003 (Cth) and the Do Not Call Register Act 2006 (Cth) for our marketing.
• The confidentiality obligations in your engagement terms, which in most cases are stricter than the law requires.

The employee records exemption in the Privacy Act applies to an employer handling records about its own current or former employees. It does not apply to Evolution Partners when we hold information about your employees. We treat all client personnel information as fully subject to the Australian Privacy Principles.

4. What we hold

5. Confidentiality in the coaching relationship

Coaching works only if people can speak freely. Our standing position is that an individual coaching conversation is confidential to that conversation.

Where we are engaged by an organisation and coach an individual within it, we agree the reporting boundary at the outset and state it to both parties. As a default:

• We report on themes, engagement, and progress against agreed development objectives.
• We do not report the content of what an individual said.
• We do not provide input into remuneration, promotion or termination decisions unless that has been explicitly agreed with the individual in advance and in writing.

Where the owner and the CEO or GM are different people, we state at the outset who our client is, who we report to, and what each party can expect to be told. Where in-camera or one-on-one sessions occur at board level, the same principle applies in both directions.

The limits

We tell every individual about them before we start rather than afterwards.

1. Where there is a serious and imminent threat to a person’s life, health or safety.
2. Where we are compelled to disclose by law.
3. Where we are told of conduct that creates a serious legal or regulatory exposure that we believe the owner or the board must know about.

Where we can tell the individual first, we will.

Protected disclosures are handled differently. Where what we are told may be a protected disclosure under the whistleblower provisions of the Corporations Act, the third limit does not apply. The coach stops, does not report the matter onward, does not put it in a written summary, and takes advice. We then tell the individual what their options are. This protects the individual, and it reflects that revealing a whistleblower’s identity is a criminal offence.

6. Recording sessions

We record some sessions so that we can prepare accurate summaries and artefacts rather than relying on memory.

Recording a private conversation is governed by state criminal law, and the rules differ between states. We apply one national standard set at the strictest level rather than varying our practice by where a session happens or where each person is sitting.

7. Sensitive and health information

Coaching conversations sometimes move into health, including mental health, family circumstances, or other matters the Privacy Act treats as sensitive information. We do not seek that information.

Sensitive information has a specific meaning under the Privacy Act. It covers health information, and information about a person’s racial or ethnic origin, political opinions, membership of a political association, religious or philosophical beliefs, membership of a professional or trade association or a trade union, sexual orientation or practices, criminal record, and genetic or biometric information. The additional protections below apply to anything in that list.

In practice the category that arises most often is health. Where an individual chooses to share it, we collect and keep it only where it is reasonably necessary for the coaching relationship and the individual has consented.

Where we hold it:

• It is not disclosed to the employer.
• It is not entered into the EP Hub, unless recording it is necessary to the work and the conditions at section 8 have been met.
• It is not included in any dataset used for benchmarking or pattern analysis across clients.
• Where an individual would prefer we hold no record of it at all, we make a note of the conversation without the detail.

Health information is separately regulated in Victoria, New South Wales and the Australian Capital Territory, and those regimes differ. We apply the strictest of them everywhere.

8. The EP Hub

The EP Hub brings client information into a single environment so that we can work with continuity across coaches, sessions and years. Consolidation creates value for you. It also concentrates risk, so it carries specific controls.

Sensitive information in the EP Hub

Our working position is that sensitive information is not recorded in the EP Hub. Where a coach judges that recording it is necessary to the work, three things must happen before it is entered.

1. The individual the information relates to has consented to it being recorded.
2. The Privacy Officer or Deputy has approved it, and the approval is recorded.
3. Only the minimum necessary is entered. The underlying detail stays out.

Whether or not it is in the EP Hub, sensitive information is never disclosed to the employer and is never included in any dataset used for benchmarking or pattern analysis across clients. Those two limits hold without exception.

9. Composite data and benchmarking

Holding data from many mid-market businesses in one place makes benchmarking and pattern recognition possible, and that is useful to clients. It also creates the risk that one client’s position becomes visible to another. This section sets the boundary.

We recognise three tiers of use.

Participation is opt-in

Your data is not included in any composite dataset unless you have agreed in writing that it can be. Agreement is sought through your engagement terms, separately from the engagement itself, and declining does not affect your engagement or what we do for you.

You can withdraw at any time by written notice. We will confirm the effective date and remove prospective contribution. Where a benchmark has already been published, we will not attempt to reconstruct it retrospectively.

Thresholds for Tier 1

• A minimum cohort of five clients before any benchmark is published or presented.
• No single client contributing a share of a cohort large enough to make its position inferable. Where a sector or size band is thin, the cohort is widened or the benchmark is not produced.
• No free-text content. Composite datasets draw on structured metrics only, not on session notes, survey comments or coaching records.
• No individual-level records. Composite data operates at the level of the business, not the person.
• A documented re-identification check before first publication and on any material change to the cohort.

Whether information is de-identified depends on context, on what else is available, and on who is looking at it. We re-test it rather than treating it as settled once.

Standing prohibitions

• Composite data is never used to advantage one client against another.
• Composite data is never provided to a third party in a form that could be re-identified.
• No attempt is made, by us or by any provider we engage, to re-identify de-identified data. This is a contractual term with our providers.
• Client data is not used to build a product or dataset that is sold or licensed.

10. Artificial intelligence

We use AI tools. We are direct about how, because the value of this firm sits in the judgement of its coaches.

Where we use it

• Before a session: research, synthesis of prior material, preparation of questions and options.
• After a session: drafting summaries, structuring notes, preparing artefacts.

Where we do not

• Not in the room. Sessions are not processed or transcribed by AI tools without the explicit agreement of everyone present.
• Not to make or substantially influence a decision about an individual. We do not use AI to score, rank, screen or assess a person.
• Not as a substitute for the coach’s thinking. Every output is reviewed, corrected and owned by a named person.

Our controls

• Enterprise or business tier accounts only, under terms that prohibit training on our inputs and limit retention. Consumer accounts are not permitted for client work.
• No sensitive information is entered into any AI tool.
• Personal identifiers are removed or generalised before input wherever the task does not require them.
• A register of approved AI tools is maintained and reviewed at least annually.
• The methodologies we apply, including Metronomics, Scaling Up and the work of Patrick Lencioni, together with our own intellectual property, are applied by the coach. AI assists in that application.

On automated decision-making: Evolution Partners does not use computer programs to make, or to do anything substantially and directly related to making, a decision that could reasonably be expected to significantly affect an individual’s rights or interests. If that position changes we will update this document and our Privacy Policy to describe the information used and the decisions involved, before any such use begins.

11. Where your information is held

We disclose personal information to our own coaches, contractors and staff on a need-to-know basis, to the technology providers who host or process it for us, to our professional advisers, and to anyone we are compelled to disclose to by law.

Some providers store or process information outside Australia. At the date of this document the countries where this is likely to occur are the United States and Canada. Where a provider offers Australian data hosting, we elect to use it.

Under Australian Privacy Principle 8 we remain accountable for what happens to information after it leaves us. Before engaging a provider we assess where data is held, what the provider may do with it, whether it is used for training, how long it is retained, and what security and breach commitments apply.

We keep a register of our providers and their data locations, and we will show it to you on request.

If you require Australian-only data residency, tell us at the point of engagement. We will tell you what we can and cannot accommodate rather than agree to something we cannot deliver.

12. Security

• Multi-factor authentication on the systems that hold client information.
• Encryption of information in transit and at rest.
• Access granted by role and by engagement, and removed when a person leaves or an engagement ends.
• Devices encrypted, screen-locked and able to be wiped remotely.
• Client material kept in firm systems, not on personal devices or personal cloud accounts.
• Confidentiality obligations in every employment and contractor agreement, which survive termination.

No system is perfectly secure. We take reasonable steps, we review them, and we tell you promptly if something goes wrong.

13. How long we keep it

At the end of an engagement you can ask us in writing to return or delete client material earlier. We will do so, apart from records we are legally required to keep.

14. If something goes wrong

We maintain a data breach response plan. In summary:

1. Contain the breach immediately.
2. Assess whether it is likely to result in serious harm, within thirty days and faster where the facts allow.
3. Notify your sponsor as soon as practicable, and in any event within seventy-two hours of becoming aware of a breach affecting your information.
4. Where the breach is an eligible data breach, notify affected individuals and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires.
5. Review the cause and change the control that failed.

The seventy-two hour commitment at step 3 is stricter than the law requires of us.

15. Access, correction and complaints

Any individual can ask us what personal information we hold about them, and can ask us to correct it. Write to our Privacy Officer. We will respond within thirty days.

There are limited grounds on which we may decline, including where access would unreasonably affect another person’s privacy, or would reveal information given to us in confidence by someone else. If we decline, we will tell you why and how to challenge it.

If you are concerned about how we have handled information, raise it with our Privacy Officer at the same address. We will acknowledge within five business days and respond substantively within thirty days. Where your concern involves the Privacy Officer, or a decision he was party to, say so and it is handled by the Deputy Privacy Officer instead. You do not have to explain why.

If you are not satisfied with our response, you can take the matter to the Office of the Australian Information Commissioner at oaic.gov.au. Where your concern relates to health information, the privacy or health complaints body in your state may also be available to you.

16. Governance and review

• A named Privacy Officer is accountable for this document, the provider register, the AI tool register and the breach response plan, with a named Deputy who acts where the Privacy Officer is unavailable or conflicted.
• This document is reviewed annually, and on any material change to our systems, our tooling or the law.
• All coaches, contractors and staff complete privacy and confidentiality induction, refreshed annually.
• Composite data thresholds are reviewed each time a new benchmark is introduced.
• A privacy impact assessment is completed before any new system, tool or data use that materially changes how personal information is handled.