Nobody finds out you are selling
Confidentiality is not a promise in a policy. It is a set of steps, and these are mine.
Get my free appraisal, in writingCall 0431 124 128
No obligation. Nothing is published. Nobody is contacted.
Check it yourself
This is the privacy policy for tonypope.com.au and for ETP Consulting Pty Ltd
Version 1.1. Last updated 15 September 2026. If this policy changes, the new version replaces this one on this page and this date changes with it.
It covers everything I hold about you, whether you rang, emailed, filled in the form on this site, used the chat assistant, booked a call, or handed over identity documents because you decided to sell.
How confidentiality actually works, in practice
Confidentiality is not a promise in a policy. It is a set of steps, and these are mine.
- Your business is advertised without being named. A buyer sees a sector, a region, a size and a shape. Not your trading name, not your address, not your website.
- Every enquiry signs a confidentiality agreement before anything identifying is released. No exceptions, including for people I know.
- Buyers are qualified for financial capacity before they see your figures. Curiosity is not a reason to hand over your accounts.
- Sensitive material is released last, not first. Customer names, key contracts and supplier terms come out at due diligence, to a buyer who is already committed.
- Your staff hear it from you, when you decide. Not from me, not from a portal, and not from a buyer walking through the door unannounced.
- If you decide not to sell, that is confidential too. Nothing about the conversation goes anywhere.
If confidentiality is the thing that has kept you from making the call, ring me and ask how it is handled before you tell me anything at all. That conversation costs you nothing and gives away nothing.
Why the Privacy Act applies to me at all
The Privacy Act 1988 (Cth) generally exempts a small business with an annual turnover of $3 million or less. On turnover alone I would sit inside that exemption.
It does not end there. Because I am a reporting entity under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), the exemption is displaced for the personal information I handle for anti-money laundering purposes. The Office of the Australian Information Commissioner puts it plainly: small businesses that are reporting entities "are required to comply with the Privacy Act in relation to the activities for the purposes of, or in connection with their obligations under the AML/CTF Act".
The Australian Privacy Principles therefore bind me for the identity checks and the records that go with them. Rather than run one standard for that and a looser one for everything else, this policy covers the lot. Where something is a choice rather than a legal requirement, it says so.
The exemption itself has not been abolished. Removing it has been proposed and is not law. If anyone tells you otherwise, they are ahead of the legislation.
What I collect, and how
When you get in touch
Your name, phone number, email address and whatever you choose to tell me about your business. You give this to me directly, by phone, by email, through the enquiry form on this site, or by booking a time through Calendly. There is no newsletter. The only list is the optional one you can tick on the form, which sends you businesses for sale that match what you told me, and you can stop it from any of those emails. Leaving it unticked is recorded as a no, not as a blank.
When you ask what your business is worth
Financial statements, tax returns, management accounts, lease documents, plant and equipment registers, employee entitlement figures, customer concentration information, and anything else needed to form a view on price. Some of that is personal information about you. Some of it is personal information about other people, including your employees, and I treat it the same way.
When you decide to sell
Identity documents, so that the compulsory customer identification can be completed before you are listed. Typically a passport or driver licence, and evidence of who controls the business. This is the part the AML/CTF Act requires, and it is the part that brings the Australian Privacy Principles down on me regardless of my turnover.
When you fill in a form or use the chat
What you type: your name, how to reach you, roughly where the business trades, what it does, and anything you write in the message box. If you tick the box asking for businesses for sale, I record the exact words you were shown and the fact you said yes, so I can prove later that you asked. If you do not tick it, I record that too. Nothing is inferred from silence.
Alongside what you type, the form records the IP address the enquiry came from, the browser and device you used, and the page or the search that sent you here. That is kept with the enquiry so I can tell a real enquiry from an automated one, and it is deleted on the same 24-month schedule as the rest of it. It is not used to work out who you are, and it is not used for advertising.
The chat assistant records the conversation, which page you were on, and what it worked out about what you are trying to do, whether you look like a seller or a buyer and roughly what stage you are at. That last part is a guess made by software, and it never decides anything on its own. A person reads it.
If the assistant asks whether Tony may call or email you, it records the exact words it asked and the exact words you answered, with the period you agreed to, the same standard the form holds itself to. If you ask it to pass a question to Tony, or it decides a conversation needs a person, what you typed is sent to Tony by email and lands in the same enquiry register as the form, marked as coming from the chat. The assistant is AI and says so on its face. It cannot give you a price, a valuation, or financial or legal advice, and where a conversation touches those subjects it says so in the conversation itself, not in fine print somewhere else.
When you visit this website
Google Analytics 4 records the pages you look at, roughly where in the world you are, and what device you used. It sets cookies to do that. It does not tell me who you are. There is no advertising pixel on this site, no remarketing tag and no tracking beyond that one tool.
If you would rather not be counted, Google publishes an opt-out browser add-on, and every major browser lets you block cookies for a site.
Why I hold it
- To answer your question and give you an appraisal.
- To market a business for sale confidentially, and to qualify the people who enquire about it.
- To meet my obligations under the Property Occupations Act 2014 (Qld), including the appointment paperwork.
- To meet my obligations under the AML/CTF Act, including customer identification, ongoing customer due diligence and record keeping.
- To understand which pages of this website are useful, in aggregate.
I do not sell your information. I do not trade it, rent it, or hand it to a data broker. I do not use it to build a marketing list. There is no list.
Who else sees it
As few people as the job allows, and never your identity to the market. A business is marketed blind. Buyers sign a confidentiality agreement and are qualified for financial capacity before they receive anything that identifies your business.
| Who | What they see | Why |
|---|---|---|
| Calendly | Your name, email and the time you booked | Booking a call |
| Resend | Your name, email, phone and what you wrote on the form or asked the chat assistant to pass on | It sends the confirmation to you, the copy to me, and the note the chat sends me when it hands a conversation over. Processed in Japan |
| Anthropic, if you use the chat assistant | What you type into the chat, and the page you were on | The assistant is an AI. Anthropic processes the conversation so it can answer. It is not used to train their models |
| Supabase | Enquiries and the records behind them, at rest | The database. The project is in Supabase’s Sydney region, and the connection to it is pinned to Supabase’s own certificate |
| Netlify | This website as it is served, and an enquiry in transit on its way to the database | The hosting. Netlify is a United States company. Page files are cached on a worldwide network, so the copy you are reading may not be in Australia. Nothing you send is stored there |
| Google Analytics | Anonymous website usage | Which pages are read |
| Instant Compliance | Your name, date of birth, address and identification document, and company or trust documents where they apply | It runs the compulsory identity check. Australian company, ACN 111 744 668, records held on Amazon Web Services in Sydney |
| Sumsub, through Instant Compliance | The image of your identification document and any biometric data taken from it | It is the identity verification sub-processor. It holds that material in the European Union |
| Anthropic again, where a company or trust is involved | The text of company and trust documents | Instant Compliance uses it to read structured detail out of them, transiently, in the United States |
| Qualified buyers | Business information, after a confidentiality agreement | Selling the business |
| Your solicitor and accountant, and the buyer's | What the transaction requires | Contract and due diligence |
| AUSTRAC, the Office of Fair Trading, a court | What the law compels | Where I have no choice |
Information that leaves Australia
Yes, some does, and you should know which.
The chat assistant on this site is built on Claude, made by Anthropic, and the conversation is processed in the United States. Whatever you type into it goes there. It is not used to train anyone's model, I hold a contract that says so, and I delete chat transcripts after 90 days. If you would rather not use it, everything the assistant can tell you is also on these pages, and you can ring me instead.
Calendly stores booking information in data centres in the United States. If you book a call through this site, your name, email address and the time you chose are held there. If you would rather that did not happen, ring me on 1300 173 183 or email me and we will find a time without it.
Resend sends the email this site generates: the short confirmation you get when you use the form, and the copy that comes to me. It processes those messages in Japan, so your name, email address, phone number and what you typed pass through a Japanese data centre on the way. The record itself does not: that stays in my own database in Sydney. If you would rather nothing was emailed at all, ring me on 1300 173 183 and say so.
Google Analytics processes website usage data in the United States and in other countries where Google operates. It records your IP address in order to work out roughly where you are, and it does not tell me who you are.
Identity documents, and exactly where they go. The AML/CTF Act requires me to verify who you are before I can act for you, and to keep the record for seven years. I record what the law requires: your name, date of birth, address, the document type, its number and its expiry.
The check is run by Instant Compliance Pty Ltd, ACN 111 744 668, an Australian AML/CTF platform. Here is what that means for your documents, in the order it happens, taken from their own trust and privacy pages and checked on 21 August 2026.
- The image of your licence or passport, and any biometric data taken from it, is held by Sumsub, in the European Union. Instant Compliance does not store it. Sumsub is their identity verification sub-processor and it holds that material on its own infrastructure under the General Data Protection Regulation.
- The verification record, the audit trail and the compliance file sit in Australia, on Amazon Web Services in Sydney, encrypted at rest.
- Where a company or a trust is involved, the text of those documents is read by software in the United States. Instant Compliance uses Anthropic's Claude to pull structured detail out of company and trust paperwork. The processing is transient and their contract says the content is not used to train the model.
So the plain answer is that your identity document does leave Australia, to the European Union, and company paperwork is read in the United States on the way through. That is more than this page could tell you before a provider was chosen, and it is why it is set out here in full rather than in a footnote. This is the page that governs how your identity documents are handled, and every other page on this site points here rather than describing it again. If you want to know exactly how your check will be run before you hand anything over, ask me and I will tell you.
Netlify serves this website. The pages themselves are copied onto a worldwide network so they load quickly wherever you are, which means the copy of this page you are reading may be held outside Australia. Pages are not personal information. When you send the form, the code that receives it also runs on Netlify, and it writes the enquiry straight to the database in Sydney. Netlify is a United States company, and United States law reaches United States companies, so you should know that before you decide what to put in the message box.
Cloudflare runs the automated check that tells a person from a robot on the enquiry form. When the form loads, your IP address and some signals about your browser go to Cloudflare, which decides whether you look automated and hands back a pass or a fail. It does not see your name, your email address or anything you type in the message box. Cloudflare is a United States company. This is here because in August 2026 this site was receiving roughly 140 automated fake enquiries a day, and the alternative was a form that buried real sellers under robots.
Everything else stays in Australia. Enquiries, appraisals, listings, the documents you send me, my own verification record and the database behind all of it are held in Sydney. That is a deliberate choice and it is not the cheapest one. It means that for almost everything I hold, the question of which country's laws apply does not arise. The image of your identification document is the one part that does not stay here, and it is set out above rather than buried in this sentence, because that is the sort of detail a policy is usually written to lose.
How it is held, and for how long
The one exception is the image of your identification document, which is held by Sumsub in the European Union and is set out in full above. Everything else is held in access-controlled cloud storage in Sydney, with multi-factor authentication on every account that can reach them. Paper, where any exists, is locked. I am a sole operator, so the list of people with access is one person long.
The AML/CTF Act requires identification records and transaction records to be kept for seven years. That is not discretionary and I cannot shorten it at your request.
Chat transcripts are deleted after 90 days. Website enquiries that go nowhere are deleted after 24 months. Documents on a deal that did not proceed are deleted after 12 months unless the seller asks me to keep them. Those are jobs that run on a schedule, not intentions.
Everything else is kept while it is needed and then destroyed or de-identified. If you had a conversation with me and decided not to sell, tell me and I will delete what I hold, other than anything the seven-year rule captures.
What software decides, and what I decide
Two things on this site are worked out by software rather than by me, and you should know what they are and what they do not do.
The kinds of personal information used. What you type into the chat assistant and the page you were on. What you put in the enquiry form: your name, how to reach you, where the business trades, what it does and what you wrote in the message box. For buyer matching, the buying criteria you gave me, which is sector, region, budget and the shape of business you are after. For the identity check, the text of any company or trust documents you give me.
The kinds of decisions they assist with. Which enquiry I look at first and how urgent it appears to be. Whether an enquiry reads as a seller or a buyer. Which listings are put in front of a registered buyer, and in what order. Whether the detail read out of a company or trust document matches what you have told me, which I then check myself against the document.
The one thing software does decide on its own. Before an enquiry reaches me at all, it has to get past an automated check that tells a person from a robot. If that check is not completed, the form is refused and nothing is recorded. This is the only point on this site where a machine turns something away without a human seeing it, and it is here because in August 2026 this site was receiving roughly 140 fake enquiries a day. If you are refused you are told so on the spot, told the likely reason, and given my phone number and my email address, because I would rather you rang me than gave up. That page is not a dead end and it is not a scored judgement about you. It is a check that either ran or did not.
What the rest never do. Once an enquiry is through that door, nothing else decides anything on its own. The chat assistant forms a view; the matching puts listings in an order. I decide who I call, who is qualified, what gets released and to whom. An enquiry may be marked as likely automated, which changes the order I read things in and holds back the automatic acknowledgement, but it is still recorded and I still read it myself. Nothing about you is scored for creditworthiness or used to price anything.
I hold this position deliberately, because a judgement made by software about a person, that nobody can explain afterwards, is not something I want in this business. From 10 December 2026 the Privacy Act requires this to be spelled out in a policy like this one. It is spelled out now.
Seeing it, and correcting it
You can ask me for a copy of the personal information I hold about you, and you can ask me to correct it if it is wrong. Email tony@tonypope.com.au or ring 1300 173 183.
I will respond within 30 days. There is no charge. If I refuse, which would be unusual, I will tell you in writing why, and how to complain about that decision.
If you are not happy
Tell me first. Email tony@tonypope.com.au with "Privacy complaint" in the subject line, or write to me at PO Box 4440, Gumdale, Queensland 4154. I will acknowledge it within five business days and give you an answer within 30 days.
If that does not resolve it, you can take the complaint to the Office of the Australian Information Commissioner. It is free.
- Online: oaic.gov.au/privacy/privacy-complaints
- Phone: 1300 363 992
- Post: GPO Box 5288, Sydney NSW 2001
You do not have to come to me first, but the Commissioner will usually ask whether you have.
A data breach
If personal information I hold is lost or disclosed without authority, and it is likely to cause you serious harm, the Notifiable Data Breaches scheme requires me to tell you and to tell the Commissioner. I will do that as soon as I reasonably can, and I will tell you what was involved and what to do about it.
Changes
If this policy changes, the new version replaces this one on this page and the date at the top changes with it. Material changes will be flagged in the first paragraph rather than buried. Old versions are kept and available on request.
Questions about any of this
Ring me. 1300 173 183, or 0431 124 128, or tony@tonypope.com.au. You will get me, not a privacy team, because there is not one.