Privacy Policy.

GST Register is operated by Australian Registration and Lodgement Services Pty Ltd, ABN 53 630 861 219, a registered BAS agent, number 25972850. This policy explains what we collect, why, who else handles it, where it goes, and what you can ask us to do about it.

We handle personal information in accordance with the Australian Privacy Principles in the Privacy Act 1988. As a registered BAS agent we are also bound by the Code of Professional Conduct in the Tax Agent Services Act 2009, which requires us to keep your affairs confidential.

Current as at 12 November 2026.

What we collect.

When you order a registration or a cancellation.

Your name, your date of birth, email address, mobile number, your ABN, your registered entity name, and the details the ATO needs for the lodgement you have asked us to make. Depending on the service that includes your GST turnover band, whether you account for GST on a cash or an invoice basis, your reporting cycle, your main industry, the date you want the registration to start or the cancellation to take effect, whether you import goods, and for PAYG withholding your expected number of employees, your withholding estimate and whether you employ anyone on a working holiday visa.

Why we need your date of birth. The ATO uses it to match you to your ABN, which is how a registered agent is able to act for you. Without it we cannot access your account to lodge what you have asked for. It is not used for anything else, and it is not the same thing as the date of birth Stripe reads from your identity document, which we never receive: see the identity verification section below.

We do not ask for your tax file number.

Nothing on this site asks for a TFN, and we do not hold one for you. We say so plainly because it is a reasonable thing to check before typing your details into any site that lodges with the ATO.

If you start a form and do not finish it.

Our order forms, for a GST registration, a rideshare registration and a GST cancellation, save your answers as you go once you have given us an email address. That save happens on our servers, and on the registration form in your own browser as well, so you can come back to it. It means we may hold your name, email address, phone number, ABN, date of birth, the answers you had entered and how your visit reached us, even if you never submitted the form or paid anything.

If you start an order and do not finish it, one of our team may phone or email you to see whether we can help you complete it. That includes an order you submitted but did not pay for. We do this ourselves; your details are not passed to anyone else to contact you. Once your payment goes through, you are no longer on that list. We delete an unfinished form 30 days after it was last changed.

If you would rather we did not contact you, or would rather we did not keep what you entered, email info@gstregister.com.au and we will delete it. An unfinished form is not a record we are required to keep, so there is nothing stopping us.

If you use the BAS workspace.

Your name, email address, and a scrambled version of your password. We store passwords using scrypt with a unique salt for each account, which means we hold something derived from your password and never the password itself, and we cannot read it or recover it for you. We also store the BAS figures you choose to save: your period totals and the line descriptions and wage records you enter.

If you subscribe to BAS reminders.

Your email address, your BAS cycle, and your mobile number if you give us one for text reminders.

If you look up an ABN or a GST status.

The ABN or business name you search for is sent to the Australian Business Register to get the answer. We do not keep a record of your searches against you.

When you pay.

Your payment goes to Stripe on Stripe's own checkout page. We never see, handle or store your card number. What comes back to us is that the payment succeeded, the amount, and the type of card.

When you verify your identity.

This one is different enough to have its own section below.

Automatically, when you visit.

Your IP address, your browser and device type, the pages you look at, and how you arrived. See "What we measure, and what we do not" below for exactly what that involves and who receives it.

Why we use it.

• To prepare and lodge your GST registration, rideshare registration, PAYG withholding registration or cancellation with the Australian Taxation Office, which is the service you have engaged us for.
• To confirm your identity before we lodge, which we are required to do.
• To raise your tax invoice and take payment.
• To contact you about your order by email, phone or text message, and to answer your questions about it, including an order you started and did not finish.
• To send BAS reminders and run the BAS workspace, if you have asked for those.
• To keep the records the law requires a registered BAS agent to keep.
• To understand how the site is used, so we can improve it.

We do not sell your information, and we do not provide it to anyone for their own marketing. We may send you information about our own services; every such message has an unsubscribe link, and unsubscribing does not affect anything to do with an order.

Verifying your identity.

Before we lodge on your behalf we have to confirm who you are. The Tax Practitioners Board requires every registered tax practitioner to take proof of identity steps before providing a service, and that applies to a registered BAS agent in the same terms as to a tax agent: there is one Code of Professional Conduct, and section 30-5 of the Tax Agent Services Act 2009 applies it to both. We are Registered BAS Agent 25972850.

We do this using Stripe Identity. You are asked to photograph a government-issued identity document, such as a driver licence or passport, and to take a selfie so the photograph on the document can be matched to you. That match is done by automated biometric comparison.

Your document and your selfie go to Stripe, not to us. You submit them directly to Stripe. On that path we never receive the images, the biometric data, or the details Stripe reads off your document such as your date of birth or document number. Our access to Stripe is deliberately restricted so that we cannot read them even if we wanted to. What we receive is whether the check succeeded, and when.

A photograph used for automated biometric matching, and the biometric template derived from it, are sensitive information under section 6(1) of the Privacy Act 1988. Sensitive information may only be collected with your consent, so verification is something you choose to start. Nothing is collected unless you begin the check yourself, and you can instead call us on 1800 546 526 to arrange another way to confirm your identity.

If Stripe Identity will not work for you, there is a fallback, and on it we do receive your document. Some documents are not accepted, some cameras will not open, and for some people the photograph match fails over and over. Rather than leave you with no way through, the verification page links to a secure upload page where you can send us photographs of your identity document instead. Nothing on that path collects a selfie or a biometric template. It is your choice, it is never the default, and nothing is sent to us unless you choose it.

Documents uploaded that way travel over an encrypted connection into private storage in Australia, readable only by the people in our practice who run identity checks. They are not attached to an email. We use them for one thing: confirming who you are so your application can be lodged, which includes submitting your document to Stripe to run the same check the automatic path runs, in the United States. Once your identity has been confirmed we delete the images. If a verification is never completed, they are deleted within 30 days of the upload regardless. What we keep after that is our record of the check: that it happened, and when. If you would rather not upload a document at all, call us on 1800 546 526 and we will arrange another way.

If your identity is not confirmed, we cannot lodge. Your order and your payment are unaffected, and you can ask us to refund a service we have not lodged.

Stripe handles this information in the United States, and holds the images and the biometric data under its own arrangements rather than ours. Our own record is that the check happened and its date, and we keep that with the rest of your file.

The BAS workspace, and your bank statement.

The workspace lets you upload a bank statement CSV so it can suggest which lines are income and which are expenses. That file is read entirely inside your own browser. It is never uploaded, never transmitted to us, and never stored anywhere. The coding rules run on your device. What reaches us is only the figures you confirm and choose to save, and if you never press save, nothing reaches us at all.

We do not store receipts or source documents. Keeping those is your obligation to the ATO, not something we take over.

You can ask us to delete your workspace account and everything saved in it at any time, through the contact page or on 1800 546 526. A workspace account is not a lodgement record, so nothing stops us deleting it.

What we measure, and what we do not.

Cookies. Our own code sets no cookies. Four services we use do, and each is described below: our measurement script sets one, called ro_attr, which lasts 90 days; Google Analytics and Google Ads set their own, to tell visits and advertising clicks apart; Hotjar sets its own, to tell one visit from the next; and the chat window sets one, called chatbase_anon_id, so a conversation can carry on as you move between pages. You can refuse or delete cookies in your browser settings, and the site still works without them. Separately, three things are saved in your own browser using local storage: your progress through the registration form, so you do not lose it, your BAS workspace login, so you are not asked to sign in on every visit, and a short note of how your visit arrived, described below. All three stay on your device, and clearing your browser data removes them.

How you arrived, when you order. To learn which of our pages, searches and advertising lead to orders, your browser keeps a short note of how your visit arrived: the page you first landed on, the site or search engine that sent you (without any search terms), and any advertising or campaign code in that link. The note is stored only on your device, for up to 30 days, and reaches us only if you submit an order, when it is saved with your order. It never contains anything you type.

Our measurement script. Every page except the two identity verification pages and the BAS calculator loads a small script from registrationoffice.com.au. It is operated by Australian Registration Office Pty Ltd, the company behind our sister sites ABN Assist and CGT Clearance, rather than by an outside analytics company. It records the shape of a visit rather than its content: pages viewed, which links and buttons are clicked, when a form is started and submitted, how far you get through a form that has several steps, whether you reached the form by clicking a link on another page of this site or arrived at it directly, how far you scroll, how long you stay, any errors the page hits, and whether you are on a phone, tablet or desktop. It gives each visit a random identifier that lasts only until you close the tab. It also sets the ro_attr cookie, which holds a random token for 90 days, and with it records any advertising click identifier or campaign code in the link you arrived from, so that an order can be matched to the advertising that led to it. It does not record what you type, the contents of any field, or your name, contact details or payment details.

Three pages deliberately do not load it. The two identity verification pages, the one where you verify and the one where you can upload your document instead, because their addresses contain your order reference, and the first a payment identifier as well, and we would rather those were not sent anywhere they do not need to go. And the BAS calculator, because that page holds your turnover, your wages, any employee names you enter and every line of your bank statement, all of it in the page itself. A script loaded from anywhere else has access to what is on the page, and we promise on that page that your statement never leaves your browser. Leaving the script off is how that promise stays true rather than depending on what the script chooses to read.

Google Analytics and Google Ads. We use Google Analytics 4 to understand how people find and use the site, and Google Ads to measure which of our advertising leads to an order. Both set cookies. Google Analytics records pages viewed, clicks, how you arrived (including the search or advertisement you came from), your approximate location from your IP address, and your device and browser. On our order forms it also records how far through a form you get (the step you reached, never what you entered in it) and whether you reached the form by clicking a link on another page or arrived on it directly. When an order is paid, we send Google the order number, the amount and the services bought, so we can tell which advertising works. We do not send Google your name, email address, phone number, date of birth, ABN or card details. You can opt out of Google Analytics on every site that uses it with Google's browser add-on at tools.google.com/dlpage/gaoptout, and you can control advertising personalisation at myadcenter.google.com.

Hotjar. We use Hotjar to understand how people move through our forms, so we can find the steps where they get stuck. Hotjar records pages viewed, clicks, scrolling, and how far through a form someone gets. It is configured so that what you type is not recorded, and so that the parts of a page that display your own details back to you are blocked before anything is sent. That includes your name, email address, phone number, date of birth, the result of any ABN lookup, and your order confirmation. Your card details are never captured. You can opt out of Hotjar across every site that uses it at hotjar.com/opt-out.

Chat. The chat window in the corner of most pages is run by Chatbase. What you type into it, and the replies, are sent to Chatbase and to the AI service it uses to write those replies, and the conversation is kept so our team can read it and improve the answers. Please do not type your tax file number, date of birth, card details or anything else you would not put in an email. For anything about your own order, call us on 1800 546 526 or email info@gstregister.com.au. Chatbase holds conversations on our behalf and deletes them when we ask. You do not need to use the chat to place an order.

The same three pages that do not load our measurement script do not load Google Analytics, Google Ads, Hotjar or the chat window either.

Fonts. Our body typeface is served from this site's own hosting. Our heading typeface is licensed through Adobe Fonts and is served by Adobe, which means your IP address reaches Adobe when a page loads. Adobe is told which site you are on and nothing else: not which page, not what is in the address bar. We cannot host that typeface ourselves, because its licence does not allow it.

Who else handles your information.

We use a small number of providers to run this site and deliver your lodgement. Each receives only what it needs, and none is permitted to use your information for anything other than the service it provides to us.

• Stripe processes payments and runs the identity verification described above. We name Stripe because everything we have told you about how that verification is protected depends on who does it.
• Australian Registration Office Pty Ltd operates the measurement script described above. It is a separate company from ours, which is why it is named here rather than treated as part of us.
• Google provides the website analytics and advertising measurement described above, through Google Analytics and Google Ads. We name Google so you can use the opt-out links in that paragraph, which only work if you know who to opt out of.
• Hotjar provides the session recording described above, named for the same reason.
• Chatbase runs the chat window described above, and the AI service it uses to write replies receives what you type into it. Named so you know who holds a conversation you start.
• Adobe serves our heading typeface, and so receives your IP address on every page load. See the fonts paragraph above.
• An order database provider stores your order and your workspace so we can lodge, and answer questions about it later.
• An email delivery provider sends your tax invoice, your order confirmation and your BAS reminders.
• A text message provider sends BAS reminders, if you asked for those.
• A customer messaging platform holds your contact details and order status so we can keep you updated.
• A website hosting provider serves this site.
• A business email provider carries the email our team works from.
• The Australian Taxation Office receives your lodgement, and the Australian Business Register answers ABN lookups. Both are Australian government bodies, and this is the purpose you gave us your information for.

Several are described by what they do rather than by name, because suppliers change and a policy naming last year's is worse than one that does not. If you want to know exactly who holds your information, or which country a particular provider holds it in, email us and we will tell you.

Information sent overseas.

Some of those providers operate outside Australia, so some of your personal information is handled overseas. As best we can set it out:

• Your order and your BAS workspace are stored in Australia, and so is any identity document you upload to us yourself.
• Payments and identity verification are handled by Stripe in the United States, including your identity document and the biometric match.
• This website is hosted in the United States, and so is the measurement script's collection point.
• The platform we use to keep you updated about your order operates in the United States, as does the service that sends text message reminders.
• Google Analytics and Google Ads data are handled in the United States. Google also operates data centres in other countries and may process it in more than one of them.
• Session recording by Hotjar is held in Ireland, in the European Union.
• Chat conversations are handled by Chatbase in the United States, and by the AI services it uses to write replies, which may process them in other countries.
• Adobe receives your IP address for the heading typeface, and handles it in the United States and in other countries where it operates.
• Your tax invoice, your order emails and your BAS reminders are sent from Japan.
• The Australian Taxation Office, the Australian Business Register, our own team, and the email system our team works from are all in Australia.

Providers may use their own suppliers, some of whom are in other countries again.

Before using an overseas provider we take reasonable steps to satisfy ourselves that it handles personal information to a standard comparable to the Australian Privacy Principles, which is what Australian Privacy Principle 8 requires. If you would like to know which country a particular provider holds your information in, email info@gstregister.com.au and we will tell you.

How long we keep it.

We keep the records of a lodgement we have made for you for at least five years after the service was provided. That is not our choice: section 30 of the Tax Agent Services (Code of Professional Conduct) Determination 2024 requires a registered practitioner to keep records showing the nature, scope and outcome of every service, and to retain them for at least five years.

This is also the answer to why we cannot always delete everything on request. We can delete a workspace account, an unfinished form, a reminder subscription and your marketing preferences whenever you ask. We cannot delete the record of a lodgement inside that five years, because we are required to hold it.

Once we no longer need information and are not required to keep it, we destroy it or de-identify it.

Getting at your information, and correcting it.

You can ask us what we hold about you, ask for a copy, and ask us to correct anything that is wrong. Email info@gstregister.com.au or call 1800 546 526. We will ask you to confirm who you are first, for obvious reasons, and we will respond within 30 days.

There is no charge for asking, and no charge for a correction.

If you are not happy with how we have handled your information.

Tell us first, and we will try to sort it out.

1. Email info@gstregister.com.au with "Privacy complaint" in the subject line, or write to us. Set out what happened and what you would like done about it.
2. We will acknowledge it within 5 business days and give you an answer in writing within 30 days. If it is going to take longer than that we will tell you why and when to expect an answer.
3. If our answer does not satisfy you, you can take it to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

If your complaint is about our conduct as a registered BAS agent rather than about privacy, it can also go to the Tax Practitioners Board.

Keeping it safe.

We take reasonable steps to protect your information from misuse, loss, and unauthorised access or disclosure. In practice that means traffic to and from this site is encrypted, access to order records is restricted to the people who lodge them and to management, passwords are stored scrambled and cannot be read by us, and card numbers never reach us at all.

If something goes wrong and there is a data breach likely to cause you serious harm, we will tell you and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.

Payment security.

Card details are entered on Stripe's own checkout page and go straight to Stripe, so GST Register never sees, handles or stores a complete card number. Stripe is certified to PCI Service Provider Level 1, the most stringent certification available in the payments industry. For more about how Stripe handles payment data, see stripe.com/au/privacy.

Other things worth saying.

Links to other sites.

This site links to other websites, including the ATO and the Tax Practitioners Board. We are not responsible for how they handle your information, and their own policies apply once you leave here.

When the law requires it.

We may disclose information where we are required or authorised to by law, including to a court or in response to a lawful request from a government agency.

Changes to this policy.

If we change this policy we will update the page and change the date at the top. Where a change materially affects how we handle information we already hold, we will tell you rather than relying on you noticing.

Sources.

The obligations described on this page come from the Privacy Act 1988 and the Australian Privacy Principles in Schedule 1 to it, the OAIC's Australian Privacy Principles guidelines, the Tax Agent Services Act 2009, and the Tax Agent Services (Code of Professional Conduct) Determination 2024.