Privacy Policy
How we collect, hold, use and disclose personal information — published under Australian Privacy Principle 1
This document forms part of a single, consistent suite together with our Privacy Policy, Privacy Collection Notice, Terms of Use and AI Use Policy, all published at www.johnnychal.legal
Johnny Chal Legal (ABN 62 414 471 860, "we", "us", "our", "the firm") is a legal practice based in Sydney, NSW, providing advice in privacy, artificial intelligence and technology law. This Privacy Policy explains how we handle personal information across our practice, including through our website at www.johnnychal.legal, in the course of providing legal services, and in our general business operations.
We are committed to handling personal information in accordance with the Australian Privacy Principles (APPs) set out in the Privacy Act 1988 (Cth), and to the standards of confidentiality required of Australian legal practitioners. As a sole practice, we may fall within the Privacy Act's small business exemption in some respects; nonetheless, we handle personal information in accordance with the APPs as a matter of professional obligation and good practice.
1. Who we are
Johnny Chal Legal is a sole practice specialising in privacy, artificial intelligence and technology law, principally conducted by Johnny Chal, a solicitor admitted in New South Wales and New Zealand. Liability limited by a scheme approved under Professional Standards Legislation.
2. The personal information we collect
The kinds of personal information we collect, and hold depend on the nature of our dealings with you. This may include:
— Identity and contact information: name, title, postal and email address, telephone number, and, where relevant, date of birth or identity document details for verification purposes
— Information relevant to a legal matter, including financial, commercial, employment, health or other sensitive information where it is relevant to the advice or representation sought
— Information about other parties, witnesses, opposing counsel, or third parties connected with a matter
— Records of correspondence, instructions, telephone or video call notes, and billing information
— Website usage information, such as pages visited, time on site, referring pages, browser and device type, and general location data inferred from IP address
— Information you provide when making an enquiry, subscribing to updates, or requesting to attend a firm event
We do not knowingly collect personal information from children, and our services are directed at adults.
3. How we collect personal information
We generally collect personal information directly from you. We may also collect it from other sources where it is not reasonably practicable or appropriate to collect it directly from you, including other parties to a matter, courts, tribunals and regulators, publicly available sources, other professional advisers, and our website.
4. Why we collect, hold, use and disclose personal information
— Providing legal advice and representation, and administering the retainer between us
— Complying with our professional, regulatory and legal obligations, including under the Legal Profession Uniform Law and, where applicable, the AML/CTF Act 2006 (Cth)
— Managing conflicts of interest, billing, trust accounting and file administration
— Operating and improving our website
— Communicating with you about matters you have raised with us, and, where you have opted in, sending updates, legal commentary, or event invitations
— Practice administration generally, including through cloud-based systems
5. Direct marketing
We will only send you direct marketing communications if you have subscribed or otherwise consented, or where the law permits. Every such communication includes a simple opt-out, actioned promptly. We do not sell, rent or trade personal information to third parties for their own marketing purposes.
6. Disclosure of personal information
— Counsel, expert witnesses and other professional advisers engaged on your matter
— Courts, tribunals, regulators and opposing parties, as required or authorised by law
— Our professional indemnity insurer (Lawcover) and other insurers, where relevant
— Our service providers, including cloud hosting, practice management, accounting and IT providers (currently including Microsoft 365)
— Other parties as required or authorised by law, or with your consent
We do not sell personal information.
7. Overseas disclosure
Some cloud-based platforms we use, including Microsoft 365, may store or process personal information on servers located outside Australia. We take reasonable steps to satisfy ourselves as to a provider's security and privacy practices before use and will update this policy if our overseas disclosure practices change.
8. Our use of artificial intelligence
We use artificial intelligence tools in limited, considered ways to support our practice, including AI-assisted meeting transcription and note-taking. Any AI-assisted output is reviewed by a solicitor before it is relied upon or communicated, and we do not use AI to make autonomous decisions about a client's matter.
The detail of the tools we use, what we do and don't do with them, and the safeguards we apply, is set out in full in our separate AI Use Policy, which forms part of this suite and should be read alongside this Privacy Policy.
9. Cookies and website analytics
Our website may use cookies and analytics tools to understand how visitors use the site and to improve its content. Most browsers allow you to control or disable cookies through their settings. Our website does not use cookies for third-party behavioural advertising.
10. Sensitive Information
Where a matter involves sensitive information, we collect and handle it only where reasonably necessary, with your consent implied by your instructions, or as otherwise permitted by law.
11. Data quality and security
We take reasonable steps to ensure personal information is accurate, complete and up to date, and to protect it from misuse, interference, loss, and unauthorised access, modification or disclosure, through access controls, secure cloud storage, and staff practices consistent with our confidentiality obligations.
12. Retention
We retain client file information for a minimum of seven years after completion of a matter, after which it is securely destroyed or de-identified unless a longer period is required by law. Information collected through general website enquiries that do not proceed to a retainer is kept only as long as reasonably necessary.
13. Access and correction
You may request access to, or correction of, personal information we hold about you using the details below. We will respond within a reasonable period, and there is no charge for making a request, though we may charge a reasonable fee for giving access.
14. Complaints
If you have a concern about how we have handled your personal information, please contact us first so we can investigate. If unresolved, you may complain to the Office of the Australian Information Commissioner (www.oaic.gov.au, 1300 363 992).
15. Changes to this policy
We may update this Privacy Policy from time to time. The current version is always available on our website.
16. Contact us
Johnny Chal Legal
ABN 62 414 471 860 · Sydney, NSW
Johnny Chal Legal: hello@johnnychal.legal
Privacy matters: privacy@johnnychal.legal
Website: www.johnnychal.legal
Address: Level 1, 63-73 Ann Street, Surry Hills, NSW 2010
Last updated: 6 August 2026.