CD Portfolio Pty Ltd ("we", "us", "our") is a privately held family investment office. This Privacy Policy explains how we collect, hold, use, disclose and protect personal information, and how you can access or correct what we hold about you.
We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) contained in Schedule 1 to that Act. Where this policy refers to a principle — for example APP 11 (security) or APP 12 (access) — it is a reference to that principle.
We hold very little personal information, and we intend to keep it that way. That is a deliberate position rather than a marketing statement: the less data an organisation holds, the less there is to misuse, lose or be compelled to disclose.
This policy applies to visitors to this website, to individuals who contact the office by email or in writing, and to professional counterparties, advisers and service providers with whom we correspond.
It does not apply to information about the family whose capital we manage insofar as that information is used for purely personal, family or household purposes. Nor does it replace the confidentiality arrangements that govern any transaction or mandate we may enter into — where a separate deed of confidentiality or non-disclosure agreement applies, that agreement governs and this policy sits alongside it.
We collect only what we need in order to answer you and to keep proper records. In practice that means:
We do not operate a client portal, we do not require accounts, and we do not ask you to register in order to read anything on this site.
We do not knowingly collect sensitive information within the meaning of the Privacy Act — that is, information about health, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, sexual orientation or criminal record. If you send such information to us unprompted, we will handle it only for the purpose it was sent and will destroy it once that purpose is exhausted, unless we are required by law to retain it.
We do not collect financial account details, tax file numbers or government identifiers through this website. We do not buy, rent, licence or enrich personal information from data brokers, and we do not attempt to identify anonymous visitors.
The personal information held is collected directly from you, because you wrote to the office or asked to receive something.
We do not scrape social media, we do not append third-party data to your contact details, and we do not use this website to build profiles of visitors. Technical information described above is collected automatically by our hosting provider in the ordinary course of serving pages; we treat it as operational data rather than as a marketing asset.
If we ever receive personal information we did not solicit and could not lawfully have collected, we will determine whether we could have collected it under APP 3 and, if not, destroy or de-identify it as soon as practicable.
We use personal information for the following purposes and no others:
We do not use your personal information for direct marketing, we do not sell it, and we do not disclose it to anyone for their own marketing. Under APP 7 we would not use or disclose personal information for direct marketing without your consent, and we do not seek that consent because we do not market to individuals.
We disclose personal information only where it is necessary to do so, and only to the extent required. The persons to whom we may disclose it are:
We do not disclose personal information to unrelated third parties for commercial gain, and we do not participate in data-sharing arrangements.
Some of the service providers we use may store or process data outside Australia, and in that case the recipient may be located in a country other than Australia. Before disclosing personal information to an overseas recipient we take such steps as are reasonable in the circumstances under APP 8 to ensure the recipient handles it consistently with the APPs — ordinarily by contractual commitment and by selecting providers with published, auditable security practices.
If you would like to know whether a particular disclosure involves an overseas recipient, ask us and we will tell you which country or countries are involved.
We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure, as required by APP 11. Those steps include:
No system is perfectly secure and we do not claim otherwise. What we can say is that the volume of personal information we hold is small, that it is held in few places, and that we would rather delete it than store it "just in case".
We retain personal information only while it remains relevant to the purpose for which it was collected, and while we have a legal or administrative reason to keep it. Enquiry correspondence is retained while the matter remains live and for a period afterwards sufficient to record what was discussed. Subscription details are retained until you unsubscribe.
When information is no longer required, and we are not required by law to keep it, we destroy it or de-identify it — as APP 11.2 requires. If you ask us to delete your information earlier, we will do so unless a legal obligation, or the need to establish or defend a legal claim, prevents us. If any part of a deletion request cannot be met, we will tell you which part and why.
If a data breach occurs that is likely to result in serious harm to any individual whose personal information is involved, we are required to notify affected individuals and the Office of the Australian Information Commissioner under the Notifiable Data Breaches (NDB) scheme in Part IIIC of the Privacy Act.
If we suspect a breach we will act quickly: contain it, assess it, and where the threshold is met notify those affected as soon as practicable — including what happened, what information was involved, and what you should do in response.
You may ask us for access to the personal information we hold about you, and we will respond to a request in accordance with APP 12. Ordinarily we will:
We may refuse access in the limited circumstances permitted by law — for example where access would unreasonably affect the privacy of another person, or would reveal commercially sensitive information. If we refuse a request, we will give written reasons and tell you how to complain.
If any information we hold about you is inaccurate, out of date, incomplete, irrelevant or misleading, tell us and we will correct it. Where we have disclosed that information to others and a correction is necessary, we will take reasonable steps to notify them.
If we disagree that a correction is required, we will give reasons in writing, note your disagreement on the record, and explain how you may escalate the matter.
Where it is lawful and practicable, you may deal with us anonymously or under a pseudonym — for example, by browsing this site, or by asking a general question that does not require us to know who you are. If a matter genuinely requires identification — responding to a formal access request, for instance — we will explain why.
If you believe we have handled your personal information in a way that breaches the APPs, please write to us first. We will acknowledge your complaint promptly and respond substantively, normally within 30 days, setting out what we found and what we propose to do about it.
If you are not satisfied with our response, you may refer the matter to the Office of the Australian Information Commissioner (OAIC), which can investigate privacy complaints. Contact details for the OAIC are published on its website at oaic.gov.au. You do not need to complain to us first, but in our experience most matters are resolved faster that way.
We may update this policy from time to time. When we do, we will change the "last updated" date below and, where a change is material, say so on this page rather than relying on you to notice. Continuing to use this site after a change takes effect indicates acceptance of the updated policy.
For access requests, corrections, deletion requests, complaints or any question about this policy:
Email: info@cdportfolio.com.au
Website: cdportfolio.com.au
Address: Level 3 / 685 Burke Road, Camberwell VIC 3124, Australia
Written requests are read by the office directly. We do not operate a call centre and we do not outsource privacy administration.
Last updated: 18 October 2026
Plain-language answers to the questions we receive about what the office holds, why, and how to have it corrected or removed.
Only what is necessary: the details you provide through an enquiry or subscription form — name, email address, organisation and the content of your message — together with standard technical information such as IP address and browser type collected by our hosting provider.
We do not collect sensitive information, and we do not buy or enrich data from third parties.
To respond to your enquiry, to send notes you have asked for, and to meet record-keeping obligations under Australian law.
Enquiry correspondence is retained only while it remains relevant to the matter, and subscription details are retained until you unsubscribe. You may request deletion at any time.
It is not sold, rented or traded. It is disclosed only to service providers that operate our website, email and administration, and only to the extent required for them to perform that function — or where disclosure is required by law.
Those providers are contractually bound to handle the data in line with this policy.
Through access controls, encryption in transit, and limiting internal access to the people who need it to respond to you.
No system is perfectly secure and we do not claim otherwise. What we do is keep the amount of data held to a minimum, which remains the most reliable control available.
Email info@cdportfolio.com.au with your request. We will confirm what we hold, correct anything inaccurate, and delete records we are not required to retain.
Requests are handled within a reasonable period, and we will tell you if any part of a request cannot be met and why.
No. We do not ask for, and do not wish to receive, information about health, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, sexual orientation or criminal record.
If such information is sent to us unprompted, we will use it only for the purpose it was sent for and destroy it once that purpose is exhausted, unless we are required by law to retain it.
Ask us to review it. We will reconsider and respond, normally within 30 days, with the reasons for our position.
If the outcome still does not satisfy you, you may refer the matter to the Office of the Australian Information Commissioner. You are not required to come to us first, but most matters are resolved faster that way.
This page is a summary. It sits alongside, and does not replace, the full Privacy Policy above.