Privacy Policy

1. About this Privacy Policy

Amplify Story House (“Amplify”, “we”, “us” or “our”) respects the privacy of the individuals and organisations we work with and is committed to handling personal information responsibly, securely and transparently.

This Privacy Policy explains how we collect, hold, use, disclose and protect personal information in connection with:

• our website;
• enquiries, proposals and client onboarding;
• client portals and file-upload facilities;
• podcast, audio, video and photography production;
• interviews and events;
• animation and digital content;
• social media, marketing and publishing services;
• artificial intelligence-assisted workflows;
• suppliers, contractors and partners; and
• our other business activities.

This Policy is intended to reflect the Privacy Act 1988 (Cth) and the Australian Privacy Principles (“APPs”) where they apply to Amplify.

We also seek to use these principles as a baseline for responsible privacy management where a particular obligation may not strictly apply.

This Policy should be read together with any applicable collection notice, participant release, consent form, client agreement, service agreement or project-specific notice.

2. Who We Are

Amplify Story House is an Australian podcast, video, digital content and creative production business.

Our services may include:

• podcast strategy and production;
• audio recording and editing;
• video production and photography;
• interviews and event coverage;
• animation and motion graphics;
• social media content and management;
• digital strategy;
• content planning and publishing;
• content repurposing;
• AI-assisted creative production;
• music and audio production; and
• related creative and consulting services.

Because our work can involve identifiable voices, images, recordings and personal stories, our privacy responsibilities extend beyond information collected through our website.

3. Personal Information We May Collect

Personal information generally means information or an opinion about an identified individual or an individual who is reasonably identifiable.

Depending on how someone interacts with Amplify, we may collect the following.

Contact and business information

This may include:

• name;
• organisation;
• role or position;
• email address;
• telephone number;
• business or postal address;
• social media details; and
• communication preferences.

Enquiry and client information

This may include:

• enquiries and project briefs;
• budgets and timelines;
• meeting notes;
• proposals and contracts;
• production schedules;
• approvals and feedback;
• correspondence;
• account permissions;
• client-supplied content;
• social media information;
• campaign information; and
• analytics.

Production information

Our work may involve podcast hosts, guests, interviewees, employees, customers, students, teachers, club members, athletes, community members and other participants.

We may collect:

• name;
• image and likeness;
• voice;
• photographs;
• video and audio recordings;
• interview responses;
• opinions and statements;
• biography or professional history;
• organisation and role;
• personal stories voluntarily shared;
• transcripts and captions;
• production notes; and
• associated metadata.

Audio recordings, video footage, photographs and other media containing an identifiable individual’s voice, image, likeness or statements may constitute personal information, and we treat that material accordingly.

Account and billing information

Where relevant, we may collect:

• client portal account information;
• authentication and access records;
• billing contacts;
• ABNs;
• invoice information;
• payment status; and
• transaction references.

Full payment card or banking credentials may be collected directly by a third-party payment provider rather than Amplify.

Website and technical information

We or our service providers may collect:

• IP address;
• browser and device information;
• operating system;
• approximate location derived from technical information;
• referring source;
• pages viewed;
• links clicked;
• access date and time;
• session information;
• campaign or UTM information;
• cookie identifiers;
• analytics identifiers; and
• security or diagnostic information.

Recruitment, supplier and contractor information

We may also collect professional information relating to applicants, freelancers, contractors, suppliers, production crew, venues, studios, consultants and business partners.

4. Sensitive Information

Certain categories of personal information receive additional protection under privacy law and may include information relating to:

• health;
• racial or ethnic origin;
• political or religious beliefs;
• sexual orientation;
• criminal records;
• trade union or professional association membership; and
• certain biometric information.

Amplify does not generally seek to collect sensitive information unless it is reasonably necessary for a legitimate activity, voluntarily provided in connection with a production, collected with appropriate consent where required, or otherwise permitted by law.

Podcast and interview participants may voluntarily discuss sensitive matters.

Participants should avoid disclosing sensitive information about another person unless they have an appropriate basis to do so.

5. How We Collect Personal Information

We may collect personal information:

• directly from an individual;
• through our website or forms;
• through meetings, calls or correspondence;
• during recordings, interviews, photography or events;
• through client portals and file uploads;
• from our clients;
• from production participants or collaborators;
• from third-party service providers;
• from publicly available professional or business sources; and
• automatically through cookies, analytics, server logs and similar technologies.

Where a client provides us with personal information relating to another individual, the client should only do so where it has an appropriate basis or authority.

6. Data Minimisation and Unsolicited Information

We seek to collect only information reasonably necessary for the relevant activity.

We aim to avoid unnecessary collection of:

• sensitive information;
• identification documents;
• passwords;
• financial credentials;
• information about children; and
• confidential third-party information.

Where we receive personal information that we did not request and it is unnecessary or inappropriate for us to retain, we may take reasonable steps to delete, destroy or de-identify it where permitted and practicable.

7. Why We Use Personal Information

We may collect, hold, use or disclose personal information to:

• respond to enquiries;
• prepare proposals and quotations;
• enter into and administer agreements;
• plan and deliver productions;
• communicate with clients and participants;
• record, edit and produce audio, video and photography;
• create transcripts, captions, graphics and animations;
• publish and distribute authorised content;
• manage podcasts, websites and social media;
• provide digital strategy and marketing services;
• administer client portals and accounts;
• transfer and store project files;
• process invoices and payments;
• provide customer support;
• manage suppliers and contractors;
• maintain security;
• prevent fraud or unauthorised access;
• analyse website and marketing performance;
• improve our services;
• maintain business and legal records;
• manage complaints and disputes;
• comply with legal obligations; and
• establish, exercise or defend legal rights.

We may also use appropriately de-identified or aggregated information for analytics, planning and service improvement.

We generally use personal information for the purpose for which it was collected, or for a related purpose that would reasonably be expected. Other uses may occur where consent has been given or where authorised or required by law.

8. Client-Supplied Information and Client Responsibilities

A significant part of Amplify’s work is performed on behalf of organisations.

Clients may provide us with personal information relating to employees, customers, members, students, parents, participants, guests or other stakeholders.

Unless otherwise expressly agreed, clients are responsible for:

• ensuring they have an appropriate basis to provide information to Amplify;
• identifying required permissions and releases;
• obtaining participant, parent or guardian permissions where required;
• advising us of restrictions applying to an individual or content;
• complying with their own privacy and safeguarding obligations;
• reviewing content submitted for approval;
• identifying privacy, consent, confidentiality or factual concerns; and
• authorising final publication.

We may request evidence or confirmation of relevant permissions where appropriate.

Nothing in this section removes any privacy obligation that applies directly to Amplify.

9. Production Participants, Editorial Approval and Publication

Individuals participating in a podcast, interview, video, photography session or other production should understand that recordings may be created for publication or distribution.

Depending on the project, content may appear through:

• podcast platforms;
• websites;
• social media;
• video platforms;
• newsletters;
• advertising;
• internal communications;
• presentations;
• school or community channels; and
• other agreed media.

Participation may also be subject to a separate release or consent agreement.

Editorial approval

Where Amplify produces content for a client, the client ordinarily maintains final editorial approval unless otherwise agreed.

Clients are responsible for identifying required corrections, edits, restrictions, confidentiality issues, consent concerns or safeguarding concerns before publication.

Amplify may also recommend edits, pause publication or decline to publish material where we reasonably consider there to be a material legal, privacy, confidentiality, security or safeguarding risk.

Public and private distribution

Content may be distributed publicly, privately, through restricted-access platforms, through unlisted links or through client-controlled systems.

We will not knowingly make restricted content public without appropriate authorisation.

Content already published

Once material is publicly available, third parties may copy, download, share, archive, cache or republish it.

Amplify cannot guarantee complete removal of material from systems outside our control.

10. Use of Client Content to Promote Amplify

Producing content for a client does not automatically give Amplify unrestricted rights to use confidential or unpublished client material for our own promotion.

We will not knowingly use confidential or unpublished client material, private production recordings or identifiable participant material to:

• advertise Amplify;
• create public case studies;
• enter awards;
• publish portfolio material; or
• otherwise promote our services

unless that use is authorised under the relevant agreement, separately approved, already lawfully public and available for that purpose, or otherwise permitted by law.

Intellectual property ownership, portfolio rights, licences and ownership of raw or completed production material are governed by relevant agreements and applicable law rather than this Privacy Policy.

11. Children, Young People and Education Productions

Amplify may work with schools, sporting clubs, community organisations and other organisations involving children and young people.

We recognise that children’s privacy, safety and best interests require particular care.

Our general public website is intended primarily for organisations and adults and is not designed to encourage children to submit personal information directly to us.

Information relating to children

Where reasonably necessary for a project, we may collect a child’s:

• image;
• voice;
• first name or pseudonym;
• role;
• age or school year where relevant;
• interview responses;
• photographs;
• audio;
• video; and
• transcripts.

Data minimisation

We seek to minimise unnecessary identification of children.

Depending on the project, we may use:

• first names only;
• pseudonyms;
• roles instead of names;
• limited identifying information; or
• no identifying name.

Consent and authority

Participation may require:

• parent or guardian consent;
• agreement from the child or young person where appropriate;
• school or organisational authority;
• media consent;
• talent releases; or
• other permissions.

Where a client organises participation, the client is ordinarily responsible for obtaining required permissions unless we expressly agree to manage that process.

We may request confirmation or evidence of consent or authority.

Where appropriate, we may also consider a young person’s age, maturity and ability to understand the nature of their participation.

Publication

Content involving children will only be intentionally published publicly where authorised under the relevant project arrangements.

Content may instead be private, restricted, password-protected, unlisted, published without names or distributed through client-controlled systems.

Marketing and profiling

Amplify does not knowingly use children’s personal information for unrelated behavioural advertising, commercial profiling or direct marketing.

12. Artificial Intelligence and Automated Technologies

Amplify may use commercial artificial intelligence, machine-learning and automated tools as part of our creative and operational workflows.

These tools may assist with:

• transcription and captioning;
• audio enhancement;
• video editing;
• translation;
• summarisation;
• search and indexing;
• ideation;
• copy development;
• animation;
• image or video generation;
• workflow automation; and
• administration.

Where an AI-enabled service processes personal information, we seek to use the service appropriately and with reasonable privacy and security safeguards.

We do not intend to place confidential client information, sensitive information or identifiable private production material into unrestricted public AI services where doing so would create an unreasonable privacy or confidentiality risk.

AI model training

Amplify does not intentionally provide private client material or identifiable production content to third-party providers specifically to train general-purpose public AI models unless:

• appropriate authority exists;
• suitable contractual protections apply;
• the information has been appropriately de-identified; or
• the use is otherwise lawful and appropriate.

Synthetic likenesses

We will not knowingly create for external publication a materially deceptive voice clone, digital replica, synthetic likeness or impersonation of an identifiable person without appropriate authority or another lawful basis.

Automated decision-making

As at the date of this Policy, Amplify does not use personal information in automated systems to make decisions based substantially and directly on that information that could reasonably be expected to significantly affect an individual’s rights or interests.

If this changes, we will update this Policy and provide any disclosures required by applicable law.

13. Cookies, Analytics and Digital Tracking

Our website and digital services may use cookies, pixels, analytics tools, tags, server logs and similar technologies to:

• operate and secure our website;
• understand website traffic;
• measure engagement;
• diagnose technical issues;
• understand enquiry sources;
• measure campaign performance;
• improve website performance; and
• support authorised advertising activity.

Third-party providers may independently process information in accordance with their own privacy practices.

Where required by applicable law, we will seek appropriate consent for non-essential tracking technologies.

Users can generally manage cookies through their browser settings, although disabling them may affect website functionality.

We seek to avoid intentionally transmitting sensitive or confidential client information through advertising or analytics tools.

14. Service Communications and Direct Marketing

Amplify may send operational communications reasonably necessary to administer a project, account or service, including:

• production updates;
• approval requests;
• schedules;
• publishing notifications;
• invoices;
• account notices;
• file deliveries;
• security alerts; and
• support communications.

These communications are distinct from promotional marketing.

Where permitted by law, we may also communicate about Amplify services, projects, news or opportunities.

Marketing communications will provide a means of opting out where required.

Opting out of marketing will not prevent necessary project, transaction, account, security or service communications.

Amplify does not sell or rent personal information or mailing lists to third parties for their independent marketing purposes.

15. Who We May Share Personal Information With

Where reasonably necessary, personal information may be disclosed to:

• Amplify personnel;
• authorised contractors and freelancers;
• production crew;
• studios and venues;
• cloud and hosting providers;
• email and productivity providers;
• authentication and client portal providers;
• file-transfer and project-management services;
• audio, video, transcription and captioning providers;
• AI-enabled production services;
• podcast hosting and distribution services;
• social media platforms;
• analytics and advertising providers;
• accounting, invoicing and payment providers;
• insurers;
• lawyers, accountants and other professional advisers;
• regulators, courts, government agencies or law-enforcement authorities where legally appropriate;
• prospective purchasers or successors in connection with a legitimate business transaction; and
• other parties authorised by the relevant individual or client.

We seek to limit disclosure to information reasonably required for the relevant purpose.

16. Third-Party Service Providers

Amplify relies on third-party technology and production providers.

Where reasonably appropriate, we consider matters such as:

• the type of information involved;
• security practices;
• privacy and contractual terms;
• access controls;
• encryption;
• storage locations;
• international processing;
• subprocessors; and
• the nature and risk of the activity.

Use of a third-party provider does not mean Amplify represents that the provider is automatically compliant with Australian privacy law.

We may provide further information about significant providers involved in handling personal information, including relevant hosting or processing locations where reasonably available, upon request.

17. Overseas Processing and Disclosure

Many cloud, software, social media, publishing and AI providers operate internationally.

Personal information handled by Amplify may therefore be stored, processed, backed up or accessed outside Australia.

Depending on the providers and configurations involved, likely locations may include:

• the United States;
• Singapore;
• the United Kingdom;
• countries within the European Economic Area; and
• other jurisdictions in which our providers operate infrastructure or support services.

These locations may change as providers update their infrastructure and subprocessors.

Where applicable, Amplify seeks to take reasonable steps required under Australian privacy law in relation to overseas disclosure.

Individuals may contact us for further information about overseas processing relevant to their information.

18. Security

Amplify takes reasonable steps to protect personal information against misuse, interference, loss, unauthorised access, modification and disclosure.

Depending on the relevant information and system, measures may include:

• authentication and access controls;
• multi-factor authentication where appropriate;
• role-based or need-to-know access;
• encrypted transmission;
• cloud-provider encryption;
• secure file transfers;
• password-management practices;
• restricted sharing permissions;
• device security;
• backups;
• confidentiality obligations;
• contractor controls;
• security monitoring;
• service-provider assessment; and
• incident-response procedures.

Raw footage, audio recordings, photographs, transcripts and project files are intended to be accessible only to people who reasonably require access to perform their role.

No electronic transmission, cloud platform or storage system can be guaranteed to be completely secure.

19. Privacy Governance and Operational Controls

Amplify maintains internal privacy and data-handling procedures designed to support the commitments in this Policy.

These procedures address matters including:

• access permissions;
• data retention and deletion;
• use of artificial intelligence and third-party services;
• client file uploads;
• participant consent records;
• staff and contractor access; and
• response to suspected data breaches.

These procedures are reviewed periodically and may change as our systems, services, technology, risks and legal obligations evolve.

20. Data and Production File Retention

Amplify retains personal information only for as long as reasonably necessary for the relevant purpose, ongoing services, legitimate business requirements or legal obligations.

Retention periods may depend on:

• project status;
• contractual requirements;
• client instructions;
• anticipated revisions;
• content repurposing requirements;
• accounting, taxation and insurance requirements;
• limitation periods;
• disputes;
• security needs; and
• participant consent or release records.

Production material

Amplify and a client may agree to a project-specific retention period for raw video, audio, photographs, transcripts, project files and other production material.

Where no specific period has been agreed, we may retain files for a reasonable period for:

• revisions;
• re-exports;
• authorised content repurposing;
• ongoing production;
• client support;
• archive administration; or
• dispute management.

Amplify does not guarantee permanent archival storage of raw production material unless long-term storage has been expressly agreed.

Clients should retain copies of final deliverables and other material they are responsible for keeping.

Deletion and backups

Where information is no longer reasonably required and there is no lawful or legitimate reason to retain it, we may take reasonable steps to delete, destroy, de-identify or place it beyond use.

Deleted information may remain temporarily in secure backup systems until those backups are overwritten, rotated or retired.

21. Editing, Removal, Deletion and Withdrawal of Consent

Clients and authorised individuals may request that Amplify:

• correct information;
• edit production material;
• restrict access;
• remove material;
• delete information; or
• stop a particular future use.

We will consider requests having regard to applicable law, contractual obligations, client instructions, existing publication, technical limitations, third-party systems and legitimate record-keeping requirements.

Where we control the relevant publication channel, we may remove material or request removal where authorised and appropriate.

We cannot guarantee removal from:

• downloaded copies;
• third-party reposts;
• screenshots;
• archives;
• search-engine caches;
• podcast directories;
• syndicated feeds; or
• other systems outside our control.

Where we rely on consent, an individual may withdraw that consent for future handling.

Withdrawal does not necessarily invalidate processing that occurred lawfully before withdrawal and may affect our ability to continue providing a service or production.

22. Access and Correction

Individuals may request access to personal information Amplify holds about them or ask us to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading.

We may require reasonable verification of identity or authority before responding.

We will seek to respond within a reasonable period.

Access may be refused or limited where permitted by law, including where providing access would unreasonably affect another person’s privacy, disclose legally privileged information or fall within another applicable exception.

Where required, we will explain the reason for refusing a request.

There is generally no charge for making an access or correction request.

23. Anonymity and Pseudonyms

Where lawful and practical, individuals may interact with Amplify anonymously or using a pseudonym.

Identification will generally be necessary where required to:

• enter into a contract;
• arrange a production;
• make or receive payment;
• grant secure account access;
• verify permissions;
• manage intellectual-property or participant rights; or
• comply with legal obligations.

24. Data Breaches and Security Incidents

If we become aware of a suspected privacy or security incident, we may:

• contain and investigate the incident;
• identify affected information and individuals;
• assess potential harm;
• remediate vulnerabilities;
• secure affected systems;
• engage relevant providers or advisers; and
• assess notification obligations.

Where the Notifiable Data Breaches scheme under the Privacy Act applies, Amplify will assess suspected eligible data breaches and notify the Office of the Australian Information Commissioner (“OAIC”) and affected individuals where required by law.

Where an incident concerns information handled for a client, we may coordinate investigation, remediation and notification with that client.

25. Third-Party Websites and Platforms

Our website and communications may link to external websites, social networks, podcast platforms, video platforms, booking systems or other third-party services.

Those providers may independently process personal information under their own privacy policies.

Amplify is not responsible for the independent privacy practices, content or security of third-party services.

26. Legal Disclosures and Business Changes

We may use or disclose personal information where reasonably necessary to:

• comply with law or a valid court or tribunal order;
• respond to lawful regulatory or law-enforcement requirements;
• investigate fraud or misconduct;
• protect safety or legal rights;
• obtain professional advice;
• enforce an agreement; or
• establish, exercise or defend legal claims.

If Amplify undergoes a merger, acquisition, restructure, sale or similar corporate transaction, personal information may also be disclosed to professional advisers, potential counterparties or successors where reasonably necessary and subject to appropriate safeguards.

27. Privacy Complaints

If you believe Amplify has mishandled your personal information or breached an applicable privacy obligation, please contact our Privacy Officer.

We may:

1. acknowledge the complaint;
2. investigate the circumstances;
3. request further information where necessary;
4. consult relevant clients or providers where appropriate;
5. consider applicable legal obligations; and
6. provide a response.

We aim to provide a substantive response within 30 days where reasonably practicable, although complex matters may require longer.

Where the Privacy Act applies and you remain dissatisfied, you may be entitled to complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

28. Changes to This Privacy Policy

We may update this Policy where our:

• services;
• technology;
• service providers;
• information-handling practices;
• business operations; or
• legal obligations

change.

The current version will be published on our website with its last-updated date.

Where a material change affects existing personal information, we will provide additional notice where required by law.

We intend to review this Policy periodically to ensure it continues to reflect our actual practices.

29. Contact Us

Questions, privacy requests or complaints can be directed to:

Email: hello@amplifyhouse.com.au

Phone: +61 410 044 991

Website: amplifystoryhouse.com.au

Where appropriate, please use “Privacy Request” or “Privacy Complaint” in the subject line.

We may require reasonable evidence of identity or authority before acting on a request involving personal information.