Privacy Policy

Last updated: 19 September 2026

This Privacy Policy explains how Owen Anthony Cumine, trading as Acoma (ABN 95 542 651 312) ("Acoma," "we," "us" or "our"), collects, uses, discloses and protects personal information in connection with the acomaagency.com website and our Meta (Facebook and Instagram) advertising management services. This policy is a notice about how we handle information — it does not require you to accept it before it applies, and it is not a contract. Acoma handles personal information responsibly and, where applicable, in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Some small businesses are exempt from parts of that Act; Acoma follows the practices described in this policy regardless of whether a particular exemption applies to us.

1. Who we are

Acoma is the trading name of Owen Anthony Cumine, an Australian sole trader.

• Legal name: Owen Anthony Cumine, trading as Acoma
• ABN: 95 542 651 312
• Email: contact@acomaagency.com
• Phone: 0483 299 678
• Location: Western Australia, Australia

2. Information we collect directly

We collect information you give us directly, including:

• Your name
• Business name
• Email address
• Phone number
• Advertising budget range
• Marketing goals and enquiry details you include in the contact form or in messages to us
• Information you provide during calls or onboarding
• Billing and transaction records, if you become a client
• Client ad account access and campaign information you give us to deliver services
• Records of your communications with us

3. Lead information we handle on behalf of clients

Where we provide lead-generation or lead follow-up services to a client, we may handle personal information belonging to that client's prospective customers, such as:

• Names
• Contact details
• Enquiry details
• Appointment or follow-up status
• Call or communication records, where this is lawfully configured by the client and disclosed to the person contacted

We handle this information only to provide services to the relevant client, and not for any unrelated purpose. We do not currently record calls. If call recording is introduced for a client engagement, it will only be used where the required notices and consents under applicable law have been put in place.

Each client remains responsible for having a lawful basis to collect and share their own customers' and leads' information with us, and for giving their customers appropriate privacy notices.

4. Information collected automatically

When you visit our website, some technical information is collected automatically by us and by the infrastructure providers we use, including:

• IP address and approximate location (derived from IP address)
• Browser and device information
• Pages visited and time spent on the site
• Referring page or link
• Basic website performance and security information (for example, information used to detect malicious traffic)

Our website does not set cookies of its own. Cloudflare, which delivers, secures and provides limited analytics for our website, may set technical, security and analytics cookies or use similar technology as part of that service — see Section 6. We do use browser local storage (not a cookie) to remember your light or dark theme preference on this site, under the key acoma-theme, so the site displays correctly on your next visit. This is stored only in your own browser and is not sent to us.

5. Providers we actually use

We keep this list accurate to what is genuinely running on our website and in our services. It may change as our tools change, and we will keep this page updated when that happens.

• FormSubmit (formsubmit.co) — receives and forwards submissions from our website enquiry form by email. FormSubmit is operated by a third party independent of Acoma; see FormSubmit's own documentation for how it handles data.
• Cloudflare — delivers our website, helps secure it against malicious traffic, and provides Cloudflare Web Analytics, a limited analytics service that is enabled for this website. Through these functions, Cloudflare may receive your IP address, an approximate location derived from that IP address, your browser and device information, the page that referred you to our site, the pages you visit, and request, security and performance information.
• GitHub Pages — hosts the underlying website files.
• Google Fonts — supplies the typefaces used on this website; your browser requests font files directly from Google's servers when you load the site.

We do not currently use Meta Pixel, Meta Custom Audiences or Google Analytics on this website. Cloudflare Web Analytics is enabled and collects limited website traffic, security and performance information as described above. If we begin using Meta Pixel, Meta Custom Audiences, Google Analytics or a similar tool, we will update this policy before doing so. Where we manage a client's own Meta advertising account, Meta's own tools (such as Meta Pixel or lead forms) may be used on that client's website or assets under the client's instructions — that use is governed by the client's own privacy arrangements, not this policy.

If we engage a CRM, email, SMS, call-tracking, scheduling or payment provider for a client engagement, we will disclose that to the relevant client directly and, where it affects our general practices, update this policy.

6. Cookies and Cloudflare Web Analytics

Cloudflare may place a small number of cookies or use similar technology that support content delivery and security (for example, distinguishing legitimate visitors from automated traffic), and to provide Cloudflare Web Analytics. Cloudflare Web Analytics is a website-traffic analytics tool that reports information such as page views, visit counts and basic performance data for this website; it does not use cross-site tracking to build an advertising profile of you. We do not control the exact cookies or technology Cloudflare uses; you can find current details in Cloudflare's own documentation. You can control or block cookies through your browser settings, though this may affect how parts of the site function. We do not currently use a cookie consent banner, as we are not aware of non-essential advertising cookies being set on this site; we will add one if that changes.

7. How we use your information

• Responding to enquiries and scheduling calls
• Providing agreed advertising management, creative and lead follow-up services
• Managing client advertising campaigns and operating authorised lead follow-up
• Billing and record keeping
• Preventing abuse and maintaining the security of our website and systems
• Improving our website and services
• Complying with our legal, tax and accounting obligations
• Sending direct marketing, but only where permitted by law and where we have a valid basis to do so — see Section 9

Submitting our website enquiry form authorises us to use the information you provide to respond to your enquiry and arrange a call if requested. It does not, by itself, sign you up to any ongoing marketing list — see Section 9.

8. Disclosure of information

We do not sell personal information. We may disclose information to:

• Hosting and website infrastructure providers (GitHub Pages, Cloudflare)
• Form-processing providers (FormSubmit)
• Advertising platforms such as Meta, where required to deliver or measure a client's campaigns
• CRM, email, SMS, call-tracking or scheduling providers used for an agreed client service
• Our professional advisers (for example, an accountant), where reasonably necessary
• Government authorities, where required or authorised by law
• A buyer or successor of the business, if it is sold or transferred, subject to appropriate protections for personal information

We take reasonable steps when selecting providers, but we have not independently audited every provider's contractual terms, so we do not claim that each provider is contractually bound to specific restrictions beyond their own published terms and policies.

9. Direct marketing

We send commercial electronic messages only where we have express consent or another consent basis that is lawfully available under the Spam Act 2003 (Cth). Submitting an enquiry, booking a call or purchasing a service does not automatically authorise unrelated ongoing marketing.

• Where our website enquiry form includes a separate, optional marketing checkbox, ticking it is how you opt in to occasional marketing emails. The checkbox is unticked by default and is not required to submit an enquiry.
• Our commercial electronic messages identify Acoma as the sender, include current contact details and provide a clear and functional way to unsubscribe.
• You can also unsubscribe at any time by emailing contact@acomaagency.com with "unsubscribe" in the subject or body.
• We will action unsubscribe requests within five working days, as required by the Spam Act 2003.

10. Overseas processing

Some of the providers we use operate infrastructure outside Australia. Based on the providers we currently use:

• Cloudflare and GitHub Pages are United States-based companies operating global networks, so information may be processed or transiently stored in the United States or other countries as part of their content delivery and hosting services.
• Google Fonts is operated by Google, a United States-based company with global infrastructure; loading web fonts may involve a connection to Google's servers outside Australia.
• FormSubmit is a third-party service; we have not independently verified every country in which it processes data. We recommend reviewing FormSubmit's own privacy documentation if this matters to you.

Where we identify additional overseas processing through providers we introduce in future, we will update this section rather than leave it inaccurate.

11. Retention

We keep personal information only for as long as is reasonably necessary for the purpose it was collected, including to:

• Respond to and resolve your enquiry
• Provide services for the length of a client relationship
• Meet legal, tax and accounting record-keeping obligations (Australian tax law generally requires records to be kept for at least five years)
• Resolve disputes
• Support reasonable security and backup practices

When information is no longer reasonably required, we delete, securely destroy or de-identify it, subject to our legal obligations. We cannot guarantee instant removal from every backup system, as backups are retained for a limited period for disaster-recovery purposes before they are cycled out and overwritten.

12. Security

We take reasonable steps to protect the personal information we hold, including:

• Restricting who has access to client accounts and business systems
• Using strong, unique passwords and multi-factor authentication where a service supports it
• Choosing service providers with their own security practices
• Removing our access to client systems once an engagement ends
• Having a reasonable process to respond to a suspected data breach

No method of storage or transmission over the internet is completely secure, and we cannot guarantee that a security incident will never occur.

13. Access and correction

You can ask us for access to, or correction of, the personal information we hold about you by contacting us at contact@acomaagency.com. We will respond within a reasonable time and may need to verify your identity before actioning a request.

14. Privacy complaints

If you have a concern about how we have handled your personal information:

• Email us at contact@acomaagency.com with details of your complaint.
• We will acknowledge your complaint and investigate it within a reasonable period.
• We will explain the outcome of our review and any action we take as a result.

If the Privacy Act 1988 (Cth) applies to your complaint and you are not satisfied with our response, you may be able to raise it with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au. We note that whether the OAIC has jurisdiction depends on the circumstances, including whether an exemption (such as the small business exemption) applies.

15. Children's privacy

Our website and services are directed at business owners and are not intentionally directed at children. We do not knowingly collect personal information from children.

16. Updates to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or the providers we use. The "Last updated" date above shows the most recent revision. This policy applies prospectively from the date it is updated; it does not retroactively bind existing clients to a materially different privacy arrangement for a paid engagement without their agreement.

17. Contact us

Questions about this Privacy Policy can be sent to contact@acomaagency.com or 0483 299 678.