Privacy Policy


Privacy Policy


Magic Agency Pty Ltd [ACN 633 565 625]

Last updated:  May 2026

This Privacy Policy sets out how Magic Agency Pty Ltd (ACN 633 565 625) (“Magic”, “we”, “us” or “our”) collects, holds, uses and discloses personal information about our clients, prospective clients, employees, contractors, suppliers, website visitors, and others we interact with.

We respect the privacy rights of individuals and are committed to protecting your privacy in accordance with the Privacy Act 1988 (Cth) (“Privacy Act”) and the Australian Privacy Principles (“APPs”) contained therein.

In this Privacy Policy, personal information has the meaning given to it in the Privacy Act and includes information or opinions about an identifiable individual, including names, contact details, and other information that is reasonably capable of identifying a person.

  1. Collection of Personal Information

Magic collects personal information about the following categories of individuals:

  1. Client and prospective client representatives: name, email address, phone number, business address, and job title, collected through the course of business development, client onboarding, and ongoing client relationship management.

  2. Employees and contractors: name, home address, phone number, email address, bank account details (for payroll purposes), tax file numbers, superannuation account details, and emergency contact details, collected through our HR and payroll processes.

  3. Media publisher and vendor representatives: contact and business details relevant to our supply relationships.

  4. Website visitors: cookies and analytics data collected through our website at www.magic.com.au, including through Google Analytics and the LinkedIn Insight Tag.

  5. Consumer and audience data processed on behalf of clients: this may include hashed email addresses, device identifiers, pixel-tracked behavioural data, CRM audiences, and first-party data provided by clients for use in digital campaign targeting and attribution. Magic processes this data solely in its capacity as a service provider acting on behalf of clients. See section 7 below.

Sensitive information: Magic does not intentionally collect sensitive information (such as health information, racial or ethnic origin, political opinions, religious beliefs, or criminal records). Where third-party advertising platforms return inferred demographic segments, Magic does not collect or store that information at an individual level.

We collect personal information through the following means:

  1. Direct communication with clients, prospective clients, employees, and vendors by email, telephone, or in person.

  2. LinkedIn and other professional networking platforms, for business development purposes.

  3. Website contact forms at www.magic.com.au.

  4. Contracts, statements of work, onboarding documentation, and order forms.

  5. Advertising platform accounts (including Google Ads, Meta Business Manager, TikTok Ads, DV360, and The Trade Desk), where Magic manages accounts on behalf of clients — consumer data within those platforms originates from the client's own customer interactions.

  6. Third-party CRM and analytics integrations authorised by clients, including Salesforce, HubSpot, and Ruler Analytics.

  7. HR and payroll systems for the collection and management of employee and contractor information.

  8. Referrals from existing clients or industry contacts.

We do not purchase third-party consumer data lists.

  1. Use of Personal Information

We use the personal information we collect for the purposes for which it was provided or collected, and for the following related purposes:

  1. Delivering contracted digital media services to clients, including campaign management, media planning, programmatic buying, analytics, creative optimisation, reporting, and measurement.

  2. Business development and client relationship management.

  3. Invoicing, accounting, and financial administration.

  4. Employee and contractor management, including payroll, compliance, and HR administration.

  5. Operating, maintaining, and improving our internal systems, tools, and processes.

  6. Communicating with clients regarding campaign performance, strategic recommendations, and industry insights.

  7. Fulfilling our legal and regulatory obligations.

  8. Direct marketing: Magic may contact existing and prospective clients with information about our services, industry insights, and events. You may opt out of receiving marketing communications at any time by contacting us using the details in section 6 below.

  9. In other circumstances, with your consent or where otherwise permitted by law.

  1. Disclosure of Personal Information

We may disclose personal information to the following categories of third parties for the purposes described in section 2:

  1. Advertising platforms and publishers: including Google (Google Ads, DV360, SA360, YouTube), Meta, TikTok, The Trade Desk, DAX, DOOH operators, and other programmatic platforms, for the purpose of executing client campaigns. Information disclosed is limited to what is necessary for campaign delivery.

  2. Analytics and measurement platforms: including Google Analytics, Meta Pixel, Integral Ad Science (IAS), DoubleVerify, and attribution tools, for campaign performance measurement.

  3. Software and SaaS providers: for project management, reporting, and internal operations, including cloud storage and dashboard tools.

  4. Professional advisors: including our legal advisors (KCL Law) and accounting and finance advisors, subject to confidentiality obligations.

  5. Payroll and HR providers: for the administration of employee and contractor records, payroll processing, and related obligations.

  6. Clients: where Magic provides campaign reporting and analytics that may include aggregated or de-identified audience data.

We may also disclose personal information:

  1. Where we have your express consent to do so.

  2. Where it can reasonably be inferred from the circumstances that you consent to the disclosure.

  3. If all or substantially all of our assets or business are acquired by a third party, in which case personal information we hold may be one of the transferred assets, subject to the same constraints on use and disclosure as under this policy.

  4. Where we are required or permitted to do so by law, or to enforce our agreements, or to protect the rights, property, or safety of Magic, our personnel, or our clients.

Magic does not sell personal information to third parties.

  1. Overseas Disclosure and Transfer of Personal Information

Magic operates across Australia, the United States of America (Los Angeles), and the United Kingdom, and engages with global technology platforms. Personal information may be transferred to or accessible in the following overseas jurisdictions:

  1. United States of America: major advertising and technology platforms including Google, Meta, TikTok, and The Trade Desk are US-based and process data on US infrastructure. Magic's Los Angeles-based team members may also access client and business contact information in the ordinary course of their work.

  2. United Kingdom: Magic's UK-based team members may access client and business contact information in the ordinary course of their work.

  3. Other jurisdictions: depending on data centre locations of third-party platforms (for example, Ireland, where Meta hosts certain EU-region infrastructure).

Before disclosing personal information to an overseas recipient, Magic takes reasonable steps to ensure that the overseas recipient handles the information in accordance with the APPs or in a manner consistent with those standards. Where required by the Privacy Act, we will seek your consent before making such a disclosure or will rely on an applicable exception under the APPs.

  1. Storage and Security of Personal Information

Magic stores personal information in the following systems:

  1. Cloud-based productivity and collaboration tools, primarily Google Workspace (Gmail, Google Drive, Google Docs), with enterprise-grade security settings.

  2. Advertising platform accounts, including Google Ads Manager, Meta Business Manager, TikTok Ads, DV360, and The Trade Desk, hosted by the respective platforms.

  3. Accounting and payroll systems.

  4. Secure, company-managed devices used by Magic team members to access information in the course of their work.

Magic takes all reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification, and disclosure. Our security measures include:

  1. Password protection and multi-factor authentication (MFA) on all key systems.

  2. Access controls limiting access to personal information to team members who require it for their role.

  3. Secure cloud infrastructure through enterprise SaaS providers with their own security certifications and controls.

  4. Contractual protections with technology vendors regarding the handling of personal information.

  5. Periodic review of access permissions, including at employee and contractor offboarding.

We do not sell or otherwise transfer personal information to any third party for commercial gain.

  1. Retention of Personal Information

We retain personal information for the period necessary for the purposes for which it was collected, and in accordance with our legal obligations. Our retention practices are as follows:

  1. Client and business contact information: retained for the duration of the client relationship and for a period of 7 years following the end of that relationship, in accordance with applicable taxation and financial record-keeping obligations.

  2. Campaign and audience data belonging to clients: retained for the term of the relevant client agreement. Upon termination or expiry, Magic will return or delete such data in accordance with the terms of that agreement.

  3. Employee and contractor records: retained in accordance with applicable employment law requirements.

  4. Website analytics data: retained in accordance with the settings of the relevant analytics platform (typically 14 months for Google Analytics 4).

Once the applicable retention period expires, personal information is securely destroyed or de-identified.

  1. Processing of client Consumer Data – Magic as Service Provider

In the course of managing digital advertising campaigns for clients, Magic may handle personal information about the clients' customers and audiences. This includes:

  1. Hashed customer email lists used for custom audience matching (e.g. Facebook CAPI, Google Customer Match).

  2. Pixel and tag data: website behavioural data collected via client-approved tags (e.g. Meta Pixel, Google Tag Manager, Floodlight).

  3. CRM integration data, where a client connects their CRM to an attribution tool for lead quality and revenue attribution purposes.

  4. Retargeting audiences and lookalike pools built from client first-party data.

In all such cases, the personal information is owned by the client. Magic processes it solely in its capacity as a service provider (agent) acting on the client's instructions, for the purpose of delivering the agreed campaign services. Magic does not use client consumer data for its own purposes and does not retain such data beyond the term of the applicable client agreement, except as required by law.

Clients who wish to understand how Magic handles their consumer data in the context of a specific campaign engagement should refer to the privacy and data processing provisions of their applicable client agreement.

  1. Data Breaches – Notifiable Data Breaches Scheme

Magic is subject to the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act. Where Magic becomes aware of a data breach that is likely to result in serious harm to any of the individuals to whom the information relates, Magic will:

  1. Assess the breach as quickly as possible.

  2. Notify the Office of the Australian Information Commissioner (OAIC) and affected individuals of any eligible data breach.

  3. Take all reasonable steps to contain and remediate the breach.

Where Magic's client agreements require notification within a specified timeframe (for example, within 72 hours), Magic will use best endeavours to comply with that requirement.

  1. Cookies and Tracking Technologies

The Magic website (www.magic.com.au) uses cookies and similar tracking technologies, including:

  1. Google Analytics: for measuring website performance, traffic sources, and user behaviour on our website.

  2. LinkedIn Insight Tag: for B2B audience tracking and measuring the effectiveness of Magic's LinkedIn advertising campaigns.

  3. Standard browser session cookies for the operation of the website.

You may configure your browser to refuse cookies or to alert you when cookies are being sent. Please note that some features of our website may not function correctly if cookies are disabled.

For information about how Google uses data collected through Google Analytics, please visit: https://policies.google.com/privacy.

  1. Access, Correction and Complaints

You have the right to access and correct the personal information we hold about you. To request access to or correction of your personal information, or to make a privacy complaint, please contact our Privacy Officer:

Privacy Officer — Magic Agency Pty Ltd

1/105 Dover Street, Cremorne VIC

Email: shahram@magic.com.au 

Website: www.magic.com.au 

Please provide sufficient detail to help us identify the information in question. We will respond to access and correction requests within a reasonable time and in accordance with the Privacy Act.

Complaints: Magic takes privacy complaints seriously. If you believe that we have interfered with your privacy, please contact us using the details above. We will acknowledge your complaint promptly and aim to resolve it within 30 days. If you are not satisfied with our response, you may refer your complaint to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

  1. Changes to this Privacy Policy

We may update or modify this Privacy Policy from time to time to reflect changes in our practices, legal obligations, or business operations. We will post any updated version on our website at www.magic.com.au. We encourage you to review this Policy periodically.

Your continued engagement with Magic following any update to this Privacy Policy constitutes your acknowledgement of the updated Policy.