For digital and marketing agencies
Privacy compliance for every client site you build
One account for banners, policies and consent records across your clients, plus your own obligations covered.
10 minutes. No account needed for the score.
Why businesses trust Savira
- Australian owned
- Data hosted in Australia
- Built for the Australian Privacy Principles
- ABN 53 273 071 022
Why it matters for your agency
What makes digital agencies different
Dual exposure
You have your own obligations, and your clients rely on what you build.
Consent under the microscope
Tags you install for clients must respect consent.
Client data is still your problem
Data you hold for clients needs protecting too.
Direct marketing rules
Campaigns you run must respect opt outs.
Want the detail? Read: OAIC pixel determinations: what agencies should check
What Savira does for your agency
Your policy, consent and records in one place
- One view of banner and policy status across client sites
- Banners that block client tags until visitors agree
- Client-ready scan reports
- Partner commission or margin
Your client's journey
Follow one person through your agency
- 1 · Scan
You scan a prospect site.
Savira: A client-ready report.
- 2 · Fix
You install the plugin.
Savira: Banner live in about 10 minutes.
- 3 · Policy
The client answers the policy questions.
Savira: Published to their site.
- 4 · Monitor
You see every site in one place.
Savira: Gaps flagged.
- 5 · Prove
The client is asked for evidence.
Savira: They export their records.
Your action plan
What to do, and when
Start here
- Run the free website scan
- Update your privacy policy
- Hold tracking until consent works
Then
- Write a breach response plan
- Train your team
- List who holds your customer data
Keep it current
- Review overseas providers
- Prepare for automated decision rules
- Review your policy every year
Digital agencies privacy checklist
A one page PDF you can work through this week. We email it to you.
FAQ
What digital agencies businesses ask us
If a client's site breaches privacy law, is that our problem or theirs?
Usually both, in different ways. The client is generally the entity collecting the information and carries the primary obligation. But you built the thing that collects it, and if a breach traces back to your forms, pixels or integrations, that becomes a commercial and reputational problem for you regardless of where legal liability lands.
Our client insists on a banner that only has an Accept button. What do we do?
Put your advice in writing and let them decide. Consent has to be voluntary, informed, current and specific, and a single Accept button does not offer a genuine choice. Document that you raised it. Agencies that get burned here are usually the ones with no record of having said anything.
Do we need consent before analytics loads, or just advertising pixels?
Treat both the same way. The distinction people draw between essential and non-essential is about function, not category, and most analytics tools set identifiers and share data with a third party. The safe position is that anything not required to make the site work waits for consent.
We are under the small business threshold. Are we exempt?
Possibly not. The exemption falls away if you trade in personal information, which can include some data-matching and audience-building work, or if you are related to a larger body corporate. It also does not help you commercially, because your clients will increasingly ask what your practices are before they sign.
Can we use client work in case studies?
Get consent, and be careful about what the case study contains. Aggregate campaign results are generally fine. Naming individuals, showing customer data, or including screenshots with personal information in them is where this goes wrong.
Get the foundations in place this week
Free forever on Starter. No credit card. Built for the Australian Privacy Principles.