Privacy Policy

2.1 About customer organisations and their personnel

• identification details including: name, position, business contact details email, phone number, and address;
• authentication and account information including: usernames, passwords (stored in hashed form), multi-factor authentication tokens, IP address, device identifiers, login history and session information;
• billing and commercial information: ABN, business address, billing contact, payment instrument details (handled by our payment service providers); and
• usage information: pages and features accessed, configurations chosen, support tickets raised, communications with our team.

2.2 About website visitors

• device, browser and network information including IP address;
• information collected through cookies, and similar technologies;
• contact details that visitors voluntarily provide: for example in contact forms or to download materials; and
• information about how visitors interact with our website.

2.3 About individuals processed by the Platform on behalf of our customers

Where our customers use the Platform to perform their AML/CTF compliance processes on individuals (typically the customer's own clients or counterparties), the Platform may handle information about those individuals submitted by our customers or received from third party identity verification or screening services. This may include:

• identifying information: full name, date of birth, residential address, contact details, nationality, and country of residence;
• government-issued identifier information permitted by AML/CTF rules: driver licence number, passport number, and/or Medicare card number;
• sensitive information for the purposes of AML/CTF compliance: racial or ethnic origin (only as may be incidentally disclosed by identity documents); biometric information derived from facial images or liveness checks; and political opinions where this is relevant to politically exposed person (PEP) screening;
• documentary evidence of identity: scans or images of passports, drivers licences, utility bills, bank statements, and similar;
• verification artefacts and results: outputs of identity-document checks, likeness checks, electronic identity verification matches, and timestamps;
• screening results: matches or non-matches against sanctions lists, watch-lists, PEP lists, and adverse media, risk ratings and risk classifications;
• transaction context information: information about the property or transaction to which the AML/CTF process relates (for example, address of property, transaction value); and
• interaction and audit information: timestamps, IP addresses, device information, and any notes recorded by the customer's personnel.

In many cases, we handle personal information on behalf of our customers as a service provider. In those circumstances, the customer is responsible for their own compliance with the Privacy Act, including providing any required notices to individuals.

However, where we collect and use personal information for our own purposes (such as managing customer relationships, operating our business, or marketing), we do so as an APP entity and handle that information in accordance with this Privacy Policy.

3.1 Directly from individuals

We collect personal information directly from individuals where reasonable and practicable to do so. For example:

• when an individual registers for an Account or signs up for a trial;
• when an individual contacts us by email, web form, telephone or in person;
• when an individual responds to our marketing communications, attends a webinar or event, or downloads a resource; and
• when an individual submits an application for employment with us.

3.2 From our customers

We receive personal information from our customers when they upload it to, or process it through, the Platform. This typically relates to the customer's own clients and counterparties for AML/CTF purposes. Where personal information is provided to us by our customers, we take steps to ensure that personal information is collected lawfully, including through contractual requirements and due diligence of our customers.

3.3 From third parties

We may collect personal information from third parties, including:

• identity verification providers, electronic identity verification services, document verification services and biometric/liveness verification providers;
• sanctions, watch-list, PEP and adverse-media screening providers;
• credit reporting bodies (only where applicable and consented to);
• publicly available sources;
• our service providers and partners (for example, payment, email, hosting, analytics and cybersecurity providers); and
• our customers' authorised users, where they submit information about themselves or others.

3.4 Through the Platform automatically

When individuals use the Platform or our website, we (and our service providers) automatically collect technical information including IP address, browser type, device identifiers, operating system, referring URLs, pages visited, and information about how the Platform is used. We also generate audit logs of user activity for security, integrity and compliance purposes.

4.1 Operating and providing the Platform

• authenticating users, providing access to the Platform, and providing technical support;
• hosting, processing and storing data submitted to the Platform;
• performing the compliance workflows that our customers have configured, including identity verification, screening, risk assessment, monitoring and record-keeping;
• integrating with third party services that the customer has enabled;
• generating audit logs, reports and analytics; and
• maintaining the security, integrity and performance of the Platform.

4.2 Managing our customer relationships

• registering and managing customer Accounts and Authorised Users;
• invoicing and processing payments;
• communicating with customers about the Platform, including service notices, security alerts and changes to terms or policies;
• responding to enquiries and complaints; and
• managing contractual obligations.

4.3 Marketing and business development

We may use personal information of customer contacts and prospective customers to send marketing communications about our services, industry developments and events. We will only do so in accordance with the Privacy Act and the Spam Act 2003 (Cth).

Where required, we will obtain an individual's consent before sending direct marketing communications. In other circumstances, we may rely on consent that can reasonably be inferred from the individual's relationship with us, where permitted by law.

Individuals may opt out of receiving marketing communications from us at any time by using the unsubscribe link in our communications or by contacting us using the details in this Privacy Policy. We will comply with such requests promptly.

4.4 Product improvement and analytics

• understanding how the Platform is used and improving its features and performance;
• training and improving machine learning, statistical and rule-based models, using de-identified or aggregated data;
• benchmarking; and
• generating de-identified industry insights.

4.5 Security, fraud prevention, and integrity

• detecting, preventing and responding to security incidents, fraud, abuse and unauthorised access;
• monitoring compliance with our Terms and Conditions and acceptable use policies; and
• protecting the rights, property or safety of AML Assured, our customers, or others.

4.6 Legal and regulatory compliance

• complying with our obligations under the Privacy Act, the AML/CTF Act (where applicable to AML Assured), tax laws, corporations law and other applicable laws;
• responding to lawful requests from regulators (including the Office of the Australian Information Commissioner, AUSTRAC and the ACCC) and law enforcement;
• complying with court orders, subpoenas and other legal process; and
• establishing, exercising or defending legal claims.

4.7 Other purposes

We may use or disclose personal information for any other purpose:

• for which the individual has consented (APP 6.1(a));
• that is required or authorised by or under an Australian law or court/tribunal order (APP 6.2(b));
• where a permitted general situation or permitted health situation applies (APP 6.2(c)); or
• that the individual would reasonably expect, where that other purpose is related to a primary purpose of collection (or in the case of sensitive information, directly related to the primary purpose) (APP 6.2(a)).

6.1 Our service providers and sub-processors

We disclose personal information to third parties that provide services to us, including:

• cloud infrastructure and hosting providers;
• identity verification, document verification, electronic identity verification, biometric and liveness check providers;
• sanctions, PEP, watchlist and adverse-media screening providers;
• payment processing providers;
• customer relationship management, support, ticketing and communications providers;
• analytics, monitoring, security, fraud detection and cybersecurity providers;
• professional advisers (legal, accounting, auditing, consulting); and
• backup, data recovery, archival and electronic signature providers.

6.2 Our customers and their Authorised Users

Where individuals interact with the Platform on behalf of, or are otherwise associated with, a customer organisation, we disclose information about that individual to the relevant customer organisation as necessary to provide the Platform to that customer.

6.3 Regulators and law enforcement

We may disclose personal information to regulators, law enforcement and other authorities where required or authorised by law, including under the Privacy Act, the AML/CTF Act, court orders, subpoenas, search warrants, and similar legal process.

The AML/CTF Act requires reporting entities to lodge certain reports with AUSTRAC, and our customers may use the Platform to assist them in preparing those reports.

6.4 Corporate transactions

If we are involved in a sale, merger, acquisition, restructure, insolvency or other corporate transaction, we may disclose personal information to the relevant counterparty and their professional advisers, subject to appropriate confidentiality protections.

6.5 Other disclosures

We may also disclose personal information:

• with the individual's consent;
• to protect the rights, property or safety of AML Assured, our customers, the individual, or any other person;
• where the disclosure is required or authorised by or under an Australian law or court/tribunal order; or
• where a permitted general situation or permitted health situation under the Privacy Act applies.

Strictly necessary

Required for the website and Platform to function, including sign-in, session management, security, and delivery of core features (including training content). These technologies are essential and are not used for advertising. On the Platform, this includes local/session storage used to maintain your authenticated session.

Functional

Remember choices and settings to improve your experience, such as organisation branding and onboarding progress. Some of this information is stored in your browser (local or session storage) and some may also be stored in your account on our systems.

Analytics

Help us understand how selected pages are used so we can improve them. On the Platform, this is currently limited to public signup-related pages where Google Tag Manager is enabled. We do not use broad in-app product analytics cookies across the authenticated Platform unless we tell you otherwise.

Marketing

Used to deliver and measure marketing and advertising. Marketing cookies and tags are used on our marketing website only. On the Platform, we may collect marketing email consent during signup, but we do not use marketing tracking technologies across the authenticated Platform.