AMLTranche Privacy Policy

1. Our Commitment to Privacy

AMLTranche is a platform operated by Virya Technology Pty Ltd (ABN 90 670 925 238) ("AMLTranche", "we", "us", or "our"). We are committed to protecting the privacy of our Users and their clients, and we manage personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

This policy outlines how we collect, use, disclose, store, and safeguard personal information.

2. Information We Collect

To provide our compliance services, we collect the following categories of information:

2.1 User Information

• Name, email address, business name, ABN
• Contact details and account credentials

2.2 Identity Verification Data (KYC/CDD)

For the purpose of providing AML/CTF compliance services, we may facilitate the collection of:

• Government-issued identification documents (driver's licence, passport, Medicare card)
• Biometric data, including facial images (selfies) captured during identity verification
• Dates of birth and residential addresses
• Beneficial ownership details
• Screening results (sanctions, PEPs, adverse media)

Biometric Information (APP 3, Sensitive Information): Identity verification is performed using secure, third-party identity verification service providers. During the verification process, our verification partner may collect biometric data, including a selfie image and a facial scan of an identity document. This data is classified as sensitive information under the Privacy Act 1988 (Cth). We collect this information only with the individual's express consent and only where reasonably necessary for AML/CTF compliance obligations under the AML/CTF Act 2006 (Cth). If an individual does not consent to biometric data collection, identity verification cannot proceed and the designated service may not be provided.

2.3 Usage and Technical Data

• IP addresses, device identifiers, browser type
• Log data and metadata related to interactions with the Platform

Where reasonably practicable, usage data is aggregated or de-identified before analysis.

3. Purpose of Collection

We collect and use personal information for the following purposes:

• Service Delivery: To generate AML/CTF programs and facilitate identity verification and risk assessment workflows.
• Compliance: To meet statutory obligations under the AML/CTF Act 2006 (Cth), including record-keeping requirements.
• Communication: To send service updates, security alerts, and regulatory notifications.
• Platform Improvement: To analyse usage patterns and enhance AI-driven guidance.
• Legal and Security: To detect fraud, misuse, or unlawful activity.

We do not use personal information for purposes unrelated to compliance service delivery without consent.

4. Disclosure of Personal Information

We do not sell or rent personal information. We may disclose personal information to:

• AUSTRAC: Where required under examination or reporting powers.
• Service Providers: Trusted third-party providers, including:
  • Identity verification partners that provide automated biometric identity verification and document authentication. Depending on the provider used, these services may process identity documents and facial images on secure servers located in Australia or overseas. We select partners that maintain industry-standard security certifications, including SOC 2, ISO 27001, or equivalent frameworks.
  • Screening providers that perform sanctions, politically exposed person (PEP), and adverse media screening, which may involve checking customer names and related details against third-party data sources.
  • Cloud hosting and infrastructure providers that store core compliance and personal data on secure servers located in Sydney, Australia.
  • Payment processors, communication providers (email and SMS), and other operational service providers.
  All service providers are subject to contractual obligations regarding confidentiality and data protection.
• Professional Advisers: Legal, accounting, or insurance advisers where reasonably necessary.
• Legal Requirement: When compelled by a court order, warrant, or law enforcement authority.

5. Data Residency and Overseas Disclosure

5.1 Australian Storage

All core compliance and personal data is primarily stored on secure servers located in Sydney, Australia.

5.2 Overseas Disclosure (APP 8)

While AMLTranche stores core compliance and personal data primarily in Australia, certain personal information may be processed overseas by our operational service providers:

• Identity verification: Identity verification data (identity documents and biometric or facial images) may be processed and stored on secure servers that may be located outside Australia, depending on the verification provider used (for example, in the European Union, the United Kingdom, or the United States).
• Screening: Limited personal information (such as a customer's name and date of birth) may be checked against data sources that may be located outside Australia for sanctions, PEP, and adverse media screening.

Important: Where personal information is disclosed to an overseas recipient, the Australian Privacy Principles (APPs) may not apply to the overseas recipient's handling of that information, and individuals may not be able to seek redress under the Privacy Act 1988 (Cth) against the overseas recipient. By consenting to identity verification, individuals acknowledge and consent to this cross-border disclosure.

We take reasonable steps to ensure that overseas recipients handle personal information in a manner consistent with the APPs, including through contractual obligations with our service providers. We do not routinely transfer compliance data offshore unless required for identity verification, required by law, or with the individual's explicit consent.

6. Data Retention and Deletion

We retain personal information only for as long as required to:

• Fulfil legal obligations under the AML/CTF Act 2006 (Cth), including mandatory 7-year record retention requirements;
• Resolve disputes and enforce contractual agreements;
• Maintain security and audit integrity.

Where retention is no longer required, personal information is securely deleted or permanently de-identified. Users remain responsible for maintaining independent backups of compliance records where required under their regulatory obligations.

7. Data Security Measures

We take reasonable technical and organisational measures to protect personal information from misuse, interference, loss, unauthorised access, modification, or disclosure. Security measures include:

• Encryption at rest and in transit
• Multi-Factor Authentication (MFA)
• Role-based access controls
• Tamper-proof audit logging with hash chain integrity
• Secure Australian-based cloud infrastructure
• Regular system monitoring and vulnerability assessment

Users are responsible for safeguarding account credentials and restricting internal access to authorised personnel only.

8. Notifiable Data Breaches (NDB Scheme)

In the event of an eligible data breach likely to result in serious harm:

• We will promptly assess the breach within 30 days as required under Part IIIC of the Privacy Act 1988 (Cth).
• We will notify affected individuals and the Office of the Australian Information Commissioner (OAIC).
• We will provide information on recommended steps individuals should take.

9. Access and Correction (APP 12 & 13)

Individuals have the right to request access to personal information we hold about them and request corrections where information is inaccurate, incomplete, or outdated. Requests may be submitted by logging into the Platform or contacting us at compliance@amltranche.com.au. We will respond within a reasonable period.

10. Direct Marketing (APP 7)

We may send service-related communications, regulatory updates, and product notifications. You may opt out of non-essential communications at any time by using the unsubscribe link provided or contacting us directly. We do not sell personal information for marketing purposes.

11. Automated Decision-Making

Where the Platform uses computer programs or AI systems to make decisions that significantly affect an individual (commencing December 2026), we will:

• Provide transparency regarding the nature of automated processing;
• Offer information about the logic involved (to the extent reasonable);
• Provide a mechanism for human review upon request.

12. Role as a Service Provider

AMLTranche provides its services to Reporting Entities (such as real estate agents, conveyancers, and developers) to assist them in meeting their own obligations under the AML/CTF Act 2006 (Cth) and the Privacy Act 1988 (Cth). In handling personal information about a Reporting Entity's clients, AMLTranche acts on behalf of, and in accordance with the instructions of, that Reporting Entity.

The Reporting Entity is responsible for collecting its clients' personal information and for ensuring that it has the lawful authority and any necessary consents to provide that information to AMLTranche and to have it handled as described in this policy.

Both AMLTranche and Reporting Entities have obligations under the Privacy Act 1988 (Cth) in respect of the personal information they each hold. AMLTranche handles personal information only for the purposes of providing its services and meeting applicable legal obligations.

13. Cookies and Tracking Technologies

The Platform may use essential cookies for authentication, session management, and security purposes. We do not use third-party advertising or tracking cookies. Analytics data, where collected, is aggregated and de-identified.

14. Children's Privacy

The Platform is designed for use by business professionals and is not intended for individuals under the age of 18. We do not knowingly collect personal information from children.

15. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified via email and/or in-app notification. The current version number and date are displayed at the top of this document.

16. Complaints

If you have a concern about our privacy practices, you may contact our Privacy Officer at support@amltranche.com.au. We will respond to complaints within 30 days.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.