Privacy Policy

We are bound by the Australian Privacy Principles ("APPs") in the Privacy Act 1988 (Cth) ("Privacy Act"). This Policy explains how we collect, hold, use and disclose your personal information, how you can access and correct it, and how you can make a complaint.

This Policy applies to personal information we collect through the Bifu website at www.bifu.com.au and any Bifu mobile application (together, the "Platform"), and through our services and our other dealings with you.

"Personal information" means information or an opinion about an identified individual, or an individual who is reasonably identifiable. "Sensitive information" is a subset of personal information and includes biometric information.

By using the Platform or providing us with personal information, you acknowledge that we will handle it in accordance with this Policy. We may update this Policy from time to time by publishing the updated version on the Platform. We will notify you of significant changes where required by law.

Depending on how you interact with us, we may collect the following kinds of personal information:

• (a)Identity information: your name, date of birth, residential address, nationality, details of government-issued identity documents (such as a passport or driver licence), copies of those documents, photographs, and the results of identity verification checks;
• (b)Biometric information: a live image or video of your face captured during identity verification, and any biometric template derived from it, used to match you to your identity document. This is sensitive information and we collect it only with your consent;
• (c)Contact information: email address, phone number and postal address;
• (d)Financial and transaction information: bank account details, occupation, source of funds and source of wealth information, transaction history, wallet addresses, blockchain transaction details and the purpose of your transactions;
• (e)Customer due diligence information: for entity customers, information about directors, beneficial owners and authorised persons; whether you are a politically exposed person; and the results of sanctions, politically exposed person and adverse media screening;
• (f)Technical and usage information: IP address, device identifiers, device type, operating system, browser type, approximate location derived from your IP address, log data and information about how you use the Platform;
• (g)Communications: records of your correspondence with us, including support requests and complaints; and
• (h)Marketing preferences.

If you provide us with personal information about another person (for example, a director, beneficial owner or authorised signatory), you must have that person's authority to do so and must make them aware of this Policy.

We collect personal information directly from you when you register for an account, verify your identity, enter into a transaction, contact us or otherwise use the Platform.

We also collect personal information from third parties, including: identity verification and biometric matching providers; the Document Verification Service and other government or official record holders, with your consent, to verify your identity documents; sanctions, politically exposed person and adverse media screening providers; blockchain analytics providers; banks and payment providers; other virtual asset service providers and financial institutions involved in a transaction; and publicly available sources.

We collect some information automatically through cookies and similar technologies, server logs and analytics tools when you use the Platform (see section 10).

If you do not provide the personal information we request, we may be unable to open an account for you, verify your identity, process your transactions or provide our services.

Where we rely on your consent to collect, use or disclose personal information, including sensitive information, you may withdraw that consent by contacting us. Withdrawal of consent will not affect any handling of your information already undertaken lawfully, or our ability to retain or process information where required or authorised by law. Withdrawing consent may affect our ability to provide certain services.

Where lawful and practicable, you may interact with us anonymously or using a pseudonym, including when making general enquiries about our services. However, we are required to verify your identity before providing certain services, including virtual asset exchange services, in accordance with applicable anti-money laundering and counter-terrorism financing laws.

If we receive personal information that we have not requested, we will determine whether we could have lawfully collected that information under the Australian Privacy Principles.

Where we could not have collected the information, we will destroy or de-identify it as soon as practicable, where lawful and reasonable to do so. Otherwise, we will handle the information in accordance with this Policy and applicable privacy laws.

We collect, hold, use and disclose personal information to:

• (a)establish and verify your identity and conduct customer due diligence, as required by the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) ("AML/CTF Act");
• (b)open, administer and secure your account, process virtual asset exchange transactions, and make and receive payments or transfers of virtual assets in connection with our services;
• (c)monitor transactions and detect, investigate and prevent money laundering, terrorism financing, fraud, sanctions breaches, market abuse and other unlawful activity;
• (d)comply with our legal and regulatory obligations, including reporting to AUSTRAC, responding to requests from regulators, law enforcement agencies and courts, and meeting tax reporting obligations;
• (e)communicate with you about your account and transactions, respond to your enquiries and handle complaints;
• (f)manage our relationship with you, including risk management, auditing and record keeping;
• (g)maintain, protect, improve and develop the Platform and our services;
• (h)send you marketing communications about our products and services, where permitted by law (see section 8); and
• (i)use or disclose it for any other purpose to which you have consented, for a purpose related to the primary purpose of collection (or, for sensitive information, directly related to it) that you would reasonably expect, or as otherwise required or authorised by law.

We may collect, use and disclose government-related identifiers, including passport and driver licence numbers, where reasonably necessary to verify your identity or comply with applicable legal obligations, or where otherwise permitted by law. We will not adopt a government-related identifier as our own identifier for you unless required or authorised by law.

We may create aggregated or de-identified information from personal information we collect for statistical analysis, service improvement, risk management and business planning. We take reasonable steps to ensure that information treated as de-identified is not reasonably capable of identifying an individual.

We use computer programs, including rule-based systems and third-party identity verification, screening and blockchain analytics tools, to make, or to assist our staff to make, decisions that could significantly affect you. These programs are used to: verify your identity and match your identity document to your image; screen you against sanctions, politically exposed person and adverse media lists; assign you a money laundering and terrorism financing risk rating; and monitor transactions and wallet addresses for suspicious activity.

These programs use the following kinds of personal information described in section 2: identity, biometric, contact, financial and transaction, customer due diligence, and technical and usage information. Biometric information is sensitive information.

Decisions that may be made solely by these programs, without human involvement, include:

• (a)whether your identity is verified, including whether your live image matches your identity document;
• (b)the initial money laundering and terrorism financing risk rating assigned to you;
• (c)the transaction limits that apply to your account; and
• (d)whether a transaction is held for review.

Decisions for which these programs do something substantially and directly related to the decision, such as producing a verification result, screening match, risk score or alert that our staff consider, include:

• (a)whether to open an account for you, or to restrict, suspend or close your account;
• (b)whether to apply enhanced due diligence to you;
• (c)whether to accept, delay, decline or reverse a transaction; and
• (d)whether to report a suspicious matter to AUSTRAC.

You may contact us using the details in section 17 to request more information about a decision that affects you or to ask for it to be reviewed by our staff. We may be prohibited by law from telling you the reasons for some decisions.

We may disclose personal information to:

• (a)Service providers that help us operate our business, including identity verification, biometric matching, screening and blockchain analytics providers; cloud hosting, IT and data storage providers; banks, payment and treasury service providers; customer support, communications and analytics providers; and professional advisers such as lawyers, accountants and auditors;
• (b)Other virtual asset service providers and financial institutions, where required under the AML/CTF Act or necessary to process a transaction;
• (c)Regulators, government agencies, law enforcement agencies and courts, including AUSTRAC, ASIC, the Australian Taxation Office and the Office of the Australian Information Commissioner ("OAIC"), where required or authorised by law;
• (d)Independent reviewers and auditors of our AML/CTF program and our business;
• (e)Purchasers or prospective purchasers of our business or assets, and their advisers; and
• (f)Any other person with your consent or as required or authorised by law.

We may disclose personal information to our related bodies corporate where reasonably necessary to provide our services, undertake compliance and risk management activities, maintain the security of our operations or perform shared administrative functions. Any such disclosure will be subject to applicable privacy laws and appropriate confidentiality and security arrangements.

We do not sell your personal information.

Unless you have asked us not to, we may use your personal information to let you know about new or improved products and services and special offers that may be of interest to you.

We may disclose your personal information to our related bodies corporate or business partners for direct marketing purposes only if you consent to that use or disclosure.

If you do not want us to use your personal information for marketing purposes, please write to us at [email protected].

We may send you marketing communications about our products and services by email, SMS, push notification or through the Platform. You can opt out at any time by using the unsubscribe link in a message, adjusting your account settings or contacting us.

We will continue to send you service communications (such as transaction confirmations, security alerts and notices required by law) while you hold an account.

Some of our service providers, including cloud hosting, identity verification, screening and analytics providers, are located, or store or process information, outside Australia. We may disclose your personal information to recipients located in the United States of America and Singapore, and in any other jurisdiction in which our service providers operate from time to time.

Before disclosing personal information to an overseas recipient, we take reasonable steps to ensure that the recipient handles it in a manner consistent with the APPs, unless an exception under APP 8 applies.

A cookie is a small file that is placed on your device when you visit a website. Cookies help analyse web traffic and let the website operator know when you visit.

We use cookies, software development kits and similar technologies to operate the Platform, remember your preferences, maintain security, detect fraud and understand how the Platform is used. We may use third-party analytics providers for these purposes.

You can control cookies through your browser or device settings. Disabling cookies may affect the functionality of the Platform.

We hold personal information electronically, including in cloud-based systems operated by our service providers. We take reasonable steps, including technical and organisational measures, to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. Our measures include encryption of data in transit and at rest, access controls and multi-factor authentication, staff training, and contractual security obligations on our service providers.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your account credentials secure.

If a data breach occurs that is likely to result in serious harm to you, we will notify you and the OAIC in accordance with the Notifiable Data Breaches scheme under the Privacy Act.

We keep personal information for as long as it is needed for the purposes described in this Policy and to meet our legal obligations. The AML/CTF Act requires us to keep customer due diligence records for at least seven years after our business relationship with you ends, and transaction records for at least seven years after the relevant transaction.

When personal information is no longer required, we take reasonable steps to destroy or de-identify it.

You may request that we delete or de-identify personal information we hold about you by contacting our Privacy Officer. We will consider such requests in accordance with applicable law. We may be unable to comply where we are required or authorised to retain information for legal, regulatory, fraud prevention, dispute resolution or other lawful purposes.

You may request access to, or correction of, the personal information we hold about you by contacting us using the details in section 17. We will respond within a reasonable period, usually within 30 days. We may need to verify your identity before responding.

We may refuse access or correction in the limited circumstances permitted by the Privacy Act, including where providing access would prejudice an investigation or where we are prohibited from disclosing the information under the AML/CTF Act. If we refuse, we will tell you why, unless it would be unlawful to do so.

We do not charge for making a request, but we may charge a reasonable fee for providing access where permitted by law. You can also update some of your information through your account settings.

We take reasonable steps to ensure that the personal information we collect, use and disclose is accurate, up to date, complete and relevant, having regard to the purpose for which it is handled. We encourage you to notify us promptly of any changes to your personal information.

If you have a concern about how we have handled your personal information, please contact our Privacy Officer using the details in section 17. We will acknowledge your complaint within 7 days and aim to resolve it within 30 days.

If you are not satisfied with our response, you may lodge a complaint with the OAIC at www.oaic.gov.au or on 1300 363 992.

The Platform is not directed to persons under 18, and we do not knowingly collect personal information from them. If you believe we have collected personal information from a person under 18, please contact us.

The Platform may contain links to third-party websites. We are not responsible for the privacy practices of those websites. We encourage you to read the privacy policy of every website you visit.

Our apps run on third-party software platforms, for example, Apple’s iOS platform which powers Apple’s iPhone, and Google’s Android platform which powers Android-based smartphones. Your use of our apps is also subject to the relevant mobile app platform provider’s terms and conditions and privacy policy. You should review their terms and conditions and privacy policy to ensure you understand the kinds of data (if any) they will gather about you, how they will use that data, and what you may be able to do if you are unhappy about it.