Legal

Platform Privacy Policy

This Platform Privacy Policy explains how FrontLine Risk and Compliance Pty Ltd (we, us, our) handles personal information when we operate our websites, applications, software platforms, APIs and related services (together, the Platform).

This policy is intended for a B2B RegTech environment. Our Platform supports anti-money laundering and counter-terrorism financing (AML/CTF) compliance programs and related financial crime risk management workflows.

This policy applies to:

• visitors to our websites;
• users who access the Platform on behalf of our business customers; and
• our business contacts, suppliers and other individuals we interact with in the course of our business.

If you are an individual whose personal information is processed in the Platform on a customer's instructions (for example, you are a customer, beneficial owner, director or counterparty of one of our business customers), see Section 3 (Controller vs Processor) and Section 12 (How to make a request).

1. Key privacy concepts and scope

1.1 Personal information

Personal information means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether true or not, and whether recorded in a material form or not.

1.2 Sensitive information

Sensitive information may include (where applicable): government identifiers, biometric information used for verification, and other categories treated as sensitive under applicable Australian or New Zealand privacy laws.

1.3 The laws we consider

We design our practices to align with:

• the Privacy Act 1988 (Cth) and Australian Privacy Principles (APPs); and
• the Privacy Act 2020 (NZ) and Information Privacy Principles (NZ IPPs),

to the extent each applies to our activities.

2. How we collect personal information

We may collect personal information:

• directly from you (for example, when you contact us, request a demo, sign up for an account, or use the Platform);
• from our business customers (when a customer provisions you as an authorised user); and
• automatically through your use of our websites and Platform (for example, log data, device data, cookies).

3. Our role: controller for Platform operations; processor for customer content

3.1 When we act as controller (Platform operations)

We act as a controller (or equivalent) when we process personal information for our own purposes, including:

• operating our websites and Platform;
• account management for authorised users (e.g. admin console, authentication, access control);
• customer service, troubleshooting, and communications;
• security monitoring and incident response;
• product improvement, analytics, and quality assurance;
• sales, marketing and relationship management; and
• compliance with our legal obligations.

3.2 When we act as processor (customer content)

In many cases, we process personal information on behalf of our customers in the Platform (for example, customer due diligence / know-your-customer workflows, sanctions/PEP screening, investigations case files, audit trails). In those circumstances:

• our customer is typically the controller; and
• we act as a processor and handle the information under the customer's instructions and our contract with the customer (including the Data Processing Addendum in this document).

If you are seeking to exercise rights over information processed on a customer's behalf, you should contact the relevant customer first. We will assist the customer where required by contract and law.

4. Types of personal information we collect and process

The information we handle depends on how you interact with us and how our customers configure and use the Platform.

4.1 Business contact and account information (authorised users)

• name, business email address, business phone number;
• organisation name, role/title, department;
• username, authentication information (e.g. MFA status), access permissions;
• communications with us (support tickets, emails, call notes).

4.2 Platform usage and technical information

• IP address and approximate location derived from IP;
• device identifiers, browser type/version, operating system;
• log data (login events, access times, pages viewed, actions taken);
• security telemetry (alerts, audit logs, session identifiers).

4.3 AML/CTF and compliance-related information (customer content)

Depending on customer instructions and configuration, the Platform may process:

• identity document information (e.g. driver licence, passport, national ID, proof of address);
• verification evidence (images, video, validation outcomes);
• biometric information used for KYC verification (e.g. facial images or facial templates, liveness results), where enabled by the customer and the verification provider;
• customer risk assessments and profiles (CDD/EDD records);
• screening results and potential matches (sanctions, PEP, watchlists) and related decisioning notes;
• adverse media indicators (where enabled);
• beneficial ownership and control information (directors, shareholders, trustees, UBOs);
• source of funds / source of wealth information and financial background information (where provided to support AML/CTF programs);
• investigation case management records, escalations, and audit trail entries.

4.4 Payments and billing (B2B)

• billing contact details;
• invoicing and payment status information;
• bank account details where provided for payment processing (if applicable).

5. Purposes for which we use personal information

We use personal information to:

• provide, administer, maintain and support the Platform;
• authenticate users, manage access, and administer accounts;
• maintain audit trails, logs and evidence relevant to compliance workflows;
• enable our customers' use of AML/CTF screening, monitoring and case management functions (as processor);
• communicate with you (including service notices and support responses);
• improve the Platform (testing, analytics, bug fixes, performance);
• protect the security and integrity of the Platform (fraud prevention, misuse detection, security monitoring);
• manage our business operations (billing, accounting, corporate governance);
• send marketing communications to business contacts where permitted by law, and provide opt-out mechanisms; and
• comply with and respond to legal obligations and lawful requests (including from regulators and law enforcement).

6. Disclosure of personal information

We do not sell personal information.

We may disclose personal information to:

6.1 Our service providers (including sub-processors)

Service providers that support our operations and Platform delivery, including (as applicable):

• cloud hosting and infrastructure providers;
• identity verification / document verification providers;
• biometric and liveness verification providers (where enabled);
• monitoring, logging and analytics providers;
• communications, support and ticketing tools;
• professional advisers (legal, accounting, audit).

We require service providers to handle personal information securely and consistently with their role and our contractual requirements.

6.2 Our customers

Where you are an authorised user, we may disclose information to your organisation's administrators. Where we act as processor, we disclose customer content to the customer and its authorised users.

6.3 Regulators, law enforcement and legal processes

We may disclose personal information where required or authorised by law, including in response to:

• subpoenas, warrants, court orders and other lawful requests; and
• requests from regulators and law enforcement agencies.

6.4 Corporate transactions

If we undergo a merger, acquisition, sale of assets, restructuring, financing, or insolvency, personal information may be disclosed to relevant third parties (e.g. advisers, counterparties) subject to appropriate protections.

7. Overseas disclosures (Australia and New Zealand focus)

We may store or process personal information in Australia, New Zealand, and other locations where our service providers operate.

Where we disclose or make personal information available overseas, we take reasonable steps to ensure appropriate safeguards are in place, including contractual obligations and security controls designed to protect the information in a manner consistent with this policy and applicable laws.

If you want more information about where your information is stored or processed, contact us (Section 13).

8. Data retention (including AML/CTF record-keeping)

We retain personal information only for as long as necessary for the purposes described in this policy, including for security, auditability, dispute resolution and legal compliance.

8.1 AML/CTF-related retention and limits on deletion

Where personal information is processed for AML/CTF compliance functions (including KYC/KYB records, screening results, monitoring records and audit trails), we and/or our customers may need to retain information to satisfy applicable record-keeping obligations and regulatory expectations.

As a result:

• deletion requests may be refused or restricted where retention is required or authorised by law; and
• where we act as processor, retention and deletion are generally determined by the customer's instructions and our contractual arrangements, subject to legal requirements.

9. Security of personal information

We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure.

Measures may include:

• encryption in transit and, where appropriate, encryption at rest;
• role-based access controls and least-privilege principles;
• multi-factor authentication (where enabled/required);
• monitoring, logging and audit trails;
• vulnerability management and secure development practices; and
• staff confidentiality obligations and training.

No method of transmission over the internet is completely secure. You are responsible for maintaining the confidentiality of your access credentials and notifying us if you suspect unauthorised access.

10. Cookies and similar technologies

We may use cookies and similar technologies to operate and improve our websites and Platform. Cookies may be:

• necessary (core functionality and security);
• performance (analytics and measurement);
• functionality (preferences); and
• targeting/advertising (where used).

You can manage cookies through your browser settings. If you disable cookies, some features may not work as intended.

11. Direct marketing (B2B)

We may send marketing communications to business contacts where permitted by law. You can opt out using the unsubscribe function in the message or by contacting us (Section 13). Opting out of marketing does not affect service or security communications.

12. Your rights and how to make a request

12.1 Access and correction

You may request access to personal information we hold about you and request correction if you believe it is inaccurate, out of date, incomplete, irrelevant or misleading.

12.2 Deletion / erasure

You may request deletion where applicable. We may decline or limit deletion requests where we are required or authorised to retain information (including for AML/CTF record-keeping, security logging, legal compliance, or dispute resolution).

12.3 Requests relating to customer content

If your information is processed within the Platform on a customer's behalf, please direct your request to the relevant customer first. We will support the customer to respond where required.

12.4 Identity verification

We may need to verify your identity before responding to a request.

13. Contact us (privacy)

Email: andrew@frontlinecompliance.com.au

14. Changes to this policy

We may update this policy from time to time. If we make changes, we will update the "Last updated" date and may provide notice through our websites or Platform. Continued use after an update indicates acceptance of the updated policy.

Data Processing Addendum (DPA) — Australia / New Zealand

This Data Processing Addendum (DPA) forms part of the agreement between FrontLine Risk and Compliance Pty Ltd (Processor, we, us) and the customer entity that enters into the agreement for the Platform (Customer or Controller).

This DPA applies where we process Personal Information (as defined under applicable privacy laws) on behalf of the Customer in connection with the Customer's use of the Platform (Customer Content).

1. Definitions

In this DPA:

• Applicable Privacy Laws — the Privacy Act 1988 (Cth) and APPs; the Privacy Act 2020 (NZ) and NZ IPPs; and any other privacy, data protection, or confidentiality law applicable to the parties' processing activities.
• Controller / Processor — the roles commonly understood under privacy laws: the Customer determines the purposes and means of processing (Controller), and we process on the Customer's behalf (Processor).
• Customer Content — any data, content or information submitted to or processed in the Platform on the Customer's behalf, including personal information.
• Data Breach — a suspected or actual unauthorised access to, or unauthorised disclosure of, or loss of, personal information that is held by us (or our sub-processors), or any event that meets the threshold for notification under Applicable Privacy Laws.
• Sub-processor — a third party engaged by us to process personal information on behalf of the Customer in connection with the Platform.

2. Scope and roles

2.1 Customer as Controller

The Customer is responsible for:

• determining the purposes and means of processing Customer Content;
• ensuring it has a lawful basis/authority to collect, use and disclose Customer Content to us and through the Platform (including providing required notices); and
• ensuring its instructions comply with Applicable Privacy Laws.

2.2 We act as Processor

We will:

• process Customer Content only on the Customer's documented instructions (including as set out in the agreement and this DPA), unless otherwise required by law; and
• not use Customer Content for our own purposes except to provide, secure, and maintain the Platform, meet legal obligations, and as otherwise permitted in the agreement.

3. Processing details

3.1 Subject matter

Provision of the Platform for regulatory compliance workflows, including AML/CTF-related screening, monitoring, case management, and audit trail functionality as configured by the Customer.

3.2 Duration

For the term of the agreement, and thereafter as required for:

• return/deletion obligations (Section 9); and
• legal compliance, dispute resolution, and security logging, to the extent permitted by law and the agreement.

3.3 Nature and purpose

Processing necessary to provide the Platform, including hosting, storage, transmission, retrieval, use, disclosure (to authorised users), and deletion/return of Customer Content.

3.4 Types of personal information and individuals

Customer Content may include (depending on Customer configuration and use):

• identity documents, verification evidence, and biometric/liveness data (where enabled);
• sanctions/PEP/watchlist screening results and case notes;
• beneficial ownership and control information;
• financial background information relevant to AML/CTF programs; and
• audit logs and investigation records.

Individuals may include the Customer's customers, beneficial owners, directors, authorised signatories, employees, counterparties, and other persons the Customer screens or monitors.

4. Our security measures

We will implement reasonable technical and organisational measures to protect Customer Content against misuse, interference, loss, and unauthorised access, modification or disclosure.

Measures may include:

• encryption in transit and, where appropriate, at rest;
• access controls, least privilege and authentication controls;
• logging and monitoring of Platform activity;
• vulnerability management and secure development practices; and
• staff confidentiality obligations.

5. Personnel confidentiality

We will ensure personnel authorised to process Customer Content are subject to confidentiality obligations (contractual or statutory) and receive appropriate training relevant to their role.

6. Sub-processors

6.1 Authorisation

The Customer authorises us to engage Sub-processors to provide the Platform, including for hosting, support, identity verification, and security operations.

6.2 Sub-processor obligations

We will ensure Sub-processors are bound by written obligations that are materially consistent with this DPA regarding:

• confidentiality;
• security measures; and
• processing only for the purposes of providing services to us for the Platform.

7. Assistance to the Customer

7.1 Individual rights requests

Taking into account the nature of processing, we will provide reasonable assistance to the Customer to respond to requests from individuals to access or correct personal information, or other requests required under Applicable Privacy Laws, to the extent the Customer cannot do so through the Platform.

7.2 Regulatory inquiries

We will provide reasonable assistance to the Customer in responding to inquiries, notices or investigations by regulators relating to Customer Content processed under this DPA, where legally permitted and appropriate.

8. Data Breach notification

We will notify the Customer without undue delay after becoming aware of a Data Breach affecting Customer Content.

Our notice will include, to the extent known and practicable:

• a description of the Data Breach (including categories of information affected);
• the steps taken or planned to contain and remediate the issue; and
• information reasonably requested by the Customer to support legal assessment and any required notifications.

The Customer is responsible for determining whether to notify individuals or regulators, unless Applicable Privacy Laws require us to notify directly.

9. Return or deletion of Customer Content

On termination or expiry of the agreement, and subject to the agreement:

• we will delete or return Customer Content in accordance with the Customer's documented instructions and our standard processes; and
• we may retain Customer Content where required or authorised by law, or where necessary for security logging, dispute resolution, or enforcing our rights, provided we protect any retained information in accordance with this DPA.

10. Cross-border processing

The Customer acknowledges that we and our Sub-processors may process Customer Content in either the Commonwealth of Australia, or the Realm of New Zealand.

We will take reasonable steps to ensure cross-border processing is subject to appropriate protections consistent with this DPA and Applicable Privacy Laws, including contractual and security measures.

11. Audit and information

Upon reasonable written request, we will provide the Customer with information reasonably necessary to demonstrate compliance with this DPA, taking into account:

• confidentiality obligations;
• security requirements; and
• the need to protect other customers' data and our proprietary information.

Any audit rights (including scope, timing, and whether an independent third-party report may be used) are as set out in the parties' agreement.

12. Conflict and order of precedence

If there is a conflict between this DPA and the agreement regarding processing of Customer Content, this DPA prevails to the extent of the conflict, except where the agreement provides greater protection for personal information, in which case the greater protection applies.

13. Contact (DPA)

Privacy contact email: andrew@frontlinecompliance.com.au