Privacy Policy

1. About this policy

This policy explains how Brontech Pty Ltd (ABN 16 613 400 623), trading as bronID, and its related company Brontech, Inc. (United States) (together bronID, we, us, our) collect, hold, use and disclose personal information.

We are bound by the Privacy Act 1988 (Cth) (Privacy Act) and the Australian Privacy Principles (APPs). Where they apply to us, we also comply with the EU General Data Protection Regulation and the UK General Data Protection Regulation (together GDPR) and applicable United States privacy laws.

This policy applies to:

• Clients: businesses that use our identity verification, Know Your Customer (KYC), Know Your Business (KYB) and anti-money laundering and counter-terrorism financing (AML/CTF) services, and their staff.
• Verified Individuals: individuals whose information a Client asks us to verify or screen. This includes a Client's customers and people connected with a Client's customer, such as directors, shareholders, beneficial owners, trustees, partners and authorised representatives.
• Other individuals: visitors to our website, people who contact us, suppliers and job applicants.

2. Our role when we act for Clients

Our Clients are generally reporting entities under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) (AML/CTF Act) and the Anti-Money Laundering and Counter-Terrorism Financing Rules 2025 (AML/CTF Rules), or businesses with similar obligations in other countries. They must identify and verify their customers, screen them, assess their risk and keep records.

When we verify or screen a Verified Individual, we do so on behalf of the Client and under our agreement with that Client. The Client decides why the verification is needed and whether to provide its products or services to the individual. The Client is responsible for giving its customers a collection notice and for obtaining any consent that is required.

If you are a Verified Individual, the Client's own privacy policy also applies to you. For most questions and requests about your verification, please contact that Client first. We will help the Client respond.

3. Personal information we collect

Verified Individuals. Depending on the checks a Client requests, we may collect:

• identity details: full name, former names, date of birth, residential address, phone number and email address;
• identity documents and their details, such as a driver licence, passport, Medicare card, visa, birth or citizenship certificate, or a foreign identity document, including document numbers, expiry dates and images of the document;
• a selfie photograph or video, liveness test results and a biometric comparison between your face and your identity document;
• your role in an entity, such as director, shareholder, beneficial owner, trustee, settlor, beneficiary or partner, and your ownership or control interest;
• screening results: whether you appear on a politically exposed person (PEP) list, a sanctions list or in adverse media, and the content of any match;
• tax and source of funds or wealth information, where a Client asks us to collect it;
• risk ratings and verification results that we generate; and
• technical information from the verification session, such as IP address, device and browser type, and date and time.

Entities (KYB). We verify companies, trusts, self-managed superannuation funds (SMSFs), partnerships, associations, cooperatives, charities and other not-for-profit bodies, sole traders, government bodies and foreign entities. To do this, we may collect documents that establish the entity or show who owns and controls it, including:

• trust deeds, deeds of variation, and deeds of appointment or retirement of trustees;
• certificates of incorporation or registration, company constitutions, and company and business register extracts;
• partnership agreements, and the rules or constitution of an association or cooperative;
• share and unit registers, members' registers, and nominee or bare trust declarations; and
• other establishment, ownership and authorisation documents, such as board resolutions and powers of attorney.

These documents often contain personal information about individuals connected with the entity, such as trustees, appointors, settlors, beneficiaries, members, directors, shareholders and office bearers. This can include their names, addresses, dates of birth, signatures and interests in the entity.

Clients and their staff. Name, job title, work contact details, account login details, records of how you use our platform, and our communications with you. Payments are handled by a third-party payment processor. We do not hold payment card details.

Other individuals. Information you give us when you make an enquiry, subscribe to updates, apply for a job or deal with us as a supplier, and website usage information described in section 19.

4. How we collect personal information

We collect personal information:

• directly from you, when you complete a verification form, upload a document, take a selfie or contact us;
• from the Client that asked us to verify you, including through our API;
• from another person involved in the same application, for example a company representative who gives us details of the company's directors and beneficial owners, or a trustee who uploads a trust deed naming the beneficiaries;
• from document issuers and official record holders, including through the Australian Government's Document Verification Service (DVS);
• from public registers and government bodies, such as ASIC, the Australian Business Register, the ACNC and equivalent registers overseas;
• from commercial identity, company, watchlist and adverse media data providers;
• from credit reporting bodies, where permitted by law (see section 8); and
• from publicly available sources.

If we collect your information from someone else, we rely on the Client or the person providing it to tell you and, where required, to obtain your consent.

5. Sensitive information and biometrics

Some of the information we handle is sensitive information under the Privacy Act:

• Biometric information. Where a Client requests a biometric check, we collect a selfie image or video, run a liveness test and compare your face with the photo on your identity document. We do this only with your consent, which we ask for before the check starts. We use this information only to verify your identity and detect fraud.
• Screening information. PEP, sanctions and adverse media screening may reveal information about political opinions or associations, criminal records or alleged offences.

If you do not consent to a biometric check, tell the Client. The Client may be able to offer another way to verify your identity.

6. Why we collect, hold, use and disclose personal information

We handle the personal information of Verified Individuals to:

• verify the identity of individuals, and the existence, structure, ownership and control of companies, trusts, SMSFs, partnerships, associations and other entities;
• identify beneficial owners and other people connected with an entity;
• carry out biometric and liveness checks;
• screen against PEP and sanctions lists and adverse media;
• produce risk ratings, verification results and reports for the Client;
• help Clients meet their customer due diligence, ongoing monitoring and record-keeping obligations under the AML/CTF Act and AML/CTF Rules, and similar laws overseas;
• detect and prevent fraud and misuse of our services;
• maintain, secure, test and improve our services; and
• comply with our own legal obligations and respond to lawful requests from regulators, courts and law enforcement bodies.

We handle the personal information of Clients, their staff and other individuals to provide and administer our services, manage accounts and billing, provide support, respond to enquiries and complaints, send service and marketing communications (see section 18), assess job applications and run our business.

We do not sell personal information. We do not use the personal information of Verified Individuals for marketing.

If we do not receive the information we ask for, we may be unable to complete a verification. The Client may then be unable to provide its products or services to you.

7. Document Verification Service and government identifiers

Brontech Pty Ltd is an approved ID Service Provider for the DVS, a service of the Australian Government operated under the Identity Verification Services Act 2023 (Cth). The DVS checks whether the details on an identity document match the records held by the document issuer or official record holder.

Before a DVS check, we and the Client will ask for your express consent to your identity document details being accessed, collected, used and disclosed by us, our approved gateway service provider and the Client, and checked with the document issuer or official record holder, through the DVS and third-party systems and services, for the purpose of confirming your identity. You will also be asked to confirm that you are authorised to provide the document details. We keep a record of your confirmation and consent. If you do not consent, we will not run the DVS check. Please ask the Client whether another verification method is available.

The DVS tells us only whether the details match. It does not give us a copy of the issuer's record. We do not disclose the DVS match result to the Client. We give the Client an overall identity verification result that is based on several checks, which may include the DVS check. We use DVS results only to provide this service to the Client that requested the check.

Why we collect this information. Clients must verify their customers' identity under the AML/CTF Act and AML/CTF Rules. Our use of the DVS is governed by the Identity Verification Services Act 2023 (Cth), our DVS participation agreement and the Privacy Act.

Limits on use. We do not use or disclose identity document details collected for a DVS check to build a profile of you or track your behaviour, to offer, advertise or promote goods or services, to enable anyone else to do so, or for market research. Where a check uses address details from the Australian Electoral Commission, we use them only for purposes permitted by the Commonwealth Electoral Act 1918 (Cth) and the AML/CTF Act.

Retention of DVS results. Despite section 12, once the purpose of a DVS check has been fulfilled we take reasonable steps to destroy or de-identify the personal information in the DVS match data, unless a law or a court or tribunal order requires us to keep it. We keep records of our use of the DVS, including records of your consent, for at least 7 years.

Your rights and complaints. You can access and correct your information as set out in section 15, and complain about how your information was handled for a DVS check as set out in section 21.

Security incidents. If a security breach involving a DVS check is likely to result in serious harm to you, we will take reasonable steps to notify you.

We do not adopt a government related identifier, such as a driver licence, passport or Medicare number, as our own identifier for you. We use and disclose these identifiers only where reasonably necessary to verify your identity or where required or authorised by law.

Information about how the Attorney-General's Department operates and manages the DVS is available at idmatch.gov.au.

8. Credit reporting bodies

Where a Client is a reporting entity and requests it, we may ask a credit reporting body to verify your identity, as permitted by the AML/CTF Act. We do this only with your express consent. We give the credit reporting body your name, residential address and date of birth, and it tells us whether those details match its records.

This is not a credit check or a credit application. We do not receive your credit report and the result is not used to assess your creditworthiness. If your identity cannot be verified this way, the Client will tell you and offer another method.

If you do not consent, ask the Client about another way to verify your identity.

9. Automated decision-making

We use computer programs to carry out verification and screening checks. The results can significantly affect you, because a Client relies on them when deciding whether to open an account for you or provide a product or service.

• Database matching for KYC
  • What the program does: compares your details with the DVS, credit reporting bodies and other identity data sources, and returns a match or no match.
  • Personal information used: name, date of birth, address, identity document details.
• Database matching for KYB
  • What the program does: compares entity and officeholder details with company, business and charity registers.
  • Personal information used: names and roles of directors, shareholders, trustees and other associated individuals.
• Identification of beneficial owners
  • What the program does: analyses ownership and control information to identify individuals who own or control an entity.
  • Personal information used: names, ownership percentages, roles and relationships.
• Biometric matching and checks
  • What the program does: runs a liveness test and compares your selfie with the photo on your identity document.
  • Personal information used: selfie image or video, identity document image, biometric comparison results.
• PEP and sanctions screening
  • What the program does: compares your details with PEP and sanctions lists and flags potential matches.
  • Personal information used: name, date of birth, nationality, country of residence.
• Adverse media screening
  • What the program does: searches media sources for reports that may relate to you and flags potential matches.
  • Personal information used: name, date of birth, country of residence.
• Risk rating
  • What the program does: calculates a risk rating from the results of the checks above and the risk settings chosen by the Client.
  • Personal information used: verification and screening results, country, entity type, role.

Decisions made solely by a computer program. Where every check required by the Client's settings is satisfied, our platform can issue a verification result, including a result that you or an entity is verified, and a risk rating, without review by a person.

Decisions where a computer program substantially assists. Where a check does not match, a potential PEP, sanctions or adverse media match is flagged, or a case does not meet the conditions for automatic verification, the program's output is reviewed by our staff or the Client's staff before a result is finalised.

In every case, the Client decides whether to provide its products or services to you. If you believe an automated result is wrong, you can ask the Client, or us, for the result to be reviewed by a person and for your information to be corrected.

10. Who we disclose personal information to

We disclose personal information only as needed for the purposes in section 6. Recipients are:

• the Client that requested the verification, and anyone the Client instructs us to disclose it to;
• document issuers and official record holders, including through the DVS;
• credit reporting bodies, where section 8 applies;
• identity, company register, watchlist and adverse media data providers that we use to run checks;
• our related companies, Brontech Pty Ltd and Brontech, Inc.;
• service providers that support our operations, including Google Cloud Platform for hosting, and providers of communications, analytics, security testing and professional advice;
• regulators, courts and law enforcement bodies, where required or authorised by law; and
• a buyer or successor of all or part of our business, subject to confidentiality and this policy.

We require our service providers to protect personal information and to use it only for the service they provide to us.

11. Where information is stored and overseas disclosure

We store personal information on Google Cloud Platform in data centres located in Australia and the United States.

We may also disclose personal information to recipients in other countries where this is needed to complete a verification. This happens when:

• your identity document was issued overseas, or you live overseas, and the check must be run with a data source in that country;
• an entity is registered or operates overseas, and we need to search a register or data source in that country; or
• a data provider we use for identity, PEP, sanctions or adverse media checks processes the request outside Australia.

The countries involved depend on the document, individual or entity being verified, so it is not practicable to list every country. They will usually be the country that issued your document, the country where you live, or the country where the entity is registered. Outside Australia, our data providers are currently located in the United Kingdom, the European Union, the United States, Singapore and New Zealand.

Before we disclose personal information overseas, we take reasonable steps to ensure the recipient handles it consistently with the APPs. These steps include contractual obligations on our providers, unless an exception under the Privacy Act applies, such as your informed consent or a disclosure required or authorised by law.

12. How long we keep personal information

The AML/CTF Act requires our Clients to keep customer due diligence records for 7 years after their business relationship with the customer ends. We hold verification records on behalf of Clients so that they can meet this obligation.

We keep the personal information of Verified Individuals, including identity documents, selfies, liveness and biometric results, screening results and risk ratings, for the longer of:

• the term of our agreement with the Client that requested the verification; and
• 7 years from the date the verification was completed.

A Client can instruct us to delete this information earlier. If it does, we delete it in line with the instruction, and the Client remains responsible for its own record-keeping obligations.

When the retention period ends, or when a Client instructs us to delete information, we securely destroy or de-identify it, unless a law or a court or tribunal order requires us to keep it. Copies in backups are overwritten in line with our backup cycle.

We keep the personal information of Client staff and other individuals for as long as we need it for the purposes in section 6 and to meet our legal obligations, and then destroy or de-identify it.

If you are a Verified Individual and want your information deleted, please contact the Client. We act on the Client's instructions and cannot delete records a Client is legally required to keep.

13. Security

We take reasonable technical and organisational measures to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. Our information security management system is certified to ISO/IEC 27001. Our measures include:

• encryption of data in transit and at rest;
• role-based access controls, multi-factor authentication and logging of access;
• hosting in secured Google Cloud Platform data centres;
• regular independent penetration testing and vulnerability management;
• security and privacy training and confidentiality obligations for staff; and
• due diligence and contractual security requirements for service providers.

No system is completely secure. If you think your information or your account has been compromised, contact us immediately.

14. Data breaches

We have a data breach response plan. If a data breach involving personal information we hold is likely to result in serious harm, we will notify the affected individuals and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme in the Privacy Act. Where the breach involves Client data, we will also notify the Client and work with it on the response.

15. Access and correction

You can ask for access to the personal information we hold about you, and ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading. Contact us using the details in section 23. We will need to confirm your identity first.

If you are a Verified Individual, we may refer your request to the Client that requested your verification, or respond together with it.

We will respond within 30 days. We do not charge for making a request. We may refuse access where the Privacy Act or another law allows or requires it, for example where giving access would be unlawful, would prejudice the prevention or detection of unlawful activity, or would breach the tipping off provisions of the AML/CTF Act. If we refuse, we will tell you why in writing, unless the law prevents us, and how to complain.

16. Individuals in the European Economic Area and the United Kingdom

We have no establishment in the European Economic Area (EEA) or the United Kingdom. Some Verified Individuals live there. Where the GDPR applies to our handling of your personal information:

• Our role. For Verified Individuals, the Client is the controller and we are its processor. For Client staff and website visitors, we are the controller.
• Legal bases. As controller, we rely on performance of a contract, our legitimate interests in running and securing our business, compliance with legal obligations, and consent where required. Clients generally rely on their legal obligations under AML/CTF laws, and on explicit consent for biometric information where required.
• Your rights. You may have the right to be informed, to access, correct or erase your information, to restrict or object to processing, to data portability, to withdraw consent, and not to be subject to a decision based solely on automated processing without the safeguards the GDPR provides. Some rights are limited where information must be kept under AML/CTF laws.
• Transfers. Your information is transferred to Australia and the United States. Where required, we rely on standard contractual clauses or another transfer mechanism recognised under the GDPR.
• Complaints. You can complain to the data protection authority in your country.

If we are the processor, please send your request to the Client. We will assist the Client to respond.

17. Individuals in the United States

Brontech, Inc. provides services to Clients in the United States. We do not sell personal information and do not share it for cross-context behavioural advertising. Where a United States federal or state privacy law gives you rights over information we hold, such as rights to know, access, correct or delete, you can exercise them using the contact details in section 23, and we will not discriminate against you for doing so. Where we hold your information on behalf of a Client, we will refer your request to that Client.

Where we collect biometric information from an individual in the United States, we do so only with consent, use it only to verify identity and prevent fraud, do not sell or profit from it, and keep and destroy it as set out in section 12.

18. Direct marketing

We may send Clients and people who have enquired about our services information about our products, services and events. You can opt out at any time by using the unsubscribe link in the message or by contacting us. We do not send marketing to Verified Individuals and do not disclose personal information to third parties for their marketing.

19. Website and cookies

Our website uses cookies and Google Analytics to understand how visitors use the site. This collects information such as your IP address, browser and device type, pages visited and referring website. We use it in aggregated form to improve the site. You can block cookies in your browser settings or install the Google Analytics opt-out browser add-on. Some features may not work if you block cookies.

Our website may link to other websites. We are not responsible for their privacy practices.

20. Anonymity and pseudonymity

You can make a general enquiry without identifying yourself. It is not practicable for us to verify identity anonymously or under a pseudonym, and Clients are required by law to identify their customers.

21. Complaints

If you think we have breached the Privacy Act, the APPs or this policy, please write to us using the details in section 23. We will acknowledge your complaint within 7 days and respond within 30 days. If we need more time, we will tell you why.

If you are not satisfied with our response, you can complain to the OAIC:

• Website: www.oaic.gov.au
• Phone: 1300 363 992
• Post: GPO Box 5288, Sydney NSW 2001

22. Changes to this policy

We review this policy regularly and update it when our practices or the law change. The current version is always available at www.bronid.com/legal/privacy-policy, with the date it was last updated. We will notify Clients of material changes.

23. Contact us

Attn: Privacy Officer

Brontech Pty Ltd (trading as bronID)

Suite 207, 368 Sussex Street, Sydney NSW 2000, Australia

Email: info@bronid.com

A copy of this policy is available free of charge on request, in another form if you need one.