Privacy Policy

Projekt Agency Pty Ltd ACN 675 745 614 trading as ComplyIQ (we, us and our) is a provider of AML/CTF compliance software solutions (Software) for licensed gaming venues (Venues). This Privacy Policy explains how we collect, use, disclose and hold personal information, and how to contact us if you have any queries about personal information that we hold.

What is personal information?

'Personal information' is information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information or opinion is true or not and whether the information or opinion is recorded in a material form or not. Examples include an individual's name, address, contact number and email address.

'Sensitive information' is a special category of personal information. Sensitive information includes information or an opinion about an individual's racial or ethnic origin; political opinions, religious or philosophical beliefs or affiliations; memberships of trade union, trade or professional association; sexual orientation or practices; criminal record; health information, genetic or biometric information, or biometric templates.

We do not intentionally collect sensitive information. However, in the course of providing our Software, Venues may disclose information that reveals whether a Patron is a Politically Exposed Person (PEP) or appears on a government sanctions list. This information is collected and processed as authorised under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) (AML/CTF Act). This screening is carried out internally against a licensed dataset we host, and patron information is not sent to the dataset provider for this purpose. We do not collect biometric information or criminal record information.

How we collect personal information

We collect personal information about you directly from:

• Venues via our Software. Venues are solely responsible for the collection of personal information from their customers (Patrons), which is then disclosed to us through our Software;
• for identity verification, the result of a match against the records of the government agency that issued the document, provided through a gateway provider. This result confirms only whether the details match and does not return document data to us. Politically exposed person and sanctions screening is performed internally against a licensed dataset we host, and does not involve collection of personal information from a third party; and
• government agencies and publicly available registers that we rely on for verification and compliance purposes.

We may also collect personal information from you when you engage with us directly, such as when you subscribe to our mailing list or contact us.

The kinds of personal information we collect and hold

We collect and hold a range of personal information in carrying out our business as an AML/CTF compliance software provider.

The kinds of personal information we collect and hold will depend upon the nature of our relationship with you and the circumstances of a collection, including whether we collect the information from Venues, or from you as a supplier, contractor, job applicant or in some other capacity.

For example, we may collect:

• from representatives of Venues, the name, contact details and title of the representative, the Venue name, ABN, liquor and gaming licence details, and the full name and contact information of that Venue's Compliance Officer;
• in respect of Patrons, the personal information provided to the Venue which the Venue uploads to the Software, which may include:
• 'Know Your Customer' data including full name, date of birth, address, telephone number, email address, and government-issued ID details;
• copies or details of identity documents provided for AML/CTF verification purposes;
• payout and transaction records, including amounts, payment methods and frequency;
• any other information used to assess and monitor potential money laundering or terrorism financing risks;
• in respect of Patrons, the result of identity verification checks received through the gateway provider and the issuing government agency, and the results of PEP and sanctions screening we perform internally;
• IP addresses, login timestamps, and audit logs of actions taken within the Software;
• any other information you provide to us when you make an inquiry, request information, submit an order, provide feedback or correspond with us; and
• if you deal with us in some other capacity, your name and contact details and any other information you choose to provide to us.

If you provide us with personal information about another person, please make sure that you tell them about this privacy policy.

If you are or become our employee, the handling of your personal information may be exempt from the APPs if it is directly related to your current or former employment relationship with us.

The purposes for which we collect, hold, use and disclose personal information

We collect, hold, use and disclose personal information for a range of purposes including:

• if you are a Patron or representative of a Venue, to supply our products and services (including our Software) to Venues, including to facilitate a Venue's compliance with the AML/CTF Act and related know-your-customer obligations;
• if you are a Patron:
• to generate AUSTRAC-mandated reports (e.g., Suspicious Matter Reports, Threshold Transaction Reports);
• to conduct PEP and sanctions screening checks;
• if you use our Software, to provide technical support;
• for our administrative purposes and internal record keeping;
• to manage our relationships with our customers, suppliers and contractors; and
• if you are a job applicant, for current and future employment purposes.

We may use and disclose your personal information for other purposes required or authorised by or under law (including purposes for which you have provided your consent).

We do not use personal information for direct marketing purposes.

Disclosure of personal information to third parties

In conducting our business, we may disclose your personal information to third parties for the purposes outlined above. These third parties may include, where appropriate:

• in respect of personal information of Patrons:
• Australian government bodies, including AUSTRAC;
• the Venue the Patron is engaging with;
• for identity verification only, the gateway provider and government document verification service used to confirm identity documents. Politically exposed person and sanctions screening is conducted internally, against a licensed dataset that we host within our own environment, and patron personal information is not disclosed to the dataset provider or any other third party for that screening;
• in respect of financial institutions for payment processing;
• our contracted service providers in connection with the services they provide to us, including:
• cloud hosting and data storage providers;
• IT service providers;
• error monitoring and application performance services;
• training and learning management system providers;
• external business advisers (such as auditors and lawyers);
• in the case of a sale of our business (in whole or in part) to the purchaser (as an asset of the business); and
• if you are a job applicant, referees whose details you provide to us.

We may also disclose your personal information to other third parties and for other purposes where we are required or authorised by or under law to do so (including where you have provided your consent).

Overseas disclosures of personal information

All personal information is stored and processed within Australia. Our primary data storage infrastructure is located in the Sydney (ap-southeast-2) region.

Some of our service providers (such as error monitoring and application performance tools) may process limited, non-personal technical data (such as anonymised error reports and performance metrics) on servers located outside of Australia. We do not disclose personal information (such as names, identity documents, or patron records) to overseas recipients.

If our practices change in the future such that personal information may be disclosed to overseas recipients, we will update this Privacy Policy and ensure appropriate safeguards are in place in accordance with the Australian Privacy Principles.

How we hold personal information

We generally hold personal information in computer systems, including computer systems operated for us by our service providers. We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification or disclosure. This includes taking appropriate security measures to protect electronic materials and requiring our service providers to do so. We employ AES-256 encryption at rest and TLS 1.2+ encryption in transit.

Access to personal information within our Software is controlled by role-based access controls, ensuring that users can only access information relevant to their role and responsibilities.

Data retention

The AML/CTF Act requires that certain compliance records must be retained for seven (7) years. We retain the following data collected through our Software for this statutory period:

• Patron identity and verification records;
• transaction and payout records;
• PEP and sanctions screening results;
• Suspicious Matter Reports and related records;
• audit logs and system activity records; and
• Venue administrator account data.

This data is retained for the full seven (7) year period even if a Venue's subscription to our Software is cancelled. After the retention period expires, data will be securely destroyed in accordance with our data destruction procedures.

Job applicant information is retained separately from AML/CTF compliance data. We retain personal information of unsuccessful job applicants for up to 12 months from the date of application, after which it is securely destroyed unless the applicant has consented to longer retention for future opportunities. Personal information of successful applicants becomes part of our employee records.

Our third party data storage providers are required to protect personal information in accordance with applicable laws and take appropriate technical and organisational measures against unauthorised or unlawful use of personal information or its accidental loss, destruction or damage.

Data breach notification

In the event of an eligible data breach (as defined under Part IIIC of the Privacy Act 1988 (Cth)), we will:

• take reasonable steps to contain the breach and mitigate any resulting harm;
• assess whether the breach is likely to result in serious harm to any affected individuals;
• notify the Office of the Australian Information Commissioner (OAIC) and affected individuals as soon as practicable in accordance with our obligations under the Privacy Act 1988 (Cth); and
• keep a record of the breach in our internal data breach register.

Access to and correction of your personal information

You have a right to request access to personal information that we hold about you and request its correction if it is inaccurate, out of date, incomplete, irrelevant or misleading. You may do so by contacting our Privacy Officer at the details below.

We will respond to all requests for access to or correction of personal information within a reasonable period, and will provide access free of charge.

Our website (complyiq.au)

We use cookies on certain web pages of our website and within our Software to help them function efficiently, remember your login session and recognise your device. Cookies allow our systems to remember certain information that will make your use of our services more efficient, such as account information.

If you do not wish to receive a cookie or if you wish to set your browser to tell you each time a cookie is being sent, you can do this using the options in your web browser.

The information collected about your visit to our website using cookies is not personal information, because we cannot identify you from it unless you are logged in. For example, we may record your IP address, the date and time of your visit, the pages you viewed, the page you came from to get to our site, any documents you downloaded and the type of browser and operating system you used. If collected, this information will be used and disclosed by us in anonymous, aggregated form only, for purposes including statistical analysis and website development.

You can read more about the cookies we use and how to set your cookie preference in our Cookie Policy (below).

Cookie Policy

This Cookie Policy explains how ComplyIQ uses cookies and similar technologies on our website (complyiq.au) and within our Software.

What are cookies?

Cookies are small text files that are placed on your device by websites and applications you visit. They are widely used to make websites and applications work more efficiently and to provide information to their operators.

Cookies we use

We use only cookies that are strictly necessary for the operation of our website and Software:

Cookie	Type	Purpose	Duration
Session cookie	Strictly necessary	Maintains your authenticated login session and stores your session token. Essential for the Software to function.	Session or up to 30 days
CSRF token	Strictly necessary	Protects against cross-site request forgery attacks by verifying form submissions originate from our website.	Session
Venue preference	Functional	Remembers your selected venue context so you don't need to re-select it on each page.	Session

Cookies we do not use

We do not use:

• analytics or tracking cookies (such as Google Analytics);
• advertising or marketing cookies;
• third party social media cookies; or
• any cookies that track your browsing activity across other websites.

Managing cookies

Most web browsers allow you to control cookies through their settings. You can usually set your browser to notify you when a cookie is being placed, or to refuse cookies altogether. However, if you disable strictly necessary cookies, some features of our Software may not function correctly.

For more information about cookies and how to manage them, visit allaboutcookies.org.

Complaints

Please contact us (using the contact details below) if you have any concerns or complaints about the manner in which we have collected or handled your personal information. We will inquire into your complaint and respond within a reasonable period of time (usually 30 days). If you are not satisfied with our response, you can contact us to discuss your concerns or lodge a complaint with the Office of the Australian Information Commissioner (oaic.gov.au).

Contact details

If you would like more information about the way we manage personal information, would like to request access to or correction of personal information that we hold about you, or wish to make a complaint, please contact our Privacy Officer by either:

• Email: support@complyiq.au
• Post: PO Box 183, Sylvania Southgate, Sylvania NSW 2224

Changes to our privacy policy

From time to time it may be necessary for us to review and revise our Privacy Policy. We may notify you about changes to this Privacy Policy by posting an updated version on our website. We encourage you to check our website from time to time to ensure you are familiar with our latest Privacy Policy.