This policy explains how CertusAML Pty Ltd (ABN 43 702 436 824) ("CertusAML", "we", "us") handles personal information. It covers this website, its demo request form, and personal information handled through the CertusAML customer due diligence platform. We handle personal information in accordance with the Australian Privacy Principles in the Privacy Act 1988 (Cth).
Contact us
For privacy questions, access or correction requests, or complaints, email support@certusaml.com.au with "Privacy" in the subject line. We are based in Melbourne, Victoria, Australia.
Part A: Our website and demo requests
Information we collect
When you request a demonstration, we collect your name, email address, company name, phone number, industry, and any additional details you choose to include. When you email us, we collect your email address and the content of your message. Our hosting provider also records basic technical information needed to operate and protect the website, such as IP addresses, request times, and spam-filtering signals.
This website does not use analytics, advertising, or tracking cookies.
Why we collect it
We use this information to respond to your enquiry, arrange and prepare for a demonstration, follow up about CertusAML, and keep a record of our business conversation. We do not add you to a marketing email list unless you ask us to, and every marketing email will include a way to unsubscribe.
Please do not send customer identity documents, client onboarding information, passwords, or other sensitive case material through the demo form or by email.
Service providers and overseas disclosure
This website is hosted on Netlify, and demo requests are handled through Netlify Forms. Netlify may store and process this information in the United States and other countries where it operates. We do not sell personal information.
Retention
We keep enquiry information for up to two years after our last contact with you, unless it becomes part of a customer relationship or we need it longer to meet legal obligations or resolve a dispute.
Part B: The CertusAML platform
Our role
CertusAML provides software that helps Australian businesses (our customers) carry out customer due diligence under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth). When a business uses CertusAML to verify its own clients, that business decides what information is collected and why, and it remains responsible for its own privacy obligations. We handle that information on the business's behalf, under our agreement with it and in line with this policy.
If you are a client of one of our customers, you can also contact that business directly about how it handles your information.
Our customers' accounts and billing
For each business that uses CertusAML, we hold the business's name and ABN, billing contact details, plan, usage counts, and invoices. If we introduce card payments, card details will be handled by our payment provider; we will not store full card numbers.
Information handled through the platform
- Customer staff: names, work email addresses, roles, and sign-in and session records, including IP addresses and browser details, and a record of the actions they take in the platform.
- Clients being verified: name, date of birth, contact details, residential country, and transaction details.
- Identity verification: details from an Australian driver's licence or passport, images of the document where it is scanned or photographed, and the verification result. Document details are compared with Australian records.
- Screening: results of politically exposed person (PEP), sanctions, and adverse-media screening, including source references.
- Due diligence: source of funds and source of wealth explanations, supporting documents, risk assessments, staff reviews, and business decisions.
Sensitive information
The verification methods currently offered do not use face matching, liveness checks, or other biometric information. If we introduce a method that does, we will collect biometric information only with the individual's specific consent, recorded before the check begins, and we will update this policy first.
Screening results can indicate that a person is a politically exposed person. We handle this only for anti-money laundering purposes.
Service providers and where information is stored
- Fly.io hosts the CertusAML application and its databases in Sydney, Australia.
- Amazon Web Services stores supporting documents and business logos in its Sydney, Australia region.
- Didit performs identity document checks and politically exposed person (PEP), sanctions, and adverse-media screening. Didit processes and stores identity document information in the European Union. CertusAML keeps the structured results.
- AppSignal monitors the platform for errors and performance problems. It receives technical error information, with personal details removed before it is sent, and stores it in the Netherlands.
We require our service providers to protect personal information and use it only to provide their services to us.
Automated processing and decisions
The platform uses personal information, including transaction details, residential country, and verification and screening results, to calculate risk scores and bands and to select which checks a client should complete. These outputs help our customers' staff make decisions. The platform does not decide on its own whether to accept or decline a client: an authorised person at the business reviews the evidence and makes that decision.
Other disclosures
We may also disclose personal information:
- to regulators, law enforcement agencies, courts, or tribunals where we are required or authorised by law to do so;
- to our professional advisers, such as lawyers and accountants, under a duty of confidentiality; and
- to a prospective buyer or successor if CertusAML or its business is sold or restructured, subject to confidentiality obligations.
We do not sell personal information.
Retention
AML/CTF laws require our customers to keep certain customer due diligence records, generally for seven years. We keep platform records for as long as our agreement with the relevant business requires, and then delete or de-identify them when they are no longer needed and deletion is legally permitted.
Security and data breaches
We use administrative, technical, and physical measures to protect personal information, including access controls, encryption of sensitive fields, and restricting identity documents to our verification provider. No online service can guarantee absolute security. If a data breach is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme.
Access and correction
You can ask to access or correct personal information we hold about you by emailing support@certusaml.com.au. We may need to verify your identity first. If your information was collected by one of our customers, we may refer your request to that business. We will respond within 30 days.
Complaints
If you believe we have breached the Australian Privacy Principles, email support@certusaml.com.au with details of your concern. We will acknowledge your complaint, investigate it, and respond in writing within 30 days. If you are not satisfied with our response, you can complain to the OAIC at oaic.gov.au or by calling 1300 363 992.
Changes to this policy
We will update this policy when our services, service providers, or legal obligations change. The date above shows the current version.