QuickAML Logo

QuickAML Privacy Policy

1. Our Commitment to Privacy

QuickAML (“QuickAML”, “we”, “us”, or “our”) is committed to protecting the privacy of our Users and their clients. We manage personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

This policy outlines how we collect, use, disclose, store, and safeguard personal information across our compliance platform.

2. Information We Collect

To provide our compliance services, we collect the following categories of information:

2.1 User Information: Name, email address, business name, Australian Business Number (ABN), contact details, and account credentials.

2.2 Identity Verification Data (KYC/CDD): For AML/CTF compliance services, we facilitate the collection of:

  • Government-issued identification documents (e.g., driver’s licence, passport, national healthcare cards)
  • Biometric data, including facial images (selfies) captured during identity verification
  • Dates of birth and residential addresses
  • Beneficial ownership details
  • Screening results (sanctions, PEPs, adverse media)

Biometric Information (APP 3, Sensitive Information): Identity verification is performed via secure, third-party identity verification service providers. During verification, our partner may collect biometric data (such as a selfie image and facial scan of an ID document). We collect this sensitive information only with express consent and where reasonably necessary to fulfill compliance obligations under the AML/CTF Act 2006 (Cth). Without consent, verification cannot proceed.

2.3 Usage and Technical Data: IP addresses, device identifiers, browser type, log data, and interaction metadata. Usage data is aggregated or de-identified where reasonably practicable.

3. Purpose of Collection

We collect and use personal information strictly for:

  • Service Delivery: Generating AML/CTF programs and facilitating identity verification and risk assessment workflows.
  • Compliance: Fulfilling statutory obligations under the AML/CTF Act 2006 (Cth), including mandatory record-keeping.
  • Communication: Sending service updates, system notices, and regulatory alerts.
  • Platform Improvement: Analysing usage patterns to enhance AI-driven guidance and workflows.
  • Legal and Security: Preventing fraud, unauthorized access, and unlawful activity.

4. Disclosure of Personal Information

We do not sell or rent personal information. Disclosures are limited to:

  • AUSTRAC: Where required under regulatory, examination, or statutory reporting powers.
  • Identity Verification Partners: Certified third parties (maintaining SOC 2, ISO 27001, or equivalent frameworks) providing automated biometric verification and document authentication.
  • Screening Providers: Services that cross-reference customer details against international sanctions, PEP lists, and adverse media databases.
  • Infrastructure Providers: Secure cloud hosting facilities located primarily in Sydney, Australia.
  • Professional Advisers & Legal Mandates: Legal or financial advisers where reasonably necessary, or when compelled by a valid court order, warrant, or law enforcement agency.

5. Data Residency and Overseas Disclosure

5.1 Australian Storage: Core compliance records and customer data are primarily hosted on secure servers located in Sydney, Australia.

5.2 Overseas Disclosure (APP 8): Certain third-party processing (such as automated biometric verification or global sanctions screening) may occur on secure servers outside Australia (e.g., European Union, United Kingdom, or United States). Where cross-border disclosure occurs, individuals acknowledge that overseas recipients may not be subject to the APPs, though QuickAML takes reasonable contractual steps to ensure comparable data protections.

6. Data Retention and Deletion

Personal information is retained only as long as required to:

  • Satisfy statutory obligations under the AML/CTF Act 2006 (Cth), including mandatory 7-year record retention requirements;
  • Resolve disputes and enforce binding agreements;
  • Maintain security and audit integrity.

Data no longer required is securely destroyed or permanently de-identified.

7. Data Security Measures

We implement rigorous technical and organizational controls:

  • End-to-end encryption at rest and in transit
  • Multi-Factor Authentication (MFA)
  • Role-based access controls
  • Tamper-proof audit logging with hash chain integrity
  • Monitored cloud infrastructure and routine vulnerability assessments

8. Notifiable Data Breaches (NDB Scheme)

In the event of an eligible data breach likely to cause serious harm, QuickAML will assess the incident within 30 days pursuant to Part IIIC of the Privacy Act 1988 (Cth), notify affected individuals, and alert the Office of the Australian Information Commissioner (OAIC) with recommended mitigation steps.

9. Access and Correction (APP 12 & 13)

Individuals may request access to, or correction of, personal information held by QuickAML by login into the Platform or contacting our privacy team at info@quickaml.com.au.

10. Direct Marketing (APP 7)

We may send operational or regulatory updates. Users can opt out of non-essential marketing communications at any time via the unsubscribe link or direct inquiry.

11. Automated Decision-Making

Where automated systems or AI assist in significant decisions, QuickAML provides transparency regarding processing logic and maintains mechanisms for human review upon request.

12. Role as a Service Provider

QuickAML operates as a service provider to Reporting Entities (e.g., real estate agents, conveyancers, accountants). In processing client information, QuickAML acts on the instructions of the Reporting Entity, which remains responsible for lawful collection and consent.

13. Technical Tracking, Minors, and Policy Updates

  • Cookies: Only essential session and authentication cookies are utilized. No third-party ad trackers are deployed.
  • Minors: QuickAML is strictly intended for business use by individuals aged 18 and over.
  • Policy Changes: Material changes are communicated via in-app alerts or email.

14. Contact and Complaints

For questions, access requests, or privacy concerns: