Privacy Policy

1. Introduction

Trancher Pty Ltd (ABN 55 695 101 092) (we, us, our, the Company) is committed to protecting the privacy of individuals whose personal information we handle.

This Privacy Policy explains how we collect, use, hold, disclose, and otherwise manage personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

This Privacy Policy applies to personal information collected through our software-as-a-service compliance platform and related services (Platform), our website, and our interactions with clients, prospective clients, suppliers, and other individuals.

By accessing or using the Platform or otherwise interacting with us, you acknowledge that you have read and understood this Privacy Policy.

2. About our Platform

We provide a cloud-based compliance software platform designed to assist businesses to understand, manage, and demonstrate compliance with regulatory requirements, including anti-money laundering and counter-terrorism financing (AML/CTF) obligations.

Our Platform assists businesses to:

• assess regulatory obligations and compliance risks
• conduct customer identification and verification (KYC/KYB)
• perform AML/CTF risk assessments
• maintain compliance programs and policies
• conduct sanctions and politically exposed person (PEP) screening
• monitor and document compliance activities
• generate audit trails and regulatory documentation
• access compliance training and guidance materials

3. Our role when handling Personal Information

Depending on the circumstances, we may handle personal information in different roles:

A. Platform user information

Where we collect personal information about individuals who use our Platform (such as account holders and authorised users), we act as the organisation responsible for that personal information.

B. Client data processed through the Platform

Our clients may upload or process personal information about their own customers, employees, beneficial owners, or other third parties through the Platform for compliance purposes. In these circumstances, we generally act as a service provider processing personal information on behalf of our client, and the client is responsible for ensuring that the collection and use of that information complies with applicable privacy laws.

Where our clients provide us with personal information about third parties (such as customers, employees, contractors, beneficial owners, or other individuals) in the course of using the platform, the client is responsible for ensuring that they have the legal right to collect, use, and disclose that information to us and that any required privacy notices or consents have been provided.

4. What is Personal Information

Personal information means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information or opinion is true or not and whether it is recorded in a material form or not.

Sensitive information is a subset of personal information and includes information such as racial or ethnic origin, political opinions or associations, religious beliefs, trade union membership, sexual orientation, criminal record information, health information, and biometric information. We only collect sensitive information where permitted by law.

5. Personal Information we collect

We only collect personal information that is reasonably necessary for our business operations and the services we provide. The types of personal information we collect depend on your relationship with us.

5.1 Platform Users

When individuals access or use the Platform on behalf of a business client, we may collect:

• full name
• job title or role
• business contact details (email, phone, address)
• account credentials and authentication information
• username and encrypted password
• IP address and device identifiers
• browser and operating system information
• platform activity logs and usage data
• communications, support requests, or feedback
• billing and payment information (processed via third-party payment providers)

5.2 Personal Information processed on behalf of clients

Our clients may upload or input personal information about individuals for compliance purposes. This may include:

• full name and date of birth
• residential address and contact details
• nationality or citizenship
• identification numbers (such as passport or driver licence numbers)
• copies of identification documents
• beneficial ownership information
• source of funds or wealth information
• sanctions screening results
• politically exposed person (PEP) status
• transaction data or financial information
• other information required for AML/CTF due diligence

In some circumstances, we may collect sensitive information where this is reasonably necessary to provide regulatory or compliance services.

This may include information relating to politically exposed persons, sanctions screening results, or criminal record information relevant to anti-money laundering or counter-terrorism financing risk assessments.

We only collect sensitive information where:

• the individual has consented to the collection
• the collection is authorised or required by law
• the information is reasonably necessary for providing our services

Some information may be collected where required to support compliance with the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) and related regulatory obligations.

5.3 Information collected automatically

When you use our Platform or website, we may automatically collect certain information, including:

• IP address
• approximate geolocation (country or city level)
• browser type and version
• device type and operating system
• pages viewed and features accessed
• referring URLs
• time spent on the Platform
• system logs, diagnostic data, and error reports

6. How we collect Personal Information

We collect personal information in a number of ways, including:

• directly from you when you create an account or contact us
• when your employer or organisation provides your details to us
• through your use of the Platform
• through cookies and similar technologies
• from publicly available sources
• from identity verification providers and sanctions screening databases
• from government registers or regulatory databases
• from third-party integrations connected to the Platform
• from professional advisers or service providers assisting us

Where reasonable and practicable, we collect personal information directly from the individual concerned, however, this will not be possible in most situations when our clients use our platform.

If you do not provide certain personal information, we may be unable to provide you with our services, respond to your enquiries, or fulfil our legal obligations.

7. Unsolicited Personal Information

If we receive personal information that we did not request, we will determine whether we could have collected the information lawfully. If we could not have collected it, we will take reasonable steps to destroy or de-identify the information unless we are required by law to retain it.

8. Purposes for which we use Personal Information

We collect and use personal information for purposes including:

• providing, operating, and maintaining the Platform
• onboarding and managing user accounts
• enabling our clients to conduct compliance and due diligence activities
• facilitating identity verification and document checks
• conducting sanctions screening and PEP screening
• generating compliance documentation and audit trails
• responding to support requests and providing customer service
• sending administrative communications and security alerts
• processing payments and managing billing
• detecting fraud or misuse of the Platform
• improving our Platform and services through analytics and research
• complying with legal and regulatory obligations
• sending marketing communications where permitted by law

9. Disclosure of Personal Information

We may disclose personal information to:

• service providers, such as:
  • cloud hosting and infrastructure services
  • identity verification services
  • sanctions and PEP screening databases
  • payment processing services
  • customer support and CRM systems
  • analytics and product improvement tools
  • cybersecurity and fraud monitoring services
• professional advisers such as lawyers, accountants, and auditors
• regulators, government agencies, or law enforcement bodies where required or authorised by law
• service providers assisting with business administration or operations
• other parties where you have consented to the disclosure

10. Overseas disclosure of Personal Information

Some of our service providers may store or process personal information outside Australia, including in jurisdictions such as the United States, the United Kingdom, and the European Union.

Before disclosing personal information overseas, we take reasonable steps to ensure that the recipient will handle the information in a manner consistent with Australian privacy laws.

11. Data quality

We take reasonable steps to ensure that the personal information we collect, use, or disclose is accurate, up-to-date, complete, and relevant for the purposes for which it is used. You can help us maintain accurate records by notifying us if your personal information changes.

12. Security of Personal Information

We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification, or disclosure.

Our security measures include:

• encryption of data in transit and at rest
• access controls and role-based permissions
• multi-factor authentication
• monitoring and intrusion detection systems
• vulnerability testing and security assessments
• employee privacy and security training
• contractual security obligations for service providers
• Where sensitive information is collected, we apply enhanced safeguards and restrict access to authorised personnel who require the information to perform their role.

Despite these measures, no system can guarantee absolute security.

13. Data retention

We retain personal information for as long as necessary for the purposes for which it was collected or as required by law.

In particular:

• AML/CTF compliance records may need to be retained for at least 7 years
• financial and taxation records must be retained for statutory periods

When personal information is no longer required, we take reasonable steps to destroy or de-identify it securely.

14. Direct marketing

We may send you marketing communications about our services where:

• you have consented, or
• you would reasonably expect to receive such communications.

All marketing emails will include a clear option to unsubscribe. You may opt out at any time.

15. Access to and correction of Personal Information

You may request access to the personal information we hold about you. You may also request correction of personal information that you believe is inaccurate, out-of-date, incomplete, or misleading.

Access may be refused in circumstances permitted by law, such as where providing access would unreasonably impact another person’s privacy or where the information is subject to legal privilege.

If we decline to correct personal information, you may request that we associate a statement with the information noting your belief that it is inaccurate, incomplete, out of date, irrelevant, or misleading. We will take reasonable steps to associate that statement in a way that will be apparent to users of the information.

We will respond to all requests within a reasonable timeframe.

16. Anonymity and Pseudonymity

Where lawful and practicable, individuals may interact with us anonymously or using a pseudonym. However, in most cases we need to collect identifying information to provide the Platform and comply with regulatory obligations.

17. Government identifiers

We do not adopt government-related identifiers, such as passport numbers, driver licence numbers, or tax file numbers, as our own identifiers of individuals unless permitted by law.

18. Cookies and online tracking

We use cookies and similar technologies to:

• authenticate users
• maintain session security
• analyse platform usage
• improve user experience

You can manage cookies through your browser settings, although disabling certain cookies may affect functionality.

19. Notifiable Data Breaches

We comply with the Notifiable Data Breaches scheme. If an eligible data breach occurs that is likely to result in serious harm to individuals, we will:

• investigate and assess the breach promptly
• notify the Office of the Australian Information Commissioner where required
• notify affected individuals where appropriate

20. Third-Party websites and integrations

Our Platform may integrate with or link to third-party services. We are not responsible for the privacy practices of those third parties. We encourage you to review the privacy policies of any third-party services you access through the Platform.

21. Complaints

If you have a complaint about how we handle your personal information, please contact our Privacy Officer using the details below. We will acknowledge your complaint and aim to resolve it within a reasonable timeframe. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner.

Office of the Australian Information Commissioner (OAIC)
Website: https://www.oaic.gov.au
Phone: 1300 363 992

22. Contact Details

Privacy Officer
Trancher Pty Ltd

Email: Info@trancher.com.au

23. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. The updated version will be published on our website or Platform and will include an updated “Last Updated” date.