AFCX - Privacy Policy

Introduction

The Australian Financial Crimes Exchange Limited (AFCX, we, us or our) is an independent company that operates consistent with not-for-profit principles. We take privacy seriously and will take reasonable steps to ensure the personal information we collect, use, hold and/or disclose is done so in a safe manner and in accordance with (a) For Australia: the Privacy Act 1988 and the Australian Privacy Principles and for New Zealand: the Privacy Act 2020 (NZ) and its information privacy principles (collectively, Privacy Laws).

In addition to the Privacy Laws, individuals located in the European Union (EU) may also have rights under EU-based rules known as the General Data Protection Regulation (GDPR).

Personal information is defined in the Privacy Laws and this Privacy Policy sets out how we manage personal information.

About AFCX

AFCX’s core function is to assist in the prevention, identification and investigation of, and response to, financial crime including fraud, scams and other unlawful activity affecting our members, their customers and, as relevant, the Australian and New Zealand public. The AFCX provides an information and intelligence exchange service that aims to:

ensure governance, security and risk mitigation measures are applied to the sharing of financial crime information, including fraud, scams and fraud-related information and intelligence;
respond to actual or suspected unlawful activity or misconduct of a serious nature;
foster collaborative intelligence sharing and the exchange of information to reduce financial fraud and cybercrime; and
to provide greater protection to the Australian and New Zealand public by strengthening each countries’ stand on financial crime, including scams and fraud.

We understand that how we collect, use, disclose, process and/or exchange personal information is important and we value the trust that is placed in the AFCX. That is why protecting personal information is a vital part of our business operations.

What kinds of personal information do we collect?

We collect personal information directly from members. Sometimes we collect information directly from an individual. We use reasonable efforts to obtain, or ensure that any third party has obtained, consent for the collection or that it is permitted under Privacy Laws or such other applicable law. We collect personal information that includes:

Identity information – such as personal details to establish or verify an individual’s identity;
Information that is publicly available, for example from public registers or social media;
Contact information, such as phone numbers, address details and email addresses; and
Financial information, such as information about the acquisition, or attempted acquisition, of financial products and services, including monetary information, credit card and/or account information and certain transaction and payment data in relation to actual or suspected financial crime, fraud or scam activity or events.

In some cases we also collect personal information from other sources and entities, such as suppliers, commercially available third party databases and/or the internet.

When you send an email or message to us or give us information over the phone, we may also retain this in order to respond to your enquiry or for our internal operational or governance purposes. We may also collect information such as device and network information and/or regulatory and compliance data that may be relevant to the provision of our services, internal business operations, risk assessments, investigations and/or reporting obligations.

Specific data elements may not be listed here to preserve the integrity of fraud detection methods and investigative processes.

If you require further information about the legitimate interest legal basis under the GDPR, please refer to www.ico.org.uk.

Use and disclosure

We collect, hold, use, disclose and/or process personal information because we are required to and/or authorised by applicable laws, including Privacy Laws to collect that information. In certain circumstances we process personal information as an agent for our members.

We use personal information in order to:

administer our services and for the identification, detection, prevention and investigation of financial crime including to prevent fraud, scams, cybercrime and other unlawful activity;
manage our risks and help identify illegal activity;
comply with our legal and other obligations;
mitigate, where possible, losses associated with fraud, scams, cybercrime and other unlawful activity;
assist processing a claim or request associated with mistaken, unauthorised or scam payments;
create data insights and related reports; and
conduct and improve our business, including for internal operational matters, administration of our products and services, research, planning and product / service development.

To do this, we may disclose personal information to:

our members including Australian-based and New Zealand-based financial institutions, financial services organisations, payment providers, telecommunications companies, superannuation administrators, government agency, digital platforms and such other organisations that we’re allowed to under Privacy Laws and have appropriate data handling and security arrangements in place.
third party organisations that carry out functions on our behalf or that assist in the provision of our services. For example, our Australian-based agents, contractors and contracted service providers. Our agreements with these entities ensure the information is only used to carry out functions on our behalf.
entities engaged in the provision of human resource services and recruitment in respect of our operations and personnel.
law enforcement authorities, Government agencies or regulators.
entities established to assist with anti-money laundering and counter terrorism financing obligations and to help identify illegal activities and prevent fraud.

AFCX may utilise AI technologies to support some of its services. Where AI systems process personal information - either directly provided by a member or inferred through system interactions - the AFCX shall ensure that such use complies with the Privacy Laws or GDPR, where applicable. Any AI use is subject to governance protocols that may include human oversight, transparency and risk assessment.

We won’t use or disclose your personal information for a secondary purpose, unless that secondary purpose is related to the primary purpose for which we collect that information and you would reasonably expect the disclosure in the circumstances; or you have given your consent.

Overseas disclosure

In some limited cases, we may need to disclose personal information to organisations outside of Australia and/or New Zealand, or to Australian or New Zealand organisations that store data or operate outside of Australia and/or New Zealand. For example, when a member is based overseas or has certain back-office operations based overseas.

We may disclose to, or allow Personal Information to be accessed from, Australia, Canada, Europe, India, New Zealand, Peoples Republic of China, Philippines, United Kingdom and United States of America.

We will take reasonable steps to ensure those overseas entities comply with the Australian Privacy Principles or New Zealand Privacy Principles (as relevant), or equivalent privacy legislation or requirements with enforceable data subject rights and effective legal remedies available.

Security and Storage

We take reasonable steps to keep the personal information we hold secure to ensure that it is protected from misuse, interference, loss, unauthorised access, modification or disclosure.

Personal information is stored within secure systems that are protected in controlled facilities. This includes electronic and physical security measures and reasonable security safeguards, like encryption and intrusion detection systems. We implement risk assessments and have strict access control policies and processes. Our employees, service providers and authorised agents are obliged to comply with Privacy Laws and respect the confidentiality of any personal information held by us.

Personal information is held only for as long as the information remains relevant to the purpose for which it was collected. In certain circumstances, we may keep personal information for up to 7 years. We shall only keep information for a longer period of time to fulfil legal or regulatory obligations, for internal research and analysis purposes or to respond to a question or complaint.

Use of Website & Social Media

We collect personal information when you use our website and interact with our social media profiles. This information could include your social media handles, IP address and location data from your devices.

Our website uses “cookies”. A cookie is a small text file placed on your device by a website to capture information about your visit. We use cookies (including cookies developed by our third-party service providers such as Google Analytics) for a number of purposes, including measuring the effectiveness of our website, to improve our content, to enhance your online experience with us and maintaining the secure connection between your browser and our servers while you are using our website. We may also use the information to identify you, your browser and determine if your device has previously visited our website.

Access to personal information

You have a right to request access to your own personal information. In certain circumstances we’re allowed to deny your request, or limit the access we provide. The reasons upon which we can rely to deny access are set out in the Privacy Laws, for example, in Australia in APPs 12.3.

We will endeavour to respond to your request for access to your personal information within 30 days. We may take longer in certain situations. We will keep you up to date throughout the process.

In circumstances where we refuse to provide you with access to your own personal information, we will give you a written notice that sets out the reasons for the refusal (unless it would be unreasonable to do so). We will also advise you how to complain about any refusal.

We will not charge you for making a request or for giving you reasonable access to your own personal information. To the extent that the request requires us to undertake a substantial amount of work, we may ask you to pay our reasonable costs. If we are going to charge a fee, we’ll contact you before we proceed.

Correction to personal information

We take reasonable steps to ensure any personal data that is disclosed to us or that we collect, use or disclose is up to date and accurate. If you believe personal information that we may hold about you is not up to date or accurate, you may ask us to correct it.

If we do not agree that your information is inaccurate, out of date or incomplete, we will give you a written notice including the reasons why we do not agree with you, except to the extent that it would be unreasonable to do so. We will also advise you how to complain about a refusal.

If we are unable to correct personal information we shall provide you with details of how the personal information might be corrected.

We will endeavour to respond to an amendment request within 45 days. We may take longer in certain situations. We will keep you up to date throughout the process.

We will not charge you for making an amendment request or for correcting personal information about you.

GDPR

If the GDPR applies to you, the other sections of this Privacy Policy also apply to you. Further, your personal data will be:

processed lawfully, fairly and in a transparent manner in accordance with this Policy;
collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes;
adequate, relevant and limited to data necessary for the purposes for which the data is processed;
accurate and kept up-to-date where necessary;
kept in a form which permits your identification for no longer than is necessary for the purpose for which data is processed; and
processed in a manner that ensures appropriate security.

These principles are subject to applicable laws, including any limits or exceptions in the GDPR.

Where relevant, you may have the following additional rights under the GDPR:

Access Rights: the right to obtain confirmation of whether your personal data is being processed and the right to access the data. You may also have the right to obtain information about the purposes of processing, the categories of data processed, the recipients, the envisaged retention period (or criteria to determine that period), your rights to rectify or erase data or restrict processing and to complain about any regulated automated decision making, including the significance and envisaged consequences of the automated decision making for you.
Rectification: You may require us to rectify inaccuracies in personal data held about you.
Objection rights: You have the right to object to processing of data for direct marketing, processing based on our legitimate interests, and processing for research or statistical purposes. If you object, there may be compelling reasons why we are not required to stop processing your data (except in the case of direct marketing).
Right of erasure: You have the right to have your personal data erased in certain situations, including where the data is no longer necessary for the purpose for which it was collected or processed, or if you withdraw consent to processing and there is no other justification for processing.
Right to restrict processing: You have the right to restrict the processing of data in certain situations, such as where the individual disputes the accuracy of the data or has objected to its processing.
Profiling and automated decision making: You have the right not to be subject to decisions based solely on automated processing of data, such as profiling, if the decision produces legal effects concerning you, or similarly significantly affects you. However, we can use automated processing of data in certain circumstances if it is based on your consent, or when it is authorised by law.

What we do if a privacy breach occurs

If we consider that a privacy breach has occurred, we’ll identify the issue and take steps to contain the breach and minimise any harm.

If we believe the breach has caused, or is likely to cause serious harm, we will contact the relevant member(s) who may be affected by the breach. We may also contact the relevant Office of the Privacy Commissioner.

If you believe a privacy breach has occurred, please contact us as soon as possible.

Questions & Complaints

If you have a query or wish to make a complaint regarding the handling of your personal information by us, please contact us via our website - https://www.afcx.com.au/contact-us/

If you are not satisfied with the response provided by us, you have the option to refer your complaint to the relevant external dispute resolution scheme.

Australia	Office of the Australian Information Commissioner GPO Box 5288 Sydney NSW 2001 Phone: 1300 363 992 Email: enquiries@oaic.gov.au www.oaic.gov.au
New Zealand	Office of the New Zealand Privacy Commissioner Online: privacy.org.nz Phone: 0800 803 909 (From overseas) +64 (0)4 474 7590 Email: enquiries@privacy.org.nz
If you’re in a country that is covered by GDPR	You can also complain to your local data protection authority in the EEA. Contact details for those authorities are available here

Changes to this policy

From time to time, we may review this policy and the information contained in this document. We will notify you of any changes by posting an updated version on our website.

AFCX – Privacy Policy