Privacy Policy

1. Introduction

Dinar Exchange Australia and New Zealand ("we," "us," or "our") is committed to protecting your privacy and personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our currency exchange services or visit our premises.

We are bound by the provisions of the Privacy Act 1988 (Cth) (Privacy Act), including the Australian Privacy Principles (APPs), the Privacy Act 2020 (New Zealand), as well as the Identity Verification Services Act 2023 (Cth) (IVS Act). Your personal information will be handled in accordance with our obligations under these Acts and legislation. By using our services, you consent to the collection and use of information in accordance with this policy.

2. Information We Collect

2.1 Personal Information

We collect personal information that you provide to us directly, including but not limited to:

• Full name and date of birth
• Contact information (address, phone number, email address)
• Government-issued identification documents (passport, driver's license, national ID card)
• Financial information (bank account details, credit card information)
• Transaction history and currency exchange details
• Tax File Number or IRD number (where required by law)
• Source of funds information

2.2 Automatically Collected Information

When you visit our website or use our online services, we may automatically collect:

• IP address and device information
• Browser type and operating system
• Website usage data and analytics
• Cookies and similar tracking technologies

2.3 CCTV and Security Footage

Our premises are equipped with CCTV cameras for security purposes. This footage is recorded and retained in accordance with applicable privacy laws.

3. How We Use Your Information

We use the information we collect for the following purposes:

• To process and complete currency exchange transactions
• To verify your identity and prevent fraud
• To comply with anti-money laundering (AML) and counter-terrorism financing (CTF) obligations
• To comply with taxation and financial reporting requirements
• To communicate with you about your transactions and our services
• To improve our services and customer experience
• To send marketing communications (with your consent)
• To maintain the security of our premises and prevent criminal activity
• To respond to legal requests and protect our legal rights

4. Legal Basis for Processing

We process your personal information based on the following legal grounds:

• Contractual necessity: To fulfill our obligations under the service agreement with you
• Legal compliance: To meet our obligations under AML/CTF laws, taxation laws, and other regulatory requirements
• Legitimate interests: To operate our business, prevent fraud, and ensure security
• Consent: Where you have provided explicit consent for specific uses of your information

5. Information Sharing and Disclosure

We may share your personal information with:

5.1 Regulatory Authorities

We are required to disclose information to:

• AUSTRAC (Australian Transaction Reports and Analysis Centre)
• Financial Intelligence Unit (FIU) New Zealand
• Australian Taxation Office (ATO)
• Inland Revenue Department (IRD) New Zealand
• Law enforcement agencies when legally required

5.2 Service Providers

We may share information with third-party service providers who assist us with:

• Payment processing and banking services
• Identity verification services
• IT and data storage services
• Professional advisors (lawyers, accountants, auditors)
• Marketing and communication services

All service providers are required to maintain the confidentiality and security of your information and use it only for the purposes we specify.

5.3 Business Transfers

If we are involved in a merger, acquisition, or sale of assets, your personal information may be transferred. We will provide notice before your information is transferred and becomes subject to a different privacy policy.

6. Document Verification Service (DVS)

We use the Attorney-General's Department's Document Verification Service (DVS) to verify your identity documents. This will only occur with your express consent.

6.1 Why We Collect Identity Information for DVS

We are required by the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 to verify your identity before we can provide you with currency exchange services. We collect your personal information for the purpose of verifying your identity in order to provide you with our products, services, and offerings, including:

• Currency exchange and foreign currency purchase services
• International money transfer services

We may also use this information for the following secondary purposes:

• Ongoing customer due diligence and enhanced due diligence as required by AML/CTF regulations
• Fraud prevention and detection

6.2 How DVS Works

We collect your personal information through our website, online forms, email, and in-person interactions at our premises. The information you provide will be sent to the DVS Hub, administered by the Attorney-General's Department, and matched against official records held by the government agency responsible for issuing the identity document (document issuer).

The DVS Hub will advise us of whether the information you provide matches official records.

6.3 Storage of Identity Documents

We do not store copies of your identity documents after the DVS check is complete. Identity verification data is retained for 7 years from the end of the customer relationship, as required by AML/CTF legislation.

6.4 How the Attorney-General's Department Handles Your Information

The DVS Hub facilitates information transfer between us and the document issuer. The DVS Hub itself does not retain any personal information and the Attorney-General's Department cannot view or edit any of the personal information transmitted through the DVS Hub.

6.5 Special Needs

If individuals have any specific needs or require this notice in an alternative format, or if you need assistance due to special circumstances, please contact us at dinars@dinarexchange.com.au.

7. International Transfers

We operate in both Australia and New Zealand. Your information may be transferred between these jurisdictions and potentially to other countries where our service providers operate. When we transfer information internationally, we ensure appropriate safeguards are in place to protect your privacy in accordance with applicable laws.

We will not transfer your personal information to overseas recipients unless:

• We have your consent
• The transfer is required or authorized by law
• We reasonably believe the recipient is subject to substantially similar privacy protections

8. Data Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of sensitive data in transit and at rest
• Secure storage of physical documents in locked facilities
• Access controls and authentication procedures
• Regular security assessments and updates
• Employee training on data protection and privacy
• CCTV surveillance and alarm systems

While we strive to protect your information, no method of transmission or storage is 100% secure. We cannot guarantee absolute security but will notify you of any data breaches as required by law.

9. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes outlined in this policy and to comply with our legal obligations.

Specific retention periods include:

• Transaction records: 7 years from the date of transaction (AML/CTF requirement)
• Identity verification documents: 7 years from the end of the customer relationship
• CCTV footage: 30 days unless required for investigation or legal purposes
• Marketing data: Until you withdraw consent or the data is no longer relevant
• Financial records: 7 years (taxation requirement)

When information is no longer needed, we securely destroy or permanently de-identify it.

10. Your Rights

Under Australian and New Zealand privacy laws, you have the following rights:

10.1 Right to Access

You have the right to request access to the personal information we hold about you. We will provide you with a copy of your information within 30 days of your request.

10.2 Right to Correction

If you believe your personal information is inaccurate, incomplete, or out of date, you have the right to request correction. We will take reasonable steps to correct the information within 30 days.

10.3 Right to Erasure

You may request deletion of your personal information, subject to our legal obligations to retain certain records for regulatory compliance. We cannot delete information we are required by law to retain.

10.4 Right to Object

You have the right to object to the processing of your personal information for direct marketing purposes. You can opt out of marketing communications at any time by contacting us or using the unsubscribe link in our emails.

10.5 Right to Complain

If you have concerns about how we handle your personal information, you have the right to lodge a complaint with:

• Australia: Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or 1300 363 992
• New Zealand: Office of the Privacy Commissioner at www.privacy.org.nz or 0800 803 909

11. Cookies and Tracking Technologies

Our website uses cookies and similar technologies to enhance your experience, analyze usage, and assist with marketing efforts. Cookies are small text files stored on your device.

Types of cookies we use:

• Essential cookies: Required for website functionality
• Analytics cookies: Help us understand how visitors use our site
• Marketing cookies: Used to deliver relevant advertisements
• Preference cookies: Remember your settings and preferences

You can control cookies through your browser settings. However, disabling certain cookies may affect website functionality.

12. Children's Privacy

Our services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected information from a child without parental consent, we will take steps to delete that information.

13. Marketing Communications

With your consent, we may send you marketing communications about our products, services, and special offers. You can opt out of receiving marketing communications at any time by:

• Clicking the unsubscribe link in our emails
• Contacting us directly at dinars@dinarexchange.com.au
• Updating your preferences in your account settings (if applicable)

Please note that even if you opt out of marketing communications, we will still send you transactional and service-related messages.

14. Third-Party Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices of these external sites. We encourage you to review the privacy policies of any third-party sites you visit.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make changes, we will:

• Update the "Last Updated" date at the top of this policy
• Post the revised policy on our website
• Notify you by email of significant changes (where we have your email address)

Your continued use of our services after any changes indicates your acceptance of the updated policy.

16. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us:

We will respond to your inquiry within 30 days.

17. Consent and Acknowledgment

By using our services, visiting our premises, or providing your personal information to us, you acknowledge that you have read, understood, and agree to this Privacy Policy. You consent to the collection, use, and disclosure of your personal information as described in this policy.

If you do not agree with this Privacy Policy, please do not use our services or provide us with your personal information.

18. Definitions

• Personal Information: Information or an opinion about an identified individual, or an individual who is reasonably identifiable.
• AML/CTF: Anti-Money Laundering and Counter-Terrorism Financing regulations and requirements.
• APPs: Australian Privacy Principles contained in the Privacy Act 1988 (Cth).
• Processing: Any operation performed on personal information, including collection, storage, use, disclosure, and deletion.
• Data Breach: Unauthorized access, use, disclosure, loss, or modification of personal information.
• DVS: Document Verification Service, operated by the Attorney-General's Department, used to verify identity documents against official government records.
• IVS Act: The Identity Verification Services Act 2023 (Cth), which governs the use of identity verification services including the DVS.
• Document Issuer: The government agency responsible for issuing an identity document (e.g., a state transport authority for driver's licences, the Department of Foreign Affairs and Trade for passports).