1. Who We Are

Deed Dot Com Dot Au Pty Ltd (ABN 32 123 929 984), of Baulkham Hills, NSW 2765, Australia ("TDIDCheck", "we", "us", "our") operates www.tdidcheck.com.au platform, which undertakes identity verification and screening checks on individuals and businesses onboarded by them and further also allows those registered clients ("Clients") to request identity verification and screening checks on individuals and businesses ("Data Subjects"). This Privacy Policy explains how we collect, use, disclose, and protect personal information in connection with the Service, and applies to both Clients and Data Subjects.

We are bound by the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth), and by record-keeping and customer due diligence obligations under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) ("AML/CTF Act").

2. Personal Information We Collect

2.1 About Clients

Name, business name, email address, phone number, billing details, all relevant information provided in the ID documents for validation checks with relevant authorities, and records of Checks requested and Credits purchased.

2.2 About Data Subjects

photograph submitted directly by the Data Subject during the verification process; and the results of Adverse Media, Politically Exposed Person (PEP), Sanctions, IP Address checks, and other directory databases generated during that process.

Identity documents and facial photographs are "sensitive information" and biometric information under the Privacy Act. We only collect this information with the Data Subject's express consent, obtained at the point of submission (see clause 5).

3. How We Collect Personal Information

3.1 Client information is collected directly from the Client on registration and through ongoing use of the Service.

3.2 A Data Subject's name, email, and phone number are provided to us by the Client that initiates a Check.

3.3 Identity documents, facial photographs, and IP address data are collected directly from the Data Subject when they access the verification link and voluntarily complete the ID Verification step.

3.4 Adverse Media, PEP, and Sanctions check results are generated by matching the Data Subject's details against third-party and publicly available screening databases.

4. Why We Collect, Use, and Hold Personal Information

We collect, hold, use, and disclose personal information to: operate and provide the Service; verify a Data Subject's identity and generate Reports for Clients; comply with our own obligations as an AML/CTF Act reporting entity, including customer due diligence and record-keeping; manage Client accounts, billing, and Credit balances;investigate and respond to complaints or suspected misuse of the Service; and comply with other applicable laws or regulator requests.

We do not use Data Subject personal information for direct marketing purposes.

5. Consent — Data Subjects

5.1 Before submitting an identity document or facial photograph, the Data Subject will be presented with a clear notice explaining what information is being collected, the purpose of the collection, who it will be shared with (see clause 6), how long it will be retained, and that facial recognition technology and session video recording will be used to verify their identity. By selecting "Continue", the Data Subject confirms that they have read and accepted the End User Terms and Privacy Policy and expressly consents to the collection, use and disclosure of their personal information for the purpose of completing the identity verification Check. Submission cannot occur until this step has been completed.

5.2 A Data Subject may decline to proceed or exit the identity verification process at any point before submission, in which case no identity document or facial photograph will be collected and no Check involving that information will be completed.

5.3 A Data Subject may withdraw consent for any future processing by contacting us using the details in clause 11. Withdrawal does not affect the lawfulness of any processing carried out before consent was withdrawn, and we may still be required to retain certain records to comply with applicable laws, including the AML/CTF Act (see clause 8).

6. Who We Share Personal Information With

6.1 We share Report results with the Client who requested the Check.

6.2 We engage accredited third-party identity verification and screening providers to perform components of the identity verification, adverse media, PEP, sanctions, and related screening processes. Personal information, including identity documents and facial photographs, may be transferred to and processed by these providers outside Australia, including in the European Union, where it may be subject to data protection laws different from those in Australia.

6.3 We take reasonable steps to satisfy ourselves that overseas recipients handle personal information consistently with the Australian Privacy Principles or an equivalent standard, including through contractual arrangements, though we cannot guarantee the acts of any overseas recipient.

6.4 We may disclose personal information to regulators, law enforcement, or other parties where required or authorised by law, including under the AML/CTF Act.

6.5 We do not sell personal information to third parties.

7. Data Security

7.1 We take reasonable technical and organisational steps to protect personal information from misuse, interference, loss, unauthorised access, modification, or disclosure, including encryption in transit and at rest, access controls, and restricting access to personal information to personnel and systems that need it to provide the Service.

7.2 If we become aware of a data breach likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) in accordance with the Notifiable Data Breaches scheme.

8. Data Retention and Destruction

8.1 Where a Check is conducted for the purposes of complying with the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) (AML/CTF Act), we retain the records required by law, including Reports, screening results, monitoring records and other compliance information, for a minimum of seven (7) years in accordance with applicable legal record-keeping obligations.

8.2 Identity documents, facial photographs and other raw biometric image files collected solely for the purpose of completing an identity verification Check are securely destroyed as soon as the verification process has been completed, unless we are required by law to retain them.

8.3 A Data Subject may request deletion of their personal information by contacting the professionals engaged by them to render any professional services (referred to in clause 11). Where we are legally required to retain certain records under the AML/CTF Act, we will inform the Data Subject that those records cannot be deleted until the applicable retention period has expired.

8.4 Once the applicable legal retention period has expired, and unless a longer retention period is required or permitted by law, we will take reasonable steps to permanently destroy or de-identify the remaining personal information so that it can no longer be used to identify the Client and Data Subject.

9. Access and Correction

9.1 An individual may request access to, or correction of, personal information we hold about them by contacting us using the details in clause 11.

9.2 We will respond within a reasonable period, and may need to verify the identity of the requester before providing access. We may refuse a request in circumstances permitted by the Privacy Act, and will explain our reasons if we do so.

10. Complaints

10.1 If you believe we have breached the Privacy Act or the Australian Privacy Principles, you may lodge a complaint with us using the details in clause 11. We will investigate and respond within a reasonable period.

10.2 If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

11. Contact Us

For Clients: For privacy questions, access and correction requests, consent withdrawal, or complaints, contact us on: support@trustdeed.com.au

For Data Subjects: For privacy questions, access and correction requests, consent withdrawal, or complaints, please contact your engaged professional

12. Changes to This Policy

We may update this Privacy Policy from time to time. The updated version will be posted on our website with a revised "last updated" date. Material changes affecting Clients and Data Subjects will, where practicable, be reflected in the consent notice described in clause 5.