Privacy Policy

This Privacy Policy explains how Glacix Tech Pty Ltd (ABN 36 644 983 595, ACN 644 983 595) (Glacix, we, us) collects, holds, uses and discloses personal information.

We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). We are a reporting entity under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) (AML/CTF Act), which requires us to collect and keep certain information.

For any privacy question, request or complaint, please contact our Privacy Officer:

• Email: compliance@glacix.xyz
• Post: Privacy Officer, Glacix Tech Pty Ltd, Level 5, 7 Eden Park Drive, Macquarie Park NSW 2113, Australia

Depending on how you deal with us, we may collect:

• identity information, such as your name, date of birth, nationality, address, identity document details and images, and photographs used to verify your identity;
• contact information, such as your email address and phone number;
• business information, such as details of your business and of its directors, shareholders, beneficial owners, authorised persons and cardholders;
• financial and transaction information, such as wallet addresses, bank account details, payment instructions, information about payers and recipients, transaction history and the source of funds;
• technical information, such as your IP address, device and browser information, and records of logins and activity on the platform; and
• communications, such as messages and attachments you send us.

Identity verification may involve biometric information, such as matching a photo of your face to your identity document. We collect biometric information only with your consent and only to verify identity. Our screening checks may also reveal information about criminal matters or sanctions, which we handle as the law permits.

We collect most personal information directly from you, for example when you sign up, complete verification, use the platform or contact us. We also collect it from people acting for you, from identity verification and screening providers, from public registers and databases, from banks and payment partners, and automatically when you use our website and platform.

If you give us personal information about another person, such as a director, beneficial owner, cardholder, payer or recipient, please make sure that you are allowed to do so and that the person knows about this policy.

We collect, use and disclose personal information to:

• verify identity and meet our obligations under the AML/CTF Act and sanctions laws, including customer due diligence, ongoing monitoring, reporting to AUSTRAC, record keeping and sending payer and recipient information with payments;
• provide and manage the Services, including opening your account and processing deposits, payments, conversions, cards and payment links;
• provide customer support and communicate with you about your account, transactions and changes to our Services;
• protect you and us against fraud, security incidents and misuse;
• maintain and improve our Services; and
• comply with other laws and respond to lawful requests.

If you do not give us the information we ask for, we may not be able to provide the Services to you.

We do not sell personal information. We send marketing messages only where the law permits, and you can opt out at any time.

We use automated systems for identity verification, sanctions screening, blockchain analytics and transaction monitoring. These systems use your identity, business, financial and transaction, and technical information, and their results can affect decisions about whether we open your account or process a transaction. Our staff review these results where a decision could significantly affect you, and you can ask us to review a decision by contacting our Privacy Officer.

We may disclose personal information to:

• service providers who help us provide the Services, such as identity verification and screening providers, digital asset custody and blockchain analytics providers, payment and banking partners, card issuers, and cloud hosting, IT and email providers;
• banks, payment networks and other institutions involved in your transactions, including the recipient’s bank;
• AUSTRAC, law enforcement agencies, regulators and other government bodies, where the law requires or authorises it;
• our professional advisers and auditors; and
• anyone else with your consent or as the law permits.

Our servers are located in Australia and Singapore. We are likely to disclose personal information to service providers and partners located outside Australia, including in Singapore, Hong Kong, the United Kingdom and the United States. When we process a payment, information is also sent to banks and payment institutions in the countries or regions where the recipient or payer is located.

We take reasonable steps to ensure that overseas recipients handle personal information consistently with the APPs, unless an exception under the Privacy Act applies, for example where Australian law requires the disclosure.

We store personal information electronically on our servers in Australia and Singapore, provided by our cloud hosting providers. We protect it with measures including access controls, multi-factor authentication for staff access, encryption of data in transit and activity logging. No system is completely secure, so please keep your login details safe and tell us at support@glacix.xyz if you think your account has been compromised.

The AML/CTF Act requires us to keep transaction records for 7 years after the transaction, and customer identification records for 7 years after our relationship with you ends. We keep other personal information only for as long as we need it, and then securely destroy or de-identify it.

You can ask to access or correct the personal information we hold about you by contacting our Privacy Officer. We may need to verify your identity first. We will respond within a reasonable period, usually 30 days, and we do not charge for making a request.

We may refuse a request where the law allows, for example where giving access would be unlawful. If we refuse a request to access or correct your information, we will tell you in writing why, unless the law prevents us from doing so, and how you can complain.

Our website and platform do not set cookies. The platform uses your browser’s local storage to keep you signed in and to remember your preferences. Some pages load fonts from a third-party content delivery network, which receives your IP address and browser information. We do not use third-party advertising or tracking.

If a data breach is likely to result in serious harm to the individuals affected, we will notify those individuals and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme.

If you think we have breached the APPs, please contact our Privacy Officer in writing. We will acknowledge your complaint and aim to respond within 30 days.

If you are not satisfied with our response, you can complain to the OAIC at www.oaic.gov.au or on 1300 363 992.

We may update this policy from time to time. The current version is always available on our website, with its effective date.

This policy is available in English and Chinese. If there is any inconsistency between the two versions, the English version prevails.