Privacy Policy and Collection Notice
1. Introduction
FX Corp is committed to protecting your privacy and is bound by the Australian Privacy Principles (APPs) established under the Privacy Act 1988 (Cth). This privacy policy outlines how FX Corp collects, handles, uses, discloses and protects your personal information in accordance with the APPs and applicable legal provisions.
This Privacy Policy applies to personal information we collect about our customers and prospective customers, individuals associated with business customers (such as directors, beneficial owners, trustees and authorised users), payees and beneficiaries of payments, and other individuals we deal with. It does not apply to records about our employees, which are exempt under the Privacy Act.
2. Anonymity and Pseudonymity
Where lawful and practicable, you have the option to deal with us anonymously or by using a pseudonym. However, in most cases we cannot provide our foreign exchange and remittance services without knowing who you are due to:
• Our obligations under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (AML/CTF Act), which requires us to verify your identity;
• Our obligations under the Corporations Act 2001 as an Australian Financial Services Licensee; and
• The nature of the financial services we provide
If you wish to make a general enquiry or provide feedback, you may do so anonymously or using a pseudonym.
3. Information we Collect
The information FX Corp collects depends on the services we provide. We collect personal information that is reasonably necessary for our functions and activities as a foreign exchange and remittance provider. This includes:
• Identity details: name, date of birth, residential address and contact details;
• Identification documents: driver's licence number, passport details or other identification;
• Email addresses and telephone numbers;
• Bank account details and financial information;
• Employer details and occupation;
• Details of specific services or products you require;
• Transaction details and history;
• Information about the source of your funds and wealth, the purpose and intended nature of your transactions, and your expected transaction activity;
• Details of payees and beneficiaries of payments you ask us to make (such as their name, address and bank account details);
• Information about individuals associated with a business customer, such as directors, shareholders, beneficial owners, trustees, partners and authorised users;
• Results of screening against sanctions, politically exposed person (PEP) and adverse media lists;
• Information we generate or infer about you in the course of our relationship, such as customer risk ratings, transaction monitoring outcomes and records of our communications with you;
• Information necessary to assess and provide the services you request; and
• Any additional information you provide to us online, by telephone, email or in person
We also collect information to comply with our obligations under the AML/CTF Act and other regulatory requirements.
Sensitive information
We do not generally seek to collect sensitive information about you (such as information about your health, religious beliefs or criminal record). However, the screening we must conduct under the AML/CTF Act may reveal sensitive information, such as information about criminal proceedings or political associations. We only collect sensitive information where you consent or where the collection is required or authorised by law.
Information about other people
If you give us personal information about another person (for example, a director, beneficial owner, authorised user or payee), please make sure they know you have done so, authorised you to do so, and that they can read this Privacy Policy to understand how we will handle their information.
4. How we collect your Information
We collect personal information directly from you unless it is unreasonable or impracticable to do so. We may collect information:
• Through account application forms and onboarding documents
• During conversations with our representatives
• Through transactions you conduct using our services
• Via emails or other correspondence you send to us
• Through your use of our website
• From third parties where you have consented or where we are legally required or authorised to do so (such as identity verification service providers, sanctions and PEP screening providers, credit reporting bodies and business information providers, public registers such as those held by ASIC and the Australian Business Register, people you have authorised to act for you, and businesses that refer you to us)
If we receive personal information about you that we did not ask for, we will decide whether we could have collected it under the APPs. If we could not, we will destroy or de-identify it as soon as practicable, where it is lawful and reasonable to do so.
5. Website information and cookies
When you visit our website, we may automatically collect technical information including:
• The domain and host from which you access the internet;
• Your computer's IP address;
• Browser type and version;
• Date, time and pages accessed; and
• Documents downloaded.
We use cookies (small text files stored on your device) to:
• Identify pages accessed and documents downloaded
• Store preferences and track activity on our website
• Personalise website content
• Facilitate administration and security
You can disable cookies through your browser settings, but this may limit your ability to use all features of our website. Our website does not use third-party cookies. Our marketing emails may use technologies that tell us whether an email has been opened or a link clicked.
6. Notification at Collection
At or before we collect your personal information (or as soon as practicable afterwards), we will provide you with a copy of this Privacy Policy to ensure you are aware of:
• Our identity and contact details (FX Corp Pty Ltd, AFSL 459050);
• The fact that we have collected or are collecting your information;
• If we collect your information from someone other than you, the fact that we have done so and the circumstances of that collection;
• Whether the collection is required or authorised by law and, if so, the name of that law (for example, the AML/CTF Act);
• The purposes for which we collect your information;
• The main consequences if you do not provide all or some of the information (for example, we may be unable to provide services to you or may be in breach of our AML/CTF obligations);
• The types of organisations to which we usually disclose your information (such as banks, payment providers, regulatory authorities, identity verification services);
• How you can access and seek correction of your information;
• How you can complain about a breach of the APPs; and
• Whether we are likely to disclose your information to overseas recipients and, if practicable, the countries where they are located.
This information is provided through this Privacy Policy and, where appropriate, our direct communications with you.
7. Use and Disclosure of Information
We collect your personal information for specific purposes (primary purposes) and will only use or disclose it for those purposes or related purposes you would reasonably expect (secondary purposes), unless you consent or an exception applies.
Primary purposes include:
• Providing foreign exchange and remittance services
• Processing your transactions
• Verifying your identity, conducting customer due diligence and ongoing monitoring as required by law
• Assessing your service requirements
• Managing our relationship with you
• Detecting, preventing and reporting fraud, scams, money laundering, terrorism financing and other unlawful activity
• Meeting our legal and regulatory obligations
We may use or disclose your information for secondary purposes where:
• You have consented to the use or disclosure
• You would reasonably expect us to use or disclose the information for that purpose and it is related to the primary purpose (or directly related in the case of sensitive information)
• We are required or authorised by law to do so
• It is necessary to prevent or lessen a serious threat to life, health or safety
• It is reasonably necessary for enforcement-related activities
• Other permitted situations under the Privacy Act apply
Specific uses and disclosures
We may use or disclose your personal information to:
• Provide you with financial services and undertake associated business functions
• Respond to your specific requests
• Administer your account and manage our operations
• Verify your identity with identity verification service providers, including by checking your identification document details with the document issuer or official record holder via third party systems (see section 8)
• Assess the creditworthiness of you or your business if you apply for hedging products such as forward contracts or options, which may include obtaining a credit report from a credit reporting body with your consent
• Comply with laws and regulatory requirements, including the AML/CTF Act, Corporations Act, and tax laws
• Disclose to regulatory authorities including AUSTRAC, ASIC, and the ATO
• Disclose to banks, payment service providers and correspondent financial institutions to facilitate transactions
• Disclose to our service providers who help us run our business, such as identity verification and screening providers, IT, cloud hosting and data storage providers, trade reporting providers, auditors, legal advisers, accountants and independent AML/CTF reviewers
• Disclose to the Australian Financial Complaints Authority (AFCA) and law enforcement agencies where required or authorised by law
• Disclose to people you have authorised to act on your behalf
• Improve and monitor our services
• Maintain records as required by law
Use of computer programs in decisions
We use computer programs, including systems provided by third parties, to assist with some decisions about you, such as whether we can open an account for you or process a transaction. These programs use personal information such as your identity details, identification document details, information about individuals associated with you, payee details, transaction information and screening results. In particular:
• Electronic identity verification systems check whether your identification details match official records. The result affects whether we can verify your identity electronically or need to ask you for further documents;
• Screening systems check customers, associated individuals and payees against sanctions, PEP and adverse media lists and flag potential matches for review; and
• Transaction monitoring systems flag transactions that may be unusual or require further review.
These programs do things that are directly related to our decisions, but they do not make decisions about you by themselves. A member of our team reviews the outcome and makes the final decision on whether to onboard you, process a transaction or take other action. If you have a question about a decision, please contact us using the details in section 15.
Direct marketing
We may use your personal information (other than sensitive information) to notify you of products or services that may interest you where:
• We collected the information from you and you would reasonably expect us to use it for this purpose
• We include a simple way for you to opt out of receiving marketing communications in each marketing message we send you
• You have not opted out
You have the right to:
• Request not to receive direct marketing communications from us at any time
• Request that we not use or disclose your information to facilitate direct marketing by others
• Request the source of your information used for direct marketing
We will not charge you for making these requests or giving effect to them. To opt out, contact us using the details at the end of this policy.
We do not use or disclose sensitive information for direct marketing unless you have consented.
When we send you electronic marketing messages or make marketing calls, we comply with the Spam Act 2003 (Cth) and the Do Not Call Register Act 2006 (Cth).
8. Electronic Identity Verification
As part of our onboarding process, and at other times when the law requires, we verify your identity electronically. With your express consent, we check the details of the identification documents you provide (such as your driver licence or passport) with the document issuer or official record holder via third party systems, for the purpose of confirming your identity. A third-party identity verification service provider submits these checks on our behalf.
We conduct these checks to meet our obligations under the AML/CTF Act and the Anti-Money Laundering and Counter-Terrorism Financing Rules, which require us to verify the identity of our customers.
We will ask for your express consent before we conduct an electronic check. If you do not consent, or if we cannot verify your identity electronically, we will offer you another way to verify your identity (for example, by providing certified copies of your identification documents). If we cannot verify your identity by any method, we will not be able to provide our services to you.
You can access and correct the personal information we hold about you, and make a complaint about how we have handled it, as set out in sections 11 to 13. For information about how the Australian Government's identity matching services operate, visit www.idmatch.gov.au.
9. Cross-Border Disclosure
We may disclose your personal information to recipients located outside Australia, including in countries where we maintain banking relationships or use service providers. This may include locations such as Canada, the United States, the United Kingdom, European Union countries (including Luxembourg), and Asia-Pacific countries, depending on the nature of your transaction, and any country to which you ask us to send funds.
When you send or receive an international payment, the AML/CTF Act requires us to pass certain information about the payer and payee (such as name, address, account number or unique transaction reference) to the financial institutions involved in the transfer. These institutions may be located in the destination country or in intermediary countries.
Some of the service providers that host our trading, customer portal and onboarding systems store data in Canada as well as Australia. Our email marketing provider may store data in the United States.
Before disclosing your personal information overseas, we take reasonable steps to ensure that overseas recipients do not breach the APPs in relation to your information. This may include:
• Assessing the privacy and security practices of our service providers before we engage them; and
• Ensuring contractual protections are in place that require recipients to handle your information consistently with the APPs.
Where we disclose your personal information to an overseas recipient, we generally remain accountable under the Privacy Act for how that recipient handles it.
Where we disclose information overseas as required or authorised by Australian law, or where permitted exceptions apply, we will inform you accordingly.
10. Data Quality and Security
We take reasonable steps to ensure that:
• Personal information we collect is accurate, up-to-date and complete
• Personal information we use or disclose is, having regard to the purpose of use or disclosure, accurate, up-to-date, complete and relevant
You can help us maintain accurate records by notifying us of any changes to your personal information.
We take reasonable steps to protect your personal information from misuse, interference, loss, unauthorised access, modification or disclosure. These steps include technical and organisational measures, such as:
• Restricting access to personal information on a "need to know" basis
• Role-based access controls and multi-factor authentication
• Physical security measures including locked filing cabinets and secure offices
• Electronic security including firewalls, encryption and secure data transmission, with controls aligned to the Australian Signals Directorate's Essential Eight
• Staff training on confidentiality and privacy obligations
• Secure destruction of information no longer required
• Requiring our service providers to protect personal information and to notify us of data breaches
• Regularly reviewing our security and privacy practices
Data breaches
If we experience a data breach that is likely to result in serious harm to any of the individuals whose personal information is involved, we will notify those individuals and the OAIC as required by the Notifiable Data Breaches scheme under the Privacy Act.
Internet transmission risks
While we take reasonable precautions, we cannot guarantee the security of information transmitted over the internet. There is a risk that third parties may unlawfully intercept transmissions. You should take care to verify you are dealing with FX Corp and not an imposter when communicating electronically. To help keep your information and funds safe, please contact us using the details in section 15 if you are ever unsure whether a communication is from us. You can find general tips on protecting yourself from scams at www.scamwatch.gov.au.
Data retention and destruction
We retain personal information for as long as necessary to fulfil the purposes for which it was collected, or as required by law. We are required under AML/CTF laws to retain identity verification records and transaction records for 7 years after the end of the relationship or transaction.
When we no longer need your personal information for any purpose and are not required by law to retain it, we take reasonable steps to destroy the information or, where destruction is not appropriate, ensure it is de-identified.
11. Access to your Personal Information
Your right to access
You have the right to request access to the personal information we hold about you. We will respond to your request within a reasonable period (generally within 30 days) and provide access in the manner you request where reasonable and practicable to do so.
How to request access
To request access, please contact our Privacy Officer using the details at the end of this policy. Please specify:
• What information you wish to access
• Your preferred format for receiving the information
We will need to verify your identity before giving you access to your personal information.
Access charges
We do not charge for making an access request. If we provide access, we may charge a reasonable fee to cover our costs of providing access (such as photocopying or compiling information). Any charge will not be excessive. We will inform you of any charges before providing access.
When we may refuse or restrict access
In some circumstances, we may refuse to provide access or limit the access we provide. This includes where:
• Giving access would pose a serious threat to life, health or safety
• Giving access would have an unreasonable impact on others' privacy
• The request is frivolous or vexatious
• The information relates to existing or anticipated legal proceedings and would not be discoverable
• Giving access would reveal our intentions in negotiations and prejudice those negotiations
• Giving access would be unlawful
• Denying access is required or authorised by law
• Giving access would prejudice an investigation of unlawful activity or serious misconduct
• Giving access would prejudice enforcement-related activities
• Giving access would reveal evaluative information generated within FX Corp in connection with a commercially sensitive decision-making process
If we refuse access
If we refuse access or refuse to provide access in the manner you requested, we will:
• Provide you with a written notice explaining our reasons (unless it would be unreasonable to do so)
• Inform you of available complaint mechanisms
• Where possible, provide access through alternative means (such as through a mutually agreed intermediary)
12. Correction of Personal Information
You have the right to request correction of personal information we hold about you if you believe it is inaccurate, out-of-date, incomplete, irrelevant or misleading.
If we are satisfied that information should be corrected, we will take reasonable steps to correct it. If you ask us to correct your information, we will consider your request and take reasonable steps to correct it where it is inaccurate, out-of-date, incomplete, irrelevant or misleading.
How to request correction
To request correction, please contact us using the details at the end of this policy. Please:
• Specify what information you believe is incorrect
• Explain why you believe it needs correction
• Provide supporting documentation if available
Response timeframe
We will respond to your correction request within a reasonable period (generally within 30 days). We do not charge for making a correction request or for correcting your information.
If we refuse to correct
If we refuse to correct your information as requested, we will:
• Provide you with a written notice explaining our reasons (unless unreasonable to do so)
• Inform you of available complaint mechanisms
You may request that we associate a statement with the information indicating that you believe it is inaccurate, out-of-date, incomplete, irrelevant or misleading. We will take reasonable steps to associate this statement with the information so it is apparent to users of the information.
Notification to third parties
If we correct information that we have previously disclosed to another organisation and you request we notify them of the correction, we will take reasonable steps to do so unless it is impracticable or unlawful.
13. Complaints
For complaints regarding how we have managed your privacy or handled your information please contact our complaints officer at complaints@fxcorp.com.au.
We will acknowledge your complaint within one business day (or as soon as practicable) and aim to give you a final response within 30 calendar days.
We hope to resolve your complaint to your satisfaction, but we understand that this won't always be possible. If you're not happy with our response or how we've handled your complaint, you have the right to take the matter to an independent external dispute resolution service, the Australian Financial Complaints Authority (AFCA), or to the OAIC (see below).
Please refer to our full Complaint Policy, located on our website at www.fxcorp.com.au for more details about how we will manage and work with you to resolve your complaint.
Escalation Options
If you are not satisfied with our response, you have the right to complain to the Office of the Australian Information Commissioner (OAIC) or AFCA: The OAIC will generally expect you to have complained to us first and given us a reasonable opportunity to respond.
Office of the Australian Information Commissioner
The OAIC can investigate complaints about interference with privacy and may make determinations requiring us to take specific action.
OAIC Contact Information
• Phone: 1300 363 992
• Website: www.oaic.gov.au
• Mail: GPO Box 5288, Sydney NSW 2001
Australian Financial Complaints Authority (AFCA)
AFCA provides a free and independent dispute resolution service for consumers and small businesses in the financial sector.
AFCA Contact Details
• Phone: 1800 931 678 (free call)
• Email: info@afca.org.au
• Mail: Australian Financial Complaints Authority, GPO Box 3, Melbourne VIC 3001
• Website: www.afca.org.au
14. Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements or for other operational reasons.
Updated versions will be made available on our website at www.fxcorp.com.au. You can also request the current version by contacting us. We recommend you review this policy periodically to stay informed of how we protect your information.
For significant changes that affect how we handle your personal information, we will take reasonable steps to notify you directly.
15. Contact Us
Privacy Officer
FX Corp Pty Ltd
ABN 40 165 555 046
Level 14, 1 Castlereagh Street
Sydney NSW 2000
Ph: 02 8076 9535
Business hours: 8:30 AM - 5:30 PM Sydney time, Monday to Friday
AFSL: 459050
Version: 2.2
Last Updated: October 2026