Privacy Policy - Equivest.AI

1. Introduction

Equivest AI Pty Ltd (“Equivest”, “we”, “our” or “us”) operates the Equivest platform, including the websites equivest.ai and app.equivest.ai (together, the “Platform”). We are committed to protecting your privacy and handling your personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

This Privacy Policy explains what personal information we collect, why we collect it, how we hold and use it, who we share it with, and how you can access or correct it or make a complaint.

By using the Platform or providing your personal information to us, you consent to the collection, use and disclosure of your personal information as described in this Privacy Policy.

2. What personal information we collect

The personal information we collect depends on how you interact with us. It may include:

Identity and contact information. Your name, email address, phone number, residential address, date of birth, and (where required for verification) government-issued identification such as a driver licence or passport.
Identity verification (KYC/AML) information. Where you apply to transact through the Platform, we are required under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) to verify your identity. This may include copies of identity documents and the results of verification checks conducted through an accredited third-party identity verification provider.
Financial and property information. Information about your property (address, title details, estimated or assessed value, mortgage balance), your income, assets, liabilities, investment experience, bank account details for distributions and payments, and your investment preferences and objectives.
Transaction information. Details of applications, eligibility assessments, agreements entered into, distributions, and communications relating to your arrangement.
Technical and usage information. Your IP address, device type, browser type, operating system, pages visited, time spent on pages, referring URLs, and interactions with the Platform, collected via cookies and similar technologies (see Section 8).
Communications. Records of your correspondence with us, including emails, phone calls, and support enquiries.

We do not generally collect sensitive information (such as health information or biometric data) unless it is reasonably necessary for our functions and you consent, or collection is otherwise permitted by law.

3. How we collect personal information

We collect personal information:

directly from you, when you complete an eligibility assessment, create an account, submit an application, contact us, or otherwise use the Platform;
from third parties where reasonably necessary, including identity verification providers, independent valuers, your professional advisers (with your authority), property data providers, and publicly available registers such as land title registries; and
automatically, through cookies and analytics tools when you use the Platform.

If you provide us with personal information about another person (for example, a co-owner or co-applicant), you must ensure you are authorised to do so and that they are aware of this Privacy Policy.

You may deal with us anonymously or using a pseudonym where it is lawful and practicable — for example, when making a general enquiry. However, we cannot provide an eligibility assessment, enter into any arrangement, or meet our AML/CTF obligations without verifying your identity.

4. Why we collect, hold and use personal information

We collect, hold and use personal information to:

assess your eligibility for arrangements facilitated through the Platform;
verify your identity and comply with AML/CTF, taxation, and other legal and regulatory obligations;
coordinate and administer arrangements between homeowners, investors and other participants, including valuations, legal documentation, settlements and distributions;
communicate with you about your account, applications and arrangements;
provide you with information about products, services and opportunities that may interest you (you can opt out at any time — see Section 9);
operate, maintain, improve and secure the Platform;
respond to enquiries and complaints; and
establish, exercise or defend legal claims.

We do not use or disclose your personal information for purposes other than those for which it was collected, unless you consent or the use or disclosure is otherwise permitted under the Privacy Act.

5. Who we disclose personal information to

We may disclose your personal information to:

Service providers who assist us in operating the Platform and our business, including cloud hosting and infrastructure providers (DigitalOcean), identity verification providers, payment processors, email and communications providers, and analytics providers;
Professional advisers and transaction parties involved in an arrangement you enter into or apply for, including independent valuers, legal practitioners, licensed conveyancers, financial advisers, and trustees or administrators of investment vehicles;
Counterparties to your arrangement, limited to the information reasonably necessary to structure and administer the arrangement (for example, an investor participating in an arrangement will receive relevant property and transaction details, but not your identity documents);
Regulators, law enforcement and government bodies, including ASIC, AUSTRAC and the ATO, where required or authorised by law;
Our related bodies corporate, being Aura Investments (Australia) Pty Ltd and Aura Investments Co Limited (Vietnam), where necessary for the purposes described in this Policy (see Section 6 regarding overseas disclosure); and
Prospective purchasers or investors in our business, on a confidential basis, in connection with a sale, restructure or capital raising.

We do not sell your personal information.

6. Overseas disclosure

We store and process personal information in Australia and Vietnam. Personal information may be disclosed to our related body corporate Aura Investments Co Limited, located in Vietnam, and may be stored or processed by our service providers in either country.

Vietnam does not have a privacy law regime substantially similar to the Australian Privacy Principles. Before disclosing personal information to an overseas recipient, we take reasonable steps — including binding contractual obligations — to ensure the recipient handles the information in a manner consistent with the APPs, and Equivest remains accountable under the Privacy Act for the handling of that information.

7. How we hold and protect personal information

We hold personal information in electronic form on secure servers operated by us and our service providers. We take reasonable technical and organisational steps to protect personal information from misuse, interference, loss, and unauthorised access, modification or disclosure, including:

encryption of data in transit (TLS) and at rest;
access controls limiting access to personnel who need it to perform their roles;
logging and monitoring of access to systems holding personal information; and
regular review of our security practices.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Data breach response. We maintain a data breach response process. If a data breach occurs that is likely to result in serious harm to affected individuals, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) in accordance with the Notifiable Data Breaches scheme under the Privacy Act.

8. Cookies and analytics

The Platform uses cookies and similar technologies to keep you signed in, remember your preferences, understand how the Platform is used, and improve it. We use the following categories:

Essential cookies, required for the Platform to function (for example, session and authentication cookies). These cannot be disabled.
Analytics cookies, which help us understand usage patterns through third-party analytics services. Analytics data is collected in aggregated or pseudonymised form where practicable.

You can control cookies through your browser settings. Disabling non-essential cookies will not prevent you from using the Platform, but some features may not function fully.

9. Direct marketing

We may send you information about products, services and opportunities we consider may interest you, by email or other channels, where permitted by law. Every marketing communication will include a simple means of opting out, and you can opt out at any time by using the unsubscribe link or contacting us at privacy@equivest.ai. We will action opt-out requests promptly. We do not provide your personal information to third parties for their own direct marketing.

10. How long we keep personal information

We keep personal information only for as long as it is needed for the purposes described in this Policy or as required by law, whichever is longer. In particular:

identity verification records must be retained for 7 years after the end of our relationship with you, as required under AML/CTF law;
transaction, financial and tax records are retained for at least 7 years in accordance with corporations and taxation law; and
records relating to a property arrangement are retained for the life of the arrangement and for at least 7 years after it ends, given the long-term nature of the arrangements and potential legal claims.

When personal information is no longer required, we take reasonable steps to destroy it or de-identify it securely.

11. Access and correction

You may request access to the personal information we hold about you, and request that we correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading. To make a request, contact us at privacy@equivest.ai.

We will respond within a reasonable period (usually within 30 days). We do not charge for making a request, though in limited cases a reasonable charge may apply for giving access. If we refuse access or correction, we will give you written reasons and information about how to complain.

12. Complaints

If you believe we have breached the APPs or mishandled your personal information, please contact us:

Privacy Officer, Equivest AI Pty Ltd — Email: privacy@equivest.ai

We will acknowledge your complaint promptly and aim to resolve it within 30 days. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner:

Office of the Australian Information Commissioner (OAIC) — Website: www.oaic.gov.au · Phone: 1300 363 992

13. Third-party websites

The Platform may contain links to third-party websites. We are not responsible for the privacy practices of those websites, and this Policy does not apply to them.

14. Changes to this Policy

We may update this Privacy Policy from time to time. The current version will always be available on the Platform, with the “last updated” date shown at the top. Where a change is material, we will take reasonable steps to bring it to your attention.

15. Contact us

For any questions about this Privacy Policy or our handling of personal information:

Email: privacy@equivest.ai