Privacy Policy

Four Foxes Consulting ("we", "us", "our") is committed to protecting personal information in accordance with the Privacy Act 1988.

This Privacy Policy explains how we collect, use, disclose and store personal information in connection with our services, including:

• AML/CTF consulting services
• Identity verification and AML screening tools ("Platform")

We may collect personal information including:

Identity & Verification Data

• Full name
• Date of birth
• Address
• Identification documents (e.g. driver's licence, passport)
• Images (including facial images for liveness/face match)

Contact Information

• Email address
• Phone number

AML Screening Data

• Watchlist matches
• Politically exposed person (PEP) status
• Sanctions or adverse media results

Technical & Usage Data

• IP address
• Device and browser information
• Session activity and timestamps
• Audit logs (including acknowledgements and actions taken within the Platform)

Sensitive Information

Some personal information we collect is classified as sensitive information under the Privacy Act 1988. This includes biometric information and biometric templates collected as part of identity verification, including facial images used for liveness detection and face matching.

We collect personal information:

• Directly from Clients (business users)
• From individuals via verification links sent by our Clients
• Through use of our Platform
• From third-party service providers and data sources

Collection Notices

In addition to this Privacy Policy, we take reasonable steps to notify individuals about the collection of their personal information at or before the time of collection, in accordance with Australian Privacy Principle 5.

Where individuals are invited to complete an identity verification process via a link provided by one of our clients, a collection notice will be presented to that individual prior to or at the point of collection. That notice will describe:

• Who is collecting the information
• The purpose of collection
• Whether the collection is required or voluntary
• How the individual can access or correct their information
• Any overseas disclosure that may occur

This Privacy Policy should be read alongside any collection notice provided to you.

We collect and use personal information to:

• Provide identity verification and AML screening services
• Deliver consulting services and support AML program development
• Generate reports and audit trails
• Support Clients in managing their AML/CTF processes

We provide information and tools to assist Clients, but we do not make compliance determinations on their behalf.

We may disclose personal information to:

• Third-party identity verification and AML data providers
• Cloud hosting and technology providers
• Professional advisers (e.g. accountants, legal advisers)
• Regulatory authorities where required by law

Some of these providers may be located outside Australia.

Some of our third-party service providers are located outside Australia. As a result, personal information we hold may be disclosed to, processed by, or stored with recipients in overseas jurisdictions.

Before disclosing personal information to an overseas recipient, we take reasonable steps to ensure that the recipient handles that information in a manner consistent with the Australian Privacy Principles. These steps may include:

• Entering into contractual arrangements with overseas providers that require them to handle personal information consistently with Australian privacy standards
• Assessing the data protection frameworks and security practices of our providers prior to engagement
• Reviewing provider terms, certifications and applicable legal frameworks on an ongoing basis

Where an overseas recipient is subject to a foreign law that requires or permits disclosure of personal information in circumstances that would not be permitted under the Privacy Act 1988, we will take reasonable steps to mitigate that risk.

We will update this section if our use of overseas providers changes materially.

We rely on:

• Information provided by our Clients
• Data supplied by third-party providers

We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access. This includes:

• Secure cloud infrastructure
• Access controls
• Audit logging of system activity

Notifiable Data Breaches

We are subject to the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act 1988.

If we become aware of a data breach that is likely to result in serious harm to any individual whose personal information is involved, we will:

• Take immediate steps to contain the breach where possible
• Assess whether the breach is likely to result in serious harm
• Notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as soon as practicable where notification is required

We maintain internal procedures for identifying, assessing and responding to data breaches. These procedures are reviewed periodically and align with our broader information security practices.

We retain personal information only for as long as reasonably necessary to fulfil the purposes for which it was collected, or as required by law. Retention periods vary depending on the nature of the information:

• AML/CTF records: Retained for a minimum of seven years as required under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006, or such other period as required by applicable law.
• Verification and screening data: Retained for as long as the relevant client relationship is active and for a reasonable period thereafter, subject to legal obligations.
• General operational data: Retained in accordance with our internal data management policies and deleted or de-identified when no longer required.

When personal information is no longer required and retention is not mandated by law, we take reasonable steps to destroy or de-identify it securely.

Individuals may request access to or correction of their personal information by contacting us at:

We will respond within a reasonable time.

If you have a concern or complaint about how we have handled your personal information, we encourage you to contact us in the first instance so we can attempt to resolve the matter.

We will acknowledge your complaint within five business days and aim to provide a substantive response within 30 days. Where a complaint is complex or requires further investigation, we will keep you informed of progress.

If you are not satisfied with our response, or if you have not received a response within a reasonable time, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):

We may update this Privacy Policy from time to time. The latest version will be available on our website.