Privacy Statement

NeoEx is a currency exchange and international money transfer service. In this statement, "NeoEx", "we", "us" and "our" mean Armin Pty Ltd. "You" means anyone whose personal information we handle. That includes customers, people who send or receive money through us, people who visit our website, and people who contact us.

We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). As a remittance and currency exchange provider registered with AUSTRAC, we are also bound by the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) (the AML/CTF Act). That law requires us to collect, check, keep and in some cases report information about our customers and their transactions.

This statement explains what personal information we collect, why we collect it, who we share it with, where it is stored, how long we keep it and how you can access it, correct it or complain. It applies to our website (neoex.com.au), our customer portal and status links, our phone lines and messaging channels, and our office.

What we collect depends on how you deal with us.

If you are a customer (sender or buyer of currency):

• Identity details: full name, date of birth, residential address, nationality, occupation and contact details (phone, email), and a photograph of you, including a photo of you with your identity document.
• Identity documents: copies and details of documents such as your passport, driver licence, Medicare card, visa, ImmiCard or a national identity card. These include document numbers, expiry dates and the photo on the document.
• Verification results: the outcome of checks against government records and credit bureau data (see section 4).
• Financial details: your bank account details, payment receipts and slips, the source of your funds and the purpose of your transfer, and, if you transact in virtual assets, your wallet address, wallet type, the type and amount of virtual asset and related transaction details.
• Transaction records: amounts, currencies, exchange rates, dates and the people involved in each transaction.
• Screening information: whether you appear on sanctions lists or are a politically exposed person, and related due diligence information.
• Business customers: details of the business, its directors, beneficial owners and authorised representatives.

If you receive money through NeoEx (recipient):

Your name and bank account or wallet details. The sender usually gives them to us. For recipients in Iran, our compliance procedures also require their address and phone number.

If you contact us:

• Phone calls: your phone number, call times and duration, and a recording of the call. We will tell you at the start of a call if it is being recorded.
• Messages: the content of messages you send us by WhatsApp, Telegram, Instagram, Facebook, SMS or email, together with your name or username and number on that platform.
• Enquiries: any information you give us through our website forms, at our office or by phone.

If you visit our website:

Technical and usage information, such as your IP address, device and browser type, pages visited and how you arrived at the site. This is collected through cookies and similar technologies (see section 9).

Sensitive information

We do not ask for sensitive information such as your health, religion or political opinions. Some identity documents contain your photo, and our checks may show whether you hold or have held a prominent public position. We collect this information only because the law requires it for identity verification and AML/CTF screening, and only with your consent or where the law requires or authorises it.

Can you deal with us anonymously?

You can make a general enquiry, for example about our rates, without telling us who you are. To exchange or transfer money, the AML/CTF Act requires us to identify you. We cannot provide our services anonymously or under a pseudonym.

We collect personal information:

• directly from you: when you fill in our onboarding form, upload documents, call us, message us, visit our office or make a transaction;
• from people acting for you or with you: for example, a business that sends money on your behalf, or a sender who gives us your details as a recipient;
• from verification and screening sources: government document records, credit reporting bodies and sanctions and watch lists (see section 4);
• from our banks and payment partners: for example, details on a deposit you make into our account;
• from our overseas payment partners and offices: for example, confirmation that a payment has reached your recipient;
• automatically: through our website, phone system and messaging platforms.

If you give us information about someone else, such as a recipient, a person paying on your behalf or a business director, please make sure they know you are giving it to us and point them to this statement.

If we receive personal information we did not ask for, we check whether we could lawfully have collected it. If not, we destroy or de-identify it as soon as practicable, where it is lawful to do so.

Document Verification Service (DVS). We check details from your government identity documents against the issuing agency's records through the Australian Government's Document Verification Service. The DVS confirms only whether the details match. It does not give us any further information from the government record. These checks are governed by the Identity Verification Services Act 2023 (Cth).

Visa Entitlement Verification Online (VEVO). If you hold a visa, we may check your visa details and status with the Department of Home Affairs through VEVO.

Credit reporting body (Equifax). The AML/CTF Act lets us ask a credit reporting body, currently Equifax, to confirm whether your name, address and date of birth match the information it holds. This is not a credit check. It does not affect your credit rating, although the credit reporting body keeps a record that the check was made. If we cannot verify you through the credit reporting body, we will tell you and offer another way.

We use your personal information to:

• verify your identity and run the customer due diligence the AML/CTF Act requires;
• screen against sanctions laws, including the Autonomous Sanctions Act 2011 (Cth) and the Charter of the United Nations Act 1945 (Cth);
• carry out your currency exchange or money transfer and pay your recipient;
• send you receipts, invoices and updates on your transfer;
• detect and prevent fraud, money laundering, terrorism financing and other crime;
• meet our reporting and record-keeping duties under Australian law;
• answer your enquiries and resolve disputes. We use call recordings and message history for this, and for staff training and quality;
• improve our website and services; and
• send you rates, offers and news, if you have agreed (see section 8).

We do not sell your personal information.

We share personal information only as needed for the purposes above, or as the law requires or allows:

• AUSTRAC and other government agencies. The AML/CTF Act requires us to report certain matters to AUSTRAC. These include international funds transfers, cash transactions of $10,000 or more and suspicious matters. AUSTRAC may share these reports with partner agencies such as the Australian Federal Police, the Australian Taxation Office and state police.
• Law enforcement, courts and regulators, when the law requires or authorises it, for example under a warrant, court order or notice.
• Identity verification providers: the Document Verification Service and our credit reporting body (see section 4).
• Our banks and payment partners in Australia, to receive and send your payments.
• Our overseas payment partners. They receive your recipient's name and bank account details, which they need to pay your recipient. They do not receive the sender's identity documents, ID verification results or contact details. They also receive information about the sender that the law requires us to send with a transfer, such as the sender's name. We do not send them your identity documents or your ID verification results.
• Our service providers, who help us run the business. They include cloud hosting and database providers, website hosting, phone and call recording systems, messaging platforms, email delivery, document reading (OCR) software, analytics and advertising services. They may use your information only to provide services to us.
• Our professional advisers, such as our accountants, auditors and lawyers, and AML/CTF independent reviewers.
• Anyone you authorise, and, if our business or assets are sold or restructured, the buyer, subject to confidentiality.

Information we cannot tell you about. The AML/CTF Act forbids us from disclosing certain information. For example, we cannot tell you whether we have made a suspicious matter report or received a notice from AUSTRAC. If a question or request from you would require us to disclose such information, we will not be able to answer it.

Some of your personal information is stored or handled outside Australia:

Where we store your information. Our customer database and the documents you upload are hosted by our cloud provider, on servers currently located in Australia. We keep control of this information. The provider stores it on our behalf, it is encrypted in transit and at rest, and access is restricted to authorised NeoEx staff using two-factor authentication.

Overseas payment partners. To complete a transfer, we give your recipient's name and bank account details to our payment partner in the destination countries.

Other service providers. Some of our service providers operate or store data overseas, including in the United States and other countries where they run their services. They include Google (analytics and advertising), Meta (WhatsApp, Instagram, Facebook and advertising), Telegram, our messaging inbox provider, our email delivery provider and our website hosting provider. When you message us on a platform such as WhatsApp or Telegram, that platform also handles your message under its own privacy policy.

Before we disclose personal information overseas, we take reasonable steps to make sure the recipient handles it consistently with the Australian Privacy Principles. We share only what is needed, use reputable providers and rely on contractual and security commitments where available. Privacy laws in some of these countries do not give the same protection as Australian law, and an overseas recipient may be required to disclose information under its own country's laws.

With your consent, we may send you exchange rates, offers and news by SMS, WhatsApp or email. We will always identify ourselves as NeoEx and give you an easy way to opt out, as the Spam Act 2003 (Cth) requires. You can unsubscribe at any time by following the instructions in the message, replying "STOP" where offered, or contacting us. Opting out of marketing does not stop service messages about your transactions.

We do not call numbers listed on the Do Not Call Register for marketing unless you have agreed to it.

Our website uses cookies and similar technologies:

• Google Analytics tells us how visitors use our site, for example which pages are visited and how people found us. We use this information in aggregate to improve the site.
• Advertising pixels (Meta and Google Ads) help us measure our advertising and show NeoEx ads to people who have visited our site, on platforms such as Facebook, Instagram and Google. These providers may combine this information with what they already know about you under their own privacy policies.

You can block or delete cookies in your browser settings. You can also opt out of Google Analytics with Google's browser add-on (tools.google.com/dlpage/gaoptout), manage Google ad personalisation at adssettings.google.com and manage Meta ad preferences in your Facebook or Instagram settings. The site will still work if you block these cookies.

We take reasonable steps to protect your personal information from misuse, interference, loss and unauthorised access, change or disclosure. These steps include:

• two-factor authentication for all staff access to customer data;
• encryption in transit and at rest, with stronger encryption and a tamper-evident access log for identity and AML records;
• access limited to staff who need it for their role; and
• staff training and confidentiality obligations.

If a data breach is likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner (OAIC) as the Notifiable Data Breaches scheme requires.

The AML/CTF Act requires us to keep customer identification records and transaction records for at least 7 years after our business relationship with you ends, or after the transaction, as applicable. We keep call recordings and messages for as long as we need them for the purposes in this statement, and longer where they form part of a transaction or compliance record.

When we no longer need your information and the law no longer requires us to keep it, we securely destroy or de-identify it.

Privacy enquiries

NeoEx (Armin Pty Ltd)

Email: info@neoex.com.au (please write "Privacy" in the subject line)

Phone: 1300 70 40 40

Post / in person: South Tower, Level 5, Suite 501, 1–5 Railway Street, Chatswood NSW 2067

We may update this statement from time to time, for example when the law or our services change. The current version is always on our website, with its "last updated" date. If we make a significant change, we will tell you before it takes effect.