Privacy policy

1. Who we are

Altego is operated by Altren Group Pty Ltd ABN 32 700 087 332, a technology company based in Melbourne, Victoria, Australia ("Altego", "we", "us", "our"). We build and operate AML/CTF operations software for Australian reporting entities, including remittance businesses, digital currency exchanges and Tranche 2 professions.

Our privacy contact. For any privacy question, request or complaint: altegoprivacy@altego.com.au. We aim to respond within 5 business days.

2. How we handle personal information

Altego is used by regulated businesses to meet their own obligations, so we handle personal information in two distinct ways.

If you are a customer of a business that uses Altego, your privacy concerns about that data should go to that business first. We will cooperate with reasonable requests from a reporting entity to help it meet its obligations under the Privacy Act 1988 (Cth).

3. What personal information we collect

3.1 When you visit our website. IP address and approximate location derived from it; browser, operating system and device type; pages visited, time on page and referring URLs; cookies and similar technologies (see section 9).

3.2 When you register a business. Identity and contact information such as name, email address and phone number; business information such as legal name, trading name, ABN or ACN, head office address and business type; the AUSTRAC registration or enrolment number and the documentary proof supplied for it; billing and payment details, processed by our payment provider (we do not store full card numbers); and anything else you choose to provide during registration.

3.3 When you use the platform. Information generated by your use of the platform, including customer and beneficiary records, identity verification records, transaction records, alerts, cases, screening results, reports and the decisions recorded against each; usage data such as which features you access and when; device and session information used to keep the account secure; support messages, chat transcripts and emails exchanged with our team; and the audit trail of actions taken in the platform.

Information held in the platform about a reporting entity's own customers is handled under section 2 and section 12.

3.4 When you contact us. Your name, email address, anything you include in your message, and our correspondence with you.

3.5 Information we receive from third parties. Payment status from our payment provider; publicly available sources such as ASIC and the AUSTRAC Reporting Entities Roll, to verify business details and registration.

4. How we use your information and our lawful basis

We collect only the personal information reasonably necessary for the purposes above. We do not use information held in the platform to train artificial intelligence or machine learning models without the reporting entity's express consent.

5. How long we keep your information

The seven-year record-keeping obligation under the AML/CTF Act rests with the reporting entity, not with Altego. The platform is not the reporting entity's system of record once a subscription has ended. A reporting entity must export its records before its subscription ends and hold its own copy. After the 90-day period, records held only in Altego cannot be recovered.

At the end of the applicable period we securely delete or de-identify the information. Where you ask us to delete information before the end of a retention period, we will comply to the extent the law permits, and we will explain where we cannot.

6. Who we share your information with

We do not sell personal information. We share it only as follows.

6.1 Our service providers. We use third-party providers to help operate the platform. They may use personal information only for the purpose we engage them for and are contractually bound to protect it.

A current list of our service providers, what each handles and where it operates, is available on request from altegoprivacy@altego.com.au.

6.2 AUSTRAC, law enforcement and courts. We may disclose information where required by law, court order or other legal process. Where we receive a request for a reporting entity's data, we notify that entity before responding so it can take whatever steps it considers appropriate, unless we are prohibited from telling it. Where we are prohibited, we notify it as soon as the prohibition ends.

6.3 Business transfers. If Altren Group is involved in a merger, acquisition or sale of assets, information may be transferred as part of that transaction. We will notify you before your information becomes subject to a different privacy policy.

6.4 With your consent. Where you have given us explicit consent for a specific disclosure.

7. Where your information is held

Data in the Altego platform is hosted in Australia. Production data is held in Sydney, with a replica and backups in Melbourne. Platform data does not leave Australian infrastructure as part of normal operation.

Where any service provider we use operates outside Australia, we take the steps APP 8 requires before disclosing personal information to it, including contractual arrangements requiring handling consistent with the Australian Privacy Principles, and we limit what is shared to what the service requires. The current list described in section 6.1 states where each provider operates.

8. Your privacy rights

To exercise any of these, contact altegoprivacy@altego.com.au. We may ask you to verify your identity first. Access and correction are free unless a request is voluminous or complex, in which case we agree a reasonable fee with you in advance. We never charge a fee just for lodging a request.

9. Cookies and similar technologies

Our marketing website uses first-party analytics to understand traffic and improve content. We do not use advertising, targeting or cross-site tracking cookies, and we do not share cookie data with advertisers or data brokers. The contact form uses Cloudflare Turnstile to verify that a submission comes from a person rather than a script, which may set a small number of cookies for that purpose. The product platform uses session cookies to keep you signed in and to protect the session; it does not use cookies for behavioural tracking.

10. Security

We implement technical and organisational measures appropriate to the sensitivity of the information the platform holds:

• encryption in transit using TLS 1.2 or above;
• encryption at rest using AES-256 or equivalent, including backups;
• separation of businesses enforced at the data layer, not only in the interface, so one business cannot reach another's data;
• role-based access control, and tipping-off partitions that restrict who can see that a report exists or is contemplated;
• multi-factor authentication required for every sign-in;
• an append-only audit trail of every alert, parameter change, screening decision and report action;
• no standing access by Altego staff to a reporting entity's data; where a support request requires access it is granted for that request, logged, and removed when the request closes;
• continuous monitoring of production systems and periodic security testing;
• encrypted backups held in a second Australian region.

No security measure eliminates risk. Under the Notifiable Data Breaches scheme we will notify you and the Office of the Australian Information Commissioner as soon as practicable after becoming aware of a breach likely to result in serious harm, and we aim to notify within 72 hours.

11. Identity verification

Identity checks are recorded in Altego by the business's own staff, against the document the person provides. Altego does not currently send identity details to an electronic verification provider, because none is connected. If one is connected in future, this page will say which provider, what is shared and what Altego receives back, before the method can be enabled for any business.

12. If you are a customer of a reporting entity

If a business that uses Altego holds your personal information in the platform, that business is responsible for it and we hold it on that business's behalf so it can meet its obligations under the AML/CTF Act.

Direct any access, correction or deletion request to that business in the first instance. We will cooperate with it to help it respond. Two things to be aware of: the law requires that business to keep certain records for seven years, and those records cannot be deleted on request while that obligation applies; and the AML/CTF Act restricts what a reporting entity may tell you about a report it has made or is considering.

If you cannot reach the business, or it directs you to us, contact altegoprivacy@altego.com.au and we will assist where we reasonably can.

13. Children's privacy

Altego is intended for use by regulated businesses and adults. We do not knowingly collect personal information from anyone under 18 other than where a reporting entity holds it in the platform as part of its own customer records. If you believe we have inadvertently collected information from a minor, contact altegoprivacy@altego.com.au.

14. Direct marketing

We may send marketing about our products and features where we have your consent or are otherwise permitted. Every marketing message includes an easy way to unsubscribe, and you can opt out at any time by clicking unsubscribe, emailing altegoprivacy@altego.com.au, or updating your preferences in your account. We process an opt-out within 5 business days. Opting out does not affect transactional messages such as invoices, security alerts and service updates. We comply with the Spam Act 2003 (Cth).

15. Links to other websites

Our website may link to third-party websites and services. This policy applies only to Altego. We are not responsible for the privacy practices of any third party, and we encourage you to read their policies.

16. Changes to this policy and version history

We may update this policy. When we make a material change we will notify you by email at least 30 days before it takes effect, and post the updated policy at altego.com.au/privacy with the new effective date. Where a change requires your consent, we will ask for it before the change takes effect.

Each version of this Privacy Policy is published with an effective date, and earlier versions are kept on record and available on request.

To request an earlier version of this policy, email altegoprivacy@altego.com.au.

17. Applicable law and how to complain

This policy is written to comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles, the Notifiable Data Breaches scheme, and the Spam Act 2003 (Cth). Our handling of AML/CTF records is also governed by the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth).

If you have a concern we have not resolved to your satisfaction, you can contact the Office of the Australian Information Commissioner at oaic.gov.au, on 1300 363 992, or online at oaic.gov.au/privacy/privacy-complaints.

18. Contact us

• Privacy: altegoprivacy@altego.com.au
• Security: security@altego.com.au
• General enquiries: hello@altego.com.au
• Phone: 1300 556 527, 9 am to 5 pm AEST, Monday to Friday, excluding Victorian public holidays
• Website: altego.com.au

We aim to respond to privacy enquiries within 5 business days.

Altren Group Pty Ltd · ABN 32 700 087 332 · Melbourne, Victoria, Australia