Privacy Policy

1. About this Privacy Policy

1.1 Who we are. This Privacy Policy applies to Rounded Wealth Advisory Pty Ltd ACN 633 327 143, ABN 32 633 327 143, AFSL 523251 (Rounded Wealth Advisory, we, us or our).

1.2 Our obligations. We are bound by the Privacy Act 1988 (Cth) (Privacy Act) and the Australian Privacy Principles (APPs) in it. We also handle personal information in line with other laws that apply to financial services businesses, including the Corporations Act 2001 (Cth), the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) and the Privacy (Tax File Number) Rule 2015.

1.3 Who this policy covers. This policy applies to personal information about our clients and prospective clients, visitors to www.roundedwealth.com.au (Website), subscribers to our Insights newsletter, people who contact us, and other individuals we deal with in running our business, such as representatives of product issuers and service providers. Our Website and services are intended for people aged 18 or over, and we do not knowingly collect personal information directly from children, other than details of dependants that a client gives us.

1.4 Other documents. This policy should be read together with our Website Terms and Conditions and Cookie Policy. When we provide you with financial advice, our Financial Services Guide and client engagement documents may contain further information about how we handle your information.

1.5 What personal information is. Personal information is information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether or not it is true or recorded in a material form.

2. The kinds of personal information we collect

2.1 The personal information we collect depends on how you deal with us. When you open an account or become a client, it may include:

• identity and contact details, such as your name, date of birth, town or city and country of birth, citizenship, residential address, email address and mobile number;
• login and security details, such as your password (which we never store in readable form), one-time verification codes sent to your phone, and the devices you use to log in;
• identity verification information, such as images and details of your driver's licence or passport (including the document number, issuer and expiry date), proof of address documents such as a bank statement, utility bill or council notice, and a selfie or short video used to match you to your photo ID (see clause 6);
• tax information, such as your tax file number (TFN), your country or countries of tax residence and, for companies and trusts, your FATCA and CRS tax classification;
• financial information, such as your annual income, net worth, liquid assets, the source of your funds and wealth, investments, superannuation, insurance policies, expenses, liabilities and financial goals;
• bank account details, such as your account name, BSB and account number, so that we can make payments to you;
• employment information, such as your occupation and employer;
• suitability information, such as your risk tolerance, investment preferences and experience;
• affiliation and screening information, such as whether you or a close family member are a director, 10% shareholder or senior officer of a listed company, or work for a broker, exchange or financial regulator, and whether you are a politically exposed person or appear on a sanctions list;
• company and trust information, where you open an account for an entity, such as its name, ABN, ACN, registered office, trust type and trust deed, ASIC extracts, and the identity details of its directors, trustees, authorised signatories and beneficial owners (people who own or control 25% or more);
• joint account holder information, such as the details listed above for the person you open a joint account with;
• family and estate planning information, such as details of your partner, dependants and beneficiaries, and your will and powers of attorney;
• sensitive information, such as biometric information used to verify your identity;
• records of our dealings with you, such as your electronic signature, the agreements and consents you accept (with the date, time and IP address), booking notes, file notes, emails, Statements of Advice, Records of Advice;
• your preferences, such as your communication and marketing preferences.

2.2 If you use our Website or subscribe to our publications, we may collect your name, email address and the information you provide in forms, together with technical and usage information collected by cookies, pixels and similar technologies, such as your IP address, device identifiers, browser type, approximate location, the pages you visit, the ads you have seen or clicked and how you interact with our emails (see clause 11).

2.3 If you book a call with an adviser, we collect your name, contact details, preferred time and anything you tell us you would like to discuss.

2.4 If you apply for a job with us, we collect the information in your application, such as your résumé, qualifications, work history and referee details.

3. How we collect personal information

3.1 Directly from you. Wherever reasonable and practicable, we collect personal information directly from you, for example when you complete our online account application, meet or speak with us, book a call, complete a fact find or other form, use our client portal, send us an email, or subscribe through our Website.

3.2 From third parties. We may also collect personal information about you from others, where you have consented or where it is unreasonable or impracticable to collect it from you directly. These may include:

• our identity verification provider, Sumsub, which tells us the result of your identity checks (see clause 5.3);
• the primary applicant, where you are a joint account holder, director, trustee, signatory or beneficial owner named in an application;
• your accountant, solicitor, mortgage broker or other professional adviser;
• product issuers, investment platforms, superannuation trustees and insurers, for example to obtain details of your existing products;
• your employer, for example in relation to workplace superannuation or insurance;
• advertising and social media platforms, such as Meta, Google and LinkedIn, which may tell us how you came to our Website or responded to our ads;
• people you have authorised to act for you, such as an attorney or family member; and
• publicly available sources, such as the ASIC and ABN registers.

3.3 Calls and meetings. We may record phone calls and video meetings for quality, training and compliance purposes. We will tell you before a call or meeting is recorded.

3.4 Information about other people. If you give us personal information about someone else, such as a joint account holder, a director, trustee or beneficial owner, or your partner or dependants, please make sure they know you are doing so and that they can read this policy. Where the law requires us to verify their identity, we will send them a link to complete their own verification.

3.5 Unsolicited information. If we receive personal information we did not ask for, we will decide whether we could have collected it lawfully for our purposes. If not, we will destroy or de-identify it as soon as practicable where it is lawful and reasonable to do so.

4. Dealing with us anonymously

4.1 You can browse our Website and make general enquiries without telling us who you are, or by using a pseudonym. However, we cannot provide financial advice or arrange financial products for you without identifying you, because the law requires us to know who our clients are and to understand their circumstances.

5. Why we collect, hold, use and disclose personal information

5.1 Our purposes. We collect, hold, use and disclose personal information so that we can:

• provide financial advice and related services to you, including understanding your objectives, financial situation and needs;
• arrange, apply for, vary or dispose of financial products on your behalf;
• verify your identity and meet our legal and regulatory obligations;
• manage our relationship with you, including communicating with you, administering your account and charging fees;
• respond to your enquiries, requests and complaints;
• send you publications and information about our services where you have agreed or the law allows (see clause 10);
• operate, secure and improve our Website and services, including through analytics;
• manage our business, including risk management, audit, insurance, training and quality assurance;
• assess job applications; and
• for any other purpose you have consented to, or that is required or authorised by law.

5.2 Laws that require us to collect information. We are required or authorised to collect certain personal information under Australian law, including the Corporations Act (for example, to give you advice that is in your best interests), the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) (to verify your identity), and taxation laws (in relation to your TFN and foreign tax residency).

5.3 Identity verification with Sumsub. We use Sumsub (Sum and Substance Ltd, a company registered in England) to verify the identity of applicants, joint account holders, directors, trustees and beneficial owners. When you verify your identity, Sumsub collects your photo ID, proof of address and a selfie or short video. It checks that your documents are genuine, compares your face to your ID photo, and confirms that you are a real person present at the time (a "liveness" check). Sumsub may also screen your name against politically exposed person, sanctions and adverse media lists. Sumsub then reports the result to us. Sumsub handles your information under its own privacy notice, available at sumsub.com, and in some cases, such as fraud prevention, uses it for its own purposes under that notice. You will be asked to acknowledge Sumsub's notice before your verification starts.

5.4 If you do not give us information. If you do not provide the personal information we ask for, or it is incomplete or inaccurate, we may not be able to open your account or provide our services to you, or the advice we give may not be appropriate for your circumstances.

5.5 Secondary purposes. We will only use or disclose your personal information for another purpose if you consent, if you would reasonably expect us to use it for a related purpose, or if the law permits or requires it.

6. Sensitive information

6.1 Sensitive information includes information about your health, racial or ethnic origin, religious beliefs and criminal record, and biometric information used to verify or identify you. It receives extra protection under the Privacy Act.

6.2 We only collect sensitive information with your consent, and only where it is reasonably necessary for our services, unless the law requires or permits us to collect it without consent. For example:

• Biometric information. When you take a selfie or short video during identity verification, Sumsub creates a template of your facial features to compare with your ID photo and to check that you are a real person. We ask for your consent before this check starts. Biometric information is used only to verify your identity and prevent fraud, and is deleted by Sumsub in line with our instructions once it is no longer needed. If you do not want to complete a biometric check, please contact us to discuss other ways to verify your identity.

6.3 We only use and disclose sensitive information for the purpose for which you provided it, or a directly related purpose you would reasonably expect, or as the law permits.

7. Tax file numbers

7.1 We only collect, use and disclose your TFN where we are permitted to by taxation, superannuation or other laws, such as when we help you apply for a financial product or superannuation account. You are not required to give us your TFN, but if you do not, tax may be withheld from your investment income at the highest marginal tax rate plus the Medicare levy.

7.2 We handle TFNs in line with the Privacy (Tax File Number) Rule 2015. We do not use your TFN, or any other government related identifier such as your driver's licence, passport or Medicare number, as our own identifier for you.

8. Who we disclose personal information to

8.1 We may disclose your personal information, for the purposes in clause 5, to:

• product issuers, investment platforms, superannuation trustees, insurers and other financial institutions, when we arrange or manage products for you;
• our identity verification provider, Sumsub;
• service providers who help us run our business, such as paraplanning, administration, IT, cloud hosting, document management, electronic signature, SMS and email delivery, call booking, mailing and printing providers;
• advertising, analytics and social media providers, such as Meta, Google and LinkedIn, in the form of website usage data and, where you have not opted out, encrypted (hashed) contact details used to measure and target our ads (see clause 11);
• your accountant, solicitor or other professional adviser, where you have asked us to or consented;
• people you have authorised to act for you, such as an attorney;
• our auditors, insurers, compliance consultants and legal advisers;
• regulators, government agencies and dispute resolution bodies, such as ASIC, AUSTRAC, the Australian Taxation Office and the Australian Financial Complaints Authority (AFCA), where required or authorised by law;
• referral partners, where you have asked to be referred and consented to the disclosure; and
• a prospective purchaser of all or part of our business, under appropriate confidentiality arrangements.

8.2 When we share personal information with service providers, we require them to keep it confidential and to use it only for the services they provide to us.

8.3 We do not sell personal information. We do not sell, rent or trade your personal information to anyone.

9. Overseas disclosure

9.1 Some of the service providers we use store or process personal information outside Australia. In particular:

• Identity verification. Sumsub is based in the United Kingdom and stores verification data on servers in Germany. It may also transfer data to members of its group or service providers in the United Kingdom, Switzerland, the United States, the United Arab Emirates, Singapore and Brazil.
• Advertising and analytics. Meta, Google and LinkedIn process website usage and advertising data mainly in the United States, and may also process it in other countries where they or their service providers operate.

9.2 Before we disclose personal information overseas, we take reasonable steps to ensure the recipient handles it in a way that is consistent with the APPs, for example through contractual obligations. If we cannot do this, we will only disclose your information with your consent or where the law permits.

10. Direct marketing

10.1 We may use your contact details to send you our Insights newsletter, invitations to events, and information about our services that may interest you, where you have consented or where the Privacy Act permits.

10.2 Every marketing email or SMS we send will identify us and include a simple way to unsubscribe, in line with the Spam Act 2003 (Cth). We will comply with the Do Not Call Register Act 2006 (Cth) when making marketing calls.

10.3 You can opt out of direct marketing at any time by using the unsubscribe link, calling us on 1300 050 090 or emailing privacy@roundedwealth.com.au. Opting out will not affect communications we must send you about your account or the services we provide.

10.4 We do not disclose your personal information to other organisations for their own direct marketing.

10.5 We also advertise our services online, including on social media. Clause 11 explains how advertising platforms help us show and measure those ads, and how you can limit this.

11. Our Website, cookies and analytics

11.1 Cookies. Our Website uses cookies and similar technologies to operate the Website, keep you logged in securely, remember your preferences, understand how visitors use it and measure the effectiveness of our advertising and communications. You can manage or disable cookies through your browser settings, although some parts of the Website may not work properly if you do. Our Cookie Policy has more detail.

11.2 Analytics. We use Google Analytics to collect information such as your device and browser type, approximate location (worked out from your IP address), referring website, the pages you visit and the time you spend on them. We use this information in aggregate to improve our Website and services. You can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on.

11.3 Advertising pixels and social media tracking. Our Website uses tracking pixels and tags from advertising and social media platforms, including the Meta Pixel (Facebook and Instagram), Google advertising tags and the LinkedIn Insight Tag, and other social media platforms we advertise on. These tools collect information about your visit, such as the pages you view and actions you take (for example, starting an application or booking a call), together with your IP address, device information and cookie identifiers. The platforms use this information to help us measure how our ads perform, show our ads to people who have visited our Website (remarketing), and find people with similar interests. The platforms may combine it with information they already hold about you, such as your account with them, under their own privacy policies.

11.4 Customer lists. We may share encrypted (hashed) email addresses or phone numbers with Meta, Google or LinkedIn so that they can match them to their users, measure our ads and exclude existing clients from them. The platforms do not receive your contact details in readable form, and delete the hashed data after matching.

11.5 Your choices. You can limit this tracking by adjusting your cookie settings or browser privacy controls, and by changing your ad preferences in your Meta, Google and LinkedIn account settings. You can also opt out of interest-based advertising from many providers through the Your Online Choices website (youronlinechoices.com.au). Opting out does not stop you seeing ads, but they will be less tailored to you.

11.6 Emails. Our emails may contain technology that tells us whether an email was opened and which links were clicked, so that we can improve our communications.

11.7 Forms and client portal. Information you submit through Website forms or our client portal is transmitted over an encrypted connection. Please do not include your account passwords, or detailed financial or health information, in a Website form; we will request any such information through a secure channel if it is needed.

11.8 Links and social media. Our Website may link to other websites and social media platforms, such as LinkedIn. We are not responsible for the privacy practices of those websites or platforms, and we encourage you to read their privacy policies.

12. Automated decision-making

12.1 Identity verification. When you open an account, Sumsub's software uses your identity document details and images, your selfie or video to check your identity automatically. Its result is one of the things we use to decide whether we can open your account.

12.2 Advice and suitability. The answers you give about your income, net worth, liquid assets, risk tolerance and source of funds help us assess what is suitable for you. Decisions about the advice we give you are made by our qualified advisers, not solely by software.

12.3 If you have a question about an automated check, or believe a result is wrong, please contact us and a member of our team will review it.

13. How we hold and protect personal information

13.1 How we hold it. We hold personal information in electronic form on secure servers and systems, including cloud-based systems, and in paper files at our offices.

13.2 How we protect it. We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. These steps include:

• access controls and multi-factor authentication, so that only authorised staff can see client information;
• encryption of information in transit and, where appropriate, at rest;
• firewalls, anti-malware and regular security updates;
• secure offices and lockable storage for paper files;
• confidentiality obligations and regular privacy and cyber security training for our staff; and
• due diligence on, and contractual obligations for, our service providers.

13.3 How long we keep it. We keep personal information for as long as we need it for our purposes and to meet our legal obligations. Financial services and anti-money laundering laws generally require us to keep client records for at least 3 years. When we no longer need personal information, we take reasonable steps to securely destroy or de-identify it.

14. Data breaches

14.1 We have procedures for responding to data breaches. If a data breach involving your personal information is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act, and tell you what steps you can take to protect yourself.

15. Accessing and correcting your personal information

15.1 Access. You can ask for access to the personal information we hold about you by contacting our Privacy Officer. We will respond within a reasonable time, usually within 30 days. We will not charge you for making a request, but we may charge a reasonable fee to cover the cost of providing access, and we will tell you about any fee first.

15.2 Correction. We take reasonable steps to make sure the personal information we hold is accurate, up to date, complete and relevant. Please tell us if your details change. If you believe information we hold about you is incorrect, you can ask us to correct it, and we will respond within a reasonable time, usually within 30 days.

15.3 If we refuse. In some circumstances the Privacy Act allows us to refuse access or correction, for example where giving access would unreasonably affect someone else's privacy or is unlawful. If we refuse, we will tell you why in writing and how you can complain. If we refuse to correct information, you can ask us to attach a statement to it noting that you believe it is incorrect.

15.4 We may need to verify your identity before we give you access to, or correct, your personal information.

16. Privacy complaints

16.1 Contact us first. If you believe we have breached the Privacy Act or the APPs, please contact our Privacy Officer using the details in clause 18, or email complaints@roundedwealth.com.au. Please give us enough detail to investigate your concern.

16.2 How we handle complaints. We will acknowledge your complaint within 24 hours, or one business day, of receiving it, investigate it, and give you a final response within 30 calendar days, in line with our Complaints Policy. If we need more time, we will tell you why.

16.3 AFCA. If you are not satisfied with our response, and your complaint relates to the financial services we provide, you may contact the Australian Financial Complaints Authority, which can deal with privacy complaints about its members. Rounded Wealth Advisory is an AFCA member (member number 76566).

• Website: www.afca.org.au
• Email: info@afca.org.au
• Phone: 1800 931 678 (free call)
• Mail: Australian Financial Complaints Authority, GPO Box 3, Melbourne VIC 3001

16.4 OAIC. You may also complain to the Office of the Australian Information Commissioner.

• Website: www.oaic.gov.au
• Phone: 1300 363 992
• Mail: GPO Box 5288, Sydney NSW 2001

17. Changes to this Privacy Policy

17.1 We may update this Privacy Policy from time to time to reflect changes in the law, our services or how we handle personal information. The updated policy will be published on our Website and takes effect from the "Last updated" date shown above. You can ask us for a free copy of this policy in another format at any time.

18. Contact us

Privacy Officer

Rounded Wealth Advisory Pty Ltd

ACN 633 327 143 · ABN 32 633 327 143 · AFSL 523251

• Email: privacy@roundedwealth.com.au
• Phone: 02 8880 6200 or 1300 050 090
• Mail: Privacy Officer, Level 35, One International Towers, 100 Barangaroo Avenue, Sydney NSW 2000
• Website: www.roundedwealth.com.au