Status: DRAFT — prepared from the current codebase (what the platform actually collects and where it goes). It must be reviewed by legal counsel and the AFSL holder before publication. Items in [square brackets] must be confirmed.
Effective date: [DD Month YYYY]
Last updated: [DD Month YYYY]
1. Who we are
This Privacy Policy explains how Digital Finance CRC Limited (ACN 652 335 405), which operates the ImpactX platform (“ImpactX“, “we“, “us“, “our“), handles personal information. We operate as Corporate Authorised Representative No. [x] of Vellum Australia Pty Ltd (ACN 605 190 369, AFSL No. 482051) (the “AFSL Holder“).
We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (“APPs“). Where they apply to us, we also comply with the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) (“AML/CTF Act“) and the Corporations Act 2001 (Cth).
This policy covers the ImpactX web platform, the emails it sends, and any contact you have with us about the platform.
2. Personal information we collect
We collect only what we need to confirm that you are eligible, give you access, and meet our legal obligations.
2.1 Information you give us
| When | What we collect |
|---|---|
| Invitation | Your email address, entered by ImpactX staff when they invite you. |
| Account set-up | First and last name; email address; company or firm name (optional); tax identifier such as an ABN, ACN or TFN (optional); and your persona (investor/family office, or financial adviser). |
| Wholesale and AML/KYC confirmations | A record of each confirmation you give (wholesale client status, no retail protections, general advice only, duty to tell us about changes, consent to data handling, false information warning, identity verification consent, and sanctions/PEP screening consent), with the date and time. |
| Supporting documents [when built] | Documents proving wholesale status (for example an accountant’s certificate) and identity documents, if we ask for them. |
| Profile updates | Any changes you make to your name, company, tax ID or persona on the Settings page. |
| Access enquiry | If your invite link is invalid or has expired and you ask for access: your name, email address and an optional message. |
| Correspondence | Anything you send us by email or another channel. |
Tax file numbers. You do not have to give us a TFN. Please give an ABN or ACN where you can. If you do give a TFN, we handle it in line with the Privacy (Tax File Number) Rule 2015 and use it only where the law allows. [Legal to confirm whether TFN collection should continue — see note at end.]
2.2 Information we collect automatically
| Data | Purpose |
|---|---|
| Opportunity views | The first time in a session that you open a listing, we record your user ID, the opportunity and the time. |
| Enquiries | When you click “Enquire” on a listing, we record your user ID, the opportunity and the time. |
| Authentication data | Sign-in events, session tokens and related technical data managed by our authentication provider (Supabase). This can include IP address and browser information. |
| Server and security logs | Standard request logs kept by our hosting and infrastructure providers (for example IP address, timestamp, URL and user agent), used for security, debugging and rate limiting. |
| Administrative audit trail | When ImpactX staff act on an account (for example inviting, revoking or changing a user), we record which staff member did what, to which record, and when. |
We do not use third-party advertising, cross-site tracking or marketing analytics on the platform.
2.3 Information from third parties
When we verify your identity or screen you, we may receive information from the AFSL Holder, from identity verification providers (including the Document Verification Service, biometric matching or myID), and from sanctions and politically exposed person (PEP) databases. We may also receive information from your financial adviser or accountant.
2.4 Sensitive information
We do not intend to collect sensitive information as defined in the Privacy Act. Biometric information may be collected only during identity verification, and only with your express consent.