Duely is a registered business name of Ilixir Technologies Pty Ltd (ABN 11 680 039 392, ACN 680 039 392) ("Duely", "we", "us", "our"). We are committed to protecting your privacy. This Privacy Policy outlines how we collect, use, disclose, and safeguard your personal information when you use our platform and website. This policy is prepared to comply with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth). Duely is listed on the Office of the Australian Information Commissioner's Privacy Opt-in Register (as "ILIXIR TECHNOLOGIES Pty Ltd t/as Duely") and handles all personal information in accordance with the Australian Privacy Principles.

This policy explains how we handle personal information. Where the Privacy Act requires consent (for example, before an identity check that uses your personal information), we obtain it separately, as described in sections 2 and 7.

This version applies from the date it is published, shown at the top of this page, because it describes how we handle personal information now. It is not part of our contract with Firms: where a change also affects the Data Processing Agreement, that agreement says when the change takes effect for a Firm. Section 12 lists what changed in this version. The providers we rely on, the countries they process in, how long each holds data and the documents that bind them are set out in section 4 of our Data Processing Agreement.

1. Role as a Data Processor versus Data Controller

For the AML/CTF compliance tools provided through our platform:

the Reporting Entity (Firm / Subscriber) using our platform is the Data Controller of its clients' personal data; and
Duely acts as the Data Processor, acting on the instructions of the Firm.

Where Duely obtains identity information from a verification provider or a government registry in the course of an identity check, Duely also has its own obligations under the Privacy Act and its agreements with those providers. Those obligations apply in addition to any instruction from a Firm and, where inconsistent, prevail over it. Duely is bound by the Australian Privacy Principles for all personal information it holds, including information it processes for a Firm.

If you are an individual whose data has been submitted to Duely by a participating Firm, your primary point of contact for privacy inquiries is the Firm itself. You may also contact us directly (section 10).

2. Information We Collect

We collect personal information to operate and improve our services.

2.0 How We Collect Information

We collect personal information through the following channels:

Directly from you: when you register an account, subscribe to a plan, submit a support request, or interact with our platform.
From Firms on behalf of their clients: when a Firm uploads customer identity documents, enters customer details, or initiates verification workflows through the platform.
From third-party providers: identity verification results; sanctions, politically exposed person, criminal watchlist and adverse-media screening results; Document Verification Service (DVS) match results where a Firm requests a document check; Australian Business Register (ABR) records; details read from a document by our AI provider; and payment confirmations.
Automatically: through cookies and the analytics and advertising tags described in section 8 (Google Analytics, Google Ads, Meta Pixel and Microsoft Advertising) when you visit our public website, through server logs and error reports when you use the platform, and through the chat assistant on our website if you use it. See our Cookie and Tracking Policy for details.

2.1 Information Collected from Subscribers (Firms)

When creating an account or subscribing to our services, we collect:

contact details (name, email address, phone number);
business details (company name, ABN/ACN, role/title), which we verify against the Australian Business Register;
billing and payment information; and
account credentials and platform usage data.

2.2 Sensitive Data Processed on Behalf of Firms

In operating our AML/CTF compliance platform, we process sensitive customer data on behalf of Firms, which may include:

Identity information: names, dates of birth, residential addresses.
Government-issued IDs: drivers' licences, passports, Medicare cards, and the document numbers on them. Document numbers are government related identifiers under APP 9. We use and disclose them only to verify the identity of the individual for the Firm's obligations under the AML/CTF Act 2006 (Cth), and we do not adopt them as our own identifier for any person. For a Document Verification Service check, our record of the request never holds the person's name, date of birth or address, and the document numbers in it are deleted 7 days after the check is resolved, once their purpose is fulfilled. We keep the rest of that record (the document type, the result and reference numbers) for 7 years, as our agreement with the agency requires. The Firm's customer record may still hold the document details it recorded. The Attorney-General's Department, which administers the Document Verification Service, explains how it handles personal information in its Identity Verification Services privacy statement.
Biometric data: a live image (selfie) and liveness and face-match data, collected through our identity verification provider. We delete our copy of the live image within 7 days of capture, except that a copy included in a reliance pack the Firm releases to another firm is kept with that pack as part of the Firm's records, for the life of the subscription and the deletion periods in section 6. The provider keeps its copy of the verification session, including the face template it creates for the face match, for about one month after the check and then deletes it. The provider may also keep pseudonymised data derived from the check for its own purposes, as described in section 4.3. What stays is the identity document record, the face-match and liveness results, and a hash proving the image existed. If a Firm releases a reliance pack to another reporting entity that relies on its customer due diligence, and the Firm has chosen to include identity images, the pack includes a copy of the live image if it has not yet been deleted.
Screening data: politically exposed person (PEP), sanctions, criminal watchlist and adverse-media results. Only the person's name and, for individuals, date of birth, gender and any declared citizenship go to our screening provider. For a one-off check it keeps them only for the duration of the request. Where ongoing monitoring is turned on, it keeps the name, date of birth and gender while the person is part of an active engagement, and deletes them when we remove the person from monitoring.

3. How We Use Information

We use the collected information to:

operate and maintain the Duely platform;
facilitate Identity Verification (KYC/KYB) and screening processes as instructed by the Firm;
process payments and manage subscriptions;
provide customer support and respond to inquiries;
monitor platform security and prevent fraudulent activity; and
analyse platform usage and improve our services. Personal information of individuals whose identity a Firm checks is used for this only after it has been de-identified and aggregated so that it no longer identifies the Firm or any individual.

Marketing to Firms: we may use the contact details of Subscribers and their account holders to send product updates, feature announcements and offers about Duely services. You can opt out at any time using the link in the message or by contacting us, and we action opt-outs within five business days (APP 7).

No marketing or profiling of verified individuals: we do not use the personal information of individuals whose identity a Firm asks us to check (their identity information, identity documents, biometric data or screening results) to build profiles of them, to offer, advertise or promote goods or services to them, to enable anyone else to do so, or for market research.

AI features: Duely has two AI features. Dee, the in-app assistant, answers a user's questions from the Firm's records and Duely's help guides. When Duely makes Dee available, it is on for every Firm unless a Firm administrator turns it off. AI-assisted document reading drafts identity or entity details from a document the Firm uploads, for the Firm to check, and is off until a Firm administrator turns it on. A Firm administrator can turn either on or off under Settings > Consent and privacy > Your firm. When a feature is on, only the document being read or the records needed for the answer go to our AI provider, which does not use them to train its models and deletes them within 30 days unless the law or its usage policy requires longer. Dee conversations are deleted from Duely after 90 days.

We do not use customer data to train our own AI models, and our providers may not use it to train theirs. Before we add an AI feature that uses a new provider or uses data for a new purpose, we give Firms at least 30 days' notice under section 4 of the Data Processing Agreement.

4. How We Share and Disclose Information

We do not sell your personal information. We share information only in the following circumstances.

4.1 Service Providers

We use these providers to run Duely:

Service	Where	Personal information
Identity document and face-match verification	European Union, with transfers outside the European Economic Area, including to the United States, under standard contractual clauses	Identity documents and a live image, deleted about one month after the check (pseudonymised data kept for the provider's own purposes is described in section 4.3)
Sanctions, PEP, criminal watchlist and adverse-media screening	Switzerland and European Union	Name, date of birth, gender and any declared citizenship: for the duration of a one-off check, or while the person is monitored
AI document reading (only for a Firm that has turned it on) and Dee (when Duely makes it available, unless a Firm has turned it off)	The United States, and any other country where our AI provider runs its models	The document or records needed, normally deleted within 30 days (legal and usage-policy exceptions apply)
Document Verification Service (DVS), through our DVS gateway, where a Firm requests it	Australia	Document details, name and date of birth, for a match or no-match result
Hosting, storage and sign-in	Australia	All platform records
Payments	United States and other countries	Firm billing details (the payment provider also acts as an independent controller for payment data)
Email from the platform	United States	Recipient name and email address and the content of the email
Error monitoring	Germany (storage), with sub-processors in the United States and other countries	Technical details of an error, which can include a user identifier
Address lookup in the platform	United States and other countries	The address text a user types, sent from the user's browser, with its IP address
Fonts for the platform and website	United States and other countries	The visitor's IP address and browser details, sent when a page loads
Website hosting	The hosting provider's global network, including Australia and the United States	Requests to our website, including the visitor's IP address and anything submitted through a website form
Website analytics and advertising tags	United States and other countries where Google, Meta and Microsoft operate	Pages visited, browser identifiers and device details, collected by tags that load when a page of our public website loads (section 8)
Website chat and follow-up email	United States	What a visitor types, and an email address if they ask for a follow-up
Demo booking on our website	United States	The name, email address and booking details a visitor enters

The platform providers, with their retention and breach notice periods, are described in section 4 of the Data Processing Agreement. The website services above have no access to records held in the Duely platform. Please do not enter personal or client information in the website chat. The ABR is a public register; we send it only the ABN or business name being looked up.

4.2 Legal and Regulatory Requirements

We may disclose information where required by law, subpoena, or other legal process, or where a permitted general situation applies under section 16A of the Privacy Act 1988, such as lessening a serious threat to life, health or safety, or taking action on suspected unlawful activity. We may also disclose information to a verification provider or the government agency administering a verification service where our agreements with them require it, including for audit of our use of that service. Where permitted by law, we will notify the Firm of such requests in accordance with our Law Enforcement Request Policy.

4.3 Overseas Disclosure: the Steps We Take (APP 8)

When we disclose personal information to a provider outside Australia, we take reasonable steps under APP 8.1 to make sure it is handled in line with the Australian Privacy Principles, and we remain accountable for it under section 16C of the Privacy Act. We do not ask individuals to consent under APP 8.2(b) to remove that accountability, so you can always complain to us and to the OAIC. For the overseas providers that receive a Firm's clients' information (verification, screening and AI):

Written terms: our identity verification and AI providers are each bound by a data processing agreement. When acting as a processor on our behalf, each must use the information only to provide the service we request, keep it secure, delete it when the work ends (except the pseudonymised data described below), tell us before it appoints a sub-processor, and tell us of a breach within a fixed time. Our screening provider handles screening requests under its published privacy policy and terms, which say requests to its screening service are not stored in its databases or logs.
Privacy law: our identity verification provider processes the data in the European Union, where the GDPR applies, and transfers it outside the European Economic Area, including to the United States, only under standard contractual clauses; our screening provider is subject to Swiss data protection law, and to the GDPR for processing in the European Union; our AI provider is bound by its data processing addendum. That adds to our accountability; it does not replace it.
Minimum data, short retention: we send only what the service needs, and each provider deletes it within the periods in section 4.1, except the pseudonymised data described below. The record itself is stored in Australia.
Provider's own use: the identity verification provider may also keep pseudonymised data derived from a verification, for its own security, fraud and abuse prevention (including across its other customers), service testing and quality assurance, legal compliance and legal claims, as its own privacy policy describes.
No model training: our AI provider's terms prohibit it, and we have switched off our identity verification provider's option to use verification data to improve its models.
Review: we check each provider's certifications and terms, and review them regularly and whenever a provider tells us its terms have changed.

Our email provider (United States), error-monitoring provider (Germany, with sub-processors in the United States and other countries) and payment provider (United States and other countries) receive limited personal information, mostly about Firms and their users, and are bound by their standard data processing terms.

5. Data Storage and Security

Where data is stored: Duely's platform and its records are hosted in Australia. Verification, screening and AI processing happen overseas and the results are stored in Australia. The countries in which overseas recipients of personal information are likely to be located are: member states of the European Union (including Germany), Switzerland and the United States; for the AI features, any other country where our AI provider runs its models; and other countries outside the European Economic Area to which our identity verification provider, our error-monitoring provider's sub-processors and our payment provider transfer data. Section 4.1 shows which service uses which country.

Security Measures: We use security practices including encryption at rest, TLS 1.2 or higher in transit (TLS 1.3 preferred), role-based access control (RBAC), and append-only audit logging.

5.1 Data Breaches

We operate under the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act, and we assess every suspected breach against that scheme's test (whether the breach is likely to result in serious harm to any individual), not only against overseas privacy law.

If we suspect that personal information we hold has been lost, or accessed or disclosed without authority, we assess it and take all reasonable steps to complete that assessment within 30 days (section 26WH).
We notify the administrator and AML/CTF Compliance Officer of each affected Firm, and any additional contact the Firm has nominated in writing, without undue delay, and no later than 72 hours after we become aware of an actual or reasonably suspected breach involving that Firm's data. That commitment is in section 5 of our Data Processing Agreement, which forms part of the Master Subscription Agreement.
Each overseas provider whose terms set a breach notice period must tell us of a breach within the time stated in section 4 of the Data Processing Agreement. Our 72 hours runs from when we become aware, including when a provider tells us, so a provider's notice period comes before ours, not within it.
Where the information is held jointly by Duely and a Firm, section 26WM of the Privacy Act provides that if one of us notifies the OAIC and the affected individuals, both are treated as having done so. We agree with the Firm who will notify and give it what it needs; if the Firm has not notified within five business days after both of us have concluded that the breach is an eligible data breach, or sooner where delay would increase the risk of serious harm to the affected individuals, we may notify ourselves after consulting the Firm's AML/CTF Compliance Officer. Where the breach involves information obtained through a government verification service, we notify the affected individuals as our agreement with the agency administering it requires. Where the breach affects personal information Duely holds in its own right, we notify the OAIC and the affected individuals ourselves.

Our Breach Notification Summary sets out the process in full.

6. Data Retention

We retain data for the periods below. When a Firm's subscription ends, the Firm keeps read-only access to view and download its records, and may resume its subscription. We will give the Firm's administrator at least 30 days' notice by email before the Firm's data is deleted or de-identified: files are deleted and personal information is removed from records. We do not prepare exports or supply copies of records on request. A Firm's own record-keeping obligations under the AML/CTF Act are its own, so it must download the records it needs before its data is deleted.

Data	Retained for	Notes
Firm billing and financial records	7 years	Our own record-keeping under section 286 of the Corporations Act 2001 (Cth).
Records of a Firm's acceptance of our terms (the version, the date, and the accepting user's name and email address)	7 years	Our own record of what the Firm agreed to.
Records of a data breach involving a Firm's data	7 years	Our own record of the breach and our response.
Record of the removal of a Firm's data	7 years	Our own record that the deletion or de-identification took place.
Firm account and support records	Life of the subscription and after it ends until deleted or de-identified (at least 30 days' notice by email)	Deleted with the Firm's other data.
Customer identity records, screening results, risk assessments, audit logs and evidence packs	Life of the subscription and while the Firm has read-only access after it ends, then deleted or de-identified after at least 30 days' notice by email (encrypted backups through normal backup rotation)	These are the Firm's AML/CTF records. The Firm must download and keep them for the 7 years required by Part 10 of the AML/CTF Act 2006 (Cth). We keep them after the subscription ends so the Firm can view and download them; backups are kept only until the rotation overwrites them, so that the platform can be recovered after a failure.
Identity document images (front and back)	With the customer identity record, as above	Part of the record of the document verified.
Live image (selfie) captured for a face match	Up to 7 days from capture, except a copy in a released reliance pack	The face-match and liveness results and a hash proving the image existed are kept with the verification record. A copy included in a reliance pack the Firm releases within that time is kept with that pack as part of the Firm's records, and deleted with them as above (section 2.2).
Verification session at our verification provider	About one month after the check	Includes the face template the provider creates for the face match, which is deleted with the session. Pseudonymised data the provider keeps for its own purposes is described in section 4.3.
Our record of a Document Verification Service request	Document numbers: 7 days after the check is resolved. The rest of the record: 7 years	The record never holds the person's name, date of birth or address. Document numbers are deleted once their purpose is fulfilled; the document type, result and reference numbers are kept for 7 years, as our agreement with the agency requires.
Screening details at our screening provider	One-off check: duration of the request. Ongoing monitoring: while the person is part of an active engagement	Deleted when we remove the person from monitoring; only billing details of the request are kept.
Inputs and outputs of the AI features at our AI provider	Up to 30 days	Longer only where the law or the provider's usage policy requires. Not used to train models.
Data produced by AI-assisted document reading	With the customer record it was read for	The Firm checks and may edit it before it becomes part of the record.
Dee conversations	90 days, then deleted	A daily sweep deletes conversations older than 90 days.
Consent records (who consented, when, and to which wording)	With the customer identity record, as above. Our records of Document Verification Service consents and checks, which do not hold the person's name, date of birth or address: 7 years	Available to the Firm in the platform during the subscription and while the Firm has read-only access after it ends. Our Document Verification Service records are kept as our agreement with the agency requires, and are producible to the agency administering that service where our agreements require.

After deletion we keep only the records listed above as kept for 7 years (billing and financial records, terms-acceptance records, Document Verification Service consent and check records, records of any data breach involving the Firm's data, and a record of the removal), anonymised, aggregated statistics that cannot identify anyone, and anything a court order requires.

7. Your Privacy Rights

Under the Australian Privacy Principles, individuals have the right to request access to and correction of their personal information.

Account holders / Subscribers: you may access and update your profile directly within the platform or by contacting us.
Clients of Subscribers (Data Subjects): if you are an individual whose data was submitted by a Firm, you may make an access or correction request to that Firm or to us. We respond within a reasonable period, usually within 30 days, and work with the Firm on the request. We may refuse access where the Privacy Act allows, including where giving access would be unlawful (APP 12.3(f)), for example where it would disclose information in breach of section 123 of the AML/CTF Act; if we refuse, we tell you why, unless that would itself be unlawful, and how to complain.
Consent to identity checks: before an identity document check, a biometric (face-match and liveness) check or a Document Verification Service check that uses your personal information, you are shown a collection notice and asked for your express consent. The notice names the Firm, the law that requires the collection, what happens if you decline, that our providers process your information outside Australia and where, the Firm's privacy policy and privacy contact where the Firm has set them, and this policy. It also tells you that the verification provider may keep pseudonymised data derived from the check for its own fraud-prevention and security purposes. You may decline, in which case the Firm will need to verify your identity another way, and you may withdraw consent before a check is run by telling the Firm or us.
Sanctions, PEP and adverse-media screening: where the AML/CTF Act requires a Firm to carry out customer or personnel due diligence, the Firm may screen you without your consent against sanctions and politically exposed person lists (APP 3.4(a)). Adverse-media screening relies on your consent or on the enhanced customer due diligence the AML/CTF Rules require the Firm to carry out for you; the Firm may screen you against adverse media only on one of those bases. The platform screens a person automatically when they sign a consent form while a due diligence review is open for them, when an identity verification the Firm requested returns a result, when a Firm adds them as a team member, and, where ongoing monitoring is switched on, when they are registered for monitoring and when the monitoring service reports a change; each of these is screening requested by the Firm. The Firm must take such steps as APP 5 requires to tell you about the collection, unless doing so would or could contravene section 123 of the AML/CTF Act.

Note on Deletion Requests: Deletion of certain AML/CTF verification records may be restricted where statutory record-keeping obligations (for example, sections 107, 111 and 116 of the AML/CTF Act 2006) require the Firm to retain that evidence, overriding general privacy deletion rules.

Children's Privacy: The Duely platform is a business-to-business service for professional services firms, and only individuals aged 18 or over may hold an account. Where a Firm asks us to verify the identity of a person under 18 as part of its customer due diligence, the Firm must obtain consent from a parent or guardian if that person is under 15 or otherwise lacks capacity to consent.

7A. Automated Decisions

The Duely platform, and the providers it uses, run computer programs that use personal information to produce results that a Firm considers in its customer due diligence:

Identity verification: using the data on an identity document and a live image, a program produces a face-match result (whether the live image matches the document photo) and a liveness result (whether the image was taken of a live person).
Screening: using a person's name and, for individuals, date of birth, gender and any declared citizenship, a program flags possible matches against sanctions, politically exposed person, criminal watchlist and adverse-media sources.
Risk rating: using facts in the customer record, such as the type of customer and the countries connected to it, the platform suggests a customer risk rating.
AI-assisted document reading: where a Firm has turned it on, a program reads a document the Firm uploads and drafts identity or entity details for the Firm to check.
Ongoing monitoring: where ongoing monitoring is switched on, the screening provider reports a change in a monitored person's sanctions, politically exposed person, criminal watchlist or adverse-media results, and the platform screens the person again.

Duely does not use these programs to make decisions solely by themselves. Each produces a result that is substantially and directly related to a Firm's decision about whether a customer's identity is verified, whether a person is a sanctions or PEP match, and the customer's risk rating. The Firm reviews each result and makes the decision: it reviews and decides each possible screening match, checks details drafted from a document before they become part of the record, and can override a suggested risk rating.

8. Cookies and Tracking

The Duely application sets only strictly necessary cookies, for signing in and keeping your session secure. Our public website loads analytics and advertising tags from Google (Google Analytics and Google Ads), Meta (Meta Pixel) and Microsoft (Microsoft Advertising) when a page loads. They set cookies and send the pages you visit, browser identifiers and device details to those companies, which process them in the United States and other countries where they operate. You can block them through your browser settings (for example by blocking third-party cookies) or with a tracker-blocking extension, and the website still works. See our Cookie and Tracking Policy for details.

9. Complaints Process

If you believe we have breached the Australian Privacy Principles, or you have a complaint about the collection, use or disclosure of your information for an identity check, please contact us with your concerns. We will acknowledge your request within 7 business days and aim to resolve it within 30 days.

If you are not satisfied with our response, you have the right to lodge a complaint with the Office of the Australian Information Commissioner (OAIC):

Website: www.oaic.gov.au
Phone: 1300 363 992

10. Contact Us

For any questions about this Privacy Policy or our data practices, please contact our Privacy Officer at:

Email: privacy@duely.com.au
Entity: Ilixir Technologies Pty Ltd (ABN 11 680 039 392), trading as Duely
Address: Bellbird Park, Queensland 4300, Australia

11. Changes to This Policy

We give Firms at least 30 days' notice, by email to the Firm's administrator, before we add a provider that handles personal information, before we move a provider's processing to another country, or before we use personal information for a new purpose. Where a provider changes its own processing location, terms or purposes, we tell Firms as soon as practicable after we learn of it, and where a provider proposes a sub-processor of its own, we pass that on within three business days. If a provider becomes unavailable and must be replaced urgently, we may do so on shorter notice and tell Firms as soon as practicable. The detail, and the Firm's right to object, are in section 4 of the Data Processing Agreement. For other changes to this policy that are adverse to Firms, we commit to give Firms at least 30 days' notice before they take effect; other changes take effect when they are published here, with the version and date shown at the top of this page. The documents each provider is bound by are listed in section 4 of the Data Processing Agreement and are reviewed regularly and whenever a provider tells us its terms have changed.

12. Version History

2.3 (19 October 2026, effective on publication): sections 2, 3, 4, 5, 6, 7 and 8 updated; platform email, error monitoring, payments, address lookup, fonts, website hosting, analytics and advertising tags, website chat and demo booking providers added; Privacy Opt-in Register listing stated.
2.2 (14 and 15 October 2026): sections 3, 4, 5 and 6 updated; section 4.3 on overseas disclosure and section 5.1 on data breaches added; provider table of services, countries and retention added.
Changes between 2.1 and 2.2: 17 September 2026, Document Verification Service and government related identifiers added; 23 September 2026, 7-day destruction of the live image.
2.1 (19 August 2026): named the operating entity and ABN; separated the verification provider from the screening provider; added an AI provider; removed two providers from the provider list; added the staff identity attestation.
2.0 (19 May 2026): revised policy.
1.0 (12 March 2026): first published version.