Australia Specific Additional Consumer Terms

1. Contracting Entity for Australia

2. Governing Law

The Global General Terms specify New Zealand as the governing law. For Australian users, New Zealand law governs the agreement except to the extent that: (a) Australian Consumer Law (Schedule 2 of the Competition and Consumer Act 2010 (Cth)) provides mandatory protections that cannot be excluded; (b) the Privacy Act 1988 (Cth) imposes obligations on Opefin in connection with your personal information; or (c) another mandatory law of Australia or of a State or Territory applies to a specific matter. Where Australian law provides you with a right greater than what New Zealand law provides, the Australian right applies.

3. Courts

Disputes not resolved through complaints processes may be brought before the courts of New Zealand or, for Australian Consumer Users asserting rights under Australian Consumer Law, before the courts of the relevant Australian State or Territory or the Federal Court of Australia. Opefin does not contest Australian court jurisdiction for disputes involving Australian mandatory consumer law rights.

4. Dispute Resolution Schemes

5. Privacy Act 1988 (Cth) Compliance

5.1 Application

The Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) apply to Opefin’s handling of personal information about individuals in Australia. Opefin is the primary controller of Consumer Data collected through the Opefin Source consent process. The definition of Personal Data in the GGT encompasses personal information as defined in the Privacy Act 1988 (Cth).

5.2 Australian Privacy Principles

5.3 Notifiable Data Breaches

Australia’s Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act 1988 requires Opefin to notify affected individuals and the OAIC of eligible data breaches. Opefin will assess data breaches against the NDB criteria as soon as practicable and, where a breach is assessed as notifiable, will notify the OAIC as soon as practicable and affected individuals directly where practicable. For Enterprise Users: Opefin will notify the Reporting Entity within 72 hours of becoming aware of a breach involving Consumer Data related to their certificates.

6. Australian CDR Framework

6.1 The Regulatory Framework

Australia’s Consumer Data Right (CDR) is established by the Competition and Consumer Act 2010 (Cth) and the Consumer Data Right Rules. The CDR has been in operation for the banking sector since 2019. The ACCC administers the CDR together with the OAIC. The Data Standards Body sets the technical standards for CDR data sharing.

6.2 Open Banking Provider for Australia

In Australia, Opefin accesses Consumer banking data through an ACCC-accredited CDR data recipient as specified in the applicable Product Schedule and confirmed when Australian operations commence. For identity verification, Opefin uses an appointed IDV Provider for biometric capture, liveness detection, and document verification. The current IDV Provider for Australian transactions is identified in the applicable Product Schedule. The IDV Provider processes biometric data under its own privacy framework. Opefin does not retain raw biometric data after the verification event; it retains the verification outcome only. Opefin is pursuing direct CDR accreditation from the ACCC. When direct accreditation is obtained, this AU Addendum will be updated.

6.3 Designated Data Holders

The following Australian banks are currently designated Data Holders under the CDR: ANZ Banking Group, Commonwealth Bank of Australia (CBA), National Australia Bank (NAB), Westpac Banking Corporation, and a growing number of non-major banks. The current list is maintained by the ACCC at www.cdr.gov.au.

6.4 Disclosed purpose of CDR consent

The CDR Rules require that CDR data be used only for the purpose disclosed at consent. The purpose disclosed in Opefin’s consent flow for Australian users includes: verifying your identity and generating your AML/CTF compliance certificate; creating and maintaining your Compliance Network Record; enabling accredited Reporting Entities to query your record for future transactions with notification to you; EDD screening where the EDD Module is activated; and improving Opefin products using derived and anonymised data. Raw CDR data is not used for purposes outside this disclosed scope.

6.5 Australian Consumer CDR Rights

Under the Australian CDR framework, users have the following rights:

• The right to authorise and revoke data sharing consents at any time through their bank’s CDR consent dashboard.
• The right to a Consumer Data Request Dashboard provided by each Data Holder, showing all active CDR consents.
• The right to access their own CDR data from Data Holders.
• The right to complain about CDR conduct to the OAIC (CDR privacy safeguards) or the ACCC (other CDR Rules).
• The right to seek compensation for loss caused by a breach of CDR privacy safeguards.

7. Privacy Rights for Australian Users

7.1 Right to Access

You may request access to personal information Opefin holds about you under APP 12 by contacting privacy@opefin.com. Opefin will respond within 30 days. Opefin may charge a reasonable fee to cover the cost of providing access (but not for the request itself) where the Privacy Act permits. We will tell you the fee before we proceed.

7.2 Right to Correction

You may request correction of personal information under APP 13 by contacting privacy@opefin.com. Opefin will correct the information or attach a notation of your correction request within a reasonable period.

7.3 Right to remove from Compliance Network queries

You may request removal of your Compliance Network Record from active queries at any time by contacting privacy@opefin.com. This means no future Reporting Entity can query your record going forward. The underlying Certificate must still be retained for the 7-year statutory period applicable to Australian transactions.

8. Australian Consumer Law Guarantees

Schedule 2 of the Competition and Consumer Act 2010 (Cth) (Australian Consumer Law) applies to services supplied to Consumer Users in Australia in trade or commerce. Where you are a consumer within the meaning of the ACL, the following statutory guarantees apply and cannot be excluded: services will be provided with due care and skill; services will be reasonably fit for their purpose; and services will be supplied within a reasonable time where no time is agreed. For major failures, you have an immediate right to cancel and receive a full refund or compensation.

9. Unfair Contract Terms

The ACL prohibits unfair terms in standard-form consumer contracts and small business contracts. Opefin does not rely on any term it considers unfair under this standard. The liability limitations in the GGT are drafted to preserve the ACL guarantees; the ACL guarantee applies to the extent of any inconsistency.

10. Do Not Call Register and Spam Act

Opefin complies with the Do Not Call Register Act 2006 (Cth) and the Spam Act 2003 (Cth). We will not send you unsolicited commercial electronic messages without your consent. You may unsubscribe from marketing communications at any time using the unsubscribe link in any marketing message or by contacting privacy@opefin.com.

11. Retention Periods in Australia

12. Cross-Border Transfers from Australia

APP 8 requires Opefin to take reasonable steps to ensure that overseas recipients of personal information about Australian individuals handle it consistently with the APPs. Opefin currently processes Australian user data using infrastructure in Australia and New Zealand. Transfer to New Zealand is a transfer to a jurisdiction with comparable protections. Where data is transferred to other jurisdictions for cloud provider redundancy, Opefin relies on contractual arrangements with those providers requiring APP-equivalent protections.

13. Government and Regulatory Requests in Australia

Where Opefin receives a request from an Australian regulatory authority, law enforcement agency, or court for personal information or records, Opefin will assess its legal basis, respond in accordance with its legal obligations, notify the affected Enterprise User or Consumer User where lawfully permitted before complying, and provide only the minimum information necessary. AUSTRAC has powers under the AML/CTF Act to require production of records from Opefin in connection with investigations. Opefin will cooperate with any lawful AUSTRAC request.

14. Opefin Source in Australia

14.1 Compliance Network in Australia

The Opefin Compliance Network is a current core feature of Opefin Source. When a Consumer’s certificate is generated, a Compliance Network Record is created and held for the 7-year statutory retention period applicable to Australian transactions. Accredited Reporting Entities involved in future transactions with that Consumer may query the Network with Consumer notification. This supports the reliance model under section 38 of the AML/CTF Act 2006 (Cth), which permits a reporting entity to rely on CDD conducted by another reporting entity. It eliminates repeated verification friction for Consumers across transactions, including cross-border transactions.

14.2 CDR Maturity Advantage

Australia’s CDR has been in operation since 2019, giving it significantly greater bank coverage and API maturity than New Zealand’s CDR framework. CDR connections are available for all major Australian banks and a growing number of non-major banks, meaning more complete data coverage is available for Australian certificates.

15. Complaints About Opefin Source in Australia

Complaints about Opefin Source in Australia should follow the process in the Opefin Complaints Policy, by emailing complaints@opefin.com. The applicable external dispute resolution scheme depends on the nature of the complaint: AFCA for financial services disputes (clause 4); OAIC for privacy complaints; ACCC or relevant State or Territory consumer affairs office for Australian Consumer Law complaints; and AUSTRAC for AML/CTF- related matters.