Consumer Consent Disclosure Notice

1. Who we are

In this Notice, Opefin, we and us mean Opefin Limited and any related company that joins it in providing the service, as listed in the Global Privacy Policy.

We’re a data infrastructure company. We aren’t a lawyer, bank, financial adviser, credit reporter or regulator. We don’t act as any business’s agent, we don’t carry out anyone’s legal obligations for them, and we don’t decide whether a business deals with you. The business makes its own decisions and is responsible for its own obligations.

2. How it works

What your Opefin Passport is, and isn’t

Your Opefin Passport is not an official document. It is not a government passport or travel document, and it is not issued, approved or accredited by any government or other authority. It is a collection of your verified information, kept with Opefin in one place because you chose to. No business has to accept it: each business decides for itself whether the information you share is enough for what it needs.

Who can use Opefin

Opefin is for people aged 18 or over. When you start, you confirm that you’re 18 or over, and we also check the date of birth on your ID before the face and record checks. If you’re under 18, the process stops and we delete what was collected, unless the law requires us to keep it. This applies to people using Opefin, not to people named in records a business provides, such as a child who is a beneficiary of a trust.

Your first verification

1. A business asks. A business you’re dealing with, for example a law firm, real estate agent or accountant, sends you a request to verify your identity.

2. You set up your Opefin Passport. On the first screen, you read what your Opefin Passport is and agree to set it up (section 10).

3. You see what the business has asked for. On the next screen, you see what the business will receive and any extra checks it has asked for, and you approve or decline its request. Nothing is shared with it unless you approve.

4. You provide your ID. You take a photo of an identity document we accept for your country, such as a passport or driver licence, or, where this option is available on your device, read the chip in your passport. Our technology checks whether the document is genuine and reads your details from it.

5. You take a short video selfie. We check that you’re a real person and compare your face with the photo on your ID.

6. We check your ID details with the issuer. With your permission, we check your details with the organisation that issued your ID or keeps the official record. It confirms only whether the details match.

7. If the request asks for bank information, you can connect your bank or provide documents. You’re asked about this separately, when you reach that step.

8. We produce your verification result. Automated tools, including AI, assess the checks and produce your verification result: our conclusion on whether you’re who you say you are. We share it with the business. We don’t review your photos as part of a check, and we don’t decide whether a business accepts you. Section 5 explains the limited reasons our own staff can open your photos, and how that access is controlled.

When another business asks later

We keep your Opefin Passport so that another business can ask to verify you, or for information in your Opefin Passport. Each time, you approve or decline the request on its own screen, which names the business, why it’s asking and any Opefin service it uses. Until your selfie confirms it’s you, we show your details only in part.

If your Opefin Passport holds a photo of you, you take a quick selfie when you approve, and we check that you’re a real person and compare your face with the photo on your ID, and with your earlier selfie. We then check your ID details with the issuer again, give that business a fresh verification result, and share what the screen shows. If you don’t approve, or don’t answer, nothing is shared.

If a business verified you itself

Sometimes a business checks your identity itself, for example by looking at your original ID or a certified copy. If you’d like an Opefin Passport anyway, so the next business can ask you rather than starting again, the business gives us your name and contact details with your permission, and we email or text you.

We hold nothing about you at that point beyond your contact details. Our message explains what an Opefin Passport would hold, and you choose whether to set it up. If you set it up, you read this Notice, the Global Privacy Policy and the Global Consumer Terms on one screen and agree there. The business then sends us the ID document it checked, or you photograph it yourself. If you choose not to, we delete your contact details, we tell the business you didn’t confirm, and it can’t use Opefin for you unless you tell it otherwise. That doesn’t change the work the business is doing for you. If you don’t answer, we send one reminder, and if we still don’t hear from you we close the request and delete your contact details.

An Opefin Passport set up this way holds the ID document and the details read from it, and the results of any checks the business asked for. It doesn’t hold a selfie, so we don’t compare your face with anything unless you add your own photo later and agree to that. You can add one at any time.

If you don’t use email or a phone

The business can give you a printed pack instead. It has this Notice, a short summary and a form. You read it, or someone reads it to you, and you sign the form if you’d like an Opefin Passport. The business signs the form too, confirming that it gave you the pack and that you signed it in front of it. We keep the signed form as our record of what you were shown. We’ll ask for a postal address, because that becomes how we reach you.

After that, if another business asks for information from your Opefin Passport, it prints a one page approval sheet, you sign it, and nothing is shared until you do. Each sheet is for one request only. You can also ask us to post approval sheets to you instead.

3. What we collect and where it comes from

Where we collect information about you from someone else and you haven’t already been told about it in this Notice, we’ll tell you as soon as we reasonably can, unless the law says we don’t need to.

If you give us information about other people, we may contact them to tell them about this Notice, or ask you to pass it on.

4. How we use your information

We use your information to:

• verify your identity: check that your ID is genuine, check your details with the issuer, and check whether the person taking the selfie is the person on the ID;
• produce your verification result, using automated tools that include AI;
• share with each business you approve, and any compliance or other provider working for it, what its request screen shows, such as your verification result, verified details, face photo and ID image, so it can make its own decisions and keep its own records;
• keep your Opefin Passport so businesses can ask to verify you, or for information in your Opefin Passport, including through Opefin services that package it for particular kinds of business, with your approval each time, and handle each request, including the selfie check and fresh checks;
• detect and prevent identity fraud, including checking whether the same identity details have already been presented by someone else (section 5);
• store records that a business keeps with us, and provide tools the business uses in its own processes, on that business’s instructions;
• keep our service secure, meet our legal obligations, and handle complaints, disputes and legal claims; and
• create anonymised, aggregated information that no longer identifies you, to run and improve our services.

We don’t use your information to decide whether you can get credit, or for advertising. If we want to use your information for a new purpose, we’ll ask you before we do, unless the law allows the new use without your consent. What an Opefin service a business uses does with your information is set out in its addendum (section 11).

5. How we use your face

• We compare your face one to one: with the photo on your ID and, when you approve a later request, with the photo on your ID and your earlier selfie. We don’t search our records to identify you among other people.
• We check that the selfie is of a real, live person, using the short video.
• To help prevent identity fraud, we check whether the same identity details have already been presented. If a record already holds the same ID, we compare your selfie with the face on that record only. If they don’t match, the business sees a flag and the reason, not the other person’s details.
• We don’t use your face photo, video or ID image for marketing, to train AI models, or to infer things about you such as your emotions or health.
• We don’t review your photos as part of a check. The business, or the compliance provider it uses, looks at them to review anything unclear. A small number of named staff can open them to run, support or secure the platform, to look into a suspected security or fraud problem, to answer a request or complaint from you, or where the law requires it, and every access is logged.

6. Who receives your information

7. Where your information is held

We require our providers, by contract, to protect your information to the standard of New Zealand’s Privacy Act 2020 and the Australian Privacy Principles, and we stay responsible to you for how our providers handle it. Ask privacy@opefin.com for the current list of providers and countries.

Businesses outside Australia

If you approve a business in New Zealand, the United Kingdom or the European Economic Area, we’ve assessed its privacy law as protecting your information in a way that is substantially similar to Australian privacy law, with ways for you to enforce it. For a business anywhere else, the screen tells you before you agree that, if you go ahead and the business mishandles your information, we won’t be accountable under Australia’s Privacy Act and you won’t be able to seek redress under that Act, and that the law where the business operates may not require it to protect your information to the same standard as Australian or New Zealand law. You then choose whether to go ahead. Whatever the country, we also require the business, by contract, to protect your information to a comparable standard.

8. How long we keep it

Your Opefin Passport is used when a business receives information from it with your approval, or when you complete a new check.

We keep information longer only where the law requires it, or while it’s needed for a legal claim or dispute, a request from a court, regulator or law enforcement agency, or an investigation into fraud or a security incident. We delete it when that ends.

Asking us to remove your photos doesn’t delete the copies a business has already received, including any we store for that business. That business handles its copies under its own obligations.

If we receive satisfactory evidence that a person has died, such as a death certificate, we delete their face photo and ID image, unless the law requires us to keep them.

If a business asked us to set up an Opefin Passport for you and you don’t confirm it, we delete your name and contact details when the request closes.

9. Your choices, and the alternatives

Using Opefin is your choice. A business that needs to verify you can usually do it in other ways, for example by seeing your original ID in person. These can take longer, and you may need to repeat them for each business. To go this way, contact the business.

• If you don’t tick the ID record check box, we can’t check your ID with the issuer and you can’t continue online. The business can verify you another way.
• Connecting your bank is a separate choice. If you’d rather not, you can usually provide documents instead.
• Each request is your choice. Nothing is shared with a business unless you approve its request.
• If you’d rather not take a selfie for a later request, the business can verify you another way.
• If a business asks us to set up an Opefin Passport for you after verifying you itself, that’s your choice too. You can decline, and the business carries on as it would have anyway.
• You can ask us to remove your photos and stop sharing at any time, in your account settings, by emailing privacy@opefin.com, by writing to us, or by asking a business that uses Opefin to pass the request on. We then delete your face photo and ID image within 30 days, unless section 8 says we must keep them longer, and no new business can use your Opefin Passport.

Choosing an alternative doesn’t affect your legal rights.

10. What you agree to

You agree before any photos are taken. Where a business sends you a request, that happens on two screens.

1. On the Opefin Passport screen, you tick the ID record check box. This confirms: “I confirm that I am authorised to provide the personal details presented and I consent to my information being checked with the document issuer or official record holder via third party systems for the purpose of confirming my identity.” The box is never ticked for you, and you can read About this check before you tick it.

2. You tap Agree & continue. This confirms that you’re 18 or over and have read the Global Privacy Policy and this Notice, agrees to the Global Consumer Terms, and consents to us setting up your Opefin Passport as described on that screen, in this Notice and in the Global Privacy Policy. That includes the ID and face checks, the checks with issuers and the credit reporting agency, and keeping your Opefin Passport so businesses can ask to use it, with your approval each time.

3. On the request screen, you approve or decline the business’s request. Approving consents to us sharing what the screen shows with that business, and with any provider that business uses to run these checks for it, as section 6 explains. Where the request uses an Opefin service, approving also agrees to that service’s addendum and consents to the extra checks the screen shows (section 11). You see a request screen for the first business straight after the Opefin Passport screen, and one for each later business, which you approve with a quick selfie.

If a business verified you itself and asked us to set up an Opefin Passport, you agree on one screen instead, after the message we send you. That screen shows the same points, the ID record check box where it applies, and the same Agree button. No photos are taken.

If the business is outside Australia, in a country not listed in section 7, the request screen also asks you to agree to your information being shared with it on the basis explained there. Where that’s a tick box, it’s never ticked for you either.

Some things are asked separately, at the time:

• connecting your bank, which you authorise with the open banking provider;
• each request from a business to use your Opefin Passport, which you approve on its own screen; and
• any new use of your information that this Notice doesn’t cover.

If you’re acting for a company, trust or partnership

You confirm that you’re authorised to act for it. The business records who is acting and on what basis, and gives us evidence of that authority where you’re not named as a director or officer on the public register. Each director, trustee or other person whose own ID and face are checked gives their own consent.

11. Opefin services that package your information

Some businesses use an Opefin service that packages information from your Opefin Passport in the form their kind of business needs, and runs extra checks they ask for. Each service has its own addendum, which forms part of this Notice, the Global Privacy Policy and the Global Consumer Terms. It explains what the service adds, what it collects, who receives what, where it’s held and how long it’s kept.

When a business’s request uses a service, the request screen names it, shows the extra checks and links to its addendum. You approve or decline the request there, and the service’s extra checks run only if you approve. We publish a service’s addendum before the service starts. The current service is Opefin Source, explained in the Opefin Source Addendum (section 16).

12. Your rights, and how to complain

• See what we hold about you. In New Zealand we’ll respond within 20 working days. In Australia we’ll respond within a reasonable time, usually 30 days. We can withhold information only where the law allows, and we’ll tell you why. Records we keep only for a business, such as its own assessment of you, are that business’s records, and we pass requests for them to it, unless the law requires otherwise.
• Correct anything that’s wrong. If a business has already received it, we’ll tell you and, where we can, tell that business.
• Ask us to remove your photos and stop sharing (section 9).
• Raise a concern or complain about how we’ve handled your information, including your face photo and video, by emailing complaints@opefin.com. We’ll respond within 20 working days.
• Records a business keeps. The initial risk score, any review notes and anything else a business records about its own assessment of you are that business’s records, not ours. We don’t show them to you. Ask that business, or ask us and we’ll pass the request on.
• Complain to a privacy regulator if you’re not satisfied, such as New Zealand’s Privacy Commissioner or the Office of the Australian Information Commissioner (sections 14 and 15).

13. How we assessed our use of face checks

We’ve assessed whether our face checks are necessary and proportionate, as the Biometric Processing Privacy Code 2025 requires. The assessment covers the privacy risks, whether a less intrusive option would work as well, the safeguards we use, and the effects on the people involved, including cultural impacts and effects on Māori. It also explains why we keep your face photo and ID image rather than only a coded version of them: the business, or its compliance provider, may need to look at them to review anything unclear, and a person can’t look at a coded version. A summary of the assessment, and the full assessment, are available on request from privacy@opefin.com.

14. New Zealand

• New Zealand’s Privacy Act 2020 and the Biometric Processing Privacy Code 2025 apply to how we handle your information.
• For a New Zealand passport, we check your details with the Department of Internal Affairs. For a New Zealand driver licence, we check your details with NZ Transport Agency Waka Kotahi and confirm your name, date of birth and address with a credit reporting agency (section 3).
• New Zealand bank connections run through an open banking provider you authorise, and you can manage or end the connection yourself.
• Complaints to the regulator: Office of the Privacy Commissioner, privacy.org.nz, 0800 803 909, PO Box 10 094, Wellington 6140.

15. Australia

• Australia’s Privacy Act 1988 applies to how we handle your information.
• Sensitive information. Your face photo and the information used to compare faces are biometric information, which is sensitive information under Australian law. By tapping Agree & continue, you consent to us collecting, using and sharing it as this Notice describes. You can withdraw that consent at any time by asking us to remove your photos and stop sharing. Where an Opefin service collects sensitive information, its addendum says so, and you consent on the request screen.
• Section 7 lists the countries your information may go to.
• Complaints to the regulator: Office of the Australian Information Commissioner, oaic.gov.au, 1300 363 992, GPO Box 5288, Sydney NSW 2001.

The ID record check for Australian documents

For Australian documents, we check your details, such as your name, date of birth and document number, with the organisation that issued your document or keeps the official record, through third-party systems that include a secure gateway service provider. The issuer confirms only whether the details match. We use that as one input to the verification result we give the business, and we don’t give the business the match result itself. We delete the check request and its result once the verification result is produced, unless the law requires us to keep them.

We, the gateway service provider and the business must each handle your information under the laws that apply to them, including the Privacy Act 1988 and the Identity Verification Services Act 2023. If you don’t consent to the check, we can’t check your ID with the issuer, and the business can verify you another way. You can ask us about the check, or complain, at privacy@opefin.com, and then to the Office of the Australian Information Commissioner. You can read more about how these checks work at idmatch.gov.au.

Australian bank connections

Australian bank connections run under the Consumer Data Right, through an accredited provider. You’re asked for a separate consent that says what data is collected, what it’s used for and for how long. Your bank data, and anything we create from it, is used and shared only as that consent and the Consumer Data Right rules allow, and is deleted or de-identified when your consent ends. A business you approve may receive a summary, such as confirmation of a balance or of money received, where those rules allow it.

16. Contact and full terms