Global Privacy Policy

Opefin is a data infrastructure company. You verify your identity once and keep it as your Opefin Passport, and you decide which businesses receive information from it. Some businesses use an Opefin service that packages information from your Opefin Passport for the kind of work they do, and each service has its own addendum.

In this policy, Opefin, we and us mean Opefin Limited and any related company listed above. We’re a data infrastructure company. People verify their identity once, and we keep their verified details for them as their Opefin Passport, which businesses can ask to use with the person’s approval each time (Part 6). Some businesses use Opefin services that package Opefin Passport information in the form they need and run extra checks they ask for, each explained in its own addendum (Part 6.5).

We’re responsible for the personal information we hold. We’re the agency that collects and holds it under New Zealand law, and we handle it in line with the Australian Privacy Principles. A business that receives information from us holds its own copy, and is responsible for that copy and for its own legal obligations.

We don’t act for businesses. We’re not the agent of any business that uses us, we don’t carry out anyone’s legal obligations for them, we’re not a credit reporter, and we don’t decide whether a business deals with anyone. The business makes its own decisions.

• People verified through our platform, whether a business sent you a request or you started yourself, and whether the information came from you or from the business.
• People named in information we receive, such as the directors, trustees, beneficiaries or owners of a company or trust.
• Businesses that use the platform, and the people who hold accounts for them.
• Visitors to opefin.com and anyone who contacts us.

In this policy, a business means any organisation that asks to verify a person or to receive information from their Opefin Passport. Opefin is for people aged 18 or over (Part 15).

Where we collect information about you from someone other than you, and this policy or the Consumer Consent Disclosure Notice hasn’t already told you about it, we’ll tell you as soon as we reasonably can, unless the law says we don’t need to. If documents name other people, we may contact them to tell them about our Notice, or ask the person who gave us the documents to pass it on.

If we want to use your information for a new purpose that this policy doesn’t cover, we’ll ask you before we do, unless the law allows the new use without your consent.

5.1 Our own purpose

We collect your information because it’s necessary for a lawful purpose connected with our functions: identity verification and data services, keeping Opefin Passports that people can use with businesses they approve, including through services that package Opefin Passport information, and preventing identity fraud. That is what information privacy principle 1 requires in New Zealand, and Australian Privacy Principle 3 in Australia.

5.2 Your consent

Your consent is the basis for the face checks, for keeping your Opefin Passport, and for sharing your information with each business you approve. You give it before any photos are taken, on two screens where a business sends you a request, or on one screen where a business has verified you itself. On the Opefin Passport screen, you tick the ID record check box and tap Agree & continue after the key points are shown there, with the full detail in the Consumer Consent Disclosure Notice. On the request screen, you approve the business’s request, including any Opefin service it uses, which also agrees to that service’s addendum.

Some things are asked separately, at the time: connecting your bank; each later request, which you approve with a quick selfie where your Opefin Passport holds a photo of you; and, for some businesses outside Australia, sharing on the basis explained in Part 9. You can withdraw your consent at any time by asking us to remove your photos and stop sharing (Part 13). Withdrawing doesn’t undo what has already been shared.

5.3 Opefin services

Each Opefin service’s addendum sets out the basis for the extra checks it runs, and you agree to it on the request screen.

Many people are verified more than once. A lawyer, an accountant and a real estate agency may each need to verify the same person, and each would normally ask that person to start again. Your Opefin Passport lets you approve each business’s request instead.

• Your Opefin Passport is not an official document. It is not a government passport or travel document, and it is not issued, approved or accredited by any government or other authority. It is a collection of your verified information, kept with Opefin in one place because you chose to. No business has to accept it: each business decides for itself whether the information you share is enough for what it needs.

6.1 How a request works

• A business asks to verify you, or for information in your Opefin Passport. You see a request screen that names the business, why it’s asking and any Opefin service it uses.
• Where a selfie is taken, we show your details only in part until it confirms it’s you.
• If your Opefin Passport holds a photo of you, you take a quick selfie when you approve. We check it’s of a live person and compare it with the photo on your ID. We then check your ID details with the issuer again and give the business a fresh verification result. Any extra checks from a service the business uses run as its addendum describes.
• The business usually receives your verified details, your ID image, your verification result, any face photo your Opefin Passport holds, anything a service it uses adds and, where you approve it, documents you gave earlier and the analysis we produced from them. Bank information needs a separate approval, and Australian bank information is shared only in the forms the Consumer Data Right allows.
• If you don’t approve, or don’t answer, nothing is shared.

6.2 A one-to-one check, not a search

Your Opefin Passport confirms that a person is who they claim to be, against that person’s own record. We don’t search faces against other people’s faces, and we don’t run a facial identification or watchlist service.

6.3 Your control

• You approve each request. Without your approval, nothing is shared.
• You can stop sharing at any time, in your account settings, by emailing privacy@opefin.com, by writing to us, or by asking a business that uses Opefin to pass the request on. No new business can then use your Opefin Passport, and we delete your face photo and ID image within 30 days, unless a hold in Part 10 applies.
• Businesses can be in any country. Part 9 explains how your information is protected when it goes overseas.

6.4 How we’re paid

6.5 Opefin services that package your information

Some businesses use an Opefin service that packages information from your Opefin Passport in the form their kind of business needs, and runs extra checks they ask for. Each service has an addendum, published at opefin.com/legal, that forms part of this policy. It sets out what the service adds: what it collects, how it’s used and analysed, who receives what, where it’s held and how long it’s kept.

When a request uses a service, the request screen names it and links to its addendum, and you approve it there. We publish a service’s addendum, and update this policy where needed, before the service starts. The current service is Opefin Source, explained in the Opefin Source Addendum.

If a business verified you itself

A business that checked your identity itself can ask us to set up an Opefin Passport for you. It gives us your name and contact details with your permission, and nothing else. We contact you, give you this policy, the Consumer Consent Disclosure Notice and the Global Consumer Terms, and you choose. We hold nothing beyond your contact details until you agree. If you decline or don’t answer, we delete them and tell the business you didn’t confirm, and it can’t use Opefin for you unless you tell it otherwise.

An Opefin Passport set up this way holds the ID document and the details read from it, and the results of any checks the business asked for. It doesn’t hold a selfie. You can add your own photo at any time, and the Opefin Passport then works in the same way as any other.

Where someone can’t be contacted by email or phone, the business gives them a printed pack containing our Notice, a summary and a form. They sign the form, the business certifies that it gave them the pack and witnessed the signature, and we keep the signed form as our record of what they were shown, in place of the screen capture we would otherwise hold. We ask for a postal address, which becomes the way we reach that person. A later request from another business is approved on a printed sheet that we generate for that request, signed by the person and uploaded by that business, and nothing is shared until we have it.

7.1 What we collect

A selfie, and a short video taken during the liveness step so the system can confirm that a live person is present rather than a photo, mask or screen. A photo of your ID, including the photograph printed on it. If you use the passport chip option where it’s available, the photo stored in the chip.

7.2 What it’s used for

Only one-to-one comparisons: your selfie with the photo on your ID when you first verify; a new selfie with the photo on your ID, and your earlier selfie, when you approve a later request; and, to prevent identity fraud, where a record already holds the same ID, your selfie with the face on that record only. The comparisons are automated. Unclear results go to the business, or the compliance provider it uses, to review. We don’t review your photos as part of a check. Part 11 sets out the limited reasons our people can open them and how that access is controlled.

7.3 Why we keep images

Some systems keep only a coded version of a face. We keep the face photo and ID image because:

• a person at the business, or its compliance provider, may need to look at them to review an unclear result, and a person can’t look at a coded version;
• identity verification standards link the person to the image on their ID document, so a later check needs that image;
• coded versions only work with one provider’s system, so keeping images means you don’t have to verify again if we change provider; and
• businesses need to keep a copy of the evidence they used.

We manage the extra risk with the time limits in Part 10, encrypted storage, restricted access, your right to ask us to remove your photos, and the limits in 7.5.

7.4 Our assessment

We’ve assessed our face checks under rule 1 of the Biometric Processing Privacy Code 2025, including the privacy risks, less intrusive alternatives, our safeguards, the benefits, and the cultural impacts and effects on Māori. A summary of the assessment, and the full assessment, are available on request from privacy@opefin.com.

7.5 Limits we hold ourselves to

• Your face is compared only with your own ID photo or record. It’s never used to identify you from a group, to match you against a watchlist, or to search for you.
• It’s never used to categorise you or to infer characteristics such as age, gender, ethnicity, emotion or health.
• Your face photo, video and ID image aren’t used to train AI models, by us or, under our settings, by our identity verification provider.
• Your liveness video is kept for up to 30 days after your check.
• You can raise a concern or complain about how your face photo or video has been handled at any time, as Part 14 explains.

Where a business sends us an ID document it checked itself, we don’t run a face check on it. We don’t compare the photo in that document with anything unless you add your own photo and agree to that comparison.

Where you approve a business’s request, that approval also covers any provider the business uses to run these checks for it. That provider acts on the business’s instructions and only for that business’s dealings with you, and the business stays responsible for it.

Apart from the recipients in the table above, we don’t disclose your personal information. In particular, we don’t disclose it to advertisers, data brokers, marketing services or social media platforms.

9.1 Our providers

• Every overseas provider is bound by a written contract requiring it to protect your information to the standard of New Zealand’s Privacy Act 2020 and the Australian Privacy Principles, to use it only as we instruct except in the limited ways stated in Part 8, to keep it secure, to return or delete it when the contract ends, and to tell us promptly if it’s compromised.
• We stay responsible to you for our choice of provider and for how they handle your information.
• Our own people are in New Zealand and Australia. If we later need people elsewhere, the same access controls in Part 11 apply to them wherever they are, and we add the country here.
• Where a provider offers an Australian or New Zealand region and it works for the service, we use it.
• The current list of providers and countries is available from privacy@opefin.com. If a provider or a country changes, we update this policy.

9.2 Businesses you approve outside Australia

• Businesses in New Zealand, the United Kingdom and the European Economic Area. We’ve assessed their privacy laws as protecting your information in a way that is substantially similar to Australian privacy law, with ways for you to enforce that protection.
• Businesses anywhere else. Before you agree, the screen tells you that if the business mishandles your information, we won’t be accountable under Australia’s Privacy Act and you won’t be able to seek redress under that Act, and that the law where the business operates may not require it to protect your information to the same standard as Australian or New Zealand law. You then choose whether to go ahead.
• Every business, whatever the country, must protect your information to a comparable standard under its contract with us.

Each Opefin service’s addendum lists anything further it sends overseas. Part NZ and Part AU set out the legal position in each country.

10.1 The starting point

We keep personal information only for the periods in this Part. We keep it longer only where the law requires it, or while it’s needed for a legal claim or dispute, a request from a court, regulator or law enforcement agency, or an investigation into fraud or a security incident (a hold). When the hold ends, the normal period applies again.

Records a business keeps with us are kept on that business’s instructions, for as long as it tells us it needs them for its own legal obligations. They’re then deleted or returned to the business. The credit reporting agency’s own response is the exception: we delete it within 30 days of the check and keep our own record of what it confirmed instead.

10.2 When your record is used

Some periods run from the last time your Opefin Passport was used, which means a business receiving information from it with your approval, or you completing a new check.

10.3 Periods

If we receive satisfactory evidence that a person has died, such as a death certificate, we delete their face photo and ID image, unless the law requires us to keep them. Information about people under 18 is dealt with in Part 15.

Deleting information removes it from our live systems, and from our backups in the ordinary course of the backup cycle. A business that has already received your information holds its own copy, which we can’t delete. If you ask, we’ll tell you which businesses received your information so you can contact them.

We take reasonable steps to protect personal information against loss, misuse, and unauthorised access, modification and disclosure, including:

• Encryption of information in transit and in storage.
• Access control. Access to ID documents, face photos and videos is limited to the people whose work needs it, is granted individually, needs multi-factor authentication, and is logged. Those people are currently in New Zealand and Australia. If we later need people elsewhere, the same controls apply to them, we apply the safeguards in Part 9, and we update the countries listed there. We don’t review your photos as part of a check or make decisions about your checks. Our people open them only to run, support or secure the platform, to look into a suspected security or fraud problem, to answer a request or complaint from you, or where the law requires it.
• Separation. Each business sees only its own dealings. Access to your Opefin Passport needs your approval and is logged.
• Contracts with providers that limit what they may do, require security, and require them to tell us promptly of any compromise.
• Deletion by design. Time limits are applied automatically rather than left to someone to remember.
• Monitoring and testing. We log and monitor access, investigate anything unusual, and review our arrangements and providers at least once a year.

No system can be guaranteed secure. Part 14 explains what we do if something goes wrong.

Parts of our service are automated: reading documents, comparing faces, checking liveness, and producing your verification result. Some of these use AI. An Opefin service a business uses may add its own automated outputs, such as the initial risk score prepared by Opefin Source, and its addendum sets out what they are and the information they use.

We don’t make decisions about you. A business may use our automated results when it decides whether to deal with you, and that decision can significantly affect you. Our automated processes use your identity details, ID images, face comparison and liveness results, results of checks with issuers and the credit reporting agency, the documents and bank information you provide or authorise, and your sharing history, together with the information a service’s addendum lists. The business makes the decision, reviews anything unclear, and is responsible for its decision.

If you think an automated result is wrong, tell the business, or email privacy@opefin.com and we’ll check our record, correct anything that’s wrong, and tell the business.

These rights apply to everyone covered by this policy. Part NZ and Part AU set out the legal basis and timeframes in each country, and we apply whichever is more favourable to you.

One thing is not ours to give. The initial risk score, any review notes and anything else a business or its compliance provider records about its own assessment of you are that business’s records, held in our platform at its direction. We don’t show them to you, and nothing you see from us changes according to them. Ask that business if you want to see or correct them. If you ask us, we’ll pass the request on and tell you we have, and that business decides what it can release.

We may need to confirm your identity before acting on a request, so we don’t disclose your information to someone else. We’ll ask for the least we need, and won’t use it for anything else.

14.1 Complaining to us

If you’re unhappy with how we’ve handled your personal information, including your face photo or video, email complaints@opefin.com. We’ll acknowledge your complaint within 5 working days, investigate it, and give you a written response within 20 working days. If we need longer, we’ll tell you why and when to expect an answer.

14.2 Complaining to a regulator

You can also complain to the privacy regulator in your country. Regulators generally expect you to complain to us first and give us a chance to respond.

14.3 If there is a breach

If our systems are compromised, or your information is lost or disclosed without authority, we’ll investigate immediately, contain it and assess the harm. Where a breach has caused or is likely to cause serious harm, we’ll notify the Privacy Commissioner in New Zealand and the Australian Information Commissioner in Australia as the law requires, and we’ll tell you in plain language what happened, what information was involved, what we’ve done and what you can do. We’ll do this whether the breach started with us or with one of our providers.

Opefin is for people aged 18 or over. If we learn that we’ve collected information about someone under 18 through our consumer service, we delete it, unless the law requires us to keep it. This doesn’t apply to people named in records a business provides, such as a child who is a beneficiary of a trust. That information is handled as part of the business’s records.

We use cookies and similar technologies on opefin.com and on the platform for three purposes only: to make the site and the verification session work, to keep them secure, and to understand in aggregate how they perform so we can improve them.

We don’t use advertising cookies, don’t allow third-party advertising or cross-site tracking, and don’t let social media platforms track visitors through our sites. Where consent is needed for a non-essential cookie, we ask before setting it, and you can decline without losing access. A current list of cookies, what each does and how long each lasts, is available at opefin.com and from privacy@opefin.com.

Most browsers let you block or delete cookies. Blocking the cookies that are strictly necessary will stop the verification session from working.

We review this policy at least once a year, and update it whenever the platform, our providers or the law change in a way that affects it. Where a change materially affects how your personal information is handled, we’ll tell you before it takes effect, by email where we have your address and by a notice on the platform. If a change needs your consent, we’ll ask for it separately rather than treating your continued use as agreement. Previous versions are available from privacy@opefin.com.

This Part applies where you’re in New Zealand, or where your information is collected or held in New Zealand. It adds to the Parts above. If anything in this Part is inconsistent with an earlier Part, this Part prevails for New Zealand.

NZ 1. The law that applies

Opefin Limited is an agency under the Privacy Act 2020 and is bound by the information privacy principles. Our face checks are biometric processing, so we’re also bound by the Biometric Processing Privacy Code 2025, which modifies how the principles apply to that processing.

NZ 2. Collection

• Principle 1. We collect your information because it’s necessary for a lawful purpose connected with our functions, as Part 5.1 explains.
• Principle 2. We collect your information from you wherever we can. We collect it from someone else, such as an issuer or the credit reporting agency, only where you’ve authorised it, the information is publicly available, or another exception in principle 2 applies.
• Principles 3 and 3A. This policy and the Consumer Consent Disclosure Notice, shown to you before you agree, tell you what the principles require. Where we collect information about you from someone else and you haven’t already been told about it, we take reasonable steps to tell you as soon as reasonably practicable.
• Principle 4. We collect information lawfully and fairly, without deception, and the camera is used only for the check you’ve agreed to.

NZ 3. Biometric processing

Under the Biometric Processing Privacy Code 2025, we:

• have assessed and recorded whether our biometric processing is necessary and proportionate, including the cultural impacts and effects on Māori, and make a summary available on request;
• tell you what the Code requires, clearly and conspicuously, before or when we collect your biometric information, in the consent screen and the Consumer Consent Disclosure Notice;
• use biometric processing only for biometric verification, and not for biometric identification or biometric categorisation;
• don’t use your biometric information for a different type of processing from the one you were told about; and
• keep your biometric information only for the periods in Part 10;
• protect your biometric information with security safeguards that are reasonable given how sensitive it is, including over the providers who handle it; and
• disclose your biometric information outside New Zealand only on a ground the Code allows, including where you have authorised it or the recipient is required to protect it in a comparable way.

NZ 4. Use, disclosure and overseas transfers

• Principles 10 and 11. We use and disclose your information for the purposes it was collected for or directly related purposes, where you’ve authorised it, or where the law requires or allows it, as Parts 4 and 8 describe.
• Principle 12. We disclose information to a foreign person or entity only where we believe on reasonable grounds that it’s subject to privacy laws providing comparable safeguards to the Privacy Act 2020, such as those of Australia, the United Kingdom and the European Economic Area, or it’s required by agreement to protect the information in a comparable way, or you’ve authorised the disclosure after being told that it may not be required to protect the information in a comparable way. Part 9 sets out the countries and recipients.
• Principle 13. We don’t assign you an identifier that another agency has already assigned to you. We use your ID document number only to verify your identity, and on request screens we show only part of it until your selfie confirms it’s you (Part 6).

NZ 5. Access and correction

Under principles 6 and 7 you can ask us to confirm whether we hold personal information about you, to give you access to it, and to correct it. Email privacy@opefin.com. We’ll respond as soon as reasonably practicable, and no later than 20 working days after we receive your request. Access is free. Where we hold information only to store or process it for a business, the Privacy Act 2020 treats that business as holding it, and we transfer your request to that business.

The Privacy Act 2020 allows us to extend that time in some cases, such as where a request involves a large quantity of information or consultations are needed. If we extend, we’ll tell you within the original 20 working days, with the length of and reasons for the extension, and that you can complain to the Privacy Commissioner.

We may refuse access only on a ground the Privacy Act 2020 provides, for example where disclosure would be likely to prejudice the maintenance of the law, or would involve the unwarranted disclosure of another person’s affairs. If we refuse, we’ll tell you the ground and that you can complain to the Privacy Commissioner. We’ll release everything else we’re able to.

NZ 6. Complaints and breaches

You can complain to us as Part 14.1 describes, and to the Office of the Privacy Commissioner. The Commissioner may decline to investigate if you haven’t made reasonable efforts to resolve the complaint with us first. If we have a notifiable privacy breach, meaning a privacy breach that it’s reasonable to believe has caused or is likely to cause serious harm, we’ll notify the Privacy Commissioner and affected individuals as soon as practicable after becoming aware of it.

This Part applies where you’re in Australia, where your information is collected or held in Australia, or where the Privacy Act 1988 otherwise applies to our handling of it. It adds to the Parts above. If anything in this Part is inconsistent with an earlier Part, this Part prevails for Australia.

AU 1. The law that applies

We handle personal information in line with the Privacy Act 1988 and the Australian Privacy Principles, whatever our size, including when we handle it outside Australia. This Part, read with the rest of this policy, is our APP privacy policy.

We’re not accredited under the Digital ID Act 2024 and don’t hold ourselves out as accredited.

AU 2. Sensitive information

Your face photo, the information used to compare faces and your liveness video are sensitive information, because they are biometric information used for automated biometric verification. We collect sensitive information only with your consent and where it’s reasonably necessary for our functions (APP 3.3). You give that consent by tapping Agree & continue after the key points are shown on the Opefin Passport screen, with the full detail in the Consumer Consent Disclosure Notice, and you can withdraw it at any time by asking us to remove your photos and stop sharing. We use and disclose sensitive information only for the purposes you consented to, for a directly related purpose you would reasonably expect, or where the law requires or allows it (APP 6). Where an Opefin service collects sensitive information, its addendum says so, and you consent on the request screen.

AU 3. Collection, notice, use and direct marketing

• APP 3. We collect only what is reasonably necessary for our functions, from you where reasonable and practicable, and sensitive information only with your consent.
• APP 5. This policy and the Consumer Consent Disclosure Notice tell you the matters APP 5 requires, at or before collection.
• APP 6. We use and disclose your information only for the purposes in Part 4 and to the recipients in Part 8, unless an exception in APP 6 applies.
• APP 7. We don’t use or disclose information about the people we verify for direct marketing. Any marketing to business contacts is sent only as the law allows, with a simple way to opt out.

AU 4. The ID record check for Australian documents

For Australian documents, we check your details with the issuer or official record holder through third-party systems, with your express consent given by ticking the ID record check box. The issuer confirms only whether the details match, and we use that as one input to the verification result without giving the business the match result itself. The About this check information on the Opefin Passport screen, and section 15 of the Consumer Consent Disclosure Notice, explain the check, the laws that apply including the Identity Verification Services Act 2023, your rights, and how to complain. You can read more about how these checks work at idmatch.gov.au.

AU 5. Consumer data right

Australian bank connections run under the Consumer Data Right through an accredited provider. You’re asked for a separate consent that sets out what data is collected, what it’s used for and for how long. Your bank data, and anything we create from it, is handled under the Consumer Data Right rules, which apply in addition to this policy, and is deleted or de-identified when your consent ends.

AU 6. Overseas disclosure

Part 9 sets out the countries involved. For our overseas providers, we take reasonable steps to ensure they don’t breach the Australian Privacy Principles, by written contract, and we remain accountable for how they handle your information. For businesses you approve in New Zealand, the United Kingdom and the European Economic Area, we reasonably believe they’re subject to laws substantially similar to the Australian Privacy Principles, with mechanisms you can use to enforce them (APP 8.2(a)). For businesses anywhere else, we ask for your consent after expressly telling you the consequences, as Part 9.2 describes (APP 8.2(b)). In those two cases we aren’t accountable under the Privacy Act 1988 for how the business handles your information.

AU 7. Security and destruction

We take the steps in Part 11 to protect your information. We destroy or de-identify personal information once we no longer need it for any purpose for which we may use or disclose it under the Australian Privacy Principles, unless an Australian law or a court or tribunal order requires us to keep it (APP 11.2). Part 10 sets out how.

AU 8. Access and correction

You can ask for access to the personal information we hold about you (APP 12) and for its correction (APP 13). Email privacy@opefin.com. We’ll respond within a reasonable period, which we treat as 30 calendar days, and tell you if we need longer and why. Access is free. Where we hold information only to store or process it for a business, we’ll consult that business before responding and apply any ground for refusing access that APP 12.3 provides. We may refuse access only on a ground APP 12.3 provides, and if we refuse we’ll give you written reasons, except where that would be unreasonable, and tell you how to complain. If we refuse to correct information, we’ll give you written reasons and, if you ask, attach a statement that you consider it inaccurate, out of date, incomplete, irrelevant or misleading, in a way that is apparent to anyone who uses it.

AU 9. Complaints and breaches

You can complain to us as Part 14.1 describes. The Australian Information Commissioner generally investigates a complaint only if you’ve complained to us first. If you’re not satisfied with our response, or we haven’t responded within 30 days, you can complain to the Office of the Australian Information Commissioner. If we suspect an eligible data breach under the Notifiable Data Breaches scheme, we’ll assess it and complete the assessment within 30 days of becoming aware of it, and if it’s likely to result in serious harm, we’ll notify the Australian Information Commissioner and affected individuals as soon as practicable.