Global Privacy Policy

Opefin Limited is a technology company incorporated in New Zealand (Company Number 9403953, NZBN 9429053433008). We operate Opefin Source, an end-to-end AML/CTF compliance platform covering identity verification, source of funds analysis, enhanced due diligence (EDD) screening, risk profiling, ongoing monitoring, and suspicious activity report (SAR) workflow tooling, and the Opefin Compliance Network, through which accredited reporting entities can access verified compliance records with consumer notification.

We are the data controller for all personal information collected when consumers use our services, including when that information is submitted on a consumer’s behalf by a reporting entity. When a consumer interacts with our platform, whether through a magic link or any other Opefin interface, they agree to these terms and our privacy policy directly, and Opefin is the primary controller of the underlying data. The reporting entity receives the certificate as an output and is responsible for its own obligations under applicable AML/CTF law.

2.1 Who this policy applies to

This policy applies to:

• consumers who use Opefin Source to generate an AML/CTF certificate, whether directly via a magic link or whose documents are submitted on their behalf by a reporting entity, provided they have accepted these terms and the applicable privacy notice
• reporting entities who use the Opefin platform to initiate certificate requests on behalf of their clients
• anyone who visits opefin.com or contacts us

2.2 What a Reporting Entity is

A Reporting Entity is a professional or business required by AML/CTF law to undertake customer due diligence. This includes but is not limited to financial services providers, lawyers, conveyancers, real estate agents, high value dealers, accountants, and online marketplace operators, and any other entities or individuals engaged in captured activities under applicable AML/CTF law.

2.3 What Opefin Source does

Opefin Source screens your provided information, and also connects to your financial accounts via a regulated open banking connection (with your consent) or processes documents and information submitted through the platform, and generates a cryptographically signed AML/CTF source of funds certificate. That certificate is used by the requesting reporting entity to satisfy their legal obligation to verify your identity and source of funds.

2.4 What the Opefin Compliance Network is

The Opefin Compliance Network is a core feature of Opefin Source. When your certificate is generated, a verified compliance record associated with it is stored in the Network. Accredited reporting entities can query the Network to verify your identity and compliance status for future transactions, with notification to you and subject to your retained right to remove your record from active queries.

This is a fundamental feature of the service, not a secondary optional use. By accepting these terms, the country specific privacy notice, as well as the Opefin Source Consumer Terms (including each relevant country specific consumer terms), you agree to your certificate and associated verified data being part of the Opefin Compliance Network for the duration of the applicable statutory retention period. The benefit to you is that future reporting entities, including those in other jurisdictions, can verify your identity and source of funds and wealth status instantly, without requiring you to repeat the full AML/CTF process.

4.1 Primary purpose

The primary reason we collect and use your personal information is to generate an Opefin Source certificate for the reporting entity involved in your transaction and to maintain your verified compliance record in the Opefin Compliance Network.

4.2 Full list of purposes

4.3 Lawful bases

We use your data only when we have a valid legal reason to do so. The specific lawful basis applicable in your jurisdiction is set out in the jurisdiction-specific notice for your country.

5.1 How the Network works

When your certificate is generated, a verified compliance record is created and held in the Opefin Compliance Network. This record contains the structured data derived from your certificate, including your verified identity, source of funds and wealth status, certificate date, tier, and associated risk profile, and any other information that you provided as part of a previous full due diligence process. It does not contain your full raw bank transaction data, which is governed by the separate retention rules in Part 7.

5.2 Who can query your record

Only accredited reporting entities with an active Opefin enterprise account may query the Network. Accreditation requires agreement to Opefin’s data use terms. Reporting entities can query the Network only in the context of a genuine transaction in which you are involved.

5.3 Notification for Network queries

When an accredited reporting entity queries your Network record, you will receive a notification. Your stored consent, given when you first used Opefin Source, covers Network queries by future accredited reporting entities. You do not need to give fresh consent for each query, but you are notified of each one so you are always aware of who has accessed your record.

5.4 Cross-border access

The Opefin Compliance Network is designed to support cross-border AML/CTF verification. An accredited reporting entity in another jurisdiction may query your Network record if you are involved in a transaction with them. Cross-border queries are subject to the same notification and accreditation requirements. The applicable cross-border transfer mechanisms are set out in Part 6.

5.5 Removal from active Network queries

You may request removal of your record from active Compliance Network queries at any time by contacting privacy@opefin.com. Removal means no future reporting entity can query your record. However, your underlying certificate and associated data must be retained for the statutory period under applicable AML/CTF law. Historical certificate records held by reporting entities who have already accessed your record remain valid and subject to those entities’ own retention obligations. Removal from active queries does not affect those records.

5.6 Commercial model

Reporting entities pay Opefin for access to the Compliance Network infrastructure. This can include subscription access, per-query fees, and setup costs where applicable. These fees are charged for access to the verified compliance infrastructure, not for your personal data. Opefin’s revenue model is infrastructure access, consistent with how payment networks, credit bureaus, and identity verification platforms operate globally.

Opefin is a New Zealand company and processes data primarily in New Zealand and Australia. The Opefin Compliance Network is designed to facilitate cross-border compliance verification, which means your verified compliance record may be accessed by accredited reporting entities in other jurisdictions.

When we transfer your personal information outside your country, we take steps to ensure it receives protection consistent with applicable privacy law:

• For transfers from the European Economic Area or the UK: we rely on adequacy decisions, standard contractual clauses, or other approved transfer mechanisms under the GDPR or UK GDPR.
• For transfers from New Zealand: transfers outside New Zealand are made only to countries with comparable privacy protection, or under contractual arrangements requiring the recipient to protect the data to the standard of the Privacy Act 2020.
• For transfers from Australia: we comply with the cross-border disclosure provisions of Australian Privacy Principle 8 under the Privacy Act 1988 (Cth).
• For transfers from other jurisdictions: we comply with applicable local law, as specified in the jurisdiction-specific notice for your country.

Details of the specific transfer mechanisms we use are available on request from privacy@opefin.com.

You have the following rights over your personal information. Which rights apply and how they work in practice depends on your location and applicable law. Your jurisdiction-specific notice sets out any variations.

9.1 How to exercise your rights

Contact us at privacy@opefin.com. Include your full name, the email address associated with your Opefin account, and a description of the right you want to exercise. We may ask you to verify your identity before we process your request. We will acknowledge your request within 10 working days and respond within 20 working days or the period required by applicable law, whichever is shorter.

9.2 Complaints

If you are not satisfied with how we have handled your personal information, contact us first at complaints@opefin.com. We will respond within 20 working days. You also have the right to complain to the privacy regulator in your jurisdiction. The relevant authority is set out in the jurisdiction-specific notice for your country.

We take the security of your personal information seriously. The measures we apply include:

• Encryption of data in transit (TLS 1.2 or higher) and at rest (AES-256).
• Multi-factor authentication for all staff access to production systems.
• Role-based access controls limiting which staff can access which data.
• Regular penetration testing and vulnerability assessments.
• Cryptographic signing and hash-anchoring of certificates so any tampering is immediately detectable.
• Staff training on data security and privacy obligations.

Full details of our technical and organisational security measures are set out in our Security Policy, available on request from privacy@opefin.com.

10.1 If something goes wrong

If we suffer a breach that affects your personal information and poses a real risk of harm to you, we will notify the relevant privacy regulator within 72 hours of becoming aware (where required by applicable law), notify you directly as soon as practicable, and explain what happened, what data was affected, and what we are doing about it (if such notification is allowed under law).

You can manage cookie preferences through your browser settings at any time. Blocking strictly necessary cookies will prevent you from using the Opefin platform.

Opefin Source is not intended for use by anyone under the age of 18 (or the age of majority in a particular jurisdiction). We do not knowingly collect personal information from children. If we become aware that we have inadvertently collected personal information from a person under 18, we will delete it promptly. If you are a parent or guardian and believe your child has provided us with personal information, contact us at privacy@opefin.com.

We may update this policy from time to time as our products develop, as we expand into new jurisdictions, or as the law changes. The current version is always available at opefin.com/legal/global-privacy-policy.

We will notify you of material changes by email at least 30 days before the change takes effect. For changes required by law or for security reasons, we may implement them immediately and notify you as soon as practicable. If you continue to use the Opefin platform after a change takes effect, you accept the updated policy.