Privacy Policy

1. Purpose and Scope

City Gold Bullion respects your privacy and is committed to handling personal information in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles and other applicable laws.

This Privacy Policy applies to personal information we handle through our website, stores, Accounts, transactions, customer verification, collection, storage, enquiries, telephone and email communications, and other interactions with us.

2. What Personal Information We Collect

The personal information we collect depends on how you interact with us and may include:

• identity information, including full name, date of birth, signature and copies or details of government-issued identification;
• contact information, including residential and postal addresses, email address and telephone number;
• proof-of-address documents, such as utility bills, bank statements or rental records;
• Account credentials, customer numbers, authentication records and communication preferences;
• transaction information, including quotes, purchases, sales, payment status, collection, storage and delivery records;
• financial information required to process or verify a transaction, such as nominated bank account details, payment references and limited payment information;
• information about source of funds, source of wealth, occupation, business activities or the purpose of a transaction where relevant to customer due diligence;
• company, trust, SMSF, partnership or sole-trader information, including ABN, ACN, extracts, trust deeds, amendments and governing documents;
• information about directors, trustees, beneficiaries, members, shareholders, beneficial owners, authorised representatives and other persons connected with an entity Account;
• records of identity verification, sanctions and politically exposed person screening, risk assessments and compliance reviews;
• communications with us, including emails, forms, enquiries, complaints and call recordings where recording is lawful and notified;
• images captured by security systems, including CCTV at our premises where used;
• technical and website information, such as IP address, device and browser information, cookies, website activity and security logs; and
• any other information you provide or that we are authorised or required by law to collect.

Some identification and compliance information may be sensitive in context. We collect sensitive information only where permitted by law, reasonably necessary for our functions and activities, or with consent where consent is required.

3. How We Collect Personal Information

We usually collect personal information directly from you when you create an Account, complete a form, upload documents, place or collect an order, buy from or sell to us, use storage services, contact us or visit a store.

We may also collect information from:

• an Authorised Representative or another person acting for you;
• company directors, trustees, employers, professional advisers or other persons connected with an entity Account;
• identity verification, fraud prevention, sanctions screening and compliance service providers;
• public registers, government databases, company searches and other reliable independent sources;
• financial institutions, payment providers and delivery providers;
• our related entities, contractors and service providers; and
• regulators, law enforcement bodies or other organisations where authorised or required by law.

If you provide personal information about another person, you must be authorised to do so and, where appropriate, make this Privacy Policy available to that person.

4. Why We Collect Use and Disclose Information

We collect, use and disclose personal information where reasonably necessary to:

• establish, administer, secure and support Accounts;
• identify and verify customers, beneficial owners, representatives and other relevant persons;
• provide quotes, process purchases and buybacks, receive and make payments, arrange collection, administer storage and, when available, arrange delivery;
• assess product authenticity, investigate discrepancies and maintain transaction records;
• comply with anti-money laundering and counter-terrorism financing, sanctions, taxation, second-hand dealer, record-keeping, reporting and other legal obligations;
• assess and manage money laundering, terrorism financing, proliferation financing, fraud, security and credit risks;
• respond to enquiries, complaints, disputes and legal claims;
• maintain the safety and security of our premises, personnel, customers, systems and property;
• operate, secure, analyse and improve our website, Products, Services and customer experience;
• communicate operational, account, transaction, security and policy information;
• send marketing communications where permitted, and manage marketing preferences;
• obtain professional advice, conduct audits and manage insurance or legal claims; and
• support a proposed or completed business sale, restructure or transfer, subject to appropriate confidentiality and legal safeguards.

5 Customer Due Diligence and Identity Verification

As a reporting entity providing designated services under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006, we conduct customer due diligence. This can require us to collect and verify identity, beneficial ownership, authority, transaction purpose, source-of-funds, source-of-wealth and risk information.

We may verify information using identification documents, electronic verification services, public registers and other reliable independent sources. We may request additional documents or information where required by law or appropriate to the assessed risk.

If required information is not provided or cannot be satisfactorily verified, we may be unable to approve an Account, complete a transaction or continue providing a Service. We may be prohibited by law from explaining certain compliance actions or disclosures.

6. Anonymity and Pseudonyms

You may deal with us anonymously or using a pseudonym where lawful and practicable, such as when making a general enquiry. This option is generally unavailable for transactions, Accounts, collections, storage and other dealings where identification is required by law, reasonably necessary for security or needed to provide the requested Product or Service.

7. Who We May Disclose Information To

We may disclose personal information to:

• AUSTRAC, law enforcement bodies, courts, regulators, government agencies and other persons where authorised or required by law;
• identity verification, sanctions screening, fraud prevention and compliance service providers;
• banks, payment processors and financial institutions involved in a transaction;
• vaulting facilities, insurers, auditors and service providers involved in storage;
• designated delivery providers and collection locations when delivery services are available;
• information technology, cloud hosting, cybersecurity, document management, communications and website service providers;
• professional advisers, including lawyers, accountants, auditors, consultants and insurers;
• debt recovery providers where a valid amount remains unpaid;
• our related entities and personnel who need the information to perform their duties;
• a purchaser, investor or adviser involved in a proposed business transaction, subject to confidentiality protections; and
• any other person to whom you authorise us to disclose the information.

We require service providers to handle information only for authorised purposes and to apply appropriate confidentiality and security protections.

8. Overseas Disclosure and Storage

Some technology, cloud, verification, communications or professional service providers may store or process personal information outside Australia. The locations can vary according to the provider and service in use.

Before using an overseas arrangement, we take reasonable steps required by the Australian Privacy Principles to ensure appropriate handling of personal information, unless an exception applies. You may contact our Privacy Officer for current information about likely overseas locations relevant to your information.

9. Website Cookies and Analytics

Our website may use cookies and similar technologies to maintain sessions, remember preferences, protect Accounts, prevent fraud, understand website use and improve performance. Some cookies are necessary for the website to function; others may support analytics or communications.

You can control cookies through your browser settings. Blocking some cookies may affect website functionality. Where required, we will seek consent before using non-essential cookies or similar technologies.

10. Marketing Communications

We may send information about Products, Services, market updates or events where you have consented or where otherwise permitted by law. Commercial electronic messages will identify the sender and include a clear way to unsubscribe.

You may opt out at any time by using the unsubscribe function in a message or contacting us. We may still send non-marketing communications necessary to administer an Account, transaction, security issue or legal obligation.

11. Security

We take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. Measures may include access controls, identity and authority checks, secure systems, encryption or protected transmission where appropriate, logging, staff training, physical security and contractual controls for service providers.

No internet transmission or storage system is completely secure. You should protect your Account credentials, use secure devices and promptly tell us if you suspect unauthorised activity or a fraudulent communication claiming to be from City Gold Bullion.

12. Retention and Destruction

We retain personal information for as long as reasonably necessary for the purposes described in this Policy and to satisfy legal, regulatory, accounting, insurance, dispute and security requirements.

Anti-money laundering and counter-terrorism financing records are generally retained for at least seven years, with the applicable period depending on the type of record and, for customer due diligence records, the end of the business relationship or date of the last occasional transaction.

When information is no longer required and we are not legally required or otherwise authorised to retain it, we take reasonable steps to destroy it securely or permanently de-identify it.

13. Access and Correction

You may request access to personal information we hold about you or ask us to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading. We may need to verify your identity and authority before responding.

We will respond within a reasonable period. If access or correction is refused, we will provide written reasons where required by law and explain available complaint options. We do not charge for making a request, although a reasonable charge may apply to providing access where permitted by law and advised in advance.

14. Data Breaches

We maintain processes for responding to suspected data breaches. We will investigate, contain and assess an incident and take remedial action where appropriate.

Where the Notifiable Data Breaches scheme applies and a breach is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner as required by law.

15. Privacy Complaints

If you have a privacy question or complaint, contact our Privacy Officer using the Contact Us page on the City Gold Bullion website or the published contact details for our Adelaide or Brisbane office. Please provide enough information for us to identify the issue and the outcome you seek.

We will acknowledge and investigate the complaint and aim to respond within a reasonable period. If you are not satisfied, you may contact the Office of the Australian Information Commissioner through www.oaic.gov.au.

16. Changes to this Policy

We may update this Privacy Policy to reflect changes in law, technology, our practices or the Products and Services we provide. The current version will be published on our website with its effective date. Where a change is material, we will take reasonable steps to provide additional notice where appropriate.

17. Contact

Privacy Officer, City Gold Bullion. Please use the Contact Us page on our website or the published contact details for our Adelaide or Brisbane office.