Collybus Pty Ltd and Collybus Pte Ltd form part of the Collybus group of companies (together, Collybus, we, us or our). We recognise the importance of protecting the confidentiality and security of personal information and are committed to handling it lawfully, fairly and transparently.
Our business is operated primarily through Collybus Pty Ltd in Australia. Collybus Pty Ltd is bound by the Privacy Act 1988 (Cth), including the Australian Privacy Principles (APPs), and is the primary entity responsible for personal information collected in connection with enquiries, onboarding and brokerage services provided by Collybus Pty Ltd.
Collybus Pte Ltd is a group entity incorporated in Singapore and may collect or process personal information in connection with Singapore activities and in providing group administration, technology and other support services. Where applicable, Collybus Pte Ltd handles personal data in accordance with the Personal Data Protection Act 2012 of Singapore (PDPA).
This Privacy Policy explains how we collect, hold, use, disclose and protect personal information when you interact with our website, platform and services, and how you may access or correct your personal information or raise a privacy concern or complaint.
Depending on the relevant entity, individual and activity, other privacy and data protection laws may also apply, including the General Data Protection Regulation (GDPR) and other applicable laws in jurisdictions in which we operate or provide services.
Who Is Responsible for Your Personal Information
Collybus Pty Ltd (Australia): Collybus Pty Ltd is the primary entity responsible for personal information collected in connection with Australian brokerage services, including enquiries, onboarding, KYC and AML/CTF checks, account administration, trading and transaction activity, settlement, regulatory reporting and ongoing client servicing.
Collybus Pte Ltd (Singapore): Collybus Pte Ltd is responsible for personal information it collects or uses in connection with its Singapore activities. It may also process personal information on behalf of Collybus Pty Ltd in providing group administration, technology and other support services, subject to appropriate privacy and contractual safeguards.
Where both entities are involved in a service or use personal information for their own purposes, each entity is responsible for its own handling of that information under the laws applicable to it.
If you have questions about which entity is responsible for your information, or wish to exercise your privacy rights, contact us at support@collybus.co. We will route your request to the appropriate Collybus entity.
Personal Information We Collect
We may collect and hold personal information that you provide directly to us, that is generated through your use of our services, or that we obtain from third parties where permitted by law. The types of information we collect depend on the nature of your relationship with us and may include:
- Identity and contact information: name, date of birth, title, occupation, business or employment information, residential or business address, email address and telephone number;
- KYC, KYB and verification information: identification documents such as passports, driver licences or other government-issued identification; proof of address; photographs, selfies or other images used for identity verification or liveness checks; biometric information used for automated identity verification, including facial recognition data where applicable; results of electronic identity verification, sanctions, PEP, adverse media and other financial-crime screening; and information relating to directors, authorised representatives and beneficial owners of corporate clients;
- Financial and source-of-funds information: bank account details and other payment information; information and supporting documentation relating to source of funds, source of wealth, financial position or business activities where required for onboarding, due diligence, transaction monitoring or regulatory purposes;
- Account, transaction and digital asset information: account details, trading and order history, instructions, deposits, withdrawals, transfers and settlement activity; digital asset wallet addresses used for deposits or withdrawals; blockchain transaction information such as transaction hashes and confirmations; and information obtained through wallet screening or on-chain analytics;
- Technical and usage information: IP address, device, browser and operating-system information, website or platform usage information, cookies and analytics data, and approximate location information derived from technical data where applicable; and
- Communications and support information: correspondence, enquiries, complaints, support requests, feedback and other communications with us.
We may also collect other information where reasonably necessary to provide our services, manage our relationship with you, comply with legal or regulatory obligations, or protect our clients, systems and business.
We seek to collect only personal information that is reasonably necessary for our business activities, services and legal or regulatory obligations. Where we collect sensitive information, including biometric information used for identity verification, we do so in accordance with applicable privacy law.
How We Use Personal Information
We may collect, use and disclose personal information for the following purposes:
- Service Delivery & Communication: To respond to enquiries, assess prospective clients, establish and administer accounts, provide brokerage and related services, process instructions and transactions, and communicate with you about our services.
- Compliance & Regulatory Obligations: To conduct KYC, KYB, AML/CTF, sanctions and other compliance checks, monitor activity, maintain required records, make regulatory reports, respond to lawful requests and comply with obligations imposed by regulators or other authorities.
- Risk, Security & Fraud Prevention: To manage operational, financial crime, information-security and other risks, investigate suspicious or unauthorised activity, and protect our clients, systems and business.
- Business Operations & Record-Keeping: To maintain corporate, administrative, financial, legal and operational records and to manage service providers, professional advisers and group administration.
- Marketing & Updates: To provide information about our services, market updates or other communications where permitted by law, with consent where required and with an appropriate opt-out mechanism.
We handle personal information in accordance with the requirements of the privacy laws that apply to the relevant activity. Where GDPR applies, our legal basis for processing may include consent, performance of a contract or steps taken before entering a contract, compliance with a legal obligation, and our legitimate interests or those of a third party where those interests are not overridden by your rights and interests.
If we propose to use personal information for a materially different purpose that is not permitted by applicable law, we will provide further notice or obtain consent where required.
International Data Transfers
Our business operates primarily from Australia, while the Collybus Group also has operations in Singapore. Personal information may therefore be accessed, processed or disclosed between Collybus Pty Ltd and Collybus Pte Ltd and by service providers located outside the country in which the information was collected.
Overseas recipients may include group entities and providers of cloud hosting, technology, identity verification, financial crime screening, professional services, custody, banking, brokerage, trading or other infrastructure. Such processing may occur in Singapore and in other jurisdictions in which relevant service providers or market infrastructure operate. Where practicable, more specific information about likely overseas recipients or jurisdictions may be provided in collection notices or service documentation.
Where Australian privacy law applies, Collybus Pty Ltd takes reasonable steps to ensure that overseas recipients handle personal information consistently with applicable Australian privacy requirements, including APP 8. Where Singapore law applies, Collybus Pte Ltd applies the PDPA requirements governing transfers of personal data outside Singapore. Where GDPR applies, we use appropriate safeguards for restricted international transfers, which may include adequacy decisions, standard contractual clauses or other legally recognised transfer mechanisms.
Data Protection in Australia and Singapore
Australia: Collybus Pty Ltd manages personal information in accordance with applicable requirements of the Privacy Act 1988 (Cth) and the APPs. This includes requirements relating to transparency, collection, notification, use and disclosure, direct marketing, overseas disclosure, data quality, security, access and correction. Collybus Pty Ltd may also be required to collect, use, disclose and retain personal information under financial services, AML/CTF and other regulatory laws.
Singapore: Collybus Pte Ltd manages personal data in accordance with the PDPA where applicable. It maintains a Data Protection Officer (DPO) function for Singapore privacy matters. Where Collybus Pte Ltd processes personal data solely on behalf of another Collybus entity, it will do so in its capacity as a data intermediary or service provider, as applicable.
Privacy and DPO enquiries for either entity may be sent to support@collybus.co.
Marketing Communications
We may send marketing communications where you have requested them, where we have another lawful basis to do so, or where applicable law otherwise permits. Where consent is required, we will seek that consent before sending the relevant marketing communication. You may opt out at any time by using the unsubscribe mechanism in the communication or by contacting us at support@collybus.co.
We do not sell personal information or share it with third parties for their own independent marketing purposes.
Who We Share Information With
We may share personal information where reasonably necessary for the purposes described in this Policy, including with:
- Collybus Group Entities: Collybus Pty Ltd and Collybus Pte Ltd for client servicing, compliance, administration, technology and operational support;
- Service Providers: Providers of IT support, cloud hosting, data storage, communications, identity verification, KYC/KYB, sanctions or financial crime, wallet screening and other operational services;
- Financial and Market Infrastructure Providers: Banks, custodians, brokers, trading venues and other providers involved in providing or supporting our services where relevant;
- Professional Advisers: Lawyers, auditors, accountants, consultants and insurers supporting our business operations;
- Regulatory and Public Authorities: Regulators, law-enforcement bodies, government agencies, courts, tax authorities or other persons where disclosure is required or permitted by law.
We expect third parties with whom we share personal information to protect its confidentiality and security and to handle it in accordance with applicable law. Where a third party processes personal information on our behalf, we also impose appropriate contractual and privacy requirements.
Security Measures
We take reasonable technical and organisational measures to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. Access is restricted to personnel and service providers with a legitimate business need, and we maintain procedures for responding to suspected data breaches or security incidents.
Where a data breach is subject to mandatory notification requirements, including under the Australian Notifiable Data Breaches scheme, the Singapore PDPA or other applicable law, we will make the required notifications to affected individuals and relevant authorities.
Data Retention
We retain personal information only for as long as reasonably necessary for the purposes for which it was collected and to satisfy applicable legal, regulatory, accounting, dispute-management and record-keeping requirements.
In Australia, relevant AML/CTF records are generally subject to seven-year retention requirements under Australian law. Other records may be retained for different periods where required by law or reasonably necessary for our business or legal purposes. When personal information is no longer required to be retained, we will take reasonable steps to securely destroy or de-identify it, subject to applicable law.
Your Rights and Privacy Complaints
Your rights depend on the privacy law that applies to the relevant processing activity:
- Australia: You may request access to personal information held about you and request correction of information that is inaccurate, out of date, incomplete, irrelevant or misleading, subject to applicable exceptions. You may also make a complaint about our handling of your personal information.
- Singapore: Where the PDPA applies, you may have rights to request access to and correction of personal data and to withdraw consent, subject to the requirements and exceptions in the PDPA.
- European Union / EEA: Where GDPR applies, you may have rights including access, rectification, erasure, restriction, portability, objection and withdrawal of consent, subject to applicable conditions and exceptions.
To exercise a right or make a privacy complaint, contact support@collybus.co. We may request information reasonably necessary to verify your identity and protect personal information from unauthorised disclosure. We will investigate privacy complaints and generally aim to respond within 30 days, although complex matters may take longer.
If you are not satisfied with our response, you may be entitled to complain to the Office of the Australian Information Commissioner (OAIC), the Personal Data Protection Commission of Singapore (PDPC), a relevant European data protection authority, or another competent privacy regulator in your jurisdiction.
Website Cookies
Our website may use cookies and similar technologies to support website functionality, remember preferences and understand site usage, including through analytics services such as Google Analytics where used. You can manage cookies through your browser or available cookie controls. Where applicable law requires consent for non-essential cookies, we will seek that consent before using those cookies.
Disabling some cookies may affect the functionality or performance of parts of our website or platform.
Contact Us
For questions, requests or complaints about this Policy or our handling of personal information, please contact:
Email: support@collybus.co
This is the primary privacy contact for Collybus Pty Ltd and Collybus Pte Ltd. Privacy and Data Protection Officer enquiries will be directed to the appropriate Collybus entity.