1. About us
PAYANGEL PTY LTD (ABN 13 685 159 497, ACN 685 159 497) provides international money transfer (remittance) services to customers in Australia. In this Policy, “PayAngel”, “we”, “us” and “our” mean PAYANGEL PTY LTD, the entity that collects, holds and handles the personal information of our Australian customers. “You” and “your” mean an individual whose personal information we collect, hold or handle.
PayAngel is registered with AUSTRAC as an independent remittance dealer. Registration is not an endorsement or approval of PayAngel by AUSTRAC or by any other government agency.
2. About this Policy
This Policy sets out how we collect, use, store and disclose your personal information. By “personal information” we mean information or an opinion about an identified individual, or an individual who is reasonably identifiable.
Some technical information we collect online — such as an IP address, device identifier or cookie ID — may not identify you on its own. It may still be personal information if, in the circumstances, it can reasonably identify you, including where it is linked or reasonably linkable to your name, contact details, account, transaction or identity-verification information. Personal information does not include information that has been made anonymous and cannot reasonably identify an individual.
We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles. We may update this Policy from time to time; the current version is always available through the “Privacy Policy” link on our website.
3. What personal information we may collect
- Identity and contact information
- Name, date of birth, gender, nationality; residential address, email address, telephone number.
- Government-related identifiers
- Passport, driver licence, Medicare or immigration document numbers and similar identifiers used to verify your identity.
- Verification information
- Identity and address documents, and the results of the identity checks we carry out, which we are required to collect to meet our anti-money laundering and counter-terrorism financing (AML/CTF) and sanctions obligations.
- Financial and transaction information
- Bank account, payment card or mobile-money details; transfer amounts, history, payment methods, and information about your recipient and the destination.
- Sensitive information
- Where additional verification is required, biometric information — a “liveness” check confirming that the person presenting a document is the person in it. See section 6.
- Technical and digital information
- Device identifiers, device type, IP address, location where you enable it, app and website activity, and standard log data — used for security, fraud prevention, troubleshooting and analytics.
- Marketing and communication information
- Your marketing and communication preferences, and your interactions with us.
4. How we collect your personal information
We collect personal information directly from you — for example when you create an account through our website or app, make a transfer, contact us, or sign up to receive communications.
We also collect personal information about you from third parties, in particular from the identity verification providers and credit reporting bodies described in section 6, and from publicly or commercially available sources, in each case to meet our legal and regulatory obligations. If you do not provide the information we ask for, we may not be able to provide our services to you.
5. Why we collect your personal information, and how we use it
We collect and use your personal information to provide our services and to meet our obligations, including to:
- set up and manage your account, and provide our money transfer services;
- verify your identity and your payment methods, and check that a transaction is legitimate;
- process transfers, payments and refunds;
- communicate with you about your account, your transfers and changes to our service;
- prevent, detect and investigate fraud and other unlawful activity;
- comply with our legal and regulatory obligations, including under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) and sanctions laws;
- improve and develop our services, in aggregated or de-identified form where practicable; and
- send you marketing where permitted — you can opt out at any time.
6. Verifying your identity
The law requires us to verify who you are before we can provide our services to you. This section explains how we do that and what choices you have.
Checking your details with a credit reporting body
One of the ways we can verify your identity is by asking a credit reporting body whether the details you have given us match the identification information it holds about you. This is often called a “credit header” check.
We want to be clear about what this does and does not involve. We do not obtain your credit report, your credit score, your repayment history or information about defaults, and we are not a credit provider. We ask only whether your identification details match, and the credit reporting body tells us only whether they matched. The check does not affect your credit rating.
We will ask for your express consent before carrying out this check. We will ask for it separately, and not as part of your general acceptance of our terms.
If you would prefer not to have this check carried out
You can decline, and declining is never a dead end. If you decline, we will verify your identity using other independent sources instead — for example by matching your passport, driver licence, Medicare card or immigration document against the record held by the government agency that issued it, through the Australian Government’s Document Verification Service. The standard we apply is the same either way.
If we are unable to verify your identity, we will tell you in writing and explain what that means. We keep records of the checks we carry out, and destroy them, as the law requires.
Additional verification in some cases
Where our risk assessment indicates that additional verification is needed, we may ask you to complete a “liveness” check — typically taking a short video or photograph of yourself so that we can confirm you are the person shown in the identity document you have provided. This is biometric information, which is sensitive information under the Privacy Act. We will ask for your consent before collecting it, we will use it only to verify your identity, and we will not use it for any other purpose. This step is not required of every customer.
7. Automated processing and decisions
Parts of our identity verification, sanctions screening and fraud prevention are automated.
When you apply, our service providers check the details you give us against independent sources and return a result to us — for example whether your details matched, or whether a screening check raised a match. Those providers do not decide anything about you. Our own systems take that result, apply our risk rules, and decide whether we can open your account or process your transfer. The decision is ours.
The personal information used in that automated processing is your identity and contact information, your government-related identifiers, the results of the verification and screening checks, your transaction and payment information, and device and technical information.
The kinds of decisions involved are whether to accept your application and open an account for you; whether to ask you for further verification before proceeding; and whether to hold, refer, decline or reverse a transfer. Some of these decisions, including a decision to decline an application, may be made by our systems alone, without a person considering your case at the time. Where that happens, the systems are applying rules that our people have written, tested and approved, and that we review. They are not making up the rules as they go.
A person can always look at a decision our systems have made. Our staff can review it, question it and set it aside. If a decision has affected you and you would like us to look at it again, contact us using the details in section 19 and a person will review it.
There are decisions we are not permitted by law to give you the reasons for. Where that is the case we will tell you the outcome, and that we are unable to explain it, rather than give you a reason that is not the real one.
Source note. This section anticipates the automated decision-making transparency requirements that commence on 10 December 2026. Retain and review before publication.
8. Direct marketing
We may use your personal information to tell you about our products and services, by email, SMS or other channels permitted by law. You can opt out at any time using the unsubscribe option or by contacting us. We do not sell your personal information, and we do not disclose it to third parties for their own direct marketing unless you have expressly opted in.
9. Who we may disclose your personal information to
We may share your personal information, for the purposes described in this Policy, with:
- our employees, contractors and authorised representatives who need it to perform their roles;
- our affiliates — entities under common ownership with us — where they perform processing or support functions for us;
- payout partners and correspondent institutions that complete the transfer to your recipient in the destination country;
- payment processors, card acquirers and settlement providers;
- identity verification, credit reporting, screening and fraud prevention providers;
- cloud hosting, IT, analytics and communications providers;
- professional advisers, and parties involved in a sale, merger or restructure of our business; and
- government agencies, regulators and law enforcement, including AUSTRAC, as required or permitted by law.
We share personal information only as described in this Policy, as notified to you when we collect it, with your consent, or as otherwise permitted or required by law. We do not authorise our service providers to use your personal information for their own purposes.
10. Disclosure of personal information outside Australia
Because we provide cross-border money transfers, we routinely disclose personal information to recipients outside Australia.
Information about you and your recipient is disclosed to the destination country you send to. The destination countries we currently support are Ethiopia, Ghana, India, Kenya, Nigeria, the Philippines, South Africa and the United Kingdom.
Personal information may also be handled in the United Kingdom, where processing and support functions are performed for us.
[TBD — Jones / Daniela] Confirm whether personal information is processed in the European Union or in any country other than the United Kingdom and the destination countries listed above. The list must describe where data actually goes.
When we disclose personal information overseas we take reasonable steps to ensure the recipient handles it in accordance with the Australian Privacy Principles, or we rely on an exception under Australian Privacy Principle 8 — for example your consent, or a requirement of Australian law.
11. Anonymity and pseudonymity
Australian privacy law gives you the option of dealing with an organisation anonymously or under a pseudonym where that is practicable. We are not able to offer that option for our money transfer service, because the AML/CTF Act requires us to identify and verify every customer before we provide the service. You can, of course, make a general enquiry to us without identifying yourself.
12. Cookies and analytics
We use cookies and similar technologies on our website and app to enable functionality, improve performance, support security and fraud prevention, and understand how our services are used. You can adjust your browser settings to disable non-essential cookies, though some features may not work properly. Information collected through these technologies is handled in accordance with this Policy.
13. Security
We hold your personal information in electronic form, and may store it with trusted service providers. We take reasonable steps to protect it from misuse, interference and loss, and from unauthorised access, modification or disclosure — including access controls, encryption, network security measures and staff training.
If a data breach occurs that is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.
14. How long we keep your personal information
We keep personal information for as long as it is needed for the purposes described in this Policy and to meet our legal obligations. Records we are required to keep under the AML/CTF Act are retained for seven years. We securely destroy or de-identify personal information when we no longer need it and are no longer required to keep it.
15. Links to other websites
Our website and app may contain links to third-party websites. We are not responsible for the content or the privacy practices of those websites, and we recommend reviewing their privacy policies before using them.
16. Accessing and correcting your personal information
You can ask us for access to the personal information we hold about you, using the contact details in section 19. We will need to verify your identity first. In some cases we may not be able to give you full access — for example where the law prevents us from doing so — and if that happens we will explain why.
If you believe the information we hold about you is inaccurate, out of date or incomplete, please tell us and we will take reasonable steps to correct it.
17. Making a privacy complaint
If you believe we have not handled your personal information in accordance with the Privacy Act or the Australian Privacy Principles, please tell us, using the details in section 19. Putting your complaint in writing helps us understand it, but we will accept it however you make it.
We will acknowledge your complaint when we receive it, and we will give you our response within 30 days.
If you are not satisfied with our response, or if we have not responded within 30 days, you can complain to the Office of the Australian Information Commissioner:
- Website: www.oaic.gov.au
- Email: enquiries@oaic.gov.au
- Telephone: 1300 363 992
- Post: GPO Box 5218, Sydney NSW 2001
18. Changes to this Policy
We may update this Policy from time to time. The updated version will be posted on our website with a new “last updated” date.
19. Contact us
For any question about this Policy, to access or correct your information, or to make a privacy complaint, contact us:
- PAYANGEL PTY LTD (ABN 13 685 159 497)
- Email: privacy.au@payangel.com
- Post: 60 Martin Place, Sydney NSW 2000, Australia
[TBD — Jones / Daniela] Confirm that 60 Martin Place, Sydney NSW 2000 is PayAngel Pty Ltd’s registered office as recorded with ASIC.
[TBD — Jones / Daniela] Customer support telephone number and support hours, including time zone.
Open items to be completed before this Policy is published to production:
Confirmation of the registered office address and the support telephone number (section 19); confirmation of every country in which personal information is processed (section 10); and the date of the Policy, which is the date it is approved.
