Privacy Policy

We collect information directly from you, automatically when you use our website or services, and from trusted third parties where this is reasonably necessary for identity verification, fraud prevention, AML/CFT compliance, transaction processing, security, tax reporting, or another lawful purpose.

Third-party and indirect sources may include identity-verification services and their authorised subprocessors, official government identity data sources, banks or open-banking services, AML/CFT and fraud-screening services, sanctions and politically exposed person screening sources, adverse media sources, blockchain analytics or wallet-risk services, payment and settlement partners, exchange or liquidity partners, public blockchain data, regulators, law enforcement, tax authorities, and other lawful data sources.

When we collect personal information about you from another source, we take reasonable steps to make you aware of the collection, its purposes, intended recipient categories, the relevant law where applicable, and your access and correction rights before collection or as soon as reasonably practicable afterwards, unless an exception under the Privacy Act or another law applies.

Before you can use some or all of our services, we must complete customer due diligence and identity-verification checks. Depending on the verification method and your risk profile, these checks may include document verification, checks against reliable and independent identity sources, sanctions and politically exposed person checks, adverse media and fraud checks, wallet risk checks, source of funds or wealth checks, and enhanced due diligence.

Where remote biometric verification is used, an automated one-to-one face match compares a live selfie, facial image, or video with the portrait on your identity document. Liveness and anti-spoofing checks are used to help confirm that a real person is present and that the verification material has not been forged, altered, or presented by another person. The process may create facial measurements or a biometric template, match or confidence scores, liveness results, fraud signals, and a verification decision.

Flow Crypto is responsible under the Privacy Act for personal and biometric information processed for us by contracted identity-verification services. Intended recipients may include authorised Flow Crypto staff and contractors, our contracted verification service and its authorised subprocessors, professional advisers supporting our compliance or security work, and regulators, law-enforcement agencies, or other authorities where disclosure is required or permitted by law.

We use biometric information only for identity verification, liveness and anti-spoofing, fraud prevention, security, and legal or regulatory compliance. We do not sell biometric information, use it for marketing, use it for general one-to-many identification, or use it to infer health, emotions, ethnicity, religious beliefs, political views, or other unrelated sensitive characteristics.

Before using biometric verification, we assess its lawful purpose, necessity, effectiveness, reasonable alternatives with less privacy risk, privacy safeguards, likely impacts, accessibility, accuracy and bias risks, and cultural impacts and effects on Māori. We review this assessment when the system, purpose, risk, or legal requirements materially change. A summary of our assessment is available on request from our Privacy Officer.

Providing biometric information is voluntary, but completing identity verification to the required standard is mandatory before we can provide regulated services. A non-biometric verification route is available on request. Depending on the circumstances, it may involve certified identity documents, manual review, a first payment from a New Zealand bank account in your name, or an in-person check. An alternative route may take longer or require additional safeguards. We may be unable to open or maintain an account or provide a service if identity cannot be verified to the standard required by law and our risk-based procedures.

Some checks are automated. If a check fails, is inconclusive, is incomplete, or indicates elevated risk, we may request more information, conduct manual review, restrict services, decline a transaction, close an account, or make a regulatory report where required. Where practicable and lawful, we do not make a final decision that materially affects you solely because of an automated biometric result without reasonable checks. You may ask us to arrange human review of a failed or inconclusive result, subject to legal restrictions.

We provide a separate clear and conspicuous notice before biometric capture begins. That notice summarises the collection, purposes, available alternative, recipients, overseas processing, retention, consequences of not providing the information, and your rights. We do not rely on your agreement to this Privacy Policy as the only basis for biometric processing. Where specific authorisation is required by law, we will request it separately after providing the required information. Our biometric retention period is summarised in section 9.

We do not sell your personal information.

We may share personal information where reasonably necessary for the purposes described in this policy, including with:

• Identity and compliance providers - contracted identity-verification services and authorised subprocessors, official identity-data checks, AML/CFT, sanctions, fraud, adverse media, blockchain analytics, and wallet-risk service providers.
• Transaction providers - banks, payment processors, open-banking providers, exchange or liquidity partners, settlement providers, and other transaction service providers.
• Technology providers - cloud hosting, storage, cybersecurity, analytics, customer support, email, SMS, communications, and software providers.
• Professional advisers - auditors, insurers, accountants, legal advisers, and compliance or security consultants.
• Authorities - regulators, supervisors, Inland Revenue and other tax authorities, law enforcement, courts, tribunals, and government agencies where required or permitted by law, including for suspicious activity reports, prescribed transaction reports, Crypto-Asset Reporting Framework reporting and information exchange, regulatory requests, and investigations.
• Business transactions - another organisation involved in a proposed or completed business sale, merger, investment, financing, restructure, or transfer of all or part of our business, subject to appropriate confidentiality and privacy safeguards.

Some service providers and authorised subprocessors may be located outside New Zealand or may store or process information overseas. Where a provider acts only on our instructions and for our purposes, Flow Crypto remains responsible for the information processed on our behalf. We use provider due diligence, contractual protections, access controls, and other safeguards appropriate to the nature and sensitivity of the information.

Where personal information is disclosed to an overseas recipient for its own purposes, we do so only where the Privacy Act permits it. This will generally be because we reasonably believe comparable privacy safeguards apply, enforceable contractual protections are in place, or you have given informed authorisation after receiving the information required by law.

For biometric information, we apply the additional overseas-disclosure requirements in the Biometric Processing Privacy Code. You may contact our Privacy Officer for more information about the categories of overseas recipients and the safeguards used.

We take reasonable technical, organisational, and administrative steps to protect personal information against loss, unauthorised access, use, modification, disclosure, or other misuse. These steps may include encryption, access and authentication controls, audit logging, monitoring, staff training, secure storage, provider due diligence, data-minimisation measures, and incident response processes.

No method of electronic transmission or storage is completely secure. We cannot guarantee absolute security, but we work to protect personal information using safeguards appropriate to the nature and sensitivity of the information.

We keep personal information only for as long as reasonably required for the purposes described in this policy, unless a longer period is required or permitted by law.

Raw biometric samples, such as selfies, facial images or video and liveness captures, and derived biometric templates are deleted, or we instruct our contracted provider to delete them, no later than 30 days after the final verification decision. They may be kept longer only where reasonably necessary for an active verification retry, fraud or security investigation, complaint, dispute, legal hold, or specific legal requirement, and then only for as long as that reason continues.

The longer AML/CFT record-keeping period does not automatically require retention of raw selfies, videos, liveness captures, or biometric templates. We retain the verification outcome and the minimum identity and verification evidence reasonably necessary to identify the evidence used. Identity and verification records are generally kept for at least five years after the end of the business relationship or completion of an occasional transaction or relevant wire transfer, and may be kept longer if required by a supervisor, the Commissioner of Police, or another law.

Transaction records are generally kept for at least five years after completion. Suspicious activity reports and related records are generally kept for at least five years. Tax, accounting, and Crypto-Asset Reporting Framework records are kept for the periods required by law; applicable Crypto-Asset Reporting Framework due-diligence records may need to be kept for at least seven years after the end of the relevant reportable period.

When information is no longer required, we take reasonable steps to delete, anonymise, or securely restrict access to it. Deletion may be limited or delayed where information remains in protected backups, audit logs, legal holds, dispute records, regulatory records, or systems that must be retained for security or compliance reasons. We do not use retained backup information for ordinary business purposes.

You can ask us to confirm whether we hold personal information about you, including whether we hold biometric information and the types held, and request access to that information.

You can request correction if information is inaccurate, incomplete, out of date, or misleading. If we do not make a requested correction, you may ask us to attach a statement of correction to the information where the Privacy Act or Biometric Processing Privacy Code requires this.

You can request deletion or restriction where legally permitted and may request human review of a failed or inconclusive automated biometric result. We may be unable to delete information that we must retain under AML/CFT, tax, regulatory, legal-hold, security, or dispute-resolution obligations.

To make a request, contact us using the details below. We may need to verify your identity before responding. We will respond within the timeframes required by the Privacy Act, generally within 20 working days.

We may refuse, limit, or delay a request where the Privacy Act or another law allows or requires us to do so, including where disclosure would prejudice security, compliance, investigations, legal privilege, regulatory reporting, AML/CFT obligations, or another person's privacy.

You can opt out of marketing emails by using the unsubscribe link or contacting us. You will still receive important account, transaction, compliance, and security messages.

For privacy questions, access or correction requests, deletion requests, requests for human review, complaints, or a summary of our biometric assessment, contact our Privacy Officer:

Email: support@flowcrypto.co.nz

Post: Flow Crypto Limited, 14 Sewell Street, Linwood, Christchurch 8062, New Zealand

If you are not satisfied with our response, you can contact the Office of the Privacy Commissioner at www.privacy.org.nz or enquiries@privacy.org.nz.