PRIVACY POLICY

At Onni, our whole reason for existing is joy between people — and you can’t have joy without trust. This Privacy Policy describes how Onni Pty Limited ABN 14 631 824 523 ("Onni", "we", "us", "our") collects, uses, holds and discloses your personal information when you use our Service, and explains your privacy rights and how the law protects you. We handle personal information in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), applicable AML/CTF obligations and, as we expand internationally, the privacy laws of the other places we operate.

The Onni Gift Visa is issued by iGoDirect Group Pty Ltd ABN 17 110 897 320, AFSL 551294 ("iGoDirect"). Onni Pty Limited is a Corporate Authorised Representative (AR No. 001323805) of iGoDirect. iGoDirect also collects and handles personal information in connection with the card under its own privacy policy — see "Sharing of your personal information" below.

1. Definitions

In plain English: Capitalised words mean the same thing everywhere in this policy, singular or plural. Here’s the pocket dictionary.

• Account means a unique account created for you to access our Service or parts of it.
• Application / App means the Onni software application downloaded to your Device.
• Device means any device that can access the Service, such as a computer, mobile phone, wearable or tablet.
• Device Wallet means Apple Pay, Google Wallet, Samsung Wallet or another supported digital wallet.
• KYC Information means information collected for Know Your Customer, identity verification, fraud prevention, anti-money laundering or regulatory compliance purposes.
• Personal information means information or an opinion about an identified individual, or an individual who is reasonably identifiable (called "Personal Data" in some jurisdictions).
• Sensitive information includes government identifiers, biometric information used for verification, and other categories classified as sensitive under applicable privacy laws.
• Service means the Application, the Website, Onni Gift products, reloadable card functionality, digital gifting services and related services.
• Service Provider means any person or entity that processes information on our behalf.
• Usage Data means data collected automatically through use of the Service.
• Website means our website at https://www.onnigift.com.
• You means the individual accessing or using the Service.

References to "Onni", "we", "us" and "our" mean Onni Pty Limited and its related bodies corporate. Our Service Providers and financial partners are separate entities that handle information under their own policies and our contracts with them — this policy describes what we do and, where relevant, points you to theirs.

2. What we collect

In plain English: We collect what we need to send gifts, verify identities and keep the platform safe — contact details, transaction info, KYC where the law requires it, and technical data from your device. Not more than we need.

Personal information you provide

While using our Service, we may ask you to provide personal information that can be used to contact or identify you, including: your email address; first and last name; phone number; residential address, state and postcode; date of birth; government-issued identification and identity verification information (as part of KYC Information); wallet tokenisation information; and transaction information. As much as possible or unless provided otherwise in this policy or a notification, we will collect your personal information directly from you, but we may also collect personal information about you from other sources and third parties.

Information about gift recipients

Because Onni is a gifting platform, an Onni Gifter gives us limited information about their recipient — typically a name and a mobile number or email address — so we can deliver the gift. If someone gives us your details this way, we use them to deliver the gift, invite you to claim it, and comply with our legal obligations; this policy applies to that information from the moment we receive it. If you give us information about someone else, you must be authorised to do so and should let them know about this policy. (Surprise gifts: encouraged. Surprise data collection: not our style.)

Usage Data

Usage Data is collected automatically and may include: your Device’s IP address; browser type and version; device identifiers; pages visited, and the time, date and duration of visits; mobile device type, operating system and unique identifiers; app interaction data; wallet provisioning information; diagnostic data; and security and fraud monitoring information.

Information collected with your permission

To provide certain features of the App, and only with your prior permission, we may collect: your location; information from your Device’s contacts list (to help you pick a lucky recipient); pictures and information from your camera and photo library; wallet provisioning and tokenisation information; and device authentication information. We use this to provide and improve the Service, support gifting functionality and wallet integrations, prevent fraud, secure transactions, personalise your experience and comply with legal obligations. You can enable or disable these permissions at any time in your Device settings.

Sensitive information

Some of what we collect for verification — such as government identifiers or biometric-based verification information — is sensitive information. We collect sensitive information only with your consent and where reasonably necessary for identity verification, fraud prevention and AML/CTF compliance, and we do not use it for marketing. Biometric authentication on your Device (such as Face ID) is processed by your Device provider, not stored by us.

Anonymity

Where lawful and practicable — for example, browsing our Website or making a general enquiry — you may interact with us anonymously or using a pseudonym. To send or receive an Onni Gift, though, we do need to know who you are: anonymous generosity is lovely in theory, but tricky to deliver to the right phone number.

3. AML/CTF and identity verification

In plain English: We’re part of the regulated payments world, which means we (and iGoDirect) sometimes must verify who you are. It’s the law, and it keeps the platform safe for everyone.

As a fintech platform operating within the digital payments ecosystem, we and our regulated financial partners (including iGoDirect) may be required to collect and verify identity information under applicable Anti-Money Laundering and Counter-Terrorism Financing laws. Accordingly, we may: verify your identity; conduct sanctions screening; monitor transactions; request additional identification documents; conduct fraud assessments; and retain KYC records for legally required periods (generally up to seven years). If you do not provide requested information, we may be unable to provide some or all of the Service.

4. How we use your personal information

In plain English: To run Onni: deliver gifts, manage accounts, meet legal obligations, stop fraud, help you when things go wrong, and make the product better.

We may use personal information to: provide and maintain the Service; manage your Account; facilitate digital gifting and stored value functionality; enable wallet integrations; conduct identity verification and KYC procedures; comply with legal and regulatory obligations; prevent fraud, financial crime and misuse; contact you about Service updates and security notices; provide customer support; improve the Service and user experience; conduct analytics and operational reporting; monitor platform performance and security; manage disputes and complaints; support business transfers or corporate transactions; and provide marketing communications where permitted by law (see section 8).

Aggregated insights

We may also use aggregated, anonymised or de-identified information — information from which no individual can reasonably be identified — for product development, analytics, fraud monitoring, platform innovation, and aggregated trend insights that we may share with brands, charities and researchers (think "coffee emojis spike on Mondays", never "you bought a coffee on Monday"). We do not sell your personal information.

5. Sharing of your personal information

In plain English: We share information with the partners who make Onni work — the card issuer, payment processors, wallet providers, hosting and support — plus regulators when the law requires, and buyers or investors in a corporate transaction. Never a sale of your data.

We may share personal information in the following situations:

• With Service Providers — to provide and support the Service, conduct identity verification, facilitate payments and wallet integrations, support cloud hosting, monitor usage, assist fraud prevention, conduct analytics and provide customer support — always under contractual obligations to protect your information;

With financial partners — with card issuers (including iGoDirect, issuer of the Onni Gift Visa — privacy policy at privacy policy), payment processors (including Stripe), acquirers, banking institutions, wallet providers and regulated financial service providers, to operate the card and process transactions;

• With other users — the recipient of a gift sees the sender’s name and any note attached; the sender can see whether their gift has been claimed;
• For legal and regulatory compliance — to comply with legal obligations, respond to lawful requests, meet AML/CTF requirements, conduct sanctions screening, prevent fraud, and protect the rights, safety and security of users, partners and the platform;
• For business transfers — in connection with a merger, financing, acquisition or sale of company assets, under confidentiality obligations; and
• With your consent — for any other purpose you agree to.

6. Overseas transfers

In plain English: Our main cloud infrastructure lives in Australia, in data centres in Sydney — your information stays on Australian soil. A few of our suppliers process data overseas, and we hold them to the same Australian standard. If that ever changes, we’ll tell you.

All personal information about you is processed and stored by Onni on infrastructure located in Australia, in data centres in Sydney. This includes our application, our databases, our file storage and our backups.

Some of our Service Providers may process information outside Australia. These include our payment processor, our SMS and email delivery providers, and, for as long as we use it, our Firebase provider. Where we disclose personal information to overseas recipients, we take reasonable steps to ensure they implement safeguards consistent with the Australian Privacy Principles, including contractual protections. We will tell you about material changes to where your information is processed.

7. Security and retention

In plain English: Encryption, tokenisation, access controls and constant monitoring — and we keep information only as long as we need it or the law requires. If a serious breach ever happens, we’ll tell you and the regulator.

We implement commercially reasonable administrative, technical and organisational safeguards designed to protect personal information, including encryption, tokenisation, access controls, secure cloud infrastructure, authentication controls, monitoring and logging, fraud prevention systems and security response procedures. Payment card processing is handled by PCI DSS-compliant providers. No method of transmission or storage is completely secure, so please protect your own account too: lock your Device, keep credentials private, and contact us immediately if you suspect unauthorised access.

We retain personal information only as long as necessary for the purposes in this policy, including compliance with legal obligations (AML/CTF and financial records laws generally require retention for up to seven years), dispute resolution, fraud prevention, enforcement of agreements and operational purposes. Usage Data is generally retained for shorter periods unless needed for security, compliance or legal purposes. When information is no longer required, we take reasonable steps to destroy or de-identify it. If we experience a data breach likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) in accordance with the Notifiable Data Breaches scheme.

8. Marketing, cookies and tracking

In plain English: We’ll only market to you where the law allows, and every message has an easy exit. Cookies help the site work and show us what’s working — you can turn them off in your browser.

Marketing — where permitted by law (including the Spam Act 2003 (Cth)), we may send you news, offers and promotions by email, SMS or in-app notification (and you expressly consent to us doing so). You can opt out at any time via the unsubscribe link in any message, your app settings, or by emailing privacy@onnigift.com. Opting out of marketing does not affect essential service communications about your Account or gifts.

Cookies and tracking — we use cookies, web beacons, tags, pixels, analytics technologies and security monitoring technologies to track activity on the Service and store certain information. We use both session and persistent cookies for authentication, fraud prevention, user preferences, security, analytics, platform optimisation and Service functionality. You may refuse cookies through your browser settings, although some parts of the Service may not function properly.

9. Data analytics and future technologies

In plain English: We may use machine learning and AI to make Onni smarter and safer. If that ever changes what happens with your information, we’ll tell you first — and ask, where the law requires it.

We may use analytics, automation, machine learning or artificial intelligence technologies to improve platform functionality, enhance security, detect fraud, personalise user experiences and support operational efficiencies. Where these technologies materially change how personal information is used, or where the law requires it, we will provide additional disclosures or seek additional consents before proceeding.

10. Children and young people

In plain English: Onni is for people 16 and over, consistent with our Terms & Conditions. We don’t knowingly collect information from younger children — tell us if that happens and we’ll delete it.

The Service is intended for users aged 16 and over, consistent with our Terms & Conditions. We do not knowingly collect personal information from children under 16. If you believe a child under 16 has provided us with personal information, please contact privacy@onnigift.com and we will take reasonable steps to delete it.

11. Links to other websites

Our Service may contain links to third-party websites and services. We have no control over, and assume no responsibility for, their privacy practices or content — once you leave Onni, their rules (and their cookies) apply. We encourage you to review the privacy policy of every site you visit.

12. Your privacy rights, access and correction

In plain English: It’s your information. You can see it, fix it, ask us to delete what we don’t need, withdraw consent, and complain — to us first, and to the OAIC if we don’t sort it out. All free.

Subject to applicable law, you may: request access to the personal information we hold about you; request correction of inaccurate information; request deletion of information we are not required to retain; withdraw consent to processing that relies on consent; object to certain processing (including opting out of direct marketing); and complain about our privacy practices. Requests may require identity verification — we need to be sure it’s really you asking.

To exercise any of these rights, contact our Privacy Officer at privacy@onnigift.com. We will respond within a reasonable period (usually 30 days) and will not charge you for making a request, although a reasonable fee may apply to compiling extensive access requests. If we decline a request, we will tell you why and how to complain.

13. Complaints

If you have any concerns or complaints about the manner in which we have collected, used or disclosed and stored your personal information, please contact us as set out in item 15 below. In order to resolve a complaint, we: (a)will liaise with you to identify and define the nature and cause of the complaint; (b) may request that you provide the details of the complaint in writing; (c) will keep you informed of the likely time within which we will respond to your complaint; and (d) will inform you of the legislative basis (if any) of our decision in resolving such complaint.

If you are not satisfied with our response to a complaint, you may contact the Office of the Australian Information Commissioner: www.oaic.gov.au · 1300 363 992 · GPO Box 5288, Sydney NSW 2001. For privacy matters relating to the Onni Gift Visa, you may also contact iGoDirect, and unresolved card-related complaints may be escalated to the Australian Financial Complaints Authority (AFCA) as set out in the PDS.

14. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will notify users of material changes by posting the updated policy on the Website, updating the "Last updated" date, and/or providing electronic notice where appropriate. The current version is always available at www.onnigift.com/privacy. If you do not agree to our continued use of your personal information due to the changes in our policy, please cease providing us with your personal information and contact us via the details set out in item 15 below.

15. Contact us

Onni Privacy Officer · Onni Pty Limited ABN 14 631 824 523 · Email: privacy@onnigift.com · Website: https://www.onnigift.com · Phone: 1300 591 880