Idealx Privacy Policy and Collection Notices

Definitions and interpretation #

A specific meaning or rule in the relevant service clause prevails over a general definition. References to an accepted schedule or record mean the version supplied for that service, not an undisclosed internal policy. Mandatory legal rights and obligations are not displaced by these definitions.

In this policy, “we” and “us” refer to the Idealx entity handling the information, as identified in section 1. This policy explains information handling; it is not a blanket permission or waiver.

1 Who handles your information #

This policy covers Idealx Platform Pty Ltd, ACN 694 912 126; Idealx Securities Limited, ACN 647 627 889; and Idealx Digital Assets Pty Ltd, ACN 667 364 276, for information each handles in supplying its services. Shared branding and contact details do not merge their legal responsibilities. Independent advisers, fund operators, banks and payment providers have their own privacy obligations and notices.

Contact the Privacy Officer through support@idealx.com, or make a privacy complaint through complains@idealx.com. Identify the relevant service or entity if known. You may write to the Privacy Officer, Idealx Platform Pty Ltd, Suite 109, Level 1, 40 Burgundy Street, Heidelberg VIC 3084, Australia. Requests will be routed to the responsible Idealx entity.

2 Information and collection #

We collect information needed for the services you apply for or use: identity and contact details, date of birth, residential and tax residence, entity and trustee details, beneficial owners and authorised persons, identity documents and verification results, bank and wallet details, account activity, investment instructions, financial information relevant to the service or required checks, communications, complaints and consent records. Security and service logs may include device, browser, network address, access events and transaction records. We collect only information reasonably necessary for the relevant purpose or otherwise lawfully required.

We usually collect it from you. We may also receive it from your authorised firm, entity representatives, verification providers, banks, payment and execution providers, custodians, fund issuers, lawful public registers and other sources where permitted. An authorised firm must have a lawful basis to supply information. We may need to contact you or seek further evidence if supplied information is incomplete or inconsistent.

Where practicable and lawful, you may make a general enquiry anonymously or using a pseudonym. Identification is normally necessary to open or operate an account and meet legal requirements. If you do not supply required information, we may be unable to supply the relevant service or may need to restrict it. We explain specific consequences where appropriate.

We request sensitive information only where reasonably necessary and with consent where required, or where another legal basis applies. Do not upload unnecessary health, biometric or other sensitive material into ordinary messages. If biometric verification is offered, its separate collection notice and applicable consent precede collection. This policy alone is not consent to biometric processing.

3 Purposes #

Information is used to assess applications and eligibility; establish and operate accounts; execute authorised transactions; administer fees and client mandates; communicate service information; provide support; investigate complaints and errors; maintain security and prevent fraud; conduct required due diligence, screening and reporting; keep records; and establish, exercise or defend legal rights. Applicable Australian obligations may include AML/CTF, corporations, tax, sanctions and privacy laws. The relevant collection notice identifies any particular legally required collection where applicable.

We may improve service reliability and usability using appropriately controlled operational information. Any use for a materially different purpose must have its own lawful basis and notice or consent where required. We do not obtain unrestricted permission to use information merely because it is entered into Idealx.

4 Disclosures #

We disclose information as reasonably necessary for these purposes to the responsible Idealx service entity; authorised firms within your mandate; identity, screening, hosting, security and communications providers; banks and payment processors; brokers, exchanges and custodians; relevant fund issuers and registries; professional advisers and auditors; and regulators, courts or authorities where required or lawfully permitted. A provider receives only information appropriate to its role. A referral does not grant the referrer unrestricted access to your accounts.

For Zai-supported payment services, Zai Australia Pty Ltd receives information under the Payment Provider Notice and its applicable privacy policy. Where a transaction requires disclosure to a foreign recipient or your chosen fund or adviser, the service and transaction notices identify the relevant arrangements.

5 Overseas handling #

Some providers may store, process or access information outside Australia. For the current Zai arrangement, its published platform privacy disclosure identifies the United States, United Kingdom, New Zealand, Philippines and Singapore among possible locations. Zai’s applicable policy and the service-specific notice explain that provider’s handling. This is not a representation that every Idealx service uses each country.

For other enabled services, the Overseas Handling Register supplied with this policy identifies the actual provider functions and likely countries, to the extent practicable, before relevant information is collected. The register forms part of this policy. A new overseas arrangement requires assessment and updated notices where required. We take reasonable steps required by Australian privacy law in relation to overseas disclosures; acceptance of this policy does not waive those protections.

Ownership of platform intellectual property by TMA LLC-FZ in the UAE does not itself authorise access to customer information. Any actual UAE access or other group sharing must have a necessary purpose, lawful basis, appropriate controls and inclusion in the applicable notice and register.

6 AI assistants #

Atlas AI, Agent X, AtlasX and successor interfaces process the messages, documents and account information needed for the requested supported task. Access remains subject to your permissions and the relevant service. We may use multiple model, hosting and technical providers. The AI service notice and Overseas Handling Register identify the applicable processing arrangements and retention settings before use.

You should not supply irrelevant third-party personal information, secrets or unnecessary sensitive material. We do not authorise your confidential financial information or identifiable conversations for unrelated general-purpose model training merely through account acceptance. Such use needs a separately assessed lawful basis and any necessary notice and consent. We apply access restrictions, appropriate provider settings and record controls; no promise of perfect model accuracy or absolute security is made.

Transaction confirmation and legal consent remain separate from chat processing. AI-generated identity or authority assumptions are not treated as verified evidence. Material decisions remain subject to the review and confirmation requirements in the Service Schedules.

7 Security and retention #

We take reasonable steps to protect information from misuse, interference, loss and unauthorised access, modification or disclosure, including appropriate access controls and security procedures. No internet service is risk-free. Tell us promptly of suspected account compromise; never send passwords or authentication codes to support.

We retain records for the periods required by applicable laws, payment schemes, actual service needs and the establishment or defence of legal claims. Different records may have different retention periods. When no longer needed for a permitted purpose and not required to be retained, we take reasonable steps to destroy or de-identify them. Account closure does not require destruction of records we must lawfully keep. We assess and notify eligible data breaches as required by law.

8 Marketing and website technologies #

Optional promotional communications are separate from essential account, security and legal notices. You may opt out of marketing through the message controls or support@idealx.com. We will give effect to that request as required and will not make optional marketing consent a condition of ordinary account access.

The website technology notice identifies cookies, analytics or similar technologies actually deployed, their purposes and available controls. Essential security and session functions are distinguished from optional analytics or advertising. This policy does not activate an undisclosed tracking technology or grant consent where specific permission is required.

9 Access correction and complaints #

You may request access to or correction of personal information through our contact details. We will verify identity proportionately, respond within a reasonable period and provide access or correction where required. If access or correction is refused, we will explain the permitted reason and complaint route where required. Any permitted access charge will be explained beforehand; no fee applies simply to making a request. We may need to retain an accurate historic transaction record alongside a correction.

We aim to acknowledge privacy complaints promptly and respond within 30 days. If unresolved, you may contact the Office of the Australian Information Commissioner through oaic.gov.au or 1300 363 992. Other applicable external complaint avenues are described in the Complaints Policy. We will cooperate with the relevant process; a complaint is not a waiver of other rights.

10 Updates #

We may update this policy to reflect actual service or legal changes. We publish the current version and provide notice or obtain consent where required. A policy update does not retrospectively authorise an unrelated use, remove a statutory right or change a contractual fee or asset mandate.

Collection notice at registration #

The Idealx entities identified for your selected services collect the identity, contact, entity, authority and account information requested to assess and operate your account, prevent fraud and meet applicable verification and recordkeeping obligations. We may verify information with authorised firms, verification providers and relevant financial institutions and disclose it to the service providers identified in your service record, or to authorities where required. Without required information, the service may not be available. The Privacy Policy and supplied Overseas Handling Register explain overseas processing, access, correction and complaints. Optional marketing and any sensitive-information permissions are requested separately.

Collection notice for Console firms #

Provide personal information only where you have authority or another lawful basis. Idealx and the identified service providers use supplied client and personnel information for the requested onboarding, account, verification and administration functions. Supplying it does not grant a trading mandate or automatically activate statutory KYC reliance. Tell affected people about the applicable Idealx collection notice and preserve any required consent. The Privacy Policy explains access, correction, overseas handling and complaints.

Collection notice for AI use #

Your message, attachments and relevant authorised account context will be processed to answer or prepare your requested action using the AI providers and locations identified in the AI service notice. Do not submit unnecessary sensitive information. Review outputs and confirm consequential actions; a conversation alone does not create an unspecified authority. Account acceptance is not permission for unrelated model training. The Privacy Policy explains records, access and complaints.