1. Who we are
Southledger is operated by [Southledger Pty Ltd] ([ABN 00 000 000 000]), an Australian digital asset exchange registered with AUSTRAC as a virtual asset service provider (VASP). In this policy, “Southledger”, “we”, “us” and “our” refer to that company. This policy explains what personal information we collect when you use our website, apps and exchange services, why we collect it, and what choices you have.
2. What we collect
Information you give us
- Your name, email address, phone number and password (stored only as a salted hash)
- Identity details we need for verification: date of birth, residential address, government ID and a selfie or liveness check
- Source-of-funds information where the law requires it
- Bank account and payment details you add to fund or withdraw
- Messages you send to our support team
Information created when you use Southledger
- Orders, trades, deposits, withdrawals and the wallet addresses involved
- Device and browser details, IP address and approximate location
- Log-in history, security events and how you use our features
- Cookie and similar technology data (see our Cookie Policy)
We never collect your 12-word recovery phrase. It is generated on your device when you sign up and is never sent to or stored on our servers.
3. Why we use it
- To open and run your account and carry out your instructions
- To verify your identity and meet our obligations under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth)
- To detect, investigate and prevent fraud, scams and unauthorised access
- To keep our platform secure and working well, and to improve it
- To contact you about your account, security alerts and changes to our terms
- To send product news, but only if you opt in (you can opt out at any time)
4. How we protect it
We use layered technical and organisational controls, including:
- Encryption of personal data in transit (TLS 1.2+) and at rest (AES-256)
- Recovery phrases created and checked only on your device, never on our servers
- Strict, role-based access with multi-factor authentication for staff
- Continuous monitoring and automated detection of unusual activity
- Regular security testing by independent specialists
No system is completely secure. If a data breach is likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme.
5. Who we share it with
We do not sell your personal information. We share it only where needed:
- Identity verification, payment, banking, cloud hosting and customer-support providers who act on our instructions and must protect your data
- AUSTRAC, law enforcement, courts and other regulators where the law requires or authorises it
- Professional advisers such as auditors and lawyers
- A buyer or successor if our business is sold or restructured
- Anyone else you ask us to share it with
6. Overseas disclosure
Some of our service providers store or process data outside Australia, including in [list countries, e.g. Singapore, the United States and the European Union]. Before we send information overseas we take reasonable steps to make sure the recipient handles it in line with the Australian Privacy Principles.
7. How long we keep it
We keep personal information only for as long as we need it. Under the AML/CTF Act we must keep identity and transaction records for at least 7 years after our relationship with you ends. After that, we securely delete or de-identify the information.
8. Your rights and choices
- Access: ask for a copy of the personal information we hold about you
- Correction: ask us to fix information that is wrong, out of date or incomplete
- Marketing: unsubscribe at any time using the link in our emails or in your settings
- Deletion: ask us to close your account and delete data we are not legally required to keep
We will respond within 30 days. We may need to verify your identity first.
9. Complaints
If you have a privacy concern, contact our Privacy Officer at privacy@southledger.com. We aim to resolve complaints within 30 days. If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.
10. Changes to this policy
We may update this policy from time to time. We will post the new version here, change the date at the top, and tell you directly about significant changes.
11. Contact us
Privacy Officer, [Southledger Pty Ltd]
[Street address], [Suburb] [STATE] [Postcode], Australia
Email: privacy@southledger.com