1- Overview of Policy
Ceylon Exchange Pty Ltd (trading as Ceylon Exchange and referred to in this document as ‘Ceylon Exchange’, ‘we’, ‘us’ or ‘our’) understands the importance of protecting your privacy and personal information.
We are committed to protecting and maintaining the privacy of individuals dealing with us in an open, transparent and secure manner in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles (“APPs”), the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) (“AML/CTF Laws”), and other applicable laws and regulations..
This privacy policy describes how we collect, hold, use, disclose and protect your personal information when you use our products, services, website, social media channels, or otherwise interact with us.
This Privacy Policy also explains how we use identity verification systems, including the Australian Government’s Document Verification Service (“DVS”), to verify your identity and comply with our legal obligations.
This Privacy Policy applies to:
- Ceylon Exchange;
- our website located at www.ceylonexchange.com.au;
- our mobile and digital platforms, including daily rate alerts and newsletters;
- our social media pages; and
- all related customer service and transaction channels.
By using any of our services in person or through our website or any other channels you acknowledge that you have read, understand and agree to be bound by the privacy notice. It is important to us that you are confident and aware of our approach to handling personal information.
2- Information We Collect
Personal information refers to any information that could be used to identify an individual or relates to the identity of an individual. We may collect and process the following data:
- Personal details such as data which may identify you or the beneficiary of your transaction with us such as name, residential address and /or business address, e-mail address, telephone number, and date of birth, gender, citizenship, occupation, and identity verification information such as copies of your government-issued identification or other authentic information
- For non-individual clients, we may collect information about the entity, its corporate records and personal information about the Beneficial Owners of the business & any person who is authorized to act on behalf of the entity.
- Financial details such as your or your beneficiaries bank details in order to execute the transaction instructions
- To comply with AML/CTF Laws, fraud prevention obligations, sanctions screening requirements, and identity verification obligations, we may collect and verify information contained in identity documents and other government-related identifiers.
This may include:
- passport details;
- driver licence details;
- Medicare details;
- visa or immigration status information;
- national identity card details;
- copies or images of identity documents;
- biometric comparisons where permitted by law;
- information required to verify the authenticity of identity documents; and
- information obtained through electronic identity verification systems.
- Technical information, including the host from which you access the Internet, your IP address or device advertising ID, and network information, the date and time you access our websites and the address of the site from which you linked to our website when you visit us. We collect personal information on your online activities as described in the section titled “Cookies & Tracking”
- We will not collect, use or disclose sensitive information about you unless it is necessary to provide you with a product or service and we have your consent or, unless we are legally required to collect, use or disclose such information. Sensitive information includes, but is not limited to, any information about a person’s religious beliefs or affiliations, sexual preferences or practices, racial or ethnic origin, political opinion, criminal record or health information. We will always strive to explain the purpose for collecting sensitive information.
To conduct a money transfer, or use other payment services, you must provide certain information to execute the transfer and to enable us to comply with our legal obligations associated with transferring money. Failure to provide some of your personal information may affect our ability to provide our services to you. This may include information about the form of identification used to send or receive a transaction (where required by law) including the identification or a copy of the identification document, transaction activity, bank account and payment information.
3- How We Collect Personal Information
Ceylon Exchange collects your personal information in several ways:
- When you complete an application form to register for our services and /or setting up an account with us.
- While providing customer support or consultation, including using email, telephone, live chat or postal mail.
- Through automated means such as communications protocols, e-mail communications and cookies or similar internet mechanisms.
- Through your use of social media or other public data sources
- Through your interest in Ceylon Exchange advertisements placed on third party sites.
- Through authorised identity verification providers, including Gateway Service Providers, government record holders and electronic verification systems such as the Australian Government’s Document Verification Service (DVS), where permitted by law and with your consent where required.
- For corporate clients, we may collect personal information about the beneficial owners from any person that has represented to us that they have authority to act on behalf of the entity and provide that information.
In addition to the personal information we collect from you, we may also collect your personal information from the person to whom you send and/or receive money.
4- How we use your Information
We use personal information in several ways, including
- To complete your transaction, administration of your account, to contact you, to resolve any problem that may arise in effecting the transaction
- To verify your identity, authenticate your account, and confirm the validity of identity documents using electronic verification systems including the Document Verification Service (DVS).
- To notify you about changes or developments relating to our service which you used or have requested.
- To perform analytics on understanding our customers, improving their experience.
- To comply with our legal and regulatory obligations, including obligations under AML/CTF Laws, sanctions laws, fraud prevention laws, and identity verification requirements.
- To prevent, detect and investigate fraud, identity theft, scams, money laundering, terrorism financing, cybercrime, or other unlawful activity.
- To conduct risk assessments, transaction monitoring, compliance reviews, and internal investigations.
- To maintain audit logs, compliance records, and system monitoring associated with identity verification activities.
- To contact you with marketing communications in relation to the products and services of Ceylon Exchange
- For quality control and staff training
We may use your personal information for any additional purposes related to the purposes listed above. However, we will not use your personal information other than for purpose you would reasonably expect or authorized by you or as required by law.
5- Sharing of Information
For the purposes listed in this statement, Ceylon Exchange may disclose or share relevant information with the flowing third parties if you ask us to, it is required to provide our service to you or we are obliged by law to do so.
- Our agents and other affiliates who facilitate the money transfer transaction or specific service you have requested. Payments processors, banking partners and data processors contracted to support processing your transactions.
- Contractors or service providers such as webhosting and IT infrastructure and administration service, for the purpose of providing our service to you.
- Customer services, based on your consent where applicable, including marketing, advertising and customer satisfaction and market research on our behalf.
- Identity verification providers, Gateway Service Providers, fraud prevention agencies, government agencies, official record holders, and other organisations engaged to verify your identity, authenticate identity documents, conduct sanctions screening, or manage risks relating to fraud, cyber security, identity theft, or AML/CTF compliance.
- Third parties that you have authorized to access your account and/or your account information in order to perform services for you, such as account information service providers and payment initiation service providers.
- Government authorities, regulatory and financial authorities, credit reporting agencies, law enforcement bodies, courts, governments, or government agencies for the purpose of complying with compliance and legal obligations or to assert or defend the rights and interests of Ceylon Exchange or that of others, enforcing our customer agreement or other applicable agreement or policies.
We may disclose your personal information to AUSTRAC (Australian Transaction Reports and Analysis Centre), a Court or Tribunal in response to a request or in response to a subpoena or to the Australian Taxation Office upon request.
Where permitted by law, we may disclose identity information and government-related identifiers to authorised identity verification providers, including for checks through the Australian Government’s Document Verification Service (DVS).
If Ceylon Exchange becomes involved in a merger, acquisition or any form of sale of some or all its assets, we may disclose personal information to third parties in connection with the evaluation of the transaction. The surviving company may have access to personal information which would continue to be subject to this privacy statement.
Ceylon Exchange will not sell, rent, or lease your personal information to third parties. Importantly.Use of your personal information for any other purpose, such as marketing purposes, will always be made in compliance with the applicable law regarding customer consent.
6- Cross-Border Data transfers
We may disclose, transfer, store or process personal information outside Australia where:
- our service providers, cloud hosting providers, identity verification providers, payment processors, compliance providers, or technology partners operate internationally; or
- international transfers are necessary to provide our services or comply with legal obligations.
Some overseas recipients may be located in countries that do not provide the same level of data protection as Australian privacy laws.
Where reasonable and practicable, we take steps to ensure overseas recipients handle personal information in a manner consistent with the Australian Privacy Principles, including through contractual safeguards, security requirements, and compliance obligations.
7- How Long Is Your Personal Information Retained?
We retain personal information only for as long as reasonably necessary for:
- providing our services;
- complying with legal and regulatory obligations;
- fraud prevention and dispute resolution purposes;
- audit and compliance requirements; and
- legitimate business purposes.
In accordance with AML/CTF Laws and AUSTRAC requirements, we may retain certain customer identification records, transaction records, verification records and compliance records for a minimum period of seven (7) years or longer where required or permitted by law.
Identity verification logs, audit records and compliance monitoring records relating to DVS checks may also be retained for regulatory, audit, fraud prevention and security purposes.
When personal information is no longer required, we take reasonable steps to securely destroy or de-identify it.
8- Data Security
We take reasonable measures designed to maintain the security of your personal data against loss, misuse or unauthorized access, modification or disclosure.
We store personal information as a combination of computer storage, paper-based files and other records. We have deployed industry-standard practices and security measures to safeguard and secure the personal information we collect. Ceylon Exchange may store personal information on databases in Australia and other parts of the world for back-up and business operation after satisfying such places have implemented industry standards of security.
All our employees who have access to, or are associated with, the processing of personal data are contractually obliged to abide by the privacy policies we have established and maintain the confidentiality
Our service providers are aware of the need to comply with privacy principles and the agreements we have entered into with them covers this aspect.
We maintain security controls designed to protect personal information and identity verification information from misuse, interference, loss, unauthorised access, modification or disclosure.
These controls may include:
- access controls and user authentication;
- encryption and secure transmission methods;
- system monitoring and audit logging;
- staff training and confidentiality obligations;
- cyber security monitoring;
- restricted access to identity verification systems; and
- periodic compliance reviews and security assessments.
Access to identity verification systems, including DVS-related systems, is restricted to authorised personnel, and use of these systems may be monitored and logged for security, fraud prevention, compliance and audit purposes.
Although our information security standards conform to applicable industry standards, we cannot guarantee the absolute security of personal data as no security system is perfect and impenetrable.
Please be aware that transmission of information over the internet or other media is not 100% secure and we encourage you to safeguard your account information and login credentials, use passwords that are sufficiently complex and not to share them with others. If we receive instructions using your login information, we will consider you have authorized instructions. You agree to notify us immediately of any unauthorized use of your account or you have reason to believe that your interaction with us is no longer secure.
9- Electronic Identity Verification and Document Verification Service (DVS)
To comply with legal obligations and protect against fraud and identity crime, Ceylon Exchange may use electronic identity verification systems including the Australian Government’s Document Verification Service (“DVS”).
The DVS is a secure electronic system that allows authorised organisations to verify whether information on identity documents matches records held by the relevant government issuing authority.
The DVS does not generally provide us with copies of government records. Instead, it provides a response indicating whether the information provided matches official records.
We may use the DVS or similar systems to verify:
- passports;
- driver licences;
- Medicare cards;
- visas and immigration documents; and
- other government-issued identity documents.
We will only conduct electronic identity verification where:
- required or authorised by law;
- reasonably necessary to verify identity;
- reasonably necessary to comply with AML/CTF obligations and fraud prevention requirements; or
- you have provided your consent.
Where required, we will obtain your express consent before conducting DVS checks.
You may choose not to provide consent or identification information; however, this may prevent us from providing some or all of our services.
10- Marketing
From time to time we may also use your personal information to provide you with current information about our products and new offerings that may be of interest and benefit to you. We may contact you via phone, email, or mail about our new or existing products, services, promotions or for customer survey purposes.
If you do not wish to receive marketing information, you may at any time decline to receive such information by contacting our offices by telephoning (02) 9749 7775 or e-mailing us. We will not charge you for giving effect to your request and will take all reasonable steps to meet your request at the earliest possible opportunity.
Please note that if you opt-out of receiving marketing-related communications from us, we may still send you important service, administrative or transaction-related communications.
You should note that we are opposed to third-party spam mail activities and do not participate in such mailings, nor do we release or authorise the use of customer personal data to third parties for such purposes.
11- Cookies & Tracking
Cookies are text files containing information, which your computer or mobile device downloads when you visit a website so that upon re-visiting those websites, the web server does not have to repeatedly request the same information.
We use cookies and similar tracking technologies to recognize you and to customize your online experience and other purposes such as to provide enhanced functionality, to ensure security and privacy when you use our websites, store login details for our secure sites, to collect information about how you use our website.
Some of the cookies are operationally required to provide our service or certain features of our service. These cookies allow you to access secure areas of our websites perform core tasks and take advantage of certain key functions of our service.
Cookies or similar technologies may be used by us or our third-party service providers to deliver relevant ads to you and track ad campaign performance and effectiveness. We may partner with third party providers such as Google Analytics to analyze our website usage performance and Google AdWords and other advertising networks for targeted advertising. Any information collected through this process does not enable us or the third-party provider to access personally identifiable information about you.
Information collected through cookies and tracking technologies may also be used for fraud detection, cyber security, authentication and account protection purposes.
12- Social Media Features
Our website may include social media features, such as a Messenger or WhatsApp chat bubble or other interactive mini programs. These features may collect your IP address, which page you are visiting on our website, and may set a cookie to enable smooth functioning of the feature in future. Social media features and widgets are either hosted by a third party or hosted directly on our website. Your interactions with these features are governed by the privacy statement of the company providing it.
13- Third Party websites and services
Ceylon Exchange website or online channels may contain links to other websites whose operators may or may not adhere to a Privacy Statement. Ceylon Exchange is not responsible for the content of privacy policies of these websites. Users are encouraged to review the privacy statement of these other websites before providing them with personal information.
14- Information from Children
Ceylon Exchange does not direct our services at children under the age of 18. We do not knowingly collect or maintain information from our website or other channels from persons under the age of 18.
15- Access to Information
You may request access to personal information that we hold about you or request correction to existing personal information. We will provide ways to give you reasonable access to your information in our database to review, update, or modify as required. To protect your privacy and security, we will also take reasonable steps to verify your identity before granting you access or enabling you to make corrections and in some circumstances, we may charge an administrative fee which will be advised in advance.
There may be situations where we are not required to provide you with access to your personal information. An example of such a situation would be information relating to an existing or anticipated legal proceeding with you, or if your request is vexatious. If we deny you access to any of your personal information that we hold, we will provide an explanation for such refusal.
Requests relating to identity verification records may be subject to legal, regulatory, fraud prevention, security, or AML/CTF restrictions.
16- Maintenance of Information
We are committed to ensuring that the information we obtain and use about you is accurate for its intended purpose. We ask you to regularly review and advise us of changes to your personal information so we could update our records promptly. Accurate information about you enables us to provide you with the best possible service.
17- Updates to this policy
Ceylon Exchange reserves the right to modify this Privacy Statement. Updated privacy policies will be posted on this website when amendments occur. We encourage you to review the Privacy Statement periodically to obtain the most current statement.
For more information or if you have questions
If you have further questions or complaints regarding our privacy policy or about how we handle your personal information, you may contact us directly at:
Ceylon Exchange
1/1 Station Road
Auburn NSW 2144
Australia
Phone: (02) 9749 7775
E-mail: info@ceylonexchange.com.au
Last updated – 24 July 2026