ONNI PRIVACY POLICY

This Privacy Policy describes Our policies and procedures on the collection, use and disclosure of Your information when You use the Service and tells You about Your privacy rights and how the law protects You.

We use Your Personal Data to provide, maintain, improve and protect the Service. By using the Service, You agree to the collection and use of information in accordance with this Privacy Policy.

This Privacy Policy has been updated to align with:

• The Privacy Act 1988 (Cth)
• The Australian Privacy Principles (APPs)
• Applicable AML/CTF obligations
• Digital payments and wallet functionality requirements
• Future international expansion considerations

Interpretation and Definitions

Interpretation

The words of which the initial letter is capitalised have meanings defined under the following conditions. The following definitions shall have the same meaning regardless of whether they appear in singular or in plural.

Definitions

For the purposes of this Privacy Policy:

Account

Means a unique account created for You to access our Service or parts of our Service.

Affiliate

Means an entity that controls, is controlled by or is under common control with a party.

Application

Means the software program provided by the Company downloaded by You on any electronic device, named Onni.

Company (referred to as either "the Company", "We", "Us" or "Our" in this Agreement)

Refers to Onni and its related entities, affiliates, authorised representatives, technology partners and service providers.

Cookies

Are small files that are placed on Your computer, mobile device or any other device by a website.

Country

Refers to Australia.

Device

Means any device that can access the Service such as a computer, cellphone, wearable device or digital tablet.

Device Wallet

Means Apple Pay, Google Wallet, Samsung Wallet or other supported digital wallet providers.

KYC Information

Means information collected for Know Your Customer, identity verification, fraud prevention, anti-money laundering or regulatory compliance purposes.

Personal Data

Means any information that relates to an identified or identifiable individual.

Sensitive Information

Includes government identification information, biometric information, verification information and other information classified as sensitive under applicable privacy laws.

Service

Refers to the Application, Website, Onni Gift products, reloadable card functionality, digital gifting services and related services.

Service Provider

Means any natural or legal person who processes data on behalf of the Company.

Usage Data

Refers to data collected automatically through use of the Service.

Website

Refers to Onni, accessible from https://www.onni.io.

You

Means the individual accessing or using the Service.

Collecting and Using Your Personal Data

Types of Data Collected

Personal Data

While using Our Service, We may ask You to provide Us with certain personally identifiable information that can be used to contact or identify You.

Personally identifiable information may include, but is not limited to:

• Email address
• First name and last name
• Phone number
• Residential address
• State, Province, ZIP/Postal code, City
• Date of birth
• Government-issued identification
• Identity verification information
• KYC Information
• Wallet tokenisation information
• Transaction information
• Device information
• Usage Data

Usage Data

Usage Data is collected automatically when using the Service.

Usage Data may include information such as:

• Your Device's Internet Protocol address (IP address)
• Browser type and browser version
• Device identifiers
• Pages visited
• Time and date of visits
• Time spent on pages
• Mobile device information
• Operating system
• Diagnostic data
• Security and fraud monitoring information

When You access the Service through a mobile device, We may collect information automatically, including: mobile device type, mobile operating system, unique mobile device identifiers, mobile browser type, app interaction data, and wallet provisioning information.

Information Collected while Using the Application

While using Our Application, in order to provide features of Our Application, We may collect, with Your prior permission:

• Information regarding Your location
• Information from Your Device's phone book or contacts list
• Pictures and information from Your Device's camera and photo library
• Wallet provisioning and tokenisation information
• Device authentication information

We use this information to:

• Provide and improve the Service
• Support gifting functionality
• Facilitate wallet integrations
• Support fraud prevention
• Support transaction security
• Customise user experience
• Comply with legal obligations

You can enable or disable access to this information at any time through Your Device settings.

AML/CTF and Identity Verification

As a fintech platform operating within the digital payments ecosystem, We and/or Our regulated financial partners may be required to collect and verify identity information in accordance with applicable Anti-Money Laundering and Counter-Terrorism Financing laws.

Accordingly, We may:

• Verify Your identity
• Conduct sanctions screening
• Monitor transactions
• Request additional identification documents
• Conduct fraud assessments
• Retain KYC records for legally required periods

Failure to provide requested information may limit or prevent access to certain Services.

Tracking Technologies and Cookies

We use Cookies and similar tracking technologies to track activity on Our Service and store certain information.

Tracking technologies may include:

• Cookies
• Web beacons
• Tags
• Pixels
• Analytics technologies
• Security monitoring technologies

We use both Session and Persistent Cookies for purposes including:

• Authentication
• Fraud prevention
• User preferences
• Security
• Analytics
• Platform optimisation
• Service functionality

You may refuse Cookies through browser settings, although some parts of the Service may not function properly.

Use of Your Personal Data

The Company may use Personal Data for the following purposes:

• To provide and maintain the Service
• To manage Your Account
• To facilitate digital gifting and stored value functionality
• To enable wallet integrations
• To conduct identity verification and KYC procedures
• To comply with legal and regulatory obligations
• To prevent fraud, financial crime and misuse
• To contact You regarding Service updates and security notices
• To provide customer support
• To improve the Service and user experience
• To conduct analytics and operational reporting
• To monitor platform performance and security
• To manage disputes and complaints
• To conduct business transfers or corporate transactions
• To provide marketing communications where permitted by law

We may also use aggregated, anonymised or de-identified information for product development, analytics, fraud monitoring and future platform innovation.

Sharing of Your Personal Data

We may share Your personal information in the following situations:

With Service Providers

We may share Your personal information with Service Providers to:

• Provide and support the Service
• Conduct identity verification
• Facilitate payments and wallet integrations
• Support cloud hosting infrastructure
• Monitor platform usage
• Assist with fraud prevention
• Conduct analytics
• Provide customer support

With Financial Partners

We may share information with:

• Card issuers
• Payment processors
• Acquirers
• Banking institutions
• Wallet providers
• Regulated financial service providers

For Legal & Regulatory Compliance

We may disclose information:

• To comply with legal obligations
• In response to lawful requests
• For AML/CTF compliance
• For fraud prevention
• For sanctions screening
• To protect the rights, safety or security of users, partners or the platform

For Business Transfers

We may share or transfer Your information in connection with a merger, financing, acquisition or sale of Company assets.

With Your Consent

We may disclose Your personal information for any other purpose with Your consent.

Retention of Your Personal Data

The Company will retain Your Personal Data only for as long as necessary for the purposes set out in this Privacy Policy, including:

• Compliance with legal obligations
• AML/CTF retention requirements
• Dispute resolution
• Fraud prevention
• Enforcement of agreements
• Operational and business purposes

Usage Data is generally retained for shorter periods unless required for security, compliance or legal purposes.

Transfer of Your Personal Data

Your information, including Personal Data, may be processed and stored in jurisdictions outside Australia, including the United States.

Our primary cloud infrastructure may be hosted in North Virginia, United States.

By using the Service and providing information to Us, You consent to the transfer, storage and processing of information outside Your jurisdiction.

We take reasonable steps to ensure that overseas recipients implement appropriate safeguards and protections for personal information.

Security of Your Personal Data

The security of Your Personal Data is important to Us.

We implement commercially reasonable administrative, technical and organisational safeguards designed to protect personal information, including:

• Encryption
• Tokenisation
• Access controls
• Secure cloud infrastructure
• Authentication controls
• Monitoring and logging
• Fraud prevention systems
• Security response procedures

However, no method of transmission over the Internet or electronic storage is completely secure.

Data Analytics & Future Technologies

We may use analytics, automation, machine learning or artificial intelligence technologies in the future to:

• Improve platform functionality
• Enhance security
• Detect fraud
• Personalise user experiences
• Support operational efficiencies

Where legally required, additional disclosures or consents will be provided.

Children's Privacy

Our Service is not intended for individuals under the age required by applicable law without parental or guardian involvement. We do not knowingly collect personal information from children unlawfully.

Links to Other Websites

Our Service may contain links to third-party websites or services. We have no control over and assume no responsibility for the privacy practices or content of third-party websites. We encourage You to review the privacy policies of all third-party websites You visit.

Your Privacy Rights

Subject to applicable law, You may have rights to:

• Access personal information
• Request correction of inaccurate information
• Request deletion of information
• Withdraw consent
• Object to certain processing activities
• Make complaints regarding privacy practices

Requests may require identity verification.

Changes to this Privacy Policy

We may update Our Privacy Policy from time to time.

We will notify users of material changes by:

• Posting the updated Privacy Policy on the Website
• Updating the "Last updated" date
• Providing electronic notice where appropriate

You are encouraged to review this Privacy Policy periodically.

Contact Us

If you have any questions about this Privacy Policy, You can contact us:

Onni Privacy Officer

Email: privacy@onnnigift.com

Website: https://www.onnigift.com