Privacy Collection Notice for Identity Verification

Background

This Privacy Collection Notice explains how Stakeshop Pty Ltd (ACN 610 105 505) and its related entities (together, ‘Stake’, ‘we’ or ‘us’) will collect, use, disclose and store your personal information to verify your identity, as required by the Privacy Act 1988 (Cth) and Identity Verification Services Act 2023 (Cth) in Australia and Privacy Act 2020 in New Zealand (as applicable).

By clicking ‘continue’ on the identity verification request, you consent to Stake and the third parties listed in this Collection Notice collecting and processing your personal information in accordance with this Privacy Collection Notice.

How and why we collect your personal information

We are required by the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) to verify your identity before we can provide you with Stake’s services.

We and our third party service providers, Sumsub and Onfido, will collect and process your personal information, including biometric information, when you use Sumsub’s or Onfido’s identity and liveness verification service via Stake’s app or website.

The types of personal information that we, Onfido and Sumsub will collect and process includes facial image data, biometric data, geolocation data, identity document data, technical data and general personal information (for example your full name, gender, date of birth, nationality and citizenship). This is not an exhaustive list of personal information that may be collected.

We use other third party services, including the Attorney-General’s Department’s Document Verification Service (‘DVS’), Equifax, Experian, Onfido and SuperChoice to verify your identity via FrankieOne. We collect your personal information via Stake’s app or website. The information you provide is sent by Stake to these third party services. In the case of the DVS, your information is matched against official records held by the government agency responsible for issuing the relevant identity document. The DVS will provide whether the information provided matches official records. In the case of Equifax, your personal information may be collected, accessed and used by Equifax as your agent to access third party datasets and used in relation to their IDMatrix service.

The purpose of the collection

Your personal information is collected for the following purposes:

to remotely verify your identity, including by confirming the liveness of your face and to confirm that a given identity document presented by you is legitimately owned by you,

to comply with applicable anti-money laundering and countering terrorism financing laws,
for internal risk management, and
to comply with Stake’s customer due diligence procedures in accordance with the laws governing the intended business relationship with you.

The third parties referred to in this Notice will collect and process your personal information for compatible purposes. For further information, please see the following:

Sumsub will collect your personal information for compatible purposes. Please see their Privacy Notice here for further information https://sumsub.com/privacy-notice-service/
Onfido Privacy Notice: https://www.entrust.com/sites/default/files/documentation/licensingandagreements/product-privacy-notice-identity-verification-services.pdf

Attorney-General’s Department Privacy Statement: https://www.idmatch.gov.au/resources/privacy-statement-identity-verification-services

Disclosing your personal information

Your personal information may be disclosed to Sumsub’s associated entities in order for them to achieve the purposes of processing as set out in this Notice and their Privacy Notices.

Stake may also disclose your personal information to its related entities, applicable regulators and government authorities, law enforcement and its applicable third party service providers in order to achieve the purposes of processing as set out in this Notice. Other intermediary service providers involved, including outsourced providers that connect us to the DVS, may receive your personal information.

Sumsub operates in the United Kingdom, Europe, the United States, the United Arab Emirates and Singapore. Onfido operates in the United Kingdom, Europe, North America, India and Singapore. A number of Stake’s key third party suppliers have operations outside of Australia. As a result, your personal information will be disclosed to overseas recipients.

The DVS does not retain any personal information and the Attorney-General’s Department cannot view or edit any of the personal information transmitted through the DVS Hub. The Attorney-General’s Department engages a third-party provider as a managed service provider for the DVS, who is required to adhere to the APP requirements and security standards to ensure the use and disclosure of personal information is limited to explicitly defined purposes including for the purposes of the contract with the department and to comply with any request under 95C of the Privacy Act 1988 (Cth). The Attorney-General’s Department is authorised to operate the DVS Hub for the purpose of verifying individual’s identities under the IVS Act.

The Attorney-General’s Department’s verification assistance service

There may be circumstances in which we will require assistance to verify your identity. If we request assistance from the Attorney-General’s Department to verify your identity through the DVS, the Attorney-General’s Department will collect your personal information for the purposes of verifying your identity document(s) through the DVS.

The Attorney-General’s Department may also disclose your personal information to the relevant document issuer to assist them with verifying your identity documents. This collection is authorised under APP 5.2(c) and section 27 of the IVS Act which permits the collection of your personal information from someone other than yourself when it is authorised under an Australian law.

The Attorney-General’s Department will handle your personal information in accordance with their obligations under the Privacy Act.

Where the identity document(s) you require to be verified include information regarding other individuals (such as a Medicare card covering multiple individuals), it will be assumed that you have advised those individuals and obtained their consent to the disclosure. This information will only be used for the purposes of verifying your identity document(s) through the DVS. Any personal information of other individuals will otherwise be managed in the same way as your personal information.

There may be overseas disclosure of your personal information to recipients located in New Zealand where New Zealand government agencies or private organisations request for verification assistance of your identity document(s).

If you don’t provide your personal information to the Attorney-General’s Department, the Department will be unable to verify your identity document(s).

What happens if we don’t collect your personal information?

Without the personal information set out in this Notice, Stake may not be able to satisfactorily verify your identity and accordingly it may not be able to process your request, or your request may be significantly delayed.

Further information

Our Privacy Policy contains additional information about how we handle your personal information, how you can access your personal information and how you can seek correction of such information. It also explains how to complain about a breach of privacy laws and how Stake will deal with such a complaint.

Our Privacy Policy can be found here:

for individuals in Australia: https://hellostake.com/au/legal/privacy-policy,
for individuals in New Zealand: https://hellostake.com/nz/legal/privacy-policy.

For further information please contact us at support@hellostake.com.