OFX Privacy Policy
Last Update 26 April 2023
Please click here to view the previous version of our Privacy Policy.
1. Overview of Policy
Scope
At OFX, your privacy is important to us, and so is being transparent about our privacy practices.
This Privacy Policy (Policy) applies to individuals and corporate clients that use our products and services and our Online Channels (defined below). This Policy describes the information we collect and how that information is used and shared by us. It also includes details about the choices we offer you in relation to that information. If you are a customer of OFX, this Policy should be read with the customer agreement you enter into with us (Customer Agreement).
OFX acquired Firma Foreign Exchange Corporation (Firma) on 1 May 2022. Firma’s privacy policies will continue to apply to Firma’s Canadian, United Kingdom and New Zealand businesses until those businesses are integrated into the OFX business.
California Notice at Collection: See the Additional Information for California Residents section below for important information about your rights under applicable state privacy laws.
Definitions
OFX, we, us and our refers to the following companies: OzForex Limited, CanadianForex Limited, NZForex Limited, OzForex (HK) Limited, OFX Japan G. K, OFX Payments Ireland Limited, OFX Singapore Pte. Limited, UKForex Limited and USForex Inc.
Personal Information refers to any information or opinion relating to or about an individual or an individual who is reasonably identifiable.
Online Channels means:
- Websites operated by us (Websites);
- Software applications made available by us for use on or through computers and mobile devices (Apps);
- Our social media pages and apps that we control (collectively, our Social Media Pages); and
- HTML-formatted email messages that we send to you that link to this Policy or other communications with you.
- Device notifications and other channels or activities described in this Statement that we use that are not Websites, Apps or Social Media Pages.
2. Information We Collect
Identification Information
We may collect some or all of the following information: your name, date of birth, title, gender, mailing address, phone number, email address, nationality, occupation and social security number or other tax identification number.
To comply with applicable laws and regulations (including anti-money laundering and counter terrorism financing laws (AML/ CTF Laws), we may collect identity verification information such as copies of your government-issued identification (including passport, driver’s license, social security card, government health benefits card or national ID card) or other authentication information, all of which may include photographs of you.
We also may provide you with the option of using identification verification technologies that analyse your facial imagery or other biometric information provided.
Financial Information
In order to comply with AML/ CTF Laws, assess creditworthiness, and process payments and transactions we may collect financial information such as bank account details (account number, routing number), credit or debit card numbers, credit information or reports or tax information, such as withholding allowances and filing status.
Transaction Information
When you book transactions with us, we may collect information about the parties to the transaction, the source of the funds, the reason for the transaction, and the devices and payment methods used to complete transactions. If you choose to pay someone else, we will ask you for the designated recipient’s name, mailing address, email address and bank account information. This is necessary for us to make a payment to them and you confirm that you know they agree or that you are otherwise allowed to give us this information and will inform them of the contents of this Policy.
Business Information
If you are using our services on behalf of a business entity, we may collect information about the business including the organisational structure of the company and individuals involved in the business. We also may collect entity formation documents or other corporate records. OFX is required under AML/ CTF Laws to collect Personal Information of individuals who ultimately own or control corporate clients, directly or indirectly (Beneficial Owners). Such information may include the Beneficial Owner’s name, date of birth, title, gender, mailing address, phone number, email address, nationality, occupation and social security number or other tax identification number. You confirm that you know the Beneficial Owners agree or that you are otherwise allowed to give us this information and will inform the Beneficial Owners of the contents of this Policy.
Background Information
To the extent permitted by applicable law, we may obtain, in the course of providing you with the services you request, background check reports from public records of criminal convictions and arrest records. Some jurisdictions require us to obtain your consent. Where you refuse to provide consent, we may be unable to provide services to you.
Log Data
When you access our Online Channels, we collect server logs, which may include information such as IP address, access times and dates, pages viewed and other system activity, including the third-party site you were using before and after accessing our services.
Device Information
We may obtain information about the devices you use to access our Online Channels including: the device type, operating systems and versions, the device manufacturer and model, preferred languages, unique identifiers (including identifiers used for advertising purposes), and plugins.
Usage and Preference Information
We collect information about how you interact with the Online Channels and how you use our Online Channels, including your user preferences and other settings selected by you. In some cases we do this by using cookies and other tracking technologies. Please see further details in our Cookies & Tracking Notice.
Geolocation Information
When you use certain features of our Online Channels, we may collect information about your approximate location as determined by data such as your IP address.
Aggregated, Anonymised and Deidentified Data
We may also collect or create aggregated, anonymised, or deidentified data about our users. This data is used for industry and market analysis, demographic profiling, marketing and advertising, and other business purposes.
Other Information
We may collect any other Personal Information you may provide to us when you update your account information, respond to surveys, post to community forums, or use any other feature of our Online Channels or services.
3. How We Collect Information
We collect information about you in a variety of different ways, including the following:
Information You Provide
We collect Personal Information and other information from you when you complete an application or form, register for an OFX user account, submit to our verification procedures, apply for additional account features or services, conduct transactions, respond to our emails, messages or surveys, communicate with us including by telephone, email and online, provide feedback, participate in promotions or contests, provide referrals, or upload content. We make and store recordings of our telephone communications with you.
Information from Your Use of services
When you use our services, we collect Personal Information and other information about you and the devices you use to access the Online Channels. If you connect your social media account to your OFX account, you will share certain Personal Information from your social media account with us, for example, your name, email address, photo, list of social media contacts, and any other information that may be or you make accessible to us when you connect your social media account to your OFX account.
Information from Third Parties
We also collect Personal Information about you from third parties and other sources, including government agencies, identity verification and fraud detection service providers and databases, credit bureaus, credit reporting bodies, credit reference agencies, community forums used to post ratings or reviews, social media platforms, advertising, advertising technology and market research companies, contact list, demographic & profile data brokers including companies that publish OFX marketing and advertising materials that you interact with, OFX business partners and associates through which you access our services, or other sources of public records.
For corporate clients, we may collect Personal Information about the Beneficial Owners of the business from any person that has represented to us that they have authority to act on behalf of the business entity and provide that information.
4. How We Use Your Information
We use Personal Information we collect from or about you (including credit information) for several purposes, including:
To provide or improve our services
- To process payments or money transfers.
- To provide customer support.
- To evaluate your application to use our services.
- To develop new products or enhance existing products and services.
- To monitor and analyse trends, usage, preferences and other user activities on our Online Channels to optimise user experience and to enhance the effectiveness of our promotional campaigns.
- For quality control and staff training.
To ensure safety and security
- To verify your identity or authenticate your right to access an account or other information.
- To conduct manual or automated monitoring to protect against fraud, money laundering and other crimes and harmful activities.
To comply with legal obligations
- To comply with laws, regulations, codes of conduct, stock exchange rules, binding determinations or to respond to legal process or government authorities.
- To address disputes or resolve claims related to use of our services.
- To enforce our terms and conditions and collect fees
To communicate with you
- To respond to your inquiries and support requests.
- To send you technical notices, updates, security alerts and other administrative messages.
- To provide information related to your transactions, including confirmations, receipts, and tracking notices.
To market and advertise our services
- To deliver promotional offers, incentives, and targeted or personalised marketing in a variety of ways including via email, SMS, push messages, telephone, social media or online.
- To provide invitations and information about events held by us or our partners.
- To facilitate promotional contests or sweepstakes.
- For analytics and insights with any Personal Information that we collect or obtain about you, including combining your Personal Information with other personal information and data to use in advertising and marketing that may influence your behaviour or decisions or provide insights and measurement to us in relation to any advertising initiatives that we may run.
You can opt-out of receiving marketing at any time through the unsubscribe function available in each marketing communication we send. Alternatively you can update your preferences by logging in to your OFX account on the Website or contact us at customer.service@ofx.com or using the “Contact Us” information below.
Other purposes
Any other purpose disclosed at the time of collection.
5. Information Sharing and Disclosure
We may disclose or otherwise provide anonymised/aggregated, or deidentified data to third parties without restriction. We may also share information about you, including Personal Information, with the following third parties if you ask us to, if we consider it necessary to provide our services to you, if we have a duty to disclose it or an applicable law allows us to do so for legitimate interests or business reasons:
Our Corporate Affiliates
To facilitate or support us in providing our services to you, we may share your Personal Information with other companies in the OFX group.
Our Service Providers
We engage a variety of service providers to enable us to provide our services to you. For example, service providers may be used to support technology or infrastructure, analytics and insights generation, collect debts, determine who we should market and advertise to, distribute marketing materials, conduct market research, perform audits, provide professional advice or other functions.
Payment Processors
To payment processing service providers, intermediary banks and financial institutions to process your transactions.
Credit Reference and Identity Verification Agencies
To credit bureaus, credit reporting bodies, credit reference agencies, identity verification agencies and other companies and organisations (Verification Agencies) to check your details, verify your identity and protect against fraud, money laundering and other crimes and harmful activities.
In some cases Verification Agencies may need to access third party databases (including without limitation databases of government issuers of identification documents). You provide your authority for Verification Agencies to act as your agent in accessing these databases. Verification Agencies may disclose to third parties any information provided to them for identity verification purposes.
Our Partners, Business Associates or Contractors
To any of our partners, business associates, or contractors or your agents that you have authorised to have access to your OFX account or your Personal Information in connection with the provision of our services. A partner’s, business associate’s or contractor’s access to and use of any transactional data provided by OFX will be treated in accordance with that third party’s terms of use. Xero’s access to and use of any transactional data provided to Xero by OFX will be treated in accordance with Xero’s Terms of Use.
If you are an online seller receiving funds from a marketplace, we may be required to share your Personal Information and OFX account information with the marketplace to assist with minimising fraudulent and illegal activity or as required by applicable laws.
Other Authorised Third Parties
If you provide your consent, we may share your information including your Personal Information with other authorised third parties. Such disclosure will only be carried out in the manner described to you at the time you agreed to the sharing. Authorising a third-party application or website to access your OFX account or participating in certain promotional activities constitutes such consent to share your information.
Government Authorities
If we believe it is necessary or appropriate, we may share your Personal Information with law enforcement officials, government authorities, regulatory bodies or other third parties, including for purposes of: (i) enforcing our Customer Agreement or other applicable agreements or policies; (ii) protecting our rights, property, privacy, or security, or that of others; or (iii) complying with applicable law, legal process, or government orders.
Third-Party Acquirers
If we are the subject of or are involved in any corporate merger, acquisition, consolidation, reorganisation, sale, joint venture, assignment, transfer or other disposition of all or any portion of our business or assets (including in connection with bankruptcy or similar proceedings), we may disclose or transfer data, including Personal Information, with third parties in connection with such events.
Professional Advisors
We may share your information with professional advisors, such as lawyers, auditors, bankers and insurers, where necessary in the course of the professional services that they provide to us.
6. International Transfers
We collect information globally and may transfer, process and store your information outside of your country of residence, to wherever we, our third party service providers or any recipients referred to in section 5. Countries to which we are likely to transfer your information are the United States of America, Canada, United Kingdom, countries in the European Economic Area, Australia, New Zealand, Hong Kong and Singapore. Whenever we transfer your information, we take steps to protect it.
7. How long we keep Information
We need to keep your Personal Information so that we can provide our services to you. Under relevant AML/ CTF Laws we need to keep your Personal Information and information about your transactions for up to 7 years from the end of your relationship with us. We also need to keep it for longer for legitimate business purposes (such as transactional information for our accounting purposes) and for other legal and regulatory reasons. Subject to this, we will destroy, erase, or anonymise your Personal Information when it is no longer needed.
8. Choices and Transparency
You have choices regarding how to manage your Personal Information and how we use and disclose your Personal Information.
How Your Information may be Accessed, Updated or Corrected
To ensure the information we hold is accurate, you should tell us as soon as possible if any of the information you have provided us has changed. You may request that we correct or update the Personal Information you provided to us at any time by logging into your OFX account or by contacting us using the “Contact Us” information below. If you want to access a copy of the Personal Information we hold about you, you can contact us at privacy@ofx.com or using the “Contact Us” information below.
We will respond to any such request consistent with applicable law. Prior to changing or correcting your information or providing your information to you, we may be required to verify your identity.
There may be situations where we cannot action your request including where the information may impact the privacy of other individuals, the information is subject to legal privilege, the disclosure could threaten the safety, physical or mental health or life of an individual or OFX is prohibited by applicable law from providing you with access. If this is the case, we will set out in writing to you any reasons for our refusal to provide access to such information.
We will take reasonable steps in the circumstances to ensure that your Personal Information is accurate, complete and up-to-date to minimise the possibility that inappropriate information may be used to make a decision about you. We will not routinely update your Personal Information unless such a process is necessary to fulfil the purposes for which the information was collected.
If you are a California resident, please refer to the “Additional Information for California Residents” section at the end of this Policy for more information about the requests you may make under the California Privacy Rights Act.
If you are resident in the UK or European Union, please refer to the “Additional Information for UK/EU Residents” section at the end of this Policy for more information about the requests you may make under privacy legislation.
Restrict Sharing
If you are resident in the UK or European Union, you may request further limits on our disclosure of certain of your Personal Information where such information is not required for delivery of our services by contacting us at privacy@ofx.com or using the “Contact Us” information below.
If you are a U.S. resident using our Online Channels to conduct transactions for personal, family or other household purposes, you may request further limits on our disclosure of certain of your Personal Information to certain affiliated third parties. Please refer to our Consumer Privacy Notice to learn more about your opt-out rights and how to exercise them.
Device Permissions
Most mobile devices allow you to disable the use of location services, or revoke consent to applications to access your camera and photo library or send you push notifications. Some devices allow you to activate a ‘do not track’ function, reset your device specific advertising identifier. Please refer to your device settings to restrict collection of certain information.
Marketing Opt-Out
You can opt out of receiving our marketing at any time through the unsubscribe function in each marketing communication or by updating your preferences under the “Your Profile” section or “Profile & Settings – Notifications” section when you log into the Website. Please note that if you opt out of marketing-related emails from us, we will continue to send you non-promotional messages that are required to provide our services, such as transactional receipts and messages about your account or our relationship with you.
Testimonials
We display personal testimonials of satisfied customers on our website in addition to other endorsements. With your consent, we may post your testimonial along with your name. If you wish to update or delete your testimonial, you can contact us at privacy@ofx.com or using the “Contact Us” information below.
Declining to Provide Information
We need to collect Personal Information to provide certain services. If you do not provide the information we identify as required or mandatory, we may not be able to provide those services.
9. Security
We employ technical, physical, and organisational measures designed to safeguard your Personal Information against loss, misuse, or unauthorised access.
Unfortunately, the transmission of information over the Internet or the telephone is never 100% secure and no data storage system can be guaranteed safe. We cannot warrant the security of data transmitted to us and any transmission is at your own risk.
We encourage you to understand the integral role you play in keeping your own Personal Information secure and confidential, always keep your log-in details secure. You should also take care not to give any security credentials we provide you or you choose (such as a password) to someone who is not an OFX representative. We will never ask you for your full security credentials. If you are unsure, please end the session. If you suspect any unauthorised use or access to your account or information, please contact us immediately, using the “Contact Us” information below.
10. Cookies and Tracking Technologies
We use cookies and similar tracking technologies to recognise you and to customise your online experience. To learn more about cookies and the other tracking technologies we may utilise, please refer to our Cookies & Tracking Notice, which includes a comprehensive overview of cookies and provides further details about how we use cookies and how to control our use of cookies. We do not currently respond to browser “Do Not Track” signals. To find out more about “Do Not Track,” please visit http://www.allaboutdnt.com.
11. Advertising, Profiling, non-advertising issues and analytics
We may partner with third parties to display and personalise OFX advertisements to you and to track and report on the performance of those advertisements. These third-party partners use cookies and other technologies to gather information about your activities on our Online Channels, as well as information from third parties and your activities on other sites or online services on any of your devices, in order to serve you advertising based upon your online behaviours including browsing history and interests. They also use these technologies, along with information they collect about your online use, to recognise you across the devices you use.
To learn more about behavioural advertising and online tracking, including how to opt out of interest-based online advertising delivered by member companies, please visit Your Online Choices, Network Advertising Initiative and DAA’s WebChoices Tool. You may download the AppChoices app here to opt out in mobile apps. For more information about some of our online advertising supplier privacy policies or the cookies that may be served through use of our Online Channels, please refer to our Cookies & Tracking Notice.
12. Social Media Features
Our Websites may include social media features, such as the Facebook Like button, and widgets, such as the Share This button or interactive mini-programs that run on our Website. These features may collect information about you and your online activities and may set a cookie to enable the feature to function properly. Social media features and widgets are either hosted by a third party or hosted directly on our website. Your interactions with these features are governed by the privacy statement of the company providing it.
13. Third Party websites and services
This Policy does not apply to third party websites, applications, products or services, even if they are linked to our services or Online Channels, and we are not responsible for the privacy, information, or other practices of third parties. The inclusion of a link on the Online Channels does not imply endorsement. You should review the privacy policies of any third party websites you visit.
14. Children
Our services are not intended for or directed at individuals under the age of 18. If you are a parent or guardian of a child from whom you believe we have collected Personal Information in a manner prohibited by law, please contact us using the “Contact Us” information below. If we learn that we have collected Personal Information through the Online Channels from a child without the consent of the child’s parent or guardian as required by law, we will comply with applicable legal requirements to delete the information.
15. Complaints
OFX will investigate all complaints. For more information on how we manage complaints see our Complaints Policy in the Legal section of our Website or contact Customer Service at customer.service@ofx.com.
16. Updates to This Policy
We may change this Policy from time to time. If we make any material changes we will notify you by means of a notice on our Websites. Any changes will become effective on the date specified in the revised Policy posted on our Websites.
17. Contact Us
If you have questions or concerns about this Policy, need it in an alternative format, have a specific request related to your Personal Information or any complaints about our privacy practices, please contact us at privacy@ofx.com or at:
For Australian Residents
OzForex Limited (trading as OFX)
Level 19, 60 Margaret Street,
Sydney NSW 2000 Australia
Attn: Privacy Officer
Tel: +612 8667 8090
For Canadian Residents
CanadianForex Limited trading as OFX
145 King Street, Suite 1002
Toronto, ON M5H 1J8
Attn: Privacy Officer
For EU Residents
OFX Payments Ireland Limited trading as OFX
Fitzwilliam Court, 2 Leeson Close, Dublin 2, D02 YW24, Ireland
Attn: Privacy Officer
For Hong Kong Residents
OzForex (HK) Limited trading as OFX
44th Edinburgh Tower, The Landmark
15 Queen’s Road
Central Hong Kong
Attn: Privacy Officer
For New Zealand Residents
NZForex Limited
C/- Bell Gully, Level 22, Vero Centre
48 Shortland Street
Auckland 1010 New Zealand
Attn: Privacy Officer
For Singapore Residents
OFX Singapore PTE. Limited
OUE Downtown Gallery, 6A Shenton Way, #4-01 to #4-09, Singapore, 068815
Attn: Data Protection Officer
For UK Residents
UKForex Limited (trading as “OFX”)
4th Floor, The White Chapel Building, 10 Whitechapel High Street,
London, E1 8QS
Attn: Privacy Officer
For U.S. Residents
USForex Inc., dba OFX
49 Stevenson St, 13th Floor
San Francisco, CA 94105
Attn: Privacy Officer
Additional Information for Residents of Australia
Office of the Australian Information Commissioner (OAIC)
OAIC is a government agency which oversees the Privacy Act 1988 (Cth) and related legislation, and investigates complaints about handling of Personal Information under the Privacy Act. OAIC will in many cases only investigate once OFX has been given the opportunity to resolve your complaint internally. You may lodge your complaint with OAIC by sending the necessary documents and information to:
Australian Information Commissioner
GPO Box 5218, Sydney NSW 2001
Website: http://www.oaic.gov.au
Telephone: 1300 363 992
Facsimile: (02) 9284 9666
Email: enquiries@oaic.gov.au
Statement of Notifiable Matters – Credit Reporting
Credit reporting bodies are permitted to handle Personal Information relating to credit. Credit reporting bodies may include your Personal Information disclosed by OFX in reports provided to other credit providers to assist them to assess your creditworthiness.
Details on the kinds of credit information OFX collects, uses, holds and the purposes for which OFX discloses credit information is contained within the main body of this Policy and as such, OFX’s credit reporting policy is set out within this Policy.
OFX may collect information about you that it has obtained from businesses that provide information about the credit worthiness of individuals, including consumer credit reports from a credit reporting body. Applicable laws and regulations outline what OFX can do with the information we obtain from a credit reporting body. If you fail to meet your payment obligations in relation to the payment services OFX provides to you, if you commit fraud or try to do so, or if you otherwise commit a serious credit infringement, OFX may disclose your Personal Information to those credit reporting bodies.
You have a right to access the credit related information that OFX holds about you, to correct that credit related information and to make a complaint about OFX’s handling of your credit related information, as set out in section 8 (Choices and Transparency) of this Policy.
The credit reporting bodies that OFX may deal with are:
CreditorWatch – https://creditorwatch.com.au/
illion – https://www.illion.com.au/
Other reporting bodies that OFX’s suppliers may deal with are:
Experian in Germany through Trulioo – Privacy Notice (in German)
Contact details as well as information on how the credit reporting bodies manage credit related Personal Information is available via the above links. You may obtain a copy of the credit reporting bodies’ credit reporting policy by contacting them directly.
You also have a right to request that credit reporting bodies do not use credit related information held by them for the purposes of pre-screening of any direct marketing by credit providers. If you would like to make such a request, please contact the credit reporting bodies directly.
If you believe that you have been a victim of fraud, you have a right to contact the credit reporting bodies and ask them not to use or disclose your credit related information. Please contact the credit reporting bodies directly.
Additional Information for Residents of Canada
If you are not satisfied with the resolution of any complaint you make with us concerning your privacy, you may submit a complaint to the Privacy Commissioner in your province of residence or to the Office of the Privacy Commissioner of Canada at:
Office of the Privacy Commissioner of Canada
30 Victoria Street, 1st Floor
Gatineau, QC K1A 1H3
1-800-282-1376
https://www.priv.gc.ca
Additional Information for EEA and UK Residents
Lawful processing
If you are an individual in the UK or European Economic Area (EEA), we collect and process information about you only where we have legal bases for doing so under the General Data Protection Regulation (GDPR) in the EEA and the Data Protection Act, 2018 in the UK. The legal bases depend on the OFX services you use and how you use them. This means we collect and use your information only where:
- We need it to provide you our services, including to operate our services, provide customer support and personalised features and to protect the safety and security of our services;
- It satisfies a legitimate interest (which is not overridden by your data protection interests), such as to market and promote our services and to protect our legal rights and interests;
- You give us consent to do so for a specific purpose; or
- We need to process your data to comply with a legal obligation.
If you have consented to our use of information about you for a specific purpose, you have the right to change your mind at any time, but this will not affect any processing that has already taken place. Where we are using your information because we or a third party have a legitimate interest to do so, you have the right to object to that use though, in some cases, this may mean no longer using our services.
Your rights
Under data protection law, you have rights including:
Your right of access – You have the right to ask us for copies of your personal information.
Your right to rectification – You have the right to ask us to rectify personal information you think is inaccurate or is incomplete.
Your right to erasure – You have the right to ask us to erase your personal information in certain circumstances.
Your right to restriction of processing – You have the right to ask us to restrict the processing of your personal information in certain circumstances.
Your right to object to processing – You have the right to object to the processing of your personal information in certain circumstances.
Your right to data portability – You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.
Please contact us at privacy@ofx.com if you wish to make a request. If you make a request, we have one month to respond to you.
Transfers to third countries
The Personal Information that we collect from you may be transferred to and stored outside of your country of residence, including outside of the UK (for UK residents) and outside of the EEA (for EEA residents). To facilitate our global operations, we transfer information to and allow access by staff in countries in which OFX owned companies have operations for the provision of our services. Such staff are likely to be involved in, among other things, processing your transaction or payment details and providing support services. We also share information with third parties as described in this Policy. For example, this may involve information being transferred to a banking partner in a country where you have instructed us to send a payment.
Where we share information with an organisation outside of the UK or the EEA, we will take all reasonable steps to ensure that they apply equivalent levels of protection as we are required to provide, including the use of standard contractual data protection clauses which have been approved by the European Commission. If this is not possible, for example, we are required by law to disclose your information, we will make sure that sharing the information is lawful.
Additional Information for Residents of New Zealand
If we transfer your Personal Information outside New Zealand, we will ensure the intended recipient is subject to privacy laws that provide comparable safeguards to the Privacy Act 2020, is covered by a binding scheme or is subject to the privacy laws of a country prescribed by the New Zealand Government or has agreed to adequately protect the information. Alternatively, we will obtain your explicit consent for the transfer.
Additional Information for U.S. Residents
If you are a U.S. resident using our services to conduct transactions for personal, family or other household purposes, please also review our Consumer Privacy Notice, which provides additional information about our privacy practices and a description of your rights as a consumer to control how your Personal Information is handled.
Additional Information for California Residents
This section applies only to California residents. It describes how we collect, use, disclose and share Personal Information of California residents in operating our business, and their rights with respect to that Personal Information. For purposes of this section, “Personal Information” has the meaning given in the California Consumer Privacy Act (as amended by the California Privacy Rights Act (CPRA)) but does not include data exempted from the scope of the CCPA. Personal Information we collect from customers that have or used to have a financial product or service from us to be used primarily for personal, family or household purposes is subject to OFX’s Consumer Privacy Notice. If there is any conflict or inconsistency between this Statement and the Consumer Privacy Notice with respect to information we collect from customers that have or used to have a financial product or service from us to be used primarily for personal, family or household purposes, the Consumer Privacy Notice shall control to the extent of any such conflict or inconsistency with respect to such information.
Your California privacy rights. As a California resident, you have the rights listed below. However, these rights are not absolute, and, in certain cases, we may decline your request as permitted by law.
- Information. You can request information about the categories of Personal Information that we have collected; the categories of sources from which we collected Personal Information; the business or commercial purpose for collecting, sharing and/or selling Personal Information; the categories of any Personal Information that we sold or disclosed for a business purpose; and the categories of any third parties with whom Personal Information was sold, shared or disclosed for a business purpose.
- Access. You can request a copy of the Personal Information that we have collected about you.
- Deletion. You can ask us to delete the Personal Information that we have collected from you.
- Correction. You can ask us to correct inaccurate Personal Information that we have collected about you.
- Opt-out. You can opt-out of the sharing of your Personal Information for cross-contextual behavioral advertising purposes and/or from the sale of your Personal Information for monetary or other valuable consideration.
- Limit processing of Sensitive Personal Information. You can ask us to limit the processing of any Sensitive Personal Information we collect as necessary for our (1) Service delivery and operations, (2) Compliance and protection, (3) research and development, or (4) Service improvement and analytics purposes.
- Non-discrimination. You are entitled to exercise the rights described above free from discrimination. This means that we will not penalise you for exercising your rights by taking actions such as denying you services; increasing the price/rate of services; decreasing service quality; or suggesting that we may penalise you as described above for exercising your rights.
How to Exercise Your Rights
- Right to information, access, correction, and deletion, and limit processing of Sensitive Personal Information. You can request to exercise these rights by emailing us at privacy@ofx.com or 1-888-288-7354.
- Right to opt-out of the “sale” or “sharing” of your Personal Information. You can request to opt-out of the “sharing” of your Personal Information by clicking the Do Not Sell or Share My Personal Information link in the footer of this webpage. Your request to opt-out will apply only to the browser and the device from which you submit the request.
Identity verification. We need to verify your identity to process your requests to exercise your rights to know, access, deletion, and correction, and we reserve the right to confirm your California residency. To verify your identity, we may require you to log into your account if you have one, provide identifiers we can match against information we may have collected from you previously, confirm your request using the email address used to make the request, provide government identification, or provide a declaration under penalty of perjury, where permitted by law.
Authorised agents. Your authorised agent may make a request on your behalf upon our verification of the agent’s identity and our receipt of a copy of a valid power of attorney given to your authorised agent pursuant to applicable state law. If you have not provided your agent with such a power of attorney, we may ask you and/or your agent to take additional steps permitted by law to verify that your request is authorised, such as information required to verify your identity and that you have given the authorised agent permission to submit the request.
Information practices. The following describes our practices currently and during the past 12 months:
- Sale and sharing of Personal Information. Our use of the behavioral advertising services described above may constitute “sharing” of your Personal Information with our advertising partners from which you have the right to opt-out under the CCPA. You can request to opt-out of this “sharing” as detailed above. The categories of Personal Information shared include Identifiers and Internet or Network Information as described in the CCPA. As stated above, we do not otherwise “sell” Personal Information as defined by the CCPA. Although our Online Channels are not intended for children under 16 years of age, we are required to inform you that we do not have actual knowledge that we have sold or shared the Personal Information of children under 16.
- Deidentified data. We do not to attempt to reidentify deidentified information that we derive from Personal Information except that we may do so to test whether our deidentification processes comply with applicable law.
- Retention. We retain your personal information for 7 years from account closure.
- Sources and purposes. We collect all categories of Personal Information from the sources, use them for the business purposes described in the Information We Collect and How We Collect Information sections above, and disclose them for the business purposes described in the How We Use Information section above.
Collection and disclosure. The chart below describes the Personal Information we collect by reference to the categories of personal information specified in the CCPA (Cal. Civ. Code §1798.140), and the categories of third parties to whom we disclose Personal Information for business purposes. The terms in the chart refer to the categories of information and third parties described above in this Statement in more detail. Information you voluntarily provide to us, such as in free-form webforms, may contain other categories of Personal Information not described below. We may also disclose Personal Information to professional advisors, government authorities, and third-party acquirers as described above in the Information Sharing and Disclosure section above.
| Statutory category (Cal. Civ. Code § 1798.140) / Personal Information we collect | Categories of third parties to whom we disclose the Personal Information for a business purpose |
| Identifiers · Identification Information · Financial Information · Transaction Information · Business Information · Background Information · Log data · Device Information · Usage and Preference Information | · Corporate Affiliates · Service Providers · Payment Processors · Credit Reference and Identity Verification Agencies · Partners, Business Associates or Contractors · Other Authorised Third Parties |
| California Customer Records (as defined in California Civil Code §1798.80) · Identification Information · Financial Information · Transaction Information · Business Information · Background Information | · Corporate Affiliates · Service Providers · Payment Processors · Credit Reference and Identity Verification Agencies · Partners, Business Associates or Contractors · Other Authorised Third Parties |
| Commercial Information · Identification Information · Transaction Information · Business Information · Background Information · Log data · Usage and Preference Information | · Corporate Affiliates · Service Providers · Payment Processors · Partners, Business Associates or Contractors · Other Authorised Third Parties |
| Internet or Network Information · Log data · Device Information · Usage and Preference Information | · Corporate Affiliates · Service Providers · Payment Processors · Partners, Business Associates or Contractors · Other Authorised Third Parties |
| Geolocation data · Geolocation Information | · Corporate Affiliates · Service Providers · Partners, Business Associates or Contractors · Other Authorised Third Parties |
| Sensitive personal information · Social Security Number, driver’s license number, government-issued identification information, or passport number · Account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account · Biometric information · Contents of a consumer’s mail, email, and text messages unless the business is the intended recipient of the communication | · Corporate Affiliates · Service Providers · Payment Processors · Credit Reference and Identity Verification Agencies · Partners, Business Associates or Contractors · Other Authorised Third Parties |
| Inferences May be derived from any of the above categories. | · Corporate Affiliates · Service Providers · Payment Processors · Credit Reference and Identity Verification Agencies · Partners, Business Associates or Contractors · Other Authorised Third Parties |
California Shine the Light. Under California’s Shine the Light law, California residents have the right to request the contact information of third parties with whom we have shared certain categories of your Personal Information for those third parties’ direct marketing purposes, as well as the categories of Personal Information shared for such purposes. Please note that these categories of Personal Information do not include the Personal Information covered under our Consumer Privacy Notice. If you are a California resident and would like to request this information, please contact us at privacy@ofx.com.