Privacy Policy

1Our two roles — please read first

Clarity handles personal data in two very different capacities, and your rights depend on which applies:

• As the responsible organisation (controller). For the personal data of our business customers’ staff and account users, website visitors, and prospects, we decide why and how the data is used. This policy governs that data directly.
• As a data intermediary (processor). When a dealer (“Merchant”) uses Clarity to onboard and check its own customers, the Merchant is the organisation responsible for that personal data. We process it only on the Merchant’s behalf and instructions, to provide the service. If you are an end-customer of a dealer, the dealer is your first point of contact for your data; we assist them.

2Personal data we handle

Merchant users & business contacts (we are controller)

• Name, work email, mobile number, role, and the branch/store you belong to
• Account credentials and multi-factor authentication data
• Business-verification (KYB) details you provide at sign-up
• Usage and technical data (log-in events, actions taken, device/browser, IP)

Dealers’ end-customers (we are intermediary, on the Merchant’s behalf)

• Identity data — full name, identity-document type and number (e.g. NRIC, FIN, passport), nationality, date of birth where collected, and verification results (including via Singpass / Myinfo where used)
• Contact and profile data — email, mobile, residential address, occupation
• AML/CTF data — source of funds, purpose of the transaction, politically-exposed-person and third-party declarations, sanctions / watch-list screening results, risk ratings, and case notes
• Transaction data — items, amounts, payment method, and related invoice or report records

3Why we use it, and our legal basis

• To provide the platform — operating your account, onboarding and checks, screening, reporting, and record-keeping (performance of our agreement with the Merchant).
• To meet legal and regulatory obligations — end-customer data is processed so the Merchant can meet its AML/CTF duties under the applicable law; this is a legal requirement, not optional marketing.
• To secure the service — authentication, fraud and abuse prevention, audit trails (our legitimate interests / the Merchant’s).
• To communicate — service messages, including sending a customer their secure check code by email or SMS at the Merchant’s instruction.

We do not use end-customer compliance data for our own marketing, and we do not sell personal data.

4Who we share it with

• The Merchant whose customer the data concerns, and that Merchant’s authorised users.
• Service providers (sub-processors) who help us run the platform — cloud hosting (Netlify), identity verification (e.g. Singpass / Myinfo), sanctions and watch-list data providers, accounting integrations (e.g. Xero, where the Merchant connects it), and email / SMS delivery providers. They act on our or the Merchant’s instructions and under confidentiality and security obligations.
• Regulators and authorities where disclosure is required or permitted by law — for example a filing to STRO (Singapore), AUSTRAC (Australia), or the relevant Hong Kong authority.
• Professional advisers and, in a business transfer, a successor entity, under appropriate safeguards.

5International transfers

Clarity serves dealers in Singapore, Australia, and Hong Kong, and uses service providers that may process data outside your country. Where personal data is transferred across borders, we take steps to ensure it receives a standard of protection comparable to that required by the applicable law (for example PDPA transfer requirements, and Australian APP 8). We are working towards jurisdiction-aligned data residency as the platform matures.

6How long we keep it

We keep personal data only as long as needed for the purposes above and to meet legal retention requirements. AML/CTF law sets minimum retention periods, counted from the transaction or the end of the business relationship:

• Singapore (PSPM Act): 5 years
• Australia (AML/CTF Act): 7 years
• Hong Kong (AMLO Cap. 615): 7 years

We will not delete records in a way that would cause a Merchant to breach these obligations. After the applicable period, data is deleted or anonymised.

7How we protect it

• Authentication at the edge with role-based access control and two-factor authentication
• Encryption in transit; access limited to authorised users and least-privilege roles
• Tenant isolation so each Merchant’s data is separated
• Audit logging of sensitive actions; security headers and request filtering

No system is perfectly secure, but we work to protect personal data against unauthorised access, loss, or misuse, and we maintain processes to respond to incidents — including notifying affected parties and regulators where required (for example under Australia’s Notifiable Data Breaches scheme).

8Your data-subject rights

Your rights depend on where you are and on the role described in section 1. If you are an end-customer of a dealer, please contact that dealer first — they are the organisation responsible for your data, and we will support them in responding. If we are the responsible organisation (for example for a Merchant user), contact our DPO.

9How to exercise your rights & complaints

End-customers: contact the dealer who served you. Merchant users and others whose data we control: contact our DPO at [privacy@ your domain]. We will verify your identity and respond within the time the applicable law requires. We may charge a reasonable fee where the law allows (for example for a Singapore access request). If you are not satisfied with our response, you may complain to your regulator — the PDPC (Singapore), PCPD (Hong Kong), or OAIC (Australia).

10Cookies & analytics

The Clarity website and app use only the storage necessary to run the service — for example to keep you signed in, remember your language or theme, and operate the onboarding flow. We keep this to a minimum and do not use it to track you across other sites for advertising.

11Children

Clarity is a business tool and is not directed to children. Where a dealer’s customer is a minor, the dealer is responsible for handling that data appropriately under the applicable law.

12Changes & contact

We may update this policy; the current version and effective date are shown here, and we will take reasonable steps to notify of material changes. Questions: our Data Protection Officer at [privacy@ your domain], VERIDEX TECHNOLOGIES PTE. LTD., Singapore.