Privacy

Macquarie Group Services Pty Limited (ABN 70 090 831 039)

Effective date: 13 May 2026 · Last updated: 13 May 2026

1. About this Privacy Policy

This Privacy Policy explains how Macquarie Group Services Pty Limited (ABN 70 090 831 039) (MGS, we, us, our) collects, uses, discloses, stores and otherwise handles personal information.

We take privacy seriously and are committed to handling personal information in accordance with:

the Privacy Act 1988 (Cth) (Privacy Act) and the Australian Privacy Principles (APPs);
the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) (AML/CTF Act) and the AML/CTF Rules 2025; and
other applicable Australian privacy and data protection laws.

This Privacy Policy applies to personal information we collect through:

our website at www.macquariegs.com.au (Website), through which we sell trust and company documents and related services to Australian accountants;
our AML/CTF compliance platform (Platform); and
our other dealings with you, including by phone, email and in person.

Some collection notices may apply at the point of collection — those notices supplement this Privacy Policy.

2. Who we are and what we do

MGS is an Australian company that provides:

trust and company formation services to Australian accountants who order trust and company documents through the Website. In providing these services, MGS is itself a “reporting entity” under the AML/CTF Act and has customer due diligence and other obligations under that Act.
the AML/CTF compliance Platform, a software-as-a-service used by Australian accounting practices to manage their own AML/CTF compliance.

This Privacy Policy covers personal information we handle in connection with both businesses.

3. The kinds of personal information we collect

The personal information we collect depends on how you interact with us. Personal information has the meaning given in the Privacy Act.

3.1 If you are a customer of our Website (an accountant or accounting practice)

If you (or your practice) order trust or company services through the Website, we collect personal information about:

the practice's principals and authorised representatives, including names, business contact details, role and position;
the practice's AML/CTF Compliance Officer, including name, contact details, and qualifications;
any individual who is a beneficial owner of the practice;
billing contacts, payment details (which are processed by our payment service provider) and account credentials; and
correspondence and order history with us.

3.2 If you are a customer of the Platform

If you (or your practice) subscribes to the Platform, we collect personal information about:

the principals, partners or directors of the practice;
the practice's AML/CTF Compliance Officer and other personnel with AML/CTF responsibilities;
each individual who is given access to the Platform as an authorised user (account name, role, login credentials, activity logs);
the practice's beneficial owners; and
billing contacts, payment details and account information.

3.3 If you are an end client of a Platform customer

If a customer of ours uploads information about you (their client) to the Platform — typically as part of their own customer due diligence — we receive and process that information. The categories may include:

name, former names, date of birth, residential or registered address, and contact details;
nationality, country of birth, country of residence;
occupation and source of funds or wealth;
identification documents (such as passport, driver licence, Medicare card, ASIC extracts, trust deeds);
beneficial ownership information;
politically exposed person status;
sanctions screening results;
adverse media information;
the customer's risk rating of you and the basis for it; and
transaction and engagement history relevant to the services your accountant provides.

If a customer of ours orders trust or company services through the Website on your behalf, we receive similar information for the purposes of those services.

You should also read the privacy policy of your accountant or other service provider, who is the entity that initially collected your personal information.

3.4 If you visit the Website

When you visit the Website, we may collect:

IP address, browser type, device information, operating system;
pages visited, links clicked, and time spent;
cookies and similar tracking technologies (see clause 12); and
information you provide through online forms, contact us pages or chat features.

3.5 Sensitive information

Some of the personal information we handle is “sensitive information” under the Privacy Act, including information about racial or ethnic origin (which can be inferred from country of birth) or criminal history (where collected for AML/CTF purposes such as adverse media checks or PEP screening). We collect sensitive information only where reasonably necessary for the purposes set out in this Policy and where we have your consent or the collection is required or authorised by law (including the AML/CTF Act).

4. How we collect personal information

We collect personal information:

directly from you, when you register for an account, place an order, complete a form on the Website, contact us, or otherwise interact with our services;
from a Platform customer about their end clients, where the Platform customer enters that information into the Platform or orders Website services in respect of an end client;
from third-party service providers, including:
- our identity verification provider, which returns identity and document verification results;
- our screening provider, which returns PEP and sanctions screening results;
- payment processors;
- hosting and security providers; and
- our analytics providers;
from publicly available sources, where reasonably necessary for our purposes (for example, ASIC searches);
automatically through the Website and Platform, including through cookies and similar technologies;
from regulators or government bodies, where required or authorised by law.

Where we collect personal information from a third party rather than directly from you, we take reasonable steps to ensure that you have been notified of the collection at or before the time the information is collected, or where this is impracticable, as soon as practicable afterwards (APP 5).

5. Why we collect, hold, use and disclose personal information

We use personal information for the following primary purposes:

to provide our Website services, including taking and fulfilling orders for trust and company services;
to provide and improve the Platform, including operating the verification, screening and ongoing monitoring features;
to comply with our own AML/CTF obligations, including conducting customer due diligence on Website customers and end clients, applying our reliance arrangements, conducting ongoing monitoring, and submitting reports to AUSTRAC where required;
to verify your identity and the identities of associated persons;
to manage accounts, billing, payments, customer support and the customer relationship;
to communicate with you about our services, including operational notices, service updates and security alerts;
to maintain records as required by Part 10 of the AML/CTF Act and other legal record-keeping obligations;
to investigate, prevent and respond to fraud, security incidents and misuse;
to comply with our other legal and regulatory obligations and to enforce our rights;
for direct marketing of our services, where permitted (see clause 13); and
where the use or disclosure is otherwise permitted by the Privacy Act.

6. To whom we disclose personal information

We disclose personal information to:

6.1 Our service providers

our identity verification provider, which is based overseas and processes information outside Australia (see clause 7);
our screening provider, which is based overseas and processes information outside Australia (see clause 7);
hosting providers — for the secure hosting of the Platform and Website, on Australian servers;
payment processors — for processing payments and managing subscriptions;
email, communications and analytics providers — to enable our communications with you and to analyse use of our services;
professional advisers — such as our lawyers, accountants and auditors.

We require our service providers to protect personal information consistent with the requirements of the Privacy Act and our contractual arrangements with them.

6.2 Regulators and law enforcement

We disclose personal information to AUSTRAC, the Australian Federal Police, the Australian Taxation Office, the Australian Securities and Investments Commission, courts, tribunals, and other regulators and law enforcement agencies where:

required by law (including under the AML/CTF Act, in response to a notice or warrant, or in connection with a court order); or
otherwise permitted under the Privacy Act, including where we reasonably believe that disclosure is necessary to assist with the location of a missing person, to lessen or prevent a serious threat to life, health or safety, or to prevent or investigate suspected unlawful activity.

6.3 In connection with our businesses

We may disclose personal information:

to our related bodies corporate;
to a purchaser or potential purchaser of our business or assets, subject to confidentiality protections;
to our successors in the conduct of the business; and
in connection with any restructuring or financing of our businesses.

6.4 With your consent

We disclose personal information where you have consented to that disclosure.

6.5 Disclosure to your accountant or service provider

If you are an end client whose personal information was uploaded to the Platform by your accountant, we may disclose information about your record to that accountant in the ordinary course of providing the Platform to them.

7. Cross-border disclosure of personal information

The Platform is hosted on servers located in Australia. However, some personal information is disclosed or processed outside Australia, in particular:

identity verification, where our provider uses processing infrastructure that may include the United Kingdom and the European Economic Area;
PEP and sanctions screening, where our provider uses processing infrastructure that may include the European Economic Area;
email, analytics and similar service providers, which may store or process information in the United States or other countries;
where we are required to disclose information to a foreign regulator or court, in accordance with applicable law.

When we disclose personal information overseas, we take reasonable steps to ensure the overseas recipient handles the information in a way that is consistent with the APPs, including through contractual arrangements with our service providers. Despite those steps, you should be aware that information held overseas may be subject to lawful access by foreign governments or agencies.

By using our services and providing personal information, you consent to the cross-border disclosures described in this clause 7.

8. Storage and security

We hold personal information in:

our cloud-hosted Platform databases, located in Australia;
our internal business systems (including email, accounting and customer relationship management systems), some of which are operated by our service providers;
third-party identity verification and screening systems;
secure backups; and
to a limited extent, in physical files for hard-copy documents.

We take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification or disclosure. Those steps include:

access controls (including role-based access, multi-factor authentication and information barriers within the Platform that support compliance with section 123 of the AML/CTF Act);
encryption of data in transit and at rest;
regular security testing and patching;
staff training on privacy and information security;
contractual security obligations with our service providers;
monitoring and logging of access; and
physical security of premises where applicable.

No security measure is perfect. While we take reasonable steps to protect personal information, we cannot guarantee that personal information will never be accessed without authorisation.

9. How long we keep personal information

We keep personal information for as long as we need it for the purposes for which we collected it, and for any longer period required or authorised by law.

In particular:

AML/CTF records must be kept for at least 7 years after the relevant record event, in accordance with Part 10 of the AML/CTF Act. This period applies to records of designated services we provide, customer-provided documents, and records of customer due diligence procedures.
Tax and accounting records must generally be kept for at least 5 years.
Records relating to legal claims are kept for the relevant limitation period.
Marketing records are kept while you remain subscribed to our marketing communications.
Other records are kept while we have an active relationship with you and for a reasonable period afterwards.

When we no longer need personal information, we will destroy or de-identify it in a secure manner, except where retention is required or authorised by law.

10. Your rights — access and correction

10.1 Access

You have the right to request access to personal information we hold about you. To make a request, contact us using the details in clause 17.

We will respond to access requests within 30 days. We may charge a reasonable fee for our cost of providing access (no fee will be charged for making the request).

10.2 Correction

If you believe personal information we hold about you is inaccurate, out of date, incomplete, irrelevant or misleading, you may ask us to correct it. We will take reasonable steps to make the correction or, if we disagree, to attach a statement of your view.

10.3 Limits on access and correction

In some cases we may be unable to provide access to or correct personal information. This may include where:

giving access would have an unreasonable impact on the privacy of other individuals;
the request is frivolous or vexatious;
the information relates to existing or anticipated legal proceedings and would not be discoverable in those proceedings;
giving access would reveal commercially sensitive information; or
giving access or making the correction would be unlawful or prejudice an investigation, including an investigation under the AML/CTF Act.

If we refuse a request, we will provide written reasons (except where doing so would itself be unlawful or prejudicial).

11. AML/CTF — special information handling

Where we collect, use or disclose personal information for AML/CTF purposes, special rules apply:

Mandatory collection. Some personal information is collected because the AML/CTF Act requires it. We may not be able to provide certain services if you do not provide the information.
Tipping off. Section 123 of the AML/CTF Act makes it an offence to disclose certain information that would, or could reasonably be expected to, prejudice an investigation. As a result, there are some matters about which we are unable to confirm or deny information, and we may decline to respond to access requests where doing so would or could prejudice an investigation. This is consistent with the recognised exceptions under APP 12.3.
Reports to AUSTRAC. We are required to make certain reports to AUSTRAC under the AML/CTF Act, including suspicious matter reports, threshold transaction reports, cross-border movement reports and annual compliance reports. Where we make such reports, we are protected from liability for that disclosure under section 235 of the AML/CTF Act.

12. Cookies and analytics

The Website and Platform use cookies and similar technologies, including:

strictly necessary cookies that are required for the Website or Platform to function;
functional cookies that remember your preferences and settings;
analytics cookies that help us understand how visitors use the Website and Platform; and
session cookies that allow you to remain logged in.

We may use third-party analytics services (such as Google Analytics) which set cookies and collect information about your use of the Website. Information collected through analytics may be transmitted to and stored by the relevant analytics provider on servers outside Australia.

You can control cookies through your browser settings. Disabling cookies may affect the functionality of the Website and Platform.

13. Direct marketing

We may use your personal information to send you direct marketing communications about our services. You can opt out of receiving direct marketing at any time by:

using the unsubscribe link in any marketing email;
contacting us using the details in clause 17.

We comply with the Spam Act 2003 (Cth) in sending commercial electronic messages.

We do not sell personal information to third parties for their direct marketing purposes.

14. Notifiable Data Breaches

We comply with the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act.

If we become aware of an “eligible data breach” (broadly, an unauthorised access, unauthorised disclosure or loss of personal information that is likely to result in serious harm to one or more affected individuals, and we have not been able to take action to prevent the serious harm), we will:

notify the Office of the Australian Information Commissioner; and
notify affected individuals, as required by the Privacy Act.

If you are a Platform customer and the breach affects your end clients' personal information, we will work with you in good faith to support your own data breach response, including by providing relevant information about the incident.

If you are concerned that a data breach may have affected you, please contact us using the details in clause 17.

15. Children

The Website and Platform are not directed at children, and we do not knowingly collect personal information directly from children. If you become aware that personal information about a child has been provided to us without the consent of a parent or guardian, please contact us so that we can address the situation.

We may, in limited circumstances, hold personal information about minors in the context of customer due diligence (for example, where a minor is a beneficial owner of a trust). Such information is handled in accordance with this Policy.

16. Complaints

If you have a complaint about how we have handled your personal information, please contact us using the details in clause 17. We will:

acknowledge your complaint within 7 days;
investigate the complaint; and
aim to provide you with a substantive response within 30 days.

If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC):

Website: www.oaic.gov.au
Phone: 1300 363 992
Mail: GPO Box 5288, Sydney NSW 2001

17. How to contact us

If you have any questions about this Privacy Policy or wish to exercise your rights, please contact our Privacy Officer:

Privacy Officer
Macquarie Group Services Pty Limited
Level 7, 77 Castlereagh Street, Sydney, NSW 2000
Email: contact@macquariegs.com.au
Phone: (02) 9231 5111

18. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The current version is always available on the Website at www.macquariegs.com.au/terms/privacy. The “last updated” date at the top of this Policy indicates when it was most recently revised.

Where the change is material, we will take reasonable steps to bring it to your attention before it takes effect (for example, by email to registered users or by a prominent notice on the Website).

By continuing to use our services after a change takes effect, you accept the updated Policy.