Privacy Policy

The shareholder payout portal at https://nccpayouts.accountingsns.com.au (the Portal) is operated by S & S Accounting & Business Services (SNS Accounting, we, us) on behalf of the Nepalese Community Center (NCC). NCC is the organisation whose shareholders use the Portal, and NCC decides why and how shareholder information is used. SNS Accounting collects and handles that information as NCC's service provider.

This policy explains how personal information is collected, used, disclosed, stored and protected in connection with the Portal, and how you can access or correct it or make a complaint. It is written to comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). It applies in addition to any privacy policy published by NCC or by SNS Accounting for its other services.

We collect only the information needed to confirm who you are, confirm your shareholding and pay you. This includes:

• Identity and contact details: your name, residential address, home and mobile phone numbers and email address.
• Shareholding details: the number of shares you hold and whether the shares are held jointly with a spouse or on behalf of a child.
• Family details where relevant: if shares are held for a child, the child's name and date of birth and the parent or guardian's name and relationship; if shares are jointly held, the fact that a spouse is involved.
• Bank account details: the account name, BSB and account number you nominate for the payout, and any notes you add.
• Consent and signature: your typed name as an electronic signature, the consent you give, and the date and time it was given.
• Identity documents: an image or PDF of a driver's licence, passport or other approved photo ID, and a proof-of-address document such as a utility bill or bank statement. These contain further details such as your date of birth, document number, photograph and signature.
• Usage and security information: the date and time you open your link and submit information, and basic technical information used to keep the Portal secure and prevent misuse.
• Change history: a record of changes made to your details, by you or by authorised staff.

We do not collect tax file numbers, and we do not collect information for marketing.

• From NCC's existing records. Your name, address, contact details and shareholding are taken from NCC's shareholder records so you can check and correct them.
• From you, through the Portal. When you confirm or update your details, nominate a bank account, give consent and upload identity documents.
• From a parent, guardian or spouse who completes the Portal on behalf of a child or a joint holding. If you provide information about another person, you confirm that you are authorised to do so and that you have told them about this policy.

You can choose not to provide information, but without it NCC may not be able to verify your shareholding or make the payout to you.

We use personal information for these purposes, and for closely related purposes you would reasonably expect:

• to confirm that you are the shareholder recorded by NCC and that your details are current;
• to verify your identity and residential address before money is paid, in order to prevent fraud and payment to the wrong person;
• to record the bank account you nominate and to make the payout to that account;
• to record your consent and electronic signature, and the consent of a parent or guardian where shares are held for a child;
• to communicate with you about your record, including sending secure links, confirmations and review outcomes;
• to keep an accurate history of what was submitted, by whom and when;
• to keep the Portal secure and investigate suspected misuse; and
• to meet NCC's legal and record-keeping obligations.

We do not use your information for direct marketing and we do not sell it.

Identity documents are collected only to verify who you are. We do not use your driver's licence number, passport number or any other government identifier as our own identifier for you; your record is identified by a Record ID that the Portal generates. Document images are stored privately, are never sent by email, and can be viewed only by authorised staff while they review your submission.

We ask that proof-of-address documents be dated within the last three months. You may black out information on a document that is not needed to confirm your name and address (for example, transaction details on a bank statement).

Where shares are held under a child's name, we collect the child's name and date of birth and the details and consent of a parent or guardian. The Portal calculates the child's age from the date of birth; if the person is 18 or older, their own consent is required instead. We do not knowingly collect information from a child directly.

We disclose personal information only as needed for the purposes above, to:

• NCC and its authorised administrators, who review submissions, verify identity documents and approve payouts. NCC may also use the information in its own shareholder records.
• SNS Accounting staff who operate the Portal and process payouts on NCC's behalf.
• Trusted service providers that supply the secure cloud infrastructure and email delivery used by the Portal. They act on our instructions and are not permitted to use the information for their own purposes.
• Banks and payment providers, to the extent needed to make the payout to your nominated account.
• Professional advisers, regulators, courts or law enforcement where required or authorised by law, or to investigate suspected fraud.

Your information, including identity documents, is stored in secure cloud data centres located in Australia (Sydney region). Limited technical information involved in delivering the website to your browser may be processed outside Australia. We take reasonable steps to ensure that any provider involved protects personal information in a way that is consistent with the APPs.

• Your record can be opened only with the personal link sent to your email. Links expire and can be reissued or revoked.
• Information is encrypted while it travels to and from the Portal and while it is stored.
• Identity documents are kept in private storage and are not publicly accessible.
• Bank details are masked wherever possible and shown in full only to authorised staff who need them, which is recorded.
• Staff access requires an individual, authorised account with the minimum permissions needed.
• Every change to a record is recorded in a history that staff can review.

You can help by not forwarding your link, by checking that emails come from NCC's address, and by telling us promptly if you think your link or details have been misused. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

We keep personal information for as long as it is needed for the purposes above and for the periods required by law. Records of the payout, including your confirmed details, bank account and consent, are generally kept for seven years in line with financial record-keeping obligations.

Identity documents are kept only as long as needed to verify your identity and to evidence that verification, after which they are deleted in accordance with NCC's retention practices. When information is no longer required it is deleted or de-identified.

You can view the details NCC holds for you by opening your personal link, and you can correct them through the Update option. You can also ask us for access to, or correction of, your personal information by contacting us using the details below. We will respond within 30 days. We may need to verify your identity before giving access, and we may refuse access in the limited circumstances permitted by the Privacy Act, in which case we will tell you why.

If you have a question or believe we have handled your personal information in breach of the APPs, please contact us first using the details in section 15. We will acknowledge your complaint, investigate it and respond in writing, normally within 30 days.

If you are not satisfied with our response you may complain to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or on 1300 363 992.

If a data breach occurs that is likely to result in serious harm to you, we will notify you and the OAIC as required by the Notifiable Data Breaches scheme in the Privacy Act, and tell you what steps you can take.

The Portal does not use advertising or analytics cookies. Your browser keeps your place while you complete the form, and this is cleared when you close it. A security service used to protect the Portal from automated misuse may set its own cookies.

We may update this policy from time to time. The current version is always published at https://nccpayouts.accountingsns.com.au/privacy with its effective date. Material changes will be communicated by email where we have your address.

Please mark privacy requests "Attention: Privacy Officer" or email info@accountingsns.com.au with "Privacy" in the subject.