Lead Comply
AML Portal
Privacy Policy
Effective: 1 July 2026 · ABN 57 883 606 493 · Lead Comply AML Portal
This Privacy Policy explains how Lead Comply (ABN 57 883 606 493) collects, uses, stores, and protects your personal information when you register for and use the Lead Comply AML Portal — our purpose-built compliance management platform available at aml.leadcomply.com.au.
This policy applies to all registered users of the Lead Comply AML Portal, including users on the free tier and paid plans. It covers the personal information of both portal users (your staff members) and the customer data you enter into the portal as part of your AML/CTF compliance obligations.
We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). We take our obligations seriously — not as a tick-box exercise, but because the nature of the compliance data handled in this portal demands it.
1. Who We Are
Business name
Lead Comply
ABN
57 883 606 493
Portal address
aml.leadcomply.com.au
Privacy contact
info@leadcomply.com.au
Website
leadcomply.com.au
Governing law
Privacy Act 1988 (Cth) and the Australian Privacy Principles
2. What Information We Collect and Why
2.1 Portal User Information
When your agency registers for the Lead Comply AML Portal, we collect information about the people who use the portal on your behalf:
| What we collect | Why we collect it |
|---|---|
| Full name and email address | To create and manage your portal account |
| Business name and ABN | To set up your agency's compliance environment |
| Role and position title | To apply the correct access permissions within the portal |
| Password (encrypted) | To authenticate your identity on login |
| Login timestamps and activity logs | To maintain an audit trail as required by the AML/CTF Act 2006 |
| Training completion records | To track mandatory AML/CTF training as required by AUSTRAC |
2.2 Customer Compliance Data
As part of conducting Customer Due Diligence (CDD) under the AML/CTF Act 2006, you will enter personal information about your customers into the portal. This data is collected and processed on your behalf and includes:
- Customer names, dates of birth, and identification document details
- Customer addresses and contact details
- Beneficial ownership information for entity customers
- Risk ratings and due diligence assessments
- Transaction records and monitoring alerts
- PEP and sanctions screening results
- Suspicious Matter Reports (SMRs), Threshold Transaction Reports (TTRs), and IFTI reports
- Case management records
This data is collected because your agency is legally required to collect it under the AML/CTF Act 2006 (Cth) and the AML/CTF Rules 2025. You are the data controller for this information — Lead Comply processes it on your behalf as your technology service provider.
3. Where Your Information Is Stored
The Lead Comply AML Portal is hosted on an Australian server located in Sydney, New South Wales. All compliance records, customer data, audit logs, training records, and user information are stored in Australia.
| System | Hosted in | What it stores |
|---|---|---|
| Lead Comply AML Portal (aml.leadcomply.com.au) | Australia ✅ | All compliance records, customer data, user accounts, audit trails |
| Portal database | Australia ✅ (Sydney) | All data entered into the portal |
| Transactional emails (invites, password resets, alerts) | Processed via encrypted transmission — logs not retained | Email delivery only — no compliance data transmitted |
| PEP and sanctions screening (NameScan) | Australia ✅ | Customer names submitted for screening — results stored in portal |
| Transactional email delivery (Resend) | United States | Recipient name and email address only — used to deliver portal notifications such as invite links, password resets, and compliance alerts. No compliance records or identification data are transmitted. Resend operates under a Data Processing Addendum aligned with applicable privacy laws. |
| Billing (Stripe) | United States | Payment card details only — no compliance data |
4. PEP and Sanctions Screening — NameScan
The Lead Comply AML Portal integrates with NameScan — an Australian-based PEP (Politically Exposed Person) and sanctions screening service — to help you meet your Enhanced Customer Due Diligence obligations under the AML/CTF Act 2006.
When you run a screening check on a customer:
- The customer's name (and date of birth where provided) is submitted to NameScan for matching
- NameScan returns a result (Clear, Review, or Match) which is stored in the portal
- No sensitive identification documents are transmitted to NameScan
- NameScan is bound by Australian privacy law and their own privacy policy
This screening is available on paid plans only. You should include NameScan screening in your agency's AML/CTF Program disclosure to customers where applicable.
5. How We Use Your Information
We use the information collected in the Lead Comply AML Portal solely for the following purposes:
- To provide, operate, and maintain the Lead Comply AML Portal
- To authenticate users and manage role-based access
- To store your agency's AML/CTF compliance records securely
- To generate compliance reports, certificates, and audit trails
- To send you transactional notifications directly related to your portal use — such as invite links, password reset emails, and compliance alerts
- To calculate your compliance health score and provide reporting
- To monitor system performance and ensure portal security
6. Who We Share Your Information With
We do not sell, rent, or trade your information to anyone.
The only circumstances in which we share information are:
- Resend — recipient name and email address, used solely to deliver transactional portal notifications (invite links, password resets, compliance alerts). Resend is based in the United States and operates under a Data Processing Addendum. No compliance records or identification documents are transmitted.
- NameScan — customer names for PEP and sanctions screening (paid plans only, as described in Section 4)
- Stripe — payment card details only, for billing on paid plans (no compliance data)
- AUSTRAC and other regulators — only where required by Australian law, including the AML/CTF Act 2006
- Law enforcement — only where compelled by valid Australian legal process
- With your explicit consent — for any purpose not described in this policy
We do not share your compliance records, customer data, or audit trails with any third party for any commercial purpose.
7. How We Protect Your Information
We apply practical security measures appropriate to the sensitivity of AML/CTF compliance data:
- All data transmitted to and from the portal is encrypted using TLS (HTTPS)
- All data is encrypted at rest on our Australian servers
- Passwords are hashed using bcrypt — we cannot see your password
- Two-factor authentication (email OTP) is required for all real user accounts
- Role-based access controls ensure staff only see data relevant to their role
- All user actions are recorded in a tamper-evident audit log
- Session tokens expire after 8 hours of inactivity
- Our server infrastructure is maintained by a reputable Australian-based hosting provider
If you believe there has been unauthorised access to your portal account or data, contact us immediately at info@leadcomply.com.au.
8. How Long We Keep Your Information
Retention periods are aligned with the legal requirements of the AML/CTF Act 2006 and general Australian privacy law:
| Information | Retention period | Reason |
|---|---|---|
| Customer CDD records and identification documents | 7 years minimum | Required by AML/CTF Act 2006 s.105 |
| Transaction monitoring records | 7 years minimum | Required by AML/CTF Act 2006 s.105 |
| SMR, TTR, and IFTI reports | 7 years minimum | Required by AML/CTF Act 2006 s.105 |
| Audit trail and activity logs | 7 years minimum | Required by AML/CTF Act 2006 s.105 |
| Staff training records | 7 years minimum | Required by AML/CTF Act 2006 and AML/CTF Rules 2025 |
| User account information | Duration of account + 2 years | To support offboarding and records requests |
| Independent evaluation reports | 7 years minimum | Required by AML/CTF Rules 2025 Part 9.3 |
| Billing records | 7 years | Required by Australian taxation law |
When information is no longer required, it is securely deleted from our systems. Electronic records are permanently and irreversibly deleted — not merely archived.
9. Your Rights
Under the Australian Privacy Principles, you have the following rights in relation to your personal information held in the Lead Comply AML Portal:
| Your right | What this means |
|---|---|
| Access your information | Request a copy of the personal information we hold about you. We will respond within 30 days. |
| Correct your information | Ask us to correct information that is inaccurate, out of date, or incomplete. |
| Delete your account | Request deletion of your portal account. Note that compliance records required by law cannot be deleted before their mandatory retention period expires. |
| Know how your data is used | Ask us at any time to explain how we are using your personal information. |
| Withdraw consent | Where we rely on consent, you may withdraw it at any time — though this may affect your ability to use the portal. |
| Make a complaint | If you believe we have handled your information incorrectly, you can make a formal complaint (see Section 10). |
To exercise any of these rights, email info@leadcomply.com.au with the subject line "Privacy Request — AML Portal". We will acknowledge your request within 2 business days and respond fully within 30 days.
10. Complaints
We would always prefer you raise any privacy concern with us directly first. Please email info@leadcomply.com.au and we will work to resolve it promptly and fairly.
If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) — the independent regulator for privacy in Australia:
Office of the Australian Information Commissioner
Website: oaic.gov.au
Phone: 1300 363 992
Email: enquiries@oaic.gov.au
11. Notifiable Data Breaches
Lead Comply is subject to the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act 1988 (Cth). In the event of an eligible data breach — one that is likely to result in serious harm to affected individuals — we are required to:
- Notify affected individuals as soon as practicable
- Notify the Office of the Australian Information Commissioner (OAIC)
- Provide a statement of the breach, the information involved, and the steps we have taken
Given the sensitivity of AML/CTF compliance data handled in the portal, we maintain an incident response plan and conduct regular security reviews to minimise the risk of a data breach occurring.
12. Updates to This Policy
We may update this Privacy Policy from time to time to reflect changes in the portal, our business practices, or Australian privacy law. When we make material changes, we will update the effective date at the top of this page and notify registered users by email.
The current version of this Privacy Policy is always available at aml.leadcomply.com.au/privacy. We recommend reviewing it periodically.
Lead Comply AML Portal Privacy Policy · Version 1.0 · Effective 1 July 2026
Privacy questions?
Email us at info@leadcomply.com.au and we will respond within 2 business days.
Lead Comply AML Portal · aml.leadcomply.com.au · ABN 57 883 606 493