Privacy Policy
This policy explains what personal information Dromela collects, why we collect it, who we share it with, how long we keep it and what rights you have. It is written for users in Australia and applies to our website and platform.
1. Definitions
In this policy, "we", "us" and "Dromela" mean the operator of the dromela.org website and platform. "You" means the person using them. "Personal information" means information or an opinion about an identified or reasonably identifiable individual, as defined in the Privacy Act 1988 (Cth).
2. Personal data we collect
When you register or contact us we collect your first and last name, email address, telephone number and the content of your enquiry. When you go through verification we also collect identity and address documents and, where required, a facial image for comparison with your ID. When you fund your account we handle payment references and the last digits of a card, but not the full card number, which is processed by payment providers.
3. Usage data
We automatically record technical information when you use the website: IP address, browser and device type, pages visited, time spent and referring page. We use this to keep the site secure, to understand which pages help users and to fix errors. Where it is possible, we aggregate it so that it no longer points to one person.
4. Cookies
Cookies are small files stored on your device. We use strictly necessary cookies to keep you signed in and protect forms from abuse, and, with your consent where it is required, analytics cookies that tell us how pages perform. You can delete or block cookies in your browser settings, though some parts of the site may then work less well.
5. Who controls your data
Dromela is the entity that decides how and why your personal information is processed, and so is responsible for it under Australian law. Some providers act as processors for us, handling data only on our instructions. Our contact details are at the end of this policy.
6. How we collect and use information
We use your information to respond to your enquiries, to open and operate your account, to arrange the call from your account manager, to verify your identity, to meet our legal obligations, to protect the platform from fraud and to improve our services. We may send you service messages that you need to receive, and marketing messages only where the law allows and you have not opted out.
7. Legal basis and your consent
In Australia we collect personal information that is reasonably necessary for our functions and, where required, with your consent. In practice that means we rely on: the contract or request you make when you register, our legal and regulatory obligations such as AML/CTF identity checks, our legitimate interests in security and service quality, and separate consent for marketing. If you are in a place where the GDPR applies, the same grounds are used in the form that law requires.
8. Retention of data
Enquiry details are kept for up to two years after our last contact with you. Account and transaction records, including identity verification records, are kept for at least seven years after the account is closed, in line with AML/CTF record keeping rules. Technical logs are normally kept for twelve months. When a retention period ends we delete or de-identify the information.
9. Transfer of data
Your information is primarily stored on servers in Australia. Some service providers may process it in other countries, in which case we take reasonable steps to make sure the recipient protects it in a way that is consistent with Australian privacy principles, usually through contractual safeguards.
10. Disclosure of data
We disclose personal information to people who help us deliver the service: identity verification providers, IT hosting and communication providers, payment processors, professional advisers, affiliated companies in our group and call-centre partners. We also disclose it to regulators, law enforcement and courts where the law requires. We do not sell your personal information.
11. Security
We use encryption in transit and at rest, access controls, staff training and monitoring to protect your information. No method of transmission or storage is perfectly secure, so we also ask you to protect your password and devices. Our security page describes the controls in more detail, and we will notify you and the regulator if a breach is likely to cause serious harm.
12. Your rights
You can ask to access the personal information we hold about you, to correct it if it is inaccurate, to have it deleted when we no longer need it, to restrict or object to certain processing, and to withdraw consent for marketing at any time. Send your request to [email protected]. We will confirm your identity and respond within 30 days.
13. Service providers
Service providers working for us are bound by confidentiality and may use your information only for the services they provide. We review them before engaging them and when their services change, and we require them to tell us promptly about incidents affecting your data.
14. Analytics
We may use analytics tools to measure traffic and how users move through the website. Analytics data helps us decide which pages need to be clearer. It is not used to make decisions with legal effect on you, and you can switch off the relevant cookies using the tools provided on the site or in your browser.
15. Advertising and retargeting
If we use advertising technologies, they allow our ads to be shown to people who visited our site on other websites. These work through cookies and similar identifiers, and we will ask for consent where required. You can opt out through your browser or through the controls offered by advertising platforms.
16. Links to other websites
Our site may link to websites run by others, such as exchanges or regulators. We do not control them and are not responsible for their privacy practices. Check the policy of any site you visit before sharing personal information.
17. Children's privacy
Our services are not directed at anyone under 18, and we do not knowingly collect personal information from children. If you believe that a minor has given us information, contact us and we will delete it.
18. Changes to this policy
We may update this policy as our services or the law change. The current version is always published on this page with its effective date, and we will tell you about material changes by email or a notice on the site. Continuing to use the service after a change means that you accept it.
19. Contact us
If you have a question or a complaint about how we handle personal information, email [email protected] or write to Dromela, Level 12, 60 Marcus Clarke Street, Canberra ACT 2601, Australia. If you are not happy with our response, you may contact the Office of the Australian Information Commissioner (OAIC).