Privacy Policy

Version 1 · Last updated: 2 November 2026

In short

• This policy covers visitors to our website, people who contact us, and our investors.
• Our website has no cookies, analytics or forms.
• Before accepting an investment, we verify the investor’s identity through our provider, Sumsub, and screen them against sanctions lists.
• We share information only with the providers, advisers and related companies that help us, and where the law requires it. Some are outside Australia.
• We do not sell personal information.
• You can ask to see or correct your information, or make a complaint, at contact@atyslabs.com.

1. Who we are

ATYS Labs Pty Ltd (ACN 703 455 270, ABN 19 703 455 270) (“ATYS Labs”, “we”, “us”) is a company registered in New South Wales, Australia. Our registered office is Suite 416 / Mezzanine, 388 George Street, Sydney NSW 2000.

This policy explains how we handle personal information about:

• visitors to atyslabs.com;
• people who contact us; and
• our investors and prospective investors, and people connected with an investor, such as the directors, owners and authorised representatives of an investing company.

We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth).

2. What we collect

Website visitors. This website has no cookies, analytics, trackers or forms. Our hosting provider automatically records basic technical information, such as your IP address, browser type, the page you request and the time, to deliver the site and keep it secure.

People who contact us. Your name, email address and anything you choose to tell us.

Investors and prospective investors. To consider and administer an investment, we collect:

• your name, date of birth, residential address and contact details;
• a copy of your photo ID, images or a short video of your face, and a document showing your address;
• the information you give in our investor qualification pack, including whether you qualify to invest and the facts that support it, such as your income, net worth or assets;
• if you invest through a company or other entity: its details, and the details of its directors, signatories and every person who owns 25% or more of it;
• the bank account or blockchain wallet you pay from, and records of your payments;
• the results of identity verification, sanctions screening, politically exposed person screening and wallet screening; and
• your signature, your signed investment documents and our communications with you.

Sensitive information. The images of your face used to match you to your photo ID are biometric information, which the Privacy Act treats as sensitive information. Screening may also show public positions you hold or have held. We collect sensitive information only with your consent, which you give in our investor qualification pack, or where the law allows it.

If you do not give us the information we ask for, we may not be able to accept your investment.

Using a pseudonym. You can contact us without giving your real name. Investors cannot, because the law requires us to know who our investors are.

Government identifiers. Your ID documents carry government identifiers, such as a passport or driver’s licence number. We do not use these as our own way of identifying you.

3. How we collect it

We collect most information directly from you: through our investment documents, by email, and through the secure link from our identity verification provider, Sumsub. We may also collect information from public registers, sanctions and screening databases, public blockchain records, and people authorised to act for you, such as your adviser or an investing company.

If we receive personal information we did not ask for and do not need, we delete or de-identify it.

4. How we use it

• To decide whether we can accept an investment from you, including checking your identity and eligibility and screening against sanctions lists.
• To meet our legal obligations, including under company, tax, securities, anti-money laundering and sanctions laws, and to make regulatory filings.
• To prepare, sign and administer your investment documents, keep our share and investor registers, and send you updates and reports.
• To reply to you, and to run and secure our website.
• To establish, exercise or defend legal claims.

We do not sell personal information, and we do not use it for advertising.

5. Who we share it with

• Sumsub (Sum and Substance Ltd and its group companies), which verifies identity and carries out sanctions and politically exposed person screening for us.
• Our service providers, including Cake Equity (share and investor registers), DocuSign (electronic signing), and our email, website hosting, wallet screening and banking providers.
• Related companies we work with in connection with your investment, including any company that becomes a party to your investment documents.
• Our professional advisers, such as lawyers, accountants and auditors.
• Regulators, government agencies and courts, where the law requires or allows it.
• A prospective buyer of, investor in or lender to our business, and their advisers, in connection with a proposed sale, financing or restructure, under a duty of confidentiality.

6. Overseas disclosure

Some of the people and providers above are located, or store information, outside Australia. The countries are likely to include the United Kingdom, Germany and other European Union countries, the United States and Singapore. Related companies may also be located outside Australia.

7. Automated checks

Sumsub uses automated tools to check that your photo ID is genuine, that your face matches it, and whether you appear on sanctions or politically exposed person lists. We use the results to help decide whether we can accept your investment. The final decision is made by our directors. You can contact us to ask about any decision.

8. Security

We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, change or disclosure. We store it electronically with the providers above and limit access to the people who need it.

9. How long we keep it

• Investor records, including identity verification records: 7 years after you stop being an investor.
• If an investment does not go ahead: for as long as we need the records for the purposes above or the law requires, and no longer.
• Website logs: for the limited period our hosting provider keeps them.

After that, we delete or de-identify the information.

10. Access and correction

You can ask to see the personal information we hold about you, or ask us to correct it, by emailing contact@atyslabs.com. We will respond within 30 days and do not charge for a request. If the law allows us to refuse, we will tell you why.

11. If you are in the United Kingdom or European Union

If the UK or EU General Data Protection Regulation applies to our handling of your information, ATYS Labs is the controller. We rely on these legal bases:

• taking steps to enter into, or performing, your investment documents;
• complying with our legal obligations;
• our legitimate interests in running and protecting our business and website; and
• your explicit consent, for the biometric information used to verify your identity.

You can ask to access, correct or delete your information, to restrict or object to how we use it, or to receive a copy in a portable form. Where we rely on consent, you can withdraw it at any time; this does not affect anything done before. When your information is transferred outside the UK or European Economic Area, we rely on the safeguards our providers offer, such as standard contractual clauses. You can also complain to your local data protection authority, such as the Information Commissioner’s Office in the UK.

12. Complaints

If you have a concern about how we have handled your personal information, please email us first at contact@atyslabs.com. We will respond within 30 days. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

13. Changes to this policy

We may update this policy from time to time. The current version is always on this page, with the date it was last updated.

14. Contact us

The Directors
ATYS Labs Pty Ltd
Suite 416 / Mezzanine, 388 George Street, Sydney NSW 2000
contact@atyslabs.com