Privacy Policy

1. About this Privacy Policy

Kids Money App Pty Ltd (ABN 40 672 025 302) Also known as, Bank'd ("Bank'd", "we", "us" or "our") is committed to protecting the privacy and security of the personal information entrusted to us by families who use our products and services.

Bank'd is a family-focused financial technology platform designed to help children develop positive financial habits through spending, saving, earning and financial education, while giving parents and guardians appropriate visibility and control.

This Privacy Policy explains how we collect, hold, use, disclose and protect personal information when you:

• create or manage a Bank'd account;
• use the Bank'd mobile application or website;
• use a Bank'd debit card or other Bank'd financial product;
• use our parent or guardian features;
• communicate with our support team;
• participate in our educational, promotional or other programs; or
• otherwise interact with Bank'd.

This Privacy Policy applies to personal information relating to parents, guardians, children and other individuals who interact with Bank'd.

We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles, as applicable to us.

2. Who is responsible for your information?

Kids Money App Pty Ltd is the company responsible for the Bank'd platform and the services we provide through the Bank'd brand.

Bank'd works with a range of specialist third parties to provide financial, payment, card, identity verification, technology, security and other services.

Some of these organisations may independently handle personal information in providing their services. For example, our banking, card issuing or payment partners may collect and process information directly in accordance with their own privacy policies and legal obligations.

Where another organisation is responsible for particular financial or payment services, we will explain this to you where appropriate.

3. Information we collect

The information we collect depends on how you interact with Bank'd.

Information about parents and guardians

This may include:

• full name;
• date of birth;
• residential and postal address;
• email address;
• telephone/mobile number;
• identification information;
• identity verification information;
• account login information;
• information about your relationship with a child using Bank'd;
• payment and funding information;
• information about your use of Bank'd; and
• information required to meet legal, regulatory and security obligations.

Information about children

We may collect information about children who use Bank'd, including:

• name;
• date of birth or age;
• profile information;
• email address;
• telephone/mobile number;
• parent or guardian relationship;
• account and card information;
• transaction and spending information;
• savings goals;
• earning and allowance information;
• financial education and learning activity;
• preferences and settings;
• interactions with Bank'd features; and
• information about how the child uses the Bank'd application.

We collect information about children primarily to provide the Bank'd service, facilitate financial education and enable parents or guardians to manage the child's account.

We do not intend to collect information about children that is unnecessary for these purposes.

4. Financial and transaction information

When you use Bank'd, we may collect information relating to financial activity, including:

• account balances;
• deposits and transfers;
• card transactions;
• transaction dates and times;
• transaction amounts;
• merchant information;
• payment status;
• card status;
• spending history;
• savings activity;
• account funding information;
• refunds and reversals; and
• other information necessary to administer the Bank'd service.

Card information

Bank'd does not store the complete card number (PAN), card security code (CVV) or card PIN in its own systems.

Where these details are required for card processing, they are passed directly to our relevant card or banking provider, including Change Financial, and are redacted from Bank'd logs.

Bank'd may instead retain limited card-related information such as:

• a Change Financial card token;
• the last four digits of a card;
• card expiry information;
• the embossed cardholder name; and
• the relevant Change Financial customer reference ID.

This allows Bank'd to identify and administer cards without retaining the complete underlying card credentials.

Account and reconciliation information

Where PANs or bank account numbers are required in reconciliation or authorisation records, these are masked before being saved, with only the last four digits retained.

Where Bank'd receives a bank account number through an API, the account number is masked when returned and stored by Bank'd.

5. Authentication and security credentials

Bank'd uses specialist authentication infrastructure to protect account credentials.

Passwords and SMS/email one-time password (OTP) codes are handled entirely by AWS Cognito and are not stored by Bank'd's application backend.

Where Bank'd needs to retain security-related tokens or access codes, these may be stored in protected form rather than as the underlying value. For example:

• session tokens are stored as SHA-256 hashes; and
• parent access codes are stored as bcrypt hashes.

Stripe payment client secrets are stored only as a token, reference or hash rather than as the underlying secret.

6. Identity verification and regulatory information

Because Bank'd operates in the financial services ecosystem, we may need to collect information to verify identity, prevent fraud and comply with applicable laws.

This may include:

• date of birth;
• residential address;
• government-issued identification;
• identity verification results;
• information confirmed during identity verification;
• information relating to beneficial ownership or authority to operate an account;
• information required under anti-money laundering and counter-terrorism financing obligations; and
• information relating to fraud, sanctions or other compliance checks.

Identity documents and biometric information

Where identity verification is performed through our identity verification provider, identity documents and face/liveness images are captured directly within the provider's hosted verification flow.

These documents and images are not received or retained by Bank'd's own storage systems.

Bank'd retains the verification outcome and the personal details confirmed during verification, such as your name and date of birth.

7. Information about how you use Bank'd

We may collect information about your interaction with our website, application and services, including:

• features you use;
• pages or screens viewed;
• educational content accessed;
• savings goals created;
• preferences;
• device information;
• operating system;
• application version;
• IP address;
• approximate location derived from IP address;
• crash reports;
• diagnostic information;
• security events; and
• other technical information required to operate and improve Bank'd.

We may use this information to understand how our products are being used, identify technical problems, improve the Bank'd experience and maintain the security of our services.

Analytics and advertising

Bank'd draws a clear distinction between the Bank'd app and the Bank'd website.

In the Bank'd app, we do not use advertising, behavioural or attribution analytics, advertising-network SDKs, IDFA, ATT or cross-app tracking. Firebase Analytics has been permanently deactivated, and our application privacy configuration declares that tracking is not performed. We do not sell or share personal information collected in the app for advertising purposes.

On the Bank'd website, we use analytics and advertising technologies (such as Google Analytics and the Meta and TikTok advertising pixels) to understand how our website is used and to measure and improve our advertising. These technologies are used on our website only and are not used within the Bank'd app. Full details, including the information collected and how to manage your preferences, are set out in section 16 (Cookies, analytics and advertising on our website).

In the Bank'd app, Sentry is used for crash and performance diagnostics and does not receive personally identifiable information. Our website also sends security reports to Sentry, as described in section 16.

8. How we collect information

We may collect personal information:

• directly from you;
• from a parent or guardian;
• from your child where appropriate;
• when you create or use a Bank'd account;
• when you use a Bank'd card;
• through our website or mobile application;
• when you communicate with us;
• from our banking, card, payment and identity-verification partners;
• from service providers assisting us;
• from organisations involved in fraud prevention and compliance;
• from publicly available sources; or
• from another person who is authorised to provide information on your behalf.

9. How we use personal information

We collect and use personal information for purposes including:

Providing Bank'd

To:

• create and administer accounts;
• provide cards and financial functionality;
• process transactions;
• manage payments and transfers;
• provide parent and child features;
• administer savings and earning features;
• provide financial education and gamification;
• provide customer support; and
• otherwise provide the products and services requested by you.

Security and fraud prevention

We may use information to:

• verify identity;
• detect and prevent fraud;
• detect suspicious activity;
• protect accounts and users;
• investigate security incidents;
• prevent misuse of our services; and
• protect the Bank'd platform.

Legal and regulatory obligations

We may use and disclose information where necessary to:

• comply with applicable laws;
• meet regulatory obligations;
• comply with anti-money laundering and counter-terrorism financing requirements;
• respond to lawful requests from government agencies or regulators;
• comply with court orders or other legal processes; and
• protect our legal rights.

Improving Bank'd

We may use information to:

• analyse how our products are used;
• improve features;
• develop new products and services;
• troubleshoot technical issues;
• conduct research and testing;
• improve educational content;
• understand customer needs; and
• improve the overall Bank'd experience.

10. Children's information

Protecting children's information is particularly important to us.

Bank'd is designed so that parents and guardians remain involved in their child's financial experience while children are given an appropriate level of independence.

We seek to collect only information that is reasonably necessary to provide the Bank'd service and its associated features.

We do not intend to use children's personal information for unrelated purposes.

Where we use information to improve our products, services or educational experience, we seek to do so in a way that is appropriate to the purpose for which the information was originally collected.

We do not sell or share children's personal information for advertising purposes.

11. Parents and guardians

The Bank'd parent or guardian account provides authorised adults with visibility and control over relevant aspects of a child's Bank'd account.

Depending on the product and features being used, parents or guardians may be able to view information including:

• account balances;
• transaction history;
• savings goals;
• spending activity;
• card status;
• account settings; and
• other information relating to their child's Bank'd account.

Parents and guardians should understand that this information may include personal information about their child.

We may take reasonable steps to verify that a person requesting access to a child's information is authorised to do so.

12. Sharing personal information

We may disclose personal information to organisations where reasonably necessary to provide Bank'd or fulfil the purposes described in this Privacy Policy.

These organisations may include:

Banking and financial service providers

Including:

• banking partners;
• card issuers;
• payment providers;
• payment processors;
• account providers; and
• other financial infrastructure providers.

Identity and compliance providers

Including providers that assist with:

• identity verification;
• fraud prevention;
• AML/CTF compliance;
• sanctions screening; and
• risk management.

Technology providers

Including providers that assist with:

• cloud hosting;
• application infrastructure;
• data storage;
• analytics;
• cybersecurity;
• communications;
• customer support;
• software development; and
• technical operations.
• Sentry (Functional Software, Inc.) for website security monitoring.
• Mailchimp (The Rocket Science Group LLC, part of Intuit Inc.) for storing our mailing list and sending marketing email to people who have opted in.

Operational service providers

Including providers involved in:

• card production;
• card fulfilment;
• postal services;
• customer communications;
• marketing administration;
• accounting; and
• professional services.

We require service providers that handle personal information on our behalf to maintain appropriate safeguards and only use information for authorised purposes.

13. Our banking and BaaS partners

Bank'd is a technology and customer-facing platform and works with specialist financial services providers to facilitate certain financial products and services.

Depending on the product you use, information may therefore be exchanged between Bank'd and our banking, card, payment and other financial service providers.

Those providers may have their own privacy policies and legal obligations.

Where a financial service provider independently controls personal information, you should also review that provider's privacy policy.

In particular, Change Financial may receive and process card and customer information necessary to provide the relevant banking and card services. Bank'd does not retain the complete card credentials described above.

14. Third-party service providers

We may use third-party service providers located in Australia or overseas.

These providers may assist us with:

• cloud infrastructure;
• software;
• analytics;
• identity verification;
• payments;
• fraud prevention;
• customer support;
• communications;
• cybersecurity;
• card services; and
• other operational functions.

Where Bank'd stores your information

Bank'd stores personal information in Amazon Web Services in the Sydney region, Australia (ap-southeast-2).

Some of our service providers store or process personal information overseas, including in New Zealand and the United States. Where we disclose personal information overseas, we take reasonable steps required by applicable privacy laws to ensure that it is handled consistently with the Australian Privacy Principles.

Website security reports sent to Sentry and mailing-list information held by Mailchimp are processed in the United States.

The precise storage or processing locations used by certain third-party providers may depend on their infrastructure and contractual arrangements.

15. Marketing and communications

We may use your personal information to communicate with you about:

• your Bank'd account;
• important service updates;
• security matters;
• changes to products or services;
• new Bank'd features;
• educational content;
• offers and promotions; and
• products or services that may be relevant to you.

We will provide an appropriate means to opt out of direct marketing communications where required by law.

You will continue to receive important service, security and account-related communications even if you opt out of marketing.

Our child-facing content is intended primarily to support financial education, engagement and the use of Bank'd.

We do not sell or share personal information for advertising purposes, except as described in section 16 in relation to advertising technologies used on our website.

For details of our website mailing list and how to unsubscribe, see section 24 (Direct marketing and our mailing list).

16. Cookies, analytics and advertising on our website

Scope. This section applies to visitors to our website at bankd.com. The technologies described below are used on our website only. They are not used within the Bank'd app.

When you visit our website, we use cookies and similar technologies, including the following third-party tools, to understand how our website is used and to measure and improve our advertising:

Google Analytics and associated Google Ads / DoubleClick signals, provided by Google LLC, to collect information about how visitors use our website, such as pages visited, time spent on pages, referring websites, device and browser type, and approximate location.

Meta Pixel, provided by Meta Platforms, Inc., to measure the effectiveness of our advertising on Facebook and Instagram and to show relevant ads to people who have visited our website.

TikTok Pixel, provided by TikTok, to measure the effectiveness of our advertising on TikTok and to show relevant ads to people who have visited our website.

Each provider handles information in accordance with its own privacy and cookies policies, which are linked at the end of this section.

Information collected

These tools may collect information such as your IP address, cookie and device identifiers, browser and device information, the pages you visit and actions you take on our website, and the website or ad that referred you. Where you provide your name and email address on our website (for example, when you sign up for early access), we may share this information with these providers in a hashed (scrambled) form so they can match your website activity to an account you hold with them, to measure and improve our advertising. We do not share your telephone or mobile number with these providers.

Consent and control

These cookies and technologies load when you visit our website. You can control or limit them at any time by blocking or deleting cookies through your browser settings (some parts of our website may not work as intended if you do this), and by using the opt-out and advertising controls each provider offers. In particular, you can:

• install the Google Analytics opt-out browser add-on;
• adjust your ad preferences with Meta; and
• manage ad personalisation settings in your TikTok account.

Overseas disclosure

Google, Meta, TikTok and Sentry may store and process information collected through these tools outside Australia, including in the United States and other countries in which they or their service providers operate. Where we disclose personal information overseas, we take the reasonable steps required by applicable privacy laws to ensure it is handled consistently with the Australian Privacy Principles. These providers handle information in accordance with their privacy policies.

Children

Our website is intended for parents and guardians. While we cannot prevent anyone, including children, from accessing a publicly available website, we do not knowingly use these advertising technologies to target advertising to children. The analytics and advertising cookies described above operate in the same way as they do on other general websites, and are directed at understanding and improving our website and advertising rather than at children specifically. If you believe a child has provided personal information through our website, please contact us at support@bankd.com.

Other technologies and services on our website

In addition to the analytics and advertising tools above, our website uses the following third-party services, some of which may set cookies or receive your IP address when website resources or features load:

Intercom — provides our website support chat and may set cookies to operate that feature.

hCaptcha — protects our contact and register-interest forms from abuse.

Shopify — powers our online shop and checkout.

YouTube — used for embedded videos, which may set cookies when a video loads or is played.

Google Fonts — used to load website fonts; your IP address is sent to Google when those resources load.

Amazon Web Services (CloudFront and web application firewall) — hosts and protects our website; server and security logs record visitors' IP addresses.

Our website also sends security reports to Sentry, a service provided by Functional Software, Inc., so that we can detect and fix security misconfigurations on the site. When a page on our website tries to load content that does not match our website security policy, your browser may send a report to Sentry. The report contains the address (URL) of the page you visited, the address of the resource that did not match the policy, the security-policy rule involved, and your browser's user agent, and Sentry receives your IP address as part of the request. Sentry processes these reports in the United States. We use them only for website security, and not for advertising or profiling.

Provider policies

• Google Privacy Policy — policies.google.com/privacy; and how Google uses information from sites that use its services — policies.google.com/technologies/partner-sites
• Meta Privacy Policy — facebook.com/privacy/policy; Meta Cookies Policy — facebook.com/privacy/policies/cookies
• TikTok Privacy Policy — tiktok.com/legal/page/row/privacy-policy/en; TikTok Business Products (Data) Terms — ads.tiktok.com/i18n/official/policy/business-products-terms
• Intercom Privacy Policy — intercom.com/legal/privacy
• hCaptcha Privacy Policy — hcaptcha.com/privacy
• Shopify Privacy Policy — shopify.com/legal/privacy
• YouTube / Google Privacy Policy — policies.google.com/privacy
• Google Fonts — developers.google.com/fonts/faq/privacy
• Amazon Web Services Privacy Notice — aws.amazon.com/privacy
• Mailchimp - intuit.com/privacy.
• Sentry Privacy Policy — sentry.io/privacy/

Where required, we will obtain appropriate consent for cookies or similar technologies.

17. Security

We take reasonable steps to protect personal information from:

• misuse;
• interference;
• loss;
• unauthorised access;
• modification; and
• unauthorised disclosure.

Depending on the nature of the information, our security measures may include:

• encryption at rest;
• encryption in transit;
• tokenisation;
• hashing of sensitive credentials;
• masking of card and account numbers;
• access controls;
• authentication;
• monitoring;
• logging;
• security testing;
• network protections;
• staff access restrictions; and
• security procedures for our service providers.

Personal information held within Bank'd's AWS backend is encrypted at rest. Sensitive card credentials such as PAN, CVV and PIN are not stored in Bank'd's systems, while other sensitive values are tokenised, hashed or masked as described in this Privacy Policy.

No method of electronic storage or transmission is completely secure. Accordingly, while we take reasonable steps to protect information, we cannot guarantee that information will always be completely secure.

18. How long we retain information

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including to:

• provide our services;
• maintain appropriate business and financial records;
• comply with legal and regulatory obligations;
• resolve disputes;
• investigate fraud or security incidents; and
• enforce our agreements.

Identity, verification and financial records are retained for seven years, as required by applicable Australian financial record-keeping laws.

When an account is deleted, we remove or de-identify personal information that we are not legally required to retain.

How to request account deletion

See our account-deletion guide for step-by-step instructions, including how to request deletion without signing in or reinstalling the app.

You can request deletion of your account and personal information at any time by using the account-deletion option in the Bank'd app, or by emailing us at support@bankd.com with the subject “Bank'd Account Deletion Request”. Please include the account email address and whether the request relates to the parent account, a child profile, or both. We may need to verify your identity or parental authority before processing the request. When we delete an account, we remove or de-identify personal information that we are not required by law to retain (see the retention periods above).

19. Accessing and correcting your information

You may request access to personal information we hold about you.

You may also request that we correct information that is inaccurate, incomplete or out of date.

Requests can be made by contacting us using the details below.

We may need to verify your identity before processing an access or correction request.

In some circumstances, we may be unable to provide access to particular information where an exception under applicable privacy law applies.

20. Privacy requests relating to children

Where a request relates to a child's personal information, we may need to establish:

• the identity of the person making the request;
• their relationship with the child; and
• whether they are authorised to make the request.

This is particularly important where providing access to information could affect the privacy or safety of a child or another person.

21. Data breaches

We maintain processes designed to identify, investigate and respond to suspected data breaches.

Where an eligible data breach occurs, we will comply with our obligations under the Privacy Act 1988 (Cth), including the Notifiable Data Breaches scheme where applicable.

22. Complaints

If you believe we have mishandled your personal information or have otherwise breached applicable privacy laws, please contact us first so that we can investigate and attempt to resolve your complaint.

Privacy Officer

Kids Money App Pty Ltd trading as Bank'd

Email: support@bankd.com

We will acknowledge and investigate privacy complaints within a reasonable period.

If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC).

23. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect:

• changes to our products or services;
• changes to how we handle personal information;
• changes to our service providers;
• changes to applicable laws; or
• improvements to our privacy practices.

The latest version will be published on the Bank'd website.

Where required, we will provide additional notice of material changes.

24. Direct marketing and our mailing list

You can choose to join our mailing list by submitting the register-interest form on our website. The text next to the form's submit button makes clear that, by submitting it, you are subscribing to our mailing list.

Submitting an enquiry through our website contact form does not add you to our mailing list — the contact form is used only to respond to your enquiry.

When you submit the register-interest form, Bank'd receives the information you enter through our website and sends it to Mailchimp, our email marketing provider. This includes your name and email address, and — where you choose to provide them — whether you are a parent, a teacher or school, or other; how many children you have; and any question or message you choose to include.

For a new registration, Mailchimp will email you a link to confirm your subscription before you become a subscribed member of our mailing list. When you open Mailchimp's confirmation pages, Mailchimp also receives technical information sent by your browser, such as your IP address. Mailchimp records delivery and engagement information for the emails we send, such as whether an email was opened and which links were clicked.

Mailchimp stores and processes this information on our behalf for the purpose of managing our mailing list and sending you communications. Mailchimp may store or process information outside Australia, including in the United States. Mailchimp handles personal information in accordance with its own privacy policy, available at intuit.com/privacy (Mailchimp is an Intuit company).

You can unsubscribe from our mailing list at any time using the unsubscribe link in any marketing email, or by contacting us at support@bankd.com.

25. Contact us

If you have any questions about this Privacy Policy or how Bank'd handles personal information, please contact:

Kids Money App Pty Ltd — AKA Bank'd

Email: support@bankd.com

Website: https://bankd.com

Postal address: PO Box 5053 Gold Coast MC, QLD 9726