Privacy Policy

Table of Contents
 

1. ​Introduction

2. Scope and Application

3. Definitions

4. Our Role and Your Data Controller

5. Personal Information We Collect

6. How We Collect Personal Information

7. How We Use Personal Information

8. Legal Bases for Processing (International Users)

9. How We Share and Disclose Personal Information

10. International Data Transfers

11. Aggregated and De-Identified Data

12. Data Security

13. Data Retention

14. Your Privacy Rights

15. Cookies and Tracking Technologies

16. Third-Party Links and Services

17. Children's Privacy

18. Data Breach Notification

19. Changes to This Privacy Policy

20. Jurisdiction-Specific Information

1. Introduction
MoneyMind Profile Pty Ltd ABN 33 672 152 073 ("MoneyMind Profile," "we," "us," or "our") values the privacy of everyone who visits our website and uses our software and services. We are committed to protecting your Personal Information and being transparent about our data practices.

This Privacy Policy explains:

• What Personal Information we collect and why

• How we use, share, and protect that information

• Your rights regarding your Personal Information

• How to contact us with privacy questions or concerns

​

We operate globally, serving customers in Australia, the United Kingdom, and the United States. This Privacy Policy is designed to comply with applicable data protection laws in all jurisdictions where we operate, including:

• Australia: Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs)

• United Kingdom: UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018

• United States: California Consumer Privacy Act (CCPA/CPRA), Virginia Consumer Data Protection Act (VCDPA), Colorado Privacy Act (CPA), and other applicable state privacy laws

2. Scope and Application

2.1 What This Policy Covers
This Privacy Policy applies to Personal Information we collect, use, and disclose when you:

• Visit our websites (including www.moneymindprofile.com and related domains)

• Use our MoneyMind Profile software and services ("Services")

• Communicate with us via email, phone, chat, or other channels

• Attend our events, webinars, or training sessions

• Enter into a business relationship with us

2.2 Our Business Model
We provide MoneyMind Profile software and related support services to organizations such as financial advisory firms, wealth management companies, and individual financial advisers ("Customers" or "Subscribing Organizations"). These Customers use our Services to:

• Conduct behaviour profiling of their clients

• Perform risk profile analysis

• Generate financial planning reports

• Manage client relationships and advisory workflows

​

2.3 Important Distinction: Controller vs. Processor

When We Are a Data Processor (Service Provider):
When a Subscribing Organization (Customer) uses our Services to process Personal Information about their clients (End-Users), that organization is the data controller (under GDPR/UK GDPR) or business (under CCPA) of that Personal Information. We act as a data processor (or service provider) on their behalf.
In this capacity:

• The Subscribing Organization determines what Personal Information is collected and how it is used

• The Subscribing Organization's privacy policy applies to their clients

• We process End-User Personal Information only on the Subscribing Organization's documented instructions

• End-Users should contact the relevant Subscribing Organization regarding their Personal Information

​

When We Are a Data Controller (Business):
We act as a data controller (or business) for:

• Personal Information of our Customers (Subscribing Organizations and their authorized users)

• Website visitors

• Newsletter subscribers

• Event attendees

• Marketing contacts

• Prospective customers

2.4 Who This Policy Does NOT Cover
If you are a client (End-User) of a financial advisor, fund provider, or organization that uses our Services, your Personal Information is controlled by that organization, not by us. Their privacy policy governs how they collect, use, and share your Personal Information. We only process your information on their behalf according to their instructions.
Please contact your financial advisor or the relevant organization for questions about how they handle your Personal Information.

​

3. Definitions
For purposes of this Privacy Policy:

"Applicable Data Protection Laws" means all applicable data protection and privacy laws, including: (i) in Australia, the Privacy Act 1988 (Cth) and the Australian Privacy Principles; (ii) in the United Kingdom, the UK GDPR and the Data Protection Act 2018; (iii) in the United States, the CCPA (as amended by the CPRA), VCDPA, CPA, and other applicable state privacy laws; and (iv) any other applicable data protection or privacy laws.

"Controller" (or "Business" under US laws) means the entity that determines the purposes and means of processing Personal Information.

"Customer" or "Subscribing Organization"** means the financial advisory firm, wealth management company, or individual financial advisor that subscribes to our Services.

"Data Subject" (or "Consumer" under US laws) means an identified or identifiable natural person whose Personal Information is processed.

"End-User" means a client of a Subscribing Organization whose Personal Information may be processed through our Services.
"Personal Information" (or "Personal Data") means any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with an identified or identifiable natural person. This includes information defined as "personal information" under the Privacy Act 1988 (Cth), "personal data" under the UK GDPR, and "personal information" under the CCPA.

"Processing" means any operation performed on Personal Information, including collection, recording, organization, structuring, storage, adaptation, retrieval, consultation, use, disclosure, transmission, erasure, or destruction.

"Processor" (or "Service Provider" under US laws) means an entity that processes Personal Information on behalf of a Controller.

"Sensitive Personal Information" includes information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health information, sex life or sexual orientation, and in some jurisdictions, financial account information, Social Security numbers, precise geolocation, and contents of communications.

"Services" means our MoneyMind Profile software platform, applications, tools, features, and related services.

​

4. Our Role and Your Data Controller
4.1 When We Control Your Personal Information
We are the data controller (or business) for:
Customer Personnel: If you work for a Subscribing Organization and use our Services in your professional capacity (as a financial advisor, administrator, or other authorized user), we control Personal Information credentials as described in this Privacy Policy.
Direct Contacts: If you interact with us directly (as a website visitor, newsletter subscriber, event attendee, prospective customer, or business contact), we control your Personal Information.

4.2 When We Process on Behalf of Others
When Subscribing Organizations use our Services to process their clients' Personal Information, we act as a processor (or service provider).

In this role:

• We process Personal Information only on the Subscribing Organization's documented instructions

• We do not use End-User Personal Information for our own purposes

• The Subscribing Organization remains responsible for compliance with privacy laws regarding their clients

• End-Users should exercise their privacy rights through the Subscribing Organization

​

4.3 Contact Your Financial Adviser
If you are a client of a financial adviser using our Services: Your financial adviser or the organization they work for is responsible for your Personal Information. Please contact them directly regarding:

• What Personal Information they collect about you

• How they use your information

• Your rights to access, correct, or delete your information

• Their privacy practices and policies

We cannot directly respond to privacy requests from End-Users as we process this information only on behalf of the Subscribing Organization.

5. Personal Information We Collect
The Personal Information we collect depends on how you interact with us and the Services you use.
5.1 Information We Collect About Customer Personnel
When you register for an account, use our Services, or interact with us as a representative of a Subscribing Organization, we may collect:

Identity and Contact Information:

• Full name

• Email address

• Phone number

• Business address

• Job title and role

• Professional credentials and licenses

• Organization/firm name

​

Account and Authentication Information:

• Username and account ID

• Password (stored in encrypted/hashed form)

• Security questions and answers

• Multi-factor authentication credentials

• Professional Information:

• Professional licenses and registrations

• Areas of specialization

• Years of experience

• Professional association memberships

​

Usage and Activity Information:

• Login history and session data

• Features and services accessed

• Content created, uploaded, or modified

• Search queries and navigation patterns

• Device information (IP address, browser type, operating system, device identifiers)

• Time stamps and duration of use

​

Communications:

• Support requests and help desk interactions

• Chat messages and correspondence

• Feedback and survey responses

• Training and webinar participation

​

Financial and Billing Information:

• Billing name and address

• Payment method details (processed and stored by our third-party payment processor; we do not store full credit card numbers)

• Purchase history and transaction records

• Subscription plan details

​

End-User Information You Input:

• When you use our Services to profile your clients, you input information about them (names, dates of birth, financial information, risk tolerance responses, etc.). This information is controlled by you (the Subscribing Organization), and we process it only as your processor. See Section 4.2.

​

5.2 Information We Collect From Website Visitors
When you visit our website, we may collect:

Automatically Collected Information:

• IP address and approximate geolocation

• Browser type and version

• Operating system

• Referring website

• Pages visited and time spent

• Links clicked

• Device identifiers

​

Information You Provide:

• Contact form submissions

• Newsletter subscriptions

• Demo or trial requests

• Event registrations

• Cookie preferences

​

5.3 Information From Third Parties
We may receive Personal Information from:

Service Providers and Integration Partners:

• Payment processors (billing information)

• Analytics providers (usage data)

• Customer relationship management platforms

• Marketing and communication platforms

• Financial advice platforms

• Identity verification services

​

Publicly Available Sources:

• Professional licensing databases

• Business directories

• LinkedIn and other professional networks

• Regulatory registers

​

Subscribing Organizations:

• If your employer or firm subscribes to our Services, they may provide your information to set up your account

​

5.4 Sensitive Personal Information
Important: Our Services are designed to minimize the collection of Sensitive Personal Information. However, we acknowledge that:

• Financial advisors using our Services may input Sensitive Personal Information about their clients (financial information, questionnaire information, information revealing racial or ethnic origin in demographic data, etc.)

• When Subscribing Organizations input such information, they remain the controller and are responsible for obtaining appropriate consents and complying with applicable laws

• We process this information only as a processor on their behalf

We do not require or request Sensitive Personal Information from Customer personnel. If you choose to provide Sensitive Personal Information to us, you consent to our processing of that information for the purposes described in this Privacy Policy and in accordance with Applicable Data Protection Laws.

​

6. How We Collect Personal Information
We collect Personal Information through the following methods:

6.1 Direct Collection
When You Provide It to Us:

• Registration and account creation

• Using our Services and entering data

• Completing forms, questionnaires, or surveys

• Communicating with our support team

• Subscribing to newsletters or marketing

• Attending events or webinars

• Applying for employment or contractor positions

6.2 Automatic Collection
Through Technologies:

• Cookies and similar tracking technologies (see Section 15)

• Web server logs

• Analytics tools

• Session recording for quality assurance and training (with notice)

​

6.3 Third-Party Sources
From Service Providers:

• Payment processors

• Analytics and monitoring services

• Marketing platforms

• CRM systems

• Identity verification providers

From Subscribing Organizations:

• When they set up user accounts for their personnel

• When they provide contact information for billing or support

​

From Publicly Available Sources:

• Professional licensing registers

• Business contact databases

• Company websites and directories

6.4 Anonymous and Pseudonymous Use
Website: You may visit our website anonymously. However, certain features and interactive elements may not be available without providing some Personal Information.

Services: Due to the nature of our Services (which require secure authentication and personalized functionality), anonymous use is not practical. You may use a pseudonym for certain communications, where lawful and practicable.

​

7. How We Use Personal Information
We use Personal Information for the purposes described below and only where we have a lawful basis to do so (see Section 8).

7.1 To Provide and Maintain the Services

• Creating and managing user accounts

• Authenticating users and preventing unauthorized access

• Providing access to features and functionality

• Processing and storing data you input

• Generating reports and outputs

• Providing customer support and technical assistance

• Troubleshooting and resolving issues

• Performing backups and ensuring business continuity

​

7.2 To Improve and Develop the Services

• Understanding how users interact with our Services

• Analyzing usage patterns and trends

• Identifying areas for improvement

• Developing new features and functionality

• Conducting research and analytics

• Testing new products and beta features

• Benchmarking performance and reliability

7.3 For Business Operations

• Processing payments and managing subscriptions

• Maintaining internal records

• Performing accounting, auditing, and financial analysis

• Managing vendor and service provider relationships

• Conducting due diligence for business transactions

• Protecting our business interests and enforcing our rights

​

7.4 For Communication and Marketing

• Sending transactional emails (account notifications, service/feature updates, billing statements)

• Providing customer support via email, phone, or chat

• Sending newsletters and marketing communications (with consent where required)

• Inviting you to events, webinars, and training sessions

• Conducting surveys and requesting feedback

• Sharing product updates and feature announcements

• You may opt out of marketing communications at any time using the unsubscribe link in emails or by contacting us.

7.5 For Security and Fraud Prevention

• Detecting and preventing fraud, abuse, and unauthorized access

• Investigating security incidents and policy violations

• Monitoring for malicious activity and threats

• Maintaining the security and integrity of our systems

• Enforcing our Terms of Use and Acceptable Use Policy

• Protecting against legal liability

​

7.6 For Compliance and Legal Obligations

• Complying with applicable laws, regulations, and legal process

• Responding to lawful requests from authorities

• Defending legal claims and protecting legal rights

• Maintaining records as required by law

• Conducting internal audits and compliance reviews

• Meeting regulatory reporting obligations

​

7.7 With Your Consent
Where required by applicable law, we will obtain your consent before using Personal Information for purposes not covered above.

​

8. Legal Bases for Processing (International Users)
For users in jurisdictions requiring a legal basis for processing (such as the UK and EU under GDPR), we rely on the following legal bases:

8.1 Contract Performance

• We process Personal Information to perform our contract with you or the Subscribing Organization, including:

• Providing access to the Services

• Delivering customer support

• Processing payments

​

8.2 Legitimate Interests
We process Personal Information for our legitimate business interests, including:

• Improving and developing the Services

• Conducting marketing and business development

• Preventing fraud and enhancing security

• Analyzing usage and performance

• Managing business operations

• We conduct balancing tests to ensure our legitimate interests do not override your rights and interests.

8.3 Legal Obligations

We process Personal Information to comply with legal and regulatory obligations, including:

• Responding to lawful requests

• Meeting record-keeping requirements

• Complying with tax and financial regulations

​

8.4 Consent
Where required or appropriate, we process Personal Information based on your consent, including:

• Marketing communications (where consent is required)

• Certain cookie uses

• Processing Sensitive Personal Information (where applicable)

You may withdraw consent at any time without affecting the lawfulness of processing based on consent before withdrawal.

8.5 Vital Interests
In rare circumstances, we may process Personal Information to protect vital interests (yours or another person's), such as in emergency situations.

​

9. How We Share and Disclose Personal Information
We do not sell, rent, or lease Personal Information to third parties. We share Personal Information only as described below.

9.1 Service Providers and Subprocessors
We engage trusted third-party service providers to perform functions on our behalf, including:

Infrastructure and Hosting:

• Cloud hosting providers (data centers and servers)

• Content delivery networks

• Data backup and disaster recovery services

• Payment Processing:

• Payment gateways and processors

• Billing and invoicing platforms

​

Communication and Support:

• Email delivery services

• Chat and messaging platforms

• Customer relationship management systems

• Help desk and ticketing systems

​

Analytics and Performance:

• Website and application analytics

• Performance monitoring and error tracking

• User behavior analysis

Security and Fraud Prevention:

• Identity verification services

• Fraud detection and prevention tools

• Security monitoring services

• Marketing and Outreach:

• Email marketing platforms

• Event management systems

• Webinar and video conferencing tools

​

All service providers are bound by contractual obligations to:

• Use Personal Information only for the specified purposes

• Implement appropriate security measures

• Comply with Applicable Data Protection Laws

• Not use Personal Information for their own purposes

A list of our key subprocessors is available on our website at www.moneymindprofile.com.

9.2 Within the MoneyMind Profile Organization
We may share Personal Information among MoneyMind Profile entities and affiliates for:

• Internal administration and reporting

• Customer support and service delivery

• Business operations and management

• Product development and improvement

All internal sharing is subject to appropriate data protection safeguards.

9.3 Business Transfers
If we are involved in a merger, acquisition, asset sale, reorganization, bankruptcy, or similar transaction, Personal Information may be transferred as part of that transaction.

We will:

• Provide notice before Personal Information is transferred

• Ensure the receiving party maintains protections at least as protective as this Privacy Policy

• Provide you with choices regarding the use of your Personal Information

9.4 Legal and Regulatory Requirements
We may disclose Personal Information when required or permitted by law, including:

To Comply with Legal Obligations:

• Court orders, subpoenas, or other legal process

• Regulatory investigations and examinations

• Tax authorities and financial regulators

• Law enforcement requests (where lawful)

To Protect Rights and Interests:

• Defending legal claims

• Enforcing our Terms of Use and policies

• Protecting against fraud, abuse, or illegal activity

• Safeguarding the security and integrity of our Services

• Protecting the safety of individuals

​

With Your Consent or Direction:

• When you authorize us to share your information

• When you direct us to integrate with third-party services

• When you participate in co-sponsored events or programs

• We will notify you of legal requests for your Personal Information unless prohibited by law or where notice would be counterproductive.

9.5 Aggregated and De-Identified Information
We may share aggregated, anonymized, or de-identified information that cannot reasonably be used to identify a "Customer" or "Subscribing Organization", or "End-User" including:

• Questionnaire data

• Statistical data and research findings

• Industry benchmarks and trends

• Usage analytics and performance metrics

Such information is not Personal Information and is not subject to this Privacy Policy.

9.6 No Sale of Personal Information
Important: We do not sell Personal Information. Under California law (CCPA), "sale" has a broad meaning that includes sharing for monetary or other valuable consideration. We do not engage in such activities.

​

10. International Data Transfers
10.1 Global Operations
MoneyMind Profile operates globally and may transfer Personal Information to countries other than where you are located, including:

• Australia (where our primary operations are based)

• United States (where our cloud hosting infrastructure is located)

• United Kingdom (where we maintain offices)

• Other countries where our service providers operate

10.2 Adequacy Decisions
Where possible, we transfer Personal Information to countries recognized as providing adequate protection:

• The European Commission has recognized certain countries (including the UK, post-Brexit) as providing adequate protection for personal data

• Australia is recognized under the EU-Australia adequacy decision

​

10.3 Safeguards for International Transfers
When transferring Personal Information to countries not recognized as providing adequate protection, we implement appropriate safeguards, including:

• Standard Contractual Clauses (SCCs):

• We use the European Commission's Standard Contractual Clauses for transfers from the EU/EEA

• We use the UK International Data Transfer Agreement (IDTA) or Addendum for transfers from the UK

• These clauses provide contractual protections for your Personal Information

​

Binding Corporate Rules:

As we expand, we may implement Binding Corporate Rules for intra-group transfers

Supplementary Measures:

• Encryption in transit and at rest

• Strict access controls and authentication

• Regular security assessments

• Data minimization practices

​

10.4 Your Consent
By using our Services or providing Personal Information, you acknowledge and consent (where required by law) to the transfer of your Personal Information to countries that may have different data protection laws than your country of residence.

10.5 Data Localization
For some Subscribing Organizations, particularly those in highly regulated industries or jurisdictions, we may offer options to:

• Store data in specific geographic regions

• Limit cross-border transfers

• Implement additional security and access controls

Please contact us to discuss data localization options.

​

11. Aggregated and De-Identified Data
11.1 Our Use of Aggregated Data
We create aggregated, anonymized, and de-identified data from "Customer" or "Subscribing Organization", or "End-User" Information to:

• Improve the Services and develop new features

• Conduct research and analytics

• Generate industry insights and benchmarks

• Produce statistical reports and trends

• Enhance our algorithms and risk assessment models

​

11.2 De-Identification Process
When we aggregate and de-identify data:

• We remove all direct identifiers (names, email addresses, account IDs)

• We apply statistical techniques to prevent re-identification

• We ensure the data cannot reasonably be linked back to individuals

• We combine data from multiple users to prevent identification

• We apply our Data Aggregation and De-Identification Policy.

​

11.3 Ownership and Use
Aggregated Data created from End-User information (clients of Subscribing Organizations):

• We may create aggregated data in accordance with our Data Processing Agreement

• Such data is fully de-identified and cannot identify individual End-Users

• We may use and license this aggregated data for our business purposes

• This use is disclosed to Subscribing Organizations in our Terms of Use

​

Aggregated Data created from Customer personnel information:

• We may create aggregated usage analytics and benchmarks

• Such data helps us improve the Services and identify trends

• This data is fully anonymized and cannot identify individuals or organizations

​

11.4 No Re-Identification

• We commit to not attempting to re-identify aggregated or de-identified data and to implementing measures to prevent others from doing so.

12. Data Security
12.1 Our Commitment to Security

• We take data security seriously and implement comprehensive administrative, technical, and physical safeguards to protect Personal Information against unauthorized access, use, disclosure, alteration, or destruction.

12.2 Technical Safeguards
Encryption:

• Data in transit is encrypted using Transport Layer Security (TLS 1.2 or higher)

• Data at rest is encrypted using industry-standard encryption algorithms

• Database encryption protects stored information

• Password storage uses strong cryptographic hashing

​

Access Controls:

• Multi-factor authentication (MFA) for user access

• Role-based access controls (RBAC) limiting access to authorized personnel

• Least privilege principle (users have only necessary access)

• Regular access reviews and revocations

• Secure API authentication and authorization

​

Network Security:

• Firewalls and intrusion detection/prevention systems

• Network segmentation and isolation

• DDoS protection and mitigation

• Regular security patching and updates

• Vulnerability scanning and penetration testing

​

Application Security:

• Secure software development lifecycle (SDLC)

• Code reviews and security testing

• Input validation and sanitization

• Protection against common vulnerabilities (OWASP Top 10)

• Security headers and configurations

​

12.3 Administrative Safeguards
Policies and Procedures:

• Comprehensive information security policies

• Data classification and handling procedures

• Incident response and disaster recovery plans

• Vendor management and due diligence

• Regular policy reviews and updates

Personnel:

• Background checks for employees with access to Personal Information

• Confidentiality and non-disclosure agreements

• Security awareness training and education

• Clear roles and responsibilities

• Separation of duties

​

Monitoring and Auditing:

• Security information and event management (SIEM)

• Log monitoring and analysis

• Regular security assessments and audits

• Third-party security certifications (SOC 2, ISO 27001 in progress)

• Continuous compliance monitoring

​

12.4 Physical Safeguards
Data Centers:

• Our infrastructure is hosted in secure, certified data centers

• Physical access controls and monitoring

• Environmental controls (fire suppression, climate control)

• Redundant power and network connectivity

• 24/7 security monitoring

​

Office Security:

• Secured office facilities with access controls

• Visitor management and escort policies

• Secure disposal of physical media

• Clean desk and screen lock policies

​

12.5 Your Responsibilities
While we implement robust security measures, security is a shared responsibility. We encourage you to:

• Use strong, unique passwords

• Enable multi-factor authentication

• Keep login credentials confidential

• Log out when finished using the Services

• Report suspicious activity immediately

• Keep your devices and software up to date

• Use secure networks when accessing the Services

• Be cautious of phishing attempts

​

12.6 No Absolute Security
Despite our efforts, no security measures are perfect or impenetrable. We cannot guarantee absolute security of Personal Information. Internet transmissions are never completely private or secure, and any information you transmit may be intercepted by others.

12.7 Security Incidents
In the event of a data breach or security incident affecting Personal Information, we will:

• Promptly investigate and contain the incident

• Notify affected individuals as required by applicable law

• Notify relevant regulatory authorities

• Take steps to prevent recurrence

• Cooperate with investigations

See Section 18 for more details on data breach notification.

​

13. Data Retention
13.1 Retention Principles
We retain Personal Information only for as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, resolve disputes, and enforce our agreements.

13.2 Retention Periods
Customer Account Information:

• Active accounts: For the duration of your subscription plus up to 30 days after termination (to allow for reactivation)

• Terminated accounts: Deleted or anonymized within 30 days of subscription termination, unless longer retention is required by law

• Backup copies: Retained for an additional 90 days in backup systems, then permanently deleted

​

End-User Information (Processed as Processor):

• Controlled by the Subscribing Organization

• Retained according to the Subscribing Organization's instructions

• Deleted or returned upon subscription termination as directed by the Subscribing Organization

• Subscribing Organizations are responsible for their own retention policies and legal obligations

​

Financial and Transaction Records:

• Billing and payment information: Retained for 7 years to comply with tax and accounting requirements

• Invoice records: Retained for 7 years

​

Communications and Support:

• Support tickets and correspondence: Retained for 3 years

• Chat logs: Retained for 1 year

• Marketing communications: Until you unsubscribe, then deleted within 30 days

​

Website Analytics and Logs:

• Server logs: Retained for 90 days

• Analytics data: Aggregated and anonymized data may be retained indefinitely

Legal and Compliance:

• Records required by law: Retained for the period required by applicable law

• Litigation hold: Personal Information relevant to legal proceedings retained until matter resolution

13.3 Secure Deletion
When Personal Information is no longer needed:

• We delete it from production systems

• We overwrite or degauss physical media

• We ensure backups are purged according to retention schedules

• We use secure deletion methods to prevent recovery

​

13.4 Requesting Deletion
You may request deletion of your Personal Information at any time (see Section 14). We will honor such requests subject to:

• Legal obligations requiring retention

• Legitimate business needs (e.g., fraud prevention)

• Technical limitations (e.g., backup retention cycles)

13.5 Exceptions
We may retain Personal Information longer than standard retention periods when:

• Required by applicable law or regulation

• Necessary for legal claims or disputes

• Needed for audit or compliance purposes

• Subject to a litigation hold or investigation

• Required to protect rights, property, or safety

14. Your Privacy Rights
Depending on your jurisdiction, you may have various rights regarding your Personal Information. We respect these rights and provide mechanisms to exercise them.

14.1 Rights Under Australian Privacy Law
If you are in Australia, you have the right to:

• Access: Request access to the Personal Information we hold about you. We will provide access unless an exception applies under the Privacy Act.

• Correction: Request correction of inaccurate, outdated, incomplete, or misleading Personal Information.

• Complaints: Lodge a complaint with us about our handling of your Personal Information. We will investigate and respond to complaints in accordance with the APPs.

14.2 Rights Under UK GDPR
If you are in the UK or EU, you have the right to:

• Access: Request a copy of the Personal Data we process about you (subject access request).

• Rectification: Request correction of inaccurate or incomplete Personal Data.

• Erasure: Request deletion of your Personal Data in certain circumstances (right to be forgotten).

• Restriction: Request that we restrict processing of your Personal Data in certain circumstances.

• Portability: Request to receive your Personal Data in a structured, commonly used, machine-readable format and transmit it to another controller.

• Object: Object to processing based on legitimate interests or for direct marketing purposes.

• Automated Decision-Making: Not be subject to decisions based solely on automated processing that produce legal or similarly significant effects (our Services do not make fully automated decisions with such effects).

• Withdraw Consent: Where processing is based on consent, withdraw that consent at any time.

• Complain: Lodge a complaint with a supervisory authority (Information Commissioner's Office in the UK).

14.3 Rights Under US Privacy Laws (CCPA, VCDPA, CPA, etc.)
If you are in California, Virginia, Colorado, or another state with consumer privacy rights, you have the right to:

• Know: Request information about the categories and specific pieces of Personal Information we collect, use, disclose, and sell (if applicable) about you.

• Delete: Request deletion of your Personal Information, subject to certain exceptions.

• Correct: Request correction of inaccurate Personal Information (in some states).

• Opt-Out: Opt out of the "sale" or "sharing" of Personal Information (note: we do not sell or share Personal Information as defined by these laws).

• Limit Use of Sensitive Personal Information: Limit the use of Sensitive Personal Information to certain permitted purposes (in some states).

• Non-Discrimination: Not receive discriminatory treatment for exercising your privacy rights.

• Authorized Agent: Designate an authorized agent to make requests on your behalf.

• Appeal: Appeal our decision regarding your privacy request (in some states).

14.4 How to Exercise Your Rights
To exercise any of these rights, please contact us using:

Email: support@moneymindprofile.com​​