Privacy policy

1. About this policy

MailStreet is operated by Dee Bee Vee Pty Ltd, ABN 53 642 651 590 (“we”, “us”). This policy explains how we handle personal information in running MailStreet: our website, sign-up, customer dashboard, mail handling, Nameplate and meeting room services.

We follow the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth). As a business that verifies its customers under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) (the AML/CTF Act), we also handle some information because that law requires us to. This policy is organised around the APPs, so you can see how each one applies to us.

“Personal information” means information or an opinion about an identified individual, or an individual who is reasonably identifiable. Much of our work is with businesses, but businesses are run by people: sole traders, directors, owners, trustees, partners and their staff. This policy covers them.

2. What we collect

Depending on how you deal with us, we may collect:

• Contact and account details: name, email address, mobile number, login details, two-factor authentication settings, alert preferences, and the team members you add.
• Business details: ABN, ACN, entity type and name, trading names, GST status, ASIC company extracts (including directors, shareholders and their addresses as recorded by ASIC), trust deeds (which can name beneficiaries, sometimes including children, and other family details), partnership agreements, and the names you want mail accepted for. Only our compliance staff open trust deeds and extracts, and every view is logged.
• Identity information for each person we verify: full legal name, date of birth, residential address, role in the business, ownership band, images of identity documents (such as a driver licence or passport) and the details on them, including document numbers.
• Biometric information: a selfie and a short liveness capture, and the face-matching data made from them (see the next section).
• Screening results: whether a person matches sanctions lists, lists of politically exposed persons (PEPs) or adverse media, and our assessment of the risk.
• Your use of the address: your declared uses (registered office, principal place of business, mailing), your actual operating address, the nature of your business and expected mail volume, and the declarations you make at sign-up.
• Mail information: a photo of the outside of every item we receive for you (which shows the sender and the addressee), the sender, date, type, weight, what you asked us to do with it, and a log of every action. If you ask us to scan an item, we also hold the scanned contents, which can include anything the sender put in it.
• Forwarding and collection details: forwarding addresses, tracking numbers, the name of whoever collects an item and the fact that we sighted their photo ID.
• Nameplate and meeting room details: your logo artwork, bookings, and the names of clients or guests you tell us are coming.
• Payment details: billing name and address, invoices and payment history. Card details are collected and held by our payment provider, Stripe. We see only limited details, such as the card type, last four digits and expiry date.
• Communications: emails and messages you send us, and our notes of calls.
• Technical information: IP address, device and browser type, pages visited, and security and audit logs of actions in your account.

We never ask for your tax file number. We don’t use government identifiers, such as a driver licence or passport number, as our own way of identifying you.

3. Biometric and other sensitive information

Some of what we collect is sensitive information under the Privacy Act, which gets extra protection:

• Biometric information. To confirm that you are the person in your ID document, our identity verification provider, Didit, captures a selfie and a liveness check and compares your face to the photo on your document. We collect this only with your consent, which we ask for separately just before the check starts. You can choose not to give consent, but we then can’t verify you online. Contact us to discuss other options.
• Screening results. PEP and sanctions screening can reveal information about a person’s political roles or associations, and adverse media checks can reveal information about criminal matters. We collect this because the AML/CTF Act requires us to screen customers, or with your consent.
• Mail contents. We don’t ask for sensitive information in your mail, but a letter you ask us to scan might contain some (for example, health or financial information). We handle every scan as confidential.

Where available, Didit also checks your identity document against the issuing government’s records using the Australian Government’s Document Verification Service. This happens only with your express consent.

4. How we collect it

• From you directly: when you sign up, use your dashboard, email us, visit or collect mail.
• From Didit, when you complete an identity check through its secure hosted flow.
• From public registers: the ABR (through ABN Lookup) and ASIC (current company extracts, bought on ASIC’s website).
• From the person who signs your business up, who gives us the names and emails of others we must verify.
• From people who send you mail, through what’s written on and in the items.
• From Stripe, about the status of payments.
• Automatically, through our website and dashboard (see cookies and analytics).

If we receive personal information we didn’t ask for, we check whether we could have collected it under this policy. If not, we destroy or de-identify it where it’s lawful and reasonable to do so. For example, mail addressed to someone not on any account is returned to the sender unopened.

5. Information about other people

If you give us information about someone else, such as a director, owner, trustee, partner, team member or guest, please make sure they know you’re doing so and point them to this policy. When we ask another person to verify their identity, we email them their own secure link, explaining who asked, why, and where to find this policy. Other people on an account see only whether each person’s check is complete, never their ID images or screening results.

6. Why we collect, use and disclose it

We collect, use and disclose personal information to:

• Meet our legal obligations, including customer due diligence, ongoing monitoring, record keeping and reporting under the AML/CTF Act, and our obligations under tax and corporations law.
• Provide the service: release your address, issue your address confirmation and occupier’s consent letter, receive and sort mail, notify you, scan, shred, forward and hand over items, run Nameplate and the meeting room, and provide support.
• Bill you and manage payments, refunds and failed payments.
• Keep things secure: protect your account, prevent fraud and misuse of our address, and enforce our terms and acceptable use policy.
• Run and improve our business: understand how the site and service are used, fix problems, and get professional advice.

We use and disclose information for another purpose only if you’d reasonably expect it and it’s related to these purposes (directly related, for sensitive information), if you consent, or if the law requires or allows it.

We don’t sell personal information, and we don’t use your mail or its contents for marketing.

7. Automated decisions

Some decisions that significantly affect you are made, or partly made, by computer programs using your personal information:

• Identity checks. Didit’s software reads your ID document, checks it for signs of tampering, checks liveness and compares your face to the document photo, and returns a pass, fail or “needs review” result.
• Screening and risk scoring. Software checks names against sanctions, PEP and adverse media lists, and our system gives each application a risk rating using rules such as entity type, company age, ownership structure, operating address and the results of the other checks.
• Approval. Applications that pass every check with a low risk rating are approved automatically. Anything else goes to a person on our team, who makes the decision. We may also automatically decline an application where a check fails outright or the checks aren’t completed within 14 days.
• Monitoring. Our systems re-screen customers daily and flag unusual mail patterns, such as large volumes of returned mail, for a person to review.

If you think an automated result is wrong, contact us. A person will review it, and you can give us more information.

8. Can I deal with you anonymously?

You can browse our website and ask general questions without telling us who you are, or using a pseudonym. To become a customer, you must identify yourself: the AML/CTF Act requires us to verify the people behind each business using our address, and we can’t provide the service anonymously.

9. Who we share it with

We share personal information only as needed, with:

We may also disclose personal information:

• to AUSTRAC, law enforcement agencies, courts and other government bodies, where the law requires or allows it, including suspicious matter reports under the AML/CTF Act (which the law stops us telling you about);
• to ASIC or the ABR, if you keep using our address after your plan ends (see our terms);
• to our professional advisers, such as lawyers, accountants, auditors and our AML/CTF adviser;
• to someone you authorise, such as a person you’ve allowed to collect your mail; and
• to a buyer of our business, if they agree to protect it as this policy describes.

Our service providers may use personal information only to provide services to us, and must keep it secure.

10. Overseas disclosure

We keep our main systems and files in Australia. Some information does leave Australia:

• Identity checks (Didit). Didit’s Australian entity says that personal information collected in Australia is hosted and processed on its Australian infrastructure in Sydney, and that its staff and providers outside Australia can’t access Australian verification data. We don’t expect your ID images, biometric information or screening results to be disclosed overseas.
• Payments (Stripe). Stripe Payments Australia Pty Ltd provides payment services to us in Australia. Stripe says it may transfer personal information to other countries, including Ireland (where its European entity, which is responsible for some of its processing, is based), the United States and India, and that most of its service providers are in the European Union, the United States and India.
• Email delivery. The provider we use to send emails is likely to process your name, email address and the content of our emails (such as alerts about new mail, including sender names) in the United States.
• Forwarding. If you ask us to forward an item overseas, your name, the forwarding address and the customs details go to the carriers and customs authorities in the countries it passes through.

Before we disclose personal information overseas, we take reasonable steps to make sure the recipient handles it consistently with the APPs, usually through contract terms. If we start using a provider that discloses information to other countries, we’ll update this list.

11. Marketing

Account emails (receipts, alerts, verification reminders and notices about your plan) are part of the service. We send other emails, such as news or offers, only if you’ve agreed or the law allows it. Every marketing email has an unsubscribe link, and you can opt out at any time by emailing us. We never use identity information, screening results or mail contents for marketing.

12. Our website, cookies and analytics

Our website and dashboard use cookies that are needed to keep you signed in, remember your sign-up progress and protect against misuse. We may also use a website analytics service to understand which pages are useful. Where analytics uses cookies that aren’t essential, we ask for your consent first, and you can change your choice at any time. You can also block cookies in your browser, but the dashboard won’t work without the essential ones.

13. How we protect it

We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, change or disclosure. They include:

• encryption of data in transit and at rest, with our main systems and files hosted in Australia;
• short-lived, signed links for viewing scans and identity records, rather than email attachments;
• two-factor authentication for all staff, and offered to every customer;
• access limited by role: anti-money-laundering records are visible only to our compliance officer, and general staff see only what they need to handle mail;
• an append-only audit log of every view of, and action on, personal and AML information;
• staff trained in privacy and mail handling, who sign a confidentiality undertaking;
• physical security at our mail point, with secure storage and locked shredding consoles; and
• backups, security testing, and contracts that require our providers to protect information.

14. How long we keep it

We keep personal information only as long as we need it for our purposes or the law requires. Then we destroy or de-identify it.

Records we must keep under the AML/CTF Act can’t be deleted early, even if you ask. We keep them secure, and access is limited to our compliance officer.

15. Access and correction

• You can ask for access to the personal information we hold about you, or ask us to correct it, by emailing hello@mailstreet.com.au. Much of it is already in your dashboard.
• We’ll need to confirm your identity first. We’ll respond within 30 days. Access is free, unless a request needs a lot of work, in which case we’ll tell you a reasonable charge first.
• We take reasonable steps to keep information accurate, up to date and complete. If we agree something is wrong, we’ll correct it and, where it’s practical, tell anyone we disclosed it to. If we don’t agree, we’ll tell you why and you can ask us to attach a statement to the record.
• The law lets us refuse access in some cases, for example where giving access would be unlawful, would prejudice an investigation or enforcement activity, or would reveal a report we’ve made to a regulator. If we refuse, we’ll tell you in writing and explain how to complain, unless the law stops us giving reasons.

16. Data breaches

We follow the Notifiable Data Breaches scheme in the Privacy Act. If we suspect a data breach, we act straight away to contain it and assess it, within 30 days at most. If a breach is likely to result in serious harm to anyone, we notify the people affected and the Office of the Australian Information Commissioner (OAIC) as soon as practicable, and tell you what we’re doing about it and what you can do to protect yourself.

17. Complaints

• If you have a concern about how we’ve handled your personal information, email us at hello@mailstreet.com.au with the details. We’ll acknowledge it within 2 business days and aim to respond in full within 30 days.
• If you’re not satisfied with our response, or we haven’t responded within 30 days, you can complain to the OAIC: online at oaic.gov.au, by phone on 1300 363 992, or by post to GPO Box 5288, Sydney NSW 2001.

18. Changes to this policy

We may update this policy, for example when we change providers or the law changes. The version and effective date are at the top of this page. If we make a significant change, we’ll email customers before it takes effect.

19. Contact us

For privacy questions or requests, email hello@mailstreet.com.au and put “Privacy” in the subject line.