Identity Verification Collection Notice

Identity verification: collection notice

This notice applies when Hummingbird Intercoms Pty Ltd (ABN 75 651 091 057; ACN 651 091 057), operator of Humi and user of the Humi Networks brand, collects identity information through the Humi App or an approved follow-up channel. Our full Privacy Policy contains more detail about other Humi services and information handling.

1. What we collect

For the current individual Humi App verification flow, we may collect:

• your legal first and last name, date of birth and nationality;
• your residential address, city, state or province, postcode and country;
• identity-document type, number and issuing country;
• an image of a passport, driver licence, national identity card or another approved government-issued identity document;
• the email address and Humi identifiers that connect the submission to your account;
• submission time, document type, review status, reviewer decision, review notes and requests for further information;
• technical and security records such as IP address, session, device or request identifier and App version; and
• additional information about identity, source of funds, purpose of transfer or risk only where reasonably required for eligibility, compliance, fraud prevention or a specific transfer.

Your identity document may contain a photograph, signature, sex or gender marker, place of birth, document expiry date and other information printed by the issuer. We ask you to submit only a supported document and only the pages or sides requested. Do not send extra documents by ordinary email or the general support form.

2. How the App collects the information

You enter profile information and choose whether to take a document photo with the camera or select an existing document image from your photo library. The selected image is uploaded to Humi when you choose the secure upload action. You can review and correct the typed profile fields before submitting the verification package for review.

The camera is used only when you choose to capture a document. Humi does not use the current KYC screen to record audio, read your contacts or collect precise location. You may cancel before submission, but Humi cannot complete verification or enable services that require verification without the necessary information.

3. Why we collect it

We collect and handle identity information to:

• confirm that you are the person opening and controlling the Humi account;
• assess age, country and product eligibility;
• perform customer due diligence and meet applicable anti-money laundering and counter-terrorism financing obligations;
• conduct sanctions, fraud and other financial-crime controls where required;
• protect customers and Humi against impersonation, identity misuse, scams and unauthorised access;
• review inconsistencies and request additional information where necessary;
• provide, monitor and support the AUD to CNY service; and
• meet audit, record-keeping, reporting, regulatory, court and law-enforcement requirements.

If you do not provide the required information, or if we cannot verify it to the standard reasonably required, Humi may be unable to open or continue the account, provide a quote, accept a transfer or make a CNY payout. Downloading the App does not guarantee verification or eligibility.

4. Human review and OCR

The current identity-verification outcome is reviewed by authorised Humi personnel. A reviewer may compare the details you entered with the document image, assess completeness and consistency, review relevant compliance signals and ask for more information.

Optical character recognition (OCR) is disabled by default in the current service. If Humi enables OCR, it may extract suggested text fields from the document image. You must review those fields. OCR output can be inaccurate and is an aid only: it does not approve your account, replace Humi review or remove your ability to correct the information.

Automated security or screening rules may generate alerts or route a case for review. Humi does not use OCR or an unapproved automated face score as the sole basis for the current KYC approval decision.

5. Face ID and facial information

The current Humi identity-verification flow does not integrate a third-party face-recognition SDK, does not ask for a selfie for facial comparison and does not generate or store a facial-recognition template. Humi still protects the ordinary photograph printed on an identity document as part of the identity record.

When Humi asks you to use Face ID, Touch ID or the device passcode to unlock an existing App session, Apple and the operating system perform that check on your device. Humi receives the outcome needed for local access. Humi does not receive or collect the Face ID image, mathematical representation or biometric template held by Apple.

If Humi later proposes face matching, liveness detection or another biometric identification process, it will not be silently added under this notice. Humi will first complete the required legal, privacy, security and vendor review, update platform disclosures and provide a specific collection notice and consent process before collecting sensitive biometric information.

6. Who may receive the information

Access within Humi is limited to personnel and contractors who need it for identity review, compliance, security, support, audit or legal duties. We may disclose the minimum necessary information to:

• approved identity, sanctions, screening or fraud-prevention information sources where required;
• secure hosting, storage, security and technical service providers acting for Humi;
• banks, payment and payout providers, recipient banks and other transaction participants where identity or compliance information is required to provide or investigate the transfer;
• professional advisers and auditors subject to confidentiality; and
• AUSTRAC, other regulators, courts, law-enforcement agencies and government bodies where authorised or required by law.

Humi does not sell identity information and does not use identity-document data for targeted advertising or cross-app tracking.

7. Overseas handling

The current App identity submission is processed on Humi application systems in Australia. Public-website, email and support-ticket information may be accessible to service providers in the United States; this is one reason identity-document images must not be sent through the ordinary support form or unrequested email. Information needed for a CNY transfer may be disclosed to banks, payout providers and other transaction participants in China. The exact information depends on the service, recipient and legal requirements.

Where Humi uses an overseas provider or makes an overseas disclosure, we take reasonable steps appropriate to the circumstances, such as limiting the information, reviewing the provider, setting contractual privacy and security requirements, controlling access and addressing retention and incident response. Overseas laws may differ from Australian law.

8. Retention

Identity and customer-due-diligence records are retained according to their type and the applicable legal trigger. Many AML/CTF identity and transaction records must generally be kept for seven years, but the period may run from when the record is made, when the relevant transaction occurs or when the customer relationship ends. Records may be kept longer where required by another law, court order, investigation, complaint or legal hold.

When information is no longer needed and no retention requirement applies, we take reasonable steps to destroy it securely or irreversibly de-identify it. An account-deletion request does not require Humi to destroy KYC or transaction records that must or may lawfully be retained. Retained records are restricted to the relevant compliance, audit, security, dispute or legal purpose.

9. Your choices and rights

You can ask to access or correct identity information, raise a privacy complaint, or ask which records can be deleted. See Privacy Choices and Data Requests. You can initiate account deletion in the Humi App or without reinstalling it through the web deletion request. See Account and Data Deletion for the records that may remain after closure.

If you believe a document was uploaded to the wrong account, a document is no longer under your control, or your identity has been misused, contact Humi immediately through Security support or support@humi.au. Do not attach another identity document to the initial support message.

10. Contact us

Hummingbird Intercoms Pty Ltd
ABN 75 651 091 057; ACN 651 091 057
Operator of Humi; Humi Networks brand
25 Lime Street, Sydney NSW 2000, Australia

• Privacy, identity-handling questions and complaints: compliance@humi.au
• Account and deletion requests: account@humi.au
• General or urgent security support: support@humi.au
• Online support: humi.au/support