Cross-Border Data Transfer Policy
Effective Date: 13/10/2026
Operator: OMNIMIND TECHNOLOGIES PTY LTD ("we", "us", "our")
Contact email: [email protected]
This Policy forms part of the Token Factory Privacy Policy. It is drafted in accordance with Australian Privacy Principle 8 (APP 8, cross-border disclosure of personal information) and section 16C (the accountability provision) of the Privacy Act 1988 (Cth), and incorporates the new overseas disclosure exception and "white list" mechanism introduced by the Privacy and Other Legislation Amendment Act 2024.
1. Purpose and scope
1.1 This Policy applies to all circumstances in which we transfer or disclose personal information of users in Australia to recipients located outside Australia ("overseas recipients"). It explains: the data flows and destinations, the assessments and safeguards applied before transfer, the legal responsibility we bear, your rights, and our position on foreign government access requests.
1.2 Two concepts need explanation (per the OAIC's APP Guidelines):
- "Use" vs "disclosure": information that merely transits or is processed on overseas servers while remaining under our effective control (for example, processing on an overseas cloud server we operate) constitutes "use" and does not trigger APP 8; however, we remain responsible for that personal information under the Australian Privacy Principles as if it were held in Australia;
- "Disclosure": releasing personal information outside our effective control to a third party overseas (for example, an Upstream Model Provider processing your API request content on its own systems) triggers APP 8 and section 16C. This Policy principally governs the latter, while applying the same safeguards to both.
2. Legal framework
2.1 APP 8.1 (reasonable steps): before disclosing personal information to an overseas recipient, we must take such steps as are reasonable in the circumstances to ensure the recipient does not breach the Australian Privacy Principles (APPs) in relation to that information.
2.2 Section 16C (accountability): where we disclose personal information to an overseas recipient, we are accountable for any subsequent act or practice of the recipient in relation to the information that would breach the APPs — as if that act had been our own. In other words, regardless of where your data goes, you can hold us directly responsible for any mishandling by the overseas recipient.
2.3 APP 8.2 exceptions (where the conditions are met, APP 8.1 and/or section 16C may not apply):
- the overseas recipient is subject to a law or binding scheme that is substantially similar to the APPs, and mechanisms exist for you to enforce those protections;
- under the new APP 8.2(aa), APP 8.3 and subsections 100(1A)–(1B) inserted by the Privacy and Other Legislation Amendment Act 2024, the recipient's country or binding scheme is prescribed in regulations (the "white list") (this mechanism commenced on 11 December 2024; as at the date of this Policy [no / the] white list regulations have been made — we monitor this closely);
- we have expressly informed you that APP 8.1 will not apply if you consent to the disclosure, and you consent;
- the disclosure is required or authorised by an Australian law;
- other statutory exceptions (for example, a permitted general situation).
2.4 Our practice does not rely on the exceptions in clause 2.3 as the routine path: every overseas disclosure is in principle preceded by the safeguards in clause 4.
3. Data flows and destination list
3.1 Principal data flows (to be completed based on actual deployment; the table below must be confirmed by an internal data-flow audit before launch):
| # | Data category | Overseas recipient | Location | Role | Transfer basis |
|---|---|---|---|---|---|
| 1 | API request content (prompts/outputs), usage logs | Upstream Model Provider A | [United States] | Independent processor | DPA + clause 4 safeguards |
| 2 | Account and billing data | Cloud infrastructure provider | [Singapore] | Service provider | DPA + clause 4 |
| 3 | Payment credentials (de-identified) | Payment processor | [United States / Singapore] | Service provider | DPA + clause 4 |
| 4 | Technical information (IP, device) | Security and risk-control services | TBD | Service provider | DPA + clause 4 |
3.2 Cross-border transfers occur only where necessary for the purposes set out in clause 4 of the Privacy Policy. We will not transfer your personal information for a new purpose without your consent.
4. Safeguards before transfer (reasonable steps checklist)
4.1 Contractual safeguards: with each overseas recipient we enter into a data processing agreement (DPA) or equivalent terms requiring the recipient to:
- process personal information only on our instructions and for the limited purposes;
- implement security measures no less protective than our own standards;
- not undertake onward transfers without our written consent;
- notify us of any security incident without undue delay (and in any event within 72 hours);
- cooperate with us in handling your access, correction and complaint requests;
- return or destroy the information at the end of the engagement.
4.2 Destination assessment: before transfer, we assess the recipient country's data protection framework and enforcement environment, the recipient's security certifications (such as ISO/IEC 27001, SOC 2), and its security track record; the assessment is documented.
4.3 Minimisation and de-identification: only fields necessary for the purpose are transferred; logs and technical information are preferentially de-identified or aggregated; payment credentials are limited to de-identified elements.
4.4 Ongoing monitoring: recipients' compliance is re-assessed annually; security incidents at, or material legal changes in, a recipient's country trigger immediate re-assessment, and where necessary we pause transfers, switch recipients, or add safeguards.
4.5 Encryption in transit: cross-border transfer links use TLS 1.2+ or equivalent encryption.
5. Special rules for Upstream Model Providers
5.1 Your API request content is transferred to Upstream Model Providers in order to obtain inference results. Our agreements with them specify that:
- request content is used solely to return results to you and for abuse monitoring, and must not be used for model training without authorisation (where a provider's own terms permit the use of request data for training, we will clearly flag this in the model documentation so you can make an informed choice);
- retention is limited to the period necessary to provide the results (or the shortest period required by law).
5.2 We recommend that you likewise avoid transmitting unnecessary identifiable personal information via the API. If your use case involves substantial personal information, contact us to discuss options supporting an enterprise agreement with additional safeguards.
6. Our responsibility and your redress (section 16C)
6.1 We are accountable to you under section 16C for acts or practices of overseas recipients that breach the APPs. You do not need to pursue an overseas recipient directly: you may complain to us, or seek access or correction, through the process in clause 15 of the Privacy Policy.
6.2 We will first take remedial steps (such as requiring the recipient to delete or stop processing the information) and, depending on the impact, discharge our data breach notification obligations under Part IIIC of the Privacy Act.
7. Foreign government access to data
7.1 We require all overseas recipients to commit that, on receiving any government, judicial or law-enforcement request for our users' personal information, they will (a) notify us immediately unless legally prohibited, and (b) provide only the minimum information compelled by law.
7.2 Where we ourselves receive a legally binding request from an Australian or foreign government, we will assess its legal validity and scope, notify affected users where lawful, and publish periodic transparency reports ([every six months]).
7.3 If legal changes in a recipient's country mean our safeguards can no longer be effectively honoured (for example, mandatory data-retention or access laws), we will assess pausing transfers to that country and adjusting our data-flow architecture.
8. Review of this Policy
8.1 This Policy is reviewed at least annually, and promptly updated — with notice given under clause 16 of the Privacy Policy — whenever data flows, the destination list, safeguards or the relevant laws materially change.
9. Contact
- Enquiries and complaints about cross-border data transfer: [email protected]