1. About this policy and who we are

AccountSuite 360 (“we”, “us”, “our”) provides practice management and AML/CTF compliance software to accounting, taxation, and related professional service firms (“Subscribers”). We are also pursuing accreditation as an Identity Service Provider (IDSP) under the Identity Matching Services Act 2019 (Cth) (“IMS Act”).

We are committed to protecting your privacy and handling personal information in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), the IMS Act, and all applicable Australian laws. This policy explains how we collect, use, hold, disclose, and protect personal information in connection with our platform and website at accountsuite360.com.

By using our service, you acknowledge that you have read this policy. Capitalised terms not defined here have the meaning given in our Terms & Conditions.

2. Information we collect

(a) Subscriber account information: When a firm signs up, we collect: firm name, contact person’s name, email address, phone number, business role, number of users, and billing/payment information.

(b) User information: When a Subscriber adds staff members, we collect their name, work email address, and role within the practice.

(c) Client data processed on behalf of Subscribers: Subscribers use our platform to manage their own clients. In doing so, they upload and process information about those end clients, which may include: names, dates of birth, addresses, contact details, identification document details (document type, number, expiry, issuing authority), tax file numbers, ABNs, financial records, and correspondence. We process this data on behalf of Subscribers as their service provider.

(d) Identity verification information (DVS): Where a Subscriber uses our identity verification features, we may collect and process: the type of identity document, document number, date of birth, and name as provided by the person being verified. This information is transmitted to the Australian Government’s Document Verification Service (DVS) Gateway for verification and the result (match/no-match) is returned. We do not receive or store a copy of any government record. Detailed information about this processing is set out in section 6 below.

(e) Website usage information: When you visit our website, we may collect IP address, browser type, device information, pages visited, and time spent, through cookies and analytics tools. See section 10 below.

(f) Communications: If you contact us by email or through forms on our website, we collect the content of those communications and your contact details.

3. How we collect personal information

We collect personal information:

• Directly from you when you register, complete forms, or contact us;
• From Subscribers who add users or upload client data to the platform;
• From third-party identity verification services (DVS results) when an identity check is initiated;
• Automatically through cookies, analytics, and server logs when you use our website or application;
• From publicly available sources (such as ASIC, ABR) where we retrieve business registry information on your behalf.

4. Why we collect, hold, use and disclose personal information

We use personal information for the following purposes:

• Providing, operating, and improving the AccountSuite 360 platform;
• Authenticating users and securing accounts;
• Processing subscription payments and managing billing;
• Providing customer support and responding to enquiries;
• Sending service notifications and material updates to our Terms or policies;
• Conducting identity verification checks (DVS) on behalf of Subscribers to help them satisfy their AML/CTF CDD obligations;
• Helping Subscribers meet their obligations under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) (AML/CTF Act) and related Rules;
• Meeting our own legal and regulatory obligations, including our obligations under the IMS Act, the AML/CTF Act, and the Privacy Act;
• Preventing fraud, misuse, and unlawful activity on our platform.

We will not use your personal information for marketing purposes without your consent, and we do not sell personal information to third parties.

5. Our role as a data processor

In relation to the personal information of a Subscriber’s own clients (“Client Data”), AccountSuite 360 acts as a data processor — we hold and process that information on the Subscriber’s instructions to provide the platform service. The Subscriber is the party responsible for those clients’ information, for obtaining any consents required from their clients, and for meeting its own obligations under the Privacy Act, AML/CTF Act, and other applicable laws in relation to that Client Data.

If you are a client of a practice using AccountSuite 360 and you have a privacy question about how that practice has handled your information, please contact the practice directly. If you have a question about how AccountSuite 360 itself handles your information, contact us using the details in section 14 below.

6. Identity matching services and the DVS

AccountSuite 360 is pursuing accreditation as an Identity Service Provider (IDSP) under the Identity Matching Services Act 2019 (Cth). As an IDSP, we connect to the Australian Government’s Identity Matching Services, specifically the Document Verification Service (DVS), to provide electronic identity verification.

What is the DVS? The DVS is a whole-of-government service, administered by the Department of Home Affairs, that enables participating organisations to verify whether details on a presented identity document (such as a passport or driver licence) match records held by the issuing authority.

What happens when a DVS check is run:

• The Subscriber (or the Subscriber’s client) provides identity document details on the platform;
• The person being verified is informed of the check and their consent is obtained (or relied upon in accordance with the IMS Act and AML/CTF Rules);
• We transmit the provided details to the DVS Gateway in encrypted form;
• The DVS Gateway queries the relevant issuing authority’s records;
• We receive a match/no-match response. We do not receive a copy of government records;
• The result is recorded in the Subscriber’s account as part of their CDD audit trail.

Consent: Identity matching under the IMS Act requires consent from the individual whose document is being verified (or another permitted basis under the Act). Subscribers using DVS verification on our platform are required by our Terms to ensure that valid consent is obtained from their clients before initiating a check.

Data minimisation: We only transmit the minimum information necessary to complete a DVS check. We do not collect biometric information (face images or fingerprints) through the DVS.

Retention: DVS check results (match/no-match and the details used for verification) are retained for the period required by the AML/CTF Act and Rules (generally 7 years from the completion of the relevant CDD), after which they are securely destroyed.

Our use of the DVS is governed by our participation agreement with the DVS Gateway operator and the requirements of the IMS Act, the DVS Policy Framework, and applicable Privacy Act obligations.

7. Sensitive information

We treat certain categories of information with heightened care:

• Tax File Numbers (TFNs): Where Subscribers input TFNs as part of client records, we handle these in accordance with the Privacy (Tax File Number) Rule 2015. TFNs are masked in the interface and are not accessible beyond the minimum necessary for the purpose for which they were provided.
• Health information and other sensitive information: We do not deliberately collect health information or other sensitive information (as defined in the Privacy Act). If such information is incidentally included in documents uploaded to the platform, we treat it with the same care as other personal information and do not use it for any secondary purpose.

8. Disclosure of personal information

We may disclose personal information to:

• The DVS Gateway: For identity verification checks as described in section 6;
• Cloud hosting providers: We use Australian-based cloud infrastructure to host the platform. Our primary hosting is in Australia;
• Payment processors: For billing and subscription management;
• Email and communication providers: For transactional notifications and support communications;
• Analytics and monitoring tools: For platform performance and security monitoring;
• Professional advisers: Our lawyers, accountants, and auditors, under obligations of confidentiality;
• Government and regulatory bodies: Where required or authorised by Australian law, including AUSTRAC, the OAIC, and law enforcement — or where we believe disclosure is necessary to protect legal rights or prevent serious harm;
• Successors: In the event of a merger, acquisition, or sale of our business, personal information may be transferred to a successor entity (we will notify you of any such change).

We do not sell personal information. We do not share personal information with third parties for their own marketing purposes.

9. Overseas disclosure

Our primary servers are located in Australia. Some of our third-party service providers (such as email delivery infrastructure or analytics tools) may process data outside Australia. Where this occurs, we take reasonable steps under APP 8 to ensure those recipients handle information consistently with the APPs and relevant Australian law. Overseas processing may occur in countries including the United States and European Economic Area jurisdictions. These countries have data protection frameworks that we assess before engaging providers.

DVS checks are transmitted only to the Australian Government’s DVS Gateway, operated within Australia, and are not sent overseas.

10. Data security

We implement reasonable technical and organisational security measures including:

• TLS encryption for all data in transit;
• Encryption of sensitive fields at rest;
• Role-based access controls and least-privilege principles;
• Multi-factor authentication for platform access;
• Regular automated backups with encryption;
• Audit logging of significant actions;
• Penetration testing and security reviews.

Despite these measures, no internet-based service is completely secure. We encourage Subscribers to use strong credentials and to report any suspected security concerns to us immediately.

Data breach notification: If a notifiable data breach occurs, we will notify affected individuals and the OAIC as required by the Privacy Act 1988 (Notifiable Data Breaches scheme) and, where applicable, under the IMS Act.

11. Data retention

We retain personal information for as long as necessary to provide the service and meet our legal obligations:

• Subscriber account data is retained for the duration of the subscription, plus 7 years after termination for tax and legal compliance purposes;
• AML/CTF CDD records (including DVS verification results) are retained for 7 years from the end of the customer relationship or the date of the last designated service, as required by the AML/CTF Act;
• Identity document details submitted for DVS checks are retained only for the period required by the AML/CTF Act;
• Website usage logs are retained for 90 days.

Upon expiry of the applicable retention period, personal information is securely deleted or anonymised.

12. Access, correction, and deletion

Under the Privacy Act, you have the right to request access to the personal information we hold about you, and to request correction of inaccurate, out-of-date, or incomplete information. To make a request, contact our Privacy Officer (see section 14). We will respond within 30 days. We may ask you to verify your identity before actioning a request.

Note: Some information may be subject to mandatory retention obligations (e.g., under the AML/CTF Act) and cannot be deleted on request until the retention period expires.

13. Cookies and analytics

Our website uses cookies and similar tracking technologies. For full details, see our Cookie Policy. You can control cookies through your browser settings; some features may not function properly if cookies are disabled.

14. Children’s privacy

Our service is not directed to children under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child, we will take steps to delete it as soon as practicable.

15. Privacy complaints

If you believe we have handled your personal information in breach of the Privacy Act or our obligations under the IMS Act, please contact us first so we can attempt to resolve the matter. We will acknowledge your complaint within 5 business days and aim to provide a substantive response within 30 days. If you are not satisfied with our response, you may refer your complaint to:

• The Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or by calling 1300 363 992; or
• For IMS Act matters, through the channels established by the Australian Government’s identity matching services framework.

16. Changes to this policy

We may update this policy from time to time. Where changes are material, we will notify Subscribers by email or through the platform at least 14 days before the changes take effect. The current version is always available at accountsuite360.com.

17. Contact us

Privacy Officer, AccountSuite 360
Email: info@accountsuite360.com
General: info@accountsuite360.com

1. Agreement to terms

These Terms & Conditions (“Terms”) form a binding legal agreement between AccountSuite 360 (“we”, “us”, “our”) and the entity or individual accessing or using the AccountSuite 360 platform (“you”, “Subscriber”). By creating an account, clicking “I agree”, or using the Service, you confirm that you have read, understood, and agree to these Terms.

If you are accepting these Terms on behalf of a company, partnership, or other organisation, you represent that you have the authority to bind that organisation, and these Terms will apply to that organisation. If you do not agree to these Terms, do not use the Service.

2. Definitions

“AML/CTF Act” means the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) and related Rules and legislative instruments.

“Client Data” means personal information and business records relating to your clients or prospective clients that you upload to, or generate within, the Service.

“CDD” means Customer Due Diligence as defined in and required by the AML/CTF Act.

“DVS” means the Australian Government’s Document Verification Service, administered by the Department of Home Affairs.

“IMS Act” means the Identity Matching Services Act 2019 (Cth).

“IDSP” means Identity Service Provider under the IMS Act.

“Reporting Entity” has the meaning given in the AML/CTF Act — broadly, a business that provides designated services to customers.

“Service” means the AccountSuite 360 software-as-a-service platform, including all modules, features, tools, updates, and support services.

“Subscriber Content” means all data, documents, and other content you upload to or create within the Service, including Client Data.

3. The Service — our platform role

AccountSuite 360 is a practice management and compliance workflow platform. We provide technology tools to help accounting practices and other professional service firms manage clients, jobs, documents, and compliance workflows, including AML/CTF-related functions.

We are not your compliance officer, AML/CTF officer, legal adviser, or financial adviser. Nothing in the Service, its outputs, or our communications constitutes legal, financial, accounting, or compliance advice. The Service is designed to help you organise and document your own decisions and obligations — it does not discharge those obligations on your behalf.

Subject to these Terms and payment of applicable fees, we grant you a limited, non-exclusive, non-transferable, revocable right to access and use the Service during your subscription term solely for your internal business purposes.

4. Reporting entity obligations — your responsibilities

If you are a Reporting Entity under the AML/CTF Act (or if you are uncertain whether you are), the following applies:

• You are solely responsible for determining whether you are a Reporting Entity and for enrolling with AUSTRAC;
• You are solely responsible for designing, implementing, and maintaining a compliant AML/CTF Program appropriate for your business;
• You are solely responsible for conducting CDD in accordance with the AML/CTF Act and Rules — our workflow tools assist with documentation but do not replace your judgement or responsibility;
• You are solely responsible for identifying and reporting suspicious matters (SMRs), threshold transaction reports (TTRs), and annual compliance reports to AUSTRAC;
• You are solely responsible for training your staff in AML/CTF obligations;
• You are solely responsible for the accuracy and completeness of all CDD records you create or maintain using the Service;
• You are solely responsible for ensuring you hold the appropriate authorisations, licences, and registrations to use the identity verification features (including complying with any consent requirements under the IMS Act and AML/CTF Rules).

We provide a platform and tools. Your practice bears all regulatory obligations and all liability arising from them.

5. Identity verification services

Where we offer DVS identity verification features (subject to our IDSP accreditation status, which will be communicated to Subscribers):

• You must obtain valid consent from the individual being verified before initiating any DVS check, or otherwise satisfy the applicable legal basis under the IMS Act and AML/CTF Rules;
• You must only use identity verification for the purpose of CDD and identity verification, not for any other purpose;
• DVS results are provided “as is” from the Australian Government’s systems — we do not warrant the accuracy of DVS results;
• A DVS match result does not by itself conclusively prove identity — you remain responsible for your overall identity verification assessment in accordance with the AML/CTF Rules;
• You must keep DVS verification records for the period required by the AML/CTF Act (generally 7 years);
• You must not misuse identity verification features, including by initiating checks without consent or for unauthorised purposes.

6. Your data — Subscriber Content

You retain ownership of all Subscriber Content. By uploading Subscriber Content, you grant us the limited rights necessary to host, process, back up, and display it to provide the Service. We will not access Subscriber Content except to provide the Service, for security or technical purposes, or as required by law.

You are responsible for ensuring that all Subscriber Content complies with applicable law, including that you have the right to collect, use, and store the personal information of your clients, and that appropriate consents and disclosures have been given to those individuals under the Privacy Act and AML/CTF Act.

We handle all personal information in accordance with our Privacy Policy, which forms part of these Terms.

7. Data processing agreement

To the extent AccountSuite 360 processes personal information on your behalf as a data processor (particularly Client Data), we agree to: (a) process personal information only on your documented instructions; (b) implement appropriate technical and organisational security measures; (c) assist you in meeting your obligations under the Privacy Act; (d) not engage sub-processors without appropriate contractual protections; (e) notify you of any actual or suspected data breach affecting Subscriber Content within the timeframes required by law; and (f) delete or return Client Data upon termination as set out in clause 14.

8. Acceptable use

You agree not to:

• Use the Service for any unlawful purpose or in violation of these Terms;
• Attempt to gain unauthorised access to any part of the Service or its underlying systems;
• Introduce malware, viruses, or harmful code;
• Scrape, reverse engineer, or attempt to extract source code from the Service;
• Use the Service to store or transmit material that infringes third-party intellectual property rights;
• Use identity verification features to verify identities without valid consent or for purposes not permitted by the IMS Act;
• Permit unauthorised users to access the Service using your credentials;
• Resell, sublicence, or provide the Service to third parties without our written consent.

We may suspend or terminate access if we reasonably believe you are in breach of this clause.

9. Fees and payment

Fees, billing cycles, and any applicable taxes (including GST) are as set out in your subscription plan agreed at sign-up or as subsequently updated. All fees are quoted in Australian dollars and are payable in advance. We reserve the right to vary fees on at least 30 days’ written notice.

Fees are non-refundable except as required by the Australian Consumer Law. If payment is not received when due, we may suspend access after reasonable notice. We are not liable for any loss caused by suspension resulting from non-payment.

10. Intellectual property

All intellectual property rights in the Service (including software, algorithms, UI design, documentation, and trade marks) are owned by or licensed to AccountSuite 360. Nothing in these Terms transfers any IP rights to you. You may not copy, reproduce, modify, adapt, or create derivative works from any part of the Service without our written consent.

To the extent you provide feedback, suggestions, or ideas about the Service, you grant us a perpetual, irrevocable, royalty-free licence to use that feedback for any purpose.

11. Availability and changes to the Service

We aim to provide a reliable service but we do not guarantee that the Service will be available at all times, uninterrupted, or error-free. We may carry out maintenance or updates with reasonable notice. We may modify, add to, or discontinue features of the Service and will provide reasonable notice of material changes.

12. Professional advice disclaimer

The Service, including any AI-assisted research (such as “Bre”) and AML/CTF workflow tools, is designed to support your professional work. It does not constitute accounting, taxation, financial, legal, or compliance advice. You remain solely responsible for the professional advice you provide to your clients and for all decisions made using or in reliance on the Service.

Outputs from AI-assisted features (including Bre) may be incomplete or contain errors and must be independently verified by a qualified professional before being acted upon or disclosed to clients.

13. Consumer guarantees and limitation of liability

Nothing in these Terms excludes, restricts, or modifies any rights you may have under the Australian Consumer Law (ACL), including any applicable consumer guarantees. Where the ACL applies, our liability is limited to the extent permitted by law.

Subject to the ACL and to the maximum extent permitted by law:

• Our total aggregate liability to you for all claims arising under or in connection with these Terms or the Service (whether in contract, tort, statute, or otherwise) is limited to the total fees paid by you in the 12-month period immediately before the claim arose;
• We exclude all liability for indirect, incidental, special, punitive, or consequential loss, including loss of revenue, loss of data, loss of clients, or failure to meet regulatory obligations;
• We exclude all liability for loss or damage arising from your failure to maintain a compliant AML/CTF Program, from AUSTRAC enforcement action, or from regulatory penalties imposed on your practice.

14. Term and termination

Your subscription continues until cancelled. Subscriptions are billed monthly (or as otherwise agreed). If you cancel, your subscription and access continue until the end of the current paid billing period, after which access ends. You are responsible for exporting any data you wish to retain before your access ends.

We may terminate your access immediately (with written notice) if: you materially breach these Terms and fail to remedy the breach within 14 days of notice; you become insolvent or subject to administration; or we reasonably determine that continued access creates legal, regulatory, or security risk.

Upon termination, your Subscriber Content will be retained for 90 days to allow export, after which it will be securely deleted — except where we are required to retain it by law (e.g., AML/CTF records).

15. Third-party services and integrations

The Service may integrate with or link to third-party services, including the DVS Gateway, ASIC, ATO, and payment or identity providers. Your use of those third-party services may be subject to separate terms and privacy policies. We are not responsible for the availability, accuracy, or conduct of third-party services.

16. Governing law and disputes

These Terms are governed by the laws of New South Wales, Australia. The parties submit to the non-exclusive jurisdiction of the courts of New South Wales and, where applicable, the Federal Court of Australia. We encourage you to contact us in the first instance to resolve any dispute informally before commencing proceedings.

17. General

Entire agreement: These Terms (together with our Privacy Policy, Cookie Policy, Acceptable Use Policy, and any subscription confirmation) constitute the entire agreement between you and us in relation to the Service and supersede all prior agreements.

Severability: If any provision of these Terms is found unenforceable, the remaining provisions continue in full force.

No waiver: Failure to enforce any provision is not a waiver of our right to enforce it in future.

Notices: We will send notices to the email address associated with your account. Notices to us should be sent to info@accountsuite360.com.

Changes: We may update these Terms and will give at least 14 days’ advance notice of material changes. Continued use after the effective date constitutes acceptance.

1. Purpose of this notice

This notice explains how AccountSuite 360 operates as a technology platform for reporting entities under Australian anti-money laundering and counter-terrorism financing (AML/CTF) law. It is addressed to accounting practices, tax agents, bookkeepers, and other professional service firms (“Subscribers”) who use our platform to manage their own AML/CTF obligations.

2. Legislative framework

The following laws are relevant to our platform and to the obligations of Subscribers who are reporting entities:

• Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) (AML/CTF Act)
• Anti-Money Laundering and Counter-Terrorism Financing Rules Instrument 2007 (No. 1) (AML/CTF Rules)
• Anti-Money Laundering and Counter-Terrorism Financing Amendment Act 2024 (Cth) (Tranche 2 amendments)
• Privacy Act 1988 (Cth)
• Identity Matching Services Act 2019 (Cth)

3. Our role — platform for reporting entities

AccountSuite 360 is a software platform that provides workflow, documentation, and compliance management tools. We are not a reporting entity in relation to the services you provide to your clients. Your accounting or professional services practice is (or may be) the reporting entity, and all obligations under the AML/CTF Act sit with you.

We provide tools that help you:

• Design and document your AML/CTF program;
• Conduct structured customer onboarding and CDD;
• Collect and store customer identification information;
• Perform electronic identity verification via the DVS;
• Screen clients against PEP and sanctions lists;
• Map beneficial ownership structures;
• Maintain an ongoing monitoring workflow;
• Generate an audit-ready record of your CDD activities.

Our tools assist with compliance — they do not replace your obligations, your AML/CTF program, or your professional judgement.

4. AML/CTF Tranche 2 — new reporting entity categories

The Anti-Money Laundering and Counter-Terrorism Financing Amendment Act 2024 extended AML/CTF obligations to additional categories of business, commonly referred to as “Tranche 2”. From 1 July 2026 (unless the date is amended by legislation), the following professional service providers may be reporting entities where they provide “designated services”:

• Accounting and tax practitioners;
• Lawyers and conveyancers;
• Real estate agents;
• Dealers in precious metals and stones;
• Trust and company service providers.

Designated services include: formation of companies, trusts, or other legal entities; acting as a trustee, nominee shareholder, or company director; management of client funds; and other activities specified in the AML/CTF Act. You should obtain legal advice to confirm whether and which of your services are designated services requiring registration with AUSTRAC.

5. Core obligations for reporting entities

If you are (or become) a reporting entity under the AML/CTF Act, your obligations include:

• Enrol with AUSTRAC before providing designated services;
• Establish an AML/CTF Program appropriate for your business, including Part A (risk management) and Part B (CDD procedures);
• Conduct Customer Due Diligence (CDD) before providing designated services;
• Collect and verify customer identification in accordance with the AML/CTF Rules;
• Conduct Ongoing CDD throughout the customer relationship, including transaction monitoring and periodic review;
• Identify beneficial owners of corporate customers, trusts, and other structures;
• Apply Enhanced CDD to high-risk customers, including PEPs and their associates;
• Report Suspicious Matters (SMRs) to AUSTRAC as soon as practicable;
• Lodge Threshold Transaction Reports (TTRs) for cash transactions of $10,000 or more;
• Submit Annual Compliance Reports to AUSTRAC;
• Maintain records for 7 years from the completion of the CDD or the end of the customer relationship (whichever is later);
• Train staff in AML/CTF obligations and procedures.

AccountSuite 360 provides tools that address many of these procedural obligations. AUSTRAC reporting (SMRs, TTRs, annual compliance reports) must be submitted directly to AUSTRAC and cannot be submitted through our platform.

6. Identity verification — DVS and electronic CDD

The AML/CTF Rules permit electronic means of identity verification as part of CDD. AccountSuite 360 is pursuing accreditation as an Identity Service Provider (IDSP) under the Identity Matching Services Act 2019 (Cth), which will allow us to access the Australian Government’s Document Verification Service (DVS) on behalf of Subscribers.

When available, DVS verification through our platform enables you to electronically verify identity documents (passports, driver licences, Medicare cards and others) against records held by the relevant Australian government issuing agency. This can assist in satisfying the electronic identification and verification requirements under the AML/CTF Rules.

Important limitations:

• A DVS match result does not by itself establish identity — it confirms that the document details you received match the issuing agency’s records, which is one component of identity verification;
• You must still assess the overall plausibility and reliability of the identification information and documents in accordance with your AML/CTF program;
• Where DVS returns a “no match”, further steps may be needed before you can provide designated services;
• Consent of the individual must be obtained before a DVS check is performed.

7. PEP and sanctions screening

Our platform provides access to PEP (Politically Exposed Person) and sanctions screening to assist Subscribers with their AML/CTF obligations. Screening results are based on the data sources integrated into our platform. Subscribers should:

• Not rely solely on our screening as their complete sanctions compliance program;
• Maintain their own understanding of applicable sanctions regimes (including Australian, UN, and OFAC lists);
• Document their review of any screening alerts, including the basis for any decision that a match is a false positive;
• Apply Enhanced CDD to confirmed PEPs and their associates.

8. Record-keeping

Our platform automatically timestamps and records CDD activities, identity verification results, screening events, and compliance officer decisions, providing an audit trail in support of your record-keeping obligations under the AML/CTF Act. Records created in the platform are retained in accordance with our data retention policy. You remain responsible for ensuring that your record-keeping meets all requirements of the AML/CTF Act, including maintaining complete and accurate records outside the platform where necessary.

9. No relationship with AUSTRAC

AccountSuite 360 does not have an agency relationship with AUSTRAC on behalf of Subscribers. We do not submit reports to AUSTRAC on your behalf. All regulatory reporting obligations are yours alone. References in our platform to AUSTRAC requirements are informational only and do not constitute legal advice.

10. Disclaimer

This notice and all information provided through the AccountSuite 360 platform is general in nature and is not legal or compliance advice. The AML/CTF regime is complex and obligations vary by business type, service type, and risk profile. You should seek independent legal advice to confirm your obligations and ensure your AML/CTF Program is fit for purpose. AccountSuite 360 accepts no liability for your regulatory compliance or for any penalty, fine, or enforcement action by AUSTRAC or any other regulator.

11. Contact

Questions about this notice or our AML/CTF platform capabilities: info@accountsuite360.com

1. General information only

All information published on this website (accountsuite360.com) and made available through the AccountSuite 360 platform is provided for general informational purposes only. It does not constitute — and must not be relied upon as — accounting, taxation, financial, legal, or compliance advice.

AccountSuite 360 is a software platform. We are not a registered tax agent, registered company auditor, registered liquidator, Australian financial services licensee, legal practitioner, or AML/CTF officer. All professional judgements, advice to clients, and regulatory decisions remain the responsibility of the qualified professionals using our platform.

2. No professional relationship

Use of the AccountSuite 360 platform does not create a professional, advisory, or fiduciary relationship between AccountSuite 360 and any client of a Subscriber. We are a technology service provider to practices — we have no relationship with, and no obligations to, those practices’ end clients.

3. AI-assisted research — Bre (Tax Assistant)

AccountSuite 360 includes an AI-powered tax research assistant called “Bre”. Please note the following important limitations:

• Bre generates research suggestions and summaries based on Australian taxation legislation, ATO guidance, and related materials. It does not provide advice;
• AI outputs may be inaccurate, incomplete, outdated, or not applicable to a specific set of facts. AI systems can generate plausible-sounding but incorrect information;
• All Bre outputs must be independently verified by a qualified tax professional before being acted upon, included in advice, or disclosed to any client;
• You are solely responsible for all professional advice you provide to your clients, regardless of whether it was prepared using Bre or any other tool;
• Use of Bre does not satisfy the due diligence, research, or professional care obligations imposed by your professional body, registration conditions, or applicable law.

4. Regulatory and legislative information

The platform contains references to Australian legislation, ATO guidance, AUSTRAC requirements, ASIC registers, and other regulatory material. While we take care to keep this information current, we do not warrant that it is complete, accurate, or up to date at all times. Tax laws, AML/CTF rules, and regulatory requirements change frequently. You must verify the currency of any regulatory information before relying on it.

5. Third-party data and integrations

Our platform integrates with third-party data sources including ASIC registers, ABR, the DVS, and others. We do not control these sources and cannot guarantee their availability, accuracy, or completeness. Where we retrieve data from third-party sources on your behalf (such as ABR lookups or DVS verification results), those results reflect the data held by the third party at the time of the query and we make no warranty as to their accuracy.

6. No warranty

The Service is provided “as is” and “as available”. To the maximum extent permitted by law (subject always to the Australian Consumer Law), we exclude all warranties, express or implied, including warranties of merchantability, fitness for a particular purpose, accuracy, or uninterrupted availability. We do not warrant that the Service will be free from errors, defects, or security vulnerabilities.

7. Limitation of liability

To the fullest extent permitted by law (subject to the Australian Consumer Law), AccountSuite 360 is not liable for any direct, indirect, incidental, special, consequential, or punitive damages arising from your use of, or reliance on, the Service or any information it contains — including regulatory penalties, professional disciplinary action, client claims, or data loss.

8. External links

This website may contain links to third-party websites (including government sites such as AUSTRAC, ASIC, and the ATO). These links are provided for convenience only. AccountSuite 360 does not endorse, control, or accept responsibility for the content of any linked website.

9. Contact

If you have concerns about information on this website: info@accountsuite360.com

1. What are cookies?

Cookies are small text files placed on your device by websites you visit. They are widely used to make websites work efficiently, to remember your preferences, and to provide information to website owners about how visitors use their site.

We also use similar technologies such as web beacons (also called tracking pixels), local storage, and session storage, which are collectively referred to as “cookies” in this policy.

2. Cookies we use

Strictly necessary cookies: These are essential for the platform to function. They include session authentication cookies that keep you logged in, CSRF tokens that protect against cross-site request forgery attacks, and cookies that remember your privacy preferences. You cannot opt out of strictly necessary cookies without affecting the operation of the platform.

Functional cookies: These remember your preferences and settings (such as your display preferences or recently accessed records) to improve your experience. You can disable these in your browser settings.

Analytics cookies: We may use analytics tools to understand how visitors use our public website (accountsuite360.com) — for example, which pages are most visited and how users navigate. These cookies collect aggregated, anonymous information. We do not use analytics cookies inside the logged-in platform application.

We do not use advertising or tracking cookies. We do not place cookies for advertising purposes and we do not share cookie data with advertising networks.

3. Third-party cookies

Our website uses Google Fonts, which may set cookies or collect data about font usage. We have configured these to use privacy-preserving settings where possible. No other third-party advertising or social media cookies are placed by our website.

4. How to control cookies

You can control and delete cookies through your browser settings. Most browsers allow you to: see what cookies are stored and delete them individually; block all cookies (note: this will prevent you from logging in); or accept all cookies except third-party cookies.

For instructions specific to your browser, visit the browser maker’s support pages. Relevant links: Chrome, Firefox, Safari, Edge.

5. Contact

If you have questions about our use of cookies: info@accountsuite360.com

1. Purpose

This Acceptable Use Policy (“AUP”) sets out rules for using the AccountSuite 360 platform. It applies to all Subscribers, their staff, and any other person authorised to access the platform under a Subscriber’s account. This AUP is incorporated into and forms part of our Terms & Conditions.

2. Permitted use

You may use the platform for:

• Managing your accounting or professional services practice, including client records, jobs, documents, and communications;
• Conducting AML/CTF Customer Due Diligence and compliance workflows for your practice;
• Verifying the identity of your clients for the purpose of AML/CTF CDD (using DVS features when available);
• Preparing documents and e-signing arrangements with your clients;
• Business registration and ASIC-related workflows for clients;
• Using Bre (AI tax assistant) to assist with professional research.

3. Prohibited use

You must not use the platform to:

• Upload, store, or transmit any content that is unlawful, defamatory, obscene, or infringes any third-party intellectual property or privacy rights;
• Impersonate any person or entity, or misrepresent your identity or affiliation;
• Attempt to gain unauthorised access to any account, system, or network;
• Probe, scan, or test the vulnerability of the platform or any connected system;
• Introduce viruses, malware, or other harmful code;
• Use automated scripts, bots, or scrapers to extract data from the platform (except through authorised API integrations we provide);
• Use identity verification features without the valid consent of the person being verified, or for any purpose other than lawful AML/CTF CDD;
• Conduct identity verification checks on individuals without a legitimate AML/CTF purpose and a proper customer relationship;
• Process the personal information of any person in a manner that is inconsistent with the Privacy Act 1988 (Cth) or applicable AML/CTF Rules;
• Use the platform or its AI features to generate or distribute misleading, fraudulent, or deceptive content;
• Share account credentials with persons not authorised under your subscription;
• Resell, sublicence, or commercially exploit the platform without our written consent.

4. Identity verification — specific restrictions

Access to identity verification features (DVS) is strictly controlled. You must not:

• Initiate a DVS check on any person without their knowledge and consent (or without another permitted legal basis under the IMS Act);
• Use DVS results for any purpose other than identity verification for AML/CTF CDD;
• Attempt to verify the identity of a person who has not been presented to you in connection with a genuine designated service relationship;
• Retain or share DVS results in a manner inconsistent with the AML/CTF Act or Privacy Act;
• Share DVS credentials, API keys, or access to identity verification features with any third party without our written approval.

5. AI assistant — Bre

When using the Bre AI tax assistant, you must not:

• Present unverified Bre outputs directly to clients as professional advice without independent verification;
• Use Bre to generate content intended to deceive or mislead clients or regulators;
• Input the personal or confidential information of clients into Bre prompts beyond what is necessary to obtain a research result.

6. Security responsibilities

You are responsible for maintaining the security of your account. You must:

• Use strong, unique passwords and enable multi-factor authentication;
• Not share login credentials between staff members (each user must have their own account);
• Promptly notify us at info@accountsuite360.com if you suspect unauthorised access to your account;
• Ensure devices used to access the platform have current security software installed.

7. Enforcement

We reserve the right to investigate potential breaches of this AUP. If we determine (in our reasonable discretion) that you have violated this AUP, we may: issue a warning; temporarily suspend your access; terminate your subscription; or report the matter to relevant authorities (including AUSTRAC, the OAIC, or law enforcement) where required by law or where we believe a serious breach has occurred.

We will generally give you notice and an opportunity to remedy a breach before taking action, unless the breach is serious (for example, misuse of identity verification features or a data security incident).

8. Contact

To report a potential violation of this AUP or a security concern: info@accountsuite360.com

1. About this notice

This notice is directed at individuals whose identity documents are being verified through AccountSuite 360’s identity verification service. It is designed to fulfil our notification obligations under the Identity Matching Services Act 2019 (Cth) (IMS Act), the Privacy Act 1988 (Cth), and the applicable AML/CTF Rules.

If you are reading this notice because a professional services firm (such as an accounting practice) has asked you to submit identity documents as part of their AML/CTF client onboarding, this notice explains what will happen with your information.

2. Who is conducting the identity check?

The entity that requested your identity verification is the accounting or professional services firm that sent you the onboarding link (the “Requesting Firm”). The Requesting Firm is the reporting entity under the AML/CTF Act and is responsible for conducting Customer Due Diligence on you as their client.

AccountSuite 360 is the technology platform provider used by the Requesting Firm. We access the Document Verification Service (DVS) Gateway on behalf of the Requesting Firm as an Identity Service Provider (IDSP) accredited under the IMS Act.

3. What is the Document Verification Service (DVS)?

The DVS is an Australian Government service administered by the Department of Home Affairs. It enables participating organisations to electronically verify whether the details on an identity document match the records held by the document’s issuing authority (for example, checking a passport number against Department of Home Affairs records, or a driver licence against the relevant state roads authority).

The DVS does not transfer a copy of your government record to us — it simply returns a yes/no match result.

4. What information is used in a DVS check?

Depending on the document type, a DVS check may use: your full name; date of birth; document type; document number; document expiry date; and, for some document types, additional identifiers (such as card number for driver licences or individual reference number for Medicare cards).

5. Which documents can be verified?

The DVS can be used to verify:

• Australian passports
• Foreign passports (via the Document Verification Service)
• Australian driver licences (all states and territories)
• Medicare cards
• Australian birth certificates (in participating states)
• Australian citizenship certificates
• ImmiCards
• Visa records

Available document types may vary depending on the specific DVS integration in use at the time of your verification.

6. Why is this check being conducted?

The Requesting Firm is required, as a reporting entity under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), to verify your identity as part of their Customer Due Diligence (CDD) program before or when providing you with designated services. This is a legal requirement — it is not optional once a firm is subject to AML/CTF obligations.

7. Consent

By submitting your identity document details through the AccountSuite 360 platform, you consent to AccountSuite 360 accessing the DVS Gateway to verify your document details on behalf of the Requesting Firm, for the purpose of AML/CTF identity verification. You also consent to the Requesting Firm retaining the results of that verification as part of their AML/CTF records.

If you do not consent to a DVS check, please inform the Requesting Firm. Note that the Requesting Firm may not be able to provide you with their services if they are unable to verify your identity as required by law.

8. Who can see my information?

• The Requesting Firm can see the information you submitted and the DVS match result;
• AccountSuite 360 can see the information you submitted and the DVS match result for the purpose of providing the service;
• The Australian Government’s DVS Gateway receives the document details you provide to conduct the verification;
• Your document details are not shared with any other party (except as required by law).

9. How long is my information kept?

AML/CTF legislation requires the Requesting Firm to retain CDD records (including identity verification results) for 7 years from the date of the last transaction or the end of the customer relationship. AccountSuite 360 retains this information on behalf of the Requesting Firm for that period, after which it is securely deleted.

10. Your privacy rights

You have the right under the Privacy Act 1988 (Cth) to request access to, or correction of, the personal information held about you. If you want to exercise these rights in relation to:

• Information held by the Requesting Firm — contact the Requesting Firm directly;
• Information held by AccountSuite 360 as platform operator — contact us at info@accountsuite360.com.

For further privacy information, see our full Privacy Policy.

11. Contact

Questions about identity verification: info@accountsuite360.com