Last Updated: July 1, 2026
At Indus, we take your privacy seriously and are committed to protecting your personal information. This Privacy Policy explains how Indus AU Pty Limited (ABN 78 682 656 873), together with its related entities (collectively, the Indus group, “Indus”, “we”, “us”, “our”), collects, uses, discloses, stores, and protects your personal information. It also outlines your rights and how to contact us about privacy matters.
When we refer to “your information” in this Policy, we mean personal information as defined in the Privacy Act 1988 (Cth). Any personal information you provide will be collected and handled in accordance with this Policy and our obligations under the Privacy Act 1988 (Cth). We may update this Policy without notice, so please review it periodically for any changes. The latest version is always available on our website.
This Policy should be read alongside our Collection Notice.
We usually collect personal information directly from you. At times, we may also collect it from third parties such as identity verification providers, payment processors, and marketing service providers.
Some information is required by law, including to meet anti-money laundering and counter-terrorism financing obligations. Other information is needed so we can deliver our products and services. You do not have to provide everything we request, but if you withhold information we need, we may be unable to provide services. In some cases we may need to suspend or close your account to comply with legal requirements, and we will try to contact you before doing so.
We collect your information when you:
Sign up to the Indus app.
Place buy or sell orders for investments.
Visit our website or use our app.
Top up an Indus account.
Sign up to receive educational content.
Join Beta Club or a feature or product waitlist.
Take part in activities we offer such as competitions or surveys.
Contact us to make an enquiry, provide feedback, or make a complaint.
Otherwise provide information to us.
We may also collect personal information from:
Super Fund Lookup
ABN Lookup
ASIC registers
Identity verification providers
Sanctions screening providers
Politically Exposed Person (PEP) screening providers
Where you invest through a Self-Managed Superannuation Fund (SMSF), we may also collect personal information relating to the SMSF, including its members, trustees, directors of a corporate trustee, authorised representatives, beneficial owners where applicable, and other controlling persons.
The personal information we collect depends on the services or features you use and may include:
Personal details and contact information
The types of personal information that may be involved include:
Name.
Residential and/or postal address.
Email address.
Phone number.
Images of your face and ID.
Date of birth.
Government identifiers and identity documents
The types of personal information that may be involved include:
Tax File Number and country of tax residency.
Security holder Reference Number (SRN) or Holder Identification Number (HIN).
Medicare card, passport, driver licence or pension card copies and information.
Birth, death, citizenship and marriage certificates.
Foreign Government Identifiers and Identity Documents
The types of personal information that may be involved include:
Foreign passports and driver licences.
Tax identification numbers and country of tax residency.
Financial information
The types of personal information that may be involved include:
Bank account numbers.
Credit card numbers.
Financial and investment holdings and trade history.
Copies of bank statements or utilities bills (proof of address).
Nature and purpose of your investing.
Source of funds.
Transaction information
The types of personal information that may be involved include:
Information about activity on your Indus account, including buys, sells, top-ups, and logins.
Interaction Information
The types of personal information that may be involved include:
Records of your interactions with us, including enquiries, feedback, complaints, and phone calls.
Call recordings, where applicable. We will let you know if a call is being recorded.
Digital information
The types of personal information that may be involved include:
IP addresses.
Device and browser identifiers.
Geo-location.
Types of authentication used (for example, Touch ID or Face ID).
Socio-demographic information
The types of personal information that may be involved include:
Marital status.
Age.
Gender.
Number of dependents.
Occupation.
Nationality.
For example, when we conduct customer surveys.
Behavioral information
This includes information we generate about how you use Indus, such as habitual investing with regular contributions of similar amounts, in-app search terms, or less frequent lump-sum investments.
Information you provide to us
The types of personal information that may be involved include:
Enquiries and correspondence with us.
Responses to customer surveys.
Sign-ups to mailing lists or waitlists.
Entries in competitions.
Sensitive Information
We may collect and handle certain sensitive information, such as:
Criminal history and political exposure, where required to meet legal or regulatory obligations.
Biometric information used for identity verification, such as facial images or facial biometric data.
Information regarding your Personal Circumstances
To support you during our interactions, we may ask for information about your personal circumstances, including significant life events, details of injury or illness, gambling or addiction, and unexpected changes to your financial situation.
Information that is publicly available
At times, we may collect and handle information that is publicly available, such as information from:
Websites and social media apps, including Facebook, Twitter, YouTube, TikTok, and Instagram.
Public registers.
Podcast and webinar apps.
We may use cookies and similar technologies to remember your preferences and settings, strengthen security, analyse traffic, and measure the effectiveness and popularity of product features and marketing. This technology links to your device rather than directly identifying you. We may combine this information with other data we collect about you to provide analytics.
Providing and personalizing the delivery of our Services
We use your personal information to:
Provide our products and services.
Set up and maintain your account.
Process trades, top-ups, withdrawals, and payments.
Apply and manage fees and charges.
Communicate with you, deliver support, and manage our relationship.
Enable your access to our website and app.
Provide legal notices.
Notify you about account activity and eligible investment opportunities, such as rights offers.
Collect and recover money owed to us.
Respond to complaints.
Maintain our security holder records.
Carry out any other purpose you have consented to, or that is necessary to provide our products and services to you.
Improving Indus
We use your personal information to:
Review customer feedback.
Test, validate, and research products, services, and systems.
Perform quality assurance on our interactions with you, including online chat and complaint handling.
Protect and optimize our website, products and services, user experience, and business.
Resolve operational issues and address or escalate customer concerns.
Detect and prevent fraud or crime.
Creating market data and behavioral analytics
We may use de-identified customer records to:
Report on market trends and our investor base.
Improve our products and services.
Develop offerings that better meet customer needs and preferences.
Understand and manage our risks.
Marketing
We may use your personal information to send marketing or promotional messages about our products and services, as well as selected third-party offerings we believe may interest you. You can opt out at any time by using the unsubscribe function.
Managing our business
We may use your information to help us run our business, including managing our financial position and capital needs, building capability and conducting testing, managing communications, and completing audits.
Managing our security, risk, and crime prevention
We may use your information to:
Prevent, detect, and investigate suspicious or fraudulent activity.
Strengthen our systems to guard against cyber attacks, unauthorised access, and
other criminal or malicious activity.
Verify the country from which our website or app is being accessed using IP address information and geolocation services to support fraud prevention, security controls, regulatory compliance, and to ensure
customers access the appropriate regional version of our services.
Complying with our legal obligations
We use your personal information to:
Verify your identity and address.
Monitor account activity and notify the relevant authorities of potential criminal activity, including fraud, terrorist financing, and money laundering.
Share information when required by law, including with regulators, law enforcement, or tax authorities.
Fulfil any other purpose required or permitted by law or court order.
De-identifying information
At times we de-identify your personal information and use it to produce insights and analytics. We may share this de-identified information with businesses and government agencies to help them understand general customer trends and improve the delivery of products and services.
We may disclose your information to third parties for the purposes described above, or as required or permitted by law. These third parties may include:
Other members of the Indus Group
We may share your information between members of the Indus Group in connection with any purpose set out in this Policy. The Indus Group is comprised of the various entities ultimately owned by Indus Limited (NZ) (NZBN 9429051833640), who support us with providing our products and services.
Our suppliers or service providers
To provide our products and services, and to use your information for the purposes described in this Policy, we may work with third parties, including some located outside Australia. These may include:
Stock exchanges and share registry providers.
Biometric technology providers.
Financial institutions and banks.
Identity verification databases.
Investment providers.
In-app messaging providers.
Card payment processors.
Business strategy advisers.
Data analytics and research partners.
Providers of IP address lookup and geolocation services used for fraud prevention, security, regulatory compliance, and directing users to the appropriate version of our services.
Mail-out and marketing providers.
Cloud storage and data warehouse providers.
Our advisers, consultants, auditors, and business partners
We may share your personal information with Sanlam Private Wealth Pty Ltd (AFSL No. 337927), our license holder, where required for regulatory, compliance, supervision, or service delivery purposes.
Regulators and law enforcement agencies
Australian Transaction Reports and Analysis Centre (AUSTRAC).
Australian Securities and Investments Commission (ASIC).
Australian Federal Police.
Any other domestic or international regulator where disclosure is required or permitted by law.
Authorised third parties
Your power of attorney.
The executor or administrator of your estate.
Your attorney or legal representative.
Your legal guardian.
Some of the organizations we share information with are located overseas. This includes Indus Group members in New Zealand and third parties that operate or store data outside Australia, including in New Zealand and India. We may transfer information overseas to complete international transactions, provide our products and services, or comply with laws and assist government agencies and law enforcement.
When we send your information overseas, we put appropriate privacy and data handling arrangements in place to protect it. We may also share your information if we sell or merge some or all of our business or assets with another company. We may use and share information that does not identify you for any purpose.
We take reasonable steps to protect your information from misuse, interference, and loss, and from unauthorized access, modification, or disclosure. We store information in electronic and hard copy form on secure systems and within secure facilities. Your information is encrypted in transit and at rest using industry-standard encryption. We also use hashing, masking, and tokenization to avoid unnecessary display of personal information.
Our in-house security team maintains and continually improves our security posture. Staff receive information security training, and access to your information is restricted to authorized people and systems. We conduct regular penetration tests, audits, and security reviews by independent specialists, and we design for resilience with backups and recovery plans.
Despite these measures, we cannot guarantee the security of information during transmission or storage.
Retaining and deleting your information
We may retain your information for as long as you have an account and for at least seven years after it is closed to meet regulatory, tax, insurance, and other obligations. After that, we may keep it for as long as necessary for the purposes set out in this Policy. For example, we may retain information indefinitely where we consider it necessary for fraud prevention.
Most of your information can be accessed through your account. You can ask us to correct any inaccurate information by using the contact details in this Policy or by contacting us through the app. If we do not think a correction is required, we will explain why.
We will take reasonable steps, consistent with our obligations under the Privacy Act, to correct or update information.
Requesting access to specific information
If the information you need is not available through your account, you can request specific details by contacting us using the details in this Policy or through the app. We will not charge you for making an access request. We may charge a reasonable amount for the costs of providing access, where permitted by law, and will tell you about any proposed charge in advance.
We aim to provide the requested information within 30 days. If we need more time, we will let you know and explain why. In some cases, we may not be able to share certain information with you or destroy information you ask us to delete because of legal requirements.
Contact us if you have questions about our Privacy Policy, wish to access or amend your information, believe we have not met our obligations under the Privacy Act, or want to make a complaint. We value your feedback and appreciate being told when you have a complaint — we will review it and try to resolve the issue.
1. Contact Indus
You can reach us via the "Contact Us" button in the Indus app, or through the channels below:
Email: support@indus.au
Phone: 1800 680 099
2. Contact our Compliance Manager
As we operate in the financial services industry, you can also contact the Compliance Manager at Sanlam Private Wealth Pty Ltd on:
Phone: (03) 8640 5508
3. Escalate to AFCA
If we are unable to resolve your complaint to your satisfaction, you may contact the Australian Financial Complaints Authority (AFCA), our external dispute resolution scheme, quoting Sanlam's Member Number 14570. AFCA provides fair, free, and independent resolution of financial complaints.
Website: www.afca.org.au
Email: info@afca.org.au
Phone: 1800 931 678 (toll-free)
Mail: Australian Financial Complaints Authority, GPO Box 3, Melbourne VIC 3001
4. Contact the OAIC
For more information about your privacy rights, our obligations, and how to make a privacy complaint, visit the Office of the Australian Information Commissioner at:
Website: www.oaic.gov.au
Email: enquiries@oaic.gov.au
Phone: 1300 363 992
Mail: GPO Box 5218, Sydney NSW 2001