Privacy Policy

We value your trust and are committed to being upfront about our personal information handling practices.

Last updated: 30 July 2026
Effective date: 30 July 2026

Recent changes to this Policy

We’ve made some key changes to this Policy to remain transparent about our personal information collection and handling practices. These changes include:

• clarifying personal information that we collect and handle, how and why, as you’d reasonably expect, to reflect our products and services offered to individuals as described in this Policy;
• providing further detail and clarity on privacy rights that may be available to you, and how we deal with them; and
• enhancing the Policy’s structure and layout to make it comprehensive and easier to navigate.

These changes will become effective on 30 July 2026. For any questions, refer to our contact details in section 6 below.

1. About this Policy

This privacy policy (Policy) describes how Caleb and Brown Holdings Pty Ltd (ABN 34 651 147 152) and its wholly owned subsidiaries listed in section 6 below (collectively, Caleb & Brown, C&B, we, us and our) collect and handle personal information of prospective, current, and former customers, or other individuals that we interact and engage with through the delivery of our products and services (customer, you, your). Our products and services include, but are not limited to, our website (www.calebandbrown.com) (Website), the Caleb & Brown self-directed trading portal, the Caleb & Brown mobile application (App), and other services that we may offer from time to time (Services). This Policy also sets out our personal information handling practices, your privacy rights and choices, and how to contact us with respect to a privacy-related matter.

By accessing our Services or providing your personal information, you agree to the collection and handling of your personal information as described in this Policy, unless otherwise required or permitted by law. Certain third parties and financial institutions that we interact with to provide our Services described in section 3 below may collect and handle personal information for their own purposes as described and in accordance with their respective privacy notice or policy.

1.1. Definitions

We define the following terms for the purpose of this Policy:

Personal information refers to information or an opinion about an individual, where that individual is identified or reasonably identifiable, and as otherwise defined under applicable privacy laws.

Handles refers to the collection, use, disclosure, holding, or otherwise processing of personal information, and as otherwise described under applicable privacy laws.

2. Personal Information we Collect and Handle, How and Why

In this section, we describe the categories of personal information we collect and handle, how and for what purposes, including the lawful basis that applies as prescribed under the UK General Data Protection Regulation / Data Protection Act 2018 (UK GDPR / DPA 2018).

We may collect other kinds of personal information that is reasonably necessary for our functions or activities, such as personal information that we request from you or that you or a third party provide to us, and where otherwise required or permitted by law.

2.1. Personal information we collect and handle

Information we typically collect from you or an authorized representative as follows.

Information we typically collect through your interaction with our Services or third party sources are as follows.

2.2. Why we collect and handle personal information

2.3. How we collect personal information

We collect personal information through the following ways:

• when you provide it to us directly;
• when you interact with our Services, including when you visit our Website, use our App or interact with us on social media channels;
• from third party sources, including companies we partner with and third party service providers to provide our Services, marketing and advertising partners, individuals or entities that have referred you or where you have asked them to provide your information to us, and sourced publicly available information, where permitted, such as from a relevant corporate regulator or data written on a blockchain and other publicly available ledgers.

Services provided where we may collect your personal information directly from you include by telephone, or video call, which may be recorded or transcribed, by standard form, letter, email, text, by visiting our Website or App, or through social media channels. You can find more information about our use of cookies and other similar tracking technology in our Cookie Policy.

If you are a director, officer, shareholder of a company that uses our Services, including a corporate trustee or beneficiary of a trust, then we may collect certain personal information about you, such as your name, email, address and date of birth, from another employee of the company. By providing your personal information to us, the individual providing the information agrees that they have provided all necessary notices and consents to provide this personal information to us on your behalf.

2.4. If you choose not to provide your personal information

If you choose not to provide us with certain personal information that we believe is necessary for lawful purposes, including as described in this Policy, we may not be able to provide or deliver our Services that you have requested from us. Our ability to provide effective Services depends on you providing relevant, complete, and accurate information. If you elect not to provide us with your up-to-date personal information as and when requested, we may not be able to provide you or continue to provide you with certain Services. In certain circumstances, we may need to terminate your account if personal information we require is not provided to us.

2.5. Dealing with unsolicited personal information

If we receive personal information about you that we did not solicit, we will determine if we could have lawfully collected that information. If we determine that we could not have, and the information is not required by law to be retained, we will take reasonable steps to de-identify or destroy it.

2.6. Identity verification and government-related identifiers

We have obligations under AML/CTF laws in certain jurisdictions, including Australia, New Zealand, and the United States of America to verify and confirm your identity (ie, know your customer (KYC) or customer due diligence (CDD) before we provide any designated services, and at certain other times in the course of providing our Services. In Australia, Caleb and Brown Pty Ltd is designated as a ‘reporting entity’ under the Australia’s Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), which imposes these strict legal obligations.

Our procedures to comply with applicable AML/CTF laws (including KYC and CDD) are fundamental to our commitment to identify, mitigate, and manage the risks of money laundering and terrorism financing. Any government-related identifiers obtained for the purposes of identification may be collected, used or disclosed for the following purposes:

• verifying your identity before providing certain products and services to you or the person you are acting on behalf of and throughout our relationship with you as necessary for compliance purposes;
• assessing and managing potential money laundering, terrorism financing, proliferation financing risks or related compliance risks associated with the provision of our Services;
• making reports and meeting record keeping obligations required by law under applicable AML/CTF laws;
• where reasonably necessary to fulfil obligations to an applicable regulatory agency or authority; or
• as otherwise required or authorized by or under an applicable law (including AML/CTF laws) or a court or tribunal order.

We engage third party identity verification service providers to collect your Identifiers and Identity Verification Information, to verify and provide results, for the purposes described above.

We may use the Australian Government’s Document Verification Service (DVS) to verify our Australian customers’ identities. The DVS allows for the validation of certain government-issued identity documents (such as passports or driver’s licenses) by comparing provided details against the records held by the respective Australian Government issuing authority. This is a component of Caleb & Brown’s electronic identity verification processes. The DVS checks the details you provide against the records of the document’s issuing agency and provides a ‘match’ or ‘no match’ response. You have the right to know how your information is collected and used for this purpose. If you decline to have your identity verified through this process, we will be unable to provide you with our products and services. For information about making a complaint regarding our handling of your information for this purpose, please see section 5.3 below. For more information on how your personal information is collected and handled by the Australian Government as part of the DVS, please refer to the Identity Verification Services Privacy Statement.

2.7. Automated decisions

Caleb & Brown may use your personal information and automated decision-making technology that may produce a legal or similarly significant effect on you. We may use automated decisions to enter into and for the performance of an agreement with you, including to provide our Services you request from us, or to comply with the law, including AML/CTF and sanctions laws, for the following purposes:

• to identify and prevent individuals from sanctioned countries to open an account with us and use our Services to help us comply with applicable sanctions laws;
• to perform identity verification to apply for and open an account with us, and to continue to provide you with certain Services. This decision helps us protect you and your money, to prevent fraud, money laundering, and terrorism financing, and to ensure our decision is fair and consistent; or
• to approve or decline transactions to help us protect you and your money, to prevent fraud, money laundering, and terrorism financing, and to ensure our decision is fair and consistent.

Refer to section 5.1 below for information on exercising your rights, where it applies, and relating to the use of your personal information and automated decision-making technology.

2.8. Job applicants

If you have applied for a role with us, we may collect your identifiers, along with information relating to your qualifications and employment history, and other information you provide to us to support your application, such as nominated referees, as well as publicly available information. We use your personal information to assess your application and suitability for a position or contract as an employee or service provider with us, complete appropriate checks, make opinions about you, for quality and compliance purposes, and other corporate-related purposes as described and in accordance with this Policy. Our UK GDPR / DPA 2018 lawful basis is for the purposes to enter into an agreement; and our legitimate interest to protect our business.

3. Disclosures

3.1. Who we share personal information with, and why

We may disclose personal information to the following types of third parties for purposes described in this Policy and to the extent we are authorized or permitted by law.

3.2. Overseas disclosures

In certain circumstances, we may disclose your personal information outside your country of residence to overseas recipients, including purposes described in this Policy. The countries where we may use, store or transfer personal information include Australia, New Zealand, the United States of America, or the United Kingdom (UK). We take reasonable steps to ensure a lawful transfer mechanism applies, such as entering into binding agreements with third parties to ensure appropriate and comparable safeguards are in place.

For UK residents, where we transfer your personal information outside the UK to countries that are not covered by an adequacy decision, we use appropriate safeguards that include standard data protection clauses approved by the UK’s Information Commissioner’s Office, or other applicable measures, including transfers to a third party that has implemented Binding Corporate Rules, or specific situations outlined under Article 49 of the UK GDPR. You can access a copy of the Standard Contractual Clauses approved by the UK Information Commissioner’s Office here.

4. Personal Information Handling Practices

4.1. Quality

We take reasonable steps to ensure that the personal information we collect, use, and disclose is accurate, up-to-date, complete, relevant, and not misleading. We encourage you to assist us in maintaining the accuracy of your information by updating your details promptly when they change or when a review of your personal information is requested by us.

4.2. Security

We take reasonable steps to implement technical and organizational measures to ensure that your personal information is stored safely to protect it from misuse, loss, unauthorized access, modification, or disclosure. This includes, but is not limited to, securing electronic records within our network databases, and through third party data storage providers, ensuring that personal information within our network is password protected, with access appropriately limited and monitored. Customers are expected to stay vigilant to protect their accounts.

4.3. Retention

We may retain your personal information for as long as necessary in a form that permits us to identify you for the purposes we initially collected it, including:

• as described in this Policy;
• as required by or under an applicable law, including AML/CTF laws, or a court or tribunal order;
• to manage and enforce our agreement and rights, including to retain certain personal information at minimum for the duration of an active provision of Services to you;
• for our legitimate interests, such as to manage legal claims, disputes or complaints;
• with your consent; and
• as otherwise permitted or authorized under applicable law.

When personal information is no longer required for these purposes, we will take reasonable steps to securely de-identify or destroy your personal information.

4.4. Children's privacy

Our Services are not directed to persons under the age of 18 (Child or Children), and we do not knowingly request or collect any personal information about or relating to a Child. If you are under the age of 18, please do not provide any personal information through our Services. If a Customer is suspected of being younger than 18 years of age, we will immediately close the individual’s account and will not allow the continued use of our products and services. We will take legally permissible measures to remove their information from our records as soon as possible as required and permitted by law.

If you are a parent or guardian of a Child, and you become aware that a Child has provided personal information to us, please contact us as [email protected].

5. Your Rights and Choices

Depending on where you live and which entity you are interacting with, you may be able to exercise certain privacy rights and choices relating to personal information that we hold about you as described below. We do not discriminate in any way against you for exercising your personal information rights and choices.

5.1. Rights and choices that may be available to you

You, or an authorized representative, may have the right to request the following rights, subject to limitations and exemptions under law.

• Access: To access a copy of your personal information we hold about you, and further information about our personal information handling practices.
• Correction: To request the correction of personal information we hold about you, and notify any relevant third parties of this correction, unless it is impracticable or unlawful to do so. We may be unable to do so where we believe, for the purposes for which it is held, it is accurate, up to date, complete, relevant, and not misleading. You may ask us to keep an associated statement that states your view to the contrary.
• Withdraw your consent: Where we have relied on it as a lawful basis to process your personal information. This does not affect the lawfulness of the processing prior to your withdrawal.
• Data portability: To request that your data be transferred to a third party if it is technically feasible.
• Data erasure: To request the rectification or erasure of your personal information and the right to be forgotten.
• Restriction: To request that we cease or restrict processing of your personal information.
• Object: To object to the processing of your personal information, including to manage your marketing subscription preferences as described in section 5.2 below, to limit the use of sensitive personal information or opt out of the sale or sharing of your personal information in certain circumstances.
• Automated decision rights: To ask for more information about an automated decision that has a legal effect or similarly significant effect on you, and to contest or opt out of that processing of your personal information for these purposes.

We may ask for further information to clarify your request, and to verify your identity and the identity of your authorized representative, if relevant. We will provide you with an outcome to your request in a reasonable and timely manner as required by law. If we are unable to fulfil your request, we will share with you our reasons and the review and complaint mechanisms available to you. You can make a request by reaching out through the contact details set out in section 6 below.

5.2. Manage your marketing subscription preferences

If you would like to change your marketing subscription preferences or would like to opt out of our direct marketing communications where you are opted in, you may do so using the relevant unsubscribe facility, by contacting your broker directly, or through our general communication lines as detailed on our Website and this Policy.

Please note that if you opt out of direct marketing communications, you may continue to receive Service-related messages that are necessary for the operations of any account or Service you have with us, such as security alerts and notifications, account and transaction statements, or legal terms or policy updates and notifications.

5.3. Make a privacy inquiry or complaint

If you have an inquiry or complaint about how we have handled your personal information, please contact our Privacy Team (details below) in the first instance. We will ask you to put your complaint in writing and will respond within a reasonable timeframe and provide our reasons for the outcome of your inquiry or complaint. If you are unsatisfied, you can contact us to discuss your concerns.

If we are unable to address your concerns, you may have the right to make a complaint with the following applicable privacy regulators, depending on where you live.

• For Australian residents, you can make a complaint to the Office of the Australian Information Commissioner. You can visit their website (https://www.oaic.gov.au) to find their contact details or further information relating to Australian privacy legislation.
• For New Zealand residents, you have the right to make a complaint to the Office of the Privacy Commissioner. You can visit their website to find their contact details or further information relating to New Zealand privacy legislation (https://www.privacy.org.nz).
• For UK residents, you have the right to make a complaint to the Information Commissioner’s Office. You can visit their website (https://ico.org.uk/) to find their contact details or further information relating to UK privacy legislation.
• For Californian residents where the California Consumer Privacy Act (CCPA) applies, you have the right to make a complaint to the California Consumer Privacy Agency. You can visit their website (https://cppa.ca.gov/) to find their contact details or further information relating to the CCPA.

6. Contact Us

For inquiries, requests or complaints relating to this Policy, you may contact our Privacy Team by email at [email protected] or by calling our toll-free phone lines: +1 844 494 6515 (Intl) or +61 1800 849 149 (Aus).

The following entities under Caleb & Brown Holdings Pty Ltd (ABN 34 651 147 152) are jointly subject to this Privacy Policy, in which you may be provided Services from, including applying for and entering a contract for an account with us.

7. Changes to this Policy

We reserve the right to change this Policy from time to time, as may be required to keep it accurate and up to date. We will take reasonable steps to notify known individuals covered by this Policy of material changes through available communication channels, to the extent that it impacts them. The revised Policy will be effective on the “Effective Date” listed above.

8. Jurisdiction Specific Terms

8.1. U.S. California Privacy Notice

This Notice supplements our Privacy Policy terms described above if you are an individual who resides in California and we collect and handle your personal information through our Services as a consumer, defined under Californian privacy law. This Notice excludes individuals covered by our U.S Financial Privacy Notice in section 8.2 below, who are our U.S. Customers that apply for, and if approved, enters a consumer relationship with us for our Services that are primarily for personal, family or household purposes.

You can find categories of personal information we collect and our business purposes, and our sources in section 2 above, and recipients of disclosures for business purposes in section 3above. You can find more information on the criteria we use to determine how long we retain your personal and sensitive information where collected in section 4.3 above.

We do not have actual knowledge that we sell or share the personal information of individuals under 18 years of age. We do not sell or share your personal or sensitive information as defined under California privacy law unless as described in this Policy or where otherwise required and permitted by law. We do not collect, use, or disclose sensitive personal information for purposes other than those specified in this Policy, or as permitted or required under applicable law.

The following charts summarize categories of personal information and sensitive personal information we collect and disclose as categorized under applicable Californian privacy laws, including within the preceding 12 months.

8.1.1. Categories of personal information collected and disclosed

8.1.2. Categories of sensitive personal information collected and disclosed

8.1.3. Categories of personal information sold or shared

In the past 12 months, we’ve disclosed identifiers with third party analytics providers, advertising partners for analytics and targeted advertising purposes, which may constitute a “sale” or “sharing” as defined in the CCPA. For more information, refer to our Cookie Policy.

8.1.4. Your privacy rights, and how we deal with requests

You may have the following rights subject to exemptions and limitations:

• The right to know what personal information we have collected about you, including the categories of personal information, the categories of sources from which the personal information is collected, the business or commercial purpose for collecting, selling, or sharing personal information, the categories of third parties to whom the business discloses personal information, and the specific pieces of personal information the business has collected about the consumer;
• The right to delete personal information that the business has collected from the consumer, subject to certain exceptions;
• The right to correct inaccurate personal information that we maintain about you;
• The right to opt out of the sale or sharing of your personal information;
• The right to limit the use or disclosure of sensitive personal information; and
• The right access or opt out of automated decision-making technology, where personal information is used to make a significant decision.

For all other rights listed above, we may ask you to put your request in writing, for further information to clarify your request, and to verify your identity. You may designate an authorized agent to exercise your privacy rights on your behalf where we have verified both your identity and the authority of the agent to act on your behalf. We will provide you with an outcome to your request in a reasonable and timely manner as required under law. If we are unable to fulfil your request, we will share with you our reasons and the review and complaint mechanisms available to you. We do not discriminate or retaliate against you for exercising any of your privacy rights.

You can find our contact details to exercise your privacy rights, make an inquiry or complaint in section 6 above. If you are dissatisfied with the outcome of your request, inquiry or complaint, and we are unable to resolve your concerns, you can also make a complaint to the California Consumer Privacy Agency. You can visit their website (https://cppa.ca.gov/) to find their contact details or further information relating to the CCPA.

8.2. U.S. Financial Privacy Notice

This Notice supplements our Privacy Policy terms described above if you are an individual who resides in the United States and applies for, and if approved, enters a consumer relationship with us for our Services that are primarily for personal, family or household purposes.

Rev. 30 July 2026