Privacy Policy

1. Purpose and scope

This Privacy Policy explains how Briana Global Limited collects, holds, uses and discloses personal information. It applies to personal information we collect through our website, digital services, payment and money-transfer services, customer support, business relationships, verification processes and other dealings with you.

In this Policy, we, us and our mean Briana Global Limited. Personal information means information about an identifiable individual. Services means the services we make available from time to time within the service boundary described in section 2.

For the purposes of the Privacy Act 2020, Briana Global Limited is an agency. We are the collecting and holding agency for personal information described in this Policy, including information held for us by a service provider acting solely on our behalf. Our registered office is 3 Garland Drive, Saint Andrews, Hamilton 3200, New Zealand.

This Policy is written principally for the Privacy Act 2020 and the Information Privacy Principles (IPPs). Where we process biometric information, the Biometrics Processing Privacy Code 2025 may apply instead of the IPPs to that biometric processing. Nothing in this Policy limits any rights that cannot lawfully be excluded.

2. About Briana Global and our service boundary

Briana Global Limited is a New Zealand company (company number 9362687; NZBN 9429053039798). Its Financial Service Providers Register number is FSP1010808.

The official Financial Service Providers Register record, verified on 9 September 2026, lists Briana Global Limited as registered to provide the following financial services:

changing foreign currency;

issuing or managing means of payment; and

operating a money or value transfer service.

The record also lists membership of Financial Services Complaints Limited (FSCL) – a Financial Ombudsman Service, membership number 9518, effective 13 November 2025.

FSPR registration is not a licence or a government endorsement. New Zealand does not have a specific general licence for e-money or payment service providers. Whether other legal or regulatory requirements apply depends on the relevant business model and activity.

Briana Global Limited is not a broker. We do not offer contracts for difference, derivatives, securities, investment advice, lending or credit, deposit accounts, or cryptocurrency services.

3. Our privacy approach

We collect personal information only for a lawful purpose connected with our functions or activities and only where the information is necessary for that purpose. We take reasonable steps to ensure that information is collected fairly, used for the purpose for which it was collected or a directly related purpose, and is accurate, current, complete, relevant and not misleading before it is used or disclosed.

The particular information we need depends on the Service, the transaction, the risk involved, the legal requirements that apply, and whether you are an individual customer, a representative of a business customer, a payment sender, a recipient, or another person connected with a transaction. We may need to verify information we receive and ask for additional information where reasonably necessary.

4. Personal information we may collect

The categories below describe the personal information that we may collect, depending on our relationship with you and the Services you use.

5. Where we collect personal information from

We will generally collect personal information directly from you, including when you register, request a Service, make or receive a payment, provide identity documents, contact us, use our website or digital services, or respond to a request for information.

We may also collect personal information indirectly where this is reasonably necessary and permitted by law. Depending on the circumstances, sources may include:

a person who sends or receives a payment, a business customer, or an authorised representative;

directors, shareholders, beneficial owners, authorised persons or other people connected with a business customer or transaction;

banks, payment providers, correspondent or intermediary institutions, receiving institutions and other participants in a payment chain;

identity-verification, fraud-prevention, sanctions-screening and other compliance service providers;

public registers, publicly available sources, regulators, government agencies and law-enforcement bodies where we are entitled to obtain information from them; and

our professional advisers or another person where that person is authorised or legally entitled to provide the information.

We only collect information indirectly where there is a lawful basis for doing so under the Privacy Act or another applicable law. We will assess the source, purpose and fairness of the collection in the circumstances.

Information collected about someone else

A sender or business customer may provide us with personal information about a recipient, a director, a shareholder, a beneficial owner, an authorised person or another person connected with a transaction or business relationship. If you provide another person’s information to us, you must have authority to do so and, where appropriate, take reasonable steps to tell that person that we will collect, use and disclose their information as described in this Policy.

If we collect personal information about an individual from a source other than that individual, we will take reasonable steps to notify that individual as soon as reasonably practicable where required by IPP 3A. The notification will address the matters required by law, including that we hold the information, the purpose of collection, intended recipients, our identity and contact details, any particular legal authority that applies, and the person’s access and correction rights.

There are limited circumstances in which the Privacy Act permits us not to give an IPP 3A notification. For example, this may be so where the person has already been made aware of the relevant matters, the information is publicly available, notice would prejudice the purpose of collection, notice would not be reasonably practicable, or another statutory exception applies. We will not treat cost or convenience alone as a sufficient reason to avoid a notification.

6. Why we collect and use personal information, and our authority to do so

We may collect, use and otherwise handle personal information for the following lawful purposes:

Providing the Services. This includes assessing a request, establishing and administering a customer relationship, communicating with you, processing and reconciling a currency exchange, payment or money/value transfer, dealing with errors or enquiries, and providing customer support.

Identity, authority and due-diligence checks. This includes verifying identity, age or authority to act; identifying business controllers and beneficial owners; and undertaking CDD or other checks that are appropriate to the relevant Service or relationship.

Financial-crime, sanctions and fraud prevention. This includes detecting, investigating and managing suspected fraud, scams, misuse, sanctions risks, financial-crime risks, security incidents and other unlawful or prohibited activity.

Meeting legal and regulatory duties. This may include duties under the Anti-Money Laundering and Countering Financing of Terrorism Act 2009 (AML/CFT Act), sanctions legislation, tax law, court orders and other laws that apply to us or the relevant transaction. It may also include responding to lawful requests from regulators, enforcement agencies or courts.

Operating and protecting our business. This includes maintaining records, managing complaints and disputes, auditing, accounting, insurance, legal advice, enforcing legal rights, business continuity, testing and improving our processes, and protecting our website, digital services, people and property.

Communications and marketing. Where permitted by law, this includes sending service, security and administrative communications, responding to enquiries, and sending marketing communications only in accordance with your choices and applicable law.

The Privacy Act does not use a single general list of “legal bases” in the same way as some overseas privacy laws. Under New Zealand law, our collection, use and disclosure must comply with the IPPs, the Biometrics Processing Privacy Code 2025 where applicable, and other laws that apply to the activity.

Where a law requires or authorises us to collect information, the relevant authority may include the AML/CFT Act or another applicable legal obligation. Where collection is required to provide a Service or meet a legal obligation, we will identify this in the relevant collection notice where practicable.

7. Information that is required or optional

Some personal information is required because it is needed to provide a Service, verify identity or authority, carry out CDD, prevent fraud, process a transaction, or meet a legal obligation that applies to us. Other information is optional, such as a marketing preference or information that is not needed to provide the Service you request.

We will give you a clear notice at or before the point of collection, or as soon as reasonably practicable afterwards, explaining:

what personal information we are collecting;

why we are collecting it and the intended recipients;

that Briana Global Limited is the collecting and holding agency, and how to contact us;

any particular law that requires or authorises the collection;

whether providing the information is required or optional; and

the consequences if you do not provide required information.

If you do not provide required information, we may be unable to verify you, establish or maintain a customer relationship, accept or carry out a transaction, make a payment available to a recipient, investigate an issue, or provide the requested Service. We will explain the relevant consequence where practicable. Choosing not to receive marketing will not affect the core Services.

8. Biometric information and identity verification

This section applies if a verification process for a Service collects or uses biometric information, such as a selfie, video, facial image, liveness information or a biometric template derived from it.

We will only collect or use biometric information where the processing is lawful and connected with a legitimate purpose, and where it is necessary, effective, proportionate and subject to appropriate safeguards in the circumstances.

Before or at the time we collect biometric information, we will provide a clear and conspicuous notice that identifies: the fact that biometric information is being collected; each specific purpose, such as identity verification or liveness/anti-spoofing checks; any available alternative verification process and how to request it; and where you can obtain further information about the processing. We will give the remaining applicable notice information before collection or, if that is not practicable, as soon as practicable afterwards. This includes the biometric information involved, collector and holder, intended recipients, legal authority where relevant, whether supply is required or optional, the consequences of not supplying it, retention information, and access, correction and complaint rights.

We will make the notice available in a form appropriate to the collection channel and, where relevant, will describe the overseas handling arrangements for biometric information.

We will provide a non-biometric alternative process where this is required by law. If a biometric process is required for a particular verification method, or if no alternative is available for a particular purpose, we will explain this and the likely consequence before collection where practicable.

We use biometric information only for the notified identity-verification and anti-spoofing purpose, or another purpose permitted by the Biometrics Processing Privacy Code 2025 or other applicable law. We do not use biometric information for direct marketing or to categorise individuals. We will not use biometric information to train a model or permit a provider to use it for that provider’s own purposes unless this is separately assessed, clearly notified and permitted by law.

A biometric verification result can be affected by image quality, device conditions, presentation factors and other errors. If you believe a biometric check has produced an incorrect result, please contact us at support@brianaglobal.com. We will consider whether a manual or alternative review is available, subject to applicable law and the purpose of the check.

9. Cookies, similar technologies and technical information

Our website and digital services may use cookies, software development kits, pixels, local storage, server logs and similar technologies. These technologies may collect technical and usage information described in section 4.

We may use these technologies to:

keep a service functioning and protect it against misuse;

remember settings and preferences;

understand how visitors use a website or digital service and improve it; and

measure the performance of communications or content where permitted.

The technologies used can change as our services change. Where required by law, we will give you a choice before using non-essential technologies. You can also use browser or device controls to manage some cookies and identifiers. Restricting certain technologies may affect the availability or functioning of particular website or digital-service features. Our point-of-collection notice or preference tool, where available, will give further information about the relevant technologies and choices.

10. Who we may disclose personal information to

We may disclose personal information only for a purpose for which it was collected, a directly related purpose, or another purpose permitted or required by law. We seek to limit disclosures to information reasonably needed for the relevant purpose.

Depending on the Service and circumstances, recipients may include:

Recipient category

Why disclosure may be needed

Payment and financial-service participants

Banks, payment providers, correspondent or intermediary institutions, receiving institutions, and other payment participants may need information to process, settle, investigate, return or comply with obligations connected with a payment or money/value transfer.

Verification, compliance and fraud-service providers

Identity-verification, screening, fraud-prevention, security and other providers may assist us to verify information, assess risk, prevent misuse or meet legal obligations.

Service providers acting for us

Providers of technology, hosting, communications, customer support, professional administration, secure document handling, audit or similar services may process information solely on our behalf. We remain responsible for personal information held by an agent acting solely for us.

Regulators, government agencies and enforcement bodies

We may disclose information where required or permitted by law, including to meet AML/CFT, sanctions, tax, regulatory, court-order or law-enforcement requirements.

Professional advisers and insurers

Auditors, lawyers, accountants, insurers and other advisers may need information to advise us, manage claims or help us meet legal obligations.

Dispute-resolution bodies

FSCL or a successor dispute-resolution scheme may need information to consider or resolve a complaint.

Corporate transaction parties

A prospective or actual purchaser, financier, adviser or successor may receive information where reasonably necessary for a proposed or completed restructure, sale, merger or similar transaction, subject to applicable law.

A third party may be an independent agency in respect of information it holds or uses for its own purposes. That third party’s privacy practices will then apply to its handling of the information. We may also use service providers that act solely on our behalf. In that situation, we require the provider to handle the information only for the agreed purpose and to take reasonable steps to protect it.

We do not disclose personal information to another organisation for that organisation’s own direct-marketing purposes unless you have agreed or the disclosure is otherwise permitted by law.

11. Overseas disclosures and processing

Because payment and money/value-transfer services can involve people, financial institutions and service providers in other countries, personal information may be processed or disclosed outside New Zealand. This may include the destination country of a transfer, countries where payment participants operate, and countries where our service providers support our operations.

Where an overseas provider acts solely as our agent, we remain responsible for the personal information that it handles on our behalf. We take reasonable steps to ensure that our arrangements with such providers support our obligations under New Zealand privacy law.

Where we disclose personal information to an overseas recipient that will hold or use the information for its own purposes, we will do so only where permitted by the Privacy Act and after considering the applicable overseas-disclosure requirements. Depending on the circumstances, this may involve determining that:

the recipient is subject to the Privacy Act;

the recipient is subject to privacy safeguards that are comparable to those in the Privacy Act;

contractual or other arrangements provide comparable safeguards;

you have given express authorisation after being informed that the recipient may not be required to protect the information in a way that is comparable to the Privacy Act; or

another statutory basis or exception applies.

If biometric information is disclosed to an overseas recipient that will hold or use it for its own purposes, we will also consider the overseas-disclosure requirements of the Biometrics Processing Privacy Code 2025, including whether the recipient is subject to safeguards comparable to that Code where required.

We do not treat the fact that a transfer is international, or that a disclosure is convenient, as a substitute for the required legal assessment. If we rely on your express authorisation for a relevant overseas disclosure, the required warning will be given separately and clearly before you authorise the disclosure.

12. Security and accuracy

We take reasonable steps, having regard to the nature and sensitivity of the information and the risks of harm, to protect personal information against loss, unauthorised access, use, modification, disclosure and other misuse. Our safeguards may include organisational, physical and technical measures appropriate to the circumstances, as well as controls for service providers that handle information on our behalf.

No method of electronic transmission, storage or processing is completely secure. We cannot guarantee absolute security. If you think that your information or an interaction with us may have been compromised, please contact us promptly at support@brianaglobal.com

Before using or disclosing personal information, we take reasonable steps to ensure it is accurate, current, complete, relevant and not misleading for the purpose. We may ask you to confirm or update information, verify information with a reliable source where appropriate, or pause a request while an apparent discrepancy is considered. Please tell us promptly if your information changes or you believe it is inaccurate.

13. How long we keep information

We retain personal information only for as long as it is required for a lawful purpose. The applicable period depends on the type of record, our legal obligations, the nature of the Service and whether a legal hold, dispute, investigation or direction from an authorised body requires longer retention.

Record category

Retention approach

Transaction records

We retain transaction records for the period required by applicable law. Under the AML/CFT Act, transaction records required by that Act are generally retained for at least five years after completion of the relevant transaction, subject to any longer period required by law or lawful direction.

Identity, CDD and verification records

We retain identity and verification records for the period required by applicable law. Under the AML/CFT Act, the relevant retention trigger may differ depending on whether the record relates to a business relationship, an occasional transaction or activity, or a wire transfer. This may generally be at least five years after the relevant relationship ends or transaction/activity is completed.

Account, customer-service and business-relationship records

We retain these records while the relationship continues and afterwards for as long as reasonably needed for administration, legal obligations, audit, complaints, disputes, legal rights or another lawful purpose.

Fraud, sanctions, security and compliance records

We retain these records for as long as reasonably needed to manage the relevant risk, comply with applicable law, deal with an investigation, or establish, exercise or defend legal rights.

Biometric samples, templates and verification outputs

We retain biometric information only for the period reasonably necessary for the verified purpose and any applicable legal requirement. A biometric sample or template is not subject to a blanket five-year period merely because other identity or transaction records may be.

Communications, complaints and support records

We retain these records for as long as reasonably needed to respond to, administer and evidence the interaction, complaint or outcome, subject to applicable legal requirements.

Cookies, technical logs and preference records

We retain these records for periods that are appropriate to the purpose, the technology used, security needs and applicable law. We retain preference records for as long as reasonably needed to honour and demonstrate the relevant choice.

Marketing suppression records

If you opt out of marketing, we may retain the minimum information needed to record and honour that choice.

When information is no longer required, we will take reasonable steps to delete, destroy or de-identify it. Information may remain in backups for a limited period before normal replacement or deletion processes apply. We may retain information for longer where required or permitted by law.

14. Your access and correction rights

You may ask us to confirm whether we hold personal information about you and to give you access to that information. You may also ask us to correct personal information that you believe is inaccurate, out of date, incomplete, irrelevant or misleading.

Please send an access or correction request to support@brianaglobal.com. To protect your information, we may ask for information needed to verify your identity and authority to make the request. We will not use that verification information for an unrelated purpose.

We will deal with requests in accordance with the Privacy Act. We normally decide access and correction requests within 20 working days, unless the Act permits an extension, transfer or withholding. If we do not make a requested correction, you may ask us to attach a statement of correction to the information. Where we correct information or attach such a statement, we will, where reasonably practicable, tell people to whom we have disclosed the information.

There are limited grounds on which the Privacy Act permits information to be withheld or a request to be refused. If that occurs, we will explain the decision to the extent required by law and tell you about the right to complain to the Office of the Privacy Commissioner.

A request to correct information may include a request to delete information where that is appropriate. This is not a general right to deletion. We may need to retain information to meet legal obligations, including obligations under the AML/CFT Act, or for another lawful purpose.

15. Marketing choices

Where we send direct marketing, we will do so only in accordance with applicable law and your communication choices. You can opt out of marketing communications by using the unsubscribe facility in the message, changing an available preference setting, or contacting support@brianaglobal.com.

We may still send non-marketing communications that are necessary to provide the Services, maintain an account or relationship, respond to a request, protect security, or meet a legal obligation. An opt-out of marketing will not stop those communications.

16. Automated tools and human review

We may use automated tools to support identity verification, transaction monitoring, sanctions screening, fraud prevention, security and operational risk management. Those tools may help identify information that requires further consideration. Depending on the circumstances, this may result in a request for additional information, a delay, a restriction, or a decision not to proceed with a requested Service or transaction.

Automated tools do not remove our responsibility to handle personal information fairly, accurately and in accordance with applicable law. You may contact support@brianaglobal.com to ask us to review the personal information used in an assessment and, where appropriate, to request human review of an outcome materially influenced by an automated tool. A review may be limited where a particular outcome is required by law, where disclosure would prejudice a lawful purpose, or where another lawful withholding ground applies.

We do not state that a particular outcome will be changed following a review. Any review will consider the information available, the purpose of the assessment and applicable legal obligations.

17. Children and young people

We take particular care when collecting personal information about children and young people. Where we know that a person is a child or young person, we will take account of their age, understanding, circumstances and the fairness of the collection. We may ask for information necessary to assess eligibility, authority or an appropriate point of contact.

If we become aware that personal information about a child or young person has been collected in circumstances that require action, we will assess the information and take appropriate steps. This may include restricting use, contacting an appropriate person, correcting information, or deleting information where appropriate and not inconsistent with a legal retention obligation.

18. Privacy breaches

A privacy breach occurs when personal information is accessed, disclosed, altered, lost or destroyed without authorisation, or is unable to be accessed in circumstances where unauthorised access or disclosure has occurred or may occur.

We will assess suspected privacy breaches promptly. If a breach is notifiable under the Privacy Act because it has caused, or is likely to cause, serious harm, we will notify the Office of the Privacy Commissioner and affected people as soon as practicable, unless an exception or lawful delay applies. Where direct notification is not reasonably practicable, we may use another method permitted by law.

19. Privacy Officer, questions and complaints

You may contact our Privacy Officer about our compliance with privacy law, a privacy request or a privacy complaint. The Privacy Officer function is responsible for encouraging and monitoring our compliance with privacy law, dealing with privacy requests and complaints, and liaising with the Office of the Privacy Commissioner where appropriate.

For a privacy question, access request, correction request or privacy complaint, contact our Privacy Officer:

Briana Global Limited

3 Garland Drive

Saint Andrews, Hamilton 3200

New Zealand

Email: support@brianaglobal.com

For general customer support, contact support@brianaglobal.com.

For a complaint about our Services, please contact us first at complaints@brianaglobal.com. You may also contact us at compliance@brianaglobal.com for a compliance concern. We will consider complaints in accordance with our complaints process and applicable law.

If your concern is about our handling of personal information and we have not resolved it, you may complain to the Office of the Privacy Commissioner. Information about making a complaint is available at www.privacy.org.nz.

If your complaint concerns a financial service and remains unresolved after you have raised it with us, you may be able to refer it to Financial Services Complaints Limited (FSCL) – a Financial Ombudsman Service, subject to its rules and eligibility criteria. Briana Global's FSCL membership number is 9518, effective 13 November 2025. FSCL can be contacted at 0800 347 257, +64 4 472 3725 from overseas, complaints@fscl.org.nz, PO Box 5967, Wellington 6140, New Zealand, or at fscl.org.nz.

20. Additional rights under other laws

This Policy does not promise that the privacy rights of another jurisdiction apply to every person who uses our Services or whose information we handle. Additional rights apply only where the relevant law requires them.

For example, where the EU General Data Protection Regulation, the UK General Data Protection Regulation or another overseas privacy law applies to particular processing, we will provide the rights, notices and contact arrangements required by that law. The fact that a person is outside New Zealand does not by itself make those laws apply.

21. Changes to this Policy

We may update this Policy to reflect changes in our Services, information-handling practices or legal requirements. The current version will be published on our website with its version number and effective date. Where a change is material, we will take reasonable steps to provide additional notice where appropriate.

Version 1.0 | Effective 9 September 2026