Privacy

Kafrouni Law Pty Ltd: Privacy Policy (anti-money laundering activities)

Version 1, 11 November 2026. Kafrouni Law Pty Ltd, ABN 29 120 537 162.

What this policy covers

  1. This policy explains how we manage personal information for our anti-money laundering and counter-terrorism financing (AML/CTF) activities. We are a small business, so the Australian Privacy Principles in the Privacy Act 1988 (Cth) apply to us for these activities (Privacy Act s 6E(1A)). We keep all other client information confidential under our professional obligations as lawyers.
  2. Our AML/CTF activities are the checks and records that the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) requires when we provide a service it regulates: identifying and checking our client and the people who own, control or act for it, monitoring the relationship, keeping records and reporting to AUSTRAC as the law requires.

What we collect

  1. For these activities we collect and hold:
    1. names, other names used, dates of birth, residential and business addresses and contact details;
    2. copies of identity documents and identity document numbers;
    3. information about who owns and controls a company, trust or other entity, and who acts for it;
    4. whether a person holds or has held a prominent public position, or is related to someone who does;
    5. the nature and purpose of the work we are doing, and, where more checking is needed, information about the source of a client's funds and wealth;
    6. the results of our searches of public registers, the Australian sanctions list and news and other public sources, which may include allegations of criminal conduct; and
    7. our assessment of the risk of the client relationship.

How we collect and hold it

  1. We collect this information from our client, from the person concerned, from people who act for our client, from public registers such as ASIC's, and from searches of public sources, including internet searches and the Australian sanctions list. If you give us information about another person, such as a director, trustee or beneficial owner, please let them know and show them this policy.
  2. We hold it electronically:
    1. copies of identity documents and identity document numbers in our practice management system (Actionstep) only;
    2. other customer due diligence forms and records in the client's matter file, held in Microsoft OneDrive; and
    3. working material in the AI tool described in paragraphs 8 to 11, through our business account.
  3. Access to these records is limited to our principal, Joe Kafrouni. We protect them with secure systems, access controls and contract terms with our providers.

Why we collect, use and disclose it

  1. We collect, hold, use and disclose this information to meet our AML/CTF obligations: to identify and verify our client and the people who own, control or act for it, to assess and manage risk, to decide whether we can act and what further checks are needed, to monitor the relationship, to keep the records the law requires and to report to AUSTRAC. We may disclose it to AUSTRAC or other authorities where the law requires or authorises it, to the independent evaluator who reviews our AML/CTF program as the law requires, and to the service providers described in this policy. We do not sell personal information.

Anti-money laundering checks and our use of AI

  1. If you do not give us the information we need for these checks, we cannot act on the matter.
  2. We use an artificial intelligence tool, Claude, provided by Anthropic through our business account, to help prepare these checks. It fills in our forms from documents we hold, works out who owns and controls a client, runs internet searches against a person's name, and prepares a proposed risk rating. A lawyer of our firm reviews all of this work and makes every decision. We do not give the tool copies of identity documents or identity document numbers; we keep those in our practice management system.
  3. Anthropic is bound by contract to use the information only to provide its service to us, to keep it confidential and secure, and not to use it to train its AI models.
  4. We do not make any decision about a person solely by computer program. When we decide whether we can act for a client and how much checking is needed, the AI tool uses the information in paragraph 3 to prepare search results and a proposed risk rating, which a lawyer reviews before making the decision.

Overseas disclosure

  1. We are likely to disclose personal information collected for our AML/CTF activities to recipients overseas. Anthropic stores information in the United States and may process it in data centres in other countries, including in Europe and Asia. Internet searches made through the AI tool go to the search provider it uses. The recipients are therefore likely to be located in the United States and in countries in Europe and Asia.

How long we keep it

  1. The AML/CTF Act requires us to keep records. We keep customer due diligence records for 7 years after our relationship with the client ends or 7 years after the last transaction, and transaction records for 7 years after the record is made or received.
  2. After that period we destroy or de-identify the information, unless another law or our professional obligations require us to keep it longer. Anthropic keeps conversations with the AI tool until we delete them, and removes them from its systems within 30 days after that; conversations its automated safety systems flag may be kept for up to 2 years.

Seeing and correcting your information

  1. You may ask to see the personal information we hold about you, or ask us to correct it, by contacting us (paragraph 18).
    1. We respond within a reasonable time, usually 30 days.
    2. We do not charge for a request. If giving access involves significant cost, we may charge a reasonable fee, which we tell you about first.
    3. We may refuse access, or refuse to correct information, only where the Privacy Act allows, for example where giving access would be unlawful. If we refuse, we tell you in writing why, unless it would be unreasonable to do so, and how to complain.
    4. If we do not agree to correct information, you may ask us to note with it that you consider it inaccurate, out of date, incomplete, irrelevant or misleading.

Complaints

  1. If you think we have breached the Australian Privacy Principles, please write to us (paragraph 18) with the details. We acknowledge your complaint within 7 days, look into it, and give you our written response within 30 days.
  2. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC): www.oaic.gov.au, phone 1300 363 992. The OAIC usually expects you to complain to us first.

Contact us

  1. Privacy enquiries, requests and complaints: Kafrouni Law Pty Ltd, Level 34, Waterfront Place, 1 Eagle Street, Brisbane QLD 4000; phone +61 7 3103 3199; email mail@klaw.com.au.
  2. This policy is free. You may ask us for a copy in another form, and we will provide it where reasonable.

Changes to this policy

  1. We review this policy when our practices or the law change. The current version is on our website, klaw.com.au.
Skip to main content