The Vanuatu Financial Services Commission (VFSC) respects your privacy and is committed to protecting the personal information it collects and holds.

This Privacy Policy explains how VFSC collects, uses, stores and discloses personal information when you:

• visit a VFSC website;
• create or use a VFSC online account;
• use a VFSC registry or regulatory service;
• submit an application, filing, form or document;
• make a payment;
• subscribe to VFSC communications; or
• contact VFSC.

VFSC handles personal information in accordance with applicable Vanuatu law, including the Data Protection and Privacy Act No. 13 of 2024.

Depending on the service you use, VFSC may collect:

• your name, date of birth and identification information;
• your residential, postal or business address;
• your email address and telephone number;
• your username and account information;
• information about your authority to act for another person or organisation;
• company, business, association or other organisation details;
• information relating to directors, shareholders, beneficial owners, officers, members or authorised representatives;
• applications, filings, declarations, supporting documents and correspondence;
• licence, registration and compliance information;
• the VFSC services and fees selected for payment;
• payment amounts, dates, references and payment status;
• information submitted in connection with a payment or refund request; and
• technical information such as your IP address, browser, device information, login history and activity within a VFSC online service.

VFSC may collect information directly from you, from a person authorised to act for you, from public records, from other government agencies or from an organisation providing a service to VFSC.

Credit-card payments are processed securely by an authorised payment service provider.

VFSC does not collect or store your credit-card number, expiry date or card security code. Your card details are provided directly to the payment service provider.

VFSC receives only the transaction information required to record and reconcile the payment, such as the payment amount, transaction reference, date and payment status.

VFSC may use personal information to:

• establish and administer user accounts;
• verify your identity and authority;
• process applications, registrations, filings and other service requests;
• administer public registers and official records;
• assess compliance with legal and regulatory requirements;
• process, allocate and reconcile payments;
• issue receipts and payment confirmations;
• process refund requests;
• communicate with you and respond to questions;
• provide notices, updates and service information;
• prevent, identify and investigate fraud, misuse or security incidents;
• maintain financial, audit, regulatory and operational records;
• improve the security, reliability and operation of VFSC services;
• undertake regulatory, supervisory and enforcement functions; and
• comply with VFSC’s legal obligations.

VFSC will not sell or rent your personal information.

VFSC is required to maintain public registers and make certain information available for inspection under applicable legislation.

Information submitted in connection with a company, business name, charitable association, licence or other registered matter may become publicly available where required or permitted by law.

This Privacy Policy does not prevent VFSC from publishing or providing access to information that forms part of an official public register.

Payment-card details are not published on VFSC public registers.

VFSC may disclose personal information to:

• other Vanuatu government departments and agencies;
• law-enforcement, regulatory and judicial authorities;
• banks, card schemes and payment processors;
• technology, hosting, communications and support providers acting for VFSC;
• auditors and professional advisers;
• overseas regulatory or enforcement authorities where disclosure is lawfully authorised; and
• another person or organisation where you have authorised the disclosure.

VFSC may also disclose information where required or permitted by law, or where reasonably necessary to protect VFSC’s systems, users or legal rights.

Service providers acting for VFSC may use personal information only to provide the relevant service or as otherwise required by law.

Some payment, hosting, technology or support providers may process or store information outside Vanuatu.

Where this occurs, VFSC will take reasonable steps to ensure that the information is protected and handled consistently with applicable privacy requirements.

VFSC websites and online services may use cookies and similar technologies to:

• keep you securely signed in;
• maintain your session;
• remember necessary settings;
• protect against fraud and unauthorised access;
• understand how VFSC services are used; and
• monitor performance and reliability.

You can control cookies through your browser settings. Disabling essential cookies may prevent parts of a VFSC online service from operating correctly.

VFSC uses reasonable administrative, technical and physical safeguards to protect personal information against loss, misuse, unauthorised access, alteration and disclosure.

Access to personal information is restricted to authorised personnel and service providers who require it for legitimate purposes.

No online service can be guaranteed to be completely secure. You should use a strong password, keep your login details private and sign out after using a shared device.

If you believe your VFSC account or personal information has been compromised, contact VFSC promptly.

VFSC retains personal information for as long as reasonably necessary to:

• provide and administer its services;
• maintain official registers and records;
• meet financial, audit, regulatory and legal requirements;
• resolve payment questions or disputes;
• investigate fraud, misuse or security incidents; and
• carry out its statutory functions.

Different retention periods may apply to different records.

Information that is no longer required will be securely deleted, destroyed or anonymised, subject to applicable legal and public-record requirements.

Subject to applicable law, you may ask VFSC to:

• confirm whether it holds personal information about you;
• provide access to that information;
• correct information that is inaccurate, incomplete or out of date; or
• delete information that VFSC is not legally required to retain.

VFSC may need to verify your identity before responding to a request.

VFSC may be required to retain information forming part of a public register, official record, financial record, regulatory file or investigation even if deletion is requested.

VFSC may use your contact details to send:

• account and security notifications;
• payment confirmations and receipts;
• information about an application or filing;
• regulatory or compliance notices; and
• other communications relating to a service you have requested.

Where VFSC sends an optional newsletter or general update, you may unsubscribe using the method provided in the communication.

Unsubscribing from optional communications will not prevent VFSC from sending necessary account, payment, regulatory or service notices.

VFSC websites may contain links to websites operated by other organisations.

VFSC is not responsible for the privacy or security practices of an external website. You should review the privacy policy of that website before providing personal information.

VFSC may update this Privacy Policy from time to time.

The current version will be published on the VFSC website and will apply from the effective date shown. Where appropriate, VFSC may notify registered users of a material change.

For questions about this Privacy Policy, requests to access or correct personal information, or concerns about how personal information has been handled, please contact:

Vanuatu Financial Services Commission
Companies House
PMB 9023
Rue Bougainville
Port Vila, Vanuatu

Email: info@vfsc.vu

Phone: +678 22247