Privacy & Credit Reporting Policy

Notifiable matters

The law requires us to advise you of notifiable matters in relation to how we may use your credit-related information. You may request to have these notifiable matters (and this policy) provided to you in an alternative form.

We may exchange your credit-related information with credit reporting bodies (CRBs). We use the credit-related information that we exchange with CRBs to confirm your identity, assess your creditworthiness, assess your application for finance or your capacity to be a guarantor and manage your finance.

The information we may exchange with CRBs includes:

• your identification details;
• what type of loans you have, how much you have borrowed;
• whether or not you have met your loan payment obligations;
• if you have committed a serious credit infringement (such as fraud);
• whether you have entered into a financial hardship arrangement (whether temporary or permanent) in relation to credit to which the National Consumer Credit Protection Act 2009 applies.

You have the right to request access to the credit-related information that we hold about you and make a request for us to correct that credit-related information if needed. See Requesting access to, or correction of your personal or credit-related information below for further information.

Sometimes your credit-related information will be used by CRBs for the purposes of pre-screening credit offers on the request of other credit providers, and for direct marketing by a credit provider. You can contact the CRBs at any time to request that your credit-related information is not used in this way.

You may contact CRBs to advise them that you believe that you may have been a victim of fraud. For a period of 21 days after the CRBs receives your notification the CRB must not use or disclose that credit-related information.

You can contact any of the following CRBs for more information:

• Equifax Australia, www.mycreditfile.com.au (13 83 32)
• Experian Australia, www.experian.com.au (1300 784 134)

What types of personal information and credit-related information do we collect and hold?

When we refer to personal information, we mean information from which your identity is reasonably apparent. This information may include information or an opinion about you that we collect and hold throughout the course of our relationship, and from persons you have nominated to supply information. The personal information we hold about you may include:

• Identification information, which is information which includes your name, address, contact details and date of birth used to identify you, and used to protect against fraud and unlawful activity.
• Financial information, which is information required for making credit-related decisions. For example, credit reports from CRBs, bank account information relating to your income and expenses, assets and liabilities, credit and loan repayment history, past and present credit types, employment information, court proceedings, insolvency and default information.
• Sensitive information. We will only collect sensitive information about you with your consent. For Propential products, the only sensitive information we will collect is information about your health or other reasons relating to hardship and biometric identification for verification purposes, unless such other information is necessary to process an application for a loan.
• Credit information, which is information which includes your identity; the type, terms and maximum amount of credit provided to you, including when that credit was provided and when it was repaid; repayment history information, financial hardship information (including information that any repayments are affected by a financial hardship arrangement), default information (including overdue payments); payment information; new arrangement information; details of any serious credit infringements; court proceedings information; personal insolvency information and publicly available information; and
• Credit eligibility information, which is credit reporting information supplied to us by a CRB, and any information that we derive from it.

Collectively, we refer to credit information and credit eligibility information as credit-related information.

We use your credit-related information to assess your eligibility to be provided with finance and this information may influence credit that has been provided to you or that you have applied for. This includes personal credit and business credit. It can also cover information about you as a guarantor of a loan. Usually, credit-related information is exchanged between credit and finance providers and CRBs.

If you are applying for finance or providing a guarantee, we may ask for Identification information, and also collect the ages and number of your dependants and cohabitants, the length of time you have resided at your current address, your employment details and proof of earnings and expenses. We may collect Financial Information so that we can assess your credit application, your suitability as a guarantor, or to manage your credit with us.

How do we collect personal and credit-related information?

• Directly from you. This occurs when you complete our online loan application and when you talk to us in person or on the phone. We may record your interactions with us, including your telephone conversations with us and your use of our emails and website.
• Electronically. This occurs through electronic records created when you use our website, tablet or mobile applications. For example, information about your location or activity including the date of and time of visits, which pages are viewed, how you as the user navigate through the website and interact with the webpages (including fields completed in forms and applications), IP address, telephone number, information about the device used to visit our website and whether you have accessed third party sites.
• Third party service providers. We collect information about you from third parties such as credit agencies, accountants, lawyers, financial institutions, landlords, agents, advisers, brokers and/or employers.
• Public information. We may also collect information about you that is publicly available, for example from public registers or social media, or made available by third parties.
• CRB or lenders. We may collect credit reports from CRBs or opinions from other lenders about your creditworthiness.

We may record your interactions with us, including your telephone conversations with us.

If you provide personal or credit-related information to us about someone else, you must ensure that you are entitled to disclose that information to us and that we can collect, use and disclose that information as set out in this Policy without having to take any further steps required under law (such as obtain that person's consent). Thus, if you provide us with personal information and credit-related information about someone else, you must ensure that the individual understands the content of this Policy and has provided their consent for you to provide us with their information and to be bound by this policy.

How do we hold personal and credit-related information?

We will take reasonable steps to protect your personal and credit-related information. Your personal and credit-related information will always be stored in a secure environment, and will mainly be stored electronically in cloud or other types of networked or electronic storage centres. We may store your personal and credit-related information in paper and electronic form. We will also take reasonable steps to protect any information from misuse, loss and unauthorised access, modification or disclosure. All service providers we contract with are required to have a Privacy Policy, and comply with the Privacy Act. However, please note that information you provide to us through electronic means, for example via the internet or email, may be insecure in transit, particularly where no encryption is utilised.

How do we use personal information?

We collect, use and exchange your information so that we can:

• establish and verify your identity including using biometric identification verification and identity verification services;
• assess applications for products and services;
• manage those products and services;
• price and design our products and services;
• administer our products and services;
• manage our relationship with you;
• manage our risks and help identify and investigate illegal activity, such as fraud;
• contact you, for example if we suspect fraud on our account or need to tell you something important;
• conduct and improve our businesses and improve the customer experience;
• comply with our legal obligations and assist government and law enforcement agencies or regulators; and
• identify and tell you about other products or services that we think may be of interest to you.

We may use credit-related information to assess your eligibility for credit or to become a guarantor, assist you to manage your repayment obligations, administer failures to repay, assess repayment variations, perform other credit maintenance activities in connection with your credit, comply with our regulatory obligations, prevent fraud, and similar. We may also collect, use and exchange your information in other ways where permitted by law.

To whom do we disclose personal or credit-related information?

We may disclose certain personal and credit-related personal information with CRBs to notify them about defaults, update credit reporting information, obtain a credit history report, any temporary or permanent hardship arrangements and any other activities of a similar nature.

The CRBs we may use include Equifax Australia and Experian Australia. You can contact these CRBs or visit their websites (provided above) to view their policies on their management of credit-related and personal information, including details of how to access your credit-related personal information they hold.

We may collect, hold, use and disclose certain personal information and credit-related information about you to assess and administer your credit in default recovery situations, to operate our business and improve our products, to obtain funding and to meet our legal and regulatory obligations. This information may include:

• permitted identification information e.g. names, date of birth, gender, most recent addresses, employer, passport and driver's licence details;
• the fact that you have applied for credit and the amount and type of credit;
• the identity of your current and previous lenders;
• records of previous requests made by credit providers to CRBs for information;
• information about you in connection with consumer or commercial credit applications;
• repayment history;
• information about defaults (where repayments over $150 are more than 60 days overdue, in certain circumstances);
• where those default repayments are no longer overdue, or new payment arrangements have been agreed;
• hardship variations (but we will not disclose the reasons for the hardship variation to CRBs);
• our or another credit provider's opinion that you have committed a serious credit infringement (that is, acted fraudulently or shown an intention not to comply with your credit obligations);
• the start and end dates, credit limits and certain terms and conditions of your credit arrangements;
• information about court judgments against you;
• publicly available information relevant to your creditworthiness;
• certain insolvency information from the National Personal Insolvency Index;
• information derived by CRBs from the above information (e.g. assessments and ratings in respect of your credit worthiness); and
• information we derive from the above information (e.g. our own assessments and ratings in respect of your credit worthiness).

We may also share your personal information with a related party of MediPay and organisations who assist in the management and administration of loans and loan applications; other service providers including organisations that provide archival, auditing, debt collection, banking, insurance, marketing, legal services, advertising, valuation, mail out services, authentication, document management, technology and data processing services; government bodies including courts and tribunals; persons interested in acquiring or funding us; your employer, executor, administrator, trustee, guardian or attorney; your agents, such as financial or legal advisers; anyone where you have provided us consent; other guarantors or borrowers (if more than one); borrowers or prospective borrowers, including in relation to any credit you guarantee or propose to guarantee; other financial institutions, for example to process a claim for mistaken payment; identity verification services.

We may also disclose such information as required by the Privacy Act or any other law.

Prior to disclosing any of your personal information to another person or organisation, we will take all reasonable steps to satisfy ourselves that:

• the person or organisation will provide at least the same level of protection of your personal information that we do; or
• you have consented to us making the disclosure.

Do we use personal information for marketing?

We may offer you products and services by various means, including by mail, telephone, email, SMS or other electronic means, such as through social media or targeted advertising. If you do not wish your personal information to be used or disclosed for the promotional purposes described above, please contact us to express your wish to opt out, or click the opt out at the bottom of any electronic communication.

Business without identifying you

In most circumstances, it will be necessary for us to identify you in order to successfully do business with you. However, where it is lawful and practicable to do so, we will offer you the opportunity of doing business with us without providing us with personal information (for example, if you make general inquiries about interest rates or current promotional offers).

Our use of cookies

We use cookies, identifiers for mobile devices (e.g. Android Advertising Identifier or Advertising Identifier for iOS) and other similar technology to provide you with better and more customised service and with a more effective website and to collect data.

A cookie is a small text file that is stored on a user's computer by our web page server for record-keeping purposes. A cookie can later be retrieved by our webpage servers. Cookies are frequently used on websites and you can choose if and how a cookie will be accepted by configuring your preferences and options in your internet browser.

We use cookies for different purposes such as:

• to allocate a unique number to your internet browsers;
• to customise our website for you;
• for statistical purposes;
• to identify if you have accessed a Third Party website; and
• for security purposes.

Users can control the use of cookies at the individual browser level. If you reject cookies, you may still use our Website, but your ability to use some features or areas of our Website may be limited. If you would like to learn more about cookies or how to configure your browser, please visit www.allaboutcookies.org.

We use Google Analytics and details about how Google uses data can be found at www.google.com/policies/privacy/partners/.

IP addresses

Your IP address is the identifier for your computer when you are using the internet. It may be necessary for us to collect your IP address for your interaction with various parts of our website.

Online applications

When you send a completed online application to us, we retain the information contained in that application. We are able to then use that information to provide any financial services that you require. You can also suspend and save online applications, so you can complete and send the applications at a later time. If you suspend or save your application, the information that you have entered will be retained in our systems so that you may recover the information when you resume your application. Online applications that have been suspended or saved may be viewed by us.

Updating your personal information

It is important to us that the personal information we hold about you is accurate and up to date. During the course of our relationship with you, we may ask you to inform us if any of your personal information has changed.

If you wish to make any changes to your personal information, you may contact us. We will generally rely on you to ensure that the information we hold about you is accurate or complete.

Requesting access to, or correction of your personal or credit-related information

We will provide you with access to the personal and credit-related information we hold about you. You may request access to any of the personal information we hold about you at any time.

Depending on the type of request that you make we may respond to your request immediately, otherwise we usually respond to you within seven days of receiving your request. We may need to contact other entities to properly investigate your request.

There may be situations where we are not required to provide you with access to your personal or credit-related information, for example, if the information relates to existing or anticipated legal proceedings, if your request is vexatious or if the information is commercially sensitive.

An explanation will be provided to you, if we deny you access to the personal or credit-related information we hold about you.

If any of the personal or credit-related information we hold about you is incorrect, inaccurate or out of date you may request that we correct the information by contacting us via our contact details set out at the bottom of this policy. You will not be charged any fees to access your credit-related information if you have not made a request for accessing the information within the preceding 12 months. If you have made an access request within the preceding 12 months, a reasonable cost may be charged.

If appropriate we will correct the personal information at the time of the request, otherwise, we will provide an initial response to you within seven days of receiving your request. Where reasonable, and after our investigation, we will provide you with details about whether we have corrected the personal or credit-related information within 30 days. We may need to consult with other finance providers or credit reporting bodies or entities as part of our investigation.

If we refuse to correct personal or credit-related information we will provide you with our reasons for not correcting the information.

Do we transfer your information overseas?

We may disclose your personal information to overseas recipients that provide support functions to us.

The countries to which this information may be disclosed include the United States of America, Canada, the United Kingdom, countries within the European Union, Philippines, Singapore, Israel and New Zealand. You may obtain more information about these entities by contacting us. Where we do this, we make sure appropriate data handling and security arrangements are in place. By using our website or by asking us to provide you with one of our products or services, you acknowledge that we may send your data out of Australia to countries listed above.

Customer identification

We may disclose your name, residential address and date of birth to a CRB or other organisation (including the document issuer or official records holder) to verify your identity. That organisation will use this information to give us an assessment or report of whether or not the information we have matches information held by the organisation, and that may involve use of third party systems and services. If we use these methods and are unable to verify your identity in this way, we will let you know. We may also use information about your Australian Passport, state or territory driver licence, Medicare card, citizenship certificate, birth certificate and any other identification documents to match those details with the relevant registries using third party systems and to record the results of that matching. This information may be transmitted to New Zealand.

If you do not consent to us disclosing your information in this way, we will verify your identity in another way, which may involve requiring you to provide various supporting identification documents (either original or certified copies).

Electronic communications

We are an online lender. As a result, we need to communicate with you, and give you prescribed notices electronically (where permitted). This may be by email, or by placing the notice on our portal for your access. You must have the ability to access notices electronically, and print or save the documents or notices. When you consent to us giving you notices electronically, it is important that you are aware of the following:

• paper documents may no longer be given; and
• electronic communications must be regularly checked for documents; and
• consent to the giving of documents by electronic communication may be withdrawn at any time.

Contact us about our privacy and information handling practices

If you are dissatisfied with how we have dealt with your personal information, or you have a complaint about our compliance with the Privacy Act and the Credit Reporting Code, you may contact our Propential complaints officer on 1800 012 795.

We will acknowledge your complaint within seven days and aim to resolve the complaint as quickly as possible. We will provide you with a decision on your complaint within 30 days, and may ask you for further information. We aim to resolve your concerns in a fair and efficient manner. If you are unsatisfied with our response, you may complain to our external dispute resolution scheme, the Australian Financial Complaints Authority (AFCA). AFCA provides fair and independent financial services complaint resolution that is free to consumers.

• Website: www.afca.org.au
• Email: info@afca.org.au
• Telephone: 1800 931 678 (free call)
• In writing to: Australian Financial Complaints Authority, GPO Box 3, Melbourne VIC 3001

Contacting us

You may contact us about any privacy related matter at:

Attention: Privacy Officer, Propential

Email: care@propential.com.au

Tel: 1800 012 795

Postal: 264 George Street, Sydney NSW 2000

Last updated: June 2026