Privacy & Credit Reporting policy

Privacy and Credit Reporting Policy

Effective from 12 March 2024

The Latitude Companies("we"/"us"/"our") take our obligations to protect personal information seriously. We are bound by the Privacy Act 1988(Cth) and the Australian Privacy Principles ("APPs") (together, the "Privacy Act"). For Latitude Companies who are credit providers, or who receive credit eligibility information, they are also bound by PartIIIA of the Privacy Act and the 'Credit Reporting Privacy Code', which governs credit reporting in Australia.

1. About this Privacy Policy

The purpose of this Privacy and Credit Reporting Policy ("Policy") is to tell you how we manage your personal information, including your credit information and credit eligibility information. This includes the following sections:

• 1. About this Privacy Policy;
• 2. Collection of Personal Information;
• 3. Dealing with Personal Information;
• 4. Credit-Related Information;
• 5. Security of Personal Information;
• 6. Access and Correction of Personal Information;
• 7. Contact Us;
• 8. Latitude Companies;
• 9. Key Definitions.

1.1. Anonymity and pseudonymity

You may interact with us anonymously or by using a pseudonym if the interaction is general in nature. However, if the interaction is specific to an account or relates to your personal information we will need to identify you before we can engage in further discussions and correspondence.

We may update our Policy from time to time. The updated version will be published on our Australian Latitude Financial Services website www.latitudefinancial.com.au

2. Collection of Personal Information

2.1. Kinds of personal information we collect

As a group of companies offering a wide range of products and services, we collect and hold personal information about you. We collect information from our customers, prospective customers, employees, prospective employees, contractors, suppliers, brokers, introducers, merchants, agents, service providers and the people who represent the businesses we deal with.

The type of personal information we collect and hold may vary depending on the nature of our interactions with you.For example, our companies which provide credit would collect and hold financial information and credit-related information (see section 4), identification information, transaction / repayment history information, banking details and employment information.

In order to satisfy our legal obligations, we may need to retain your information after a transaction or a relationship has ended. However, we will not retain your identifiable personal information longer than is reasonably necessary and permitted under Australian law.

We will only collect sensitive information (e.g., information about your ethnicity, health or biometric information) with your consent or when permissible under Australian law.

2.2. How we collect your personal information

Wherever it is possible and practical to do so, we will collect personal information directly from you. This may be in person, over the telephone, by email, over the internet, by email or fax, or by completion of a form (such as an application form).

We may also collect your personal information from a third party including a merchant or a third party with whom we have an arrangement, partnership or joint venture with. This will be limited to circumstances where it is impracticable or unreasonable for us to collect it directly from you. The type of third party who might provide information to us will vary depending on the nature of the business and interaction with you. For example, we may collect credit information and credit eligibility information from a credit reporting body or personal information from your employer to verify information in your credit application or, hardship application.

When we provide credit, third parties could include:

• a credit reporting body;
• collection agents;
• an employer; or
• another financial institution.

Whilst this is not an exhaustive list, we may obtain your personal information from other third parties which could include:

• an introducer such as a broker, agent, dealer and retail partner;
• someone authorised to act on your behalf (e.g., a financial adviser, executor, administrator, trustee, guardian, attorney, accountant or consumer advocate);
• research agencies;
• a referee;
• recruitment consultants (e.g., for job applicants);
• a government body;
• third party service providers and / or suppliers; or
• one or more of our related companies, in Australia or overseas.

3. Dealing with Personal Information

3.1. How we hold your personal information

We understand the importance of protecting the personal information we hold about you. We take steps to ensure your personal information is free from misuse, interference, loss, unauthorised access or modification by:

• securing personal information both in physical and electronic form;
• staff education around the importance of Privacy and Data Security;
• limiting access to personal information only to those that need access; and
• protecting our systems with appropriate technology solutions.

3.2. The purpose for collecting, holding, using and disclosing your personal information

We collect, hold, use and disclose your personal information in order to manage and administer the products and / or services we provide to our customers, whether they are individuals or businesses. You may be a customer, contractor, job applicant, supplier, partner or party with whom we do or have done business, or may do business with in the future.

As a financial services provider, a major purpose for which we hold, use or disclose personal information is to assess credit applications (including assessing any proposed guarantors), manage credit (servicing and collections activity), hardship applications, insurance agreements and claims, for planning, product and service development, research purposes and to analyse the risk profiles of our customers or potential customers.

3.3. Online servicing or access

When you register to access products or services online, the information collected is compared with the details we may already have stored. This might include your name and date of birth and allows us to verify who is seeking access. If this information is not provided you will not be able to access your personal information online.

3.4. Direct marketing

By consenting to our Privacy Policy, you authorise us to use and disclose your personal information for an indefinite period to advise you of products and services that may be of interest to you by means of direct marketing.

If you do not want your personal information to be used for direct marketing purposes, please contact us so that we can action this request. This is referred to as "opting out" of direct marketing. You can "opt-out" of direct marketing from each Latitude Company using the details in the 'Contact Us' table at the end of this policy. You can also unsubscribe from email marketing from the Latitude entity that sent the email by clicking unsubscribe in the footer of the email.

Where Latitude has provided your information to a third party or a retail partner to send you marketing or promotional materials, you will need to opt out of these services with them directly.

3.5. Sharing of personal information

In order for us to provide our products and services to our customers, from time to time, we share personal information with our related bodies corporate both in Australia and overseas, as defined in the Corporations Act 2001 (Cth).

We may also share personal information to other businesses who provide services to us and other third parties including:

• suppliers who provide us with services such as product source systems
• introducers such as brokers, dealers and retail partners;
• your employer;
• service providers such as customer service organisations, call centres, mailing houses, researchers, collections agents, and data analysts;
• other organisations as required or authorised by law, for example, government or regulatory bodies;
• credit reporting bodies;
• other financial institutions, government bodies and credit providers;
• card schemes such as Mastercard™ or Visa™;
• your nominated referees;
• additional cardholders or other persons (if any) authorised by you to operate or access your credit facility;
• organisations through whom you choose to make payments to us;
• organisations involved in our funding arrangements such as investors, advisers, trustees and rating agencies;
• organisations who purchase our debt and to whom we assign our debt to; and
• organisations wishing to acquire an interest in any part of our business (including our receivables) for assessing or implementing any such acquisition.

When sharing your personal information, we will act in accordance with, and require these businesses and our suppliers to comply with, strict confidentiality requirements and the Privacy Act.

If you are our customer (or a representative of a customer) there is additional information about how we deal with personal information in the product’s Important Privacy Notice or Product Disclosure Statement. You may request at any time your Important Privacy Notice or Product Disclosure Statement by contacting us via the 'Contact Us' table at the end of this policy.

3.6. Disclosing information overseas

Technology allows for services to be provided by different service providers including some that are located overseas. We utilise overseas service providers for some of our activities and to do so may need to disclose personal information to those service providers. We may also disclose such information to other overseas recipients for the purposes listed above when permitted to do so by the Privacy Act.

While we try to store your personal information locally, there may be times where our service providers are located outside of Australia. Where this happens, we always take adequate steps to secure and protect your personal information, wherever its being stored.

Further, we may share your personal information with overseas recipients in accordance with this Policy, in particular, section 3.5 above.

Whilst it is not practicable to list every country in which such overseas recipients are likely to be located, it is likely that the countries to which your personal and credit information may be disclosed include China, countries within the European Union, India, Israel, Japan, Mexico, New Zealand, the Philippines, Singapore, South Korea, Spain, United Kingdom and the United States of America.

4. Credit-related information

As part of obtaining credit with us, we may obtain credit-related information about you from credit reporting bodies. Credit-related information in this Policy includes:

• credit information of the kinds listed under section 9 (see credit eligibility information) but relating primarily to your dealings with other credit providers (such as about credit applications you have made or credit that you hold with other credit providers). This information will typically have been provided by other credit providers or other third parties; and

• credit eligibility information (see credit eligibility information in section 9 below) about you that credit reporting bodies derive from the information above, such as credit scores, risk ratings and other evaluations about you;

4.1. Collection, use and disclosure of credit-related information

We collect, hold, use and disclose credit information and credit eligibility information about you for purposes that deem it reasonably necessary for our business activities and within the requirements in the Privacy Act, and as permitted by law. These purposes include but are not limited to:

• assessing credit applications and accepting guarantors;
• internal management purposes, including securitisation, risk management, credit scoring and portfolio analysis;
• to assist in the collection of overdue payments;
• help prevent defaults and consider applications for financial hardship;
• to participate in the credit reporting system;
• undertake securitisation activities and debt assignments;
• to deal with complaints and legal proceedings;
• to meet our legal and regulatory requirements (such as reporting matters to regulators or enforcement bodies when authorised or required by law);
• to assist other credit providers with such purposes in circumstances permitted by the Privacy Act;
• with organisations involved in our securitisation (funding) arrangements performing certain tasks;
• with organisations who purchase our debt and to whom we assign our debt to; and
• with organisations wishing to acquire an interest in any part of our business (including its receivables) for assessing or implementing any such acquisition.

Restrictions apply under the Privacy Act in relation to the circumstances and purposes for which such information may be used or disclosed and we ensure we comply with these restrictions. For example, in general, credit eligibility information may not be disclosed unless the recipient is a credit provider and restrictions apply on the use of credit eligibility information for direct marketing purposes.

We may also disclose your credit information to credit reporting bodies. Those credit reporting bodies may include that information in reports that they provide to other credit providers to assist them to assess your credit worthiness.

For example, we will provide information that identifies you and about your application for credit when obtaining credit reporting information for the purposes of assessing that application.

Should you fail to meet your payment obligations to us or commit a serious credit infringement in relation to credit provided by us, we may be entitled to disclose this information to credit reporting bodies.

4.2. Credit reporting bodies

We access and disclose credit information to the following credit reporting bodies:

illion Australia Pty Ltd Website: www.checkyourcredit.com.au Postal address: illion Public Access Centre, PO Box 7405, St Kilda Road, Melbourne, VIC 3004

Equifax Australia Information Services and Solutions Pty Ltd Website: www.equifax.com.au Postal address: PO Box 964, North Sydney, NSW 2059

Experian Australia Credit Services Pty Ltd Website: www.experian.com.au Postal address: PO Box 1969, North Sydney, NSW 2060

These credit reporting bodies are each required to have a policy which explains how they will manage your Credit Reporting Information. If you would like to read the policies of these credit reporting bodies, please visit their websites and follow the "Privacy" links. Alternatively, you can contact them directly for further information.

4.3. Other Rights Regarding your Credit Reporting Information

4.3.1. Direct marketing pre-screening You have the right to request these credit reporting bodies to exclude your credit reporting information from any permissible direct marketing activities we may request them to perform. You should contact each relevant credit reporting body directly if you wish to request this.

4.3.2. Victim of fraud You also have the right to request credit reporting bodies not to use or disclose your credit reporting information if you believe that you have been, or are likely to be, the victim of fraud (for example, you suspect someone is using your identity details to apply for credit). You must contact the credit reporting bodies directly should this be the case.

5. Security, Websites and Cookies

5.1. Protecting Your personal information

We will take reasonable steps to keep your personal information safe from loss, unauthorised activity, or other misuse. You must take care to protect your personal information, which can include steps such as using passwords that cannot be easily guessed, ensuring you access your personal information on safe internet networks, and by not disclosing your personal information to unknown third parties. You should also notify us via our contact details listed below as soon as you become aware of any security breaches relating to your account or personal information.

5.2. Tracking information on the web

For statistical purposes, we collect information on website activity such as the number of users who visit our websites, the date and time of visits, the number of pages viewed, navigation patterns, what country and what systems users have used to access the site and, when entering one of our websites from another website, the address of that website. This information is obtained using 'cookies' (refer below for more information about 'cookies').

Our websites may also contain links to other websites. While these links are provided for convenience, if you are navigating these sites please be aware that the information handling practices of the linked websites may differ from ours. While we try to link only to sites that share our high standards and respect for privacy, we are not able to guarantee the privacy practices of other websites.

5.3. Website security

Whenever personal information is sent via our website we use high levels of security to protect it. These security levels are standard for internet banking and large scale e-commerce sites and involve the use of high levels of encryption. The security level of a web page can be viewed by clicking on the internet browser's padlock or key icon.

5.4. Cookies

A 'cookie' is a packet of information that allows a website to identify and interact more effectively with a computer. Cookies do not identify you, but they may record some browser and/or connection information.

Cookies are widely used on websites to help with navigation, monitor usage and to help personalise your experience when you visit a website. We may use cookies to monitor use of this website, to provide you with access to tailored information and services from this website, and to serve you better when you return to this website.

Your browser can be individually set to accept all cookies, reject all cookies, or notify when a cookie is sent. If cookies are rejected, there may be limits on how our websites can be used.

5.5. Website advertisements

From time to time we place advertisements on other websites. This may involve installing a cookie on a computer when our advertisement is viewed. This simply allows us to keep track of how many unique visitors we have to our site and from what advertisements they entered.

This then allows us to measure the effectiveness of different advertisements. The privacy policies of the websites which install the cookies should provide additional information about the use of cookies.

To evaluate the effectiveness of our website advertising, we may use third parties to collect statistical data. No personal data is collected on these occasions.

6. Access and Correction of Personal Information

6.1. Access

You are entitled to access the information we hold about you. Simple requests are best handled by speaking to the relevant customer service area. More complex requests such as accessing the credit information we hold about you or obtaining copies of contractual or insurance policy documents may be better detailed in writing to ensure we fully understand and can respond accurately to your request. The 'Contact Us' table at the end of this policy contains details of the ways you can contact us.

We will usually provide the information requested within 30 days of receiving your request. If there is a reason we are unable to agree to a request for access to your personal information, we will advise you of this in writing. Some examples of why we may refuse a request for access include:

• providing the information may pose a threat to the health or safety of an individual or the public;
• providing the information may have an unreasonable impact on the privacy of another individual;
• providing the information is not allowed by law; or
• providing the information may reveal internal information relating to a commercially sensitive decision-making process.

There is no charge to request access to your personal information, however, we may apply an administration fee for providing access in accordance with your request.

6.2. Correction

We aim to hold accurate and up-to-date personal information about you at all times. If you consider that any information we hold about you is incorrect in any way, you may seek the correction of that information. To seek such a correction please call the relevant contact number provided in the 'Contact Us' table at the end of this policy to discuss your query.

In certain situations, we may not agree to a request to correct information we hold about you. If this occurs, we will advise you of this and our reason for not agreeing to the correction request in writing.

6.3. Complaints

If you believe that we have failed to comply with the Privacy Act (including credit reporting requirements in Part IIIA) or the Credit Reporting Privacy Code, please contact us and we will then follow our Internal Dispute Resolution process. The 'Contact Us' table at the end of this policy contains details of the ways you can contact us.

For more detailed information on our complaint handling process please refer to our Internal Dispute Resolution web page.

If the complaint remains unresolved, you may refer it to a recognised External Dispute Resolution scheme ("EDR"). Latitude is a member of the Australian Financial Complaints Authority ("AFCA"). AFCA independently and impartially resolves disputes between customers and participating members on matters including Privacy and Credit Reporting.

The contact details for AFCA are:

Australian Financial Complaints Authority GPO Box 3 Melbourne Victoria 3001 Australia Phone: 1800 931 678 Email: info@afca.org.au Website: www.afca.org.au

Alternatively, you may refer the matter to the Office of the Australian Information Commissioner ("OAIC").

The contact details for the OAIC are:

The Office of the Australian Information Commissioner GPO Box 5218 Sydney NSW 2001 Australia Phone: 1300 363 992 Fax: +61 2 9284 9666 Website: www.oaic.gov.au

7. Contact Us

Below are the contact numbers for the products and services offered by Latitude Financial Services.

8. Latitude Companies

¹The Latitude Companies include:

• Latitude Financial Services Australia Holdings Pty Ltd ABN 46 603 161 100;
• Latitude Finance Australia ABN 42 008 583 588;
• Latitude Automotive Financial Services ABN 80 004 187 419;
• Latitude Personal Finance Pty Ltd ABN 54 008 443 810,
• LatitudePay Australia Pty Ltd ABN 23 633 528 873

and their related bodies corporate in Australia.

²Latitude Companies which provide credit products include:

• Latitude Finance Australia ABN 42 008 583 588, Australian Credit Licence 392145;
• Latitude Automotive Financial Services ABN 80 004 187 419, Australian Credit Licence 392178;
• Latitude Personal Finance Pty Ltd ABN 54 008 443 810, Australian Credit Licence 392163,

and any Latitude Companies which may provide credit products from time to time.

9. Key Definitions

The Privacy Act contains a variety of detailed definitions describing the types of information to which it applies. To make it easier for you to read this policy we have only included some general explanations of the key definitions used in this Policy.

If you would like further information on the key definitions and other definitions used in this Policy please refer to the website of the OAIC at www.oaic.gov.au or the full provisions of the Privacy Act and or the Credit Reporting Privacy Code which are also available on the OAIC website.

Personal Information is information or an opinion about an identified individual, or an individual who can reasonably be identified. The type of personal information we collect may include your name, mailing address, date of birth, email address, telephone number and financial details. Some elements of personal information are also referred to as ‘sensitive information’. These include but are not limited to:

• racial or ethnic origin
• membership of a professional association or union membership
• criminal history or health information (including biometric information, e.g. your fingerprint).

Personal information includes credit information and credit eligibility information.

Credit Information forms part of your personal information and may include information obtained from a Credit Reporting Body and usually consists of:

• identification information, such as your name, address, date of birth or employer;
• consumer credit liability information, this is information about consumer credit accounts you hold, or have held with a variety of credit providers;
• repayment history information, information about whether you have paid on time and if you have not paid on time, how overdue you are;
• financial hardship information, and from 1 July 2022, information about whether you have entered into a financial hardship arrangement;
• credit enquiry information, details of previous credit applications;
• default information, information on overdue amounts which have been overdue for greater than 60 days and greater than $150;
• court proceedings information such as summons or judgements;
• personal insolvency information, information on if you have been bankrupt.

For more information about Credit Reporting, go to www.creditsmart.org.au

Credit Eligibility Information - this information relates primarily to your credit-related dealings with other credit providers. Credit eligibility information generally comprises of:

• Credit reporting information provided by credit reporting bodies; and
• Credit worthiness information that we derive using credit information.