Privacy and Credit Reporting Policy

Privacy Policy

‍SocietyOne Privacy and Credit Reporting Policy

When you trust SocietyOne with your personal and credit related information, we know you expect us to protect it and keep it safe.

We are committed to protecting your privacy and will comply with the Privacy Act 1988 (Cth), the Australian Privacy Principles and the Privacy (Credit Reporting) Code 2014. They govern how we collect, use, hold and disclose your personal information and how we ensure it is accurate and secure.‍

This policy applies to all SocietyOne companies. All SocietyOne companies are subsidiaries of MoneyMe Limited and part of its wider group of companies (which are referred to collectively in this document as ‘MoneyMe’).

What is personal and credit related information?

Personal information is any information or opinion about you, which identifies you or from which you can reasonably be identified.‍

Credit related information includes identification information as well as information about your financial and credit situation and history, e.g. the types and amounts of loans you hold and loan applications you make, your repayment history, requests for information about you from credit providers and mortgage insurers, credit defaults, court proceedings and personal insolvency as well as information that has been derived about you by credit reporting bodies, such as a credit report.

What kinds of personal information do we collect and hold?

The information we seek to collect about you depends on whether you are an investor or borrower with us. We will always collect your name, address, contact details, date of birth and nominated bank account. We also collect credit related information about our borrowers.

If you do not provide us with the information we ask for, we may not be able to deliver our services effectively or at all.

How do we use your information?

We use your personal information to provide our products and services to you including the following:

• Establish your identity and assess your applications for our products and services

• Price and design our products and services

• Tell you about products and services offered by SocietyOne and MoneyMe or our preferred suppliers that we believe may interest you. If we contact you it may be by mail, email, SMS or social media. You may ask us not contact you for marketing-related purposes by emailing us at s1-customer.service@moneyme.com.au.

• Administer our products and services and manage our relationship with you

• Manage our risks and help identify and investigate illegal activity, such as fraud

• Conduct and improve our businesses and improve our customers' experience

• Comply with our legal obligations and assist government and law enforcement agencies or regulators.‍

What laws require or authorise us to collect personal information?

We are required by law to collect the following information:

• Certain identification information about you - by the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth);

• If you have applied for credit or provide a guarantee, certain information about your financial position under the National Consumer Credit Protection Act 2009 (Cth).

If you are an investor in a SocietyOne investment product, we will ask you for your tax file number.  You are not obliged to provide us with your tax file number, but if you choose not to, we may be required to withhold tax at the highest marginal rate from your investment returns.

How do we collect personal information?

We collect most personal information directly from you, for example, when you apply for or use a product or service or talk to us in person or on the telephone. We ask borrowers to allow us to collect information from their service providers such as banks and we also collect information about borrowers from credit reporting bodies.

We may collect information about you from others, such as your adviser or broker. We will generally only do this with your consent.

We may also collect information about you that is publicly available, for example from public registers or social media, or made available by third parties.

We do not generally collect sensitive information (a special type of personal information) about you, but if we do we will ask for your consent where required by law.

We also collect information from you electronically. If you log into the SocietyOne website we may collect information from you to confirm your identity. So that we can better tailor information and products to your needs, when we send you email messages, we may use technology to identify you so that we can know when you have opened the email or clicked on a particular link in the email.

When you use our website, tablet or mobile applications, we may collect information about your location or activity including the date of and time of visits, which pages are viewed, how you as the user navigate through the website and interact with the webpages (including fields completed in form and applications), IP address, telephone number, information about the device used to visit our website and whether you've accessed third party sites. Some of this information is collected using cookies.‍

How do we hold and manage personal information?

Much of the information we hold about you will be stored electronically in secure data centres located in Australia and owned by either SocietyOne, MoneyMe or our external service providers. Some of your information may be stored in paper files.‍

We use a range of physical and electronic security measures to protect the security of the personal information we hold. For example:

• Access to our physical premises and information systems is controlled through identity and access management.

• Technology solutions are utilised to protect against unauthorised access or disclosure.

• Employees are bound by internal information security policies and are required to keep information secure.

• All employees are required to complete training about information security and privacy.

To satisfy our legal obligations, we may need to retain your information, however we will not retain your identifiable personal information longer than is permitted under Australian law.

Disclosure of personal information

We may disclose your personal information to other SocietyOne and MoneyMe companies.

We may also disclose your personal information to organisations external to SocietyOne and MoneyMe. This includes:

• Your advisers, agents and service providers and anyone to whom you have agreed we may provide your information

• Other organisations who provide products or services to you jointly with us

• Our trusted partners who may have referred you to us, or who we believe may be able to offer services that are of interest to you. These organisations may contact you directly in relation to such services, but you may ask them not to.

• Our collection agencies, legal advisers, accountants, auditors, external dispute resolution scheme and any other agents, contractors or external service providers where it is reasonably necessary for our business purposes

• Where we are required or permitted to do so by law.

We require all our service providers to comply with the privacy laws.

Do we disclose personal information overseas?

We may disclose your personal information to the following recipients located outside Australia:

• SocietyOne and MoneyMe service providers, which are likely to be located in New Zealand, the United States, United Kingdom, Ireland, Germany or Singapore.  It is likely we will disclose your credit related information to our service providers in New Zealand and the United States;

• For international transactions, to the corresponding international party in order to process the transaction. The countries to which we disclose your information will depend on the details of the transaction you ask us to carry out.

Credit related information

When you apply for credit, we need to know if you will be able to meet payments under your agreement with us. We also want to avoid giving you credit if this would put you in financial difficulty. One of our checks involves obtaining a credit report about you.

Credit reports contain information about your credit history which helps credit providers assess your credit applications, verify your identity and manage accounts you hold with them. Credit reporting bodies collect and exchange this information with credit providers like SocietyOne and other service providers such as utility companies.

The Privacy Act limits the information that credit providers can disclose about you to credit reporting bodies, as well as the ways in which credit providers can use credit reports.

What information can we exchange with credit reporting bodies?

The information we can exchange includes your identification details, what type of loans you have, details of loan applications you have submitted, how much you've borrowed, whether you've met your loan payments and if you have committed a serious credit infringement (such as fraud). We also ask the credit reporting body to give us an overall assessment of your creditworthiness.

We use the following credit reporting bodies:

• Equifax Pty Ltd - www.equifax.com.au

• Experian Australia Credit Services Pty Ltd -www.experian.com.au/credit-services

• Illion Australia- www.illion.com.au

These credit reporting bodies are each required to have a policy which explains how they will manage your credit-related personal information.

What do we do with credit-related information?

We use this information to confirm your identity, provide you with your credit score, assess your creditworthiness and application for credit under our criteria, manage our relationship with you and collect overdue repayments.

Credit reporting bodies with whom we exchange information may include the information in reports they provide to other credit providers to assist them to assess your creditworthiness. You can obtain a copy of the credit reporting body's policy about the management of credit-related information by contacting them or from their website.

Other credit providers may ask credit reporting bodies to use your credit-related information to pre-screen you for direct marketing. You can ask a credit reporting body not to do this. Also, if you've been, or have reason to believe that you're likely to become, a victim of fraud (including identity fraud), you can ask the credit reporting body not to use or disclose the credit-related information it holds about you.

Accessing, updating and correcting your information

You can ask for access to the personal and credit-related information we hold about you. You can also ask for corrections to be made. You can contact our Customer Service team by telephone on 1300 144 221 or by email at .

We may charge you for any reasonable costs incurred by us to access your personal information which is not credit related. You may be charged our reasonable costs of accessing your credit-related information if you have already sought access to it in the past 12 months.

There is no fee for correcting your personal information. If we disagree that your information should be corrected, we will tell you why in writing.‍

We can deny or limit access to your personal information if we cannot identify you, if the information relates to commercially sensitive or privileged material, or if your request is vexatious. Whatever the outcome, we'll write to you explaining our decision.‍

Complaints

If you are concerned about how your personal information is being handled or if you have a complaint about a breach by us of the Privacy Act 1988 (including the Australian Privacy Principles) or the Privacy (Credit Reporting) Code 2014, you can contact our Privacy Officer in these ways:

Telephone: 1300 144 221 Email: s1-customer.service@moneyme.com.au Post: GPO Box 5175, Sydney NSW 2001

If you make a complaint, we will acknowledge your complaint within 7 days, and we will investigate it and try to resolve it within 30 days.  If we cannot resolve your complaint within 30 days, we will inform you of this before the end of that period, provide the reason for the delay, the expected timeframe to resolve the complaint and seek your agreement to an extension for a reasonable period.

If you are not satisfied with the way we have handled your complaint, you may complain to the Office of the Australian Information Commissioner:

Post: GPO Box 5218, Sydney NSW 2001 Telephone: 1300 363 992 Email: enquiries@oaic.gov.au www.oaic.gov.au

Updated: March 2022