Privacy Policy

1. Purpose and Scope

This Privacy Policy (Policy or Privacy Policy) explains how Credeq Australia Pty Limited handles personal information when you visit our website, contact us, submit an enquiry, apply for or use a product or service, provide supporting information, or otherwise interact with us.

Who we are	Credeq Australia Pty Limited (ABN 39 625 083 810, AFSL 568636) (Credeq, we, us, or our)
Policy scope	This Policy applies to our website and to our dealings with website visitors, customers, prospective customers, brokers, introducers, referrers, guarantors, beneficiaries, job applicants and other individuals whose personal information we handle.
Product Scope	Credeq distributes CWI products under its wholesale AFSL. Credeq also distributes Surety, Commercial Bonds and Deposit Power products which do not require an AFSL for the relevant activity.

2. About this Policy

We are committed to handling personal information in an open and transparent way and in accordance with the Privacy Act 1988 (Cth) (Privacy Act), including the Australian Privacy Principles (APPs) as amended from time to time. This Policy describes the kinds of personal information we collect and hold, how we collect, use, disclose and store it, and how you can access or correct your personal information or make a complaint.

In some cases, a product-specific application form, portal notice, collection notice, consent wordings or contract may contain additional privacy information. Where that occurs, that additional notice will also apply to the relevant collection, use or disclosure of personal information.

For details about how we manage credit related information, please see Section 18 below.

3. What Personal Information We Collect

In this Policy, personal Information has the meaning given to it under the Privacy Act, namely information or an opinion about an identified individual or an individual who is reasonably identifiable, whether the information or opinion is true or not and recorded in a material for or not.

Depending on how you deal with us, we may collect and hold personal information such as:

• Identity and contact information such as your name, title, residential or business address, telephone number and email address;
• Your password, if you use one of our online portals;
• Date of birth, identification details and information needed to verify identity, authority, ownership or control;
• Business, employment and professional information, including employer details, role, experience and authority to act;
• Application, product, policy, bond, guarantee, claim, transaction and account information;
• Financial, solvency, creditworthiness and risk-related information, including bank details, financial statements, asset and liability information and supporting evidence;
• Information about directors, officers, shareholders, trust parties, guarantors, beneficiaries, brokers, advisers and other persons connected with an application, facility, bond, guarantee, policy or claim;
• Records of communications with us, including emails, calls, meeting notes, complaints and enquiry history;
• Website, device and usage information, such as IP address, browser type, operating system, cookie data, pages viewed, timestamps and interaction data;
• Employment application information, including qualifications, work history, referees and right-to-work information; and
• Other personal information shared with us that is reasonably necessary for our functions and activities.

Where reasonably necessary, and permitted by law, we may also collect sensitive information as defined under the Privacy Act, such as criminal record information or other sensitive information relevant to a claim, guarantee, application, employment application or legal requirements. We will only collect sensitive information where permitted by law, including with your consent where required.

We may collect government-related identifiers or information from government-issued documents for verification or compliance purposes where permitted or required by law. We do not adopt a government-related identifier as our own identifier of you.

4. How We Collect Personal Information

We may collect personal information:

• directly from you when you complete online or paper forms, make an enquiry, apply for a product, provide supporting documents, use our website or portals, contact us by telephone or email, apply for employment with us, or otherwise interact with us;
• from brokers, introducers, referrers, authorised representatives, agents, advisers, employers or other persons acting on your behalf;
• from insurers, underwriters, reinsurers, product issuers, trustees, beneficiaries, counterparties and other parties involved in a product, bond, guarantee, policy, transaction or claim;
• from service providers who assist with identity verification, fraud prevention, compliance screening, document processing, analytics, hosting, workflow, automation or Artificial Intelligence (AI) enabled services;
• from our related bodies corporate, business partners, agents or suppliers;
• from publicly available sources, registers, searches, lawfully available databases;
• from credit reporting bodies when we conduct credit checks – see Section 18 below for more information; and
• automatically through cookies, analytics tools, log files, CAPTCHA, device signals and similar website technologies. See Section 9 for more information on our use of cookies and related technologies.

If you provide us with personal information about another person, you must take reasonable steps to ensure that person is aware that you have done so and of the matters set out in this Policy. Where sensitive information has been provided about another person by you, you should ensure you are authorised to provide it or that the relevant consent has been obtained if required.

If you do not provide personal information requested by us, we may be unable to respond to your enquiry, assess an application, provide or administer a product or service, process a claim, progress a complaint, consider your application for employment or otherwise deal with you effectively.

Where lawful and practicable, you may deal with us anonymously or by using a pseudonym, for example when making a general enquiry. This will usually not be practicable where you apply for a product, submit supporting information, request access to information, lodge a claim or complaint, apply for employment or where we are required by law to verify your identity or otherwise comply with legal obligations.

If we receive unsolicited personal information, we will determine within a reasonable period whether we could have collected it in accordance with this Policy and applicable law. If not, and if lawful and reasonable to do so, we will destroy or de-identify it as soon as practicable.

5. Why We Collect, Hold, Use and Disclose Personal Information

We collect, hold, use and disclose personal information for purposes including to:

• respond to enquiries and provide information about our business, website, products and services;
• assess eligibility for, quote for, distribute, place, issue, administer, renew, vary, service or otherwise support CWI, Surety, Commbonds, Deposit Power and related products or arrangements;
• verify identity, authority, ownership, control, financial standing and other relevant facts, including conducting credit checks on businesses applying for our products or services (Applicants) and their directors, as detailed in Section 18 below;
• review supporting materials and conduct underwriting, risk, fraud, compliance, operational and quality assurance checks;
• communicate with you and with brokers, underwriters, issuers, guarantors, beneficiaries, advisers and other parties involved in a transaction or claim;
• manage claims, disputes, complaints, recoveries, investigations, incidents and litigation;
• improve our website, systems, processes, service delivery, analytics, reporting and governance;
• recruit and manage employees and contractors, including considering applications for employment with us;
• comply with legal, regulatory, audit, contractual, sanctions, record-keeping and reporting obligations; and
• send you updates, insights, invitations or marketing communications where permitted by law.

We may also use or disclose personal information for related secondary purposes that you would reasonably expect, or where otherwise permitted or required by law.

6. Automation, LLMs and AI-assisted Processing

Credeq may use automation and AI-assisted tools, including large language models (LLMs), document processing, workflow and related technologies to assist with our operations. This may include using those tools to ingest and process application packs and supporting documents, extract and classify information, identify missing or inconsistent information, generate summaries, flag anomalies, support fraud or compliance checks, support underwriting or risk assessments and generate internal recommendations or workflow actions.

The personal information used in these tools may include identity and contact details, business information, financial information, application answers, contracts, guarantees, policies, bond details, claim materials, correspondence and other supporting documents submitted to or lawfully obtained by us.

These tools may produce extracted data, summaries, flags, confidence indicators, recommendations, draft communications or other outputs which are used by us for the purposes listed in Section 5 above and may be combined with other personal information we hold. Where an output relates to an identified or reasonably identifiable person we will treat that output as personal information.

We may use your data to develop and train AI models; however, we will only do so using de-identified information.

Material outputs from automation or AI-assisted tools will be reviewed by appropriately authorised personnel. Human oversight remains part of our processes, and final decisions or material actions are not intended to be made solely by AI or automated systems where those decisions or actions may significantly affect an individual’s rights or interests.

Where required by law or appropriate in the circumstances, we will provide additional notice and/or seek consent in relation to the use of automation or AI-assisted tools. We also seek to apply privacy-by-design principles, use controlled enterprise environments rather than publicly available AI tools where practicable and implement access controls, vendor due diligence and appropriate contractual, technical and organisational safeguards when selecting and using these technologies.

7. Disclosure of Personal Information

We may disclose personal information for the purposes identified in Section 5 above to:

• insurers, underwriters, reinsurers, product issuers, trustees, beneficiaries, counterparties and other parties involved in the relevant product, facility, bond, guarantee, claim or transaction;
• brokers, introducers, distributors, authorised representatives, agents and referrers;
• service providers who assist us with hosting, storage, CRM, communications, identity verification, document management, cyber security, analytics, fraud prevention, compliance, mailing, printing, payments, automation and AI-enabled services;
• our professional advisers, such as lawyers, accountants, auditors and consultants;
• our related bodies corporate and other entities within the wider Credeq group;
• regulators, courts, tribunals, law enforcement bodies, government agencies or other persons where disclosure is required or authorised by law; and
• other persons with your consent or as otherwise permitted by law.

Additionally, if the ownership or control of all or part of our business changes, we may transfer your personal information to the new owner.

8. Overseas Disclosure

Some of the persons or organisations to whom we disclose personal information may be located outside Australia or may access personal information from outside Australia. This may include related entities, cloud and software providers, service providers, business partners, underwriters and reinsurers.

The countries in which overseas recipients are likely to be located include the United Kingdom, Europe, Asia and South Africa. Where we disclose personal information overseas, we will do so in accordance with the Privacy Policy.

9. Cookies and Website Tracking Technologies

Our website may use cookies, analytics tools, local storage, log files, CAPTCHA and similar technologies to operate and secure the site, remember preferences, understand usage patterns, improve website performance, detect misuse and support communications and marketing. Information collected through these technologies may include IP address, browser type, operating system, device identifiers, pages viewed, dates and times of access and interaction data.

A cookie is a small text file that the website may place on your device to store information. We may use persistent cookies (which remain on your computer even after you close your browser) to store information that may speed up your use of our website for any of your future visits to the website. We may also use session cookies (which no longer remain after you end your browsing session) to help manage the display and presentation of information on the website. You can usually control cookies through your browser settings, although doing so may affect the operation of some parts of the website.

Services that our website may use from time to time include Google Analytics, which transmits website traffic data to Google servers. Google Analytics does not identify individual users or associate your IP address with any other data held by Google. We use reports provided by Google Analytics to help us understand traffic and usage on our website. By using our website, you consent to Google processing your data in the manner described in Google’s Privacy Policy (www.policies.google.com/privacy) and for the purposes set out in this Policy.

Google may pass on cookies to its partners and other third parties to achieve its purposes. For more information on how Google uses the information collected from cookies, and how you can opt out of this feature, please see Google’s Privacy Policy. You can also view Google Analytics’ currently available opt-out (see https://chrome.google.com/webstore/detail/google-analytics-opt-out/fllaojicojecljbmefodhfapmkghcbnh/related?hl=en-GB).

10. How We Hold and Protect Personal Information

We may hold personal information in paper form and in electronic systems operated by us or by our service providers. We take steps that are reasonable in the circumstances to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure.

These steps may include:

• role-based access controls and authentication measures;
• secure hosting, encryption and other technical safeguards where appropriate;
• audit logging, monitoring and incident management processes;
• staff training, confidentiality obligations and internal privacy procedures;
• vendor due diligence and contractual protections; and
• secure destruction and de-identification processes when information is no longer required.

No method of transmission over the internet or method of electronic storage is completely secure. However, we take privacy and information security seriously and work to reduce risk through proportionate safeguards.

11. Direct Marketing

With your consent or where otherwise permitted by law, we may use your personal information to send you news, updates, invitations, insights or information about products and services that may be of interest to you. You can opt out of marketing communications at any time by using the unsubscribe facility in the relevant communication or by contacting us using the details in Section 16 below. Even if you opt out of marketing, we may still send service, transactional or administrative communications.

12. Access and Correction

You may request access to the personal information we hold about you and ask us to correct it if you believe it is inaccurate, out of date, incomplete, irrelevant or misleading by contacting us using the details in Section 16 below. Before we provide access or make a correction, we may need to verify your identity and ask for further information about your request.

We will respond within a reasonable time and aim to address requests within 30 days where practicable. There are some circumstances in which we are not required to give you access to your personal information. If we refuse access to or correction of personal information, we will provide written reasons where required by law and explain available complaint options.

There is no charge for requesting access to or correction of your personal information; however, we may require you to meet our reasonable costs in providing you with access (such as photocopying costs or costs for time spent on collating large amounts of material).

For details of how you may request access to or correction of credit-related information that we hold about you, see Section 18 below.

13. Complaints

If you believe we have mishandled your personal information or breached applicable privacy laws, you may complain to us using the contact details in Section 16 below. Please provide enough detail to allow us to investigate the issue.

When we receive a complaint, we will acknowledge receipt promptly and will endeavour to consider your complaint and determine whether it requires further investigation. We may ask you for further information and aim to respond within 30 days of receiving your complaint. In our response, we will notify you of the outcome of this investigation, our reason for the decision and any steps we propose to take to address your concerns.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) (www.oaic.gov.au). Where a complaint also relates to a financial service or product, other external dispute resolution options may also be available depending on the circumstances.

For details of how you may submit complaints relating to our handling of credit-related information, see Section 18 below.

14. Data breaches

If we become aware of a data breach involving personal information, we will assess the incident and take appropriate action. Where required by law, we will notify affected individuals and the OAIC.

15. Retention, Destruction and De-identification

We retain personal information for as long as reasonably necessary for the purposes for which it was collected and for related legal, regulatory, insurance, tax, accounting, audit, dispute resolution, risk management and business record purposes. When personal information is no longer required, we will take reasonable steps to destroy or de-identify it, unless we are required or authorised by law to retain it.

16. Contact us

Privacy Officer

Credeq Australia Pty Limited

Email: [email protected]

Address: Level 4, 45 Clarence Street, Sydney, NSW 2000, Australia

Please mark privacy-related correspondence for the attention of the Privacy Officer.

17. Changes to this Policy

We may update this Privacy Policy from time to time to reflect changes in law or our business, technology, service providers, products, legal obligations or privacy practices. The current version will be made available on our website and will take effect from the date published.

18. Credit Information Policy

Scope

This Section 18 sets out details about our handling of Credit Information, as required under the Privacy Act and the Privacy (Credit Reporting) Code 2025 (Cth) (CRCode).

As a credit provider within the meaning of that term under the Privacy Act, you acknowledge that we may undertake any of the functions or activities identified in this Section 18.

In this Section 18, Credit Information means credit information, credit provider (CP)-derived information and/or credit eligibility information, as each of those terms are defined in the Privacy Act. Other capitalised terms in this Section 18 have the meanings given to them in the remainder of this Privacy Policy.

Collection of Credit Information

You acknowledge that we collect, store, use and disclose Credit Information and other information about Applicants and their directors when performing a credit check or assessment. Given our business involves lending and/or insurance products, we need to be satisfied of the Applicant’s creditworthiness before we agree to provide our services. Please note however that:

• we only use licensed credit reporting bodies to perform credit checks (details of which are included below); and
• without conducting a credit check or credit assessment, we cannot provide our products and services to Applicants.

Purposes of collection, use and disclosure of Credit Information

The purposes for which we may collect, hold, use and disclose your Credit Information are:

• to provide our products and services to Applicants;
• to assess credit applications;
• to determine the Applicant’s credit eligibility or creditworthiness;
• to assist in the collection of overdue payments or debt assignments;
• to administer or enforce any guarantee issued by us;
• for internal management purposes such as risk management;
• to prevent defaults or financial hardship;
• to assist other credit providers, credit reporting bodies or third-party providers; or
• as otherwise permitted by law.

Kinds of Credit Information we collect and hold

Credit Information and other information that we may collect and handle about an Applicant and its directors includes:

• information about the Applicant and its directors available on public sources (e.g. Australian Securities and Investment Commission (ASIC) registers and the Personal Property Securities Registry (PPSR)), including director and shareholder details, registered security and document filings to ASIC;
• identification details of directors of the Applicant (such as full name, date of birth, gender, your current (or last known) address and previous two addresses and your driver’s licence number);
• the name of current (or last known) employers of directors;
• the names of any credit providers that have provided the Applicant and any directors with credit and whether they are licenced by ASIC;
• the type of credit provided by those credit providers;
• the day on which that credit was made available and (if relevant) terminated;
• the limit on that credit;
• certain terms and conditions of that credit including limited information about your repayment and interest obligations;
• repayment history information, which is information about whether the Applicant and its directors have made credit payments on time, or whether they have missed a payment, or confirmation from your current or previous landlords or their management agents as to whether you have ever defaulted on your rental payments;
• financial hardship information of the Applicant or its directors which is reported against your repayment history information;
• whether a credit provider has requested access to information held in the Applicant’s or directors’ consumer credit report in connection with an application that has been made to that credit provider for credit (an information request, more commonly known as a credit enquiry);
• the type and amount of commercial credit that is sought in the application with us; and
• that the Applicant or a director has defaulted on a consumer credit payment of AUD $150 or more (this means that they are at least 60 days overdue in making the payment).

We (or our related body corporates) may collect the above Credit Information directly from you, or indirectly from third parties, including (without limitation) your previous or current landlord (or their management agent), our authorised external service providers, other credit providers (if permitted under the Privacy Act) and credit reporting bodies. These credit reporting bodies include Equifax – see details below (which includes Equifax’s privacy policy and address):

• Equifax Pty Ltd and related companies, 4 Blue Street, NORTH SYDNEY NSW 2060 (equifax.com.au/privacy) (for Australia)
• Equifax New Zealand Information Services and Solutions Limited and related companies, 8 Shortland Street, Auckland Central, Auckland 1010 (equifax.co.nz/privacy) (for New Zealand).

Disclosures of your Credit Information

We may disclose your Credit Information (specifically your full name, date of birth and residential address) to a credit reporting body for the purposes of verifying your identity against the information held on your credit file and obtaining information from the credit reporting body to assess your financial position and creditworthiness. If you do not wish to have your identity verified by these means or for us to obtain such information about you, please contact us so that we can discuss other options with you.

In the course of assessing your application for products and services with us, it may become necessary to disclose Credit Information to authorised external service providers located overseas ordinarily, those located in United Kingdom, Europe, Asia and South Africa. However, where we transfer your Credit Information overseas, we will take reasonable steps to ensure that the recipient of your Credit Information handles it securely and in accordance with the Privacy Act.

If you provide any Credit Information to us about another person (for example, about another person within your business), you confirm that you have the authority of that person to share their Credit Information with us and to permit us to hold, use and disclose their Credit Information in accordance with this Policy. You must inform them of their rights to access and request correction of their Credit Information set out the “Access to and correction of your Credit Information” section below (as updated from time to time) and of the information in Section 19 below.

Access to and correction of your Credit Information

You may access or seek correction of the Credit Information we hold about you by contacting us. Our contact details are set out Section 16 above. There are some circumstances in which we are not required to give you access to your Credit Information. Where we do not grant you access, we will provide you with reasons for such denial (where it is reasonable for us to do so) in writing.

Where you seek access to or correction of both your Personal Information (pursuant to Section 12 above) and Credit Information, we may deal with your requests concurrently, if reasonable and appropriate to do so.

We will respond to your requests to access or correct Credit Information within a reasonable time and notify you of any delays. If we consider it necessary in order to deal with your request, we may consult with a credit reporting body or another credit provider. We do not charge you for the making of requests, but we reserve the right to charge an administration fee for providing access in accordance with your request.

If you are not satisfied with our response, you may approach an independent adviser or contact the OAIC (www.oaic.gov.au) for guidance on alternative courses of action which may be available.

Complaints

If you believe that we have not complied with our obligations under the Privacy Act or the CR Code in relation to Credit Information, you should contact us. Our contact details are set out in Section 16 above.

We will consider your complaint and determine if it requires further investigation. We will notify you of the outcome of this investigation and any subsequent internal investigation. If we consider it necessary in order to deal with your complaint, we may consult with a credit reporting body or another credit provider.

If a complaint relates to both Personal Information (pursuant to Section 13 above) and Credit Information, we may deal with the complaints concurrently, if reasonable and appropriate to do so.

Depending on the nature of the complaint, sometimes we may be required to notify a credit reporting body or credit provider of the making of the complaint and our decision. If you remain unsatisfied with the way in which we have handled or resolved your complaint, you may approach an independent adviser or contact the OAIC (www.oaic.gov.au) for guidance on alternative courses of action which may be available.

Changes

We may update this Section 18 from time to time to reflect changes in law and/or our handling of Credit Information. The current version will be made available on our website and will take effect from the date published.