Privacy Policy

Version AU-2026-1

1. Introduction: We recognise that your privacy is very important to you, and this Privacy Policy has been prepared in accordance with applicable laws. By accessing or using the Website or Services, you agree to be bound by this Privacy Policy, and you authorise and consent to us collecting, using, disclosing, and holding personal information about you in accordance with the terms of this Privacy Policy. This Privacy Policy is not intended to cover categories of information that are not governed by the Privacy Act or the Privacy Code.

2. What kinds of personal information we collect: We may collect personal information about you including, but not limited to:

(a) your identity and contact details, such as your name, email address, residential and business addresses, and contact telephone numbers;

(b) information to verify your identity, such as your identity documents and government identifiers;

(d) information about your credit investment requirements;

(e) credit information (see below);

(f) credit-related personal information (see below);

(g) information about your current or previous employment, income, assets, expenses, bank accounts and transactions, and other financial and personal circumstances, at the time that you request a Quote from us, or submit a Loan Application to us, and during the term of any Loan provided to you by us;

(h) your tax file number (TFN) and tax status;

(i) your transaction and Services history with us;

(j) where you are seeking credit to purchase a vehicle, information about the vehicle, your driver licence status, ownership of the vehicle, security interests in the vehicle, and insurance related to the vehicle; and

(k) other information, where relevant.

We may also collect personal information about you that is sensitive information for specific purposes including, but not limited to:

(l) your biometric information and memberships with professional bodies that is reasonably necessary to verify your identity; and

(m) health and medical information that is reasonably necessary to enable our assessment of your hardship application.

You understand that references in this Privacy Policy to personal information include sensitive information.

3. What kinds of credit information we collect: We may collect credit information about you including, but not limited to:

(a) your credit application history with us or other credit providers, such as the products and amount of credit you applied for, and the start and end date of any applicable credit that was provided;

(b) your account identification, such as information about account numbers and customer identifier numbers with us or other credit providers;

(d) your repayment history, such as information about payments you owe us or any other credit provider that is overdue by 60 days;

(e) your credit worthiness, such as information about your credit scores, credit ratings, and evaluations about you and your credit worthiness;

(f) information about any judgment made against you in a court of law, relating to credit provided to you or whether you have been declared bankrupt or insolvent. This includes information on the National Personal Insolvency Index, and information about debt arrangements made by you, insolvency agreements entered into by you, and orders, authorities and directions made under the Bankruptcy Act 1966 (Cth) in relation to your property;

(g) information about variations to your contract arrangements, such as a new arrangement you make with us to vary your credit contract as a result of you being overdue in your payments and about which we have notified a CRB, or in relation to the provision of new credit; and

(h) information in the public domain about your activities and credit worthiness in any state or territory in Australia, information in the National Personal Insolvency Index not relating to court proceedings, and information that we have been provided about a serious credit infringement you have committed. (A “credit infringement” includes fraudulently obtaining or attempting to obtain consumer credit, fraudulently evading or attempting to evade your consumer credit obligations, or not intending to comply with your consumer credit obligations where you have also not been contactable for over a period of 6 months.)

4. What kinds of credit-related personal information we collect: We may collect the following types of credit-related personal information about you:

(a) credit information: this is information relating mainly to your credit-related dealings with us which we can disclose to a CRB that reports on your credit worthiness; and

(b) credit eligibility information: this is information provided to us by CRBs which may include your credit-related dealings with other credit providers. Credit eligibility information also includes your credit worthiness information we derive from data provided by a CRB (for example, credit scores, credit ratings, and evaluations about you and your credit worthiness).

If we hold or collect credit information or credit eligibility information about you, this Privacy Policy will also apply to that information.

5. Collecting personal information directly from you: We collect personal information directly from you when you interact with us through the Website (particularly when you create an Account, request a Quote, or submit a Loan Application) or by other means (such as when you contact us with an enquiry, or participate in promotions we offer through this Website or elsewhere). Whenever you use the Website, we use cookies to collect information about you such as the date, time and duration of your visit, your IP address, domain, locality, server, operating system, browser, search terms you used to find our Website or entered on our Website, pages and links you accessed and buttons clicked on our Website and on other websites, the last website you visited, and the referral source that brought you to our Website.

6. Where we collect personal information about you:

(a) If you use our Services, we may collect personal information about you from:

(i) your current or previous employers, business partners, accountants, lawyers, referees, banks, insurers, landlords, guarantors, co-borrowers, and financial advisers;

(ii) other third parties with whom you may have had dealings, such as professional organisations, service providers, utility providers, and card schemes;

(iii) CRBs and credit providers, for credit information;

(iv) CRBs and identification service providers, for identification information;

(v) publicly available sources of information, such as social media platforms;

(vi) your executors, administrators, or persons purporting to represent you or act on your behalf (whether or not holding Powers of Attorney);

(vii) our agents or service providers, such as debt collection agencies, introducers, professional advisers, direct debit companies, and private investigators;

(viii) public and subscribed databases;

(ix) any person we consider necessary to carry out your instructions;

(x) regulators, government authorities, courts, and the Police;

(xi) anyone else you agree; and

(xii) where you appoint an agent (such as a broker) in connection with our Services, you also authorise us to obtain personal information about you from your agent.

(b) If you give us access to your internet banking, we or our service provider may access personal information about you from your nominated banks, including by using automated technology. You consent to our ongoing access to this information for the term of your relationship with us, and for the purposes outlined in this Privacy Policy. Before giving us access, you should check that your banks’ terms of use allow you to do so.

7. Purposes for which we collect, use, disclose, and hold personal information about you: We collect, use, disclose, and hold personal information about you for our business purposes including, but not limited to:

(a) contacting you;

(b) responding to queries from you and others;

(d) assessing whether or not to provide you with our Services, such as evaluating your credit worthiness and your ability to repay amounts we may lend to you, and assessing your request for a Quote or submission of a Loan Application;

(e) establishing and verifying your identity, including checking your identity document information with the document issuer or official record holder via third-party systems;

(f) carrying out credit and other checks;

(g) providing you with our Services;

(h) managing our relationship with you;

(i) managing your scheduled repayments and one-off payments, including with direct debit companies;

(j) preventing and defending instances of fraud, unlawful conduct, and other risks to our business;

(k) internal and external dispute resolution, and assisting other credit providers with the same;

(l) dealing with serious credit infringement and assisting other credit providers to do the same;

(m) enforcing our rights, such as by undertaking debt collection, instituting legal action, enforcing our security interests, and assigning debts to third parties;

(n) undertaking securitisation activities and other activities relating to our funding and capital requirements;

(o) any specific purpose notified to you at the time the personal information is collected, or that you authorise or to which you consent;

(p) marketing products and services provided by us, Relevant Persons, and third parties, including inviting you to apply for new or further credit from us;

(q) compiling statistical data, such as credit scoring information;

(r) complying with our legal obligations, and obligations under any codes of conduct with which we agree to comply;

(s) assisting government and law enforcement agencies or regulators;

(t) complying with our customer due diligence and other obligations under any anti-money laundering or counter-terrorism financing legislation;

(u) participating in credit reporting systems and providing information to CRBs as permitted under the Privacy Act and Privacy Code;

(v) processing your information, including by the use of AI tools and personas, such as undertaking data categorisation, deriving other information from such processing, or to facilitate any of the uses or disclosures set out in this Privacy Policy;

(w) training, developing, and improving the AI tools and personas that we use; and

(x) any other purpose permitted or required by law, including but not limited to under:

(i) the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth);

(ii) the Corporations Act 2001 (Cth);

(iii) the Financial Sector (Collection of Data) Act 2001 (Cth);

(iv) the National Consumer Credit Protection Act 2009 (Cth);

(v) the Personal Property Securities Act 2009 (Cth) and State and Territory real property and security interests laws; and

(vi) the Tax Administration Act 1953 (Cth), the Income Tax Assessment Act 1997 (Cth), and other taxation laws.

8. Holding personal information about you: We will hold hard copy and electronic records of personal information about you to facilitate any of the uses or disclosures set out in this Privacy Policy. Records will be kept on our premises and systems, or offsite (including online) with third parties. We will hold personal information about you only for as long as necessary to achieve the purpose for which we collected it, and in all cases, for at least such periods as required by applicable laws.

9. Disclosing personal information about you to other parties:

(a) We may disclose personal information about you to Relevant Persons or third parties in Australia and overseas for any of the purposes set out in this Privacy Policy including, but not limited to, those third parties named in clause 6, and the following:

(i) co-applicants or potential co-applicants. In particular, if you request a Quote from us or submit a Loan Application to us jointly and severally with another party, each of you authorises and consents to us providing personal information about you to the other party, and that we may accept instructions from either of you in respect of personal information about you;

(ii) any agent (such as a broker) you appoint in connection with our Services;

(iii) CRBs and identification service providers;

(iv) your executors, administrators, or persons purporting to represent you or act on your behalf (regardless of whether they hold Powers of Attorney or not);

(v) our agents or service providers, such as debt collection agencies, introducers, professional advisers, direct debit companies, private investigators, market research and data analysis providers, mailing houses, call centre operators, and technology service providers;

(vi) providers of AI tools and personas, and such AI tools and personas themselves where they could be deemed to be a third party or an agent of a third party;

(vii) any person we consider necessary to carry out your instructions;

(viii) regulators, government authorities, courts, and the Police;

(ix) suppliers of goods and services which are financed with the proceeds of a Loan;

(x) third party creditors of yours who will be repaid with the proceeds of a Loan;

(xi) other persons on whose behalf we as an agent;

(xii) financial institutions, such as banks and credit providers;

(xiii) insurers, assessors, underwriters, brokers, and other distributors of insurance products;

(xiv) entities involved in our securitisation or other funding arrangements, such as trustees and financiers;

(xv) our assignees, transferees, and potential assignees and transferees, of any or all of our rights or obligations (including under any Loan Contract), and any other entities who acquire or may acquire an interest in our business; and

(xvi) anyone else you agree (whether expressly or impliedly), or to whom we are permitted or required by law to provide information.

(b) If you ask us to make a payment to an entity such as a retailer, bank, or financial institution, then we will provide personal information about you to that entity, and to other entities who process such payments. They are not our service providers, and we do not control how they handle personal information about you.

(c) Some recipients of personal information about you may be located overseas and may not have an Australian link (for example, some Relevant Persons are incorporated in New Zealand, and we may employ service providers in Fiji, India, New Zealand, the Philippines, and Vietnam). Such recipients may not be subject to the Privacy Act or the Privacy Code, however, we require such recipients to adhere to reasonable standards of privacy, security, and confidentiality, and where practicable, to treat personal information about you in a manner consistent with the Privacy Act and the Privacy Code.

(d) We may disclose personal information about you if we are required to do so under law, or if the disclosure is made in connection with the normal operation of our business in a way that you might reasonably expect (for example, the disclosure is incidental to technology services being provided to our business, in connection with any insurance or warranty claim, or for the resolution of a dispute).

(e) We and each third party referred to in this clause 9 are intended recipients of personal information about you. You authorise and consent to us and each third party referred to in this clause 9 collecting, using, disclosing, and holding personal information about you for any of the purposes set out in this Privacy Policy.

10. Relationship with ClearScore: Without limiting anything else in this Privacy Policy, where you have been referred to us, our Website, or our Services by ClearScore, you acknowledge and agree that:

(a) ClearScore may disclose personal information about you to us in accordance with its Terms and Conditions and Privacy Policy;

(b) where personal information about you is shared with us by ClearScore, we may collect, use, disclose, and hold that personal information in accordance with this Privacy Policy; and

11. Use of Equifax Verification Exchange: Without limiting anything else in this Privacy Policy, you acknowledge and agree that:

(a) we may use Equifax Verification Exchange to collect information about your employment; and

(b) Equifax Verification Exchange may collect, use, and disclose personal information about you in accordance with its Privacy Collection Statement, including by making disclosures to your employer(s), payroll or other service providers who might act on behalf of your employer(s), in order to identify you, and collecting your employment income, history and related information from such parties, using such information, and making disclosure to us in order for us to assess whether or not to provide you with our Services

12. Disclosing credit information about you to third parties including CRBs: Without limiting anything else in this Privacy Policy, you acknowledge and agree that

(a) you understand that if we disclose personal information about you to CRBs for the purpose of us providing Services to you, the CRBs may hold your information on their credit reporting database and use it for providing credit reporting services, including assessing your credit worthiness and for any other lawful purpose, and that the CRB may disclose your information to their subscribers for the purpose of credit checking, debt collection, or for any other lawful purpose;

(b) subject to complying with the requirements of the Privacy Act, we may disclose to a CRB information about payments owed by you to third parties (including a borrower or guarantor) under a consumer credit contract, that has remained overdue for more than 60 days (default information); and

(i) Equifax

Website: equifax.com

Phone: 1300 762 207

Address: Equifax Public Access, GPO Box 964, North Sydney, NSW 2059, Australia

(ii) Experian

Website: experian.com.au

Phone: 1300 783 684

Address: Experian Public Access Centre, PO Box 7405, St Kilda Road, Melbourne, VIC 3004, Australia

13. Your rights in relation to CRBs: You are entitled under the Privacy Act to opt-out of direct marketing pre-screenings where CRBs use credit information about you for the purposes of marketing their products and services. In addition, if you believe that you have been or are likely to be a victim of fraud, you can request that CRBs not disclose credit information about you, subject to time limits prescribed by the Privacy Act (ban periods).

14. Credit files:

(a) By requesting a Quote, you authorise and consent to our Related Body Corporate, Harmoney Services Australia Pty Ltd, obtaining a copy of your credit file. This company acts as an access seeker, meaning that its access to your credit file will not leave a credit enquiry, will not be visible to credit providers, and will not impact your credit score.

(b) By submitting a Loan Application, you authorise and consent to us obtaining a copy of your credit file. We act as a credit provider, meaning that our access to your credit file will leave a credit enquiry, and could impact your credit score.

15. Marketing communications: By providing us with personal information about you, you also agree (in addition to the matters set out above) to us:

(a) using that personal information for the purposes of informing you about our products and services; and

(b) providing that personal information to Relevant Persons and third parties we have dealings with to market our products and services, or to market their products and services, to you.

Any commercial electronic message that you receive from us or on our behalf will include an unsubscribe facility, so that you can remove yourself from any further commercial electronic messages. You may also contact us to remove yourself from our direct marketing list, and we will do so within 5 business days.

16. Security: We use a range of physical and electronic security measures to keep personal information about you secure, such as the use of encryption for the transmission of certain data, firewalls, identity and access controls, and secured physical premises. We also maintain a security operations team, enforce information security policies with our personnel, and conduct training with our personnel on privacy and information security.

17. Data breaches: A data breach occurs where personal information is subject to unauthorised access or disclosure, or is lost in circumstances where unauthorised access or disclosure is likely to occur. In the event of a data breach, we will assess and respond in accordance with our policies and procedures, which have been developed in accordance with guidance from the Office of the Australian Information Commissioner and the requirements of the Privacy Act. We will notify you where a data breach may cause or has caused you harm.

18. Revoking your consents: You may revoke any authorisations or consents that you have given us under this Privacy Policy by emailing us at [email protected]. However, in revoking any authorisation or consent you acknowledge that:

(a) your revocation of any authorisation or consent is subject to any legal obligations that we must comply with, and that such revocation may therefore be ineffective or limited;

(b) where you have requested a Quote, submitted a Loan Application, or entered into a Loan Contract, your revocation of any authorisation or consent is subject to our rights or obligations in respect of such Quote, Loan Application, or Loan Contract, and that such revocation may therefore be ineffective or limited;

(d) we may continue to use, disclose and hold personal information about you that we have already collected under your prior authorisations or consents, in accordance with this Privacy Policy. However, subject to (a) and (b), where we no longer require such personal information, we will (at our election) delete such personal information, or undertake de-identification of such information so that it is no longer “personal information” for the purposes of the Privacy Act;

(e) we may not be able to provide you with certain information, products, or services that you are seeking from us (for example, you may be unable to create an Account, request a Quote, submit a Loan Application, or enter into a Loan Contract); and

(f) you must immediately cease to use our Website and/or Services. Subsequent use of our Website and/or Services will constitute a new agreement by you to be bound by this Privacy Policy, and a new authorisation by you for us to collect, use, disclose and hold information in accordance with the terms of this Privacy Policy.

19. Consequences of you not providing the personal information we require: If you do not provide us with all of the personal information we request of you, we may not be able to provide you with certain information, products, or services that you are seeking from us. In particular, you may be unable to create an Account, request a Quote, submit a Loan Application, or enter into a Loan Contract.

20. How you can access or correct personal information about you: You may request access to the personal information about you that we hold, or that the personal information about you that we hold be corrected (by way of correction, deletion, or addition), by emailing us at [email protected]. Any request for access or correction should be as specific as possible. We may require you to verify your identity prior to processing your request. We may refuse your request in certain circumstances allowed by the Privacy Act, however we will notify you of our reason, and advise what further steps you may take.

21. Deletion of personal information about you: You may request that we delete any or all of the personal information about you that we hold by emailing us at [email protected]. However, in making such request you acknowledge that:

(a) your revocation of any authorisation or consent to hold such personal information is subject to any legal obligations that we must comply with, and that such revocation may therefore be ineffective or limited;

(b) where you have requested a Quote, submitted a Loan Application, or entered into a Loan Contract, your revocation of any authorisation or consent to hold such personal information is subject to our rights or obligations in respect of such Quote, Loan Application, or Loan Contract, and that such revocation may therefore be ineffective or limited;

(d) we may continue to use, disclose and hold personal information about you that we already collected under your prior consents, in accordance with this Privacy Policy. However, subject to (a) and (b), where we no longer require such personal information, we will (at our election) delete such personal information, or undertake de-identification of such information so that it is no longer “personal information” for the purposes of the Privacy Act;

(f) you must immediately cease to use our Website and/or Services. Subsequent use of our Website and/or Services will constitute a new agreement by you to be bound by this Privacy Policy, and a new authorisation by you for us to collect, use, disclose, and hold information in accordance with the terms of this Privacy Policy.

22. AI: Our rights to collect, use, disclose, and hold personal information about you under this Privacy Policy extend to our use of AI tools and personas (such as chatbots or virtual assistants) to do the same, including where such AI tools and personas could be deemed to be a third party or an agent of a third party. We are committed to the responsible and compliant use of AI, and have implemented AI usage and governance policies.

23. Automated decision-making: We use computer programs that substantially assist our business and/or to make decisions that significantly affect your rights or interests. This includes, but is not limited to:

(a) allowing such programs to use certain personal information about you, including but not limited to that information described in clause 2(g), and the credit information described in clause 3; and

(b) such programs making decisions that are entirely automated, including but not limited to:

(i) deciding whether biometric identity verification is required;

(ii) deciding whether or not biometric identity verification has been successful;

(iii) categorising your bank transactions;

(iv) generating an internal risk score in respect of a given Quote or Loan Application;

(v) deciding to decline a Quote or Loan Application; and

(vi) determining the interest rate and borrowing limit that we will provide in respect of a given Quote or Loan Application.

However, we reserve the right to manually review and change such decisions.

24. Privacy complaints:

(a) You may make a complaint if you reasonably believe that we have not complied with our privacy obligations under the Privacy Act or the Privacy Code by contacting our Privacy Officer on 1300 042 766 or at [email protected]. We will provide a written notice to you acknowledging receipt of and setting out how we will deal with your complaint within 7 days. We will then investigate and endeavour to resolve your complaint. In any case, we will provide you with our decision within 30 days of us receiving the complaint or, if we need more time, we will notify you of the reasons why and seek your agreement to extend the 30 day period. If you do not agree, we may not be able to resolve your complaint. We may consult a CRB or other third parties to investigate and resolve complaints about credit-related personal information as we consider necessary.

(b) If you reasonably believe that your complaint has not been handled satisfactorily, you may refer the matter to:

(i) our external disputes resolution scheme, the Australian Financial Complaints Authority, at:

Website: afca.org.au

Email: [email protected]

Phone: 1800 931 678; or

(ii) the Office of the Australian Information Commissioner at:

Website: oaic.gov.au

Phone: 1300 363 992

Post: GPO Box 5288, Sydney NSW 2001.

25. Contact us: If you have any queries about this Privacy Policy, or personal information about you, please contact us on 1300 042 766, at [email protected], or by writing to us at the address listed on harmoney.com.au.

26. Amendments: We may amend this Privacy Policy at any time by updating the Website. You should check the Website regularly. Any such amendments will apply from the date the Website is updated. By continuing to access the Website or Services, you will be deemed to have accepted such amendments.

27. Defined terms: In this Privacy Policy:

Account means an account by which you may access our Services.

AI means computer systems that do tasks that seem like intelligent behaviour, such as finding patterns, putting items into categories, or triggering actions based on information.

ClearScore means ClearScore Australia Pty Ltd (ABN 21 624 386 330) or any of its related entities.

consumer credit has the meaning set out in the Privacy Act.

CRB means a credit reporting body, which has the meaning set out in the Privacy Act.

credit has the meaning set out in the Privacy Act.

credit eligibility information has the meaning set out in the Privacy Act.

credit information has the meaning set out in the Privacy Act.

credit provider has the meaning set out in the Privacy Act.

credit-related personal information has the meaning set out in the Privacy Code.

credit worthiness has the meaning set out in the Privacy Act.

Equifax Verification Exchange means the secure employment income verification service provided by Equifax Pty Ltd.

identification information has the meaning set out in the Privacy Act.

Loan means any credit product provided by us from time to time.

Loan Application means an application for a Loan.

personal information has the meaning set out in the Privacy Act, and as used in this Privacy Policy, includes credit information, credit eligibility information, credit-related personal information, and identification information.

Privacy Act means the Privacy Act 1988 (Cth).

Privacy Code means the Privacy (Credit Reporting) Code 2025.

Quote means a quotation for the cost of credit, which may include the estimated loan amount, interest rate, and repayment amounts for a proposed Loan.

Related Body Corporate has the meaning set out in the Corporations Act 2001.

Relevant Person means each of our Related Bodies Corporate and any of our, or our Related Bodies Corporate’s, employees, directors, officers, agents, and contractors.

sensitive information has the meaning set out in the Privacy Act.

Service means any service provided by us through the Website from time to time, including the ability to request a Quote, submit a Loan Application, and review your Loans.

we, us or our means Harmoney Australia Pty Ltd.

Website means the website at harmoney.com.au, or such other website or application as we or a Relevant Person may from time to time operate to provide a Service.

you or your means the person

Privacy Policy

Location

Contact

Terms and conditions