Real Financial is a credit representative operating under the Australian Credit Licence of Southern Cross Broker Network Pty Ltd (ACL 384993). We are committed to helping you access suitable financial products and services, and to protecting the personal information you share with us.

This Privacy Policy explains how we collect, hold, use and disclose your personal information. It also serves as our credit reporting policy, covering how we manage information collected in connection with a credit application or credit facility (referred to below as credit information).

We handle your personal information in accordance with the Australian Privacy Principles set out in the Privacy Act 1988 (Cth) and any other relevant law. If you are in a country within the European Economic Area (EEA), the EU General Data Protection Regulation 2016/679 (GDPR) also applies, and we act as a data controller in respect of your information.

Who we are

Real Financial provides credit assistance within the mortgage and finance industry. We help you prepare and lodge finance applications, source lenders suited to your circumstances, and may introduce you to related products and services.

When you engage us, you appoint us as your agent to obtain your credit information from a credit reporting body for the purpose of assisting with your finance application, and you authorise us to disclose that information to prospective lenders in connection with your application.

What personal information we collect

The information we collect and hold may include:

• Identity information such as your name, date of birth, and residential, postal or email address
• Contact details such as phone numbers and social media handles
• Financial information relevant to your application, including income, assets, liabilities and, where required, your tax file number
• Any other information reasonably necessary to provide our services

Collection required or authorised by law

In some cases we are required or authorised by law to collect your information — for example, to verify your identity under Australian Anti-Money Laundering and Counter-Terrorism Financing law.

Information collected through our website

If you interact with us online, we may monitor your use of our website to verify your identity, deliver information to you, and improve our services. If you begin but do not complete an online enquiry or application, we may use the contact details you provided to offer assistance; incomplete application information is held temporarily and then destroyed if the application is not completed.

We may also collect de-identified information such as IP addresses or general location data to keep our online services secure and to improve them.

If you engage with us through social media, we may collect information from those interactions. For confidential matters, we will always move the conversation to a secure channel.

How we collect your information

Where reasonable and practicable, we collect personal information directly from you — for example, when you complete a form, call us, email us, send an SMS, or use our website. For this reason, please keep your contact details current.

Where permitted by the Privacy Act, we may also collect information from other sources when reasonably necessary, including from:

• Co-applicants, co-borrowers, guarantors and prospective guarantors
• Your employer, accountant, real estate agent or other referees
• The person or business who referred you to us
• Your solicitors, conveyancers, settlement agents and other representatives
• Organisations that help us process credit applications, verify identity, or value security you offer
• Publicly available sources, where we need to update your contact details and cannot reach you

Unsolicited information

If we receive personal information we did not request, we will assess whether it is reasonably necessary for our functions. If it is, we handle it in line with this policy. If it is not, we will destroy or de-identify it.

If you choose not to provide information

If you don’t provide the information we ask for, we may not be able to give you credit assistance, find a loan or lease suited to your circumstances, verify your identity, protect against fraud, or tell you about other products that may suit your needs.

How we hold and protect your information

We hold personal information in both paper and electronic form. We take reasonable steps to protect it from misuse, interference, loss, and unauthorised access, modification or disclosure, including through document storage policies, system access controls, and limiting access to those authorised to receive the information.

We may use third-party data storage providers, including cloud storage. Where we do, we use contractual arrangements to require appropriate protection of your information and to limit how it may be used.

When we no longer need your information, and are not required by law to retain it, we destroy or de-identify it.

How we use your information

We use your personal information to provide the products and services you have requested, including to:

• Provide credit assistance and information about loan products and related services
• Assess your eligibility and prepare your loan or lease application
• Administer the services we provide, including responding to requests and complaints
• Administer payments relating to your loan or lease
• Verify your identity
• Prevent fraud or other crime
• Run our business and perform administrative tasks
• Meet our obligations under law, regulation or industry codes
• Fulfil any other purpose you have consented to

Marketing

We may use your information to tell you about other products or services from us or third parties that may interest you. You can opt out of direct marketing at any time, and we will action your request as soon as practicable. With your consent, we may share your information with third parties to connect you with other businesses; you can ask us to stop at any time. We do not sell your personal information.

GDPR legal grounds

If the GDPR applies to you, we rely on one or more of the following legal grounds to process your information: performance of our contract with you, compliance with a legal obligation, your consent, or our legitimate interests (which include fraud prevention, security, due diligence, business operations and direct marketing).

Who we share your information with

To provide our services, we may share your personal information with:

• Your representatives and referees, such as your lawyer, accountant, settlement agent, real estate agent or employer
• Southern Cross Broker Network, as the holder of the Australian Credit Licence that authorises us to engage in credit activities, and the mortgage aggregator through which applications are submitted
• Lenders, lessors, lenders’ mortgage insurers and other loan or lease intermediaries
• Valuers and organisations that assess the security you offer
• Referrers who introduced your business to us
• Service providers, agents, contractors and advisers who help us run our business
• Fraud reporting and prevention agencies
• Government and regulatory bodies (including ASIC and the Australian Taxation Office) as required or authorised by law
• Guarantors and prospective guarantors
• Any party to which you consent, or any organisation considering an interest in our business or assets

Sharing outside Australia

We are unlikely to disclose your information to overseas recipients. However, we may store information using cloud or networked storage that can be accessed from other countries. Where information is transferred from the EEA to a recipient outside it, we take steps to ensure an adequate level of protection is in place, such as appropriate contractual safeguards.

Accessing and correcting your information

You can ask us in writing to access the personal information we hold about you. We will provide access unless there is a legal reason we cannot — for example, where access would threaten someone’s safety, unreasonably affect another person’s privacy, be unlawful, or prejudice legal proceedings or an enforcement activity. If we can’t provide access in the way you’ve asked, we will explain why in writing.

If you believe the information we hold is inaccurate, out of date, incomplete or irrelevant, contact us and we will take reasonable steps to correct it. If we have shared incorrect information with others, you can ask us to notify them of the correction.

For credit information corrections, we will help you make the request even where another organisation made the error. If we cannot make the correction, we will explain why in writing within five business days. We will generally action agreed corrections within 30 days, and will let you know if we need more time.

How to make a complaint

If you have a complaint about how we handle your personal information, we want to hear from you. Please contact:

Privacy Officer Real Financial [Name] Phone: [phone] Email: [email] Mail: [postal address]

We aim to resolve most complaints quickly and will usually respond within five business days. For complaints relating to credit information (other than access or correction requests), we will let you know how we will handle it within seven days and aim to resolve it within 30 days.

If you are not satisfied with our response, you can contact the Australian Financial Complaints Authority (AFCA):

• Online: www.afca.com.au
• Phone: 1800 931 678
• Email: info@afca.org.au
• Mail: GPO Box 3, Melbourne VIC 3001

You may also raise privacy concerns with the Office of the Australian Information Commissioner (OAIC):

• Online: www.oaic.gov.au
• Phone: 1300 363 992

If you are located in the EEA, you may also contact the data protection authority in your country.

Your rights under the GDPR

If you reside in the EEA, you may also object to or ask us to restrict or stop processing your information, ask us to delete it, withdraw your consent, or request an electronic copy of your information (including transfer to another organisation). In some cases we may be required or entitled to retain or continue using your information. If we refuse a request, we will explain why in writing and how you can complain.

Government-related identifiers

Where we are required to collect government-related identifiers such as your tax file number, we will not use or disclose that information unless authorised by law.

Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of changes by posting an update on our website or contacting you directly. You can request a current copy of this policy at any time.

Last updated: [date]