Privacy and Credit Reporting Policy

The law requires us to ensure you are aware of the following matters before we collect your personal information:

• Our identity and contact details
• The fact and circumstances of collection
• Whether the collection is required or authorised by law
• The purposes of collection
• The consequences if personal information is not collected
• Our usual disclosures of personal information collected by us
• Information about our privacy policy
• Whether we likely to disclose personal information to overseas recipients and (if practicable) the countries where they are located

These matters are addressed in this policy. Please let us know if you have any questions about these matters before providing your personal information to us.

This is the privacy and credit reporting policy of Household Capital Pty Limited ACN 618 068 214 (Australian Credit Licence 545906), Household Capital Services Pty Limited ACN 625 860 764 (an exempt special purpose funding entity and credit provider of your loan), and our related businesses (we, us, our and HHC). It sets out how we collect, use and disclose personal information (including credit-related personal information) we hold about you.

We understand how important it is to protect your personal information. This document sets out our commitment in respect of the personal information (including credit-related personal information) we hold about you and what we do with that information.

We recognise that any personal information we collect about you will only be used for the purposes we have collected it for or as allowed under the law. It is important to us that you are confident that any personal information we hold about you will be treated in a way which ensures protection of your personal information.

Our commitment in respect of personal information is to abide by the Australian Privacy Principles (APPs) and Part IIIA of the Privacy Act 1988 (Cth) (Privacy Act), the Privacy (Credit Reporting) Code 2025 (CR Code) and any other relevant law.

When we refer to ‘personal information’, we mean information from which your identity is reasonably apparent. This information may include information or an opinion about you. The personal information we hold about you may include the following:

1. Personal identifiers and contact details (including socio-demographic information)

The kinds of personal information we may collect about you include your name, date of birth, address, account details, passport details, driver licence details and any other information we may need to identify you. Where a Power of Attorney or administration order is in place, we will also collect the above personal information for this representative to establish their identity.

We may rely on digital identification scanning technology that takes an electronic copy of your proof of identity documents, such as your driver’s licence.

2. Technical and usage data

When you visit our websites or use our mobile apps, we may collect information about your location or activity, including your IP address, telephone number, whether you have accessed third party sites, the date and time of visits, the pages that you viewed, information about the device used, and other user location information.

We collect some of this information using cookies (for more information, please see our Website Terms of Use / Policy).

https://householdcapital.com.au/website-privacy-policy/

3. Product profile

We may hold details of products and services (including their status) you have, such as any home loan, finance or superannuation product.

‘Sensitive information’ is personal information that includes information relating to your racial or ethnic origin, political persuasion, memberships in trade or professional associations or trade unions, sexual orientation, criminal record or health. We will only collect sensitive information about you with your consent, unless the collection is otherwise permitted or required by law.

‘Credit-related personal information’ is a subset of personal information, and includes:

• Credit information, which is information such as your identity; the type, terms and maximum amount of credit provided to you, including when that credit was provided and when it was repaid; repayment history information (including financial hardship information); default information (including overdue payments); payment information; new arrangement information; details of any serious credit infringements; court proceedings information; personal insolvency information; and publicly available information; and
• Credit eligibility information, which is credit reporting information supplied to us by a credit reporting body (CRB), and any information that we derive from it.

Credit-related personal information that we hold about you may include your financial position and transaction data.

We use your credit-related personal information to assess your eligibility to be provided with finance. Usually, credit-related personal information is exchanged between credit and finance providers and CRBs.

If you are applying for finance or provide a guarantee, we may also collect the ages and number of your dependents and cohabitants, the length of time you have resided at your current address, your employment details, and proof of your earnings and expenses.

We collect and hold personal information for the purposes of assessing your application for finance and managing that finance, establishing your identity, contacting you, managing disputes or complaints, managing our risk and to comply with our legal obligations. For example, we are required or authorised to collect certain identification and personal information about you under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), certain information about your financial position under the National Consumer Credit Protection Act 2009 (Cth) (for applying for credit), and certain identification information under property laws in states and territories (for providing a mortgage as security).

We exchange credit-related personal information for the purposes of assessing your application for finance and managing that finance.

We may also collect your personal information for the purposes of direct marketing (see below under ‘Direct marketing’) and managing our relationship with you. Improvements in technology also enable organisations like ours to collect and use information to get a more integrated view of our customers. From time to time we may offer you other products and services.

We may use artificial intelligence (AI) as part of our business, however any information we use will not be retained to train any AI models.

If you decide not to provide us with personal or credit-related information we request, we may not be able to consider your application or delay providing you our products or services.

We collect personal information (including credit-related personal information) in a number of ways, including:

• directly from you, for example, when you provide information by phone or video, in application forms or other agreements, or when you submit your personal details using our website;
• from third parties or your representatives. If we obtained your information through any of these methods and you would like a list of these entities or websites, or if you feel you have not given us consent to use your details, please contact us;
• from publicly available sources of information;
• from CRBs. For example, when we obtain credit eligibility information from a CRB about you, we may also seek publicly available information and information about any serious credit infringement that you may have committed;
• from our own records; and
• when you visit our website.

We may also collect personal information using digital identification scanning technology. This may involve taking an electronic copy of your proof of identity documents (for example, your driver’s licence or passport) to verify your identity. We may also check information from your identity documents with the document issuer or official record holder using authorised third-party systems for the purpose of verifying your identity. The information is stored securely in electronic form and protected by our IT security measures described in this policy.

This personal information may be held by us in electronic form on our secure servers and may also be held in paper form. We may use cloud storage to store the personal information we hold about you. The cloud storage and the IT servers may be located outside Australia.

We may use AI systems and other digital technologies to assist with our business functions, for example, to improve efficiency, analyse data, or support customer service. These systems may process personal information that we hold, but we do not use personal information to train external AI models. Any AI tools we use operate in controlled environments with human oversight, and are subject to the same privacy, security and governance measures described in this policy.

From time to time, we may use computer programs or automated systems to assist with decisions about products or services, such as assessing eligibility for finance or verifying information. Personal information may be used in the operation of these systems. Where a decision is made solely by an automated process, or where a computer program does something substantially and directly related to making such a decision, and that decision could reasonably be expected to significantly affect an individual’s rights or interests, we will take reasonable steps to ensure transparency about how these systems operate and how individuals can seek review or further information.

The kinds of personal information that may be used in these automated processes include identification, demographic, contact, financial and credit-related information provided in applications or held in our systems. The kinds of automated decisions may include preliminary assessments of credit eligibility, verification of identity, and other processing steps that support the provision or administration of finance. Final lending decisions are subject to human review and oversight.

If you provide to us personal information about other individuals (for example, the name and contact details of your authorised representatives), you should inform them that you are doing so and advise them they can contact us for further information.

1. IP address

Your internet protocol address (or ‘IP address’) is the numerical identifier for your device when you are using the internet. It may be necessary for us to collect your IP address for your interaction with some parts of our website.

2. Cookies (and targeting and remarketing)

A ‘cookie’ is a small text file placed on your device by a webpage server that may later be retrieved by webpage servers. There are different types of cookies and they are used for different purposes. For example, session cookies are generally active for one session only as they are used to facilitate completing online forms; they differ from persistent cookies that are stored on your device to help websites remember your information and settings when you visit them again. We use cookies on our website to provide you with a better website experience. We also use cookies for other purposes, such as to better understand our users’ behaviours and habits (such as by measuring traffic patterns and analysing trends) so that we can diagnose problems and make improvements to our products and services. We may use cookie information to display targeted advertisements or content on our network and on this website, and also on third party networks and websites (Third Party Websites) such as Google and Facebook. We may use remarketing tools such as Google AdWords to tailor our marketing to (for example) better suit your needs and only display advertisements that are relevant to you.

When you visit our website or related landing pages to read, browse, submit or download information, our system will record/log information such as your IP address, date and time of your visit to our site, the pages viewed and any information downloaded. We may automatically collect non-personal information about you such as the site from which you were linked to our website. In some cases we may also collect your personal information through the use of cookies.

You can configure your browser to refuse cookies or delete existing cookies from your hard drive.

Rejecting cookies may have the effect of limiting access to or functionality of parts of our website.

3. Web beacons and tracking pixels

A web beacon is typically a transparent graphic image invisible to the user that is placed on a website. The use of a web beacon allows the website to record the simple actions of the user (such as opening the page that contains the beacon) through a tracking pixel.

We may use web beacons (and cookies) for purposes such as site usage analytics, advertising auditing and reporting, as well as content and ‘advertising/marketing personalisation’. We may share any data collected from web beacons (and cookies) with third parties to provide you with relevant advertising when browsing Third Party Websites.

We may use tracking pixels provided by third parties (for example, social media and analytics platforms) to help us understand how visitors use our website and to measure the performance of our advertising campaigns. Tracking pixels are small pieces of code that allow data such as IP address, pages visited, time spent on our site, form interactions or items viewed to be sent to the relevant third-party platform. We take a cautious approach to the use of tracking pixels, for example, we configure them to limit the collection of personal information to what is reasonably necessary for our business functions, and we do not intentionally share sensitive information through these technologies. Any personal information collected using tracking pixels is handled in accordance with this policy and the APPs.

4. Links to third party websites

Our website contains links to third party websites (for example, third party providers of goods and services). If you access third party websites through our website and if those third parties collect information about you, we may also collect or have access to that information as part of our arrangements with those third parties.

Where you access a third party website from our website, cookie and web beacon information, information about your preferences or other information you have provided about yourself may be shared between us and the third party.

5. Advertising and tracking

We may advertise on third party websites. When you view our advertisements on third party websites, the advertising company may use cookies, and in some cases, web beacons, to collect information such as the server your computer is logged onto, your browser type, the date and time of your visit and the performance of their marketing efforts.

When you access our website after viewing one of our advertisements on a third party website, the advertising company may collect information on how you utilise our website (for example, which pages you viewed) and whether you commenced or completed an online application or other online forms.

By providing your email address and then clicking submit on any online form, application, calculator, tool or query, or by accepting or attending a meeting with us, you consent to receive notices and other documents from us by email to the email address provided, and you understand that if you give this consent: we may no longer send you paper copies of notices and other documents; that you should regularly check your email address for documents; and you may withdraw your consent to receiving documents by email at any time and without cost by advising us in writing. You also confirm that you have the facilities or ability to print any notice or document that we send you by email, if required.

When you send a completed online application to us, we retain the information contained in that application. We can use that information to provide any products and services that you require.

You may also be able to suspend and save online applications, so you can complete and send the applications at a later time. If you suspend or save your application, the information that you have entered will be retained in our systems so that you may recover the information when you resume your application.

Online applications that have been suspended or saved may be viewed by us. In particular, if you start but do not submit an online application, we may contact you using any of the contact details you have supplied to offer assistance in completing it. If you do not wish to receive further contact or do not wish to proceed with your application, you can let us know at that time.

Sometimes people share information (including sensitive information) with us that we have not sought out. This could be through using our website or, for example, requesting us to assess or assist in a credit hardship application.

If we receive unsolicited personal information (including credit-related personal information) about you, we will determine whether we would have been permitted to collect that information. If yes, then we will handle this information the same way we do with other information that we seek from you or in the manner described in this policy. If no and the information is not contained in a Commonwealth record, then we will destroy or de-identify it as soon as practicable, but only if it is lawful and reasonable to do so.

Often, it is not possible for us to neatly unbundle this information then destroy or de-identify only certain sections or parts of it, and we may need to store this information for future use, such as to help resolve disputes between us or assess future applications by you. We have many security safeguards in place to protect the information from interference, misuse, loss, unauthorised access, modification or disclosure.

We will not sell or trade your personal information to any party outside of HHC. We may disclose your personal information to third parties for the purpose of delivering the products or services you require. Your personal information is disclosed to these organisations only in relation to us conducting our business or providing our products and services to you.

We may disclose your personal information to:

• our Partners or organisations we form a strategic partnership or a similar business relationship with;
• other organisations that are involved in managing or administering your finance such as third party suppliers, printing and postal services, call centres, lenders, mortgage insurers, trade insurers, and CRBs;
• companies that provide information and infrastructure systems to us;
• our agents, contractors, external service providers to whom we outsource certain functions, for example, statement production, debt recovery, and information technology support, including any servicers, or sub/backup servicers of your loan;
• anybody who represents you, such as finance brokers, lawyers, mortgage brokers, guardians, persons holding power of attorney, and accountants;
• anyone, where you have provided us consent;
• other guarantors or borrowers (if more than one);
• borrowers or prospective borrowers, including in relation to any credit you guarantee or propose to guarantee;
• our auditors, insurers and re-insurers;
• claims-related providers, such as assessors and investigators who help us with claims;
• where we are authorised to do so by law, such as under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), or by government and law enforcement agencies or regulators;
• authorised third party Gateway Service Providers to satisfy our identity verification obligations;
• investors, agents or advisers, trustees, rating agencies, or any entity that has an interest in your finance or our business;
• other financial institutions, for example, to process a claim for mistaken payment; or
• organisations that provide products or services used or marketed by us.

We may disclose your personal information in accordance with the purposes outlined in this policy, including as set out under ‘Direct marketing’.

Prior to disclosing any of your personal information to another person or organisation, we will take all reasonable steps to satisfy ourselves that:

• the person or organisation has a commitment to protecting your personal information at least equal to our commitment, or
• you have consented to us making the disclosure.

Some of the third parties may be located outside of Australia. Where tracking pixels result in information being sent to a third-party platform located outside Australia, we take reasonable steps to ensure the overseas recipient does not breach the APPs in relation to that information.

We run our business in Australia, but may from time to time need to share your personal information (including credit-related personal information) with organisations outside of Australia. This may include related entities and service providers located in USA, Canada, Malaysia, India, Ireland, the United Kingdom, the Philippines, or Fiji. Where we do this, we will take reasonable steps to ensure appropriate data handling and security arrangements are in place. You should note that while overseas entities will often be subject to confidentiality or privacy obligations that apply in the relevant jurisdiction, they may not always follow the particular requirements of the Privacy Act. In the event that a disclosure is made in an overseas country, the information will not be protected by the APPs, and you will not be able to hold us accountable or seek redress under the Privacy Act if the overseas entity breaches the APPs. By providing us with your details, you consent to your personal information being disclosed in this manner. Overseas entities may be required to disclose information we share with them under a foreign law. In those instances, we are not responsible for that disclosure.

We may store your information in cloud or other types of networked or electronic storage. You should note that, as electronic or networked storage can be accessed from various countries via an internet connection, it is not always practicable to know in which country your information may be held.

We will not share any of your credit information with a CRB, unless it has a business operation in Australia.

We are not likely to share with overseas entity credit information we obtain about you from a CRB or that we derive from that information.

We may disclose information about you to a CRB in Australia when you are applying for credit, you have obtained credit from us, or if you guarantee or are considering guaranteeing the obligations of another person to us. When we give your information to a CRB, it may be included in reports that the CRB gives other organisations (such as other lenders) to help them assess your creditworthiness.

Some of that information may reflect adversely on your credit worthiness, for example, if you fail to make payments or if you commit a serious credit infringement (like obtaining credit by fraud). That sort of information may affect your ability to get credit from other lenders.

The law requires us to advise you of certain ‘notifiable matters’ in relation to how we handle your credit-related personal information. You may request to have these notifiable matters (and a copy of this policy) provided to you in an alternative form.

We exchange your credit-related personal information with credit reporting bodies (CRBs). This includes information such as your identification details, the type and amount of credit you have, your repayment history, whether you have met your credit obligations, and whether you have committed a serious credit infringement (such as fraud).

We may disclose information to a CRB even if you do not consent to the disclosure. For example, we may make what is known as an information request to a CRB to obtain your credit report, and your consent is not required for us to do so.

A record of any information request we make may be used by the CRB, and shared with other credit providers, to assess your creditworthiness. This includes being used in the calculation of your credit score or credit rating. In general, more frequent credit enquiries may negatively impact your credit score, depending on how each CRB calculates it.

We use the credit-related personal information that we exchange with CRBs to confirm your identity, assess your creditworthiness, assess your application for credit or your capacity to act as a guarantor, and to manage your credit account with us.

If you fail to meet your repayment obligations or commit a serious credit infringement, we may be entitled to disclose this to a CRB. The CRB may then include that information in reports provided to other credit providers to assist them in assessing your creditworthiness.

You have the right to:

• request access to the credit-related personal information we hold about you;
• request that we correct your credit-related personal information if it is inaccurate, out-of-date, incomplete, irrelevant or misleading; and
• make a complaint if you believe we have mishandled your credit-related personal information.

This policy contains further information about how you may access and correct your information, how to make a complaint, and how we will deal with your complaint.

You can find out more about how we manage your credit-related personal information, including how to access and correct your information and how to make a complaint, by reading this policy, a current version of which is available on our website at householdcapital.com.au/privacy-credit-reporting-policy or by contacting us.

CRBs may use your credit-related personal information for the purpose of pre-screening credit offers on behalf of other credit providers. You have the right to request that a CRB does not use your credit-related information for this purpose.

You may also contact a CRB directly to advise that you believe you have been, or are likely to be, a victim of fraud. If you do so, the CRB must not use or disclose your credit-related information during a 21-day ban period (or longer, if extended).

We are not likely to disclose your credit-related personal information to entities that do not have an Australian link. More information about any overseas disclosures is included in this policy.

You can contact any of the following CRBs for more information or to exercise your rights:

Equifax Pty Limited
https://www.equifax.com.au

illion Australia Pty Limited
https://www.illion.com.au/

We may use or disclose your personal information to inform you about products and services offered by us, our agents, business partners or affiliates that we believe may be of interest to you. These may include updates, newsletters, competitions, promotions, or other opportunities tailored to your financial, lifestyle or related needs.

We may conduct direct marketing via mail, email, telephone, SMS/MMS, or other electronic and non-electronic means. We may also advertise our products and services to you through third-party platforms, including social media channels. When tracking pixels are used to deliver or measure online advertising, you can opt out of targeted advertising through your browser settings or the preference tools offered by the relevant third-party platform.

We will only use or disclose your personal information for direct marketing purposes:

• where you would reasonably expect us to do so; or
• where you have given us your consent; or
• where it is impracticable to obtain your consent, in which case we will ensure a simple and prominent means for you to opt out is included in each communication.

If we collect your personal information from someone else, or you would not reasonably expect us to use your personal information for marketing, we will only do so with your consent or where it is impracticable to obtain it.

Each direct marketing communication we send will include a clear and prominent notice of your right to opt out of further communications, and how to do so easily.

We will not use or disclose your sensitive information (as defined in the Privacy Act) for direct marketing without your express consent.

With your consent, we may also disclose your personal information to third parties such as brokers, agents, or other businesses to connect you with relevant services or opportunities. You can ask us at any time not to disclose your information for this purpose.

Where we use third-party marketing service providers, those providers may combine the personal information we provide to them with information they already hold about you to deliver more relevant marketing messages about our or their services. We do not facilitate third-party marketing beyond these providers acting on our behalf.

If you do not wish to receive marketing communications, you can opt out at any time by:

• calling us on 1300 057 080,
• emailing us at info@householdcapital.com, or
• using the unsubscribe link in marketing emails or other communications where applicable.

We will action your opt-out request free of charge and as soon as reasonably practicable, typically within a few business days.

If you are a prospective customer, we are happy to let you know how we obtained your personal information on request.

It is important to us that the personal information we hold about you is accurate, complete and up-to-date. During the course of our relationship with you, we may ask you to inform us if any of your personal information has changed.

If you wish to make any changes to your personal information, you may contact us. We will generally rely on you to ensure the information we hold about you is accurate or complete.

We will provide you with access to the personal and credit-related personal information we hold about you. You may also request information about any automated decision-making processes that have been applied to your personal information and seek a review or explanation of such decisions, consistent with our privacy obligations. You may request access to any of the personal information we hold about you at any time. We may charge a reasonable fee for our costs of retrieving and supplying the information to you, but we will not charge you for making the request.

Depending on the type of request that you make, we may respond to your request immediately. Otherwise we usually respond to you within seven days of receiving your request. We may need to contact other entities to properly investigate your request.

There may be situations where we are not required to provide you with access to your personal or credit-related personal information – for example, if the information relates to existing or anticipated legal proceedings, if your request is vexatious, or if the information is commercially sensitive. In such cases, we will provide you with a written explanation of the reasons for our decision.

If any of the personal or credit-related personal information we hold about you is incorrect, inaccurate or out-of-date, you may request that we correct the information by telephoning us on 1300 057 080 or by writing to us at info@householdcapital.com.

If appropriate, we will correct the personal information at the time of the request. Otherwise, we will provide an initial response to you within seven days of receiving your request. We will complete our investigation and advise you of the outcome within 30 days, unless you agree to a longer period in writing.

We will take responsibility for managing your correction request, even if the information was provided to us by another organisation. We will liaise directly with relevant third parties, such as CRBs or other finance providers, as necessary, to investigate and resolve your request.

If we refuse to correct personal or credit-related personal information, we will provide you with our reasons for not correcting the information. You may also request that we include a statement with your information that you believe it to be inaccurate, out of date, incomplete, irrelevant or misleading.

Where we correct personal or credit-related information that we have previously disclosed to a CRB or another credit provider, we will also take reasonable steps to notify them of the correction, unless it is impracticable or unlawful to do so.

The security of your personal information is important to us and we take reasonable steps to protect it from misuse, interference and loss, and from unauthorised access, modification or disclosure. Some of the ways we do this are:

• confidentiality requirements of our employees;
• document storage security policies, such as our IT Security Policy;
• security measures for access to our systems;
• only giving access to personal information to a person who is verified to be able to receive that information;
• control of access to our buildings; and
• electronic security systems, such as firewalls and data encryption on our website.

These measures also apply to any AI systems or digital technologies we use to process or analyse personal information, and information collected through cookies, web beacons and tracking pixels.

We have a data breach response plan in place to enable us to contain, assess and respond to suspected data breaches in a timely fashion to help mitigate potential harm to affected individuals. In the event of a serious data breach which notification is required under the Privacy Act, affected individuals and the Office of the Australian Information Commissioner will be notified.

We also regularly review developments in security and encryption technologies. However, it is important to remember that the use of email and the internet may not always be secure, even with these safeguards in place.

If we transfer personal information to another organisation, for example, as described in ‘Transfer of information overseas’ above, or store personal information physically or electronically with third party data storage providers, we will take reasonable steps such as by way of the use of contractual arrangements to ensure those organisations and providers take appropriate measures to protect that information and restrict the uses of that information in accordance with the APPs.

When we no longer require your personal information, and we are legally permitted to, we take reasonable steps to destroy or de-identify the information. However, sometimes it is impossible or impractical to completely isolate the information then completely remove all traces of the information, and we may store the information for future use, such as to help resolve disputes between us or assess future applications by you. The same security safeguards will be in place to protect the information, as detailed in this policy.

In most circumstances, it will be necessary for us to identify you in order to successfully do business with you. However, where it is lawful and practicable to do so, we will offer you the opportunity of doing business with us without providing us with personal information – for example, if you make general inquiries about interest rates or current promotional offers.

If you choose not to provide certain personal information (for example, your date of birth), we may not be able to provide you with the products and services you require, or the level of service we aim to offer.

If you want to know more about the way we manage your personal or credit-related personal information, or you have a complaint about our compliance with the Privacy Act and the CR Code, you may contact us on 1300 057 080.

We will acknowledge your complaint within one business day or as soon as practicable and aim to resolve the complaint as quickly as possible. We will provide you with a decision on your complaint within 30 days.

If you are dissatisfied with the response, you can contact the following external bodies:

Australian Financial Complaints Authority (AFCA)
Mail: GPO Box 3, Melbourne, VIC 3001
Telephone: 1800 931 678 (Monday to Friday 9am – 5pm AEST/AEDT)
Website: www.afca.org.au
Email: info@afca.org.au

Office of the Australian Information Commissioner (OAIC)
Mail: GPO Box 5288, Sydney, NSW 2001
Telephone: 1300 363 992 (Monday to Thursday 10am – 4pm AEST/AEDT)
Website: www.oaic.gov.au

We are constantly reviewing all of our policies and attempt to keep up to date with market expectations. This includes periodically reviewing our use of AI and digital technologies to ensure transparency and compliance with privacy obligations. Technology is constantly changing, as is the law and marketplace practices.

As a consequence, we may change this policy from time to time or as the need arises. We will post any changes to this policy on our website. We will notify you of material changes to this policy via email or your preferred communication method at least 30 days before they take effect.

You may request this policy in an alternative form by telephoning us on 1300 057 080 or by writing to us at info@householdcapital.com.

This policy was last reviewed in September 2026.