This privacy policy sets out the policies of Home Ownership Company® Pty Ltd and our related entities in relation to our management of personal information. It explains:

• Our commitment to privacy,
• The purposes for which we collect personal information,
• The kinds of information we collect,
• How and when we collect personal information,
• How we may use personal information,
• Our approach to direct marketing,
• How we may contract out some services that involve disclosing personal information,
• Our approach to direct marketing,
• How we may contract out some services that involve disclosing personal information,
• How we keep personal information secure,
• Individuals' access and correction rights, and
• How complaints are to be dealt with.

Words and phrases that are defined in the Privacy Act 1988 have the same meaning in this policy.

Our commitment to privacy

We understand the importance of protecting each individual's right to privacy particularly that of our customers. We commit ourselves to compliance with, the provisions relating to privacy and to the collection, use and disclosure of personal information set out in:

• The Privacy Act 1988;
• The National Privacy Principles set out in Schedule 3 to that Act; and
• The Guidelines published by the Privacy Commissioner in relation to the application of those Principles.

The purposes for which we will collect personal information about individuals

We will not collect personal information unless it is necessary for one or more of the following functions or activities:

• To provide people who enquire about the services we supply with the information they require;
• To supply services (immediately or in the future) and to conduct our business;
• To assist customers to apply for loans and other financial products and to acquire related services, such as insurance, if they want us to;
• To comply with our legal obligations in relation to the supply of our services;
• To help us plan and to develop our services for the benefit of customers and for our own administrative, marketing and planning requirements; or
• To give customers information about products and services available from us and other organisations that we think may be of interest to them.

The kinds of information we collect

The kind of information we will collect from or about an individual will depend upon the purposes for which it is collected.

When an individual requests information we may collect the information necessary to identify and contact the individual. This will include the individual's name, address and other contact details. We will allow an individual to obtain such information anonymously whenever that is practicable and the individual wishes to do so.

When a customer offers to purchase a product or service we will only collect the information we consider is or may be necessary to enable us to provide the product or service, and to provide similar future services or products.

We may collect details of one or more relatives or friends of the customer to assist us in contacting the customer if the customer defaults or needs to be contacted and we have no current contact details.

How and when will we collect personal information

We will collect the personal information we need about an individual directly from that individual whenever it is reasonable and practicable to do so. We may do so when:

• an individual contacts us to enquire about our products and services, although whenever it is lawful and practicable to do so we will give the individual the option of remaining anonymous;
• in the course of supplying our services including assisting our customers to apply for loans and in providing coaching and budgeting advice to our customers;
• a customer contacts us in relation to products or services we have supplied to the customer.

If a customer has defaulted in paying us or we need to contact the customer, we have made reasonable and unsuccessful attempts to contact the customer using the customer's last known contact details, and there are reasonable grounds to believe that the customer has moved without notifying us of the customer's new contact details, we may contact relatives or friends of the customer to ascertain the customer's current contact details, or we may retain an enquiry agent to attempt to locate the customer.

If a customer asks us to destroy information at the conclusion of our current service then we shall do so promptly and securely.

Our approach to direct marketing

We will inform customers that we may use personal information about them to send them communications about products and services that we think may be of interest to them and that are available from us and from other businesses. We will give them the option to advise us that they do not wish to receive such communications, and we will advise them that their consent to us using their personal information for this purpose will be implied if they do not notify us that they do not consent.

In all our direct marketing communications to customers we will tell them that they can opt out of receiving any more direct marketing communications. We will not send any direct marketing communications to a customer who has notified us that the customer does not wish to receive such communications.

Contracting out services that involve disclosing personal information

We may give some personal information about customers to other organisations who provide services that assist us in supplying to customers the products and services they require, or who provide related products or services that customers require. Examples of such organisations are our related entities, contractors (including consultants and coaches), mortgage consolidators, banks and other financial institutions, mailing houses, insurers, credit providers, legal advisors, collection agents and conveyancers.

If a customer fails to pay us or is in dispute with us then we may supply personal information to our collection agents and lawyers.

We will only supply to such other parties the personal information that is necessary for them to supply the relevant service; and

• We shall not authorise them to use the information for any purpose other than to provide the service;
• We shall take measures to ensure that as far as practical they keep the information secure, do not use it for unauthorised purposes and as to the destruction or return of information at the appropriate time.

Keeping personal information secure

Access to personal information held by us in physical or electronic form is restricted to our authorised officers.

An officer will only have the level of access rights necessary to enable the officer to perform the officer's legitimate functions, and may only access personal information held by us when it is necessary for the officer to do so to perform such a function.

A contractor may only have access to such information as is necessary for them to provide their products or services as authorised by us.

When we provide information on our customers to third parties (including our contractors) we shall take all reasonable steps to require the recipient to respect the confidentiality of that information to the extent that is practical and appropriate in the circumstances. Strict protocols shall be observed to protect information from unauthorised access or use including as to the physical security of files and password protection of electronic data.

We will respect that information provided to us by a couple (or any other group) is personal to each of them and shall not (except as is necessary to provide the current services or as expressly or impliedly approved by them) disclose information about one individual to another.

Access and correction rights

We will, upon request being made in a form acceptable to us, provide an individual with access to the personal information we hold about the individual, except to the extent that:

• providing access would pose a serious and imminent threat to the life or health of any individual; or
• providing access would have an unreasonable impact upon the privacy of other individuals; or
• the request for access is frivolous or vexatious; or
• the information relates to existing or anticipated legal proceedings between us and the customer, and the information would not be accessible by the process of discovery in those proceedings; or
• providing access would be unlawful; or
• denying access is required or authorised by or under law; or
• providing access would be likely to prejudice an investigation of possible unlawful activity; or
• providing access would be likely to prejudice:
  1. the prevention, detection, investigation, prosecution or punishment of criminal offences, breaches of a law imposing a penalty or sanction or breaches of a prescribed law, or
  2. the enforcement of laws relating to the confiscation of the proceeds of crime, or
  3. the protection of the public revenue, or
  4. or the prevent, detection, investigation or remedying of seriously improper conduct or prescribed conduct, or
  5. the preparation for, or conduct of, proceedings before any court or tribunal, or implementation of its orders,
  by or on behalf of an enforcement body, or
• an enforcement body performing a lawful security function asks us not to provide access to the information on the basis that providing access would be likely to cause damage to the security of Australia.

An individual's request for access to personal information must be made in writing to our Privacy Officer. It must identify the individual and, with reasonable particularity, the information required. We may require the application to be made using a form supplied by us for that purpose, and we may require evidence of identity to be produced before access is provided.

We may charge individuals reasonable fees, which we will set from time to time, for supplying them with access to their personal information.

We will respond to an individual's request for access as soon as is reasonably practicable, taking into account the age, nature and amount of information requested:

If we are not required to provide an individual with access to the individual's personal information,, we will:

• if reasonable, consider whether the use of a mutually agreed intermediary is appropriate; and
• advise the individual of the reasons for denial of access.

If an individual claims that personal information we hold about the individual is not accurate, complete, or up to date, then: if our Privacy Officer is satisfied that the personal information is not accurate, complete, or up to date, we will correct, complete or update it to the extent that it is reasonably practicable to do so; or if our Privacy Officer is not satisfied that the personal information is not accurate, complete, or up to date, we will, if it is reasonably practicable to do so, include with the information a statement drawing attention to the individual's claim.

We shall update our records of our customer's personal information as quickly as practicable upon becoming aware of any changes.

Complaints

Any complaint made to us, or to an officer or employee other than the Privacy Officer, that is related to privacy or to our use of personal information, is to be referred forthwith to the Privacy Officer.

Any customer dissatisfied with the handling of a complaint by the Privacy Officer may make a written request to our Managing Director to have the handling of the complaint reviewed.