CUA Group APP Privacy & Credit information Policy

Transcription

1 For more information: Call Visit Drop into your local branch CUA Group APP Privacy & Credit information Policy 1 August 2015 Credit Union Australia Limited ABN AFSL and Australian credit licence Registered Office: 145 Ann Street, Brisbane QLD 4000 RC00152_REV150803

2 2 The CUA Group is bound by the Privacy Act 1988 (Cth) (Privacy Act) which regulates the handling of personal information about individuals. In particular, the Australian Privacy Principles (APPs) govern the way we collect, use, disclose, store and provide access to your personal information. Within the CUA Group, Credit Union Australia Limited is also bound by Part IIIA of the Privacy Act, which regulates the handling of creditrelated personal information. Our use of your personal information is also regulated under other legislation, such as the Spam Act 2003 (Cth) and in relation to health records, legislation such as Health Records Act 2001 (Vic), Health Records and Information Privacy Act 2002 (NSW), Health Records (Privacy and Access) Act 1997 (ACT). This Policy outlines how we manage your personal information, including credit-related personal information (referred to as information ). It applies to all of your dealings with the CUA Group whether at one of our branches, via our website, through our call centre or with our mobile lending staff. Our staff respect your privacy and are trained to conduct business in accordance with this Policy. 1. What is the CUA Group The CUA Group consists of Credit Union Australia Ltd ( CUA Ltd ) and all of its subsidiary companies. These subsidiary companies are Credicorp Insurance Pty Ltd and CUA Health Limited. CUA Ltd is the only credit provider within the CUA Group. 2. information that we collect 2.1 Personal information Personal information means information or an opinion about an individual whose identity is apparent, or who can reasonably be identified, from the information. Although we try to make sure that all information we hold is accurate, personal information also includes any inaccurate information about the individual (refer to paragraph 8 Access and Correction). When you apply for one of our products or services, we may request personal information about you such as: identifying information, like your name, address and other contact details and your date of birth; information about your financial position, like your income, expenses, savings and assets, the number of dependent children and any other credit arrangements; your employment details; your tax file number and/or Medicare number; and your reasons for applying for a product or service. We may also collect other personal information which is not well known by other people for security purposes, for example, so that we can identify you over the telephone. In addition, where it is necessary to do so, we may collect personal information about you that is sensitive. Sensitive information includes information about your health, and membership of a professional or trade association. Unless we are required or permitted by law to collect that information, we will obtain your consent to do so. 2.2 Credit-related personal information If you apply for a loan, offer to provide us a guarantee, or you are a director or other related person to an applicant or guarantor which is a non-personal entity, we will collect credit information about you. This information includes credit information, credit reporting information, credit eligibility information, regulated information, Credit Reporting Body derived information and Credit Provider derived information. This may include: information about your current or terminated consumer loans; your repayment history; a statement that a credit provider, mortgage insurer or trade insurer has requested information about you from a credit reporting agency; details about the type and amount of a loan for which you applied through a financier, where that financier has requested a credit report about you; personal information contained in a credit report; information about repayments which are at least 60 days overdue under a consumer loan and collection action has started; advice that overdue payments that were previously notified to a credit reporting body are no longer overdue; information about new credit arrangements you may have made with a credit provider to deal with any defaults or serious credit infringements in relation to a consumer loan currently or previously held; information about default judgments relating to credit that you have obtained or applied for; information about you on the National Personal Insolvency Index; publicly available information about your credit worthiness; and an opinion of a financier that you have committed a serious credit infringement of credit provided by that credit provider. 3

3 We may not hold all of these kinds of credit information about you. 2.3 Credit reports Credit reporting bodies collect credit information about individuals which they provide as credit reports to financiers and others in the credit industry to assist them in managing credit risk, collecting debts and other activities. If you apply for a loan with us, offer to provide us a guarantee, or you are a director or other related person to an applicant or guarantor which is a nonpersonal entity, we may obtain a credit report about you which will provide us with information about your credit worthiness or information which will enable us to assess your credit worthiness. Such information may include: information about defaults on loans you have had; advice that payments that were previously notified to a credit reporting body as overdue are no longer overdue; information about new credit arrangements you may have made with a credit provider to deal with any defaults or serious credit infringements in relation to consumer credit currently or previously held; and information about court judgments which relate to credit that you have obtained or applied for. We may refuse a loan application made by you individually or with other applicants. Our refusal may be based on credit eligibility information obtained from credit reporting bodies about you, another applicant or another person proposed as guarantor. In that case, and if the application is for a consumer credit loan, we will give you written notice that the application has been refused on the basis of that information. The name and contact details of the credit reporting body we use are set out below. You can ask a credit reporting body, through contact details on their website, not to use or disclose your personal information if you believe on reasonable grounds that you have been or are likely to be a victim of fraud, including identity fraud. The credit reporting bodies with which we exchange credit information are: Dun & Bradstreet Ph: E: pac.austral@dnb.com.au Experian PO Box 1969, North Sydney NSW 2060 Ph: E: creditreport@au.experian.com Veda 100 Arthur St, North Sydney NSW 2060 Ph: You can obtain information on how each of these bodies handles your personal information by visiting their websites. 3. How we collect information Wherever possible, we will collect information directly from you. This information will generally come from what you provide when you apply for CUA membership or a new product through the CUA Group. However, in some circumstances, we may also collect information about you from third parties. These third parties include: joint account or policy holders; referees nominated by you; your employer(s); your agents, representatives and other people authorised by you such as your lawyers and accountants; insurance brokers and our third party distributors; (in relation to loans) other credit providers and credit reporting bodies; (in relation to financial planning services) your superannuation fund(s) and entities that manage your investments; and (in relation to health insurance) another health insurance provider, hospitals and other health service providers and organisations which manage the transfer of information between health service providers and us. If you provide us with personal information about another person (for example a referee, a joint account or policy holder or an account signatory), you must ensure that you are authorised to do so. You must also inform that person of who CUA is, that CUA will use and disclose their personal information in accordance with this policy, and that they can gain access to that information in accordance with this policy. 4 5

4 6 Some information is created through our internal processes, like credit eligibility scoring information. We may also collect available information from a variety of external sources, including through data and analytics service providers. We may use this data to gain insights which can be used for the purposes set out in section 4. information collected by a company within the CUA Group may be shared with other companies within the CUA Group. 4. Why we collect information We only collect information that is necessary for us to provide you with the products and services you request, and to maintain our relationship with you. We are also required by law to collect certain personal information from you. These laws include anti-money laundering legislation, the Corporations Act 2001 (Cth) and the National Consumer Credit Protection Act 2009 (Cth). If you do not provide us with the information that we request, there may be times when we are unable to provide you with membership or a product or service. At the time we collect information from you, we will tell you why we are collecting that information. These generally include: assessing and processing your application for the products and services we offer establishing and providing our systems and processes to provide our products and services to you executing your instructions charging and billing uses required or authorised by law maintaining and developing our business systems and infrastructure research and development (where you apply for a loan or offer to give us a guarantee) assessing your credit worthiness, helping you avoid defaulting on your credit obligations and notifying you of any defaults; collecting overdue payments due under our credit products, or managing our rights and obligations regarding external payment systems. We may also use your information so that we can provide you with information about other products and services which is offered by us including products which we distribute on behalf of other organisations (refer to paragraph 9 Marketing). You can tell us at any time if you do not wish to receive information about other products and services. If you start an online application form but do not submit it or you submit an application (whether electronically or otherwise) but do not proceed with the application, we may use your information to contact you regarding your application. We may also use it for research purposes but only after the information has been de-identified. 5. How we store your information We may hold your information in many ways including in physical documents as well as in electronic form. The security of your information is important to us and we take reasonable steps to protect it from misuse and loss, as well as unauthorised access, modification or disclosure. We do this in a number of ways, including: training our employees about our privacy obligations implementing document storage security policies and security measures for systems access allowing access to information only where the individual seeking access has satisfied our identification requirements implementing access control for our buildings taking reasonable steps to destroy or de-identify personal information when we no longer require the information, or we are no longer required by law to retain that information. Where we have issued you with passwords, personal identification numbers safe or any other access code, we request that you keep these secure in accordance with our suggestions. 6. Disclosure We may disclose your information to other organisations, for example: external organisations that are our assignees, agents or contractors our external service providers, such as organisations which we use to verify your identity, payment systems operators, mailing houses, printing service providers, information technology service providers (including core banking systems support), debit card suppliers and research consultants insurers and re-insurers, where insurance is provided in connection with our services to you superannuation funds, where superannuation services are provided to you other financial institutions, for example, when you apply for a loan from another credit provider credit reporting bodies, including disclosing that you are in default under a credit agreement or commit a serious credit infringement, if that is the case 7

5 lenders mortgage insurers, where relevant to credit we have provided debt collecting agencies, if you have not repaid a loan as required our professional advisors, such as accountants, lawyers and auditors state or territory authorities that give assistance to facilitate the provision of home loans to individuals certain entities that have bought or otherwise obtained an interest in your credit product, or that are considering doing so, and their professional advisors including for securitisation purposes your representative, for example, lawyer, mortgage broker, financial advisor or attorney, as authorised by you, your health service providers including your doctor or hospital, if health insurance is provided to you, courts and external dispute resolution schemes, or government and regulatory authorities including taxation authorities, the police, or AUSTRAC where required or authorised by law. We take all reasonable steps to ensure that our suppliers are reputable organisations and, where appropriate, are bound by written agreements to abide by the confidentiality and non-disclosure requirements of CUA. If you hold health insurance, when you are admitted to hospital or attend other health care facilities, personal information which assists in the processing of your claim is provided to us by the hospital or facility. Our agent, Australian Health Service Alliance Ltd ( AHSA ) manages the transfer of this information. You should visit the AHSA website at for complete details about how they comply with the Privacy Act. The CUA Group also distributes third party products. For example, Citigroup Pty Ltd is the issuer of the CUA credit cards and Allianz Australia Insurance Ltd is the issuer of the general insurance products which we distribute. Those entities will have their own policies regarding the way in which they handle information that they hold about you, available from their websites. The CUA Group may disclose your information to entities outside of Australia. These countries include India and United States of America. In addition, where we distribute third party products, those third parties may disclose your information to overseas recipients or entities that do not have an Australian link. You should refer to their privacy policy for further information about how they handle your information. 7. Website This section explains how we handle information collected from our website. If you have any questions or concerns about transmitting your personal information via the internet, please contact your local branch or call us on , as there are other ways for you to provide us with your personal information. Visiting our website Anytime you access an unsecured part of our website, that is, a public page that does not require you to log on, we will collect information about your visit, such as: the time and date of the visit any information or documentation that you download your browser type, and internet protocol details of the device used to access the site. Our website also includes a number of calculators, which may require you to enter your personal details. If you save the data you enter on the calculator, this information will be stored. Cookies A cookie is a small text file which is placed on your internet browser and which we may access each time you visit our website. When you visit the secured pages of our website (ie pages that you have to provide login details to access) we use cookies for security and personalisation purposes. When you visit the unsecured pages of our website (ie public pages that you can access without providing login details) we use cookies to obtain information about how our website is being used. You may change the settings on your browser to reject cookies, however doing so might prevent you from accessing the secured pages of our website. When we receive s, we will retain the content of the and our response to you where we consider it necessary to do so. Your address will only be used or disclosed for the purpose for which is was provided. It will not be added to any mailing lists or used for any other purpose without your consent. Security We use up-to-date security measures on our website to protect your personal information and your credit information. Any data containing personal, credit or related information which we transmit via the internet is encrypted. However, we cannot guarantee that any information transmitted via the internet by us, or yourself, is entirely secure. You use our website at your own risk. 8 9

6 Links on our website Our website may contain links to third party websites. This Policy does not apply to external websites. If you wish to find out how third parties handle your personal information or credit information, you will need to obtain a copy of their privacy policy. Online banking We use the Secure Sockets Layer (SSL) protocol to safeguard your information during online transactions. We have also included time-out periods in our online banking program to protect you if you forget to logout. Your information is most secure when you: Observe our security requirements for personal identification numbers (PINs) or passwords; Login to online banking directly through our website or your own bookmark, not via s or other links; Logout after every session on online banking. Our server will run detection software to help ensure that you are using a secure browser and your information is secure. If our software determines that you are not using a secure browser, a warning message will appear. You should only use a secure browser to access online banking. 8. Access and correction of information In general, you may request access to information that we hold about you at any time by calling us on or visiting your local branch. We will respond to your request for access within a reasonable time. If we refuse to give you access to any of your personal information, we will provide you with reasons for the refusal and the relevant provisions of the Privacy Act that we rely on to refuse access. You can contact our Privacy Dispute Officer whose details are at paragraph 12 below if you would like to challenge our decision to refuse access. We may recover the reasonable costs of our response to a request for access to personal information. We take reasonable steps to make sure that the information that we collect, use or disclose is accurate, complete and up-to-date. However, if you believe your information is incorrect, incomplete or not current, you can request that we update this information by calling us on or visiting your local branch. If your request for correction relates to credit-related information, it may be necessary for us to consult with a credit reporting body or another credit provider in order to deal with your request to correct your information. 9. Marketing We may use your information, including your contact details, to provide you with information about products and services, including those of third parties, which we consider may be of interest to you. You may opt out at any time if you no longer wish to receive marketing information or do not wish to receive marketing information through a particular channel, like . In order to do so, you will need to request that we no longer send marketing materials to you or disclose your information to other organisations for marketing purposes. You can make this request by calling us on or visiting your local branch, or by unsubscribing from our marketing messages, which always include an unsubscribe option. To help us reach the right people with our credit-related direct marketing, we may ask a credit reporting body to pre-screen a list of potential recipients of our direct marketing against our eligibility criteria to remove recipients that do not meet those criteria. The credit reporting body cannot use information about your existing loans or repayment history in carrying out its pre-screening and it must destroy its pre-screening assessment once it has given us, or a contractor acting on our behalf, the list of eligible recipients. If you do not want your credit information used for pre-screening by a credit reporting body that holds credit information about you, you can opt out by informing that credit reporting body. Please refer to paragraph Credit reports for details of the credit reporting bodies we use. 10. Dealing with us anonymously or under an alias We are generally required by law to know who you are and to have properly identified you in order to provide you with our products and services. However, you may deal with us anonymously or under an alias in some cases. For example, you can make general enquiries about the features and benefits of our products, or our interest rates without telling us who you are. You may also be able to lodge a complaint without telling us who you are, however, this may limit our ability to investigate your complaint and offer a resolution. 11. Changes to this Policy We may from time to time (without notice to you) make changes to this Policy that are necessary for our business requirements or to comply with the law. You can obtain a current copy of this Policy through our website at or by visiting your local branch

7 12. Questions and complaints If you have any questions, concerns or complaints about this Policy, or our handling of your information, we encourage you to contact us at: Privacy Dispute Officer GPO Box 100, Brisbane QLD 4001 Ph: If you are unhappy with the response you receive from the Privacy Dispute Officer, you can ask us to escalate your matter to our Privacy Officer for review. If you are still not satisfied, there are a number of external bodies which you can contact about privacy complaints. The appropriate external body will depend on the CUA Group company to which your complaint relates: Financial Ombudsman Service (FOS) Private Health Insurance Ombudsman (PHIO) Office of the Australian information Commissioner Credit Union Australia Ltd Credicorp Insurance Pty Ltd CUA Health Ltd Please note that FOS may forward your complaint to the OAIC if it considers that the complaint would be better handled by the OAIC. Financial Ombudsman Service (FOS) GPO Box 3, Melbourne VIC 3001 Ph: Private Health Insurance Ombudsman (PHIO) Suite 2, Level 22, 580 George St, Sydney NSW, 2000 Ph: Fax: info@phio.org.au Office of the Australian information Commissioner GPO Box 5218 Sydney NSW 2001 Ph: