This is the credit reporting policy of:

OneTwo Finance Pty Ltd (ABN 20 637 329 321) Australian Credit Licence 527230 (OneTwo), and
OneTwo Fund 1 Pty Ltd (ABN 24 646 334 983) as trustee for the OneTwo Fund 1 Bare Trust (ABN 16 855 753 665) (OneTwo Trustee).

OneTwo Trustee is the credit provider for credit which is promoted, arranged, and managed by OneTwo. In this document, we, our, or us refers to both OneTwo and OneTwo Trustee, unless the context requires otherwise.

This document sets out how we manage your credit-related personal information (which includes credit information and credit eligibility information). It should be read in conjunction with our Privacy Policy and our Credit Reporting Statement of Notifiable Matters.

At OneTwo, we take privacy seriously. We are committed to safeguarding the credit- related personal information that is entrusted to us. If you have any queries or concerns about how we manage your credit-related personal information, please contact us at privacy@onetwo.com.au.

Certain words and phrases used in this document have the same meaning as in the Privacy Act 1988 (Cth) and the Privacy (Credit Reporting) Code 2014 (together, Credit Reporting Laws). To help you understand this document, we have summarised the meaning of some of the key terms used:

Credit information: means personal information (other than sensitive information) about an individual that is:

identification information
consumer credit liability information
repayment history information
information about credit applications with which you are associated
default information
payment information
new arrangement information
court proceedings information
personal insolvency information
certain publicly available information, and
an opinion that a serious credit infringement has been committed.

Credit eligibility information: means credit information, and information derived from it, about an individual that is disclosed to us by a credit reporting body or that we derive from information disclosed to us by a credit reporting body and which has a bearing on the individual’s credit worthiness and is used to establish eligibility for consumer credit.

Credit-related personal information: includes credit information and credit eligibility information.

When you apply to us for credit, we will collect the following types of information about you from you or a person who is assisting you to apply for the credit (such as your spouse or a mortgage broker):

your name and contact details
your date of birth
information about your financial position such as your income, expenses, assets, and liabilities, and
your employment details.

We also collect credit-related personal information from third parties, such as:

a copy of your credit file (credit eligibility information) from a credit reporting body
information about your existing liabilities from other financial institutions and credit providers, and
your employment or business details from your employer or accountant.

5. The purposes for which we collect, hold, use and disclose your credit-related personal information

We collect, hold, use and disclose your credit information and credit eligibility information for the following purposes:

assessing your application or your suitability to act as a guarantor
helping you avoid defaulting on your credit obligations
managing credit that has been provided to you, and
meeting our obligations under applicable laws, regulations, codes of practice and payment systems rules.

In some cases, your credit-related personal information may be shared with other organisations, including the following:

service providers, for the purpose of providing services to us (including in relation to document verification services and to facilitate our compliance with our statutory obligations, such as our obligations in relation to anti-money laundering laws)
credit reporting bodies (including in respect of identification verification)
other credit providers
a person who has acted, or will act, as your guarantor
debt collection agencies
any person in connection with a new or proposed mortgage
mortgage insurers, and
enforcement bodies (as defined in the Privacy Act 1988 (Cth)).

We may disclose your information to other companies within the OneTwo group of companies (OneTwo Group) and contracted third parties to the OneTwo Group, so that they can perform services for us to enable or assist us in providing our products or services to you.

If you fail to meet your payment obligations in relation to consumer credit or commit a serious credit infringement, we may be entitled to disclose this to a credit reporting body. Credit reporting bodies may include the information we give to them about you in reports they provide to credit providers to assist them to assess your credit worthiness. The credit reporting bodies that we deal with, and are likely to disclose your credit- related personal information to, are:

Equifax Australia Information Services and Solutions Pty Limited (Equifax), and
Experian Australia Credit Services Pty Ltd (Experian).

Equifax
PO Box 964
North Sydney NSW 2059
Phone: 13 83 32
customerserviceAU@equifax.com
www.mycreditfile.com.au

Experian
PO Box 1969 North Sydney NSW 2060
Phone: 1300 784 134
creditreport@au.experian.com
www.experian.com.au/credit-bureau

You can obtain a copy of the credit reporting body’s policy about credit-related personal information from its website or by contacting it using the details set out above.

You may also request that a credit reporting body not use your credit information:

for the purposes of pre-screening of direct marketing by credit providers, or
if you believe on reasonable grounds that you have been, or are likely to be, a victim of fraud.

In some cases, we may need to disclose your credit-related personal information to organisations outside Australia, for example, if we use service providers located overseas to perform a function on our behalf.

If we share your information with overseas organisations, we will ensure that appropriate data-handling and security measures are in place. Except as disclosed below, we do not disclose any credit-related personal information to any recipient located outside Australia.

We may utilise the services of a third party to verify your identity using the Document Verification Service (DVS) to confirm that the personal information you provide to us in your identity documents as evidence of your identity match the information held by the agency which issued that document (also known as the ‘official record holder’). The use of the Document Verification Service (DVS) may involve processing of information in New Zealand.

We may also utilise the services of a third party (ComplyAdvantage) to ensure compliance with our anti-money laundering obligations. The use of such services may involve the processing of information in the United Kingdom and in the European Union.

Please note that we may store, process or back up credit-related personal information on servers (including servers offered through third-party service providers under contract to us) that are located in a jurisdiction outside Australia.

If you communicate with us via email, through a social network service or through some other electronic process, the communication may be routed through servers that are located outside Australia and, in relation to a message sent through a social network service (such as Twitter or Facebook), the social network provider and its partners may collect, hold, and process personal information in a jurisdiction outside Australia.

We will provide you with access to your credit-related personal information within a reasonable period following our receipt of your request unless a statutory exception applies. The exceptions include:

where the giving of access would be unlawful
if the denial of access is required or authorised by or under an Australian law or a court/tribunal order, or
if giving access would be likely to prejudice one or more enforcement-related activities conducted by, or on behalf of, an “enforcement body” (as that term is defined in the Privacy Act 1988 (Cth)). If we refuse to give access to the credit-related personal information held about you for any of the statutory reasons, we will give you a written notice that sets out the reason(s) for refusal (except to the extent that, having regard to the grounds for refusal, it would be unreasonable for us to do so) and state that, if you are not satisfied with the response to the request, you may access a recognised external dispute resolution scheme of which we are a member or to which we are subject, or to make a complaint to the Office of the Australian Information Commissioner (OAIC) (for details, see below).

Please note that we reserve the right to verify your identity before granting you access to your credit-related personal information, including your credit eligibility information.

To facilitate our timely response to your request for access to the credit-related personal information we hold about you, we request that you contact us using the details set out below (see section 13 – “Contact us”).

We will give access to credit-related personal information in the manner you request, provided that it is reasonable and practicable to do so.

If we give you access to the credit eligibility information that we hold about you, the access must be given in the manner set out in the Credit Reporting Laws. We will take reasonable steps to provide an accessible means for you to obtain access to credit eligibility information we hold about you and we will endeavour to provide access within 30 days of your request (unless unusual circumstances apply). We will present the information clearly and accessibly and provide reasonable explanations and summaries of the information to assist you to understand the impact of the information on your credit worthiness. We will advise you that, in order to ensure that you have access to the most up-to-date information, you should additionally request access to the credit reporting information held by credit reporting bodies about you. We will not impose a charge on you for the making of the request to access credit- related personal information (including credit eligibility information) that we hold about you. However, we may impose a charge for giving access to requested credit-related personal information to cover the reasonable costs we incur in processing your access request. Please note that we reserve the right (to the maximum extent permitted by law) to redact information included in the credit-related personal information we hold about you, in order to protect the privacy of other individuals.

We will take reasonable steps to correct credit-related personal information that we hold, and to ensure that such information is accurate, up-to-date, complete, relevant, and not misleading, having regard to the purpose for which it is held. This includes a situation where we are satisfied (independent of any request) that credit-related personal information we hold is incorrect, and a situation where you request that we correct credit-related personal information held about you. If you believe that any of the credit-related personal information we hold about you is not accurate, complete, or up-to-date, or is irrelevant or misleading, we will take reasonable steps to correct the information. If we have disclosed inaccurate, incomplete, out-of-date, irrelevant, or misleading information to a third party, we will (within a reasonable period) give each recipient of the information written notice of the correct, unless it is impracticable for us to give such notice or we are required by or under an Australian law, or a court/tribunal order, not to give the notice.

If we do not correct the personal information on your request, we will give written notice to you, including the reasons for our refusal to correct the personal information held about you and the complaint mechanisms available to you. If we refuse your request, you may request that we take reasonable steps to associate a statement with the personal information that you believe to be inaccurate, out-of-date, incomplete, irrelevant, or misleading.

If we form a view that we will not be able to resolve your correction request within the period required by the Credit Reporting Laws (e.g., within the required 30-day period), we will (as soon as practicable) notify you of the delay, the reason(s) for this and the expected timeframe to resolve the matter, seek your agreement to an extension for a period that is reasonable in the circumstances, and advise you that you may complain to a recognised external dispute resolution scheme of which we are a member (and provide the contact details for that scheme) or, in the case we are not a member of one at the relevant time, to the Commissioner and, if you have not agreed to the requested extension, provide a response to the correction request within the timeframe sought for extension.

When correcting credit-related personal information, if we receive a correction request, we will determine whether the credit-related personal information needs to be corrected as soon as practicable. If we are satisfied that the credit-related personal information needs to be corrected, we will correct the credit-related personal information within five (5) business days of determining the correction should occur, take reasonable steps to ensure that any future derived information is based on the corrected information, and take reasonable steps to ensure that any derived information that is based on the uncorrected information is not disclosed or used for the purpose of assessing your credit worthiness. We will notify you of a decision about a correction request you make of us within five (5) business days of the decision. If we decide to correct the information, such notification will:

include all relevant credit eligibility information we hold so that you can check that the information has been appropriately corrected
explain that you have a right under the Credit Reporting Laws to obtain your credit reporting information from a credit reporting body free of charge if the access request relates to a decision by us to correct information about you (and how that right may be exercised)
explain what credit reporting bodies, other credit providers and other interested parties we are intending to notify to fulfil our notification obligation under the Credit Reporting Laws, and
ask you if there is any other credit provider or interested party that you would like us to notify of the correction.

We will not charge you for making a request to correct personal information we hold about you, or a request to associate a statement, or for making a correction or associating a statement.

We have measures in place to protect the credit-related personal information we hold about you from misuse and loss, and from unauthorised access, modification, or disclosure. These measures include:

implementing physical security
maintaining computer and network security (including firewalls and passwords to control access), and
maintaining and monitoring our online security systems.

Our employees and authorised agents are obliged to respect the confidentiality of any credit-related personal information held by us.

We may store your personal information on third-party data storage providers. As at the date of this document, we use the cloud infrastructure platform Amazon Web Services (AWS), a service provided by Amazon Web Services Inc.

We will ensure that appropriate data-handling and security measures are in place with third-party data storage providers.

We may review the information contained in this document from time to time. We will notify you of any changes by publishing an updated version of our policy on our website.

If you wish to raise a concern or make a complaint about our handling of your credit- related personal information or you believe that we are in breach of our obligations under any of the Credit Reporting Laws by us, you may do so by contacting us. If you make a complaint, we will:

acknowledge receipt of your complaint within seven (7) days after the complaint is made
set out how we intend to deal with the complaint when acknowledging receipt of your complaint
promptly investigate the complaint
give you the details of the person handling your complaint so that you can follow up if you wish to do so
work with you to try and resolve your complaint as soon as possible
keep you informed of our progress, and
provide you with our final response to your complaint within a reasonable period following our receipt of your complaint (usually, within 30 days of our receipt of your complaint). Our response will set out our decision in relation to your complaint and will state that, if you are not satisfied with our decision, you may access a recognised external dispute resolution scheme of which we are a member or, if we are not a member of a scheme at the relevant time, to the OAIC (for details, see below).

We will try to resolve your complaint within 30 days of our receipt of your complaint. If your complaint is particularly complex and therefore more time is required, prior to the expiry of the initial 30-day period, we will advise you of the expected resolution date (including the reasons for the delay), the expected timeframe to resolve the complaint and to seek your agreement for an extension of time that is reasonable in the circumstances. We will also advise that you may complain to the recognised external dispute resolution scheme of which we are a member or to the OAIC if we are not a member of a scheme at the relevant time (for details, see below).

We reserve the right to verify your identity before dealing with your complaint.

If you are not satisfied with our response or the way we’ve handled your complaint, you can lodge a complaint with:

the Australian Financial Complaints Authority (AFCA), an independent financial services dispute resolution provider who can consider complaints involving credit, finance, or loan products from financial services providers, or
the OAIC.

AFCA GPO Box 3
Melbourne VIC 3001
Phone: 1800 931 678
Email: info@afca.org.au
www.afca.org.au

OAIC
GPO Box 5218
Sydney NSW 2001
Phone: 1300 363 992
Email: enquiries@oaic.gov.au
www.oaic.gov.au

You can find more information about the Credit Reporting Laws at the Office of the Australian Information Commissioner’s website: www.oaic.gov.au/privacy/credit-reporting/

Email: privacy@onetwo.com.au

Post:
Attn: Privacy Officer
OneTwo Finance Pty Ltd
Level 6/454 Collins St
Melbourne VIC 3000

Credit reporting

Credit Reporting Policy

Credit Reporting Statement of Notifiable Matters