Privacy Policy.

2. What personal information do we collect?

In this Privacy Policy, the term ‘personal information’ has the meaning given to it in the Privacy Act. In essence, personal information is information or an opinion about an identified, or reasonably identifiable, individual.

One kind of personal information that we regularly collect is credit information, being credit-related personal information lawfully created and accessible within the Australian credit reporting system. This can include information about our customers’ credit worthiness, details of any finance they have available, history in repaying credit, credit standing, credit capacity and other information that credit providers use to assess eligibility.

We use credit information to assess our customers’ eligibility for the credit products that we make available. Section 7 of this Privacy Policy contains further information about credit information.

In addition, before we can provide our customers with financial products or services, the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) (AML/CTF Act) requires us to collect personal information about our customers in order to verify their identity. This information may also be provided to a credit reporting body for verification, or to third parties.

for the purposes of fraud prevention, Anti-Money Laundering and Counter-Terrorism Financing checks as required by law and identify verification. Section 8 of this Privacy Policy contains further information about the collection and verification of identification information.

The other types of personal information we collect about you will depend on the nature of your dealings with us, and what you choose to share with us. Such information may include:

• your name, previous name, date of birth, contact details, home address, email address, e-signature and occupation;
• identification documents, such as copies of your passport, driver’s licence, birth certificate or extract, citizenship certificate or evidence of permanent residence, marriage certificate, Medicare card or trust deeds;
• answers you provide to questions we ask and other information in relation to your dealings with Oxbury;
• your financial details such as bank account details, credit card details and GST numbers;
• your organisational affiliations, financial information, property details, payment or billing details, historical and current account information;
• when you use our website or mobile apps, website usage information such as the IP address you are using, the name of your internet service provider, your browser version, the web site that referred you to us and the next website you go to, the pages you request, the date and time of those requests and the country you are in; and
• if you are applying for employment with us, your employment history and other information you may provide to us as part of the recruitment process, including your qualifications, background checks (including where necessary, visa checks, driver licence checks, fit to work medical checks, reference checks and police checks) as well as sensitive information relevant to the recruitment process or where you have consented to such collection including criminal record information and/or health information where relevant to our assessment of whether you are able to perform the inherent requirements of the particular role.

In addition to the types of personal information identified above, we may collect other types of personal information where required for our functions and activities and as otherwise permitted or required by law.

We generally do not collect sensitive information (other than during the recruitment process, if you are a prospective employee) unless required by applicable laws.

We will only collect, hold, use or disclose government generated identifiers (for example, your tax file number) in circumstances where we are legally permitted or obliged to do so.

3. Collection of Personal Information

We collect personal information in a number of ways. The most common ways we collect your personal information are:

• directly from you through, for example, your use of our website, or your completion of online or manual forms, or when you otherwise engage with us online (including through our social media pages, via instant messaging and in public comments) or through an interaction or exchange you have with us in person or by way of telephone, email or post;
• if you are a prospective employee, contractor or consultant seeking employment or engagement with us, from your current employer or principal, recruitment agency, any referees you provide and any background screening services provider we engage;
• from our own records about you, or from records about you held by other members of the Oxbury group;
• from credit reporting agencies;
• from other third parties;
• from publicly available sources; and
• from any authorised persons as specified, and consented to, in your Privacy Declaration.

Generally, we only collect your personal information from sources other than you if it is unreasonable or impracticable to collect your personal information directly from you.

4. Links, cookies, and use of Oxbury website and mobile apps

Oxbury websites may contain links to other sites. This Privacy Policy applies to our websites and not any linked sites which are not operated or controlled by Oxbury. We encourage you to read the privacy policy of each website that collects your personal information.

Oxbury uses ‘cookies’ and related technologies on its website and in other technology applications. A ‘cookie’ is a packet of information placed on a user’s computer by a website which is used for record keeping.

The use of cookies and related technologies is an industry standard and helps us monitor the effectiveness of our advertising and how visitors use our website and mobile apps. We use such technologies to generate statistics, measure your website activity, improve the usefulness of our website and mobile apps, and to enhance our ‘customer’ experience.

The information we collect from your general use of our website does not identify you. It is general data regarding the number of visitors/users of our website and statistics regarding their usage.

However, where you access functions of our website that require you to verify your identity by entering your log-on credentials (which may include your name and email address) and/or a password the cookie links your browsing session with your user account, allowing the server to recognise you as you navigate between secure pages. Consequently, any activity you perform, data you enter or actions you take while logged in can be directly associated with the personal information stored in your account profile. Any data collected which is linked to your secure account will be treated as personal information and handled in accordance with this Privacy Policy and our obligations under the Privacy Act.

You can configure your browser to accept or reject cookies or notify you when cookies are sent. If you disable the use of cookies on your web browser or reject cookies from our website, then our website may not function properly or optimally.

5. Why do we collect, use, hold and disclose your personal information?

The purposes for which we use, hold and disclose your personal information will depend on the circumstances in which we collect it. Whenever practicable, we endeavour to inform you at the time we collect your personal information as to why we are collecting your personal information, how we intend to use your personal information and to whom we intend to disclose it.

Generally, we collect, use, hold and disclose your personal information so that we can do business together and for purposes related to our business operations.

Some of the specific purposes for which we collect, use, hold and disclose personal information include to:

• respond to you if you have requested information about our products and services (including via our websites, social media pages or via an email or other correspondence you send to us);

• provide our products and services to you, including to:
  • establish who you are and assess your creditworthiness;
  • assess applications for products and services; and/or
  • administer and monitor products or services;
• improve our products and services and keep you up to date on such improvements;
• tell you about other products or services that we think may be of interest to you;
• administer and manage the services we use or provide, including accounting, charging, billing, collecting debts and other internal administrative procedures;
• comply with legal obligations and assist government departments and regulatory bodies;
• assess your application for employment with us or otherwise for the purpose of engaging you as a contractor or consultant;
• manage claims such as workers’ compensation, public liability or any other form of insurance claims;
• verify your identity;
• analyse your use of our website, and personalise and improve your experience on our website using cookies and similar technologies;
• address any issues or complaints that we or you have regarding our relationship;
• conduct internal research, market analysis and for other product development and quality improvement purposes; and
• comply with any other legal requirements.

We may also use and disclose your personal information for purposes related to the above purposes and for which you would reasonably expect us to do so in the circumstances, or where you have consented, or otherwise in accordance with law.

Where personal information is used or disclosed, we take steps reasonable in the circumstances to ensure it is relevant to the purpose for which it is to be used or disclosed.

You have no obligation to provide your personal information to us. However, if you choose not to disclose your personal information to us, we may be unable to provide you with the products and/or services that depend on the collection of that personal information.

6. To whom do we disclose your personal information?

We may disclose your personal information to third parties in connection with the purposes for which the personal information was collected, as described in section 5 of this Privacy Policy.

This may include disclosing your personal information to third parties including, but not limited to:

• members of the Oxbury group and/or our affiliates;
• existing and potential business partners;
• identity verification agencies;
• entities providing fraud prevention, identity verification, and other similar services;
• our actual or prospective insurers, accountants, lawyers, auditors and other professional advisors;
• our agents or distribution partners;
• our funders, indemnifiers or representatives;
• livestock buyers and sellers, and/or their agents, with whom you are or may be dealing;
• farm input providers, and/or their agents, with whom you are or may be dealing;
• anyone to whom we consider assigning or transferring any of our rights or obligations;
• anyone that we engage with about selling all or any part of our business or assets, and their advisors;
• anyone providing any credit or funding support to all or any part of our business;
• our contractors and other service providers that provide administrative or business management goods and services to us (including suppliers, marketing agencies, data analysis specialists, data processing organisations, billing and debt recovery providers, website and data hosting providers, loyalty program administrators and IT providers);
• marketing agencies or third parties for the purpose of providing direct or indirect marketing services and/or market research services to us;
• Government agencies and regulators, courts, tribunals and other bodies as required or authorised by law;
• any actual or potential financier, participant or sub-participant, or assignee, novatee or transferee of our rights and/or obligations under any transactions or potential transactions between us and you;
• recruitment and labour hire agencies (as required);
• any third parties to whom you have directed or permitted us to disclose your personal information (eg referees);
• third parties that require the information for law enforcement or to prevent a serious threat to public safety; and
• any other party to we are authorised or required to disclose personal information by law.

Where we disclose your personal information to third parties, we will take reasonable steps to ensure that such third parties only use your personal information as reasonably required by them for the purpose for which we disclosed it, and otherwise in a manner consistent with the Privacy Act.

7. Credit reports

We may disclose your personal information to a credit reporting body if:

• you are applying for credit, or you have obtained credit from us;
• you guarantee, or are considering guaranteeing, the obligations of another person to us; or
• you are a director of a company, a partner of a partnership or a trustee of a trust that is a loan applicant or borrower or guarantor.

A credit report contains information about your credit history which assists credit providers to assess your application, verify your identity and manage your accounts. Credit reporting bodies collect and exchange this information with credit providers.

The Privacy Act limits the information that credit providers can disclose about you to credit reporting bodies, as well as the ways in which credit providers can use credit reports. The information we may disclose includes your identification details, any applications for credit you have made, the type and amount of credit you have, any failure to make repayments or defaults and whether you have committed a serious credit infringement (such as fraud). This is information we have collected through your use of our products and services. We may also ask credit reporting bodies to provide us with an overall assessment score of your creditworthiness.

The credit reporting body we may share information with is called Equifax (equifax.com.au). Contact details and a copy of their privacy policy is available on its website.

We use information from credit reporting bodies to confirm your identity, assess applications for credit, manage our relationship with you and otherwise in order to comply with laws, regulations and codes of practice. This includes sharing your credit information with the entities listed in section 6 of this Privacy Policy. We may combine the information from a credit reporting body with other information. Credit providers can ask credit reporting bodies to use your credit-related information to pre-screen you for direct marketing. You can ask a credit reporting body not to do this. You can also ask a credit reporting body to not use or disclose your credit information if you believe you have been, or are likely to be, a victim of fraud. To do this, contact the credit reporting body directly.

Sections 13 and 14, respectively, contain details about how you can access or correct any information we hold about you, how you can make a complaint about a data breach and how we will deal with any complaint.

8. Identity verification

Before we can provide our customers with financial products or services, we are required to collect information from them, including personal information, to verify their identity. This requirement applies to Australian financial institutions such as Oxbury under the AML/CTF Act.

If you are seeking to obtain our financial products or services, there are two methods we can use to verify your identity: electronic verification or a manual alternate method.

choose to use either electronic verification or a manual alternate method (or both) depending on the product you are applying for and the identification you have provided to us.

8.1 Electronic verification

Under the AML/CTF Act, we can disclose your name, residential address and date of birth to a credit reporting body to assist in verifying your identity. The credit reporting body will then assess whether this information matches (in whole or part) information held in their records and in the records of government departments, an issuer or official record holder of identity documents, or other third parties (if any).

For us to complete electronic verification, you need to:

• be 18 years or over;
• have an Australian residential address;
• hold an acceptable form of identification; and
• consent to your identity being verified in this way.

8.2 Manual alternate method

If you cannot or choose not to be electronically verified, we must identify you using a manual alternate method, for example by requesting originally certified copies of identifying documents such as your driver licence, passport or other documents that verify your identity if you do not have a driver licence or passport, or your name has been changed.

9. Overseas disclosure

In order to provide our products and/or services and for administrative, data storage and other business management purposes, we may disclose your personal information (including credit information) to organisations (including our related entities and contracted service providers) that are located outside of Australia. Some of the overseas organisations to whom we disclose personal information are located in New Zealand.

We currently use cloud service providers, for example, Microsoft 365 and Amazon Web Services, and other electronic or networked systems, to store your personal information. Such service providers have data centres based outside of Australia, and your personal information may be held in these centres.

We may also need to share your personal information overseas if we sell, transfer or disclose our database of personal information to an actual or potential successor, purchaser or investor located outside of Australia.

Overseas recipients may have different privacy and data protection standards. Before we disclose your personal information to an organisation that is located outside of Australia, we will take reasonable steps in the circumstances to ensure that:

1. the overseas recipient complies with the APPs;
2. the overseas recipient is bound by a substantially similar privacy scheme, unless you consent to the overseas disclosure; or
3. the disclosure is otherwise required or permitted by law.

10. How do we protect your personal information?

We take reasonable technical and organisational steps to ensure that the personal information we hold about you is secure and to protect it from misuse, interference and loss and from unauthorised access, modification or disclosure.

We keep hard copy documents in our offices which are protected by building security and other office security measures, and which are accessible only by authorised staff. The electronic records that we hold are stored in computer systems that have firewalls, intrusion detection and virus scanning tools to protect against unauthorised access. We also maintain and monitor online security systems.

Our Privacy Officer is responsible for ensuring that our staff are trained in the proper handling of personal information so that they are aware of the things they must do to protect your personal information, including our policies on control of access to information systems and data handling, clear desks and screens, bring your own device and acceptable use. We ensure that we have appropriate data handling and security arrangements in place:

1. when we send information electronically to our related parties overseas; and/or
2. where we use third parties to handle or store data, including in the contractual arrangements we have in place with those third parties.

However, the internet is not a secure environment and although we take reasonable steps to protect your personal information, we cannot guarantee the security of personal information stored or transferred via electronic means. You can help us protect your privacy by observing our security requirements and contacting us immediately if your contact details change. You should keep any usernames, passwords and pin codes secure and confidential at all times and not disclose them to any other person. Please contact us immediately using the details in section 15 below if you believe that your username or password may have been disclosed to another person or if you otherwise become aware or have reasonable grounds to believe that the security pf your personal information may be compromised, including if you have been or are likely to be a victim of fraud.

We will destroy or de-identify personal information in circumstances where it is no longer required unless we are otherwise required or authorised by law to retain it.

11. Direct marketing

We may use and disclose your personal information for the purpose of promoting other products and services and providing you with information about special offers that could be of interest to you, including through direct marketing, where:

1. you have consented to us doing so; or
2. it is otherwise permitted by law.

Direct marketing can be delivered by a range of methods including mail, telephone, email or SMS. If you do not want to receive such communications, you can opt out or unsubscribe from our direct marketing, or change your contact preferences, by contacting us using the contact information provided below in section 15 or through any opt out mechanism contained in a marketing communication we send to you.

We will not use or disclose sensitive information about you or credit related personal information for direct marketing purposes unless you have consented to such use or disclosure or unless it is permitted under the Privacy Act and the Spam Act 2003 (Cth).

12. Unsolicited personal information

If we receive personal information that we have not requested, including sensitive information, we will, within a reasonable period after receiving it, determine whether we could have collected that information under the APPs. If we determine that we could have collected the information, we may retain it and will handle it in accordance with this Privacy Policy and the APPs. If we determine that we could not have collected the information, and the information is not in a Commonwealth record, we will destroy or de-identify the information as soon as practicable, provided it is lawful and reasonable to do so. If we are not required to destroy or de-identify the information, we will continue to handle it in accordance with this Privacy Policy and the APPs.

There are occasions where it is difficult to separate sensitive information from other personal information. Where we need to store such personal information for future use, including for regulatory reasons, we will handle the personal information in accordance with this Privacy Policy and the APPs.

13. How can you access and correct the personal information we hold about you?

We take steps reasonable in the circumstances to ensure personal information we hold is accurate, up to date, complete, relevant and not misleading. We rely on the accuracy of personal information as provided to us both directly (from you) and indirectly.

You may contact us if the personal information we hold about you is incorrect or to notify us of a change in your personal information (including your contact details). Our contact details are set out in section 15 of this Privacy Policy.

Under the Privacy Act, you have a right to access and seek correction of your personal information that is collected and held by us. If at any time you would like to access or correct the personal information that we hold about you, or you would like more information on our approach to privacy, please contact our Privacy Officer on the details set out in section 15 of this Privacy Policy.

We will grant access to your personal information to the extent required or authorised by the Privacy Act or other applicable law and take steps reasonable in the circumstances to correct personal information where necessary and appropriate.

To obtain access to your personal information:

1. you will have to provide proof of your identity to ensure that personal information is provided only to the correct individuals and the privacy of others is protected; and
2. we request that you be reasonably specific about the information you require;
3. we may charge you a reasonable administration fee, which reflects the cost to us, for providing access in accordance with your request.

We will endeavour to respond to your request to access or correct your personal information within 30 days from your request.

We will take steps reasonable in the circumstances to provide you with access in a manner that meets both your needs and our needs. We will usually provide access to your personal information free of charge. However, in some cases, such as when your request requires us to obtain information that is not readily available, we may charge you a reasonable administration fee which reflects the cost to us for providing access in accordance with your request.

If you have requested to access or correct your personal information and we refuse your request, we will provide you with written reasons for the refusal and details of complaint mechanisms. We reserve the right to refuse your request to access or correct your personal information if we consider your request to be frivolous or vexatious or if we are otherwise legally entitled to do so.

14. What can you do if you have a privacy complaint?

If you have any complaints about our handling of your personal information, or if you believe that we have not complied with this Privacy Policy or the Privacy Act, please contact our Privacy Officer using the contact details listed in section 15 of this Privacy Policy.

Oxbury takes any privacy complaint seriously. Any privacy complaint will be assessed by our Privacy Officer with the aim of resolving any the complaint in a timely, efficient and confidential manner. We request that you cooperate with us during this process and provide us with any relevant information that we may need regarding your complaint to enable us to investigate and respond to it. If your complaint concerns credit-related information, then we may need to consult with other organisations, including credit reporting bodies or credit providers.

You will be informed of the outcome of your complaint following completion of our investigation.

If you are not satisfied with the outcome of your complaint, you may contact the Office of the Australian Information Commissioner (https://www.oaic.gov.au/).

15. Contact us

For further information or enquiries regarding your personal information, to unsubscribe from or opt out of receiving any promotional or marketing communications, and to make requests to update or access your personal information, please contact our Privacy Officer at:

The Privacy Officer
Oxbury Agricultural Finance Pty Limited
Unit 505, 157 Liverpool Street, Sydney NSW 2000