30 January 2019
This credit reporting policy (‘the CR Policy’) applies to Afterpay Pty Ltd ACN 169 342 947 (‘Afterpay’, ‘we’, ‘us’ or ‘our’) and details how we, as credit provider (as defined in and for the purposes of the Privacy Act 1988 (Cth)), collect, manage and use your credit-related personal information (including but not limited to that collected on our websites, mobile applications, via email, cloud-based services or controlled widgets embedded in communication platforms with a link to this CR Policy ('Websites')). Our handling of credit-related personal information is regulated by applicable privacy laws and credit reporting requirements (“Relevant Laws”).
If you would like to request a copy of this policy by email, please contact us at the details listed in this CR Policy below.
Throughout this CR Policy, we use the term “personal information” to describe information that is associated with a specific person and can be used to reasonably identify that person. Personal information does not include information that has been made anonymous and cannot reasonably identify a specific person. "Credit-related personal information" is described below, but it is generally personal information about you that may have an impact on credit that is provided to you or that you have applied for.
Afterpay is committed to respecting the privacy of your credit-related personal informationand upholding the security of your credit-related personal information in our custody or control.
Afterpay may amend this CR Policy at any time. The updated version will be available on our Websites. The revised version will be effective from the time we post it on the Websites. Afterpay will highlight any material changes to the CR Policy that may impact you by notifying you by email or otherwise.
Types of credit-related personal information
Afterpay may collect, hold, use and disclose the following types of credit-related personalinformation about you:
• Identification information, such as your name, address, driver's licence number, Medicare number and/or other similar information;
• Information about your financial circumstances, such as your employment, income and expenses; and
• Information about your past experiences with us and other credit providers, such as the kinds of credit products you have had or sought and how you have managed your obligations (e.g. repayments), and other information about your financial position and personal circumstances.
Afterpay collects credit-related personal information about you in various ways including when you provide such information directly to us (such as when you register for or use our services, features, technologies or functions offered on our Websites and other online platforms (collectively 'Afterpay Services') or when we seek information about you from credit reporting bodies (‘CRBs’), our Partners, our service providers, (e.g. other credit providers, identity verifications and fraud prevention providers), our related companies, and other third parties or publicly or commercially available sources. Your credit-related personal information is stored in electronic form and protected using physical, technical, and administrative security measures.
Purpose
The credit-related personal information Afterpay collects from you or about you is necessary for our business and we collect, use, hold and disclose it for purposes permitted under Relevant Laws, including:
• to provide (or assess whether to provide) the Afterpay Services or other services offered to you by us from time to time;
• to manage the Afterpay Services we provide to you, including collecting overdue payments and assisting you to avoid defaulting on your credit-related obligations; and
• as required, authorized or prescribed by relevant laws and regulations.
Protecting your credit-related personal information
Afterpay will keep your credit-related personal information secure by taking reasonable steps to protect it from misuse, loss and unauthorised access, use, modification and disclosure.
We protect your information using physical, technical, and administrative security measures to reduce the risks of loss, misuse, unauthorised access, disclosure and alteration. We also review our security procedures periodically to consider appropriate new technology and updated methods. Only properly authorised people who have a need to access credit-related personal information to perform their job will be able to see or use that information. Even so, despite our reasonable efforts, no security measure is ever perfect or impenetrable.
Disclosure to Credit Reporting Bodies
From time to time, Afterpay may disclose your credit-related personal information to CRBs for purposes permitted under Relevant Laws. For example:
• If you request Afterpay Services from us, we may check your identity and/or request a credit report about you from a CRB to help us assess your application for credit. In order to do so, we will provide the CRB with some personal information about you, and the CRB, its related bodies corporate and/or its third party service providers will collect, hold, use and disclose that information for the purposes of verifying your identity and/or producing your credit report; and
• If you fail to meet your payment obligations in relation to credit provided by us (e.g. if you miss or are late with one or more payments or commit defaults) or if you commit a serious credit infringement, we may disclose such information to a CRB.
You should be aware that a CRB is authorised by us to use your personal information which we provide to it for the purposes of providing their identity and credit reporting services and may include information provided by us in reports provided to other credit providers to assist them to assess your credit worthiness.
You have special rights under Relevant Laws in relation to dealings with CRBs such as:
• You may request from a CRB its policy on how it manages your personal information;
• CRBs can use your credit-related personal information for a pre-screening assessment at the request of a credit provider, unless you ask the CRB not to. If you do not want a CRB to use your credit-related personal information for the purpose of pre-screening, you have the right to ask the CRB to exclude you; and
• If you reasonably believe that you have been or are likely to be a victim of fraud including identity-related fraud, you can request the CRB not to use or disclose credit-related personal information the CRB holds about you.
The CRB we currently deal with is Illion Australia Pty Ltd (illion) (w: www.illion.com.au | e: [email protected] | t: 1300 734 806). Please see www.illion.com.au for further information about how illion manage your credit-related personal information.
Disclosure to other recipients
Afterpay may also disclose your credit-related personal information to third parties as permitted under Relevant Laws, such as other credit providers, our related bodies corporate or organisations involved in the provision or support of the Afterpay Services. Afterpay may also disclose your credit-related personal information where we are required or authorised by law (including under the Privacy Act 1988 (Cth)) or if you have expressly consented for Afterpay to do so or that consent may be reasonably inferred from the circumstances. Note that some of the recipients to whom we disclose your credit-related personal information may be located outside your jurisdiction.
Access to and correction of credit-related personal information
We will strive to ensure that information about you is accurate when we collect or use it. Subject to some exceptions under Relevant Laws, we will let you see the credit-related personal information we hold about you on request and correct it if it is inaccurate, incomplete or out-of-date. If we do not grant you access to your credit-related personal information or do not agree to correct your credit-related personal information we will tell you why.
If you wish to obtain access to and/or correct your credit-related personal information held by Afterpay, please contact Afterpay on:
Email: [email protected]
Phone (Australia): 1300 100 729
Mail: GPO Box 2269, Melbourne, VIC 3001, Australia
Unless we do not agree to your request for access to credit-related personal information, in most cases Afterpay will provide you with access as soon as reasonably possible followingreceipt of your request. If you request corrections to your credit-related personal information and Afterpay agrees with your request, these changes will be made as soon as practicable. If Afterpay does not agree to your request for correction, it will notify you of the reasons it does not agree and will note your request on its records about you.
Resolving your concerns about your credit-related personal information
If you have a complaint regarding Afterpay’s management of your credit-related personal information or believe we have failed to comply with Relevant Laws, please let us know in writing and email it to us at [email protected].
Afterpay will provide written acknowledgement of your complaint within 5 business days of receipt. We will investigate and advise you of the steps we have taken to resolve your complaint within 21 business days of receipt of your complaint (or where we cannot resolve your complaint within 21 business days, we will notify you of the reason as well as when we expect to resolve the complaint).
We may consult with a CRB or another credit provider if we consider it necessary to deal with your complaint. If we disclose your credit-related personal information while investigating your complaint, we may also advise the recipient about your complaint.
If you are not satisfied with how we resolved your complaint after it has first been through our internal dispute resolution processes, you may contact the Australian Financial Complaints Authority (AFCA) by phone: 1800 931 678 (free call) (Monday to Friday 9am-5pm AEST) or lodge your complaint online at afca.org.au.
If you are not satisfied with AFCA’s resolution, you can make a complaint to the Office of the Australian Information Commissioner. Visit their website at www.oaic.gov.au for their most up-to-date contact details.