4 Your personal credit information

What types of credit information do we collect and hold?

• 4.1 We may collect and use personal credit information and credit eligibility information about you. Credit information may include the following types of information about individuals.
• 4.2 ID information: including current and prior names and addresses, any known aliases, date of birth, gender, current or last known employers and driver’s licence number.
• 4.3 Bank account details or financial details: allowing us to process payments
• 4.4 Payment information: including repayment history and payments owed for a relevant account with us or with another credit provider.
• 4.5 Information request: a statement that an information request has been made about the individual in relation to credit by a credit provider who assigned your account (s)to us.
• 4.6 Credit Liability Information: the type of credit and the amount of credit sought in an application that has been made by you to a credit provider; and in connection with which the provider has made an information request in relation to the individual.
• 4.7 Default information: and where a default has been remedied, payment information or new arrangement information.
• 4.8 Court proceedings information: an Australian court judgement relating to your credit.
• 4.9 Personal insolvency information: a record relating to your bankruptcy or your entry into a debt management or personal insolvency agreement.
• 4.10 Publicly available information: a record relating to an individual’s activities in Australia and credit worthiness.
• 4.11 Credit reporting information: information we receive from a credit reporting body including scores, ratings, summaries, evaluations, and other information relating to an individual’s credit worthiness which is derived by us or by a credit reporting body wholly or partly from any of the information above.
• 4.12 Credit reporting information: information we derive from the credit reporting information we receive from credit reporting bodies which includes information about credit history with other credit providers.
• 4.13 Administrative information: information relating to credit, such as account and customer numbers.
• 4.14 We, or service providers on our behalf, may hold credit related information about you in computer systems, electronic form, digital records, call recordings or in paper files.

5 Credit Reporting Bodies

• 5.1 In accordance with our obligations under the Privacy Act, we set out the following notifiable matters in relation to any of your personal or credit information disclosed by us to a credit reporting body for the purposes of undertaking a credit check or disclosing payment default information in relation to credit provided to you:
• 5.2 In connection with the provision of credit, we may disclose your personal and credit information to the following credit reporting bodies for the purposes of undertaking a credit check in relation to an application made by you or disclosing payment default information.

• Equifax Australia Information Services and Solutions Pty Ltd
  Call: 13 83 32
  Website: www.equifax.com.au
  Mail: PO Box 964, North Sydney, NSW 2059
  Email: customerserviceAU@equifax.com
• illion Pty Ltd
  Call: 1300 734 806
  Website: www.checkyourcredit.com.au
  Mail: PO Box 7405, St Kilda Road, Melbourne, VIC 3004
  Email: pac.austral@illion.com.au
• Experian Australia Credit Services Pty Ltd
  Call: 1300 784 134
  Website: www.experian.com.au
  Mail: PO Box 1969, North Sydney, NSW 2060
  Email: creditreport@au.experian.com

• 5.3 Credit reporting bodies are required to have a policy which explains how they will manage your credit personal information. If you would like to read the policies of these credit reporting bodies, please visit their websites or contact them directly for further information.
• 5.4 If you fail to meet your payment obligations in relation to consumer credit or you commit a serious credit infringement, we may be entitled to disclose this to the Credit Reporting Body.
• 5.5 You have the right to request that a credit reporting body exclude your credit personal information from being used by them in connection with pre-screening for direct marketing requested by a credit provider. You should contact each relevant credit reporting body directly if you wish to request this.
• 5.6 You have the right to request that a credit reporting body not use or disclose your credit reporting information if you believe that you have been, or are likely to be, the victim of fraud (for example, if you suspect that someone is using your identity details to apply for credit). You should contact each relevant credit reporting body directly if you wish to request this.

6 How we collect your personal information

• 6.1 Your personal and credit information may be collected in a number of ways, including:
  • (a) the credit provider(s) who assigned your account(s) to us
  • (b) credit reporting bodies
  • (c) any third party third party authorised by you to be your representative
  • (d) available databases subscribed by PRA such as people search databases, property and tenancy databases.
  • (e) recruitment purposes such as evaluating an application you may make for a position at PRA.
  • (f) communicating with you (or your representative) for example, when you seek, or enquire about, our services; or
  • (g) when you use our website or complete a form on our website.
• 6.2 In some circumstances, where it is unreasonable or impracticable to collect information from you, we may collect information about you from a third party source for example, we may collect information from a publicly maintained record, including online information which is publicly available online.
• 6.3 We will ensure to take reasonable steps to either notify you, or ensure you are aware of, certain matters relating to the collection of your personal information.
• 6.4 We will ensure that the personal information it collects and the personal information it uses or discloses is, having regard to the purpose of the use or disclosure, accurate, up to date, complete and relevant.
• 6.5 You need not provide all the information requested by us, but this may prevent us from providing some or all of our services to you.

7 Using and sharing your personal information

How we use your personal information

• 7.1 This section sets out:
  • (a) the general categories of personal information that we may process;
  • (b) in the case of personal information that we did not obtain directly from you, the source and specific categories of that data;
  • (c) the purposes for which we may process personal information; and
  • (d) the legal bases of the processing.
• 7.2 We may process data about your use of our website and services (Usage Data). The Usage Data may include your IP address, geographical location, browser type and version, operating system, referral source, length of visit, page views and website navigation paths, as well as information about the timing, frequency and pattern of your service use. The source of the Usage Data is our analytics tracking system. This Usage Data may be processed for the purposes of analysing the use of the website and services.
• 7.3 We may process your account data (Account Data). The Account Data may include your name, contact details, email address, payment details when you make a payment to us and any other information that you provide to us. The Account Data may be processed for the purposes of operating our website, performing our services, ensuring the security of our website and services, maintaining back-ups of our databases and communicating with you.
• 7.4 We may process your information included in your personal profile on our website (Profile Data). The Profile Data may include your name, address, telephone number, email address, gender, date of birth and employment details. The Profile Data may be processed for the purposes of enabling and monitoring your use of our website and providing our services to you.
• 7.5 We may process your personal information that is provided to us in the course of providing our services for your use (Service Data). The Service Data may include your Profile Data including your personal information. The source of the Service Data is information that you provide to us, your creditor provides to us and information that we receive from government registries and agencies. The Service Data may be processed for the purposes of operating our website, providing our services, ensuring the security of our website and services, maintaining back-ups of our databases and communicating with you.
• 7.6 We may process information (that is not confidential) that you post for publication on our website or through our services (Publication Data). The Publication Data may be processed for the purposes of enabling such publication and administering our website and services.
• 7.7 We may process information contained in any enquiry you submit to us regarding our services (Enquiry Data). The Enquiry Data may be processed for the purposes of offering, marketing and selling relevant services to you. The legal basis for this processing is either consent, the performance of a contract between you and us and/or taking steps, at your request, to enter into such a contract or our legitimate interests, namely the proper administration of our website and business.
• 7.8 We may process information relating to our customer relationships, including customer contact information (Customer Relationship Data). The Customer Relationship Data may include your name, your employer, your job title or role, your contact details, and information contained in communications between us and you or your employer. The source of the Customer Relationship Data is you or your employer. The Customer Relationship Data may be processed for the purposes of managing our relationships with customers, communicating with customers, keeping records of those communications and promoting our products and services to customers.
• 7.9 We may process information contained in or relating to any communication that you send to us (Correspondence Data). The Correspondence Data may include the communication content and metadata associated with the communication. Our website will generate the metadata associated with communications made using the website contact forms. The Correspondence Data may be processed for the purposes of communicating with you and record-keeping.
• 7.10 We may process information relating to transactions, including payment data and use of our services that you enter into with us and/or through our website (Transaction Data). The Transaction Data may include your contact details, your card details and the transaction details. The source of the Transaction Data is you and/or our payment services provider. The Transaction Data may be processed for the purpose of supplying the services and keeping proper records of those transactions.
• 7.11 We may process information that you provide to us for the purpose of subscribing to our email notifications and/or newsletters (Notification Data). The Notification Data may be processed for the purposes of sending you the relevant notifications and/or newsletters.
• 7.12 We may communicate with you via social media platforms or we may collect personal information about you from social media platforms if you publicly comment or send us a direct message via any social media platform that we use (Social Media Data). The Social Media Data may be processed for the purpose of supplying the services to you and keeping proper records of those communications.
• 7.13 We may process any of your personal information identified in this policy where necessary for the establishment, exercise or defence of legal claims, whether in court proceedings or in an administrative or out-of-court procedure.
• 7.14 We may process any of your personal information identified in this policy where necessary for the purposes of obtaining or maintaining insurance coverage, managing risks, or obtaining professional advice.
• 7.15 In addition to the specific purposes for which we may process your personal information set out in this section, we may also process any of your personal information where such processing is necessary for the performance of our contracts and compliance with our contractual arrangements with our clients, any legal obligation to which we are subject, or in order to protect your vital interests or the vital interests of another natural person.
• 7.16 The legal basis for the processing of your personal information is either:
  • (a) consent;
  • (b) the performance of a contract between you and us and/or taking steps, at your request, to enter into such a contract;
  • (c) you are posting any publication on our website;
  • (d) our legitimate interests, namely;
    • (i) to comply with our legal and regulatory obligations;
    • (ii) the proper administration of our website and business;
    • (iii) monitoring and improving our website and our services;
    • (iv) the proper management of our customer relationships;
    • (v) communications with users;
    • (vi) the protection and assertion of our legal rights, your legal rights and the legal rights of others (as applicable);
    • (vii) the proper protection of our business against risks; and
    • (viii) for any other purpose permitted by law.

8 Sharing your personal information

• 8.1 We may disclose your personal information to any member of our group of companies (this means our ultimate holding company and all of its subsidiaries –see section 6 ‘overseas recipients’ for further information insofar as reasonably necessary for the purposes, and on the legal basis, set out in this policy.
• 8.2 We may disclose your personal information to our insurers and/or professional advisers insofar as reasonably necessary for the purposes of obtaining or maintaining insurance coverage, managing risks, obtaining professional advice, or the establishment, exercise or defence of legal claims, whether in court proceedings or in an administrative or out-of-court procedure.
• 8.3 We may disclose personal information to our suppliers or subcontractors insofar as reasonably necessary to provide the relevant services to you.
• 8.4 We may disclose financial transactions relating to our website and payments via our payment services provider. We will share transaction data with our payment service provider only to the extent necessary for the purposes of processing your payments and dealing with complaints and queries relating to such payments.
• 8.5 In addition to the specific disclosures of personal information set out in this section, we may disclose your personal information where such disclosure is necessary for compliance with a legal obligation to which we are subject, or in order to protect your vital interests or the vital interests of another natural person.
• 8.6 We may also disclose your personal information where such disclosure is necessary for the establishment, exercise, or defence of legal claims, whether in court proceedings or in an administrative or out-of-court procedure.

9 Overseas Recipients

• 9.1 We may provide information about the circumstances in which your Personal Data may be transferred to countries outside of Australia.
• 9.2 We and our other group companies have offices in Australia, the USA, Columbia, Brazil, the EU and elsewhere around the world.

10 What happens if I do not provide information that has been requested?

• If you do not allow us to collect all of the personal information we reasonably request, we may not be able to deliver our services to you or on your behalf to your customers or be unable to identify you to protect you against fraud.

11 Managing your personal information

• 11.1 Retaining and deleting personal information
  • (a) Our data retention policies and procedure are designed to help ensure that we comply with our legal obligations in relation to the retention and deletion of personal information.
  • (b) Personal information that we process for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes.
  • (c) We will retain your personal information for as long as legally required and when we no longer are legally required or have a legitimate purpose to retain it, we will either destroy it, desensitize it or anonymize it.
  • (d) Notwithstanding the other provisions of this Section, we may retain your personal information where such retention is necessary for compliance with a legal obligation to which we are subject, or in order to protect your vital interests or the vital interests of another natural person.
  • (e) We may also de-identify your personal information which we have collected for the purposes described in this Policy. As a result, this Policy and Privacy Laws will generally not apply to our use of de-identified information. However, we will continue to safeguard this de-identified information.
• 11.2 Securing your personal information
  • (a) The security of your personal information is important to us. We will take appropriate technical and organisational precautions to secure your personal information and to prevent the loss, misuse, unauthorized access, disclosure or alteration of your personal information.
  • (b) We will store all your personal information on secure servers, personal computers and mobile devices, and in secure manual record-keeping systems.
  • (c) Much of the information we hold about you will be stored electronically. We store your information in secure data centres that are located in Australia. We also store information in data centres of our contracted service providers (including cloud storage providers), and some of these data centres may be located outside of Australia.
  • (d) Some information we hold about you will be stored in paper files.
  • (e) We take reasonable steps to hold information securely in electronic or physical form both in Australia and overseas. We are committed to keeping secure the data you provide to us and we will take all reasonable precautions to protect your personally identifiable information from loss, misuse, interference, unauthorised access or alteration.
  • (f) We aim to achieve this through:
    • (i) imposing confidentiality requirements on our employees;
    • (ii) implementing policies in relation to document storage security;
    • (iii) regularly monitoring and reviewing our compliance with internal policies and industry best practice;
    • (iv) implementing security measures to govern access to our systems;
    • (v) only providing access to personal information once proper identification has been given;
    • (vi) controlling access to our premises;
    • (vii) training all employees about privacy and information security; and
    • (viii) implementing website protection measures.
  • (g) We will not sell your personal information to other companies or organisations.

12 Can you remain anonymous or use a pseudonym when dealing with us?

• 12.1 Where it is lawful and practical to do so, you may wish to deal with us without providing any personal information, such as by providing a pseudonym or dealing with us anonymously, when you make general enquiries. However, in order to provide our services to you, we will need to identify you.

13 Notifiable Data Breaches

• 13.1 We will notify you and the Office of the Australian Information Commissioner (OAIC) of certain data breaches and recommend steps you can take to limit the impacts of a breach (for example, a password change).
• 13.2 The National Data Breach scheme requires us to notify about a data breach that is likely to result in serious harm to affected individuals. There are exceptions where notification is not required. For example, where we have already taken appropriate remedial action that removes the risk of serious harm to any individuals.
• 13.3 If we believe there has been a data breach that impacts your personal information and creates a likely risk of serious harm, we will notify you and the OAIC as soon as practicable and keep in close contact with you about the nature of the breach, the steps we are taking and what you can do to reduce the impacts to your privacy.
• 13.4 If you believe that any personal information, we hold about you has been impacted by a data breach, you can contact us using the contact details below.

14 Requests to stop Direct Marketing

• 14.1 Where we use or disclose personal information about you for the purposes of direct marketing by another organisation (eg creditor providers), you may request:
  • (a) that we no longer provide you with direct marketing communications;
  • (b) that we does not use or disclose your personal information for the purpose of facilitating direct marketing by another organisation;
  • (c) that we provides the source of the personal information.
• 14.2 Where we receive the above request from you, we will:
  • (a) give effect to your request within a reasonable period after the request is made free of charge; and
  • (b) notify you of the source of the information, upon your request, unless it is impracticable or unreasonable to do so.

15 Your rights

• 15.1 In this section, we have summarised the rights that you have under the Privacy Laws. Some of the rights are complex, and not all of the details have been included in our summaries. Accordingly, you should read the relevant laws and guidance from the regulatory authorities for a full explanation of these rights.
• 15.2 The summary of your principal rights under Privacy Laws are:
  • (a) to request, at any time, for us to inform you of the personal information we hold about you;
  • (b) the right to access;
  • (c) the right to rectification;
  • (d) the right to erasure (where we have no legitimate right or business requirements to retain your personal information);
  • (e) the right to restrict or object to processing (where we have no legitimate right or business requirements to retain your personal information);
  • (f) the right to complain to a supervisory authority; and
  • (g) the right to withdraw your consent (where we have no legitimate right or business requirements to retain your personal information).
• 15.3 You have the right to confirmation as to whether or not we process your personal information and, where we do, access to the personal information, together with certain additional information. That additional information includes details of the purposes of the processing, the categories of personal information concerned and the recipients of the personal information. Providing the rights and freedoms of others are not affected, we will supply to you a copy of your personal information. The first copy will be provided free of charge, but additional copies may be subject to a reasonable fee.
• 15.4 You have the right to have any inaccurate personal information about you rectified and, taking into account the purposes of the processing, to have any incomplete personal information about you completed. If we refuse your request to correct your personal information, you also have the right to request that a statement be associated with your personal information noting that you disagree with its accuracy.
• 15.5 In some circumstances you have the right to the erasure of your personal information without undue delay. Those circumstances include: the personal information that is no longer necessary in relation to the purpose for which it was collected or otherwise processed; you withdraw consent to consent-based processing; you object to the processing under certain rules of applicable Privacy Laws; the processing is for direct marketing purposes; and the personal information has been unlawfully processed. However, there are exclusions of the right to erasure. The general exclusions include where processing is necessary: for exercising the right of freedom of expression and information; for compliance with a legal obligation; or for the establishment, exercise or defence of legal claims.
• 15.6 In some circumstances you have the right to restrict the processing of your personal information. Those circumstances are: you contest the accuracy of the personal information; processing is unlawful, but you oppose erasure; we no longer need the personal information for the purposes of our processing, but you require personal information for the establishment, exercise or defence of legal claims; and you have objected to processing, pending the verification of that objection. Where processing has been restricted on this basis, we may continue to store your personal information. However, we will only otherwise process it: with your consent; for the establishment, exercise or defence of legal claims; for the protection of the rights of another natural or legal person; or for reasons of important public interest.
• 15.7 You have the right to object to our processing of your personal information on grounds relating to your particular situation, but only to the extent that the legal basis for the processing is that the processing is necessary for: the performance of a task carried out in the public interest or in the exercise of any official authority vested in us; or the purposes of the legitimate interests pursued by us or by a third party. If you make such an objection, we will cease to process the personal information unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing is for the establishment, exercise or defence of legal claims.
• 15.8 You have the right to object to our processing of your personal information for direct marketing purposes (including profiling for direct marketing purposes). If you make such an objection, we will cease to process your personal information for this purpose.
• 15.9 To the extent that the legal basis for our processing of your personal information is:
  • (a) consent; or
  • (b) that the processing is necessary for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into a contract, and such processing is carried out by automated means, you have the right to receive your personal information from us in a structured, commonly used and machine-readable format. However, this right does not apply where it would adversely affect the rights and freedoms of others.
• 15.10 If you consider that our processing of your personal information infringes Privacy Laws, you have a legal right to lodge a complaint with the Office of the Australian Information Commissioner.
• 15.11 To the extent that the legal basis for our processing of your personal information is consent, you have the right to withdraw that consent at any time. Withdrawal will not affect the lawfulness of processing before the withdrawal.
• 15.12 We usually will respond to you within 30 days of receiving your request.
• 15.13 We may refuse to give you access to the personal information we hold about you if we reasonably believe that giving access would pose a serious threat to the life, health or safety of an individual, or to public health or safety, where giving access would be unlawful, where giving access would have an unreasonable impact on the privacy of other individuals, or if we consider the request to be frivolous or vexatious.
• 15.14 If we refuse to give you access to or to correct your personal information, we will give you a notice explaining our reasons except where it would be unreasonable to do so.
• 15.15 You may exercise any of your rights in relation to your personal information by contacting us. If you have a question or complaint about how your personal information is being handled by us, our affiliates or contracted service providers, please contact us first on the following email: customerservice@pragroup.com.au

16 Third party websites

• 16.1 Our website includes hyperlinks to, and details of, third party websites. We have no control over, and are not responsible for, the privacy policies and practices of third parties.
• 16.2 Our service providers use cookies, and those cookies may be stored on your computer when you visit their website. We have no control over, and are not responsible for, the uses of cookies, privacy policies and practices of third parties.

17 About cookies

• 17.1 A cookie is a file containing an identifier (a string of letters and numbers) that is sent by a web server to a web browser and is stored by the browser. The identifier is then sent back to the server each time the browser requests a page from the server.
• 17.2 Cookies may be either “persistent” cookies or “session” cookies: a persistent cookie will be stored by a web browser and will remain valid until its set expiry date, unless deleted by the user before the expiry date; a session cookie, on the other hand, will expire at the end of the user session, when the web browser is closed.
• 17.3 Cookies do not typically contain any information that personally identifies a user, but personal information that we store about you may be linked to the information stored in and obtained from cookies.

18 Cookies that we use

• 18.1 We use cookies for the following purposes:
  • (a) authentication: we may use cookies to identify you when you visit our website and as you navigate our website;
  • (b) status: we use cookies to help us to determine if you are logged into our website;
  • (c) personalisation: we use cookies to store information about your preferences and to personalise our website for you;
  • (d) security: we use cookies as an element of the security measures used to protect user accounts, including preventing fraudulent use of login credentials, and to protect our website and services generally;
  • (e) advertising: we use cookies to help us to display advertisements that will be relevant to you; or
  • (f) analysis: we use cookies to help us to analyse the use and performance of our website and services.

19 Managing cookies

• 19.1 Most browsers allow you to refuse to accept cookies and to delete cookies. The methods for doing so vary from browser to browser, and from version to version. You can however obtain from the browser that you use up-to-date information about blocking and deleting cookies.
• 19.2 Blocking all cookies will have a negative impact upon the usability of many websites.
• 19.3 If you block cookies, you may not be able to use all the features on our website.

20 Changes to our privacy policy

• We may make changes to this policy from time to time by publishing a new version on our website. We encourage you to periodically review this page for the latest information on our privacy practices. We have included the version number and ‘Last Updated’ date at this bottom of this policy to help keep track of any changes.

21 Accessing your personal information

• If you want to access your personal information;
• Contact our Operations Centre 1800 772 729 or
• Email customerservice@pragroup.com.au
• If for any reason we cannot provide you with access, we will tell you why and attempt to find other ways to help you get this information.

22 Requesting correction of your information

• If you believe your personal information is inaccurate, or incomplete or out of date:
• Mail: GPO Box 1624, Brisbane QLD 4001
• Call: Customer Service: 1800 772 729
• Email customerservice@pragroup.com.au
• 9am to 7pm weekdays (Brisbane time)
• If you would like us to correct information we have received or disclosed through the credit reporting system, we will consult with the relevant organisations directly.
• If we do not agree that your information needs to be corrected, we will tell you why – and what you can do if you are unsatisfied with our response.

23 Making a privacy complaint

• If you have a concern or complaint about how we have handled your personal information (including your credit information), you may contact us so that we may try to resolve your complaint.
• PRA Customer Resolutions Team
• Mail: GPO Box 1624, Brisbane QLD 4001
• Call: 1800 979 669
• Email: customer.resolutions@pragroup.com.au
• 9am to 5pm weekdays (Brisbane time)

24 Contact details for escalation of complaints

• 24.1 If you are not satisfied with our response after you have been through our internal complaints process, you may contact the Australian Financial Complaints Authority (AFCA).
• 24.2 AFCA provides a free and independent dispute resolution service for individual and small business customers who are unable to resolve their complaints directly with ANZ.
  • Call: 1800 931 678 (free call) or (+61) 1800 931 6786
  • Email: info@afca.org.au
  • Website: afca.org.au
  • Mail: Australian Financial Complaints Authority, GPO Box 3, Melbourne, VIC 3001
• 24.3 Time limits may apply to complain to AFCA. Please act promptly and consult the AFCA website to find out if or when the time limit relevant to your circumstances expires.
• 24.4 You may also raise any concerns directly with the Office of the Australian Information Commissioner (OAIC).
• 24.5 Under the Privacy Laws you may complain to the Office of the Australian Information Commissioner (OAIC) about the way we handle your personal information. Please note the OAIC requires any complaint must first be made to the respondent organisation. The law also allows 30 days for the respondent organisation to deal with the complaint before a person may make a complaint to the OAIC.
  • Office of the Australian Information Commissioner
  • Mail: GPO Box 5218, Sydney NSW 2001
  • Call: 1300 363 992
  • Email: enquiries@oaic.gov.au
  • Website: www.oaic.gov.au

This website is owned and operated by PRA Australia Pty Ltd ACN 154 270 069 and we are incorporated under the laws of Australia.

Version 4 Last Updated: June 2024