Privacy Policy

This Privacy Policy applies to personal information collected by Lydian Financial Services Pty Ltd through our website (including enquiry forms, online applications, cookies and analytics tools) and through our mortgage and finance broking services.

Open and transparent management of personal information

We will manage personal information, including credit information, in an open and transparent manner. In doing so, we ensure that individuals are notified at the time of collecting their personal information:

• what type of personal information is being collected;
• who that personal information will be disclosed to; and
• how we use that personal information.

We will be responsible for dealing with any queries regarding access to or correction of personal information or any privacy related complaints. We ensure all our employees and authorised representatives are trained at regular intervals to ensure they understand our obligations under the Privacy Act, including the Australian Privacy Principles.

We periodically update our privacy policy and will provide a copy of our privacy policy free of charge on request and in a suitable format.

Anonymity and pseudonymity

Generally, we are not able to deal with customers who do not wish to identify themselves. However, where possible and appropriate, we will provide information of a general nature to unidentified individuals.

Collection of personal information

We collect personal information for the following purposes:

• arranging and assessing an application for credit;
• managing credit;
• providing individuals with the products or services marketed by us, our brands and our partners;
• managing our relationship with individuals;
• protecting individuals and ourselves from error or fraud; and
• complying with regulatory requirements.

As a national network of mortgage and finance professionals, we may share your personal information between Lydian Financial Services, our brokers, and our specialist brands (including Lydian Private, Lydian Practice Finance and Lydian Life) where it is relevant to the service you have requested.

Types of personal information we may collect and hold

Personal information for the purposes of identification, your contact details (e.g. name, address, phone, email and other personal contact information), date of birth, occupation and employment history, family status and relationship information (cohabitants, dependants and the ages of those individuals in your household).

From time to time we may collect information that contains government identifiers which could include your tax file number. However, we do not use or disclose this information other than as required by law.

Financial Information relating to your overall financial position and for the purposes of our loan assessment. This information may include relevant bank statements (e.g. transaction and savings statements), credit card / store card statements, and information related to your assets and liabilities.

Credit Reporting Information includes credit reports from credit reporting bodies. These reports will disclose repayment history with your loans and financial liabilities including information about overdue payments and defaults, information related to adverse credit history including infringements, insolvency or bankruptcy, court proceedings and other information that is publicly available. We use your credit-related information to assess your eligibility to be provided with finance. The credit-related information that is available on credit reports is generally exchanged between credit and finance providers and credit reporting bodies.

Sensitive Information

We may collect sensitive information from individuals if they are referred to an insurance agency or they apply for an insurance related product where the insurer may have affiliations with our business or our brands. Insurance products that may require sensitive information may include, but are not limited to, life insurance, income protection and TPD. It is unlikely that we will require collection of sensitive information in applications relating to the provision of a product or service related to our credit activities, but this may occur periodically. We only collect sensitive information directly from the individual and with the individual's consent. Sensitive information that is collected in this way is only used for the purpose for which it is provided. This may include information about your religion, ethnicity, health information, criminal record or biometric information.

Where possible, we collect personal information directly from the individual. There are a number of ways in which we may seek information from you. We might collect your information when you fill out a form with us, when you've given us a call or used our website. We also find using electronic means, such as email or SMS, a convenient way to communicate with you and to verify your details.

What do we collect via your website activity and internet activity?

When you access our website, we may monitor your use of the site to ensure we can verify you and that you can receive information from us. This also helps us identify ways we can improve our services for you.

Some customers like to engage with us through social media channels. We may collect information about you when you interact with us through these channels. However, we do not expect personal information (including financial information) to be shared on that type of forum and would recommend more secure channels be utilised for the transmission of personal and/or sensitive information.

To improve our services and products, we sometimes collect de-identified information from web users. That information could include IP addresses or geographical information to ensure your use of our web applications is secure.

Cookies and website analytics

We use cookies and similar technologies on our website to enhance your experience, analyse website traffic and improve our services. Cookies are small data files stored on your device when you visit our website.

We may use analytics tools (such as Google Analytics) to collect information about how users interact with our website, including pages visited, time spent on pages and general geographic location. This information is generally de-identified and used to improve website functionality and user experience.

You can control or disable cookies through your browser settings. However, this may affect the functionality of parts of our website.

Unsolicited personal information

If we receive unsolicited personal information, we will determine whether we could have collected that personal information by lawful and fair means, and whether it is related to one of the purposes of collecting personal information above. We will do this by looking at our relationship with the individual and whether the personal information relates to our relationship with them.

If we could not have collected the personal information by lawful and fair means, or the personal information does not relate to one of our purposes for collecting the personal information, we will destroy or de-identify the personal information.

Notification of the collection of personal information

When we first collect personal information from an individual, we will notify them that we have collected their personal information. We will require individuals to consent to our use and disclosure of their personal information.

This notification will provide the individual with information about:

• the purposes of the collection of their personal information and credit information;
• those entities that we usually disclose personal information or credit information to;
• what happens if the individual chooses not to provide us with personal information;
• direct marketing that may be undertaken by us, our brands or our partners;
• our privacy policy and where it can be found; and
• any disclosure of personal information that we make to an overseas entity.

If we know that as part of our relationship with an individual we are likely to disclose their personal information to another identifiable entity, we will usually notify the individual of:

• the identity and contact details of that organisation; and
• why their information may be disclosed to the organisation.

Direct marketing

We notify individuals at the time of collecting their personal information that their personal information will be used by us, our brands and any associated businesses for the purposes of direct marketing.

In all our direct marketing communications we will provide a prominent statement about how an individual can elect not to receive direct marketing. If the direct marketing communication is an email we will provide an 'unsubscribe' function within the email.

We will keep appropriate records to ensure those individuals who have made requests not to receive direct marketing communications do not receive them. We do not apply a fee to unsubscribe from direct marketing communications.

We do not sell personal information. We do not use sensitive information for the purposes of direct marketing.

If we purchase personal information for the purposes of direct marketing we will conduct appropriate due diligence to ensure appropriate consents from the individuals have been obtained.

Cross-border disclosure of personal information

We may disclose your information to organisations overseas who are contracted to us for the purposes of audits of loan files to ensure that legislative, regulatory and industry expectations have been met. We may store your information in the cloud or other types of networked or electronic storage.

Through our brands and specialist services, including our China Desk, South East Asia and United Kingdom operations, your information may, where relevant to the service you have requested, be disclosed to or accessed by parties located overseas.

We may use cloud storage and IT servers that may be located overseas to store the personal information we hold. As electronic or networked storage can be accessed from various countries via an internet connection, it is not always practicable to know in which country your information may be held.

Adoption, use or disclosure of government related identifiers

We do not use government related identifiers to identify individuals.

We may receive tax file numbers in the course of assessing an application for credit; however, we do not use or disclose tax file numbers for any purpose when engaging in credit activities.

Quality of personal information

We rely on individuals to help us ensure that their personal information is accurate, up-to-date and complete.

If we become aware that personal information is inaccurate, out-of-date or incomplete, such as when mail is returned, we will update our systems accordingly.

Security of personal information

We take reasonable steps to protect the personal information we hold from misuse, interference and loss, as well as unauthorised access, modification or disclosure. Some of the controls that are used may include:

• Access restrictions to data using physical and electronic barriers;
• Appropriate training of representatives in confidentiality;
• Education of representatives in recognising possible cyber intrusions;
• Governance around the provision of information to third parties;
• ICT security including firewalls, malware scanning and encryption of data.

Any paper records are only accessible to employees and others as they are needed. Any paper records are held within an office that is locked and security protected at night.

In accordance with the Australian Privacy Principles, we keep personal information only for as long as is reasonably necessary for the purpose for which it was collected or to comply with any applicable legal or ethical reporting or document retention requirements. We will take reasonable steps to destroy personal information or ensure it is de-identified if that information is no longer needed for any purpose for which it may be used or disclosed.

Access to personal information

Individuals may request access to any personal information that we hold about them. We will not charge an individual for requesting access to their personal information when it is reasonable and practicable to do so.

We will verify the individual's identity prior to disclosing any personal information.

When an individual requests access to their personal information we will conduct a search of our customer relationship database. This search will also indicate if there are any paper records that contain personal information.

Disclosure and access of information

We will not give access to the personal information that we hold about an individual where it is unreasonable or impracticable to provide access, or in circumstances where the request would likely:

• pose a serious threat to the life, health or safety of any individual, or to public health or public safety;
• unreasonably impact the privacy of other individuals;
• be frivolous or vexatious;
• relate to anticipated legal proceedings, and the correct method of access to personal information is by the process of discovery in those legal proceedings;
• reveal the intentions of the entity in relation to negotiations with the individual in such a way as to prejudice those negotiations;
• be unlawful or in breach of an Australian law;
• prejudice the taking of appropriate action in relation to a matter where there is unlawful activity or misconduct that relates to our functions or activities;
• prejudice an enforcement related activity of an enforcement body (such as ASIC); or
• reveal commercially sensitive information.

When we receive a request for access we will usually respond to the individual within 7 days. Depending on the nature of the request we may be able to provide the personal information at the same time as when the request is made.

If the individual is requesting a large amount of personal information or the request cannot be dealt with immediately, then after we have investigated the request for access we will advise the individual what personal information we hold and provide details of that personal information.

We will comply with all reasonable requests by an individual to provide details of the personal information that we hold in the requested format.

If we do not provide access to the information we will provide written reasons setting out why we do not believe we need to provide access. We will also advise the individual they can access our Internal Dispute Resolution (IDR) and External Dispute Resolution (EDR) schemes if they are dissatisfied with a decision not to provide access to personal information.

Correction of personal information

If we hold personal information about an individual and we are reasonably satisfied that the information is inaccurate, out of date, incomplete, irrelevant or misleading, or we receive a request to correct the information, we will take reasonable steps to correct the information.

If we correct any personal information that we have previously disclosed, we will take reasonable steps to notify the entity to which we disclosed the information of the correction. We may not always make corrections to an individual's personal information. When we do not make requested corrections, we will provide reasons for our refusal to make the correction and provide details of our IDR and EDR procedures.

If, after notifying the individual of our refusal to correct personal information, the individual requests us to issue a statement on the record that contains the personal information, we will take reasonable steps to do so.

We may disclose your personal information to:

• lenders and credit providers;
• our aggregator, Specialist Financial Group (SFG);
• brokers within the Lydian network and associated brands;
• service providers (including IT, CRM and cloud providers); and
• overseas service providers where relevant to our operations and compliance obligations.

What happens if you want to complain?

Examples of issues include internet privacy complaints, security breaches and misuse of personal information. Your complaint will be considered through our internal complaints resolution process and we will respond with a decision within 30 days of you making the complaint.

If you remain dissatisfied with how your complaint has been managed, you may contact the following entities:

Any issues regarding spam or telemarketing will generally be referred by OAIC to the Australian Communications and Media Authority (ACMA).

Version 1.0; June 2026