Credit Reporting Policy

Introduction

This is the Credit Reporting Policy of C1 Finance PTY LTD ("C1 Finance", "we" or "us"). It explains how we collect, use, hold, disclose and protect your Credit Information.

This Policy should be read together with our Privacy Policy, available on our website.

We handle your Credit Information in accordance with the Australian Privacy Principles (APPs), the Privacy Act 1988 (Cth) and the Privacy (Credit Reporting) Code 2014 Version 2 ("CR Code").

What Is Credit Information?

Credit Information is personal information about your credit activities and history. It may include:

• Your identity details (full name, address, date of birth)
• The type and amount of credit you have applied for or hold
• Your repayment history — whether you have made repayments on time
• Default information — if you have failed to meet repayment obligations
• Serious credit infringement information — if a lender reasonably believes fraud has occurred or you have intentionally avoided repayments
• Personal insolvency information
• Court proceedings information related to credit
• New arrangement information — if a credit contract is varied or replaced after a default is recorded
• Consumer credit liability information and publicly available information

Credit Information does not include sensitive information such as your health, racial or ethnic origin, or other special categories of personal information. We do not collect or use sensitive information in our credit assessments.

How We Collect Your Credit Information

Direct collection from you

We collect Credit Information directly from you when you:

• Complete a credit application form (online, in person or via a broker)
• Speak with our staff by telephone or email
• Apply through a finance broker who submits an application on your behalf

We will only access your credit report from a Credit Reporting Body (CRB) after you have provided your signed written consent and completed a credit application.

Collection from third parties

We may also collect Credit Information from:

• Credit Reporting Bodies (CRBs) — Equifax, Experian and illion
• Publicly available sources (such as public registers)
• Your authorised representatives (e.g. legal adviser, broker, guardian or trustee)
• Your employer (for income verification only)
• Commercial fraud prevention services

ℹ️ Which Credit Reporting Bodies do we use?

Equifax Australia — https://www.equifax.com.au | 13 8332
Experian Australia — https://www.experian.com.au | 1300 783 684
illion — https://www.illion.com.au | 13 23 33

Why we collect your Credit Information

We collect Credit Information only when it is reasonably necessary for our business functions. We do not collect more information than is needed to assess your application.

Typical purposes include:

• Assessing your application for finance
• Conducting a responsible lending assessment in accordance with the National Consumer Credit Protection Act 2009 (Cth)
• Verifying your identity
• Managing your credit account and collecting overdue payments
• Assessing co-borrowers or guarantors (where applicable)
• Fraud prevention

How We Use Your Credit Information

We use Credit Information and Credit Eligibility Information (information we obtain from a CRB or derive from it) only for permitted purposes under the Privacy Act. These include:

• Assessing your application for credit
• Collecting payments owed to us for credit we have provided
• Assessing your suitability as a guarantor and enforcing a guarantee if required
• Responding to your access or correction requests
• Responding to complaints made to the OAIC or AFCA
• Where you have otherwise expressly consented to a specific use

⚠️ Important — No use for direct marketing

We are prohibited by the Privacy Act from using your Credit Information or Credit Eligibility Information for direct marketing purposes. This is an absolute prohibition with no exceptions. Our credit data systems are kept strictly separate from any marketing systems.

Who We Disclose Your Credit Information To

Disclosure to Credit Reporting Bodies

We may disclose information about you to a CRB if you are applying for credit, have obtained credit from us, are acting as a guarantor, or are a director of a borrowing entity.

We will only disclose information to a CRB that has a business operation in Australia. Information we may disclose to CRBs includes:

• Your identification details
• The type and amount of credit you hold or have applied for
• Whether you have made repayments on time (repayment history)
• Default information (see below)
• Whether you have committed a serious credit infringement

ℹ️ Default reporting — your right to advance notice

Before we report a default to a CRB, we must first send you a written notice stating the overdue amount and our intention to make the disclosure.

We must wait at least 14 days after sending that notice before reporting the default.

If you pay the overdue amount after we have reported a default, we will update the CRB record within a reasonable time (generally within 30 days).

Other permitted disclosures

We may also disclose your Credit Eligibility Information to:

• Your authorised credit advisor
• Our related companies (within the C1 Finance group, in Australia)
• Service providers who process credit applications or manage credit on our behalf
• A guarantor or co-borrower — where you have given written consent and they have an Australian connection
• Another credit provider — a loan payout balance where you have given written consent (note: repayment history information cannot be disclosed to another credit provider even with consent — this is a firm statutory restriction under the Privacy Act)
• A debt collection agency — limited to identification information, default information, court proceedings information and personal insolvency information only, for the purpose of collecting overdue payments
• OAIC or AFCA — where required for complaint resolution
• As required by Australian law or court/tribunal order

We do not disclose your Credit Information to vehicle dealers or referrers beyond communicating whether your application is approved, declined or conditionally approved.

Overseas Disclosure

We store your Credit Information on servers located in Australia. If we use any cloud or data storage services with overseas components, we will take reasonable steps to ensure your information is protected to a standard consistent with Australian privacy laws (APP 8).

How We Store and Protect Your Credit Information

We take reasonable steps to protect your Credit Information from misuse, interference, loss, unauthorised access, modification and disclosure. Our security measures include:

• Role-based access controls on all electronic systems holding credit information
• Staff obligations to maintain information security and complete annual privacy training
• Secure storage of physical documents with prompt scanning and destruction
• Regular monitoring and review of our compliance with security policies

We will retain your Credit Information for as long as required by law. Under the National Consumer Credit Protection Act 2009 and related legislation, credit records must generally be retained for 7 years after the credit transaction.

When we no longer need Credit Eligibility Information and are not required by law to retain it, we will take reasonable steps to securely destroy or de-identify it.

ℹ️ Data breach notification

If we become aware of a data breach that is likely to result in serious harm to you, we will notify the Office of the Australian Information Commissioner (OAIC) and affected individuals as soon as practicable and within 30 days, in accordance with the Notifiable Data Breaches scheme (Privacy Act Part IIIC).

Your Right to Access Your Credit Information

You have the right to request access to the Credit Eligibility Information we hold about you at any time. We will:

• Respond to your request within 30 calendar days
• Verify your identity before releasing any information
• Provide the information in the format you request, where reasonable and practicable
• Present information clearly, with explanations to help you understand its impact on your creditworthiness
• Not charge you any fee for making the request or accessing your information

If we are unable to provide access in a particular case (for example, where disclosure would be unlawful), we will give you written reasons for the refusal and inform you of your right to make a complaint to the OAIC or AFCA.

Note: We may not retain a copy of your credit report after we have used it in accordance with the Privacy Act. For the most up-to-date copy, contact the relevant CRB directly using the contact details above.

Correcting Your Credit Information

We aim to hold accurate and up-to-date Credit Information at all times. If you believe any information we hold about you is incorrect, incomplete, out of date or misleading, you may request a correction by contacting us.

We will:

• Acknowledge your correction request within 2 business days
• Investigate and respond within 30 calendar days — at no charge to you
• Correct the information if we are satisfied it is inaccurate
• Notify the relevant CRB and any other prior recipients of the information where a correction is made
• Provide you with written confirmation of the outcome

If we do not agree with your correction request, we will advise you in writing with our reasons. You also have the right to request that a statement be associated with your credit file noting that you dispute the accuracy of the information.

If Your Application Is Declined

If we decline your credit application wholly or partly because of information on your credit report, we will tell you this fact and explain how you can obtain a copy of your credit report from the relevant CRB.

Protecting Yourself from Fraud

If you believe you have been or are likely to be a victim of fraud, you can ask a CRB not to use or disclose your Credit Information for a specified period. Contact the relevant CRBs directly using the contact details listed above.

Complaints

Internal complaints

We take privacy seriously. If you have a complaint about how we have handled your Credit Information, please contact us in the first instance. We offer a free internal complaint resolution process.

Our Complaints Officer will:

• Acknowledge your complaint within 7 calendar days
• Aim to resolve your complaint within 30 calendar days
• Provide you with a written response setting out the outcome

If your complaint is not resolved within 30 days, or you are not satisfied with the outcome, you may refer it to an external dispute resolution body (see below).

External dispute resolution — AFCA

AFCA is an independent, free external dispute resolution scheme approved by ASIC. It can hear disputes about the handling of credit reporting information.

Australian Financial Complaints Authority (AFCA)

Office of the Australian Information Commissioner (OAIC)

You may also lodge a privacy complaint directly with the OAIC.

Office of the Australian Information Commissioner (OAIC)

Changes to This Policy

We may update this Credit Reporting Policy from time to time to reflect changes in our business, legal obligations or best practice. The current version will always be available on our website. Where changes are material, we will provide notice on our website.

This Policy was last updated in April 2026 and is reviewed at least annually by our Compliance Officer.

Contact Us

If you have any questions about this Policy or how we handle your Credit Information, please contact us:

C1 Finance Pty Ltd — Privacy Enquiries