Privacy Policy

Effective: December 2023

We are committed to respecting your privacy and understand that the Citoplus website, digital platform (Platform) that we operate, and the other services we provide depend on the privacy of the personal information collected, used, disclosed and otherwise processed by us. This Privacy Policy sets out how we collect, use, store, disclose and otherwise handle personal information.

By providing personal information to us, consenting to us collecting your personal information from third parties and other sources, and/or accessing and using our website and/or Platform, you are deemed to consent to our collection, use and disclosure of your personal information in accordance with this Privacy Policy and any other arrangements that apply between us.

We reserve the right (at our discretion) to change or to replace our Privacy Policy from time to time. When we do so, we will make the Privacy Policy (as changed or replaced) available on our website and/or the Platform. We recommend that you check our website and the Platform periodically to ensure that you are aware of our current Privacy Policy.

We will make a copy of this Privacy Policy available to you free of charge on request.

What personal information do we collect?

For the purpose of this Privacy Policy, “personal information” is information or an opinion which identifies an individual or which could reasonably identify the individual, regardless of whether the information or opinion is in a material form or not.

We may collect the following types of information that may be considered personal information:

your identity information, such as your full name and your date and place of birth;
your contact information, such as your email address, telephone number, mail or street address (including your residential address), and other information that may be used to contact you;
your consumer credit report and other credit related data and information;
your accounting and taxation data and information;
your banking data and information;
your ownership and interests in, and roles with respect to, any body corporate, trust, partnership or other entity and your other business interests and relationships;
geolocation and computer-generated information, such as your device ID, device type, computer and connection information, statistics on page views, traffic to and from the Platform, IP address, access time, browser type, language and standard web log information;
details of the IP address from which you access our website or Platform, the date and time of access, and any third party website from which you linked to our website or Platform;
details of the products and services we have provided to you or that you have enquired about, including any additional information necessary to deliver those products and services to and to respond to your enquiries;
statistics on page views, traffic to and from our website and Platform, and other transactional information about your access to our website and Platform;
other information that we are required or authorised to collect in relation to assist us and organisations comply with their legal requirements under applicable anti-money laundering and counter-terrorism laws; and/or
any additional information relating to you or about you that you provide to us through the website or Platform or otherwise in any interaction that you have with us.

We only collect and process this information and data with your consent, which you may provide to us in writing or electronically or in such other way that we consider is a satisfactory indication that you have consented. You are deemed to have consented to our collection and processing of the information and data when you agree to our terms and conditions of access and use of the website and/or terms and conditions of access and use of the Platform.

Can you deal with us on an anonymous or pseudonymous basis?

In accordance with Australia’s privacy laws, where it is lawful and reasonable to do so, you have the right to deal with us on an anonymous or pseudonymous basis. This means that you do not need to provide us with personal information if and when that information is requested. Subject to the following, we will give you the option of not identifying yourself, or using a pseudonym, in dealing with us.

If you choose to interact with us anonymously or by using a pseudonym, or you do not provide personal information to us when we request it, then we may be unable to provide you with the products or services that you or your service providers request. For example, in order to gain access to the Platform, you must provide us with personal information in order to create and to maintain an account. If you do not provide us with the information we request, or you do not provide us with accurate information, we may be unable to provide you with access to the Platform.

Further, we reserve the right to request your identity from you in certain circumstances, and to verify your identity if we consider that it is appropriate or reasonable for us to do so. For example, when you request that we give you access to or that we correct personal information we hold about you, or when you wish to make a complaint regarding the manner in which your personal information has been handled, we reserve the right to request your identity and contact details in order to deal with your request or to investigate and to respond to your complaint.

If you do not wish to have your personal information used or disclosed in a manner described in this Privacy Policy, you can contact us. However, you may be unable to access, or use, all or part of the website and/or Platform, or otherwise to be supplied some or all of our services. Further, we may still use or disclose your personal information if:

we subsequently notify you of the intended use or disclosure and you do not object to that use or disclosure;
we believe that the use or disclosure is reasonably necessary to assist a law enforcement agency or an agency responsible for government or public security in the performance of their function;
it is to enforce our contracts and agreements or to protect our rights;
it is to protect the users of our website, the Platform and/or our services; or
we believe in good faith that we are required by law to disclose the information.

How do we collect personal information?

We collect personal information only through the use of lawful and fair means. Generally, we will collect personal information about you directly from you. However, there may be situations where we collect information about you from other sources or third parties, including other users of our website and/or Platform, and/or from third parties that hold your personal information.

We may collect personal information:

when you access, register or are registered on our website and/or our Platform;
when you accept an invitation sent to you by another user or an administrator of our website or Platform to use or join our website and/or Platform;
when you provide your consent to the collection by us of your personal information from a third party;
when you communicate with us through correspondence, chats, email or when you share information with us from other social applications, services or websites;
when you contact us in the course of us making the Platform available to you;
when you interact with our website, our Platform, our services, content and/or advertising; and/or
from current and prospective suppliers of goods and/or services to us.

We may also collect personal information about you when you apply for a job or position with us, including from any recruitment consultant, your previous employers and others who may be able to provide information to us to assist in our decision on whether to make you an offer of employment or to engage you under a contract (and that information may include your name, contact details, work history and relevant records check). If you are unsuccessful in your current application we will retain your application on file and we may take your application (and the information in your application) into account for future employment opportunities with us. This Privacy Policy does not apply to acts and practices in relation to employee records of our current and former employees, which are exempt from the Privacy Act 1988 (Cth).

How do we handle information received on an unsolicited basis?

Generally, we only collect personal information when we specifically request the information or when we take active steps to collect that information. However, from time to time, personal information may be volunteered to us without us requesting the information or taking steps to collect the information. For example, we may receive personal information when someone applies for a job with us on his/her own initiative and not in response to an advertised vacancy.

Where we receive information on an unsolicited basis, in accordance with our statutory obligations, we will determine whether we could lawfully have collected the information if we sought to collect the information. If we determine that the information could not lawfully have been collected had we sought it, then unless we are required or authorised by law to retain the information, we will take reasonable steps to destroy or to de-identify that unsolicited information.

Why do we collect, use and disclose personal information?

In accordance with our statutory obligations, we only use and disclose personal information for the primary purpose(s) for which we collected the information, any secondary purpose related to the primary purpose for which you would reasonably expect us to use or disclose that information, and as otherwise permitted or required by law.

We will use the personal information we collect from you for the purpose of providing our goods and/or services to you or to your organisation. Additionally, we may use and disclose your personal information for any one or more of the following purposes:

to enable you to access and use our website and/or our Platform;
to operate, protect and improve our services and the experience of our users, such as to perform analytics on the use of our website and/or our Platform;
to provide your credit providers and service providers with the necessary information and data to allow them to provide their credit and other services to you;
to generate aggregated statistical data for the purpose of monitoring the use of our website and the Platform, including for quality assurance and research purposes (including in order to assess trends in the use of the Platform by sector;
on our own behalf and on behalf of our clients and service providers, we may use your personal information to conduct research on how the website and/or Platform is used, and to enable us and/or our clients to conduct research on how our website and/or Platform is used in relation to products and/or services offered by us and/or our clients and/or service providers;
for identity verification purposes;
to send you service, support and administrative messages, reminders, technical notices, updates, security alerts and information you request;
to send you marketing and promotional messages and other information that may be of interest to you;
to comply with our legal and statutory obligations, resolve any disputes that we may have with any of our users or customers, and to enforce our contracts with third parties or with you or your organisation;
to comply with our obligations owed to a third party under a contract entered into with the third party for your benefit or the benefit of your organisation;
to monitor access to our website, the Platform and/or the services we supply;
to process transactions and to administer accounts (including by processing of invoices, bills, statements of account and related financial matters necessary to enable us to provide access to the website and/or the Platform, and associated products and services, to you or to your organisation under relevant contractual arrangements;
to address queries and to resolve complaints;
for quality assurance purposes, including to improve the quality of our website and Platform, as well as the products and services that we provide;
to maintain a safe working environment for our staff and contractors; and
to consider your application for employment with us.

Periodically, we may send emails or other communications containing marketing materials or promotions of our products and services to you or otherwise directly market our products and services to you on the basis that you would reasonably expect us to do so, where we have collected your personal information from you already. Where we collect personal information about you from a third party, then we will not use that personal information to directly market to you without your consent. By your access and/or use of our website and/or Platform, you consent to us doing so. Please note that by accessing and/or using our website and/or Platform, you are deemed to consent to our use of your personal information for direct marketing purposes.

If you no longer wish to receive marketing communications from us, you may unsubscribe at any time by using the unsubscribe facility set out in each marketing communication or by sending an email to us at the address specified below. We will remove you from the mailing list as soon as possible. There is no charge payable by you to us for removing you from the mailing list.

To whom do we disclose your personal information?

We may disclose personal information to third parties in order to fulfil one or more of the purposes for which the information was collected, any secondary purpose related to the primary purpose of collection or otherwise as required or authorised by law. We may disclose personal information for the purposes described in this Privacy Policy to:

our directors, officers, employees and related bodies corporate;
third party agents, clients, contractors, suppliers and service providers;
an integrated lender where an authorised digital loan submission has been made to a lender through the platform
our professional advisers, insurers and auditors;
governmental and regulatory authorities, including law enforcement;
our business partners and investors, as well as prospective partners and investors;
anyone to whom our assets or business (or any part of them) are transferred or anyone who is conducting due diligence on our assets or businesses (or any part of them) with a view to acquiring such assets or businesses (or any part of them); and
other third parties where you consent to the use or disclosure.

As at the effective date of this Privacy Policy, we do not disclose personal information to recipients located outside Australia. However, you acknowledge and agree that our website and our Platform (and the personal information contained on the website and the Platform) may be hosted on servers (including servers offered through third party service providers under contract to us) that are located in jurisdiction(s) outside Australia. Where we enter into any contract with a service provider to host our data, website and/or our Platform on our behalf, we will use our reasonable endeavours to ensure that the contract reserves for us the right to control access to the personal information hosted and to avoid the need for the service provider to access the information hosted for us.

If you communicate with us via email or through a social network service such as Facebook or Twitter, the email or the message may be routed through servers that are located outside Australia and, in relation to a message sent through Facebook or Twitter, the social network provider and its partners could collect, hold and process your personal information in a jurisdiction outside Australia.

Our use of cookies

While we do not use browsing information to identify you personally, we may collect certain information pertaining to your use of our website and/or Platform, including the pages you visit, when you visited and the internet protocol address assigned to your computer.

“Cookies” (including browser cookies, pixel beacons and Adobe Flash technology) are comprised of small bits of data or code that often include a de-identified or anonymous unique identifier. Websites, apps and other services send such data to your browser when you first visit a web-page, then store that data on your device in order to enable access to that information when you visit the same page subsequently.

We may use cookies and similar technology in order to help us track your website usage and to remember your preferences. You may disable cookies through your settings in your internet browser but our website and our Platform may not function as intended or at all if you do so.

Security of your personal information

We take reasonable steps to ensure that your personal information is stored in a manner that reasonably protects it from misuse and loss and from unauthorised access, use or disclosure. However, you agree that no data transmission over the internet or mobile data and communication services can be guaranteed as being totally secure.

When we no longer need your personal information for the purpose(s) for which we collected the information, we will take reasonable steps to destroy or to permanently de-identify your information, unless we are required by law to keep your personal information for a longer period.

Access to your personal information

You may request access to the personal information we hold about you and to request that we update or correct this information, subject to certain exceptions. If you wish to access your personal information, please contact us in writing. Subject to the following and exceptions to grant access under the Privacy Act 1988 (Cth), we will grant access to the information we hold about you in a timely fashion, and we will use our reasonable endeavours to grant access in the manner that you request.

We will not charge a fee for you making your access request. However, we reserve the right to charge an administrative fee before providing a copy of your information to you. We will endeavour to notify you of the fee before providing the information to you.

To protect your personal information, we reserve the right to ask that you verify your identity before we release the information to you. Further, to the maximum extent permitted by law, we reserve the right to redact information we make available in response to your request, in order to protect the privacy of other individuals.

We may refuse your request in certain situations, including (but not limited to) where:

giving access would unreasonably impact on the privacy of others;
the information relates to existing or anticipated legal proceedings, and the information would not be discoverable in those proceedings;
giving access would be unlawful;
denying access is otherwise required or authorised by law; or
the request for access is frivolous or vexatious.

If we refuse to provide you with access to, or we refuse to correct your personal information, we will provide you with a written explanation of our reasons.

Maintaining the quality of your personal information

We will take reasonable steps to ensure that your personal information is accurate, complete and up-to-date. However, the accuracy of the information we hold depends largely on the accuracy of the information you supply to us. If you consider that the information we hold is not up to date or is inaccurate, please advise us as soon as practicable.

Complaints and Enquiries

If you have any queries or complaints about the Privacy Policy or how we handle your personal information, please contact us using the following details:

Email: contactus@citoplus.com.au

We will acknowledge receipt of your complaint and will endeavour to respond within a reasonable time following our receipt of your complaint (generally 30 days from our receipt). Where dealing with your complaint requires a more detailed investigation, it may take longer to resolve. If this is the case, we will use reasonable endeavours to update you periodically on progress.

We reserve the right to verify your identity and to seek (where appropriate) further information from you in connection with the complaint. We may also seek information regarding the complaint from third parties, subject to our obligations regarding the privacy of personal information.

Where we are required by law to do so, we will acknowledge your complaint in writing and provide information in writing to you on how we will deal with your complaint. Further, if we are required by law to do so, we will provide our determination on your complaint to you in writing. We reserve the right to refuse to investigate and otherwise deal with a complaint if we consider it to be vexatious or frivolous. Where we determine not to investigate or deal with your complaint, we will notify you in writing, including the reasons why we will not investigate or deal with your complaint.

If you are dissatisfied with the outcome of your complaint, you may escalate the complaint to the Office of the Australian Information Commissioner.

Office of the Australian Information Commissioner (OAIC)
GPO Box 5218
Sydney NSW 2001
Email: enquiries@oaic.gov.au
www.oaic.gov.au

In this Privacy Policy references to “Citoplus”, “we”, “us” and “our” refer to Citoplus Pty Ltd ABN 11 653 321 094 and/or Citoplus Holdings Pty Ltd ABN 54 653 320 088 (as the context requires).