Credit Corp Financial Services Pty Limited (CDR) Policy
Introduction
About this Policy
This document constitutes Credit Corp Financial Services Pty Limited’s Consumer Data Right Policy (“CDR Policy”). Credit Corp Financial Services trades as “Wizit”. A reference to “Wizit”, “Credit Corp”, “we”, “our” or “us” means Credit Corp Financial Services Pty Limited (ABN 39 146 525 706).
Credit Corp is an online lender offering consumers loans with credit limits up to $8000.
To conduct customer due diligence, meet our responsible lending and anti-money laundering obligations, assess the suitability of your proposed loan, draw down, or credit limit increase, and manage your account (“Purposes”), Credit Corp collects and uses banking data. For these Purposes, and with your consent, we collect your banking data under the Consumer Data Right (“CDR”) regime, which we refer to as (“CDR Data”).
This policy explains how Credit Corp collects and manages your CDR Data and gives an overview of some of your rights under the CDR legislation. This document is for reference only and does not set out all of your rights in relation to the CDR and should not be relied on as legal advice.
The CDR Regime
The CDR regime allows you to authorise the sharing of information held about you and your accounts by data holders, such as your bank or other participating entity (“Data Holders”) with accredited CDR Principals, and their CDR Representatives.
Credit Corp is a CDR Representative of Basiq Pty Ltd (ABN 95 616 592 011) (ADRBNK000208) (“Basiq”). Basiq is a CDR Principal, acting as the interface between Data Holders and Credit Corp.
Basiq handles CDR Data in accordance with its CDR policy, available here.
Credit Corp’s CDR Policy should be read together with Basiq’s CDR policy. This will assist you in understanding how Credit Corp and Basiq will collect and use your CDR Data for the Purposes, and how Credit Corp will address your inquiries, requests or complaints in relation to your CDR Data. Understanding this will allow you to make an informed decision when providing or revoking your consent.
Both Credit Corp and Basiq are subject to strict controls under applicable privacy laws. Further, Basiq is required to comply with the Competition and Consumer (Consumer Data Right) Rules 2020 (“CDR Rules”). While Credit Corp is not directly subject to the CDR Rules, it is contractually required to comply with obligations set out in its CDR agreement with Basiq, which reflect the CDR Rules. Basiq remains responsible for Credit Corp’s handling of CDR Data.
If you have any query in relation to how we collect, use, store and disclose your CDR Data, please contact us. You can reach us as follows:
Telephone: 1300 768 621
Email: customercare@creditcorp.com.au
Mail: GPO Box 4475, Sydney NSW 2001.
The Consumer Data Right
What is the Consumer Data Right?
The Consumer Data Right is a legal and regulatory regime in Australia that enables consumers to access their CDR Data held by Data Holders and share that CDR Data with accredited third parties. This usually occurs in the context of a third party (such as Wizit) offering consumers products or services. For more information about the CDR regime, refer to: https://www.cdr.gov.au/
How is Data Shared Between CDR Principals and CDR Representatives?
CDR Data can be shared between CDR Principals (such as Basiq) and CDR Representatives (such as Credit Corp) under specific conditions. CDR Principals are Accredited Data Recipients (“ADR”) who have the authority to collect CDR Data directly from Data Holders. CDR Representatives are entities that are not themselves accredited under the CDR regime, but have a contractual relationship with an accredited CDR Principal. CDR Representatives can receive CDR Data collected by their CDR Principal from Data Holders and use or disclose that CDR Data to provide, or assess whether they will provide, goods or services to you, in line with your consent.
These data sharing arrangements are regulated under the CDR Rules which provide the framework for how the CDR operates. These CDR Rules outline the privacy obligations under the scheme, define the elements of consent, and set out the accreditation framework. The CDR Rules are designed to protect the security of your CDR Data and ensure it is only collected, used and disclosed in line with your consent. The Privacy Act 1988 (Cth) and the Australian Privacy Principles also apply to the information Credit Corp collects under the CDR Regime.
How Credit Corp and Basiq Share Your Information
Credit Corp and Basiq have entered an arrangement to allow secure sharing and use of CDR Data. Basiq is an ADR under the CDR regime. As an ADR, with your consent, Basiq may collect and use CDR Data from a Data Holder such as your bank or other participating financial institution and disclose that CDR Data to Credit Corp.
Credit Corp is a CDR Representative of Basiq. Under the Agreement with Basiq, Credit Corp can access and use CDR Data collected by Basiq for the Purposes. Credit Corp can only access, use, and disclose your CDR Data in accordance with your consent, ensuring you retain control over your data and how it’s used.
What CDR Data Will Credit Corp Receive From Basiq?
In line with your consent, Credit Corp will access the following CDR Data held by your bank or other participating financial institution:
- Account details – such as account type, balance, and status
- Transaction history – including amounts, dates, merchants, and scheduled payments
- Product information – like interest rates, fees, and eligibility criteria for financial products
- Loan and credit data – covering mortgages, personal loans, credit card limits, and repayment history
- Personal information – including your name, contact details, customer reference number, account ownership status, occupation and employer name
We refer to the above data throughout the remainder of this CDR Policy as ‘Account Data’.
How Do We Collect And Manage Your Consent?
When you apply for a loan, drawdown or credit limit increase, we will ask you for your consent for:
- Basiq to collect your Account Data from your Data Holders;
- Basiq to share your Account Data with Credit Corp; and
- Credit Corp to use or disclose your Account Data for the Purposes.
After your consent has been received, Basiq will collect your Account Data directly from your Data Holders and share that Account Data with Credit Corp. Credit Corp may share that data with one or more outsourced service providers (“OSP”) with your consent.
Once provided, your consent will remain valid for a period of 30 days unless you withdraw it sooner. If we wish to obtain your CDR Data after this time, we will either request that you renew your consent or provide further consent.
You can manage your consent preferences at any time through:
- Your banking application or online banking portal
- Logging in to the Wizit App, selecting the ‘Settings’ menu, then selecting ‘Manage CDR Consent’. You will be redirected to the Basiq CDR dashboard where you can manage your consent.
- Contacting Credit Corp.
If you withdraw your consent, or your consent expires:
- We will stop collecting and using your Account Data.
- We may be unable to assess your loan, drawdown or credit limit application and as a result, we may decline your application.
- We will only retain Account Data that we are authorised or required to use or disclose under Australian law.
How Do We Handle Account Data?
We collect, use, and disclose your Account Data solely for the Purposes.
Credit Corp uses Experian Open Data Solutions Pty Ltd (ABN 89 166 277 845) (ADRBNK000017) (“Experian ODS”) as a trusted OSP to assist in classify your Account Data, namely your banking transaction data, for transaction categorisation purposes and generating decision metrics based on those transactions, and for other purposes set out in your consent. Experian ODS may engage Experian Australian Operations Pty Ltd (ABN 95 006 399 677)(ADR777832) (“Experian”), as a further OSP to assist in delivering the transaction categorisation services in relation to the Account Data in accordance with your consent.
Credit Corp remains responsible for ensuring your Account Data is handled securely by Experian ODS and Experian in accordance with the CDR Rules and Privacy Safeguards.
Credit Corp will use your Account Data for the Purposes, in line with your consent. We undertake:
- Not to share your Account Data with any third party without your consent; and
- To delete your Account Data upon your Account Data becoming ‘redundant data’ as that term is defined under the CDR Rules (“Redundant CDR Data”). We explain more about Redundant CDR Data below.
How Can I Request Correction of CDR Data?
Credit Corp, Basiq and Data Holders are required to ensure that any information held, including CDR Data, is accurate, up-to-date, complete, relevant and not misleading. If you believe that any of your Account Data is incorrect, please contact us so that we can address it.
Upon receipt of your notification, we will advise Basiq that your CDR Data may be incorrect. Basiq will then work with the Data Holder to correct any incorrect data. We will endeavor to respond to you in relation to your correction request within 30 days.
How Is My Redundant CDR Data Handled?
CDR Data (including all of your Account Data) and any data derived from CDR Data becomes ‘Redundant CDR Data’ when Credit Corp no longer needs it:
- For a purpose permitted under the CDR regime; or
- For a purpose for which Credit Corp is permitted to use or disclose it under any other Australian law. This may include meeting our obligations under the National Consumer Credit Protection Act 2009, complying with the Anti-Money Laundering and Countering Financing of Terrorism Act 2006, or as required by a Court or Tribunal order.
Credit Corp will delete all CDR Data, including Account Data upon it becoming Redundant CDR Data.
Retention of CDR Data In Certain Cases?
Account Data will not become Redundant CDR Data if Credit Corp is required or authorised to use or disclose the data under any applicable Australian law.
As the Account Data may be used to meet our customer due-diligence obligations under the Anti-Money Laundering and Countering Financing of Terrorism Act 2006 , or as part of our credit assessment under the National Consumer Credit Protection Act 2009, we have certain legal obligations which require us to retain your Account Data for periods set out in these acts. Information on how Credit Corp manages your personal information is contained in our Privacy Policy.
Feedback and Complaints
For more information about how Credit Corp manages CDR Data, please email us at customercare@creditcorp.com.au or write to us at Customer Care, GPO Box 4475, SYDNEY NSW 2000.
If you wish to make a complaint please refer to our feedback and complaints page on our website.
You can contact our Customer Care team by:
A notification will be sent to you within 1 working day to confirm the receipt of your complaint.
Your complaint will be investigated by a Customer Care Officer and a written response will be provided to you.
If you have any questions or concerns about our findings, or if you require further information or clarification from us, please do not hesitate to contact the Customer Care team on 1300 768 621. Our business hours are from 8:30am – 5 pm, Sydney time. We are closed on national Australian public holidays.
If you are dissatisfied with the outcome reached with our Customer Care team, you can go to our external dispute resolution scheme, the Australian Financial Complaints Authority (AFCA), for a free and independent dispute resolution service.
AFCA’s service does not cost you anything and they will help resolve the complaint. You can contact AFCA by calling 1300 565 562, or through AFCA’s website (www.afca.org.au) or by writing to: AFCA, GPO Box 3, Melbourne VIC 3001.
Time limits may apply to complain to AFCA and so you should act promptly or otherwise consult the AFCA website to find out if or when the time limit relevant to your circumstances expires.
You can also raise your complaint with the Office of the Australian Information Commission (OAIC). You can reach OAIC at www.oaic.gov.au, by telephone on 1300 363 992, or by writing to them at Office of the Australian Information Commission, GPO Box 5288, Sydney NSW 2001
