Privacy Policy

1. Privacy Policy

This Policy outlines how Prospa Advance Pty Ltd ACN 154 775 667 and Prospa NZ Ltd NZBN 9429046731678 (as applicable) (collectively, “Prospa”) together with their related companies and permitted assigns (“we / us / the Group”), collect, use, and handle your personal information, including credit related information, in accordance with applicable privacy legislation, including:

• if you are in Australia: the Privacy Act 1988 (Cth) and the Australian Privacy Principles; and
• if you are in New Zealand: the Privacy Act 2020,

(each referred to as a “Privacy Act”), and the Credit Reporting Privacy Code applicable to your jurisdiction, as amended or replaced from time to time (“Privacy Laws”).

References to “you” or “your” in this Policy includes both individuals and, where you interact with us on behalf of a business, that business. This Policy applies not only to current customers or guarantors (where relevant) but also to any individual who interacts with us, whether in connection with the provision of credit or otherwise. By using our services or otherwise engaging with us, you acknowledge that we will handle your personal information as described in this Privacy Policy.

If you provide any personal information to us about another individual, you confirm that you are authorised to do so and that the individual has consented to the disclosure, collection, use and handling of their information in accordance with this Privacy Policy. You must also inform them of their rights to access, as outlined below, and how they can access Prospa’s Privacy Policy.

2. What information we collect

We may collect your personal information from:

• You directly;
• Your authorised agent or representative;
• Third parties you have authorised to disclose information to us;
• Our service providers, marketing partners, and agents;
• Your financial service providers, advisers, brokers or employers;
• Government agencies, public records, and social media platforms.

We also collect information about you and your interactions with us, including when you:

• Enquire about, apply for, request or use our products or services;
• Make a card payment or transfer funds;
• Participate in a competition, promotion or survey;
• Contact us by phone or visit our websites.

In addition, we collect personal information about staff, prospective staff, contractors, suppliers, and details of individuals who work for contractors and suppliers, as well as other professional associates relevant to our operations.

Providing personal information is not mandatory. However, if you choose not to provide requested information, it may affect our ability to offer products or services or to engage with you effectively.

We may collect a range of personal information, including but not limited to:

• Key personal details, such as your name, residential and business addresses, telephone numbers, email and other electronic contact details, identity documents and biometric data (including a photo of your face);
• Financial and related information, including your occupation, financial records, bank account details, transaction history, assets, expenses, income, revenue, dependents, and information relating to your employment, financial and business dealings, and other relevant events;
• Transaction history, including interactions with Prospa, its associates, or relevant third-parties. This may include details of products or services you have used, your payment history, and the capacity in which you have engaged with us; and
• Other relevant information, which may include invoicing and accounting details, gender, marital status, tax file number, director identification number and other government issued identifiers, depending on the context.

2.1 Sensitive information

We may collect sensitive information, such as health-related information, where it is reasonably necessary for a specific purpose, such as assisting with a hardship application, debt recovery process or complaint. Sensitive information is used only for the purpose for which it was collected.

2.2 Bank statement information

If you consent to provide bank statements or use a third-party account aggregation, open banking or similar service in connection with your application or ongoing product management, you authorise us and our relevant service providers to collect and access banking transaction information made available through that service.

These providers may retrieve transactional data from any account associated with the login credentials you submit which may include both personal and business accounts. Through the use of such third-party service providers, we will obtain up to the last twelve (12) months of bank transactions when you apply for a product or service with us. We may also obtain further ongoing bank transactions during the term of the product or service we provide. This information is used for the purposes of assessing your application, administering our products and services, making future offers to you, meeting our audit, legal and regulatory obligations, and data analytics.

Where you use a third-party service provider, that provider may access your banking information in accordance with the permissions you provide and its own terms and privacy policy. We do not receive your internet banking password, and our access is limited to the information made available through the relevant service.

We note that your bank’s terms may prohibit you from sharing your login, so you agree to appoint our third-party service provider as your agent to access your internet banking on your behalf solely for this purpose, and you consent to our ongoing access to this information.

You should review the terms and privacy policy of any third-party service provider before using that service, as they govern the provider’s actions or omissions in connection with that service.

2.3 Cookies

When you use our website or mobile applications, we may collect information about your location or activity including your IP address, telephone number and whether you have accessed third-party sites. Some of this information is collected using cookies. We also use cookies to enhance your user experience and to understand how you interact with our content.

3. Using your information

We may collect, use, and disclose your information to:

• Establish your identity and consider your applications for products and services;
• Price and design our current and future products and services;
• Administer products and services we offer or manage, including:
  • Assessing eligibility for future offers;
  • Loan management (including debt collection and communications);
  • Managing complaints;
  • Facilitating payments, processing and verifying payments, including through account verification or Confirmation of Payee services;
  • Conducting staff training, system monitoring and development, credit scoring and audits;
• Establish and manage our relationship with you, including fulfilling our obligations and exercising our rights under any agreement;
• Operate and improve our business and enhance customer experience;
• Provide direct marketing communications, including via email or other electronic means;
• Administer customer rewards, loyalty programs, referral programs, partner benefits and promotional campaigns, including verifying eligibility, awarding benefits, preventing misuse, sharing information with relevant partners and service providers where necessary to verify eligibility, allocate rewards, issue gift cards, facilitate redemption or administer partner offers, and communicating with you about those programs;
• Manage risk and detect or investigate illegal activity, such as fraud;
• Assess employment applications and conduct background checks for prospective staff, contractors or suppliers;
• Comply with our legal & regulatory obligations (including under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) and the Anti-Money Laundering and Countering Financing of Terrorism Act 2009 (NZ)) and assist government, law enforcement agencies, or regulators;
• Identify and offer products or services from us, our Group members, or third parties that we reasonably believe may be of interest to you (see sections 3.1 and 3.2 below).

We may also collect, use and share your information in other ways where you have authorised us to do so or where permitted by law.

3.1 Data insights

Improvements in technology enable organisations to collect and use information to get a more integrated view of customers and provide better products and services. We may combine our customer information with information available from a wide variety of external sources (for example census or Bureau of Statistics data). We analyse this data to gain useful insights which can be used for any of the purposes mentioned in this policy. In addition, Group members may generate and share aggregated and de-identified insights, analytics and reports that do not reasonably identify you.

3.2 Use of Automated Decision Making

We may use automated tools, including artificial intelligence, to assist with parts of our assessment, verification, fraud detection, risk management, product administration and customer support processes. Where we use automated tools to make or assist decisions that may significantly affect you, we will provide information about this as required by law.

4. Sharing your information

We may share your information with Group members and third-parties where permitted or required by law, or for any of the purposes mentioned in section 3.

Third-parties include, but are not limited to:

• Your co-applicant(s) (if any) and guarantors, or any person providing security for any service or product we provide;
• Funders, investors, rating agencies, auditors, advisers and other professional service providers;
• Service providers that help us provide, administer, support and improve our products and services, including identity verification providers, marketing providers, mailing houses, call centre operators, IT and software providers, payment processors, debt recovery agents, law firms, market research / data providers and dispute resolution services;
• Loyalty program operators, rewards partners, gift card and payment fulfilment providers, referral partners and promotional partners that help us administer rewards, referral programs, partner benefits and promotional campaigns;
• Brokers, introducers, aggregators, agents, advisers and other persons acting on your behalf, such as guardians or persons holding power of attorney;
• References that you provide to us, for example landlord details or trade references;
• Other financial institutions, payment providers, processors, gateways, card schemes, banking partners and their authorised representatives, including to process transactions, verify payment details, manage settlement, investigate disputes, prevent fraud and comply with legal and regulatory obligations;
• Employers or former employers;
• Recruitment agencies and partners assisting with recruitment and background checks;
• Government and law enforcement agencies or regulators;
• Credit reporting bodies;
• Third parties that provide identity verification services on our behalf, including by comparing information you provide with information held by government agencies, credit reporting bodies and other authorised sources where permitted by law (such as name, address, date of birth, unique identifiers and identity document details);
• Entities established to help identify illegal activities and prevent fraud;
• Third-parties, on a strictly confidential basis, in connection with an actual or proposed sale, transfer or restructure of our business or assets; and
• Any other parties that you authorise or that we are required or permitted by law to share information with.

4.1 Information sharing with an introducer

If you were introduced or applied to us through a partner, broker, referral partner, aggregator or other agent, we may receive personal information about you from them and will use that information to assess applications, manage products and services, verify identity, meet legal obligations and communicate with you about products or services you have requested. We will provide them with information about each application you make with us and each product or service which we provide to you. Your account will be linked to that agent, and we will continue to provide them your information for each application or request you make with us whether that application or request is made through that agent or direct with us. If you do not wish us to provide your information to the agent, you must advise us by contacting us using the details set out in section 8.

4.2 Overseas disclosure

We use customer service teams located in Australia, New Zealand and the Philippines. We may send your information overseas, including to overseas Group members and to service providers or other third-parties who operate or hold data outside Australia and New Zealand. Where we do this, we take reasonable steps to ensure that appropriate data handling and security arrangements are in place.

Where we send your information overseas, it is likely to be to countries where our Group members, service providers, technology providers, payment providers, rewards and fulfilment partners, or other third parties operate or hold data. These countries may include Canada, Hong Kong, India, the Philippines, Fiji, Singapore, Vietnam, the United Kingdom and/or the United States of America.

5. Credit reporting policy

If you apply to us for credit or propose to act as a guarantor, we need to assess your ability to meet repayments under your agreement with us. We also aim to avoid offering you further credit if doing so would put you in financial difficulty. As part of this assessment, we may obtain a credit report about you.

5.1 Credit reports

A credit report contains information about your credit history that helps credit providers assess your credit applications, verify identity and manage accounts. Credit reporting bodies collect and share this information with credit providers like us.

Credit reports may include information such as:

• Types of credit accounts held or applied for;
• Credit limits;
• Payment history;
• Public record information (e.g bankruptcies, court judgements).

We also request a creditworthiness score and other comprehensive credit information from credit reporting bodies as needed.

In addition, we may perform soft credit checks to provide tailored rate offers or for related purposes. These checks do not affect your credit score.

Applicable privacy and credit reporting laws regulate the types of information credit providers can disclose to credit reporting bodies or credit reporters, and how credit reports and credit-related information may be used.

We may use one or more of the following credit reporting bodies:

5.2 Information shared with credit reporting bodies

If you are in Australia, we may share the following information with credit reporting bodies:

• Your identification details;
• The type of credit products you have or enquired about;
• The amounts you have borrowed or enquired about;
• The number of credit accounts you currently hold or have held;
• Your repayment history, including whether you have met your scheduled repayment obligations; and
• Any serious credit infringements (such as fraud).

If you are in New Zealand, we may share credit information with credit reporters and request an overall assessment of your creditworthiness, in accordance with applicable laws and credit reporting requirements.

Credit reporting bodies will hold your personal information in accordance with their own terms and privacy policies.

5.3 Use of credit-related information

We use credit-related information obtained from credit reporting bodies to:

• Confirm your identity;
• Assess applications for commercial credit;
• Provide quotes;
• Manage our relationship with you;
• Protect our legitimate interests; and
• Collect overdue payments.

We also use this information to support our internal assessment of your creditworthiness.

Credit-related information is stored alongside your other personal information and may be combined with other insights, such as risk ratings and credit scores, as outlined in section 3.

We may disclose credit-related information to:

• Other Group members;
• Debt collection agents;
• Your guarantors;
• Our external dispute resolution scheme;
• Government and law enforcement agencies or regulators;
• Any other parties you authorise or that we are required or permitted by law to share information with.

You may access credit-related information we hold about you, request corrections, or make a complaint as set out in section 8 of this policy.

5.4 Other rights you have

Credit providers may ask credit-reporting bodies to use your credit-related information to pre-screen you for direct marketing. You can request that credit reporting body do not use your information for this purpose.

If you believe you are, or are likely to become, a victim of fraud (including identity theft), you can ask the credit reporting body not to use or disclose the credit-related information it holds about you.

6. Keeping your information secure

We store your records, both hard-copy and electronic on our premises, systems, or offsite using trusted third-party providers. Whilst we take reasonable steps to protect your personal information, no system can guarantee absolute security. Our security safeguards include:

• Staff training and awareness;
• Secure data handling practices;
• Security protocols for sending information overseas or to third-parties;
• Encryption and other technical measures.

You are responsible for keeping your log-in details private and secure. Do not share your login credentials with anyone.

We maintain records of consents, permissions, communication preferences and other authorisations or interactions relevant to our collection, use and disclosure of personal information. This may include details of when and how consent was obtained, preferences were updated, or instructions were provided to us. We may use these records to demonstrate compliance with our legal and regulatory obligations, manage your preferences, resolve disputes and respond to requests or complaints.

7. Accessing, updating and correcting your information

7.1 Access to information

You can access your basic account information (such as transaction history) via Prospa Online, the Prospa App or by calling us. To obtain a copy of current credit-related information we hold about you, please contact us by phone or email using the details in section 8.

7.2 Information access fee

There is no fee for making an initial request. However, in some cases, where permitted by law, we may charge an access fee to cover the time and resources required to locate, compile, and explain the information you’ve requested. If a fee applies, we’ll provide an estimate upfront and confirm whether you’d like us to proceed. Access charges are generally based on an hourly rate plus any photocopying, reproduction or other out-of-pocket expenses. Payment must be made before we begin, unless you’ve authorised us to debit your account.

In certain circumstances, we may deny or limit access to information, for example, where information is commercially sensitive. If we do so, we’ll provide written reasons for our decision.

7.3 Correction requests

It’s important that we hold accurate and up to date information about you, such as your current address and contact details. You can check or update your information online, by email or by phone.

You may also request that we hold or have disclosed to others (including credit-related information). If the corrected information has been shared with third parties, you may ask us to notify them of the correction. If your request relates to credit-related information provided by others, we may need to consult with credit reporting bodies or other credit providers.

If we agree to make a correction, we’ll notify you once it’s complete. No fee applies to correction requests.

If we do not agree that the information should be corrected, we’ll explain our reasons in writing. You may then request that we include a statement with the relevant information, indicating your view that the information is inaccurate, misleading, incomplete, irrelevant or out-of-date. We will take reasonable steps to comply with such a request.

We aim to respond to access or correction requests within 20 business days and complete the process within 30 business days. If we’re unable to meet this timeframe, we’ll notify you within 20 business days and work with you to extend the period.

8. Contacting us or making a complaint

For privacy related queries including access and correction requests, complaints, requests for a printed version of this policy, or to opt out of direct marketing, please contact us using the details below.

We’ll review your situation and aim to resolve it promptly. If we’re unable to provide a final response within 30 business days, we’ll contact you to explain the delay and discuss a revised timeframe for resolution.

9. External review of privacy complaints

If you’re not satisfied with how we’ve handled your matter, you may refer your complaint to the external dispute resolution scheme or government body listed below. We recommend doing so only after you’ve followed our internal complaint process outlined above.

10. Amendments to this Privacy Policy

We may update this Privacy Policy at any time by amending existing terms, adding new terms or replacing it with a new version. We will notify you of any changes by publishing the updated Privacy Policy on our websites: www.prospa.com and www.prospa.co.nz. Changes take effect from the date they are published on the website. By continuing to use our products or services after that date, you will be deemed to have accepted the updated Privacy Policy.

Last updated – August 2026