Version NZ-2026-3

1. Introduction: We recognise that your privacy is very important to you, and this Privacy Policy has been prepared in accordance with applicable laws. By accessing or using the Website or Services, you agree to be bound by this Privacy Policy, and you authorise and consent to us collecting, using, disclosing, and holding personal information about you in accordance with the terms of this Privacy Policy. This Privacy Policy is not intended to cover categories of information that are not governed by the Privacy Act or the Privacy Code.
2. What kinds of personal information we collect: We may collect personal information about you including, but not limited to:
   1. your identity and contact details, such as your name, email address, residential and business addresses, and contact telephone numbers;
   2. information to verify your identity, such as your identity documents, government identifiers, and memberships with professional bodies;
   3.  security information;
   4.  information about your credit requirements;
   5.  information about your credit history, credit accounts, credit that may have been extended to you, your repayment history, and any fines you have been ordered to pay (see below);
   6. information about your current or previous employment, income, assets, expenses, bank accounts and transactions, and other financial and personal circumstances, at the time that you request a Quote from us, or submit a Loan Application to us, and during the term of any Loan provided to you by us;
   7.  your IRD number and tax status;
   8. your transaction and Services history with us;
   9.  where you are seeking credit to purchase a vehicle, information about the vehicle, your driver licence status, ownership of the vehicle, security interests in the vehicle, and insurance related to the vehicle; and
   10. other information, where relevant (for example, health and medical information in support of a hardship application). 
       
3. Collecting personal information directly from you: We collect personal information directly from you when you interact with us through the Website (particularly when you create an Account, request a Quote, or submit a Loan Application) or by other means (such as when you contact us with an enquiry, or participate in promotions we offer through this Website or elsewhere). Whenever you use the Website, we use cookies to collect information about you such as the date, time and duration of your visit, your IP address, domain, locality, server, operating system, browser, search terms you used to find our Website or entered on our Website, pages and links you accessed and buttons clicked on our Website and on other websites, the last website you visited, and the referral source that brought you to our Website.
4. Where we indirectly collect personal information about you:
   1. If you use our Services, we may collect credit information about you from credit reporters, including:
      •    Centrix Group Limited and/or Centrix Data One Limited, whose website is centrix.co.nz; and
      •    Equifax Pty Ltd, whose website address is equifax.co.nz.
      By requesting a Quote or submitting a Loan Application, you authorise and consent to us obtaining credit information about you from a credit reporter to confirm your identity, verify your current credit obligations, help us assess your ability to meet repayment obligations and make credit decisions, and to provide you with quotes for the cost of credit.
   2. If you use our Services, we may also collect personal information about you from:
      1. your current or previous employers, business partners, accountants, lawyers, referees, banks, insurers, landlords, guarantors, co-borrowers, and financial advisers, including:
         • via Akahu Technologies Limited, whose website address is akahu.co.nz; and/or
         • via illion Open Data Solutions Pty Ltd, whose website address is bankstatements.com.au;
      2. other third parties with whom you may have had dealings, such as professional organisations, service providers, utility providers, and card schemes;
      3. credit reporters;
      4. identification service providers, including:
         • the Department of Internal Affairs, whose website address is dia.govt.nz;
         • via Frankie Financial Pty Ltd, whose website address is frankieone.com;
         • the NZ Transport Agency Waka Kotahi, whose website address is nzta.govt.nz; and
      5. publicly available sources of information, such as social media platforms;
      6. your executors, administrators, or persons purporting to represent you or act on your behalf (whether or not holding Powers of Attorney), including:
         1. Financial Services Complaints Limited, whose website address is fscl.org.nz;
      7. our agents or service providers, such as debt collection agencies, introducers, professional advisers, direct debit companies, and private investigators;
      8. public and subscribed databases;
      9. any person we consider necessary to carry out your instructions;
      10. regulators, government authorities, courts, and the Police, including:
          • the Ministry of Business, Innovation and Employment (Immigration New Zealand), whose website address is immigration.govt.nz; and
          • fines information from the Ministry of Justice, whose website address is justice.govt.nz;
      11. anyone else you agree (whether expressly or impliedly); and
      12. where you appoint an agent (such as a broker) in connection with our Services, you also authorise and consent to us obtaining personal information about you from your agent.
   3. If you give us access to your internet banking, we or our service provider may access personal information about you from your nominated banks, including by using automated technology. You authorise and consent to our ongoing access to this information for the term of your relationship with us, and for the purposes outlined in this Privacy Policy. Before giving us access, you should check that  your banks’ terms of use allow you to do so.
   4. This Privacy Policy constitutes notice by us to you that we may collect personal information about you indirectly from the sources described in this clause 4 for the purposes described in clause 5. Those sources may have collected personal information about you directly from you and subsequently disclosed it to us.
      
5. Purposes for which we collect, use, disclose, and hold personal information about you: We collect, use, disclose, and hold personal information about you for our business purposes including, but not limited to:
   1. contacting you;
   2. responding to queries from you and others;
   3. providing you with information about us or our Services;
   4. assessing whether or not to provide you with our Services, such as evaluating your credit worthiness and your ability to repay amounts we may lend to you, and assessing your request for a Quote or submission of a Loan Application;
   5. establishing and verifying your identity, including checking your identity document information with the document issuer or official record holder via third-party systems;
   6. carrying out credit and other checks;
   7. providing you with our Services;
   8. managing our relationship with you;
   9. managing your scheduled repayments and one-off payments, including with direct debit companies;
   10. preventing and defending instances of fraud, unlawful conduct, and other risks to our business;
   11. internal and external dispute resolution, and assisting other credit providers with the same;
   12. dealing with serious credit infringement and assisting other credit providers to do the same;
   13. enforcing our rights, such as by undertaking debt collection, instituting legal action, enforcing our security interests, and assigning debts to third parties;
   14. undertaking securitisation activities and other activities relating to our funding and capital requirements;
   15. any specific purpose notified to you at the time the personal information is collected, or that you authorise or to which you consent;
   16. marketing products and services provided by us, Relevant Persons, and third parties, including inviting you to apply for new or further credit from us;
   17. compiling statistical data, such as credit scoring information;
   18. complying with our legal obligations, and obligations under any codes of conduct with which we agree to comply;
   19. assisting government and law enforcement agencies or regulators;
   20. complying with our customer due diligence and other obligations under any anti-money laundering or countering financing of terrorism legislation;
   21. participating in credit reporting systems and providing information to credit reporters as permitted under the Privacy Act and Privacy Code;
   22. processing your information, including by the use of AI tools and personas, such as undertaking data categorisation, deriving other information from such processing, or to facilitate any of the uses or disclosures set out in this Privacy Policy;
   23. training, developing, and improving the AI tools and personas that we use;
   24. recording or storing your information, including electronically by means of any computer or other device, to facilitate any of the uses or disclosures set out in this Privacy Policy; and
   25. any other purpose permitted or required by law.
       
6. Holding personal information about you: We will hold hard copy and electronic records of personal information about you to facilitate any of the uses or disclosures set out in this Privacy Policy. Records will be kept on our premises and systems, or offsite (including online) with third parties. We will hold personal information about you only for as long as necessary to achieve the purpose for which we collected it, and in all cases for at least such periods as required by applicable laws.
7. Disclosing personal information about you to other parties:
   1. We may disclose personal information about you to Relevant Persons or third parties in New Zealand and overseas for any of the purposes set out in this Privacy Policy including, but not limited to, those third parties named in clause 4, and the following:
      1. co-applicants or potential co-applicants. In particular, if you request a Quote from us or submit a Loan Application to us jointly and severally with another party, each of you authorises and consents to us providing personal information about you to the other party, and that we may accept instructions from either of you in respect of personal information about you;
      2. any agent (such as a broker) you appoint in connection with our Services;
      3. credit reporters, including:
      4. illion Open Data Solutions Pty Ltd, whose website address is bankstatements.com.au;
         • identification service providers;
      5. your executors, administrators, or persons purporting to represent you or act on your behalf (regardless of whether they hold Powers of Attorney or not);
      6. our agents or service providers, such as debt collection agencies, introducers, professional advisers, direct debit companies, private investigators, market research and data analysis providers, mailing houses, call centre operators, and technology service providers;
      7. providers of AI tools and personas, and such AI tools and personas themselves where they could be deemed to be a third party or an agent of a third party;
      8. any person we consider necessary to carry out your instructions;
      9. regulators, government authorities, courts, and the Police;
      10. suppliers of goods and services which are financed with the proceeds of a Loan;
      11. third party creditors of yours who will be repaid with the proceeds of a Loan;
      12. other persons on whose behalf we as an agent;
      13. financial institutions, such as banks and credit providers;
      14. insurers, assessors, underwriters, brokers, and other distributors of insurance products;
      15. entities involved in our securitisation or other funding arrangements, such as trustees and financiers;
      16. our assignees, transferees, and potential assignees and transferees, of any or all of our rights or obligations (including under any Loan Contract), and any other entities who acquire or may acquire an interest in our business, including:
          • Quadrant Group (NZ) Limited, whose website address is quadrantgroup.co.nz; and
      17. anyone else you agree (whether expressly or impliedly), or to whom we are permitted or required by law to provide information.
   2. If you ask us to make a payment to an entity such as a retailer, bank, or financial institution, then we will provide personal information about you to that entity, and to other entities who process such payments. They are not our service providers, and we do not control how they handle personal information about you.
   3. Some recipients of personal information about you may be located overseas (for example, some Relevant Persons are incorporated in Australia, and we may employ service providers in Australia, Fiji, India, the Philippines, and Vietnam). Such recipients may not be subject to the Privacy Act or the Privacy Code, however, we require such recipients to adhere to reasonable standards of privacy, security, and confidentiality, and where practicable, to treat personal information about you in a manner consistent with the Privacy Act and the Privacy Code.
   4. We may disclose personal information about you to the credit reporters named in this Privacy Policy, such as the fact you have sought a quotation for the cost of credit from us, or made an application for a loan to us, information about your credit accounts (including credit limits and repayment history), credit defaults, credit infringement and credit non-compliance information, and updates of that information from time to time. Credit reporters may hold your information on their credit reporting database and use it for providing credit reporting services, including making this information available to other credit providers (or potential credit providers) and other persons who use the credit reporter's services, and for any other purpose permitted or required by law. In particular, Centrix will be collect, use and disclose your credit information in accordance with their Privacy Statement, and your rights of access to and correction of credit information held by Centrix is set out that Privacy Statement. We do not control how credit reporters handle personal information about you. You can find out more about credit providers’ obligations and your rights under the Privacy Code at the Office of the Privacy Commissioner.
   5. We may disclose personal information about you if we are required to do so under law, or if the disclosure is made in connection with the normal operation of our business in a way that you might reasonably expect (for example, the disclosure is incidental to technology services being provided to our business, in connection with any insurance or warranty claim, or for the resolution of a dispute).
   6. We and each third party referred to in this clause 7 are intended recipients of personal information about you. You authorise and consent to us and each third party referred to in this clause 7 collecting, using, disclosing, and holding personal information about you for any of the purposes set out in this Privacy Policy.
8. Marketing communications: By providing us with personal information about you, you also agree (in addition to the matters set out above) to us:
   1. using that personal information for the purpose of informing you about our products and services; and
   2. providing your information to Relevant Persons and third parties we have dealings with to market our products and services, or to market their products and services, to you.
      Any commercial electronic message that you receive from us or on our behalf will include an unsubscribe facility, so that you can remove yourself from any further commercial electronic messages. You may also contact us to remove yourself from our direct marketing list, and we will do so within a reasonable time.
9. Security: We use a range of physical and electronic security measures to keep personal information about you secure, such as the use of encryption for the transmission of certain data, firewalls, identity and access controls, and secured physical premises. We also maintain a security operations team, enforce information security policies with our personnel, and conduct training with our personnel on privacy and information security.
10. Privacy breaches: A privacy breach occurs where personal information is subject to unauthorised or accidental access, disclosure, alteration, loss, or destruction, or temporary or permanent inaccessibility. In the event of a privacy breach, we will assess and respond in accordance with our policies and procedures, which have been developed in accordance with guidance from the Office of the Privacy Commissioner and the requirements of the Privacy Act. We will notify you where a privacy breach may cause or has caused you harm.
11. Revoking your consents: You may revoke any authorisations or consents that you have given us under this Privacy Policy by emailing us at [email protected]. However, in revoking any authorisation or consent you acknowledge that:
    1. your revocation of any authorisation or consent is subject to any legal obligations that we must comply with, and that such revocation may therefore be ineffective or limited;
    2. where you have requested a Quote, submitted a Loan Application, or entered into a Loan Contract, your revocation of any authorisation or consent is subject to our rights or obligations in respect of such Quote, Loan Application, or Loan Contract, and that such revocation may therefore be ineffective or limited;
    3. subject to clauses (a) and (b), we will use our reasonable endeavours to cease collecting personal information about you;
    4. we may continue to use, disclose and hold personal information about you that we have already collected under your prior authorisations or consents, in accordance with this Privacy Policy. However, subject to clauses (a) and (b), where we no longer require such personal information, we will (at our election) delete such personal information, or undertake de-identification of such information so that it is no longer “personal information” for the purposes of the Privacy Act;
    5. we may not be able to provide you with certain information, products, or services that you are seeking from us (for example, you may be unable to create an Account, request a Quote, submit a Loan Application, or enter into a Loan Contract); and
    6. you must immediately cease to use our Website and/or Services. Subsequent use of our Website and/or Services will constitute a new agreement by you to be bound by this Privacy Policy, and a new authorisation by you for us to collect, use, disclose and hold information in accordance with the terms of this Privacy Policy.
       
12. Consequences of you not providing the personal information we require: If you do not provide us with all of the personal information we request of you, we may not be able to provide you with certain information, products, or services that you are seeking from us (for example, you may be unable to create an Account, request a Quote, submit a Loan Application, or enter into a Loan Contract).
13. How you can access or correct personal information about you: You may request access to the personal information about you that we hold, or that the personal information about you that we hold be corrected (by way of correction, deletion, or addition), whether it was obtained directly from you or indirectly from the sources described in clause 4, by emailing us at [email protected]. Any request for access or correction should be as specific as possible. We may require you to verify your identity prior to processing your request. We may refuse your request in certain circumstances allowed by the Privacy Act, however we will notify you of our reason, and advise what further steps you may take.
14. Deletion of personal information about you: You may request that we delete any or all of the personal information about you that we hold by emailing us at [email protected]. However, in making such request you acknowledge that:
    1. your revocation of any authorisation or consent to hold such personal information is subject to any legal obligations that we must comply with, and that such revocation may therefore be ineffective or limited;
    2. where you have requested a Quote, submitted a Loan Application, or entered into a Loan Contract, your revocation of any authorisation or consent to hold such personal information is subject to our rights or obligations in respect of such Quote, Loan Application, or Loan Contract, and that such revocation may therefore be ineffective or limited;
    3. subject to (a) and (b), we will use our reasonable endeavours to cease collecting personal information about you;
    4. we may continue to use, disclose and hold personal information about you that we already collected under your prior consents, in accordance with this Privacy Policy. However, subject to clauses (a) and (b), where we no longer require such personal information, we will (at our election) delete such personal information, or undertake de-identification of such information so that it is no longer “personal information” for the purposes of the Privacy Act;
    5. we may not be able to provide you with certain information, products, or services that you are seeking from us (for example, you may be unable to create an Account, request a Quote, submit a Loan Application, or enter into a Loan Contract); and
    6. you must immediately cease to use our Website and/or Services. Subsequent use of our Website and/or Services will constitute a new agreement by you to be bound by this Privacy Policy, and a new authorisation by you for us to collect, use, disclose, and hold information in accordance with the terms of this Privacy Policy.
       
15. AI: Our rights to collect, use, disclose, and hold personal information about you under this Privacy Policy extend to our use of AI tools and personas (such as chatbots or virtual assistants) to do the same, including where such AI tools and personas could be deemed to be a third party or an agent of a third party. We are committed to the responsible and compliant use of AI, and have implemented AI usage and governance policies.
16. No exclusions contrary to law: Nothing in this Privacy Policy operates to limit or exclude any liability, or to limit any rights you may have, to the extent that they cannot by law be limited or excluded.
17. Amendments: We may amend this Privacy Policy at any time by updating the Website. You should check the Website regularly. Any such amendments will apply from the date the Website is updated. By continuing to access the Website or Services, you will be deemed to have accepted such amendments.
18. Severability: The illegality, invalidity or unenforceability of any provision in this Privacy Policy will not affect the legality, validity or enforceability of another provision.
19. Assignment: You may not transfer or assign any of your rights or obligations under this Privacy Policy to any person. We may transfer or assign all and any of our rights and/or obligations under this Privacy Policy to any person, without requiring your consent. You agree that we may disclose all information we hold about you to any such person or intended person.
20. Jurisdiction: This Privacy Policy is governed by New Zealand law. The parties submit to the exclusive jurisdiction of the New Zealand courts. The Website may not comply with laws of other countries and should not be relied on by persons in countries other than New Zealand.
21. Interpretation: In this Privacy Policy:
    1. references to any party includes its permitted assignee or transferee, and any reference to us includes any back up servicer entity appointed to replace us;
    2. reference to the liability of a person include references to its liability under any cause of action, whether in contract, tort, or equity or under any enactment;
    3. references to any document (however described) are references to that document as modified, novated, supplemented, varied or replaced from time to time and in any form, whether on paper or in an electronic form; and
    4. a reference to any legislation is a reference to that legislation as amended or replaced from time to time, and includes any regulations or legislative instrument made under it.
       
22. Defined terms: In this Privacy Policy:

Account means an account by which you may access our Services.

AI means computer systems that do tasks that seem like intelligent behaviour, such as finding patterns, putting items into categories, or triggering actions based on information.

Centrix means Centrix Group Limited and/or Centrix Data One Limited.

credit information has the meaning set out in the Privacy Code.

credit reporter has the meaning set out in the Privacy Code.

Loan means any credit product provided by us from time to time.

Loan Application means an application for a Loan.

Loan Contract means the terms of the credit contract for a Loan, comprising a Loan Disclosure Statement, the Loan Contact Terms document, and a Vehicle Details Form (if applicable).

personal information has the meaning set out in the Privacy Act, and as used in this Privacy Policy, includes credit information.

Privacy Act means the Privacy Act 2020 (New Zealand).

Privacy Code means the Credit Reporting Privacy Code 2020 (New Zealand).

Quote means a quotation for the cost of credit, which may include the estimated loan amount, interest rate, and repayment amounts for a proposed Loan.

Related Company has the meaning set out in the Companies Act 1993.

Relevant Person means each of our Related Companies and any of our, or our Related Companies’, employees, directors, officers, agents, and contractors.

Service means any service provided by us through the Website from time to time, including the ability to request a Quote, submit a Loan Application, and review your Loans.

we, us or our means Harmoney Services Limited, having our physical address at Level 3, 110 Customs Street West, Auckland 1023, New Zealand.

Website means the website at harmoney.co.nz, or such other website or application as we or a Relevant Person may from time to time operate.

you or your means the person accessing or using the Website or any Service.