Consumer Data Right Policy.

Introduction and Purpose

Consumer Data Right (CDR) gives consumers greater choice and control over how certain information about them is shared. Under the CDR framework, consumers can choose to share eligible data with accredited organisations in a secure and standardised way.

Resimac participates in the Consumer Data Right (CDR) framework as a Data Holder. This Policy explains how Resimac manages Consumer Data Right information, including the collection, use, disclosure, correction and protection of Consumer Data, how consumers can manage their data sharing arrangements, and how consumers can make a complaint regarding the handling of Consumer Data.

Legislative and Regulatory Requirements

The CDR framework is established under Part IVD of the Competition and Consumer Act 2010 (Cth) and is supported by the Competition and Consumer Regulations 2010, the Competition and Consumer (Consumer Data Right) Rules 2020 and the Consumer Data Standards.

The framework is regulated by the Australian Competition and Consumer Commission (ACCC) and the Office of the Australian Information Commissioner (OAIC).

Scope

This Policy applies to Resimac Group Limited (ACL 247829) and participating Resimac Group entities operating under the Resimac and Homeloans.com.au brands within the Consumer Data Right framework.

References to "Resimac" throughout this Policy include those participating entities and brands. Resimac offers products and services through a number of brands, websites, customer channels and customer portals. Depending on the product held, customers may interact with different Resimac Group brands, websites or customer portals. Where those products participate in the CDR framework, this Policy applies to the handling and sharing of Consumer Data in relation to those products.

Certain Resimac Group entities and products are not currently subject to all Consumer Data Right data-sharing obligations. This Policy reflects Resimac's current obligations under the Consumer Data Right framework and will be reviewed and updated where those obligations change.

Types of CDR Data

Product Reference Data

Product Reference Data is information about products and services offered by Resimac that is made available in accordance with applicable Consumer Data Right requirements. This may include information about product features, pricing, fees, charges, eligibility criteria and other product-related information.
‍

Consumer Data

Consumer Data includes information associated with eligible accounts and products. Depending on the account and product type, this may include customer information, account information, balances, transaction information, direct debit information, scheduled payment information and other information required to be made available under applicable CDR requirements.
‍

Accessing your Consumer Data

You may request access to Consumer Data that Resimac holds about you. Requests can be made using the contact details provided in this Policy. Resimac will manage requests in accordance with applicable Consumer Data Right requirements and any relevant legal obligations.

How data sharing works

To share your Consumer Data, you must first provide consent to an Accredited Data Recipient (ADR).

Once consent has been provided, you will be redirected to Resimac to authenticate your identity and review the data requested. Resimac will then ask you to authorise disclosure of the requested data.

Once authorised, Resimac will securely disclose the approved Consumer Data to the Accredited Data Recipient in accordance with the CDR framework.

Data sharing arrangements remain active for the period authorised by the consumer, unless they expire or are withdrawn earlier.

Managing Data Sharing Arrangements

Consumers can manage their data sharing arrangements through Resimac's data-sharing dashboard. This includes viewing active arrangements and withdrawing authorisations previously provided to Resimac.

Consumers may withdraw their consent and authorisation to share Consumer Data at any time through the relevant customer dashboard or service channel. Data-sharing arrangements will remain active for the period agreed to by the consumer, unless withdrawn earlier or otherwise required by law to cease.

Joint Accounts

Additional requirements may apply where a request to share Consumer Data relates to a joint account.

Depending on the account type and applicable CDR requirements, approval from all joint account holders may be required before Consumer Data can be disclosed.

Resimac may notify joint account holders in relation to data sharing arrangements, including requests for approval, changes to an arrangement, withdrawal of authorisations and expiry of data sharing arrangements.

Privacy and Security

Resimac takes reasonable steps to protect Consumer Data from misuse, interference, loss and unauthorised access, modification or disclosure.

Consumer Data is managed in accordance with applicable privacy laws and Resimac's Privacy Policy. Further information about how Resimac collects, uses, stores and manages personal information can be found in Resimac's Privacy Policy, available on our website.

Consumer Data is retained in accordance with applicable legal, regulatory and operational requirements. Where Consumer Data is no longer required, Resimac will take reasonable steps to securely destroy or de-identify the information where required by law.

Resimac may engage appropriately authorised service providers to assist in fulfilling its Consumer Data Right obligations. Where Consumer Data is handled by a service provider on behalf of Resimac, Resimac remains responsible for ensuring the information is managed in accordance with applicable Consumer Data Right requirements.

Correcting Consumer Data

If you believe your Consumer Data is inaccurate, incomplete, out of date or misleading, you may request that Resimac correct the information.

Resimac will review the request and notify you of the outcome. Where appropriate, Resimac will correct the information or explain why a correction has not been made.

Complaints

If you have a complaint regarding Resimac's handling of CDR information, you may contact us using the details set out below.

Resimac will acknowledge and investigate complaints in accordance with its complaints handling procedures and policy which is available on our website. We will provide a response once our review is complete.

Further information about Resimac's complaints process is available in Resimac's Complaints Policy.

Email: customercare@resimac.com.au
‍Telephone: 1300 764 447
‍Mailing Address: PO Box H284, Australia Square NSW 1215

If you are dissatisfied with Resimac's response, you may be able to lodge a complaint with the Australian Financial Complaints Authority (AFCA) or the Office of the Australian Information Commissioner (OAIC).

AFCA can be contacted at:

Australian Financial Complaints Authority
Online: www.afca.org.au
Email: info@afca.org.au
Phone: 1800 931 678
Post: GPO Box, Melbourne, Vic 3001

The Commissioner can be contacted at:

Office of the Australian Information Commissioner
Online: www.oaic.gov.au
Contact us: www.oaic.gov.au/contact-us