Privacy Policy

Last updated: March 2026

1. Introduction

Buyvest Pty Ltd (ACN 684 841 496) ('Buyvest', 'we', 'us' or 'our') understands the importance of protecting your personal information. This privacy policy governs the collection, use, storage, and disclosure of your personal information by Buyvest, its related entities, subsidiaries, employees, contractors, and the brokers that assist you.

Buyvest is an Authorised Credit Representative (Credit Representative Number 567392) of Connective Credit Services Pty Ltd (Australian Credit Licence 389328).

This privacy policy outlines our approach to respecting your rights to privacy in accordance with the Australian Privacy Principles (APPs) set out in the Privacy Act 1988 (Cth) (the 'Privacy Act'). Under the Privacy Act, we are required to make you aware of the following matters, and this policy incorporates our Privacy Collection Statement:

• Our identity and contact details.
• The facts, circumstances, and purposes of the collection of personal information.
• The consequences for you if personal information is not collected.
• Other entities, bodies, or persons to whom personal information is usually disclosed.
• Information about how to access, correct, and complain about the handling of your personal information.

By providing personal information to us, you consent to our collection, use, and disclosure of your personal information in accordance with this privacy policy and any other arrangements that apply between us. We reserve the right to update this policy from time to time by posting changes on our website. We encourage you to review this policy periodically.

2. Types of personal information we collect

2.1 Personal information

When we refer to 'personal information', we mean information or an opinion about an identified individual, or an individual who is reasonably identifiable. Personal information we hold may include (without limitation):

• Your name, age, or date of birth.
• Current and previous addresses.
• Telephone, mobile phone number, and email address.
• Bank details and financial information.
• Professional job title or occupation.
• Driver's licence number and passport details.
• Details of products and services you have acquired or enquired about, and any additional information necessary to deliver those products and services.

2.2 Credit information

Personal information may also include credit information, which is a subset of personal information used to assess your eligibility for financial services. This may include any outstanding finance, your repayment history, and any defaults. Credit information is typically exchanged between credit and finance providers and credit reporting bodies (CRBs). 'CRB Derived Information' means personal information derived by a CRB from credit information that has any bearing on an individual's creditworthiness.

2.3 Information about third parties

You may need to provide personal information about other individuals, such as joint applicants, co-applicants, guarantors, authorised representatives, or the contact details of your accountant or solicitor. If so, we rely on you to inform those individuals that you are providing their information to us, to ensure they consent to their information being shared, and to advise them of this policy.

2.4 Sensitive information

We will only collect sensitive information (such as health information, religious beliefs, or criminal records) where it is reasonably necessary for our functions or activities and either you have consented to the collection, or we are required or authorised by law to collect it.

3. How we collect personal information

We may collect personal information in various ways, including:

• Directly from you — for example, when you provide information by phone, in application forms, through our website, or during any interaction with us.
• From your joint applicants, co-applicants, or guarantors.
• When you visit our website or interact with our digital platforms.
• From your representatives, such as solicitors, conveyancers, builders, and agents.
• From referral partners who refer your business to us.
• From third-party sources, such as suppliers, social media platforms, or other third-party integrations.

If you would like a list of these entities or sources, or you would like to be removed from our call or email lists, please contact us at hello@buyvest.com.au.

If you give us personal information about another person, you represent that you are authorised to do so, that you have obtained that person's consent, and that they are aware of this policy.

3.1 Information we automatically collect

We also automatically collect certain technical data sent from the computer, mobile device, or browser through which you access our website ('Automatic Data'). Automatic Data may include your Internet Protocol (IP) address, device and browser characteristics, statistics on your activities on the website, details of any services we have provided or you have enquired about, and information about how you arrived at our website. We collect Automatic Data based on your consent, granted when you accepted this privacy policy or our cookie settings.

4. How we use your personal information

We use your personal information to:

• Conduct our business and provide services to you — for example, assessing whether you qualify for a loan.
• Complete a transaction to which the provision of personal information relates, such as completing loan application forms.
• Communicate information about our products and services.
• Fulfil internal administrative, marketing, planning, product development, and research requirements.
• Update a third-party referrer on the outcome of your loan for commission purposes.
• Comply with our legal and regulatory obligations.

At any time, you may opt out of receiving marketing communications from us (other than communications required for the operation of our business). To opt out, contact your broker, email hello@buyvest.com.au, or use the unsubscribe link included in our marketing emails.

5. To whom we disclose your personal information

We may disclose personal information for the purposes described in this policy to:

• Our employees, contractors, and related bodies corporate.
• Our brokers, approved panel of lenders, service providers, and agents used in the ordinary operation of our business.
• Third-party suppliers and service providers, including providers for the operation of our website, cloud storage, CRM systems, email platforms, and other business tools.
• Professional advisers, dealers, and agents.
• Payment systems operators.
• Our existing or potential agents, business partners, or joint venture partners.
• Sponsors or promoters of any competition we conduct via our services.
• Any party to whom our assets or businesses (or any part of them) are transferred or proposed to be transferred (see Section 10 below).
• Specific third parties authorised by you to receive information held by us.
• Government agencies, regulatory bodies, and law enforcement agencies, as required, authorised, or permitted by law.

We are a contractor network, and your personal information may be disclosed between Buyvest and its brokers within the group to facilitate a transaction or to enable us to conduct our business. Third parties to whom we disclose your information are contractually prohibited from using it for any purpose other than the specific purpose for which it was disclosed.

6. Purposes of disclosure

We will only use and disclose your personal information for the purposes for which we collected it, including:

• Assessing whether you qualify for a loan and assisting you in locating a suitable loan.
• Internal or administrative purposes, such as data processing, printing, or mailing.
• Updating the referrer of your loan with the general progress of your loan (excluding any sensitive information).
• Providing other financial services that we offer and that you may require.
• Enabling you to access and use our website and purchase our products or services.
• Operating, protecting, improving, and optimising our business and website, including performing analytics and conducting research.
• Sending you service, support, and administrative messages, reminders, technical notices, updates, security alerts, and information you have requested.
• Sending you marketing and promotional messages, including on behalf of our business partners, where you have not opted out of receiving such communications.
• Administering rewards, surveys, contests, or promotional activities.
• Complying with our legal obligations, resolving disputes, and enforcing our agreements.

We do not disclose personal information unless it is for a purpose stated above, you have consented, or we are required to do so by law or regulation.

7. Access to and correction of your personal information

At any time, you may request that we provide you with a list of the personal information we hold about you, along with copies of that information. We will endeavour to provide you with the data within 30 days of receiving your request. We may charge a reasonable fee to cover administrative costs. In some cases, we may not be able to provide access (for example, where access would unreasonably impact the privacy of others, or where we are legally prevented from doing so), and we will inform you of the reason.

If you believe we are holding inaccurate or incomplete data about you, you may ask us to correct it. If we do not agree that amendment is required, we will add a note to the information stating that you disagree with it.

We may need to verify your identity before processing any access or correction request.

8. Data retention

We will retain your personal information for as long as it is needed to fulfil the purposes for which it was collected, or as required by law. As a general guide, we retain personal information related to loan applications and financial services for a minimum of seven (7) years after our last interaction with you, in line with our legal and regulatory obligations.

Financial information becomes outdated quickly; therefore, we will update it as required in any future dealings with you. When we no longer require your personal information and are legally permitted to do so, we take reasonable steps to destroy it or remove identifying features. Where it is impossible or impractical to completely isolate and remove all traces of your information, we may store it securely for future use (for example, to resolve disputes or assess future applications). The same security safeguards described in this policy will apply.

9. Transfer of information overseas

To complete our services, we may transfer personal information to an entity in a foreign country, but only where permitted under the Australian Privacy Principles of the Privacy Act 1988 (Cth). Some external organisations may be located outside Australia and, although they may be subject to confidentiality or privacy obligations, they may not always comply with the specific requirements of Australian privacy laws. Organisations may be required to disclose information under a foreign law, and in those instances, we will not be responsible for that disclosure.

We do not utilise offshore personnel for marketing or sales purposes. We will not share any of your credit information with a credit reporting body unless it has a business operation in Australia.

10. Business transfers

In the event that Buyvest or its assets are acquired, merged with another entity, restructured, or wound up, your personal information may be transferred to the acquiring or successor entity as part of the transaction. We will take reasonable steps to ensure that any such transfer is conducted in accordance with the Privacy Act and that the recipient is bound by obligations at least as protective as those in this policy. Where practicable, we will notify you in advance of any such transfer.

11. How we store and protect your personal information

Buyvest takes reasonable steps to protect your personal information from misuse, loss, unauthorised access, modification, or disclosure. Our security measures include:

• Confidentiality requirements for our employees and contractors.
• Document storage security policies.
• Security measures for access to our systems, including password protection with multi-factor authentication.
• Controlled access to personal information on a need-to-know basis.
• Physical access controls to our office premises.
• Electronic security systems, including firewalls and data encryption.

We may store your information in cloud-based or networked electronic storage. As such storage can be accessed from various locations via the internet, it is not always practicable to know in which country your information may be held.

While we take protecting your information seriously, we cannot guarantee its absolute security. We regularly review developments in security and encryption technologies. It is important to remember that the use of email and the internet may not always be secure, even with these safeguards in place.

12. Notifiable Data Breaches

We comply with the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act 1988 (Cth). We have a data breach response plan in place to enable us to contain, assess, and respond to suspected data breaches in a timely manner.

If we become aware of a data breach that is likely to result in serious harm to any individual whose personal information is involved, we will:

• Take reasonable steps to contain the breach and mitigate potential harm.
• Assess the breach to determine whether it is likely to result in serious harm.
• Notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required under the NDB scheme.

13. Cookies and tracking technologies

13.1 Cookies

A 'cookie' is a small text file placed on your device by a web server. We use cookies and similar tracking technologies on our website to provide you with a better experience. When you visit our website, our systems may record your IP address, the date and time of your visit, the pages you view, and any information you download.

You can configure your browser to refuse cookies or delete existing cookies. Rejecting cookies may limit access to or functionality of certain parts of our website.

13.2 Analytics and advertising technologies

We may use third-party analytics and advertising tools on our website, which may include (without limitation):

• Google Analytics — to analyse website traffic patterns, user behaviour, and site performance.
• Meta (Facebook) Pixel — to measure the effectiveness of our advertising campaigns and deliver targeted advertisements.
• Google Ads remarketing — to show you relevant advertisements on third-party websites based on your previous visits to our website.

These tools may use cookies, web beacons, and similar technologies to collect information such as the server your device is connected to, your browser type, pages visited, and the date and time of your visit. This information is used to report statistics, analyse trends, diagnose problems, administer our services, and improve the quality of our products and services.

You may opt out of personalised advertising through the settings of your Google Account, Facebook Account, or by using the Digital Advertising Alliance's opt-out tool at youradchoices.com.au.

13.3 Advertising on third-party websites

We may advertise on third-party websites. When you view our advertisements, the advertising company may use cookies to collect information about your interaction with the advertisement and our website. We do not control these third-party cookies and recommend that you review the privacy policies of the relevant third-party platforms.

14. Children and minors

Our services are not directed at individuals under the age of 18. We do not knowingly collect personal information from minors. If we become aware that we have inadvertently collected personal information from a person under 18 without appropriate parental or guardian consent, we will take reasonable steps to delete that information as soon as practicable. If you believe we have collected information from a minor, please contact us immediately at hello@buyvest.com.au.

15. Complaints and dispute resolution

15.1 Internal complaints

We have a formal procedure for handling privacy complaints. If you are dissatisfied with how we have handled your personal information, please contact us using the details in Section 16 below. We will acknowledge your complaint and investigate it promptly.

15.2 External dispute resolution

If you are not satisfied with our response, you may lodge a complaint with:

Time limits may apply to complaints to AFCA. You should act promptly or consult the AFCA website to determine relevant time limits.

16. Contacting us

You can make any requests relating to your personal information or any complaints regarding the treatment of your privacy by contacting us at:

End of Privacy Policy