This Privacy Policy (Policy) (including any Disclaimers and Terms and Conditions) explains how Resimac Financial Services Limited and its related entities (Resimac) (Us, we, our) handle personal information in accordance with the Privacy Act 2020 (Act).

This Policy sets out our privacy commitments in respect of personal information (including credit information) that may be provided to us, including in connection with the use of our website (www.resimac.co.nz) and related websites that reference this Policy. You may request a copy of this Policy in an alternative form without charge.

This Policy is governed by the laws of New Zealand.

Resimac Financial Services Limited and its related entities (Resimac) operate in New Zealand and Australia.

In New Zealand, Resimac manages and services an existing loan portfolio. This includes activities such as administering loan facilities, processing variations, top-ups or restructures, managing repayments, and undertaking related compliance and customer support activities. This privacy policy also explains how we collect, use and share and protect personal information in connection with those activities, and the rights individuals have in relation to their information.

When we refer to personal information, we mean information or an opinion about an identifiable individual, or information from which an individual can reasonably be identified.

The kinds of personal information we may collect include (but are not limited to):

• name and contact details
• date of birth and identification information
• employment details and income information
• information about assets, liabilities and expenses
• information relating to existing loan facilities; and
• certain sensitive information where required and permitted by law

Credit information is a subset of personal information that relates to an individual’s existing credit facilities

We may collect and use credit information where reasonably necessary to manage, administer, or assess existing loan facilities, including variations, top-ups or restructures, or to meet legal and regulatory obligations.

Credit information may include details about existing credit facilities, repayment history, or defaults. Credit information is commonly exchanged between lenders and credit reporting bodies in accordance with applicable laws.

Due to the nature of the services we provide, some of the information we collect may be sensitive information, such as information relating to health or ethnic background.

It is not our usual practice to collect other forms of sensitive information (for example, information about religion, political opinion, trade union membership, sexual orientation, or criminal history), and we will only do so where required for one or more of our functions or activities.

Sensitive information will only be collected with consent or where otherwise required or authorised by law.

We collect personal information directly from you when you contact us, update your details, request changes to an existing loan, submit an enquiry or complaint, or otherwise interact with us in connection with your existing relationship with Resimac.

This may occur when you:

• contact us in relation to an existing loan or account;
• update your personal or financial details;
• request or discuss a variation, top-up, restructure or other change to an existing loan;
• submit an enquiry or complaint;
• apply for employment with us; or
• otherwise interact with us in connection with your relationship with Resimac

In most cases, we collect personal information directly from you. In some situations, we also receive personal information from trusted third parties.
‍

In some circumstances, we collect personal information about individuals from someone other than the individual concerned. This may occur, for example, where information is provided by a mortgage broker or adviser in connection with a variation or top-up to an existing loan, or from guarantors, professional advisers, insurers, credit reporting bodies, government agencies, or other authorised representatives.

‍

• the fact and purpose of collection;
• our identity and contact details
• the types of entities the information may be shared with;
• any law authorising or requiring the collection (where applicable); and
• their rights to access and correct their information.
• otherwise interact with us in connection with your relationship with Resimac

Where we collect personal information indirectly, we take reasonable steps in the circumstances to ensure individuals are made aware of:

‍

This Privacy Policy operates alongside specific notices and disclosures provided to individuals where required, including disclosures that explain our indirect collection practices.

‍

We maintain an Indirect collection source schedule describing common third-party sources and collection purposes. This schedule is available on request by contacting us using the details below.

‍

The current Indirect collection source schedule is available to download here or on request by contacting compliance@resimac.com.au

We use personal information for purposes including:

• managing and administering existing customer relationships and loan facilities
• processing variations, top-ups or restructures to existing loans
• verifying identity and meeting legal and regulatory obligations
• communicating with customers and responding to enquiries or complaints
• enforcing contractual rights and managing credit risk
• governance, audit, compliance and risk management; and
• operating and improving business systems and controls.

‍

We do not use personal information for unrelated secondary purposes unless permitted or required by law, or with the individual’s consent where applicable.

We may disclose personal information where reasonably necessary for the purposes described in this Privacy Policy, including to:

• related Resimac group entities
• service providers and professional advisers (such as legal, audit, IT and data storage providers)
• regulators, government agencies, insurers, trustees and auditors
• credit reporting bodies (such as Equifax); and
• other parties involved in servicing, administering, or enforcing existing loan arrangements.

‍

We do not sell personal information.
‍
We only disclose personal information where disclosure is permitted or required by law, or where it would be reasonably expected in connection with our relationship with you

We may collect and exchange credit information about you with credit reporting bodies (CRBs) where reasonably necessary to manage or administer existing loan facilities, assess credit risk, or meet legal and regulatory obligations.

‍

The credit information we exchange may include information about existing credit facilities, repayment history, or defaults.

‍

Credit reporting bodies may include this information in reports they provide to other credit providers to assist them in assessing creditworthiness, in accordance with applicable laws.

We are required to verify the identity of individuals in accordance with the Anti-Money Laundering and Countering Financing of Terrorism Act 2009 and associated regulations.

‍

To meet these obligations, we may collect and use identification information and may disclose personal information about you to third-party organisations, including credit reporting bodies (CRBs), mortgage insurers, government agencies, or identity verification service providers, for the purpose of verifying your identity. This may include online or electronic verification processes.

‍

Where personal information is disclosed for identity verification, the organisation conducting the verification will provide us with a report indicating whether the information you have provided matches information held by them. If we are unable to verify your identity using these methods, we will let you know.

‍

We may also verify your identity by matching information from identification documents (including, but not limited to, your passport, driver licence, citizenship certificate, birth certificate, or other official identification documents) against relevant government or official registries using third-party systems, and by recording the result of that matching.

‍

In some circumstances, and with your express consent, we may verify your identity using the New Zealand and Australian Document Verification Service (DVS). Our use of the DVS may involve third-party systems and services. The DVS verifies supplied information by checking it against information held by the agency that originally issued the relevant document (the Official Record Holder). You may withdraw your consent for DVS verification at any time by contacting us at compliance@resimac.com.au

‍

Identity verification may occur at the start of a relationship and, where required by law or regulators, may also occur on an ongoing basis during the life of a loan or account, including where enhanced customer due diligence or additional verification is required.

‍

Third-party verification providers may retain details of identity matching results in accordance with their own data retention policies, but do not use personal information provided for purposes other than carrying out the verification process and advising us of the outcome.

‍

If you do not provide information requested for identity verification, or if we are unable to verify your identity, we may be unable to provide certain services, process requests, or continue to administer an existing loan or account.

We may disclose personal information to overseas entities that provide support services to us, including entities located in Australia and the Philippines.

‍

Before disclosing personal information overseas, we take reasonable steps to ensure the recipient protects the information in a way that is comparable to the protections required under New Zealand privacy law, or where disclosure is otherwise permitted by law or with consent where required.

When you visit our website, we also use standard website technologies to support functionality and improve user experience.

‍

We may use cookies to collect information about how visitors use our website, which helps us understand traffic patterns and tailor content. Cookies do not identify individuals personally.

‍

We may also use analytics tools (such as Google Analytics) to help measure and analyse website usage. You can adjust your browser settings to refuse cookies if you prefer, although this may affect website functionality.

From time to time, we may use personal information to provide information about products or services that may be relevant to your existing relationship with us, where permitted by law.

‍

You can opt out of receiving marketing communications at any time using the contact details below. We will not charge you for giving effect to an opt-out request and will take reasonable steps to action it promptly.

‍

We do not use or disclose sensitive information for direct marketing purposes without express consent.

‍

If you do not wish to receive marketing information, you can opt out by emailing us at marketing@resimac.co.nz or by phoning us on 0800 38 48 58.

‍

We will not charge you for giving effect to your request and will take all reasonable steps to meet your request at the earliest possible opportunity.

In addition, only authorised personnel have access to personal information. Such personnel have agreed to ensure confidentiality of this information and to comply with the Act.

‍

Your personal information may be held by us in paper form, electronic form, on our secure servers or in cloud storage. Your personal information may be combined or linked with personal information held about another individual (i.e. where a loan is held in joint name).

‍

We regularly review developments in security and encryption technologies. Unfortunately, no data transmission over the internet can be guaranteed as totally secure.

‍

We take reasonable steps to preserve the security of cookie and personal information in accordance with this Policy. If your browser is suitably configured, it will advise you whether the information you are sending us will be secure (encrypted) or not secure (unencrypted)

We retain personal information only for as long as it is required for a lawful business purpose or to meet legal or regulatory requirements.

‍

When personal information is no longer required, it is securely destroyed or de-identified in accordance with applicable requirements.

Individuals have the right to access and request correction of their personal information held by us.

‍

Requests can be made by contacting us using the details below. We will respond within the timeframes required by law.

If you have a complaint or concern about how we handle personal information, please contact our Privacy Officer using the details below.

‍

If you are not satisfied with our response, you may make a complaint to the New Zealand Privacy Commissioner.

Resimac
110 Carlton Gore Road, Newmarket, Auckland 1023
P: 0800 38 48 58
E: compliance@resimac.com.au

‍

If a dispute arises between us and we cannot resolve it with you, then you may wish to contact the Privacy Commissioner on investigations@privacy.org.nz

We regularly review our policies to ensure they remain up to date with changes in law, technology, market expectations, and industry practices.

As a result, this Privacy Policy may be updated from time to time. The current version is available on our website or by contacting us using the details above.

This Privacy Policy was last updated on 1 May 2026 and supersedes any policy previously published.