Privacy Policy (Australia)

1. Our Commitment to Privacy

The Equifax group of companies in Australia (formerly the Veda group of companies) is an information services and aggregation business.  This Policy applies to Equifax Australia Holdings Pty Ltd and each of its Australian subsidiaries (‘Equifax’, ‘we’, ‘our’, ‘us’). A full list of the Equifax entities that provide services involving collecting, holding and disclosing personal information is accessible here. This Policy will apply to the entire Equifax group except for parts which are expressed to apply only to a specific entity within the Equifax group. We may also make available other privacy policies in relation to specific entities within the Equifax group, on the websites for the relevant businesses conducted by those entities. These policies will apply in conjunction with this Policy, which is to be read subject to them in respect of those entities.

We recognise that to run our businesses successfully we must maintain high standards when it comes to how we collect, hold, use and disclose personal information. We recognise your right to privacy and have established a number of protocols to help us keep the information we hold accurate, up-to-date and complete.

Much of the personal information collected and held by our business in Australia is covered by the Australian Privacy Principles (‘APPs’) under the Privacy Act 1988 (Cth) (the ‘Act’). This policy documents how we manage personal information and reflects our obligations under APP 1.3 to have a policy on this aspect of our business.

In addition, Equifax Australia Information Services and Solutions Pty Limited (‘EISS’) operates a credit reporting business in Australia.  For further information on how EISS handles credit reporting information to which Part IIIA of the Act applies, please refer to our Credit Reporting Policy which may be found at www.equifax.com.au/credit-reporting-policy

2. Who is Equifax?

Equifax comprises of a number of separate businesses, including the following:

• EISS which operates a credit reporting business in Australia.
• Equifax New Zealand Information Services and Solutions Limited which operates a credit reporting business in New Zealand.
• National Tenancy Database runs a tenancy database for licensed real estate agents. This database is managed by EISS.
• Australian Business Research operates a commercial credit reporting business managed by EISS and has linkages to EISS’ commercial credit database.
• Secure Sentinel provides loss assistance and retrieval services to its members
• Identity Watch provides online monitoring services to detect and alert its members if their details may be compromised
• Equifax Australasia HR Solutions Pty Limited ("Employment Verification") (formerly Verify Holdings Australia Pty Limited) provides candidate background screening service to organisations and individuals for employment purposes
• Equifax Australasia Workforce Solutions Pty Limited (trading as ‘Equifax HR Solutions’) provides HR platform systems and other workforce data management services across the employment cycle to businesses and individuals under the following key products:

fit2work provides comprehensive candidate and employee background screening solutions including identity solutions, police checks and clearances. fit2work also provides employees’ background screening badging solutions that ensure that the candidate or employee screening results are relevant and current. 

The Equifax Human Resources Platform (EHRP) is a secure online platform application that streamlines end-to-end employee management processes. It offers applicant tracking, onboarding, active employee engagement and offboarding, plus a link to Verification Exchange™.

eCredential is a clinical credentialing online services solution for healthcare practitioners and providers. It provides health practitioners and staff with the capability to create and self-manage a centralised clinical profile once they have subscribed to the service, which can be then be shared with hospitals and other health service providers. Clinician status reports can be produced and issued to subscribers. These provide a complete overview of the clinician’s current scope, status and their identity. Hospital/Health Service providers are able to log in, review and/or supervise the clinician’s current scope of qualifications and activities. eCredential is also fully compatible with EHRP.

Verification Exchange™ provides data services when employment and employment income verification is required by a verifier such as a lender, credit provider or other entity seeking to determine whether the employee is entitled to a benefit. 

Collection, use and disclosure of personal information for purposes of the Equifax HR Solutions services is governed by the Privacy Policy and Collection Statements accessible at https://www.equifax.com.au/hrsolutions/termsandconditions.html. 

• Equifax Australia Marketing Services Pty Limited ("Data-driven Marketing") offers its customers a range of products to assist them in aspects of campaign management.
• Equifax Australia Personal Solutions Pty Limited (“EAPS”) provides services to communicate information and offers to individuals in relation to products and services of Equifax and its clients;
• Equifax Australasia Credit Ratings Pty Limited t/as Corporate Scorecard (formerly Corporate Scorecard Pty Limited) provides services for assessing, commercial, financial and operational risks of suppliers and contractors in procurement.
• Kingsway Financial Assessments Pty Ltd provides services for assessing, commercial, financial and operational risks of suppliers and contractors in procurement.
• Equifax Australia Commercial Services and Solutions Pty Limited provides MOGOplus and Tenant Affordability Check income and expenditure verification services.

3. How Equifax collects your personal information

Generally speaking, Equifax collects personal information from third parties. The sources of that personal information include those listed below, depending upon the purpose for which it is being collected.

• Real estate agents and real estate platforms/websites;
• Utility Providers;
• Lawyers, Insurers, Loss assessors, Loss adjustors and investigators;
• Law courts;
• Credit providers, other financial institutions and access seekers;
• Australian Securities and Investments Commission;
• Australian Financial Security Authority
• Telstra and other telecommunication providers;
• Australia Post;
• Australian Electoral Commission;
• Australian Communications and Media Authority;
• Market research organisations;
• Direct marketing companies;
• Service Providers to us;
• Government agencies (such as the Office of the Australian Information Commissioner and the Federal Department of Human Services);
• External Dispute Resolution schemes;
• Our customers;
• Our related companies;
• Your nominated representatives e.g. spouse, accountant, attorney under power of attorney, broker or other professional adviser;
• Referees whose details you have provided to us;
• Universities, health care professionals, law enforcement agencies, and other third parties for Employment Verification purposes, described further below.

In addition, there are a number of limited circumstances in which we will collect personal information from you: 

• When you apply for membership or whilst you are a member of Secure Sentinel and Identity Watch.
• When you contact our Australian commercial or consumer credit bureau to obtain a copy of your commercial or consumer credit file.
• When you contact our Australian commercial or consumer credit bureau to request an amendment to your commercial or consumer credit file or dispute information on your commercial or consumer credit file.
• When you contact Data-driven Marketing, regarding material you have received from a Data-driven Marketing client.
• When you contact NTD for a copy of your tenancy database file or to request an amendment to that file.
• When you contact Employment Verification in order to provide information for background checks for employment purposes.
• When you obtain information from us over the internet such as through the website carhistory.com.au.
• When you opt-in to receiving offers and product information from Equifax.
• When you utilise the MOGOplus or Tenant Affordability Check applications to obtain your account information and (in the case of MOGOplus) information from Centrelink about government assistance that you receive.
• When you enquire about joining Equifax as an employee or contractor.
• When you provide us with information, either through or websites or our representatives or otherwise.

4. The kinds of, and purposes for which Equifax collects, holds, uses and discloses personal information

Equifax collects personal information for a variety of different purposes.

Equifax collects a range of personal information, depending upon the purpose for which it is collected. This includes publicly available information for use in our Commercial Risk & Information Services and in some of our B2C & Marketing services, including Equifax Score, NTD and Data-driven Marketing. The publicly available information we collect includes:

• Court judgements
• Court writs
• Bankruptcy, debt agreement and personal insolvency information
• Directorship & Proprietorship information
• Office holder details, shareholdings and other extracts and documents from ASIC
• Telephone directory information
• Pre-2004 Electoral Roll information

In limited circumstances, we may be required by law to collect personal information about you.

We may create identifiers in relation to personal information collected and held by us, for our identity management purposes.

We collect, hold, use and/or disclose your personal information for the purposes of carrying on our various businesses and for conducting the affairs of Equifax.  

Generally, personal information is used and disclosed for the purposes for which it was collected, a related secondary purpose, or where you have consented to the use or disclosure.

For example, we may use personal information collected for the secondary purposes of our identity management and managing the accuracy of our data sets. 

Equifax may disclose your personal information to third parties who are customers of one of our businesses. Equifax may also disclose your personal information to:

• service providers, including data storage providers, call centre operations, technology and operations support providers, who assist us with providing products and services and conducting our business activities (and those service providers may in turn provide us with personal information collected from you in the course of providing the relevant product or service);     
• professional service providers and advisors who perform functions on our behalf, such as lawyers;
• external dispute resolution schemes;
• access seekers as contemplated and permitted by the Privacy Act;
• our related companies; 
• other third parties where it is necessary to enable us to provide a product or service;
• referees or employers whose details you have provided to us (for example, information about persons who have applied for a job at Equifax is disclosed with their consent to their employer or referee as part of the employment application process);
• where otherwise permitted by law. 

There may be other circumstances where we are required or authorised by law to disclose your personal information to someone, for example to an Ombudsman, tribunal, court, law enforcement agency or government department.

In addition, as Veda Group Pty Limited was previously a public company listed on the Australian Stock Exchange, we collected, and hold, use and disclose your personal information as follows:

If Equifax does not collect your personal information, Equifax may not be able to provide its products or services to or in connection with you.

Disclosures Overseas

In limited circumstances Equifax may disclose or provide access to your personal information to overseas entities. This occurs primarily where we have engaged overseas entities to provide support services (including technology, operations and customer support) to us, and they need access to personal information held by us in order to provide those services. Many of those entities are related to Equifax. The countries in which the entities are located include, but are not limited to: the USA, Chile, the Philippines, India, Costa Rica and Ireland. A list of all the countries in which Equifax global group entities are located can be found on our parent’s website at https://www.equifax.com/about-equifax/company-profile/. Where those entities process your personal information, they do so only for a permitted purpose on behalf of Equifax and in accordance with its instructions. Equifax retains control over and remains fully responsible for your personal information and uses appropriate safeguards as required by applicable law to ensure the integrity and security of your personal information as part of any such engagement. 

Data storage architecture employed by cloud service providers to Equifax means that personal information, other than credit information, contained in some communications with Equifax, or in certain types of documents, may be held in multiple overseas locations. 

Equifax may also, in some circumstances, disclose personal information to its customers in locations overseas, in connection with the provision of its services to those customers. 

Equifax also provides certain support services to its related entities in New Zealand, pursuant to which it discloses personal information to those entities, primarily being information supplied by those entities to Equifax, or collected in relation to individuals in New Zealand.

As part of a global group providing services to customers and in dealing with our customer relationships, Equifax may also disclose or provide access to personal information (other than credit information) of an organisation’s employees, contractors or other service providers, as made known to us by that organisation, to overseas entities. This occurs, for example, where we have engaged overseas entities to provide services (including technology, operations, billing, administrative and customer support) to us, and they need to access that personal information to provide those services. Again, many of the overseas entities are those related to us. By dealing with us, an organisation or other business entity acknowledges that these service arrangements may result in personal information provided by it or collected about such persons being disclosed to or used by an overseas recipient and that:

(a)   the overseas recipient may not be required to protect that personal information in a way that provides comparable safeguards to those under the Privacy Act; 
(b)  the overseas recipient may be subject to a foreign law that could compel the disclosure of personal information to a third party, such as an overseas authority (for example, under legislation to intercept cyber traffic or obstruct terrorism), and the individual may not be able to seek any redress in that overseas jurisdiction; and
(c)   to the extent permitted by law, we will not be accountable under the Privacy Act, and an individual will not be able to seek redress  under the Privacy Act, if the overseas recipient handles their Personal Information in breach of the Privacy Act.

By dealing with us, the organisation or other business entity – on behalf of those individuals – consents to any such disclosure and warrants that it has satisfied itself that our overseas disclosure of such personal information is compatible with and satisfies any privacy policy or other privacy statement or requirement that it operates under.

5. Your Right of Access

You have the right to access personal information Equifax holds on you and to have incorrect information amended.

If you would like to obtain a copy of your files including the personal information Equifax holds on you or to request a correction to personal information held by Equifax, please contact us in writing:

Equifax may charge you a fee for providing you with a copy of your files and for providing you with the information that Equifax holds on you.

6. Your right to request a correction or make a complaint

If you have a dispute about personal information held by Equifax and covered by this policy, we will investigate and provide you with a formal written response, generally, within 30 days. Where we determine that no amendment to your personal information is required you have the right to add a statement to your file.

We will investigate and deal with your correction request or complaint in a fair, efficient and timely manner. 

You can contact us at:

If you are unhappy with the outcome of Equifax’s investigation or would like to make a complaint, please contact our Internal Dispute Resolutions (IDR) team by sending an email to customercomplaintsAU@equifax.com. Make sure that you sufficiently detail your matter and include your full name, contact details, any reference numbers and relevant supporting documentation. Our IDR team will investigate your matter and contact you to attempt to resolve the matter directly. 
 
We want to do everything we can to resolve your matter, so it's important that you raise it with our IDR team prior to having your matter addressed externally. Raising your matter with Equifax directly will often result in a quicker resolution.  
 
If you are still not satisfied with our response, you may contact the external dispute resolution scheme of which Equifax is a member, the Australian Financial Complaints Authority (AFCA). Please note that if you have not already done so, AFCA will likely encourage you to work with us before they investigate your complaint. 
 
How to contact the Australian Financial Complaints Authority (AFCA): 
Online:  www.afca.org.au  
Email:  info@afca.org.au  
Phone: 1800 931 678  
Mail: Australian Financial Complaints Authority 
GPO Box 3 
Melbourne VIC 3001 
 
When contacting AFCA, we suggest you include the following: 

• a detailed timeline/chronology of events
• copies of any correspondence with our Customer Resolutions Team and the credit provider 

You may also make a complaint to the Office of the Australian Information Commissioner (OAIC). 
 
How to contact the Office of the Australian Information Commissioner (OAIC): 
Online: www.oaic.gov.au  
Email:  enquiries@oaic.gov.au  
Fax: 1300 363 992  
Mail: Office of the Australian Information Commissioner   
GPO Box 5218   
Sydney NSW 2001 

We want to do everything we can to resolve your matter, so it's important that you raise it with our IDR team prior to having your matter addressed externally. Raising your matter with Equifax directly will often result in a quicker resolution.

7. Use of Personal Information for Marketing Purposes

For specific information regarding use and disclosure of personal information by Data-driven Marketing or ReachTel for marketing purposes, please refer to Data-driven Marketing’s Privacy Policy and to ReachTel's Privacy Policy. The information which follows is of general application to Equifax and is subject to those policies.

Equifax collects information to provide its customers and individuals with a large variety of services.  Sometimes different entities within Equifax will contact individuals to market Equifax services.  Generally, marketing by Equifax of its services to individuals is based on the consent of the individual to that marketing.

This may, depending on the consent provided, include promotional material including but not limited to communications of the following kind:

a) Newsletters
b) Competitions
c) Surveys
d) Promotions on existing or new products
e) Other, if any

Equifax may do so by using a variety of means including:

a) electronic means such as emails, SMS, MMS or similar devices
b) hardcopy to your nominated address; and
c) subject to Do Not Call Register, call you.

Equifax may, at any time, disclose your information to its clients, where you have provided consent, for marketing purposes so they can send you marketing information similar to the above.

At all times you are free to choose not to receive some or all of the marketing communications sent by Equifax or on Equifax's behalf. In order to exercise that choice you need to communicate to:

8. Government Identifiers and Sensitive Information

We do not adopt as our own identifier any identifier assigned by a Commonwealth or State Government agency. 

However, if you are a member of Secure Sentinel and Identity Watch, we retain details of your passport, including your passport number, as part of the services we provide you.  Identity Watch may also retain your Medicare number, as part of the services we provide to you.  

In certain circumstances we may seek evidence of your identity such as passport details, driver’s licence, Medicare number or similar in order to help verify your identity.

The Privacy Act describes ‘sensitive information’ as information relating to a person’s racial or ethnic origin, political opinions, religion, trade union or other professional or trade association membership, sexual orientation, criminal record, and health information about an individual. Occasionally, it may be necessary for us to collect sensitive information about you. This would only occur when it is necessary for us to collect this information from you in the course of providing our services, or in the limited circumstances permitted under the APPs. For example, Employment Verification may collect, use, hold and disclose details relating to your criminal record, if applicable, for the purposes of conducting an employment check.

If you or third parties provide us with sensitive information, we will as a matter of policy only use and disclose the information for the purpose for which it was provided or another directly related purpose, unless you agree otherwise, or where required or authorised by law. We will only collect sensitive information with your consent, or where it is required or authorised by law. 

9. Job applicants and employees

The Privacy Act provides an exemption for employee records. That is information about an individual if that information directly relates to the act or practice of a current or former employment relationship between the employer and the individual. That exemption may apply in relation to the information held by us about our employees.

Any personal information provided to Equifax in connection with job applications may be used to consider the applicant for current and future employment and may be disclosed to our third party advisors to assist us in the selection and recruitment process. 

10. How we hold and keep your Personal Information Secure

Access to your personal information held by Equifax for Consumer Risk & Identity, Commercial Risk & Information Services is available by subscription only and is tracked and recorded.  Access is subject to contractual terms and conditions.  Access to other personal information is subject to your consent, or is publicly available, or is subject to contractual terms and conditions.  These include compliance with the Privacy Act and other relevant legislation.

We may hold your personal information in paper or other physical form, but it is usually held in electronic form on our systems. To ensure your personal information is secure, we use industry standard security and encryption to protect the personal information we hold on you. Service providers may hold the information for us, such as our data centre providers which have been certified as ISO 27001 compliant. Where a service provider holds your information, we require those service providers to adhere to our approved standards of security and confidentiality to ensure the continuing protection of your personal information.

Only authorised employees are granted access to your personal information. We train the employees who handle your personal information to ensure that your personal information is handled appropriately. Our procedures ensure that your personal information is only made available to employees where necessary.  We audit and monitor our employees’ access to, and handling of, personal information.

11. Further information about your Privacy rights

For further information about the APPs for the Act please visit the Office of the Australian Information Commissioner website at www.oaic.gov.au.

This policy documents how we manage personal information and reflects our obligations under the APPs of the Act.  If you would like information about how we manage personal information as a credit reporting body go to our Credit Reporting Policy. This document does not create any additional rights under contract, statute or equity.  

12. Do we collect any other data?

We may collect data regarding users online activities over time on our online network of internet sites, non-affiliated websites, mobile applications or online services including information that you voluntarily provide to us online or offline, for example in response to surveys or competitions.

We will not combine this data with personal information about you for sharing with any third party, nor will we provide it to an advertiser or any other third party without your express consent, or as expressly stated in this policy. 

For third party online behavioural advertising, we may disclose any data about your activities which is not personal information and does not allow you to be reasonably identifiable to a third party - for example, data associated with a cookie, pixel tag, mobile advertising ID or other tracking code – and permit them to use this data for the purpose of associating that tracking code with your use of our websites, and of third party websites where we or our advertising partners have an arrangement in place to serve ads to you on those third party websites. 

We may also collect and use, and permit third parties to collect and use, data from third parties about your online or offline activities, as linked by that third party to that tracking code, to facilitate display of advertisements, goods, services, recommendations or content to you that are selected using inferences as to your preferences or interests.  For example, we may collect information related to demographic, behavioural and usage patterns, referred to as “preference data”.  By targeting ads and content to unidentified individuals (such as you) only if you are within a particular interest or preference segment, targeted advertising and targeted content is intended to be more relevant or useful to you.

You may elect to opt-out of third party online behavioural advertising by going to http://www.aboutads.info/appchoices or if you wish to opt out of our third party marketing partners please select the relevant link below where you can opt out of internet based adverting.

https://www.oracle.com/legal/privacy/marketing-cloud-data-cloud-privacy-policy.html 
https://www.networkadvertising.org/

However, opting-out means that the display advertising you see may not be tailored to your interests or preferences and may therefore be less relevant or useful to you. 

For further information about how we use cookies, please see our Cookies Policy at www.equifax.com.au/cookies.  You can also manage cookies on your mobile device or in your web browser privacy settings.  See your device or browser FAQs, or Your Online Choices, for more information.