Privacy Statement

Effective from 1 September 2026

Latitude Financial Services Limited and related entities in New Zealand (“Latitude”), Level 21, 48 Shortland Street, Auckland 1010, New Zealand, take our obligations for protecting personal information seriously. We are bound and will abide by the requirements of the Privacy Act 2020.

This Latitude Privacy Statement (“Privacy Statement”) contains important information about the collection, use and disclosure of personal information (including biometric information) by Latitude Financial Services Limited (“Latitude”, we, us) in New Zealand. It also outlines how we protect and manage your information, and your rights to access, correct, or raise concerns about it. The words “you” and “your” refer to the applicant or customer.

You accept this Privacy Statement when you sign up for, access, or use our products or services, content, features, technologies or functions offered on our website or mobile apps.

You may interact with us anonymously or by using a pseudonym if the interaction is general in nature. However, if the interaction is specific to an account or relates to your personal information, we will need to identify you before we can engage in further discussions and correspondence. Latitude may update this Privacy Statement from time to time to reflect changes in our practices or in the law. The latest version will always be available on our website or upon request.

In this Privacy Statement, references to “personal information” include:

• “personal information” as defined under the Privacy Act.
• “credit eligibility information”, which is information about you disclosed to us by a credit reporting body or as relevant to each entity.
• “credit information” such as:
  • your identification details,
  • information about consumer credit accounts you hold, or have held with other credit providers including whether it is open or closed and the relevant dates and the type and amount of credit,
  • your repayment history information, such as whether you have made, or missed, a payment on your credit facility,
  • financial hardship information, about whether you have entered into a financial hardship arrangement.

We offer a wide range of products and services and as a result, we collect personal information that you provide us (or authorise others to provide) when you interact with Latitude. This includes information such as:

• Contact details and identification information: Your full name, date of birth, addresses, contact details, and identity documents (for example, your driver’s licence or passport details).
• Financial and credit information: Information on your financial circumstances, credit history and creditworthiness (including information we obtain from credit reporting bodies or other sources as permitted by law).
• Account and transaction information: Details about any accounts or credit facilities you have or apply for with us (e.g. account numbers, balances, payments, and transactions including purchases or cash advances).
• Employment and income information: If relevant to your application (for example, employer name and contact, income details).
• Biometric information: If you choose to verify your identity via our digital process, we collect certain biometric information about you. This is typically a selfie photograph and/or a short live video of your face, which we use to create a unique biometric identifier (such as a facial recognition template). We use this information to verify your identity, help protect you and us from fraud, detect and prevent identity theft, impersonation and other fraudulent activity, maintain the security of our products and services, and to meet our legal and regulatory obligations. (See “Biometric Information” section 5 below for full details)
• Other information: Any other personal information you provide during your application or communications with us (for example, information provided in forms, emails or phone calls, loyalty or rewards programme details, and your preferences or responses to surveys).

Where possible, we will collect personal information directly from you (for instance, via our online application form, by phone, or other direct interactions). We may also collect personal information from third parties in some cases, but only when it is not practical to collect it directly from you or where you have authorised another party to provide your information to us (e.g., when you make an application for a Latitude product via a broker or via a retail partner). We will only collect information from third parties consistent with the Privacy Act 2020 and our obligations to you.

In order to satisfy our legal obligations, we may need to retain that information even after a transaction has come to an end [subject to our obligations under the Privacy Act and Anti-Money Laundering and Countering Financing of Terrorism Act 2009 (AML/CFT Act) or any other applicable Act].

We collect and use your personal information for the purposes of providing and managing our financial products and services, meeting legal obligations, and improving your customer experience. The primary purposes for which Latitude collects, uses, and (in certain situations) discloses your information include:

• To process your application and establish your account: We use your information to assess and decide on your application for credit or other services. If approved, we use the information for setting up and administering your credit facility or account.
• To conduct identity verification (including biometric verification): We collect personal and biometric information to fulfil our legal obligations under the Anti-Money Laundering and Countering Financing of Terrorism Act 2009 (AML/CFT Act) and other laws requiring identity verification. For example, we may ask you to provide a photo or video selfie to verify that you are the true holder of an identity document you provided. Using secure biometric technology, we compare your selfie image to the photo on your identity document to confirm your identity and guard against imposters. We have assessed that using biometric verification is an effective way to enhance security. It provides a high level of confidence in confirming identity and helps protect both you and us from identity fraud. We consider this method to be appropriate for managing these risks, while applying safeguards to minimise impacts on your privacy.
• To prevent fraud and ensure security: We use personal information (including biometric data) to detect and protect against identity fraud, account takeovers, and other fraudulent or illegal activities. We may also use your details for other internal risk assessment and fraud management processes to keep your accounts and our financial services secure.
• To comply with laws and regulations: We may use and disclose your personal information where necessary to fulfil our obligations under New Zealand laws and regulations. For example, we are required to collect and verify certain identification information under the AML/CFT Act and to maintain accurate records of our customers and transactions. We may also use your info to meet other legal requirements (such as responding to court orders or lawful information requests from regulatory authorities).
• To manage and improve our services and relationship with you: We use your contact information to communicate with you about your account, transactions, and important service updates. We may also use your information to respond to inquiries, resolve complaints or disputes, and provide customer support. With your consent or as permitted by law, we might use your information to send you service-related or promotional communications (you can opt out of marketing at any time – see Direct Marketing & Opt-out section). Additionally, we may use your information internally to analyze and improve our products and services, develop new offerings, conduct data analytics and research, and ensure our processes are effective and fair.

We will not use your personal information (including any biometric information) for purposes that are incompatible with the purposes above or that are not permitted under New Zealand’s Privacy Act 2020 (including the Biometric Processing Privacy Code 2025). We do not use your biometric information to profile you or to infer traits like your behaviour, health, or demographic characteristics – it is used only to verify your identity and fraud prevention, as described.

If you contact us by email, we will collect and use the personal information contained in your email and any attachments to respond to your enquiry. To help protect your privacy, please do not send sensitive account information, such as passwords, card numbers, or security credentials, by email unless specifically requested. Personal information contained in emails from us should only be used or disclosed as permitted by law or with appropriate authorisation.

This section provides additional details about how we handle your biometric information.

• What biometric information we collect: If you choose to verify your identity through our digital biometric verification process, we will ask for a live selfie photo or a short video of your face. This is the biometric information we collect – essentially, a digital representation of your facial features. Aside from facial images for verification, we do not collect other biometric identifiers like fingerprints or voice patterns as part of our current process. All biometric information we handle is treated as “personal information” and protected accordingly.
• How we collect biometric information and from whom: We collect this directly from you, via an online platform, when you use your device’s camera to take the required selfie or video during the identification process. This biometric sample is provided by you voluntarily as part of establishing your identity remotely.
• Purpose of biometric processing: We use your facial biometric information exclusively for two purposes: (1) identity verification (to confirm you are who you claim to be when you apply for our product) and (2) fraud prevention (to help detect and prevent identity theft or other unauthorised use of your identity or accounts). We will not use your biometric information for any other purposes (for example, we do not use it for marketing, profiling, determining your characteristics, or any unrelated analytics). Biometric verification is used because it provides a high level of confidence in confirming identity and helps us meet our legal obligations, while protecting both our customers and our business from fraud. We have assessed that this method is an effective and proportionate means of verifying identity and reducing fraud risks, taking into account the sensitivity of the information collected and the safeguards applied. This process is carried out with your consent, and we apply strong safeguards to protect your information.
• Is providing biometric information voluntary? You may choose not to use our biometric verification process. Where another suitable identity verification method is available, we will tell you how to use it. If biometric verification is necessary for a particular online process, or if no suitable alternative is available, we may be unable to complete that process or provide the relevant product or service through that channel.
• Who we share your biometric information with: Your biometric information is only accessed by authorised personnel. We may disclose it to trusted identity verification and fraud prevention service providers that assist us in verifying identities and protecting against fraud. Those providers may process biometric information on our behalf only for these purposes and subject to appropriate contractual, security and privacy safeguards. It may also be shared with third parties where required by law, but it is always protected and never used beyond the original purpose of collection.
• Storage and security of biometric information: We store your biometric information securely with robust technical and organisational security measures to protect it from loss, unauthorised access, or misuse. We use a third-party verification provider to hold and process your biometric information on our behalf, and ensure they also implement strong security safeguards and handle your data in compliance with New Zealand privacy requirements.
• Retention and destruction of biometric information: We retain biometric information only for as long as reasonably necessary for identity verification, fraud prevention, security, legal, regulatory and record-keeping requirements. Once no longer required, it is securely deleted or permanently anonymised.
• Accuracy and checks: We take reasonable steps to ensure your biometric information is accurate and reliable before using or sharing it.
• Your rights and choices (biometric information): You have the right to access and correct your biometric information. We will provide or update it on request (subject to legal exceptions). If you have concerns about how we’ve handled your biometric information or our biometric processes, please see “Your Privacy Rights and Contacting Us” below – we provide ways for you to raise concerns or complaints, including contacting the New Zealand Privacy Commissioner if needed.

We do not use biometric information to make automated decisions about your eligibility for credit, nor do we use biometric information to infer your behaviour, emotions, ethnicity, sex, health status or other sensitive characteristics.

In general, we may collect your personal information (including, where necessary, biometric information) from, and disclose your personal information to, other parties only for the purposes explained in this Privacy Statement or as otherwise permitted or required by law. The types of parties we commonly collect your personal information from, or disclose your personal information to, include:

• Our service providers and partners: Companies that help us deliver our services, such as identity verification service providers (as noted above for biometrics), cloud storage and IT service providers, customer service call centres, mailing or printing companies, data analytics firms, and professional advisors (like auditors or lawyers). In each case, these third parties are engaged under contract to provide services to us and must handle your information under our instructions, with strict confidentiality and security measures.
• Credit reporting and identity verification agencies: We may collect and disclose necessary personal information from and to credit reporting bodies to obtain reports about your credit history or to monitor your credit status (for example, credit score updates). We also collect and disclose relevant personal details (like your identification information) from and to identity verification agencies or databases (such as NZ Transport Agency (Waka Kotahi) for driver licence verification, the Department of Internal Affairs for passport verification) as part of confirming your identity. These agencies may hold and use your information for their lawful purposes (for example, a credit bureau retaining data in your credit file and disclosing it to other authorised users), but those uses are governed by credit reporting laws and the agencies’ own privacy policies.

We collect and disclose information from the following Credit Reporting Bodies:

• Equifax New Zealand
  Website: https://www.equifax.co.nz/privacy
  Address: Level 10, 48 Shortland Street, Auckland
• Centrix Group Limited
  Website: https://www.centrix.co.nz/privacy-statement
  Address: Level 4, 56 Cawley Street, Ellerslie, Auckland
• Experian Data Registries (NZ) Limited (formerly illion New Zealand Limited)
  Website: https://www.experian.co.nz
  Address: Level 22, 48 Shortland Street, Auckland

• Merchant partners and Brokers: If your application is initiated at a merchant partner store or via broker platform, we may collect and disclose certain personal information from and to that merchant partner or broker. We will not share your biometric data with merchant partners or brokers.
• Related companies: Latitude may disclose your information with our related entities (within New Zealand or overseas) as needed for the purposes listed in this Privacy Statement – for instance, for internal administration, to offer you other products or services, or if group-level reporting is required. Any sharing of this information will be limited to purpose for which it was originally collected and will remain subject to the appropriate privacy safeguards.
• Legal or regulatory disclosures: We may disclose your personal information to government agencies, regulators, law enforcement or courts when required or authorised by law. For example, we might disclose information to assist with the prevention or detection of criminal activities (such as reporting suspicious transactions), to respond to a legal warrant or court order, or to meet our obligations to regulatory bodies.
• Others with your consent: If you direct us or give us your consent, we may collect and disclose your information from and to other third parties. For example, at your request we might provide your account details to a financial counsellor or advisor or obtain information about your financial situation from the financial counsellor or advisor.

Outside of the situations above, we will not disclose your personal information without your permission unless it’s necessary to protect your interests or there’s another lawful basis for doing so.

The consents given by you in relation to the use of your personal information for direct marketing, apply to contacting you by all relevant means (for example, by letter, phone, email, SMS, and other electronic means including the Latitude Service Centre and the Latitude App) and apply until you expressly withdraw those consents.

If you do not want to receive direct marketing information from Latitude, you may call our Team on 0800 422 898. You can also unsubscribe from email marketing by clicking unsubscribe in the footer of the email. Where Latitude has provided your information to our third party or a retail partner to send you marketing or promotional materials, you will need to opt out of these services with them directly.

If you had previously opted out of direct marketing, but subsequently make an application for a new Latitude product, you will be re-opted in. You can however opt-out again by following the instructions provided above.

Through the Latitude mobile application, we may collect and process your device’s location information where you have provided us consent to do so. This information will be used to send you location-based advertising. You can opt-out of sharing your location information through the Latitude mobile application or by denying location permissions through your device settings.

For statistical purposes, we collect information on website activity such as the number of users who visit our websites, the date and time of visits, the number of pages viewed, navigation patterns, what country and what systems users have used to access the site and, when entering one of our websites from another website, the address of that website. This information is obtained through the use of ‘cookies’ (refer below for more information about ‘cookies’).

Our websites may also contain links to other websites. While these links are provided for convenience, if you are navigating these sites, please be aware that the information handling practices of the linked websites may differ from ours. While we try to link only to sites that share our high standards and respect for privacy, we are not able to guarantee the privacy practices of other websites.

A ‘cookie’ is a packet of information that allows a website to identify and interact more effectively with a computer. Cookies do not identify you, but they may record some browser and/or connection information. Cookies are widely used on websites to help with navigation, monitor usage and to help personalise your experience when you visit a website. We may use cookies to monitor use of this website, to provide you with access to tailored information and services from this website, and to serve you better when you return to this website.

Your browser can be individually set to accept all cookies, reject all cookies, or notify when a cookie is sent. If cookies are rejected, there may be limits on how our websites can be used.

From time to time, we place advertisements on other websites. This may involve installing a cookie on a computer when our advertisement is viewed. This simply allows us to keep track of how many unique visitors we have to our site and from what advertisements they entered.

This then allows us to measure the effectiveness of different advertisements. The privacy policies of the websites which install the cookies should provide additional information about the use of cookies.

To evaluate the effectiveness of our website advertising, we may use third parties to collect statistical data. No personal data is collected on these occasions.

The Credit Reporting Privacy Code permits credit providers like Latitude to share information with credit reporting agencies, on an ongoing basis. This means that Latitude may provide credit reporting agencies with certain credit related information about its customers’ accounts, such as:

• type of credit account e.g., credit card
• amount of credit extended (but not current balance)
• status of account e.g., open (including account open date)
• details of credit provider i.e. the lender who provided the credit
• monthly reporting of repayment history e.g., whether an account was paid on time, and
• changes in personal details such as address, contact details, etc.

For further information on comprehensive credit reporting, please see the following website www.privacy.org.nz/privacy-act-2020/codes-of-practice/crpc2020/.

Below are the contact numbers for the products and services offered by Latitude Financial Services Limited and its related entities.