The Asset Finance Shop Pty Ltd (ACN 613 056 992), trading as TAFS, respects your privacy. This policy explains what personal and credit information we collect, why we collect it, who we share it with, how we protect it, and your rights.

We are bound by the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), Part IIIA of the Privacy Act (which governs credit reporting), and the Privacy (Credit Reporting) Code 2014.

References to "we", "us", or "our" mean The Asset Finance Shop Pty Ltd and our credit representatives, employees, contractors, and related entities.

Who we are

TAFS is a commercial asset finance brokerage. We operate as a Corporate Authorised Representative (Authorised Representative Number 493210) under Australian Credit Licence 525058 (Do Business Australia Pty Ltd).

Contact details Unit 2, 17/21 Bowden Street, Alexandria NSW 2015 Email: info@tafs.com.au Phone: 1300 558 758 Website: www.tafs.com.au

What this policy covers

This policy explains:

• The personal and credit information we collect
• Why we collect it
• Who we share it with, including credit reporting bodies and lenders
• Your privacy rights
• How you can access, correct, or complain about your information
• How we protect your information

Why we collect your information

We collect personal and credit information to:

• Source consumer credit for personal, household, or residential investment purposes
• Source commercial credit for business purposes
• Assess and process guarantor applications
• Verify your identity under Australian anti-money laundering and counter-terrorism financing (AML/CTF) laws
• Meet our responsible lending obligations and best interests duty
• Comply with our other legal obligations

What happens if you don't provide information

Providing your personal information is voluntary. If you don't provide it, we may be unable to:

• Assess your finance application, or an application from a company where you are a director or guarantor
• Provide credit assistance or brokerage services
• Source a suitable lender
• Meet our legal obligations

What information we collect

Personal information includes:

• Identification details such as name, address, date of birth, and contact details
• Identification documents including driver's licence, passport, Medicare card, birth certificate, or citizenship certificate
• Financial information including income, expenses, assets, liabilities, employment details, and bank statements
• Your requirements, objectives, and reasons for seeking credit
• Details of the asset you are financing
• Business details where you apply through a company, trust, or partnership, including ABN, ACN, directors, trustees, guarantors, and beneficial owners

Credit information under Part IIIA of the Privacy Act includes:

• The type and amount of credit you have applied for
• Consumer credit liability information
• Repayment history information
• Financial hardship information
• Defaults and serious credit infringements
• Court proceedings and personal insolvency information
• Publicly available information relevant to your credit worthiness
• Opinions of credit providers about your credit worthiness
• Information obtained from a credit reporting body

Sensitive information may be collected in limited circumstances, including:

• Country of birth or citizenship information for identity verification
• Whether you are a politically exposed person (PEP), for AML/CTF purposes
• Biometric information used for identity verification

We only collect sensitive information where necessary and permitted by law, and we do not use it for any purpose other than the one it was collected for.

How we collect your information

We collect information:

• Directly from you when you enquire, apply, or communicate with us
• From your electronic devices when you visit our website, click our ads, or open our emails
• From lenders and credit reporting bodies
• From publicly available sources including ASIC, the Australian Business Register, and the PPSR
• From referrers such as dealers, accountants, brokers, and business partners
• From identity verification providers
• From bank statement providers such as illion BankStatements
• From other third parties where you have authorised the disclosure

Where practicable, we collect information directly from you. If we collect information about you from a third party, we take reasonable steps to make you aware of the collection.

How we use your information

We use your personal and credit information to:

• Assess your finance application and financial situation
• Assess an application from a company where you are a director or guarantor
• Verify your identity
• Match you with a suitable lender and prepare your application
• Communicate with you about your enquiry, application, or existing finance
• Provide ongoing service, including refinances, variations, and additional finance
• Meet our legal and regulatory obligations
• Improve our services, systems, and website
• Send you marketing communications where you have consented or the law permits

We do not use your personal information or credit information to train third-party artificial intelligence or machine learning models.

Our credit assistance process

Our process starts with a soft credit check, which does not leave a mark on your credit file. Our internal credit team reviews your scenario using our knowledge of the 80+ lenders we have access to, and presents the options we think best suit your situation. We only submit your application to a lender once you have agreed to proceed with them.

Acting as agent for lenders

As part of providing our services to you, we may undertake tasks for a lender that are reasonably necessary to manage your application. When we do this, we act as agent for the lender, and the same privacy law requirements apply to both us and the lender.

Who we share your information with

We may disclose your personal and credit information to:

• Lenders and their assessors, so they can assess and process your application
• Credit reporting bodies
• Guarantors or prospective guarantors
• Industry bodies to whom we are accountable, including the MFAA
• Government and regulatory bodies including ASIC, AUSTRAC, and the ATO
• Identity verification and bank statement providers
• Our service providers, including CRM, telephony, SMS, email, cloud storage, document signing, marketing, and IT providers
• Our professional advisers, including lawyers, accountants, and auditors
• Debt collection agencies where applicable
• External dispute resolution schemes
• Referrers who introduced you to us, including dealers and accountants
• Our related entities
• A purchaser or potential purchaser of our business, or of rights under your contract with us

We do not sell your personal information.

Credit reporting bodies

We disclose your identification information to, and obtain credit reports from, the following credit reporting bodies:

• Equifax: www.equifax.com.au  138 332
• Experian: www.experian.com.au  1300 783 684
• illion: www.illion.com.au  13 23 33
• CreditorWatch: www.creditorwatch.com.au  1300 501 312

We disclose information to credit reporting bodies to verify your identity, obtain credit reports, and assess your credit worthiness.

What credit reporting bodies may do with your information

Credit reporting bodies may:

• Include information we disclose to them in reports provided to other credit providers to help assess your credit worthiness
• Use your information for pre-screening of direct marketing by credit providers, unless you opt out with the credit reporting body
• Disclose your credit reporting information to other credit providers and entities as permitted by law

Default reporting by lenders

TAFS does not report defaults or serious credit infringements to credit reporting bodies. If you enter into a finance arrangement with a lender through us, that lender may disclose information to a credit reporting body if you become overdue in making payments or commit a serious credit infringement. Each lender has its own privacy policy and credit reporting policy that explains how they do this.

Your rights with credit reporting bodies

You have the right to:

• Request that a credit reporting body not use your information for pre-screening of direct marketing
• Request that a credit reporting body not use or disclose your information if you believe you are, or are likely to be, a victim of fraud
• Access the credit reporting information they hold about you
• Request correction of that information
• Complain to the credit reporting body about how they have handled your information

For full details of these rights, visit the credit reporting body's website or contact them directly.

Our lender panel

We may submit your application to one or more lenders from our panel. An up-to-date list of the lenders we work with is set out in Schedule 1 of our Privacy Disclosure Consent, which we provide to you as part of your application. You can also request a copy at any time.

When we submit your application to a lender, the lender may:

• Disclose information about you to, and collect information from, credit reporting bodies
• Use your information to assess your application and credit worthiness
• Contact you or us for additional information
• Make further inquiries as required under their responsible lending obligations
• Use your information for their own direct marketing, subject to your opt-out rights

Each lender has its own privacy policy and credit reporting policy that explains how they handle your information. You can find these on the lender's website, usually under "Privacy Policy", "Credit Reporting Policy", or "Notifiable Matters", or you can request a copy directly from them.

If your application proceeds with a lender, the lender will provide you with their own privacy statement and may seek additional consents from you at that time.

Overseas disclosure

Some of our service providers store or process personal information outside Australia. This includes cloud infrastructure, IT and CRM platforms, communications platforms, and identity verification providers.

Countries where your information may be disclosed include the United States, United Kingdom, Ireland, Germany, Singapore, the Philippines, India, and Japan. This list is not exhaustive.

Some members of our administration and processing team are based in the Philippines. They are bound by confidentiality obligations and our data handling procedures.

Where we disclose personal information overseas, we take reasonable steps to make sure the overseas recipient handles it consistently with the Australian Privacy Principles, including through contractual arrangements where practicable. Overseas recipients may not be subject to the same privacy laws as Australia.

Marketing communications

With your consent, or where the law otherwise permits, we may send you marketing communications by email, SMS, and phone about our products, services, and offers.

You can unsubscribe from marketing at any time by:

• Clicking the unsubscribe link in any of our emails
• Replying STOP to any of our SMS messages
• Contacting us at info@tafs.com.au

We may still contact you for non-marketing purposes, such as about an active application or existing finance arrangement, even after you have unsubscribed from marketing.

Our SMS marketing complies with the Spam Act 2003 and the ACMA Sender ID Register requirements that took effect on 1 July 2026.

Electronic communications

By providing your email address or mobile number and proceeding with an enquiry or application, you acknowledge that:

• Communications and documents from us, lenders, and other third parties may be sent electronically
• Electronic communications have the same legal effect as paper-based communications
• You are responsible for checking your email and mobile phone messages
• You must keep your contact details up to date with us

You can withdraw your consent to electronic communications at any time by contacting us in writing.

Cookies and website analytics

Our website uses cookies and similar technologies to understand how visitors use the site and to improve our services. We also use tracking pixels from advertising platforms including Meta (Facebook and Instagram), TikTok, Google, and LinkedIn to measure the performance of our advertising and to remarket to visitors.

We use analytics tools including HubSpot tracking and Google Analytics to understand website behaviour.

You can control cookies through your browser settings. Disabling cookies may affect how our website works.

Information about other people

You may give us information about other people during your application, such as a spouse, co-borrower, guarantor, or dependent. By providing that information, you confirm that:

• You have obtained the necessary consents from that person to disclose their information to us
• You have told them what their information will be used for
• You have told them that their information will be handled in accordance with this policy

Data security

We take reasonable steps to protect the personal information we hold from misuse, interference, loss, unauthorised access, modification, and disclosure. Our measures include:

• Access controls and role-based permissions in our systems
• Encryption of data in transit and at rest with reputable providers
• Staff training on privacy and data handling
• Confidentiality obligations for staff and contractors
• Secure storage and disposal of physical records

No method of transmission or storage is completely secure. If we become aware of an eligible data breach, we will notify you and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.

How long we keep your information

We keep personal information for as long as we need it for the purposes described in this policy and to meet our legal and regulatory obligations. For credit-related information, this is generally at least seven years from the date the relevant credit product ends. When we no longer need your information, we destroy it or de-identify it.

Your rights

Access

You can request access to the personal and credit information we hold about you. We will respond within a reasonable time, generally 30 days. In limited circumstances permitted by law we may refuse access, and if we do we will explain why in writing. A reasonable administration fee may apply for complex requests, and we will let you know before we process it.

Correction

If you believe the information we hold about you is inaccurate, out of date, incomplete, irrelevant, or misleading, you can ask us to correct it. We will respond within 30 days. If we agree the information is incorrect, we will correct it and let any third parties we have disclosed it to know, where reasonable. If we refuse to correct the information, we will tell you why and you can ask us to attach a statement noting your view.

How to exercise these rights

Email: info@tafs.com.au Phone: 1300 558 758 Post: Unit 2, 17/21 Bowden Street, Alexandria NSW 2015

Complaints

If you have a concern about how we have handled your personal or credit information, please contact us using the details above. We will:

• Acknowledge your complaint promptly
• Investigate the issue
• Respond within 30 days
• Provide reasons for our decision

If you are not satisfied with our response, you can contact:

• Office of the Australian Information Commissioner (OAIC) — www.oaic.gov.au — 1300 363 992
• Australian Financial Complaints Authority (AFCA) — www.afca.org.au — 1800 931 678 — info@afca.org.au — GPO Box 3, Melbourne VIC 3001

Changes to this policy

We may update this policy from time to time. The current version is always available on our website. Where changes are material, we will let you know through our website or by direct communication.

Contact us

The Asset Finance Shop Pty Ltd ACN 613 056 992 Authorised Representative Number 493210 Under Australian Credit Licence 525058

Email: info@tafs.com.au Phone: 1300 558 758 Website: www.tafs.com.au Address: Unit 2, 17/21 Bowden Street, Alexandria NSW 2015

Last Updated: 8 July 2025