Mute Pause Play Play Volume Close Download edit Close Email Facebook filter Instagram Linked In Linked In Close Next Scroll to move Touch to move Phone Open X Search Zoom

Privacy Policy

1. Introduction

In order to adhere to its licensing conditions, Centuria Bass Credit must disclose how it intends to collect and deal with an individual’s Personal Information (including Sensitive Information), and the measures it will take to safeguard that information.

In accordance with the Privacy Act and the APPs, this Policy covers;

  • the open and transparent management of Personal Information;
  • the rights of the client to transact anonymously or under a pseudonym;
  • the collection of solicited Personal Information;
  • the receipt of unsolicited Personal Information;
  • how Personal Information can be used and disclosed (including overseas);
  • maintaining the quality of Personal Information;
  • keeping Personal Information secure; and
  • the right for individuals to access and correct their Personal Information.

Centuria Bass Credit is also obligated under the Notifiable Data Breach Scheme to ensure that any eligible breach of client’s personal data, which is likely to result in serious harm to any individuals is managed accordingly, reported to the regulators and the client is advised.

2. Policy Objective

The purpose of this Policy is to ensure that Centuria Bass Credit provides open and transparent advice to their clients about the way in which any Personal Information that is collected and held by Centuria Bass Credit is appropriately managed. This Policy sets out Centuria Bass Credit’s processes and procedures to ensure that it meets the standards and requirements set by the Privacy Act, the APPs as well as the NDB Scheme. The Privacy Statement sets out the same guidelines and is in the correct format to be distributed to our clients. This Policy applies to all representatives, whether a contractor or permanent, full-time or part-time, who must attest annually in writing that they have read, understand and agree to comply with this Policy. If a representative fails to comply with this Policy, they may be subject to disciplinary procedures. This Policy should be read in conjunction with the Centuria Bass Credit Incident, Breach and Escalation Policy.

3. Privacy Policy

3.1 What Personal Information is collected?

The types of Personal Information that may be collected and held by Centuria Bass Credit includes information used to identify the client, their financial position and any other related information necessary to provide the client with business services. This may include, but is not limited to:

  • name;
  • contact details;
  • bank account information;
  • government identifiers (such as tax file number);
  • passport or driver’s license;
  • nationality;
  • business structures;
  • Sophisticated investor certificate (Chapter 6D).

In addition, Centuria Bass Credit is required to collect and hold Personal Information under the Anti-Money Laundering and Counter Terrorism Financing Act 2006 (Cth). The Personal Information provided by clients is information that enables Centuria Bass Credit to perform our functions and activities. If a client does not provide any of the Personal Information requested by Centuria Bass Credit or does not consent to the use, holding or disclosure of Personal Information in accordance with this Policy, Centuria Bass Credit will not be able to provide the client with the products or services required.

3.2 How is Personal Information collected?

The way in which Centuria Bass Credit will collect Personal Information provided by the client includes, but is not limited to, the following:

  • Centuria Bass Credit’s Investor Application form; and
  • Centuria Bass Credit’s website and systems.

In some circumstances, Centuria Bass Credit may gather Personal Information about the client from a third party or from publicly available information. The third parties from whom the business may acquire Personal Information include, but are not limited to:

  • information service providers;
  • credit agencies;
  • financial advisers;
  • fund managers; and/or
  • intermediaries and spouses.

Should a third party provide Centuria Bass Credit with a client’s Personal Information, it is assumed that the client has provided consent for that third party to do so, unless Centuria Bass Credit is notified otherwise.

3.3 How will Personal Information be used?

The purposes for which clients’ Personal Information will be used depends upon the relationship with the client and the nature of the products and services the client requires.

  • provide clients with products and services in accordance with Centuria Bass Credit’s AFSL;
  • administer and improve the products and services provided to Centuria Bass Credit’s clients;
  • offer the client further products and services (which may include using client’s information for marketing purposes, unless told otherwise); and
  • comply with legal and regulatory obligations under the Corporations Act 2001 and the Proceeds of Crime Act 2002, the Anti-Money Laundering and Counter Terrorism Financing Act, the Foreign Tax Compliance Act and the rules of relevant stock exchanges and ASIC.

Centuria Bass Credit may share client’s Personal Information with:

  • strategic partners for the purposes of meeting their obligations under anti-money laundering and counter terrorism financing laws; and
  • other service providers which may include, but are not limited to, archival, auditing, accounting, customer contact, legal, business consulting, banking, payment, delivery, data processing, data analysis, information broking, mailing, marketing, research, investigation, insurance, identity verification, brokerage, maintenance, trustee, securitization, website and technology services.

Centuria Bass Credit is entitled to use Personal Information for any purpose which is related to the purpose for which it was originally provided.

3.4 Storage of Personal Information

Personal Information will be held in a secure environment either in writing, electronically or both. Security measures are in place at Centuria Bass Credit which are intended to protect Personal Information held from misuse, interference and loss, and from unauthorized access, modification or disclosure. The client is entitled to request details on the exact nature of where and how their Personal Information is held by contacting Centuria Bass Credit. Personal Information will only be available to Centuria Bass Credit representatives on a need-to-know basis in order to perform their duties. The key methods of securing the storage of Personal Information include, but are not limited to:

  • secure access to electronic and physical records containing Personal Information, via password-protected access permissions to systems and security pass-protected access to filing cabinets and storage;
  • access only to authorized Centuria Bass Credit representatives that need to access the Personal Information to perform their daily duties;
  • varying access levels depending on the level of the authority and the type of Personal Information required to be accessed; and
  • controls relating to how Personal Information is extracted from the secure environment and how it is used and distributed.

3.5 Access to Personal Information

Should the client wish to know what Personal Information Centuria Bass Credit holds, they may request to view this Personal Information by contacting:

Centuria Bass Credit Level 41 2 Chifley Square, Sydney NSW 200
[email protected]

Centuria Bass Credit will promptly investigate any client’s privacy inquiry and provide appropriate answers where required or permitted. If the client discovers that their Personal Information is outdated, incorrect or incomplete, they may request to have the Personal Information corrected so Centuria Bass Credit can update their records accordingly. Clients are also able to contact Centuria Bass Credit if they have any questions regarding the business’ compliance with the Privacy Act or if they wish to make a complaint. Such complaints should first be made in writing to Centuria Bass Credit, as required by the Privacy Act. Centuria Bass Credit will endeavour to respond to a complaint within 7 calendar days, in keeping with the Centuria Bass Credit Complaints and Dispute Handling Policy. If the client is not satisfied with the response to a complaint, they have the right to complain to:

Financial Ombudsman Service GPO Box 3 Melbourne VIC 3001 Telephone: 1800 367 287
Facsimile: +61 3 9613 6399 Website: www.fos.org.au Email: [email protected]

If the client remains dissatisfied with the outcome of the complaint following its determination by the Financial Ombudsman Service, they may lodge a complaint with the Office of the Australian Information Commissioner using their Privacy Complaint form on their website (www.oaic.gov.au).

3.6 Disclosure of Personal Information

When a client provides Centuria Bass Credit with their Personal Information, they are acknowledging and agreeing that their Personal Information may be disclosed to any of the following third parties:

  • any person for the purposes described in any of our agreements with you, including our strategic partners;
  • the issuer or seller of a financial product or its registry provider (or to both), if you have instructed us to acquire the financial product and its terms require us to provide your Personal Information;
  • any regulatory, governmental organization or industry or legal body which governs the conduct of any part of our business in any jurisdiction or as required by law or regulation. Whilst not exhaustive, we may need to disclose Personal Information to regulatory bodies such as ASIC and relevant stock exchanges;
  • our related bodies corporate whether in Australia or any overseas jurisdiction, including to their officers, employees and professional advisers;
  • a third party who is supplying a service to us whether in Australia or any overseas jurisdiction. We may provide Personal Information to third parties including identity verification providers, information technology maintenance companies, software providers and share registries;
  • any person who acts on your behalf, as applicable, including your financial intermediary, authorized persons, solicitor, settlement agent, accountant, executor, administrator, trustee, guardian, or attorney;
  • a prospective purchaser of, or investor in (including their agent or third parties providing services relating to the purchase or investment), Centuria Bass Credit or one of our related bodies corporate or a business operated by the same, on a confidential basis;
  • any person as necessary to enable us, or our related bodied corporate, to enforce our, or its, rights in, or in relation to any defense from, an actual or potential claim;
  • any other person to whom you have authorized us or our related bodies corporate to release Personal Information;
  • any other third party provided that we obtain your prior written consent; and
  • as otherwise permitted by law.

3.7 Disclosure of Personal Information to related bodies

When a client provides their Personal Information to Centuria Bass Credit, they are acknowledging and agreeing that this Personal Information may be transferred between related bodies corporate or to third parties who supply products and services to Centuria Bass Credit. These related bodies corporate and third parties to whom Personal Information may be transferred may be located throughout the world and may be registered and governed by laws outside the Australian jurisdiction. As such, the laws regulating a related body corporate may differ to Australian laws and may apply a greater or lesser standard of protection for Personal Information. Should a client’s Personal Information be transferred to a jurisdiction with inadequate privacy protection, Centuria Bass Credit will take reasonable steps to ensure that the relevant overseas recipient does not breach the Privacy Act or APPs in relation to such Personal Information. Alternatively, Centuria Bass Credit may seek the client’s consent to the transfer.

3.8 Disclosure to other countries

[Not Applicable]

3.9 Centuria Bass Credit websites

Centuria Bass Credit’s website is considering the use of “cookies”. A cookie is an electronic mechanism that can trace access and use of Personal Information contained within websites. By using any Centuria Bass Credit website, the client is consenting to the use of cookies. Any Personal Information obtained through the use of cookies may be used to enhance the products and services that we provide.

3.10 Sensitive Information

Centuria Bass Credit may be required to collect Sensitive Information about clients in order to provide advice, products, or services. Centuria Bass Credit will only collect Sensitive Information with client consent or as otherwise permitted by law.

3.11 Government Related Identifiers

Centuria Bass Credit may be required to collect Government Related Identifiers of a client to provide a product or service. In particular, Centuria Bass Credit may collect Government Related Identifiers to verify a client’s identity in accordance with the Anti-Money Laundering and Counter Terrorism Financing Act.

3.12 Centuria Bass Credit representative obligations

As part of employee induction, all representatives must sign and date their compliance with the Centuria Bass Credit Code of Conduct and the Technology and Social Media Policy, both of which have clauses related to confidentiality and proper handling of Personal Information. Failure to comply with these policies may result in employees being subject to disciplinary action, including a reprimand, warning, suspension, or dismissal.

4. Notifiable Data Breaches

The NDB Scheme has been set up under part of the Privacy Act to establish requirements for Centuria Bass Credit when responding to data breaches. This scheme will only apply where the breach involves Personal Information that is likely to result in serious harm to the individual affected.

4.1 What is a data breach?

A data breach can constitute one or more of the following:

  • Unauthorized access – occurs when Personal Information that Centuria Bass Credit holds is accessed by someone who is not permitted to access it. This can include inappropriate access by a representative, contractor, or externally via a hacker.
  • Unauthorized disclosure – occurs when Centuria Bass Credit intentionally or unintentionally makes clients’ Personal Information accessible to others, this can include sending one client’s correspondence to another client or accidentally publishing confidential data.
  • Loss – occurs where Centuria Bass Credit loses Personal Information, for example leaving personal client information on public transport.

4.2 Serious harm to an individual

When assessing whether the breach of data is likely to cause serious harm to the individual affected Centuria Bass Credit needs to take into regard what a reasonable person would consider serious harm from the use of Personal Information that was part of the breach. When trying to assess the seriousness of the breach, Centuria Bass Credit must consider the likelihood and consequences of the harm eventuating for individuals. Things to consider include:

  • the kind of information breached;
  • the sensitivity of the information;
  • the security measures that were/are in place of the information;
  • the kind of people that could obtain or have obtained the information; and/or
  • the likelihood of those who have obtained the information in causing harm to the individuals.

4.3 Eligible Data Breach

An eligible data breach occurs when the following criteria are satisfied:

  • There is unauthorized access or unauthorized disclosure of Personal Information or loss of Personal Information Centuria Bass Credit holds.
  • This is likely to result in serious harm to one or more individuals.
  • Centuria Bass Credit has not been able to prevent the likely risk of serious harm with remedial action.

4.4 Remedial Action

Where a breach occurs, Centuria Bass Credit must take positive steps to address the breach in a timely manner. Where Centuria Bass Credit takes remedial action to ensure that the breach does not result in serious harm to the affected individual, then the breach is not an eligible breach and therefore not reportable.

4.5 Reporting the Breach

Where the remedial action prevents causing harm to the individual, Centuria Bass Credit must notify the affected individual/s and the Commissioner.

Notification must be done as soon as practicable after becoming aware of the breach. A statement must be provided online via the Notifiable Data Breach Form athttps://www.oaic.gov.au for the Commissioner.

Centuria Bass Credit has three options when notifying the individuals:

  1. Notify all individuals – where Centuria Bass Credit will notify each individual to whom the relevant information in breach relates.
  2. Notify only the individuals at risk of serious harm – where Centuria Bass Credit has assessed only a particular individual or group of individuals is at risk of serious harm in the relevant information in breach relates to notify.
  3. Public notification – where it is not possible to identify those affected, Centuria Bass Credit must publish a copy of the statement made to the commissioner on the website and take reasonable steps to publicize the statement details so that those affected can be rightly notified.

Both statements must include the following information:

  • The identity and contact details of Centuria Bass Credit.
  • A description of the eligible data breach including date of the breach, date Centuria Bass Credit detected the breach, circumstances of the breach, who has or is likely to obtain information and any relevant steps Centuria Bass Credit has taken to remediate.
  • The kind of information involved in the data breach.
  • What steps Centuria Bass Credit recommends that individuals take in response to the data breach.

4.6 Exceptions to notification obligations

There are exceptions when Centuria Bass Credit may not need to report a data breach. These include:

  • Eligible data breaches of other entities – this applies when an enforcement body has already notified individuals or the Commissioner where applicable. This can only be an exception when there is a written statement received, regarding the eligible data breach, dated and signed by the CEO of the enforcement body. This exception does not apply if an eligible data breach is unrelated to an enforcement activity.
  • Enforcement related activities – this applies when an enforcement body does not need to notify individuals about an eligible data breach if its chief executive officer believes on reasonable grounds that notifying individuals would be likely to prejudice an enforcement related activity conducted by, or on behalf, of the enforcement body.
  • Inconsistency with secrecy provisions – this applies when the requirement to provide a statement to the Commissioner or any individual about an eligible data breach does not apply to the extent that this requirement is inconsistent with a secrecy provision. The common purpose of secrecy provisions is to prohibit the unauthorized disclosure of client information. Most secrecy provisions allow the disclosure of information in certain circumstances, such as with an individual’s consent where the information relates to them, or where the disclosure of information relates to an officer’s duties, or the exercise of their powers or functions. Where there is an eligible data breach, Centuria Bass Credit should apply this exception only to the extent necessary to avoid inconsistency with a secrecy provision.
  • Declarations by the Commissioner – in some circumstances, the Commissioner may declare by written notice that Centuria Bass Credit does not need to comply with the NDB scheme notification requirements. The purpose of the declaration by the Commissioner is to provide an exception where compliance with the NDB notification requirements would conflict with the public interest.

5. Implementation, Monitoring and Review

Centuria Bass Credit ensures the effective implementation of this Policy to ensure that all representatives are aware of their obligations regarding Privacy. All new starters must read the Centuria Bass Credit Privacy Policy when they join.

This Policy is reviewed to monitor its effectiveness and to consider its suitability, adequacy, and identify any deficiencies. Where necessary, it will be updated to ensure that the Policy is in line with all regulations, updates, and notifications to keep Centuria Bass Credit compliant and performing to their best ability. Review and assessment of this Policy will be carried out at least annually or whenever a material change occurs. Any changes to this Policy will be communicated down to the business.

Compliance with this Policy ensures Centuria Bass Credit meets its obligations. Apart from what has already been covered in the Policy, Centuria Bass Credit Compliance will monitor this Policy’s use and effectiveness through ensuring that:

  • All Centuria Bass Credit representatives attest annually that they understand and comply with this Policy.
  • Any potential breaches of the Privacy Act are reported under the Incidents, Breaches, and Escalation Policy.