Our commitment to protect your privacy

1. We understand how important it is to protect your personal information and as such we are committed to protecting the personal information we hold on our customers, partners and employees and to complying with our obligations under the Privacy Act 2020 (the Privacy Act) and its 13 information privacy principles (IPP).
2. In this Privacy Policy, we refer to any information that can uniquely identify an individual (including the information described below) as “personal information”. This Privacy Policy has been written to help you understand how we collect, use, disclose and protect your personal information when visiting any of our websites, including squirrel.co.nz and www.mortgagerates.co.nz (the Websites), using our peer-to-peer and wholesale lending platform (Platform), are employed by us or are otherwise accessing our products and services.

Who are we?

3. The terms “we”, “us” and “our” are a reference to Squirrel Group Limited and its related companies including Squirrel Money Limited and Squirrel Mortgages Limited (collectively, the Squirrel Group) and employees and authorised agents of the Squirrel Group. References to “you” and “your” are a reference to you.

Your authorisation

4. By providing us with personal information, including by accessing the Websites, using our products and services, or otherwise engaging with us, you acknowledge that you have read and understood this Privacy Policy and consent to the collection, use, storage and disclosure of your personal information in accordance with the terms set out in this Privacy Policy (as amended from time to time).

Purpose for collection of personal information

5. We will only collect personal information if it is for a lawful purpose connected with the products and services we provide, and the information is necessary for these purposes.
6. The type of personal information that we collect will depend on the purpose for which it is collected, but may include:
   1. contact information, such as your name, address(es), phone number(s) and email address(es);
   2. documentation required to verify your identity, such as a passport or driver’s licence;
   3. financial information, such as your statement of position, bank statements, income sources and value; d. your IRD number and tax status;
   4. security information, such as your residential property, vehicle details and personal assets;
   5. employment information, such as your current employer, position, salary and work history; and
   6. bureau information, such as credit history, anti-money laundering and financial terrorism information.
7. We may collect personal information (including credit information and health information) on behalf of the lenders, insurers and other providers of products or services that you choose to apply for (Product Providers). Product Providers will have their own Privacy Policy that applies to the information that we collect on their behalf.

Source of personal information

8. We collect and use personal information provided by you through your use of the Websites and when you apply for and/or access our products and services. If you choose not to provide personal information to us on request, this may mean we are unable to provide services to you, or it may affect the quality of those services.
9. We may collect personal information about you through third-party service providers, where you have agreed to the release of such personal information to us.
10. We may use your personal information in the following ways:
    1. to verify your identity, contact details, employment, and tax status;
    2. to run credit checks as appropriate or other checks for the purpose of registering you client;
    3. we collect financial information (income, expenses, debts) to help us assess your ability to borrow or otherwise to provide you with our products and services;
    4. communication between you and us related to our products and services;
    5. to assist us in developing and improving our products and services;
    6. to enforce our rights where necessary, in accordance with any contract or other terms and conditions to which you are subject;
    7. to ensure the correct amount of income tax or resident withholding tax (if applicable) is deducted from any amounts paid by us to you;
    8. if you provide content to us (such as comments or reviews), to publish that content on the Websites;
    9. to perform statistical analysis of customer behaviour and use of the Websites; and/or
    10. to comply with our legal obligations, including customer due diligence requirements under the AntiMoney Laundering and Countering Financing of Terrorism Act 2012.

Collection of personal information

11. We will not otherwise collect any personal information about you unless we have your permission, or you knowingly provide us the information.
12. In most circumstances it will be necessary for us to identify you in order to successfully do business with you. However, where it is lawful and practicable to do so, we will offer you the opportunity of doing business with us without providing us with personal information, for example, if you make general inquiries about interest rates or current promotional offers.
13. You may choose to interact with the Websites anonymously, but we will not be able to contact you unless you provide us with some personal information.

Manner of collection of personal information

14. Generally, we will collect your personal information directly from you. For example, we collect your personal information directly from your use of the Websites and the information that you submit to the Websites. We also collect your personal information if you use the “contact us” functionality on the Websites or you provide the personal information during conversations between you and us.
15. We may also collect your personal information from:
    1. Product Providers (e.g. during the term of any loan or insurance we have arranged on your behalf, in order to answer your queries or assist you with your financial arrangements as your circumstances change). If applicable, the Product Providers may also periodically disclose your loan balance, premium or sum insured to us in connection with the payment of ongoing commission to us over the term of your loan or insurance;
    2. other entities within the Squirrel Group;
    3. credit reporting, debt collection and identity verification agencies; and
    4. third-party referrers, advisors and supervisors of the products and services we offer;
    5. any other person authorised by you or the Privacy Act.
16. If you provide any personal information about anyone else to us, you confirm that you have collected that personal information in accordance with the Privacy Act and that the individual concerned has:
    1. authorised the disclosure to us and the collection, use and disclosure of their personal information by us in accordance with this Privacy Policy; and
    2. been informed of their right to access and request correction of their personal information.

Storage and security of your personal information

17. We maintain physical, technical and procedural safeguards that are appropriate to the sensitivity of the personal information we hold on our customers, partners and employees. These safeguards are designed to prevent your personal information from loss or unauthorised access, copying, use, modification or disclosure.
18. Any information captured online is stored on our secure server and in a secured database. IT professionals manage both of these on our behalf. Physical (“hardcopy”) information provided to us is stored onsite at our offices. We use a mix of alarms, cameras and other controls in our buildings to prevent unauthorised access to our offices.
19. Whilst we strive to do everything reasonably possible to protect your personal information and privacy, we cannot guarantee or warrant the security of any information you disclose or transmit to us, and we are not responsible for the theft, destruction, or inadvertent disclosure of your personal information where our security measures have been breached.
20. Any electronic transmission or physical transportation of personal information is conducted at your own risk.

Access to personal information

21. You can ask to access the personal information that we hold about you at any time. If you want to review, verify or correct your personal information, please contact our Privacy Officer (see the “How to get in touch with us” section below for our contact details).
22. Your right to access the personal information that we hold about you is not absolute. There are instances where applicable law or regulatory requirements allow or require us to refuse to provide some or all of the personal information that we hold about you e.g. material of an evaluative nature, or due to risk to public safety and/or harassment. In addition, the personal information may have been destroyed, erased or made anonymous in accordance with our record retention obligations and practices.
23. In the event that we cannot provide you with access to your personal information, we will endeavour to inform you of the reasons why, subject to any legal or regulatory restrictions.

Correction of personal information

24. Where your consent was required for our collection, use or disclosure of your personal information, you may, at any time, subject to legal or contractual restrictions and reasonable notice, withdraw your consent. All communications with respect to such withdrawal or variation of consent should be in writing and addressed to our Privacy Officer (see the “How to get in touch with us” section below for our contact details).
25. We will generally rely on you to ensure the information we hold about you is accurate. If any of your details change, please let us know as soon as possible.
26. If we are unable or not willing to correct errors that you identify in your personal information, you may request that we take reasonable steps to attach a statement to the personal information noting the correction request.

Accuracy and updating of your personal information

27. It is important that the information contained in our records is both accurate and current at the point that we provide products or services to you or whilst you are employed by us. If your personal information happens to change during the provision of products or services to you or during course of your employment with us, please keep us informed of such changes.
28. We will use our best endeavours to ensure that all personal information that is held shall not be used without taking such steps (if any) as are, in the circumstances, reasonable to ensure that, having regard to the purpose for which the information is proposed to be used, the information is accurate, up to date, complete, relevant, and not misleading.

Retention of personal information

29. Except as otherwise permitted or required by applicable law or regulatory requirements, we will retain your personal information only for as long as we believe is necessary to fulfil the purposes for which the personal information was collected (including, for the purpose of meeting any legal, accounting or other reporting requirements or obligations). We may, instead of destroying or erasing your personal information, make it anonymous such that it cannot be associated with or tracked back to you.

Use of personal information

30. We may use your personal information:
    1. for the purposes described in this Privacy Policy; or
    2. for any additional purposes that we advise you of and, where your consent is required by law, we have obtained your consent in respect of the use or disclosure of your personal information.
31. We may use your personal information without your knowledge or consent where we are permitted or required by applicable law or regulatory requirements to do so.

Disclosure of personal information

32. We may disclose information about you (including your identity) to a third-party for the following purposes:
    1. carrying out credit and identity checks or undertaking the collection or recovery of debts;
    2. conducting legal proceedings or other investigations;
    3. providing our products and services to you;
    4. enabling a third party to provide services to us or to you;
    5. providing wholesale investors, or prospective investors, with sufficient information to undertake due diligence of a loan you may have taken out on the Platform and for them to comply with any regulatory or legislative requirements as a lender under the Platform; and
    6. as otherwise permitted or required by law.
33. Third-parties that we may share your personal information include:
    1. Product Providers and other prospective lenders, third parties or other intermediaries in relation to your finance or insurance requirements (including a prospective lender’s mortgage insurer (if any), any person with whom a lender or insurer proposes to enter into contractual arrangements, any person who provides a guarantee or security and any trustee and any assignee or potential assignee of a lender’s or insurer’s rights);
    2. any company within the Squirrel Group, including any of their related companies;
    3. our professional advisors, consultants and auditors;
    4. our third-party service providers (such as IT service providers or market research companies);
    5. third-party advisors to, and supervisors of, the products and services we offer;
    6. credit reporting, debt collection and identity verification agencies;
    7. investors, or any entity that has an interest in our business or any entity to whom we consider assigning or transferring any of our rights or obligations or selling all or part of our business;
    8. anyone who we are legally required or authorised to share your information with, including regulators and government agencies; and
    9. other third-party suppliers or service providers that you give us permission to share your personal information with. 34. You acknowledge and agree that credit reporting agencies may hold your credit information (including default information) on their systems and use such information to provide their credit reporting services, which may include providing your credit information (including default information) to their customers.
    10. If you are referred to us for a mortgage from a real estate agent, we may confirm to the agent the status of your loan application. This will not include the sharing of any information that might influence the outcome of the property sale. 36. If you are referred to us for a mortgage or personal loan by third-party that has a referral relationship with us, such as a construction company, builder, media outlet or retailer, we may provide a representative of that third-party the status of your loan application to enable the third-party to provide products or services to you.
34. If you have registered as a borrower and you have asked someone else to register as a co-borrower, each of you acknowledge and agree that:
    1. you consent to us providing your personal information to the other of you; and
    2. we will be entitled to accept instructions from either of you in respect of the access to, use of, and amendment to, your personal information by us.
    3. Where applicants are joint borrowers we will communicate to both parties where the information shared is joint information related to the mortgage.
35. Prior to disclosing any of your personal information to another person or organisation, we will take all reasonable steps to satisfy ourselves that the person or organisation has a commitment to protecting your personal information at least equal to our commitment.

Cross-border disclosure of personal information

39. We may use cloud storage to store the personal information we hold about you. The cloud storage and the IT servers may be located outside New Zealand.
40. We may also disclose personal information to the overseas entities within the Squirrel Group (if any), and third-party suppliers and service providers located overseas for some of the purposes listed above.
41. Where personal information is transferred outside of New Zealand, we will ensure that such third-party is subject to comparable privacy laws to New Zealand or is required to protect the personal information in a way that is comparable to New Zealand’s privacy laws.

Unique identifiers

42. We may assign you a unique identifier to enable our systems and processes to function efficiently during the provision of our products and services to you.
43. We may also capture information that uniquely identifies you such as your IRD number, driver’s license number or passport number if required to enable the provision of our products and services to you.

Our Websites

44. When you visit the Websites, we collect certain information about your device and your interaction with the Websites. We may also collect additional personal information from you if you complete an application or contact form or use the calculators available on the Websites.
45. The type of information we collect about your device includes: the version of web browser you are using, your IP address and time zone, cookie information, what sites you visit and how you interact with the Websites. We collect this information to help load the Websites accurately for you, and to perform analytics on usage of the Websites to optimize their performance. This information is collected automatically when you access the Websites using cookies, log files, web beacons, tags, or pixels which enables us to recognise your device any time you visit the Websites.
46. We may use your personal information to provide you with targeted advertisements or marketing communications we believe may be of interest to you and e may share the information we collect about your use of the Websites and your interaction with our advertisements on other websites with our digital advertising partners. We use Google Analytics to help us understand how our customers use the Websites. You can read more about how Google uses your personal information here and you can opt-out of Google Analytics here. You can opt out of targeted advertising by changing your Facebook and Google settings
47. Cookies - a cookie is a small amount of information that’s downloaded to your computer or device when you visit the Websites. We may use a number of different cookies, including functional, performance, advertising, and social media or content cookies. Cookies provide us information on how people use the Websites, for instance whether it’s their first time visiting or if they are a frequent visitor.

The length of time that a cookie remains on your computer or mobile device depends on whether it is a “persistent” or “session” cookie. Session cookies last until you stop browsing and persistent cookies last until they expire or are deleted. Most of the cookies we use are persistent and will expire between 30 minutes and 90 days from the date they are downloaded to your device. You can control and manage cookies in various ways. Please keep in mind that removing or blocking cookies can negatively impact your user experience and parts of the Websites may no longer be fully accessible.

Most browsers automatically accept cookies, but you can choose whether or not to accept cookies through your browser controls, often found in your browser’s “Tools” or “Preferences” menu. For more information on how to modify your browser settings or how to block, manage or filter cookies can be found in your browser’s help file or through such sites as www.allaboutcookies.org. Please note that blocking cookies may not completely prevent how we share information with third parties such as our digital advertising partners. To exercise your rights or to opt-out of certain uses of your information by these parties, please follow the “optout” instructions above. 48. Do not track - please note that because there is no consistent industry understanding of how to respond to “Do Not Track” signals, we do not alter our data collection and usage practices when we detect such a signal from your browser.

49. As the Websites are linked to the internet, and the internet is inherently insecure, we cannot provide any assurance regarding the security of transmission of information you communicate to us online. We also cannot guarantee that the information you supply will not be intercepted while being transmitted over the internet. Accordingly, any personal information or other information which you transmit to us online is transmitted at your own risk.
50. Links and third-party advertisements. The Websites may contain links to other websites operated by third parties. The Websites may also display advertisements, which are hosted by third parties. We make no representations or warranties in relation to the privacy practices of any third-party website or advertisement providers and we are not responsible for other privacy policies or the content of any third-party website or advertisements. Third-party websites are responsible for informing you about their own privacy practices. Our digital advertising partners may use cookies, web beacons or other web tracking techniques to collect non-personally identifiable information about your activities on the Websites and other websites that you may visit to provide you targeted advertising based upon your interests.

Changes to our Privacy Policy

51. We reserve the right to modify or amend this Privacy Policy from time to time for any reason. Any changes will apply from the date we post the updated Privacy Policy on the Websites.
52. We may change this Privacy Policy from time to time by publishing an updated version on the legal agreements page on the Websites to reflect changes in the law and also our business needs so long as the changes do not disadvantage you. By continuing to engage us or use the Websites you will be deemed to have accepted the updated Privacy Policy.
53. If we make any significant changes, we will provide you with reasonable notice of such changes through the Websites or via other means such as email. By using our services and/or accessing the Websites after such notice period, you will be deemed to have accepted the updates to this Privacy Policy. If you do not agree to any change, you must immediately notify us and stop using our services and accessing the Websites.

How to get in touch with us or access your information

54. If you have any questions on this Privacy Policy or would like to request access to or correct the personal information that we have collected about you, you can contact us at: