Centuria Privacy Policy

The type of information collected by us will depend upon your relationship with Centuria and may include:

• name and title
• address
• contact details
• detail on entities through which you invest
• date of birth
• bank account details
• detail on your nominated beneficiaries (for friendly society bonds)
• shareholding details (for shareholders in Centuria Capital Limited)
• Taxation Identification Number e.g. Tax File Number.

In most cases, and wherever possible, Centuria will try to collect personal information only from you. Information will be collected through various company forms and from you directly, either in writing or verbally. We may also collect information about you from third parties, including:

• Financial advisers
• Outsourced registry providers
• Credit reporting bodies
• Public websites
• Contractors
• Tenants
• Other third parties you have authorised.

Your personal information is held in our registry systems for our investors and shareholders. These are either 3rd party specialist registry service providers or through an in-house registry system. Reverse mortgages borrower information is held internally and with external loan servicing and custodial service providers.

Generally personal information is stored electronically with hard copy records retained and archived with an archival service provider. Hard copies of leases and other agreements and contracts will be kept in a locked cupboard or fireproof safe (as required).

Generally, we do not combine or link other personal information held about you. The exception is when you notify us in an investment application that you have previously invested with us. In these situations, we will add the new investment to the existing client profile so that all investments are linked to under one client profile. Where available, we may also offer a service that will enable you to link your personal information when you have invested in different products across different Centuria subsidiaries so that you can choose to consolidate your investments in one online login etc.

All internal systems are subject to the security measures detailed in this policy. All external service providers are contractually required to hold personal information in accordance with the Privacy Act.

Centuria collects personal information about you primarily:

• to provide you with the products and services you request
• to provide you with the information you request
• to verify your identity before transactions are processed, your instructions are carried out, or providing you with information about your investment
• to administer your financial product or loan
• to provide you with information about other products or services offered by Centuria or its related entities. This includes sharing your information within the Centuria group, including Centuria Bass, so we can inform you about our other products unless you opt out of receiving marketing material.
• to respond to your enquiries or complaints
• to prepare internal reporting that includes identifiable customer information (e.g. customer sales or marketing information, complaints or issues reporting, registry operations reporting) to satisfy any legal requirements.

The Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (AML/CTF Act) is aimed at addressing money laundering in Australia and the threat to national security caused by terrorism. This legislation requires us to collect identification information from investors into our investment products and reverse mortgage borrowers and to verify your identity from original or certified copies of specified documents or perform electronic verification. Details of what identification information and documentation you are required to provide are set out in transactional based forms. We may also contact you to follow up and clarify certain information.

Under this legislation we are also required to monitor transactions to identify any suspicious activity within any of our investment products.

As required under the AML/ CTF Act, we may, in our absolute discretion, without notice to you, disclose or otherwise report details of any transaction or activity, or proposed transaction or activity (including any personal information) to the relevant reporting body.

Personal information held by Centuria may be disclosed to third parties such as:

• outsourced service providers, including administration, custodial and registry service providers; printers and mailing houses, information technology systems
• software providers, actuaries, professional advisers and research organisations
• business partners, including insurance underwriters
• government agencies including APRA, ASIC, AUSTRAC, Centrelink, Office of the Australian Information Commissioner (OAIC) or the ATO
• related companies
• credit reporting bodies, where a person is in default in relation to loan or other credit arrangements
• financial intermediaries such as financial planners and taxation or accounting advisers
• other third parties you have authorised to receive your personal information.

Where Centuria contracts with an outsourced service provider or business partner we take reasonable steps to protect the privacy of any information disclosed to them. This includes inserting confidentiality provisions and a requirement to comply with the Privacy Act in our contractual arrangements.

Centuria’s registry and administration service provider for its friendly society business may perform or engage parties who are located overseas to perform certain services overseas including back-office and anti-money laundering counter-terrorism financing screening services. As a result, personal information collected by Centuria may be disclosed to a recipient in a foreign country. The countries in which such overseas recipients are likely to be located are the United Kingdom, New Zealand, the United States of America, Canada, Singapore, The Netherlands, India and the Philippines.

Centuria’s registry and administrative service provider is contractually required to takes reasonable steps to ensure the overseas recipients comply with the APPs. This is achieved by implementing contractual arrangements with overseas service providers to ensure the personal information is appropriately safeguarded and to ensure that these overseas service providers comply with the APPs.

If you make an application for credit, Centuria can access a copy of your individual credit report from a Credit Reporting Body (CRB) to help us make a decision about whether or not to grant the application.

We may also disclose your credit information to a CRB if you fail to meet your payment obligations to us, or if you commit a serious credit infringement, in relation to consumer credit for our products or services.

In turn, the CRB may include your personal information in credit reporting information they provide to other credit providers.

From time to time Centuria may wish to use your information to tell you about other products, services or special offers that we think may be of interest to you. Please let us know if you do not want to receive these offers by contacting us using the contact details noted below or selecting the unsubscribe option in an email.

Centuria aims to ensure that the personal information we retain about you is accurate, complete and up to date. Please provide us with complete and accurate information and keep us informed of any changes in your details such as a change of address.

If you do not provide all or part of the personal information that we request, we may not be able to contact you or to administer your investment properly.

If you believe that the information we hold about you is inaccurate please contact us directly using the contact details provide below, so that we can update our records.

Centuria will at all times take steps to protect your personal information from misuse, loss, unauthorised access, modification or disclosure. Your personal information is treated as confidential.

Employees and contractors of the Centuria are bound by confidentiality obligations.

Passwords, firewalls and virus protection are used by Centuria with a view to ensuring the security and integrity of the information technology systems that hold your information.

All premises housing our systems and other copies of your information are monitored and protected by security alarms and access card or key lock entry. Service providers who hold personal information are contractually required to hold information in accordance with the Privacy Act and Centuria obtains periodic confirmation of adequate information security management.

We will promptly notify you if we are aware of or have reasonable grounds to believe that your personal information held by us is involved in an eligible notifiable data breach and involves personal information being lost or subjected to unauthorised access or unauthorised disclosure which is likely to result in serious harm. Our notification to you will include recommendations about the steps you should take in response to the breach and will not be anytime longer than 30 days from when the determination has been made by our management that the breach may cause serious harm. We will also notify the OAIC of the data breach.

Our assessment and escalation of such breaches will be in done in accordance with our Incident & Breach Reporting Policy and procedures.

You are entitled to obtain access to your personal information subject to some exceptions allowed by law. You may also request that Centuria correct or update information that we hold on you. We encourage our customers to ensure that their personal information is accurate and up to date, particularly mailing address and contact details. We include regular reminders in correspondence with our customers.

If you wish to make a request for access to your personal information, please contact us using the contact details below.