Privacy Policy

1. About this policy

This Privacy Policy explains how Noddle Pty Ltd (Noddle, we, us or our) collects, holds, uses and discloses personal information. It applies when you visit our website, contact us, make an enquiry, use our services, apply for finance, deal with us as a customer, guarantor, referrer or representative, or apply to work with us.

Noddle provides finance broking services for consumer car and personal loans. We do not provide mortgage broking and the proposed credit provider, not Noddle, makes the final lending decision.

We comply with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), applicable provisions of Part IIIA of the Privacy Act, the Privacy (Credit Reporting) Code 2025 where it applies to our activities, and the Notifiable Data Breaches scheme. Our electronic marketing also operates under the Spam Act 2003 and applicable telemarketing laws.

This policy is an explanation of our privacy practices. It is not a blanket consent. We provide separate collection notices and obtain specific authorities or express consents when required, including for credit report access, bank-statement retrieval, biometric identity verification and direct marketing.

Noddle is part of the Jacaranda Finance Group. This policy applies to Noddle. Related group companies have their own privacy responsibilities. We disclose information to a related company only where permitted by law and relevant to the purpose for which the information was collected, or with your consent.

2. Personal information we collect

The information we collect depends on how you deal with us. It may include:

• identity and contact information, including name, date of birth, addresses, telephone number and email;
• identity-document information, such as driver licence or passport details, where needed for verification;
• residency, citizenship and fraud-prevention information;
• employment, income, expenses, assets, liabilities, bank statements and other financial information;
• information about the car or purpose for which finance is sought, the requested amount and preferred features;
• application, lender, product, recommendation, quote, proposal and settlement information;
• consumer credit information or information derived from a credit report where we are permitted to handle it;
• communications, call recordings, emails, messages, complaints and notes of our dealings with you;
• website and device information, such as IP address, browser, pages visited, cookie identifiers and enquiry source;
• information about a co-applicant, spouse, dependant, guarantor, referee or authorised representative; and
• recruitment information if you apply to work with Noddle.

We do not ordinarily need your tax file number. Please do not send it unless we specifically request it and explain the lawful reason. If an unneeded tax file number is received, we will take reasonable steps to remove or securely destroy it.

3. Sensitive and identity information

Sensitive information includes health information, criminal-record information and biometric information used for automated biometric identification or verification. We collect sensitive information only where it is reasonably necessary for our functions and you have given valid consent, or where collection is required or authorised by law.

• If biometric verification is offered, the provider, information used, purpose and retention arrangements will be identified at the point of use, and express consent will be requested.
• If you ask us to help communicate a hardship request to your lender, we collect only information reasonably needed to provide that assistance and disclose it with your authority.
• Government-related identifiers are used only for verification or another legally permitted purpose. We do not adopt them as Noddle’s own customer identifier.

4. How we collect information

We usually collect information directly from you when you:

• use our website, submit an enquiry or start an application;
• speak with a broker, upload documents, connect a bank-statement service or communicate with us;
• sign a quote, proposal, consent, application or other document; or
• ask us to provide support, access, correction or complaint handling.

We may also collect information from:

• Jacaranda Finance or another referrer that introduces you to Noddle;
• Connective, our aggregator, and systems made available through that arrangement;
• credit providers on our panel and their application systems;
• a credit reporting body, where we act as your authorised access seeker or as permitted for an application;
• identity, fraud-prevention, bank-statement, open-banking, document and technology service providers;
• co-applicants, guarantors, representatives, employers or referees where relevant and lawful; and
• public registers or other lawful public sources where reasonably necessary.

If we receive your information from another person, we take reasonable steps to notify you of the collection and the APP 5 matters, unless an exception applies. Our application Collection Notice is designed for both direct applications and referral journeys.

5. Why we handle personal information

We collect, hold, use and disclose information to:

• respond to enquiries and understand your requirements and objectives;
• verify identity, detect fraud and meet applicable lender, licensing and legal requirements;
• assess your financial circumstances for responsible-lending and credit-assistance purposes;
• compare products available through our panel and prepare a recommendation;
• submit and support applications with your chosen credit provider;
• communicate application progress, obtain documents and assist through settlement;
• maintain records of our credit assistance, authorities, disclosures and communications;
• manage commissions, fees, referrals, conflicts, complaints and regulatory obligations;
• improve our services, systems, quality assurance and staff training using appropriately controlled information;
• protect Noddle, customers and other people from fraud, cyber threats and unlawful activity; and
• send direct marketing where permitted and after recording any required consent.

We may also use or disclose information for a related secondary purpose you would reasonably expect, with your consent, or where required or authorised by Australian law.

6. Who we disclose information to

Depending on your application or dealings with us, recipients may include:

• credit providers and lessors on our panel, but only where relevant to comparing, recommending or applying for a product;
• Connective and its technology, compliance and application-support services;
• Jacaranda Finance and other Jacaranda Finance Group entities for authorised referrals, shared support or administration, and separately consented marketing;
• identity-verification, fraud-prevention, bank-statement, open-banking, electronic-signature, communications, cloud, CRM and document service providers;
• your co-applicant, guarantor, authorised representative, accountant, financial counsellor or lawyer;
• AFCA, ASIC, the OAIC, law-enforcement bodies, courts or other authorities where required or authorised; and
• professional advisers, auditors and insurers supporting Noddle’s operations.

We do not sell personal information. We do not disclose financial information, consumer credit information, bank statements or identity documents to advertising platforms for their own use.

7. Credit reporting information

Noddle is a credit assistance provider and does not generally provide credit in its own name. A proposed lender may obtain a consumer credit report to assess an application and may create a credit enquiry. The lender’s credit-reporting notice and privacy policy explain the credit reporting bodies it uses and its reporting practices.

Noddle may handle consumer credit information where:

• you authorise us in writing to act as your access seeker or agent;
• a proposed credit provider or aggregator lawfully provides information for application processing; or
• we otherwise handle the information as a service provider or in a manner permitted by Part IIIA.

We do not make repayment-history, default, serious-credit-infringement or financial-hardship reports to credit reporting bodies in our capacity as a broker. If a lender provides information to a credit reporting body, that is governed by the lender’s notices and obligations.

At the time a credit report is requested, we or the proposed lender will identify the relevant credit reporting body and provide any required notification. You may request access to consumer credit information held by Noddle, but information held only by a lender or credit reporting body must be requested from that organisation.

8. Digital services and automated processing

Noddle uses technology to make the application process faster and more consistent. Personal information may be used by computer programs to:

• check identity and documents, screen for fraud and identify inconsistencies;
• extract and organise information from application documents and bank statements;
• compare an applicant’s circumstances with lender eligibility criteria;
• rank or shortlist panel products for broker review;
• identify missing information, compliance checks or applications needing attention; and
• support quality assurance, record keeping and customer communications.

Automated tools may perform steps substantially related to pre-qualification, product matching or fraud screening. They do not make a lender’s final approval decision. A Noddle broker reviews the application and recommendation, and the proposed credit provider applies its own assessment. You may ask us to explain or manually review a Noddle-generated outcome where appropriate.

We do not enter confidential application information into public generative-AI services. Where an AI or automated service provider processes personal information for Noddle, it must be approved and subject to appropriate privacy, security, access and contractual controls.

9. Website analytics, cookies and marketing

Our website uses cookies and similar technologies for security, functionality and analytics. We do not use cookies to serve advertising. You can control or delete cookies through your browser settings. Blocking some cookies may affect website functionality.

We send electronic marketing only where we have consent or another lawful basis. Messages identify the sender and provide a functional unsubscribe method. We action electronic-marketing opt-outs within five working days. You can also opt out by contacting us.

Consent to Noddle marketing is separate from consent to marketing by a related Jacaranda Finance Group company. Marketing choices do not affect our consideration of an application. Service and application messages are not marketing merely because they are sent electronically.

Marketing calls are made only where permitted by the Do Not Call Register Act and applicable industry standards. Callers must identify the business, provide required contact information, call only during permitted times and end the call when requested.

10. Overseas disclosures

Some technology and support providers may process or allow support access to personal information from outside Australia. Based on our current service arrangements, likely locations may include the United States, Singapore and India. We periodically review these locations and will update this policy if our arrangements materially change.

Before disclosing personal information overseas, we take reasonable steps required by APP 8 to ensure the recipient handles it consistently with the APPs, unless a specific exception applies. We do not treat acceptance of this policy as a waiver of APP 8 accountability. If we propose to rely on express consent to an APP 8 exception, we will first identify the recipient or class of recipient, explain the consequences and obtain specific consent.

11. Security, data breaches and retention

We take reasonable technical and organisational steps to protect personal information from misuse, interference, loss, unauthorised access, modification and disclosure. Measures may include access controls, encryption where appropriate, logging, staff training, vendor due diligence, secure document handling and incident-response procedures.

If we suspect a data breach, we will contain and assess it promptly. Where the Notifiable Data Breaches scheme requires notification, we will notify affected individuals and the OAIC and provide recommendations to reduce harm.

Retention depends on the record. We generally retain credit-assistance, application, assessment, consent, disclosure, commission and complaint records for at least seven years where required or reasonably necessary for credit-licensing, legal and dispute purposes. Other records may be kept for a shorter or longer period according to a documented retention schedule. When information is no longer required and no law requires retention, we take reasonable steps to destroy or de-identify it.

12. Access and correction

You may ask for access to personal information Noddle holds about you or request correction if it is inaccurate, out of date, incomplete, irrelevant or misleading. There is no charge to make a request. We may charge only a reasonable cost for providing access where permitted, and we will tell you first.

We respond within a reasonable period. If we refuse access or correction, we will provide written reasons and available complaint options unless the law permits otherwise. Credit-reporting correction or complaint timeframes are applied where Part IIIA or the Privacy (Credit Reporting) Code 2025 applies to Noddle’s handling.

13. Privacy complaints

Please contact our Privacy Officer using the details in section 15. Explain what happened, the information involved and the outcome you seek. We will acknowledge the complaint promptly and, where practicable, within one business day. We aim to provide a written response within 30 calendar days, subject to any shorter applicable credit-reporting or financial services timeframe.

If you are not satisfied, you may complain to the Australian Financial Complaints Authority (AFCA) where the complaint is within its jurisdiction, or to the Office of the Australian Information Commissioner (OAIC). The OAIC generally expects you to first give us a reasonable opportunity, usually 30 days, to respond.

Australian Financial Complaints Authority	1800 931 678 info@afca.org.au www.afca.org.au GPO Box 3, Melbourne VIC 3001
Office of the Australian Information Commissioner	1300 363 992 enquiries@oaic.gov.au www.oaic.gov.au GPO Box 5218, Sydney NSW 2001

14. Anonymity and third-party information

You may deal with us anonymously or using a pseudonym where lawful and practicable. We cannot provide credit assistance or submit an application without verifying the identity of the relevant applicant when verification is required.

If you provide information about another person, please tell them you have done so and direct them to this policy and the relevant Collection Notice. We may contact them to provide notice or obtain authority where required.

15. Changes and contact details

We may update this policy when our practices, service providers or legal obligations change. The current version will be available at noddle.com.au. Material changes will be communicated directly where required.

Privacy Officer

Email	hello@noddle.com.au
Phone	1300 168 250
Office	1/339 Coronation Drive, Milton QLD 4064