AUSTRALIAN MOTORCYCLE & MARINE FINANCE PTY LTD Privacy Statement

1. WHO ARE WE?

In this privacy policy “AMMF”, “we”, “us” and “our” means Australian Motorcycle and Marine Finance Pty Ltd ACN 603 969 875 which is a wholly owned subsidiary of Yamaha Motor Finance Australia Holdings Pty Ltd ACN 687 834 224 and its related bodies corporate (the“Yamaha Finance Group”).

This privacy policy explains how we collect, use, disclose and protect your information, including in connection with:

• use of the AMMF website (www.ammf.com.au) (“Website”);
• any enquiries or applications you make through the Website, or by email or telephone with us;
• ·our assessment of your credit application, or ongoing administration of your credit facility, including (without limitation) information collected about you from third parties such as credit reporting bodies (“CRBs”) and brokers; and
• the provision of our products and services which include various types of loans, finance leases and other financial products within Australia,

(collectively, the “Services”).

This privacy policy also applies to information collected from candidates in connection with the application and recruitment process for employment with us.

We are bound by the Privacy Act 1988 (Cth) (“Privacy Act”), the Australian Privacy Principles (“APPs”) contained in the Privacy Act and any relevant codes upon which this privacy policy is based.

2. WHAT INFORMATION DO WE COLLECT

We refer to the below kinds of information collectively as ‘information’ in this privacy policy.

PERSONAL INFORMATION

Personal information is information or an opinion about an identified individual or an individual who is reasonably identifiable. For most of the Services we provide, it is necessary for us to collect ‘personal information’ such as your name, contact details, information relating to the collection and verification of your identity documents, details of your next of kin or personal reference, demographic information such as postcodes, address (current and previous), details about your employment, marital status, gender, number of dependents, electoral role information, preferences and interests about our products and services and other information relevant to surveys, social media, product research and/ or offers. If the information about you cannot be reasonably connected to you, this privacy policy does not apply as your de-identified information is not personal information (for example, where we have aggregated and anonymised your personal information).

CREDIT-RELATED INFORMATION

When you apply or seek a quote for any of our credit-related products and services, we collect your personal information in connection with those products and services. We refer to this information as ‘credit-related information’.

The type of credit-related information we may collect includes both:

• ‘credit information’, that is personal information or an opinion about you that has a bearing on credit that has been provided to you or for which you have applied, such as your identity information, the type, terms and maximum amount of credit provided to you, repayment history information, default information (including payments which were overdue for more than 60 days in specified circumstances), court information, new arrangement information, financial hardship arrangement information (including whether you have made a financial hardship arrangement with us), personal insolvency information, disciplinary proceedings, complaints, delinquency, fraud investigations and details of any serious credit infringements; and
• ‘credit eligibility information’, that is credit reporting information supplied to us by a CRB and any information we derive from it.

SENSITIVE INFORMATION

Personal information also includes ‘sensitive information’. In the event you provide us with any sensitive information such as health or disability information, for example, when you complete a hardship application, we will ask for your consent to collect, use and disclose that information as permitted by law.

EMPLOYMENT CANDIDATE PERSONAL INFORMATION

When you apply for employment with us or an entity in the Yamaha Finance Group, this privacy policy applies to the personal information you share with us or the Yamaha Finance Group, or that is otherwise acquired by us or the Yamaha Finance Group, during the application and/ or recruitment process, including (without limitation):

• your name, address, email address, telephone number and other contact information;

• personal information contained in your CV, resume, cover letter and other accompanying documents relating to your application;

• personal information obtained from interviews and reference checks (including referee checks,  national police check and an insolvency check); and

• personal information obtained from publicly available sources.

WEBSITE INFORMATION

When you use the Website or mobile applications, we may collect information about your location or activity including IP address, telephone number and whether you have accessed a third-party site through the Website. We refer to this information as ‘website information’.

Some website information is collected using cookies (see section 12 ‘HOW WE USE COOKIES’) and is used to improve our services and enhance your online experience with us and does not identify the internet browser. Where we do identify you (such as where you have logged onto one of our online services), we will treat any use or disclosure of that information in accordance with this privacy policy.

3. WHAT WE DO WITH INFORMATION WE DID NOT ASK FOR

Where we receive unsolicited information, we will check whether that information is reasonably necessary for or directly related to our functions or activities. If it is, we will handle this information the same way described in section 8 ‘HOW DO WE HANDLE YOUR INFORMATION’. If not, we will ensure we de-identify it or destroy it.

4. WHY DO WE COLLECT YOUR INFORMATION

We collect your information for the primary purpose of providing and improving the Services. This includes so we can:

• identify you and conduct appropriate checks;

• provide you with quotes for our products and services;

• understand your requirements and provide you with a relevant product or service;

• set up, administer, and manage our products and services, obtain loan assessments and credit reports;

• undertake comprehensive credit reporting including seeking/ providing updates from CRBs; and

• manage complaints and disputes, and report to dispute resolution bodies.
  From time to time, we also collect your information for a secondary purpose (in addition to the primary purpose). Information may be applied towards a secondary purpose if the secondary purpose is related to a primary purpose of collection and the use or disclosure would be within your reasonable expectations. Relevant secondary purposes arising in connection with this privacy policy may include (without limitation) to:
• manage, train, and develop our employees and representatives;

• comply with our legal obligations;

• get a better understanding of you, your needs, your behaviours and how you interact with us, so we can engage in product and service research, development and business strategy including managing the delivery of our services and products via the ways we communicate with you;

• carry out marketing activities and promotions; and
• carry out the application and recruitment process where you seek to become our employee or representative, which includes, but is not limited to, assessing your application and skills, identifying you, verifying your information, conducting reference checks (including referee checks, national police checks and insolvency checks), and complying with all applicable laws and regulations.

5. WHAT IF YOU DON’T PROVIDE US WITH YOUR INFORMATION

If we are unable to collect personal information from or about you, or you refuse to provide the information we require or fail to provide us with any forms, guides or documents as requested by us (such as a completed privacy consent form and relevant identity documents), we may not be able to do business with you or the organisation with which you are connected.

6. HOW DO WE COLLECT YOUR INFORMATION

We collect personal information directly from you (where possible), for example, when you apply for credit, when you request additional products or services or variations to products or services either over the phone or via the Website, when you seek a quote for one or more of our products or services, or when you enter into any competition/campaigns we run from time to time.

We may also:

• collect information about you from other sources or exchange your information with a third party such as agents, brokers, dealers, and employers. For example, obtaining a credit report from a CRB for credit assessment purposes or updating your credit file including credit history;

• undertake electronic verification of your identity through approved anti-money laundering service providers;

• undertake face to face identity verification (if necessary) through an agency;

• undertake verification checks with your accountant, Equifax Australia Information Services and Solutions Pty Ltd, Illion Australia Pty Ltd, RP Data Pty Ltd, your employer or through the tenancy database for the purposes of assessing the loan application;

• where an individual is an officer of a company that has applied for finance with us, we may obtain information about the officer from public records or from other officers of the company who arrange the company's finance application or from your nominated next of kin or account authority holder;

• collect information about you from the dealership where the asset is purchased or where finance with AMMF is arranged or where the asset is serviced or repaired;

• collect information about from your insurer or broker or from another credit provider;

• undertake searches or traces, for example via tenancy databases or CRBs;

• collect information about you from asset manufacturers that we deal with;

• collect information about you from entities who form part of the Yamaha Finance Group; and

• ·obtain information about you that is publicly available, for example, on social media and public registers.

7. AUTOMATED DECISION MAKING

When you apply for one or more of our products and/ or services, it is likely that we will use computer-based software that takes the personal information that has been input into our origination platform about you and provides us with a decision to either approve, refer or reject your loan application.

We may review the computer-based decision made and take additional actions and steps regarding a loan application, whereby the decision provided is either a refer or reject decision. This is because we may need further information or certain information may need to be further investigated. The first decision made may not be the final outcome provided regarding a loan application.

The kinds of personal information that are used in the operation of such computer-based software is as follows:

• whether or not you provide your driver licence number;
• your current residential status;
• your age at the time of the application;
• your current occupation and time (months) in your current employment;
• the total sum of your living expenses disclosed in comparison to applicable benchmarks used;
• your income and expense information;
• your previous repayment history with us and our related entities;
• your Equifax score, known as VedaScore and information contained within the credit report that we retrieve about you; and
• a calculation that takes into account your income less your expenses, known as a serviceability test.

8. HOW DO WE HANDLE YOUR INFORMATION

We may provide your information to other entities in the Yamaha Finance Group, and they may disclose or use your personal information for the purposes described in section 4 ‘WHY DO WE COLLECT YOUR INFORMATION’ in relation to products and services they may provide to you. Where you advise us that you do not wish to have your personal information provided to other entities in the Yamaha Finance Group, we may not be able to continue doing business with you or the organisation to which you are connected.

Entities in the Yamaha Finance Group may also use your information to help them provide products and services to other customers, but they will never disclose your personal information to another customer without your consent . At any time, you may advise us either verbally or in writing that you withdraw your consent by using the details described in section 17 ‘CONTACT DETAILS’.

We will use and disclose your personal information for the purposes we collected it as well as purposes that are directly related, where you would reasonably expect us to. We may disclose your personal information to and/ or collect your personal information from:

• the Yamaha Finance Group and other related bodies corporate;

• any of our Yamaha Finance Group joint ventures where authorised or required;

• customer, product, business or strategic research and development organisations;

• extended warranty providers;

• guarantors to any loan facility we provide, or propose to provide, to you;

• data warehouse, strategic learning organisations, data partners, analytic consultants;

• social media and other virtual communities and networks where people create, share or exchange information;

• publicly available sources of information;

• clubs, associations, member loyalty or rewards programs and other industry relevant organisations;

• a third party that we have contracted to provide financial services, financial products, or administrative services – for example:

  • information technology providers;
  • administration or business management services, consultancy firms, auditors, and business management consultants;
  • marketing agencies and other marketing service providers;
  • claims management service providers;
  • print, mail, and digital service providers; and
  • imaging and document management services;

• any intermediaries, including your agent, adviser, a broker, representative or person acting on your behalf, other Australian Financial Services Licensees, other Australian Credit Licensees or our authorised representatives, advisers and agents;

• a third-party claimant or witnesses in a claim;

• a third-party as required by law;

• accounting or finance professionals and advisers;

• an employer, trustee or custodian associated with membership of a superannuation fund, investment/ managed fund, or life insurance policy;

• government, statutory or regulatory bodies and law enforcement bodies;
• policy or product holders or others who are authorised or noted on the policy as having a legal interest, including where you are an insured person but not the policy or product holder;

• in the case of a relationship with a corporate partner such as a bank or a credit union, the corporate partner, and any new incoming insurer;

• the Australian Financial Complaints Authority or any other external dispute resolution body;

• CRBs;

• ·other insurers, re-insurers, insurance investigators and claims or insurance reference services, loss assessors, financiers;

• legal and any other professional advisers or consultants;

• hospitals and medical, health or wellbeing professionals;

• debt collection agencies, organisations involved in valuing, surveying or registering an interest in property taken or proposed to be taken as security for any loan facility, or which otherwise have an interest in such property, purchasers of debt portfolios;

• ·vehicle manufacturers and/ or suppliers of any financed asset; and

• any other organisation or person, where you have asked us to provide your personal information to us or asked us to obtain personal information from, such as your family member.

We will use a variety of methods to collect and disclose your personal information, including through written forms, telephone calls and electronic means. We may collect and disclose your personal information during the information life cycle, regularly, or on an ad hoc basis, depending on the purpose of collection.

9. OVERSEAS DISCLOSURE

Sometimes, for the same purposes as set out in section 4 ‘WHY DO WE COLLECT YOUR INFORMATION’, we need to provide your personal information to, or get personal information about you from, entities located overseas. Overseas entities may be required to disclose that information to relevant foreign authorities under a foreign law.

The countries we usually disclose your personal information to include India, Japan, New Zealand, Singapore, Philippines, United States of America, United Kingdom, Germany and France (although from time to time, there may also be other countries between which we need to transfer your information). This includes where we may store information about you in the cloud or other types of networked or electronic storage. As electronic or networked storage can be accessed from various countries through an internet connection, it is not always practical to know in which country information about you may be held.

We will ensure that appropriate safeguards are in place to protect your personal data to the extent it is transmitted outside Australia, either through adequate protection mechanisms (consistent with the Privacy Act) or compliance with the European Commission’s Standard Contractual Clauses (for data transfers between EU and non-EU countries) (which is considered to be industry best practice).

If there is a change of control of AMMF or a sale or transfer of business assets, we reserve the right to transfer, to the extent permissible by law, our user databases, together with any personal information and non-personal information contained in such databases. This information may be disclosed to a potential purchaser under an agreement to maintain confidentiality.

10. CREDIT REPORTING

When you apply for credit with AMMF or agree to act as a guarantor on a credit application, we will assess your credit worthiness and ability to repay the loan or make repayments under the credit agreement. As part of the credit assessment, we may request a credit report about you from a CRB. Credit reports generally contain information about your credit history, accounts you hold with other credit providers, repayment history information and financial hardship information as defined under the Privacy (Credit Reporting) Code 2025. We are not required to obtain your consent to disclose your information to CRBs.

The CRB that we use is Equifax Pty Ltd (“Equifax”). Equifax’s privacy policy can be accessed at https://www.equifax.com.au/privacy.

You can ask us to provide you with access to your credit information on our record. If your financial situation changes you can ask us to correct the information by using the contact details provided in section 17 ‘CONTACT DETAILS’. You also have the right to ask the CRB not to use your information for pre-screening and direct marketing purposes. In the event of an unforeseen event, for example, identity theft or fraud that compromises your personal information, you can ask the CRB to freeze your credit file and not to use or disclose your credit information for a given period. Additionally, when we are checking your credit worthiness and at other times, we may share information about you with the CRB who may then include your information in reports that the CRB gives to other organisations (such as other lenders) to help them assess your creditworthiness. Some of the information we give to the CRB may reflect adversely on your credit worthiness, for example, where you fail to make payments or if you commit a serious credit infringement ( such as obtaining credit by fraud). Such information may affect your ability to get credit from other lenders.

We also utilise information services from illion Australia Pty Ltd (“Illion”) to access other data registries required to assess your credit worthiness, ability to repay a loan or make repayments under a credit agreement, as well as for bank statement scraping services. Illion’s privacy policy can be accessed at https://www.illion.com.au/privacy-policy/.

11. YOUR PERSONAL INFORMATION AND OUR MARKETING PRACTICES

Every now and then, we and any entities in the Yamaha Finance Group, may use the personal information collected about you for the provision of the Services to contact you (including via mail, SMS, email, telephone or online) about news, special offers, products and services that may be of interest to you. We will only use your personal information for the secondary purpose of direct marketing where:

• we have collected your personal information;
• it is reasonably expected that the information would be used for the purposes of direct marketing;
• we provide a simple means through which you can request not to receive marketing communications; and
• you have not requested that such communications cease.

You can contact us to update your marketing preferences at any time by using the details described in section 17 ‘CONTACT DETAILS’.

Our direct marketing is conducted by exchanging your personal information with other entities that provide us with specialised data matching, trending or analytical services, as well as general marketing services (you can see the full list of persons and organisations under section 8 ‘HOW DO WE HANDLE YOUR INFORMATION’). We may also collect your personal information for marketing through competitions and by purchasing contact lists.

We, the Yamaha Finance Group and our service providers, may combine the personal information collected from you or others with information that is already held about you. We may also use online targeted marketing, data and audience matching and market segmentation to improve advertising relevance to you.

12. HOW WE USE COOKIES

A cookie is a small file which asks permission to be placed on your computer's hard drive. Once you agree, the file is added, and the cookie helps analyse web traffic or lets us know when you visit a particular site. Cookies allow web applications to respond to you as an individual. The web application can tailor its operations to your needs, likes and dislikes by gathering and remembering information about your preferences.

We use traffic log cookies to identify which pages are being used. This helps us analyse data about webpage traffic and improve the Website in order to tailor it to customer needs. We only use this information for statistical analysis purposes and then the data is removed from the system.

Overall, cookies help us provide you with a better website by enabling us to monitor which pages you find useful and which you do not. A cookie in no way gives us access to your computer or any information about you, other than the data you choose to share with us.

You can choose to accept or decline cookies. Most web browsers automatically accept cookies, but you can usually modify your browser setting to decline cookies if you prefer. This may prevent you from taking full advantage of the Website.

13. LINKS TO OTHER WEBSITES

The Website may contain links to other sites. If you click on a third-party link, you will be directed to that site. Note that these external sites are not operated by us. Therefore, we strongly advise you to review the privacy policy of these websites. We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party sites or services.

14. SECURITY OF YOUR PERSONAL INFORMATION

We take the security of your personal information seriously and will take all reasonable steps to protect your personal information from misuse, loss, unauthorised access, unauthorised modification and unauthorised use or disclosure.

Some of the ways we protect your personal information include, but are not limited to:

• restricting personal information to staff who require it to perform their day-to-day functions only;

• implementing certain technology to prevent unauthorised computer access including identifiers, passwords, firewalls, and antivirus software;

• encryption of data that has been stored;

• secure storage of data at our office premises and back up facility located in Australia;

• ·other security controls including but not limited to firewall and antivirus software on endpoints, annual penetration testing, data transmission over https and sftp;

• implementing policies and procedure for handling of personal information and training of employees; and

• securely storing hard copy documents.

15. HOW TO ACCESS AND CORRECT YOUR PERSONAL INFORMATION

You can access most of the personal information we hold about you by using the contact details described in section 17 ‘CONTACT DETAILS’. We will need to confirm your identity before providing you access to the information requested. We will try to provide you the personal information requested within a reasonable period of your request.

We may charge an access fee to cover the cost of retrieving the information and supplying it to the person who has requested access.

Access to personal information may be refused in a number of circumstances, such as where the information relates to anticipated legal proceedings, where the information is prohibited to be disclosed under law or the request for access is frivolous or vexatious. If we deny or restrict an individual's access, we will write to you explaining why access was refused or restricted.

It is very important for us to have your correct details to service you better. If you become aware that the information we hold about you is not correct or if you wish to update your information, please contact us by using the contact details described in section 17 ‘CONTACT DETAILS’. We will correct inaccurate personal information within 30 days of a correction request and will send written notice confirming the correction within a reasonable period. In the event inaccurate information was previously disclosed to another entity or third party, we will also take reasonable steps to notify them of the inaccurate information.

16. MAKING A COMPLAINT

If you believe the privacy of your personal information has been compromised, please contact us by calling our Customer Service on  1300 263 123or by emailing  complaints@ammf.com.au

We will investigate and respond to your complaint as soon as possible. If you disagree with our decision, you may refer your complaint to the Office of the Australian Information Commissioner (“OAIC”) by visiting www.oaic.gov.au, calling 1300 363 992, emailing enquiries@oaic.gov.au, or writing to GPO Box 5218 Sydney NSW 2001.

Further, you may also complain to the Australian Financial Complaints Authority (“AFCA”). AFCA’s details are:
Website: afca.org.au
Email: info@afca.org.au
Telephone:  1800 931 678  (free call)
Post: Australian Financial Complaints Authority, GPO Box 3, Melbourne, VIC 3001

17. CONTACT DETAILS

If you would like more information about our approach to privacy including a statement of any notifiable matters in an alternative form, please contact our Customer Service on  1800 123 100  or by emailing customerservice@ammf.com.au.

18. CHANGES TO THIS PRIVACY POLICY

This policy may change from time to time. Please visit our website regularly as we will let you know of any changes to this policy by a notification on our website. In addition, over the course of our relationship with you, we may tell you more about how we handle your information. This could be when you complete an application or form. We recommend you review these statements as they may have more specific details for your product holding.

19. DATA BREACH NOTIFICATION

In the event of an eligible data breach (as defined in the Privacy Act), we will:

• comply with our obligations under the Notifiable Data Breaches scheme, including promptly investigating the breach;
• where required, prepare a statement outlining the breach and provide it to the OAIC and notify affected individuals; and
• include details in that statement about the nature of the breach, the types of information involved, steps we recommend you take to protect yourself, and how you can contact us for further information

If you have any questions about how we manage data breaches, please contact us by using the contact details described in section 17 ‘CONTACT DETAILS’.