Natloans privacy policy: information handling and your options

Important source and current-law distinctions

• Legal entity: the policy identifies “Natloans Ltd”, ACN 125 769 164, Australian Credit Licence 386297, and related businesses. The Terms of Use instead identify Natloans Pty Ltd as an authorised credit representative of Saccasan Pty Ltd (ACL 386297), and National Loan Solutions Pty Ltd as a representative of Australian Finance Group (ACL 389087). Both are described there as owned by Natloans Holdings Pty Ltd. These are conflicting published descriptions; confirm the entity handling your information from your formal documents and Natloans. This guide does not independently verify licence status.
• Credit Reporting Code: the source refers to the 2014 Code. The OAIC identifies the Privacy (Credit Reporting) Code 2025 as the current registered code, commencing 25 March 2025. The historical reference should not be treated as the current instrument. See the OAIC codes register.
• Policy promises versus legal requirements: source response times, fees, security statements and recipients below describe the published policy. They do not independently prove current practice or displace applicable privacy or credit obligations.

What information the policy says may be collected

This list explains the policy; it is not a request to submit any of these details through this mirror. Confirm what is necessary for your transaction and the authorised submission channel with Natloans.

Credit-related information

The policy distinguishes credit information from credit eligibility information. Credit information includes identity, credit type, terms and maximum amount, dates provided and repaid, repayment history, defaults and overdue payments, payment information, new arrangements, financial hardship arrangements, serious credit infringements, court proceedings, insolvency and relevant publicly available information. Credit eligibility information is information supplied by a credit reporting body and information derived from it.

The stated purposes are assessing finance eligibility, confirming identity, assessing creditworthiness and managing finance. The policy describes information exchange between credit and finance providers and credit reporting bodies, including other providers’ reports. It says a proposed guarantor may be subject to a credit-report check, and that missed payment obligations or serious credit infringements may be reported, subject to applicable requirements.

The policy names Equifax Pty Ltd, Experian Australia Credit Services Pty Ltd and Illion Australia Pty Ltd, with their public website domains. Treat this as the policy’s named list. For current consumer report access, the OAIC’s page updated 14 April 2026 lists Equifax and Experian. A credit reporting body must provide a free report once every three months; additional free access applies after refusal within 90 days or correction. Reports can differ between bodies.

Why and how information is collected

The published purposes include assessing applications and managing finance, identity checks, contact, risk management, legal compliance, relationship management, direct marketing, offers of other products or services, processing payments and assessing employment or broker appointments.

Where reasonable and practical, the policy says information is collected directly from the individual. Other sources include public registers and social media, credit reporting bodies, brokers, employers, accountants, lawyers, referees and other third parties.

Who may receive information

The policy lists the following possible recipients, depending on the purpose and circumstances:

• Existing or prospective funders and finance intermediaries; other borrowers, guarantors and security providers; and borrowers or prospective borrowers whose credit a person guarantees or proposes to guarantee.
• Finance administrators and suppliers, including valuers, surveyors, printing/postal services, call centres, lenders mortgage insurers, trade insurers, recovery firms, debt collectors, lawyers and credit reporting bodies.
• Agents, contractors, outsourced service providers and information/infrastructure providers, including statement production, debt recovery and IT support.
• Related marketing businesses, product/service providers, and anyone representing the individual, such as a broker, lawyer, guardian, attorney or accountant.
• Recipients authorised by the individual; auditors, insurers, reinsurers, healthcare providers, claims assessors and investigators.
• Recipients required by law, including under anti-money-laundering obligations or a court subpoena or summons.
• Funding participants such as trustees, warehouse funders, investors, rating agencies, agents, advisers and entities with an interest in the business or finance.
• Other financial institutions, for example for mistaken-payment claims; current or previous employers, referees and identity-verification providers.

The policy says Natloans takes reasonable steps before disclosure to satisfy itself that the recipient has an equivalent privacy commitment or that the individual has consented. It also describes combining customer information with sources such as third-party websites and Australian Bureau of Statistics data for analysis and service improvement. It says combined data may help other businesses understand customers, but personal information will not be supplied for that purpose unless legally required.

Storage, overseas support and security

The policy describes paper records, electronic servers and cloud storage, which may be outside Australia. It names the USA, Canada, Malaysia, India, Ireland, the United Kingdom and the Philippines as possible locations of overseas support entities receiving credit-related information. Natloans says it puts appropriate handling and security arrangements in place and can provide further information about those entities.

Its stated commitment is to take reasonable steps to protect information against misuse, loss and unauthorised access, modification or disclosure. These are published commitments, not independent verification of a particular upload tool, encryption system or hosting location.

For government identifiers such as tax file numbers, the policy says use/disclosure is limited to what law requires and that it will not use a government identifier to identify a person. Confirm any document request directly with Natloans.

Notifiable matters, credit marketing and suspected fraud

The policy says its notifiable-matters statement and privacy policy can be supplied in an alternative form. It describes credit reporting bodies using credit information to pre-screen offers and the option to ask a body not to use information in that way.

The source describes a 21-day fraud ban. Current OAIC guidance explains that an initial ban lasts 21 days, can be extended and is free. During a ban, use or disclosure is restricted, with exceptions for written consent or requirements of Australian law or a court/tribunal order. Ask a reporting body about extending the ban if the risk continues. The source’s unqualified “must not use or disclose” wording omits these exceptions.

Access, correction and keeping details current

The policy asks customers to keep information accurate and up to date. It says access can be requested at any time, a retrieval/supply fee may apply, and requests may be handled immediately or usually within seven days. It lists potential access exceptions involving legal proceedings, vexatious requests or commercial sensitivity, and promises reasons for refusal.

For corrections, the policy describes an initial response within seven days where a correction is not made immediately, consultation with other entities where needed, and information about the outcome within 30 days where reasonable after investigation. It promises reasons if a correction is refused.

Current credit-report correction rights: the OAIC states that correction requests are free. Where a credit provider or reporting body is satisfied information is incorrect, it must take reasonable steps to correct it within 30 days of the request, or a longer period agreed by the individual. This is not a fresh 30-day period starting after an investigation. If refused, written reasons and complaint options must be provided. Do not treat the policy’s general fee statement as a charge for credit-report correction.

Marketing and enquiries without identification

The policy describes marketing about finance offers, business changes and associated products or services. It says customers can decline marketing by contacting Natloans or using the unsubscribe option in marketing emails, without charge, with reasonable steps taken to honour the request within a reasonable time.

Although identification is usually needed for substantive finance business, the policy says anonymous dealings will be offered where lawful and practical, such as general questions about rates or promotions.

Calendly and cookies

The policy identifies Calendly as its appointment-scheduling service. It says the embedded widget may use cookies for booking functionality, preferences and performance, describes use of the feature as consent to Calendly’s cookie use, and notes that browser cookie controls may affect the widget. Read Calendly’s privacy policy and the original booking page before using that service. This mirror does not itself confirm the original widget’s current behaviour or consent implementation.

Data breaches and privacy complaints

The source describes notification to affected people and the OAIC under the Notifiable Data Breaches scheme where a breach is likely to cause serious harm, with exceptions including effective remedial action removing that risk. It says Natloans will notify as soon as practicable and explain the breach, response and steps individuals can take.

The policy directs privacy enquiries, marketing opt-outs and complaints to its published email links, which decode to info@natloans.com.au. Its stated complaint target is acknowledgement within seven days and a decision within 30 days. These are the privacy policy’s stated targets, not a universal timetable for every finance complaint. For credit-service complaints, also see the published complaints page and current ASIC RG 271; its standards may differ by complaint type.

The policy lists AFCA on 1800 931 678, GPO Box 3, Melbourne VIC 3001, and the OAIC on 1300 363 992 or oaic.gov.au. Use AFCA’s current complaint channels or the OAIC for current process and eligibility details. The captured AFCA email was obscured, so no address is inferred here.

Frequently asked questions

Does this guide change Natloans’ privacy policy?

No. It explains the published source and separates current authoritative guidance from outdated or conflicting source statements. Natloans’ original policy remains the source of its stated commitments.

Where do I send a request or ask which entity holds my information?

Use the public Natloans contact details above or its contact page. Refer to your formal documentation and the information or correction sought. Do not put private financial records into public directory questions or reviews.

Can a fee be charged for correcting my credit report?

The OAIC says credit-report correction requests are free. The policy’s broader retrieval/supply fee statement must not be read as overriding this right.

Which policy version should I check?

The captured policy says July 2025 and states that it may change as law, technology and practices change. Check the original page for the latest published version and request an alternative format from Natloans if needed.

Sources and review date

Natloans Privacy Policy, Terms of Use and contact page, captured 15 October 2026. The OAIC register, report access, correction and fraud guidance linked in the relevant sections were checked on 15 October 2026. This page contains public policy information only; it includes no private client records.