Commonwealth Bank's privacy changed

Each member of the CommBank Group collects and handles your personal information in accordance with its legal obligations, including those under the Privacy Act 1988 (Cth). The Commonwealth Bank of Australia and its subsidiaries (the CommBank Group) provide or distribute a wide range of banking, finance, insurance, funds management, financial planning and advice, superannuation, stockbroking and other services. This Statement describes how your personal information and credit information is collected and handled by the following members of the CommBank Group: the Commonwealth Bank of Australia Commonwealth Securities Limited (CommSec) Commonwealth Private CBA Services Private Limited our international branches in China, Hong Kong, Tokyo (Japan), Singapore, London (United Kingdom), New Zealand and New York (the United States of America) Commonwealth Bank of Australia (Europe) NV. If you are located in the European Economic Area or the United Kingdom, or if you are a customer of our China, Hong Kong, Singapore or Tokyo branches, you may have additional rights. See additional rights at the end of this page for more information. For more information about how we use your information for direct marketing purposes and ways to opt out, please see section 2b, ' How do we use your information? ' on this page. 2a. What information do we collect? We collect your personal information directly from you most of the time, however on occasion, we may also collect information about you from other people and organisations. We collect personal information when you: enquire about, apply for, or use our products or services contact us to make an enquiry or give us feedback visit our website or use our digital services participate in other activities we offer, such as competitions or surveys talk to us or do business with us. In the event of a data breach, CBA may seek to recover and identify leaked data to assist with risk assessment, notification and compliance. While we are required to collect some types of personal information to meet our legal obligations, we do attempt to keep our collection of your personal information to what is necessary to offer you the products and services you require. Depending on those products and services, or your interactions with the members of the CommBank Group, we may collect the following types of personal information: Tax File Number and country of tax residency Medicare card, Australian passport, driver licence, or pension card details Securityholder Reference Number (SRN) or Holder Identification Number (HIN) citizenship, birth, death and marriage certificates (for example, to verify your identity). tax identification number and country of tax residency foreign passport and driver licence (for example, to verify your identity at the time you request a product or service). details of your employment, income, assets, financial liabilities copies of bank statements and credit card statements from other financial institutions information from third parties about your credit history and insurance claims history. location information (if enabled on your device) IP address information about the electronic devices (computers, mobile phones or tablets) you use to access our platforms and how you use them, including details relating to your devices, their operating systems, browsers, other installed applications and settings details of the wi-fi network or mobile network used by your device type of authentication used (for example touch ID or face ID) health information (where this is relevant to an insurance policy, claim or if you're in financial difficulty and ask for hardship relief due to illness) race or ethnicity (for example we may ask you what language you speak if you request a translator to communicate with us) criminal history and political affiliation, where it is relevant for our regulatory and/or legal obligations Biometric information (such as fingerprints or face), where this information is Collected and Used for the purpose of automated biometric verification, biometric identification, or behavioural profile information (such as your keystroke typing patterns or scrolling or swiping activity) while you interact with us digitally, to detect suspicious financial and cyber activities, including fraud. information about significant life events (such as a relationship breakdown or a death in the family) information about family and domestic violence where you have been impacted by an emergency event or a natural disaster any unexpected changes to your financial situation (such as losing a job or incarceration) details of injury, illness, gambling or addiction. online forums, websites, Facebook, Twitter, YouTube or other social media (for example, if you use social media to make a complaint) public registers (for example, those kept by the Australian Securities and Investments Commission or Land Registry Services). See 'Who do we share your information with?' ( Collection, use & sharing , Section 2C) for details of third parties we may share information with. 2b. How do we use your information? We use your information to deliver our products and services. We also use your information for other reasons, such as to better understand you, your needs, and to let you know about other products and services you might be interested in. Here is a list of the ways we may use your personal information. assess and process your applications for products and services administer and manage existing products or services you have with us manage our relationship with you or your business improve our service to you and your experience with us communicate with you or your representatives about our products and services let you know about other products and services that may be of interest to you

ADDEDassess your eligibility for and, if you are eligible, opt you into, CBA's loyalty program and provide loyalty program related offers and services to you

reviewing customer feedback and assessing how you use our products and services testing and validating the effectiveness of products, services and system enhancements monitoring and reviewing call recordings, online chats and other business activity for quality assurance, training and compliance purposes, including to improve AI-generated summaries of calls. we may also use any information you provide through our online chat to improve our automated responses generated with GenAI. deliver our products and services make and manage customer payments and transactions

ADDEDprocess the earning and accumulation of points, the redemption of points for rewards, the activation or redemption of offers, the provision of cashback and other benefits to you

manage fees, charges and interest due on your products and services collect and recover money that is owed to us, this may be done through third party debt collectors and debt purchasers respond to complaints and seek to resolve them manage our share register and security holder records. prevent, detect and investigate suspicious or fraudulent activities We may also use payee details collected as part of transactions to further provide additional fraud prevention measures, and systems monitor our properties, for example using camera surveillance to ensure the safety of our people and customers investigate health and safety incidents involving our people and customers support the management of our information security and network controls to prevent cyber-attacks, unauthorised access and other criminal or malicious activities. confirm your identity screen applications and monitor accounts to identify criminal activity such as fraud, terrorist financing, bribery, corruption and money laundering investigate financial crime. protect our customers from fraud and scams respond to your enquiries about our products and services and record these interactions summarise your information and interactions with us, including your interactions on our online chat develop and improve products and services that better meet our customers' needs and behaviours help us understand trends in customer behaviour including how products and services are used collect personal information when we generate information about how you use and interact with our products and services communicate with you or your representatives about other products and services, including our partners' products and services that may be of interest to you. improve the products and services we offer improve the quality of our data develop products and services that better meet our customers' needs and behaviours understand and manage our risks better. provide insights and analytics services to and, share de-identified information with businesses and government sell, transfer, or merge parts of our business, or our assets, including products or services bring other businesses into the CommBank Group stop providing a particular product or service. We may also collect, use and share your information for other reasons where the law allows or requires us to. Direct marketing From time to time, we may also use and disclose your personal information for direct marketing purposes, including to tell you about our products and services or our partners' products and services that we think may be of interest and value to you, but we will stop if you tell us to. We may contact you by various means, including by mail, telephone, email, SMS or digital means (such as targeted advertising on social media and other media provider platforms, through CommBank websites or through our online banking services). We may also use cookies and pixels (including first and third party tracking and social media cookies and pixels). We do this to identify and track your interactions with our webpages and to provide you with advertisements you may be interested in, including on other webpages or platforms. Those third-party providers (e.g. Meta and Google) may be able to identify you. We may use third party providers to facilitate direct marketing such as: marketing companies or mail houses who send messages on our behalf; or social media and other media providers who deliver our targeted advertising on or through their platforms. If you do not want to receive direct marketing from us, you can opt-out by: updating your marketing and communication preferences in NetBank or via the CommBank App updating your message preference settings on our other online services (e.g. CommSec apps or websites) contacting us using the details in Further Information , Section 6a. We may first require you to log in or otherwise identify yourself. You can opt out of targeted CBA advertising on social and other third-party media platforms by: opting out of the 'Digital' channel within your marketing and communication preferences in NetBank or via the CommBank App; and blocking or deleting cookies on your browser. See our Cookies policy for more detail. Please note taking these steps may not stop all types of online tracking technologies, and will not remove all advertising from CommBank on the pages you visit. 2c. Who do we share your information with? We may share your information with third parties for the reasons mentioned in How do we use your information? ( Collection, use & sharing , Section 2b), or where the law otherwise allows or requires us to. The types of third parties are listed below. third parties that you have authorised to act for you (such as accountants, financial counsellors, legal representatives, agents, mortgage brokers, financial advisors, or a person with Power of Attorney) your parent or legal guardian (if you are under 14 years) guarantors and other security providers. your employer, to verify your employment status your doctor, to verify your medical history other banks and financial institutions that you may have products and services with. commercially available third party databases credit reporting bodies and credit providers (see Your credit information , Section 4). organisations that we partner with to supply products and services, for example, payment and shopping services, mortgage insurers, loyalty program partners and our product distributors.

REMOVEDexternal service providers that we engage to do some of our work for us, for example mailing houses, debt recovery agencies, legal service providers and information technology, cloud service providers and market research companies.

ADDEDexternal service providers that we engage to do some of our work for us, for example mailing houses, debt recovery agencies, legal service providers, loyalty platform providers and information technology, cloud service providers and market research companies.

external technology service providers that support our artificial intelligence capabilities (such as Microsoft). people who help us process applications and claims (like assessors and investigators). organisations involved in our funding arrangements (like loan purchasers, investors, advisers, researchers, trustees and rating agencies). auditors, insurers and re-insurers organisations that assist us to identify, investigate or prevent fraud or other misconduct. our share registry service provider Organisations that provide us with information, including publicly available information, so we can tell you about products and services we think may be of interest and value to you (for example, property insights services). If you do not wish for your information to be used in this way you can tell us by opting out of receiving direct marketing communications (see 2b. Direct Marketing). make a financial investment (e.g. a share); borrow money (e.g. credit cards, loans or bonds); save money (e.g. term deposits); manage financial risk (e.g. insurance); or facilitate payments (e.g. BPay, clearing and settlement facilities). Sending information overseas Sometimes, we may send your information overseas, including to: CommBank Group members that are located in China, India, Hong Kong, Singapore, Japan, the United Kingdom, the Netherlands, New Zealand and the United States of America service providers or third parties who store data or operate outside Australia complete international transactions, such as currency exchanges organisations we partner with to provide products and services comply with laws and help government or law enforcement agencies. If we do this, we make sure there are appropriate privacy, data handling and security arrangements in place to protect your information. 3a. Keeping your information safe Our staff are trained in how to keep your information safe and secure. We use secure systems and buildings to hold your information. We aim to only keep your information for as long as we need it. We store your hard copy and electronic records in secure buildings and systems or using trusted third parties. We use a range of physical, electronic and other security measures to protect the security, confidentiality and integrity of the personal information we hold about you. We aim to keep personal information only for as long as we need it - for example for business or legal reasons. When we no longer need information, we take reasonable steps to destroy or de-identify it. We collect credit information about you when you apply or use our credit related products or services. We may also collect credit information about you from credit reporting bodies (such as Equifax). What is credit information? Credit information is personal information that is about credit that has been provided to you or that you have applied for. This includes credit for personal purposes and credit in connection with a business. It can also cover information about you as a guarantor of a loan or as an insured party under a credit related insurance policy. Types of credit-related information we collect, hold and disclose We collect credit information directly from you or your representative when you apply for a credit related product or service, like a credit card. We also collect credit information about you from third parties, including credit reporting bodies (such as Equifax) or other credit providers (such as another bank). The types of credit information we collect and handle are set out below. Identification information This includes your name (including any aliases), gender, date of birth, driver licence number, current and most recent past addresses, as well as current and most recent past employers. Consumer credit liability information This is information about any accounts that you currently have open or may have had in the past. It includes the type of account, the open and/or close date, as well as the credit limit. Repayment history This includes a history of your repayments, including whether you have made payments when due, and if not, when overdue payments have been made. Financial Hardship Information This includes information about agreed financial hardship arrangements that you may have with us or our credit providers, both temporary and permanent. Financial hardship information will be recorded with the repayment history information. Default information Details of any defaults or serious credit infringements. Public information Public record information such as: court judgments directorship and business proprietorship details bankruptcy, debt agreement and personal insolvency. Information about credit worthiness Information about your credit worthiness such as credit scores, credit risk ratings, summaries and evaluations. Why we collect and handle your credit information When you apply to us for credit or propose to be a guarantor, we need to know if you're able to meet repayments under your agreement with us. We also want to avoid giving you further credit if this would put you in financial difficulty. We use credit information to: assess your credit applications and your ability to manage credit manage credit provided to you assist you to manage your credit related obligations and to consider any financial hardship requests derive scores, ratings, summaries and evaluations relating to your credit worthiness which are used in our decision-making processes and ongoing reviews help us collect overdue payments share information with credit reporting bodies, where the law permits us to do so. How do we hold credit information? We keep your credit information with your other information. In some cases, we may need to share some of your information with organisations outside Australia (see Collection, use & sharing , Section 2c). More information It is important that we hold accurate credit information about you. To access or correct your credit information, please contact us (see Further Information , Section 6a). You can also contact us to make an enquiry or complaint about the collection and handling of your credit information. Credit reporting bodies If you apply for credit or offer to act as a guarantor, we may collect or share your information with a credit reporting body. This information is used to determine your eligibility for credit. When we request information about you from a credit reporting body (called a credit enquiry), we will need to share some of your personal or credit information with them. Your consent is not required for us to share that information with a credit reporting body but sometimes we will need your consent for the credit reporting body to disclose information to us (e.g. when you apply for commercial credit). Credit reporting bodies may use and disclose credit inquiry information when assessing your credit worthiness, including when they calculate your credit score or rating (such as when you apply for a credit card or a loan). Credit reporting bodies may also include information about credit enquiries in their reports to help other credit providers assess your credit worthiness. In some circumstances your credit score or rating may be impacted by credit enquiries, such as where numerous credit enquiries have been recorded by a credit reporting body over a short period. We can also ask credit reporting bodies to give us your overall credit score and may use credit information from credit reporting bodies together with other information to arrive at our own assessment of your ability to manage credit. Direct marketing: Credit providers like us can ask credit reporting bodies to use your credit information to pre-screen you for direct marketing purposes. You can contact the credit reporting bodies if you want to stop your credit information being used for this purpose. Preventing identity fraud: If you think you have been, or could be, a victim of fraud you can ask the credit reporting body not to use or give anyone your credit information. We collect from, and share information with, the following credit reporting bodies. For more information about how they handle credit reporting information they hold about you, please visit their websites. Equifax Pty Ltd Experian Australia Credit Services Pty Ltd 5a. Accessing, updating and correcting your information You can contact us and ask to view your information. For more detailed information, we may ask you to fill out a request form. If your information isn't correct or needs updating, let us know straight away. How can I access my information? You can ask us for a copy of your information, like your statements or transaction history, by visiting a branch, going online (such as Netbank, CommBiz or CommSec) or calling us (see Further Information , Section 6a). To get a copy of the credit information we have about you, you can visit a branch or call us. If you would like more detailed information, please fill out the Request for Access to Personal Information Form (PDF). How will we handle you request? There is no fee to ask for your information, but sometimes we might charge a fee to cover the time we spend gathering the information you want. If there's a fee, we'll let you know how much it is likely to be, so you can choose if you want to go ahead. We try to make your information available within 30 days after you ask us for it. In some cases, we can refuse access or only give you access to certain information. For example, we might not let you see information that involves other people. If we do this, we will write to you explaining our decision. Can you correct or update your information? It's important that we have your correct details, such as your current home address, email address and phone number. You can check or update your information at any branch, via your online services (such as Netbank, CommBiz or CommSec) or by calling us (see Further Information , Section 6a). If you think your personal or credit information is incorrect, contact us to investigate the issue (see Further Information , Section 6a). We'll try to respond to your request within 30 days. If we can't, we'll let you know why it's taking longer. If we don't think the information needs correcting, we'll write to let you know why. You can ask us to include a statement with the information that says you believe it is inaccurate, incomplete, misleading or out of date. 6a. Contact us If you need more information, want to access or update your personal information or if you have a privacy concern, please contact us using the contact details below. Personal banking Message us in the CommBank app or call 13 2221 , 8am - 8pm (Sydney/Melbourne time) Overseas? Call +61 2 9999 3283 Business banking Call 13 1998 any time Overseas? Call +61 2 9009 0593 CommSec Call 13 1519 Call 1300 362 081 Overseas? Call +61 2 9115 1417 8am - 7pm, Monday - Friday (Sydney/Melbourne time)

ADDEDCommBank Yello Call 1300 Yello1 ( 1300 935 561 )

Access for hearing or speech impaired customers TTY number: Call 133 677 then ask for 13 2221 SMS Relay: Text 0423 677 767 (for more info, visit the National Relay Service) Voice Relay number: Call 1300 555 727 then ask for 13 2221 Visit your nearest CommBank branch Find a branch Contact our international Privacy Officers If you're a customer of our international branches, you can contact us on the details below. China The Data Privacy Officer Commonwealth Bank of Australia, Shanghai and Beijing Branches Mailing Address: RM 43-031 Hang Seng Bank Tower, No. 1000 Lujiazui Ring Road, Pudong, Shanghai. Telephone: +86 21 61238900 Hong Kong Commonwealth Bank of Australia, Hong Kong Branch Mailing Address: Suite 1401, One Exchange Square, 8 Connaught Place, Central, Hong Kong Telephone: +852 2844 7500 Fax: +852 2845 9194 Japan (Tokyo) Commonwealth Bank of Australia, Tokyo Branch Mailing Address: 13F, Muromachi Furukawa Mitsui Bldg 2-3-1, Nihonbashi Muromachi, Chuo-ku, Tokyo 103-0022 Japan Telephone: +81 03 5400 7857 Email: [email protected] Singapore Commonwealth Bank of Australia, Singapore Branch Mailing Address: 38 Beach Road, #07-11 South Beach Tower, Singapore 189767 New Zealand Group Chief Privacy Officer 6b. Making a privacy complaint If you have a concern or complaint about how we have handled your personal information (including your credit information), let us know and we'll try to fix it. If you're not satisfied with how we respond to your complaint about how we've handled your personal information, there are other things you can do. How can you make a complaint? To make a complaint, contact one of our staff or customer service teams (see Further Information , Section 6a). We'll look into the issue and try to fix it straight away. If you've raised your concern with one of our staff and are not satisfied, you can contact our Customer Relations team: CBA Group Customer Relations Webform https://www.commbank.com.au/support/compliments-and-complaints.html Phone 1800 805 605 +61 2 9687 0756 from overseas 8am - 6pm, 7 days a week (Sydney/Melbourne time) Mail Reply Paid 41, Sydney NSW 2001 If you would like further information on how we handle complaints, please visit how we manage complaints page . What else can you do? If you're not satisfied with our response after you've been through our internal complaints process, you can lodge a dispute through the Australian Financial Complaints Authority (AFCA), our external dispute resolution provider. AFCA provides consumers and small businesses with fair, free and independent dispute resolution for financial complaints. Australian Financial Complaints Authority Visit: www.afca.org.au Phone: 1800 931 678 (free call) Mail: Australian Financial Complaints Authority, GPO Box 3, Melbourne VIC 3001 You can also contact the Office of the Australian Information Commissioner if your complaint is about your privacy or how we handled your credit information. Office of the Australian Information Commissioner Visit: oaic.gov.au Phone: 1300 363 992 Mail: GPO Box 5288, Sydney NSW 2001 Additional rights in Asia Customers of our Singapore Branch Additional rights for customers of our Singapore Branch are set out in the Singapore Branch Privacy Notice. You may request a copy of this Notice, or further information relating to your rights, by contacting the Singapore Data Privacy Officer ( see Further Information , Section 6a). Customers of our Tokyo Branch Additional rights for customers of our Tokyo Branch are set out in the Commonwealth Bank of Australia, Tokyo Branch Privacy Policy Statement (PDF). Customers of our China Branch Additional rights for customers whose personal information will be collected, processed, stored, transmitted, disclosed and used by Commonwealth Bank of Australia in China is set out in our China Branch Privacy Notice . Customers of our Hong Kong Branch Additional rights for customers of our Hong Kong Branch are set out in the Commonwealth Bank of Australia, Hong Kong Branch Privacy Policy Statement (PDF), and the Hong Kong Branch Privacy Notice . Additional rights for individuals located in the European Economic Area and United Kingdom The European Union (EU) and the United Kingdom (UK) have local data protection laws, such as the EU General Data Protection Regulation (GDPR) and United Kingdom General Data Protection Regulation (UK GDPR), which give more rights to individuals located in the European Economic Area (EEA) and the UK and more obligations to organisations holding their personal information. If you are a customer of our UK branch or our bank in Netherlands, that organisation will be a "controller" of your personal information, which means it is responsible for compliance with the GDPR or UK GDPR as applicable. In this Appendix, "personal information" means any information relating to an identified or identifiable natural person. Under the GDPR and UK GDPR, personal information must be processed in a lawful, fair and transparent manner. This means we must provide you with more information about how we collect, use, share and store your personal information and information about your rights in data protection law. We have set out below this information, which is in addition to certain other information provided in the Group Privacy Statement above. If you are located in the UK or EEA and have an enquiry relating to your data protection rights, please contact [email protected] . What personal information do we collect? For details of what personal information we collect, please refer to Section 2 ( Collection, use and sharing ) above. If we require certain information for our contract with you or because it is legally required and you do not provide this to us, we may not be able to offer you products or services, or perform our contract with you. Special categories of personal information Personal information about your racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, biometric data (for example your fingerprints), or data concerning your health, sex life or sexual orientation is subject to additional requirements. If we process this personal information about you, we will only process this with your consent or where otherwise lawfully permitted. How long we keep your personal information We will keep your personal information while you are a customer. We keep your personal information for only as long as we need it for the relevant purpose. We generally keep your personal information for up to 7 years after you stop being a customer but we may keep your personal information for longer for the following purposes: To fulfil legal or regulatory obligations For internal research and analytics To respond to a question or complaint How we use your personal information We can collect and use your personal information for the purposes noted above in Section 2 ( Collection, use and sharing) . We must have a valid lawful ground to process your personal information, which may be one of the following lawful grounds: Contract: We need to process your personal information in order to fulfil a contract you have with us, or because you have asked us to take specific steps before entering into a contract. Legal or regulatory obligations: We need to process your personal information for us to comply with applicable law or regulations (not including contractual obligations). Legitimate interests: We need to process your personal information for our legitimate interests or the legitimate interests of a third party unless there is a good reason to protect your personal information which overrides these legitimate interests. Consent: We may (but usually do not) need your consent to use your personal information for a specific purpose. The purposes for which we use your personal information, lawful grounds we may rely upon are as follows: To perform and fulfil contracts To meet our legal duties For legitimate interests to enable us to perform our obligations and to provide our services to you We have your consent For legitimate interests to improve the products and services we offer, improve the quality of our data, develop products and services that better meet our customers' needs and behaviours, and understand and manage our risks better For legitimate interests to enable us to perform our obligations and to provide our services to you, to manage our risks better, and to run our business in an efficient and proper way For legitimate interests of fraud prevention and prevention of other crime, ensuring security of our network and systems and legal claims and proceedings For legitimate interests of compliance with applicable non-UK / non-EU laws For the legitimate interests to run our business in an efficient and proper way, including managing our financial position, business capability and planning, testing systems and process, as well as managing communications, corporate governance, and audit For legitimate interests to help us understand trends in customer behaviour including how products and services are used, improve the products and services we offer, improve the quality of our data, develop products and services that better meet our customers' needs and behaviours, and understand and manage our risks better For legitimate interests to provide insights and analytics services to other organisations, to share de-identified information with other organisations, which help organisations learn about the types of customers they have and their general spending patterns For legitimate interests to support any changes to the ownership of products or services or the make-up of the CommBank Group For legitimate interests to enable us to assess your eligibility and affordability prior to potentially issuing credit Who do we share your information with? We may share your personal information with other organisations within our Group or third parties as set out in Section 2 ( Collection, use & sharing ). Profiling and automated decision making We may use systems to make automated decisions (including profiling) based on personal information we have collected from you or obtained from other sources such as credit reporting bodies. These systems can evaluate your personal circumstances and other factors to predict risk or outcomes. Our credit approval process relies on automated analysis of personal information provided by you in the application process, alongside that received from credit referencing agencies and fraud prevention agencies, to make the following decisions: eligibility - whether it is appropriate to offer you credit or a loan; affordability - the maximum value of the credit or loan (ie, the credit limit); and the term of the credit or loan. These automated decisions can affect the products or services we offer you. For example, we may decide not to offer all or some our products or services to you, or we may decide how much to charge you, based on credit history and other financial information about you. You have certain rights in relation to automated decision making and profiling, which are set out below. Sending information outside the UK/EEA Recipients of your personal information may be located outside the UK or EEA as described in Section 2 ( Collection, use & sharing ). Where we transfer your personal information outside the UK or the EEA, we will ensure that it is transferred in a manner consistent with legal requirements applicable to the information, for example: we may put in place "standards contractual clauses" approved by the European Commission with the recipient, which requires them to protect your personal information; or the country to which we send the personal information may be approved by the European Commission or UK; or applicable law may permit us to transfer outside the UK or EEA in other ways, such as to perform a contract with you. Please contact us if you would like more information about the appropriate safeguards, including a sample copy of the standard contractual clauses, relevant to the transfer of personal information. Your rights You have a number of rights in relation to the personal information that we hold about you, although please note that in some cases, exceptions apply to the exercise of these rights and so you may not be able to exercise them in all situations. You can exercise your rights by contacting [email protected] . The right to be informed how personal information is processed You have the right to be informed how your personal information is being collected and used. The right to withdraw your consent if we are relying on it to handle your personal information If we require your consent to process your personal information you can withdraw consent at any time. If you withdraw consent, we may not be able to provide certain products or services to you. The right to withdraw only applies when the lawful basis of processing is consent. The right of access to personal information You can access your personal information that we hold by emailing: [email protected] The right to rectification You have the right to question any personal information we have about you that is inaccurate or incomplete. If you do, we will take reasonable steps to check the accuracy and correct it. The right to erasure You have the right to ask us to delete your personal information if there is no need for us to keep it. You can make the request verbally or in writing. There may be legal or other reasons why we need to keep your personal information and if so we will tell you what these are. The right to restrict processing You have the right to ask us to restrict our use of your personal information in some circumstances. We may be able to restrict the use of your personal information. In this situation we would not use or share your personal information while it is restricted. This is not an absolute right and only applies in certain circumstances. The right to data portability In some circumstances you have the right to request we provide you with a copy of the personal information you have provided to us in a format that can be easily reused. The right to object In some circumstances you have the right to object to us processing your personal information. Rights in relation to automated decision making and profiling We may use systems to make automated decisions (including profiling) based on personal information we have collected from you or obtained from other sources such as credit reporting bodies. These automated decisions can affect the products or services we offer you. You can ask that we not make decisions based on automated score alone or object to an automated decision and ask that a person review the automated decision. The right to lodge a complaint with a supervisory authority You have the right to complain to the regulator if you are not happy with the outcome of a complaint. See the 'Regulator Contact Details' section below for more information. The individual regulator websites will tell you how to report a concern. Minors and children's privacy For certain services, we will seek parent or guardian consent to collect the details of children under certain ages. Regulator contact details The UK data protection authority is: Information Commissioner's Office Wycliffe House Wilmslow Cheshire SK9 5AF UK Visit: ico.org.uk The Netherlands Data Protection Authority is: Autoriteit Persoonsgegevens Prins Causlaan 60 PO Box 93374 2509 AJ DEN HAAG / The Hague Visit: https://autoriteitpersoonsgegevens.nl/nl For other European jurisdictions please refer to the European Commission website for details of the relevant data protection authorities.

REMOVEDPolicy updated: 11 June 2026

ADDEDPolicy updated: 18 August 2026

During our relationship with you, we may tell you more about how we collect and handle your information - for example, when you fill in an application form or receive product terms and conditions. You should always read these documents carefully. Sometimes we update our Statement. You can always find the most up-to-date version on our website.