Privacy Policy

What personal information we collect

The kinds of personal information we collect depend on how you interact with us.

When you make a finance enquiry

Our online enquiry form (the quote wizard) and our eligibility check collect the information you give us so a broker can review your needs and talk to you about finance options. This includes:

• the amount of funding you are seeking and the purposes you select;
• your business name and trading profile, including how long you have been in business, your monthly turnover band, your industry, and whether you own property;
• your Australian Business Number (ABN) and goods and services tax (GST) registration status, which you answer as yes, no or not sure;
• whether you have existing business finance or other business commitments, which you give as a broad band (for example none, one or two, or several), not as a detailed statement of your accounts;
• for asset-finance enquiries, whether you have a deposit or a trade-in available (yes or no);
• your own general assessment of your credit situation, which you choose from set options (for example no known issues, a few, significant, or prefer not to say). This is a voluntary self-assessment that you provide about yourself. We use it only to help match you to lenders and finance options that may suit your circumstances. We do not carry out a credit check, and we do not access your credit report or credit file, at the enquiry stage. You can select "prefer not to say" if you would rather not answer, and you are never required to disclose a credit issue to make an enquiry;
• your confirmation that the finance is for business purposes (used to establish that the finance is not consumer credit regulated by the National Consumer Credit Protection Act 2009 (Cth));
• your residency or citizenship status as it relates to the enquiry;
• your contact details: full name, email address and mobile number.

We collect these details to understand your enquiry and to compare suitable finance options for you across the lenders and financiers on our panel. We ask only for information that is reasonably necessary for that purpose. Some fields are optional, and the credit situation question can be left as "prefer not to say".

When you subscribe to our newsletter

If you sign up for our newsletter, we collect your email address and the fact that you have consented to receive marketing emails from us, together with the date and time of that consent.

When you book a call, submit a scenario, or register as a referral partner

Three further forms collect only what each one needs:

• Book a call: your name and phone number, your email address if you provide it, the call time you choose or the callback window you prefer and, if you select one, the topic you would like to discuss, together with the consent recorded by the checkbox on the form.
• Submit a scenario (for accountants, advisers and other referrers): your name, email address and phone number as the referrer, and the details of the scenario you refer, such as the client's name and business name, their state, time in business and turnover band, and your notes on the scenario. If you give us information about your client, the paragraph below about providing another person's information applies to you.
• Partner with us: your name, email address, phone number and Australian Business Number (ABN), so we can contact you about becoming a referral partner.

Technical and analytics information

When you submit any of the forms on our website we also record technical information about your session to help us operate the site, prevent spam and understand where enquiries come from. This can include your IP address, your browser and operating system, your device type, screen and viewport size, language and time zone, the page you enquired from, the referring page, and marketing attribution parameters (for example UTM tags and advertising click identifiers such as a Google, Meta, Microsoft, TikTok or LinkedIn click ID) where these are present in the link you arrived through. Separately, where you accept them through our cookie-consent banner, we use analytics and advertising cookies and tags that collect further usage and device information, as described in the Cookies and website analytics section.

Documents and the client portal

The current website does not ask you to upload documents. If we later introduce a client loan portal or any feature that lets you upload documents (for example financial statements or identification), we will update this policy before that feature goes live to describe what we collect, why, and how it is protected.

Sensitive information

We do not seek to collect sensitive information (as defined in the Privacy Act, for example health information) through this website. Please do not include sensitive information in free-text messages unless it is necessary for your enquiry.

How we collect your personal information

We collect personal information directly from you when you complete any of the forms on our website, subscribe to our newsletter, or contact us by phone or email. We also collect technical and analytics information automatically when you use our website, as described above. Where it is lawful and practicable, you can deal with us anonymously or using a pseudonym, although we may not be able to progress a finance enquiry without your contact details.

If you provide us with personal information about another person (for example a co-director, partner or guarantor), you must make sure you are authorised to do so and that you have made that person aware of this policy.

Why we collect, hold, use and disclose it

We collect, hold, use and disclose your personal information for the following purposes:

• to respond to your enquiry and to assess and arrange business-purpose finance options that may suit your needs;
• to contact you about your enquiry by phone, email or message;
• to submit, with your authority, your details to lenders and financiers on our panel so they can assess your application;
• to operate, secure, maintain and improve our website, and to prevent fraud and spam;
• to send you marketing communications where you have asked to receive them (see Direct marketing);
• to meet our legal, regulatory and record-keeping obligations.

Under the Australian Privacy Principles we may only collect personal information that is reasonably necessary for our functions and activities as a finance broker. Where the APPs require your consent for a particular collection, use or disclosure, we rely on the consent you give us (for example the consent you provide when you tick the box on our enquiry form or newsletter form). If you do not provide the information we ask for, we may not be able to respond to your enquiry or arrange finance.

Consent

When you submit an enquiry through our website, you agree to 121 Brokers collecting and using your details to respond to that enquiry, as described in this Privacy Policy. That is the consent recorded by the checkbox on each of our forms (on the enquiry form it appears on the final step). When you subscribe to our newsletter, you separately consent to receiving marketing emails from us. Our analytics and advertising cookies and tags are handled separately again: through our cookie-consent banner you can accept all of them, decline all of them, or choose per category (analytics, advertising) which to allow, and only the categories you accept are permitted to load and run. You can change or withdraw any category at any time (see Cookies and website analytics). You can withdraw your consent to marketing at any time (see Direct marketing). Withdrawing marketing consent does not affect our handling of an enquiry you have already submitted.

Who we disclose your information to

We do not sell your personal information. We disclose it to the following categories of recipients so we can provide our services and operate our business:

• Lenders and financiers on our panel, where you authorise us to submit your details so they can assess your application.
• Our service providers and technology partners who help us run our business, described below.
• Regulators, courts and other authorities, where we are required or authorised by law to disclose information.
• Professional advisers such as our lawyers and accountants, where reasonably necessary.

The service providers that handle your personal information are:

• Our website hosting provider, which stores the website and its database on our behalf. Our hosting is provided on a server located in Australia.
• Email: we do not currently use a third-party email delivery provider. The notification and confirmation emails our website sends are handled by our own systems. If we engage an email delivery provider, we will name it in this policy before it becomes active, as described below.
• Google (Google LLC and Alphabet Inc.), which provides the analytics and advertising tags we manage through Google Tag Manager, namely Google Analytics 4, Google Ads conversion tracking and remarketing. These tags load only where you have accepted analytics and advertising cookies through our cookie-consent banner. See Overseas disclosure.
• Microsoft (Microsoft Corporation), which provides Microsoft Clarity, a session-analytics and heatmap tool that helps us see how the site is used. This tag loads only where you have accepted analytics cookies through our cookie-consent banner. See Overseas disclosure.
• Meta Platforms (Meta Platforms, Inc.), which provides the Meta (Facebook) Pixel we use for advertising measurement and remarketing. This tag loads only where you have accepted advertising cookies through our cookie-consent banner. See Overseas disclosure.

We intend to use a customer relationship management (CRM) platform, Zoho CRM, to help us manage enquiries and our contact with you. We have not yet connected a CRM to this website, so no CRM currently receives your personal information. Before we begin transferring your personal information to Zoho CRM or any other CRM, we will update this policy, and where we use Zoho CRM we will configure it to store and process your information in its Australia data region.

We are also building the ability to use third-party messaging providers to notify our team when you submit a form and to send you a confirmation. These capabilities are configured but not yet active: none of them sends anything until we have named the specific provider in this policy. They are: an email delivery provider, which may be SMTP.com, to deliver notification and confirmation emails; an SMS provider, Twilio, to send notification or confirmation text messages; and the ability to forward the details of a submission to an integration endpoint (a webhook) that we control, so we can pass your enquiry into another tool we use. Some of these providers would process your personal information overseas, primarily in the United States (Twilio and SMTP.com), and a webhook endpoint may also be located overseas, depending on where we direct it. Where we enable any of these services we will address our Australian Privacy Principle 8 obligations, and this policy will name the service in use before we switch it on (see Overseas disclosure).

We keep this list aligned with our internal vendor and data-flow register. If we engage a new service provider that receives your personal information (for example a different processor, an advertising pixel, a chat widget, or a change to our CRM arrangements), we will update this policy before that change goes live.

Overseas disclosure of your information

The core personal information you give us through the forms on our website is stored and processed in Australia, including by our website hosting provider. We do not currently use a third-party email delivery provider, and we do not currently use any overseas customer relationship management (CRM) or automation service to process your enquiry information. If we introduce a CRM such as Zoho CRM, we intend to use its Australia data region. If we ever engage a service that would process your enquiry information outside Australia, we will update this policy and address our Australian Privacy Principle 8 obligations before that service is switched on.

Separately, we are configuring the ability to notify our team and to send you confirmations through third-party messaging providers, as described under Who we disclose your information to. Some of these would process your information overseas, primarily in the United States: an SMS provider (Twilio) and an email delivery provider that may be SMTP.com. A webhook endpoint that we forward a submission to may also be located overseas, depending on where we direct it. These capabilities are configured but not yet active. Before we switch any of them on, we will name the specific service in this policy and take the steps reasonable in the circumstances to address our Australian Privacy Principle 8 obligations for that transfer.

Where you accept analytics and advertising cookies through our cookie-consent banner, the information collected by those tags (for example online identifiers, cookie IDs, your IP address and usage data) is processed overseas, primarily in the United States, by Google (Google LLC and Alphabet Inc.), Microsoft (Microsoft Corporation) and Meta Platforms (Meta Platforms, Inc.). If you decline those cookies, these tags do not load and this overseas processing does not take place.

Australian Privacy Principle 8 requires us to tell you where your information may go and to take reasonable steps, before disclosing personal information overseas, so that the overseas recipient handles it consistently with the APPs. We take such steps as are reasonable in the circumstances, including obtaining your consent through the cookie-consent banner before these tags load. You should be aware that, by their nature, these analytics and advertising providers act as controllers of the data their own tags collect and handle it in accordance with their own privacy terms. We are not able to guarantee that an overseas recipient will handle your information consistently with the APPs, and such a recipient may not be subject to the Privacy Act. If in future we engage another service provider that processes your personal information outside Australia, we will update this policy first.

Direct marketing and how to opt out

If you have consented, we may send you marketing communications such as our newsletter and updates about our services. Our marketing emails comply with the Spam Act 2003 (Cth): they identify us as the sender and include a working unsubscribe facility. You can opt out at any time by using the unsubscribe link in any marketing email, or by contacting us using the details below. We will action your request promptly. Opting out of marketing does not stop us from contacting you about an enquiry you have made or about finance we are arranging for you.

Separately from email marketing, we use advertising tags (such as Google Ads and the Meta Pixel) to measure and target online advertising, but only where you accept the Advertising category through our cookie-consent banner. You can decline or withdraw consent for that category at any time using the "Cookie settings" link in the footer, as described in the Cookies and website analytics section.

Cookies and website analytics

Our website uses cookies and similar technologies. Cookies are small files stored on your device that help the site work and remember your preferences. Some of these are first-party, functional cookies that are needed for the site to operate. We also use analytics and advertising cookies and tags, which we manage through Google Tag Manager (container GTM-PMJWMM73). These are:

• Google Analytics 4 (analytics), which helps us measure how visitors use the site so we can understand and improve it.
• Google Ads (advertising), which we use for conversion tracking and remarketing, so we can measure and target our advertising.
• Microsoft Clarity (session analytics), which produces session recordings and heatmaps that show how the site is used so we can improve it.
• Meta (Facebook) Pixel (advertising), which we use for advertising measurement and remarketing.

In plain terms, the analytics tags measure how the site is used and help us improve it, and the advertising tags help us measure and target our advertising, including showing you our ads on other platforms. When you first visit, our cookie-consent banner lets you accept all of these cookies, decline all of them, or open a "Cookie preferences" panel and choose per category which to allow: Analytics (Google Analytics 4 and Microsoft Clarity) and Advertising (Google Ads and the Meta Pixel). Necessary cookies are always on, and beyond recording your consent choice we do not set our own functional cookies. We use Google Consent Mode, so only the categories you accept are allowed to operate; any category you decline does not load or run. You can reopen the "Cookie preferences" panel at any time using the "Cookie settings" link in the footer to change or withdraw any category, or control cookies through your browser settings.

You can also control cookies through your browser settings, including by blocking or deleting them. If you block some cookies, parts of the website may not work as intended. The information these analytics and advertising tags collect is processed overseas by their providers, as described in the Overseas disclosure section.

How we keep your information secure

We take reasonable steps to protect your personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. These steps include access controls, encryption in transit, keeping any documents and personal information on private storage that is not publicly accessible, and choosing service providers that maintain appropriate security. No method of transmission or storage is completely secure, but we work to protect your information and to review our safeguards.

How long we keep your information

We keep personal information only for as long as we need it for the purposes described in this policy, or for as long as we are required to keep it by law. When we no longer need your personal information, we take reasonable steps to destroy it or to de-identify it, in accordance with Australian Privacy Principle 11.

In practice:

• Enquiry and lead records, including quote-wizard enquiries, eligibility checks, call bookings, scenario referrals and partner registrations, are kept for 2 years after your last contact with us, then destroyed or de-identified.
• Newsletter subscriber records are kept until you unsubscribe, after which we remove your details from our marketing list.

If we introduce a feature that lets you upload documents, we will set and publish a retention period for those documents before that feature goes live.

Accessing and correcting your information

You have the right to ask for access to the personal information we hold about you, and to ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading, in line with Australian Privacy Principles 12 and 13. To make a request, contact us using the details below. We will need to verify your identity before we act on your request. We will respond within a reasonable time. In most cases access is free, although we may pass on reasonable costs in limited circumstances. If we are not able to give you access or to make a correction, we will tell you why in writing.

Data breaches

We are covered by the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act. If a data breach happens that is likely to result in serious harm to any individual whose personal information is involved, and we cannot prevent that harm through remedial action, we will notify the affected individuals and the Office of the Australian Information Commissioner (OAIC) as required by law. We maintain a process to assess and respond to suspected data breaches.

How to make a privacy complaint

If you have a concern or complaint about how we have handled your personal information, please contact us first using the details below, so we can try to resolve it. Please describe your concern and how you would like it resolved. We will acknowledge your complaint and respond within a reasonable time.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC), the independent national regulator for privacy. The OAIC can investigate privacy complaints. You can reach the OAIC at www.oaic.gov.au or by phone on 1300 363 992. The OAIC generally asks that you raise your complaint with us first and give us a chance to respond before you approach them.

Access, correction and complaint requests are handled by our Privacy Officer. You can reach our Privacy Officer using the general contact details below: by email at info@121brokers.com.au, by phone on (02) 8310 8516, or by post to 121 Brokers, 5/12 Tasman Way, Byron Bay NSW 2481.

Changes to this policy

We review this policy periodically and may update it from time to time to reflect changes in our practices, our service providers, or the law. The current version is always the one published on this page. Where a change is significant, we will take reasonable steps to bring it to your attention. We encourage you to review this page from time to time so you stay informed about how we handle your personal information.

How to contact us

If you have any questions about this policy or about how we handle your personal information, please contact us:

• By email: info@121brokers.com.au
• By phone: (02) 8310 8516
• By post: 121 Brokers, 5/12 Tasman Way, Byron Bay NSW 2481