Xceda Privacy Policy

1. Our Commitment to Privacy

At Xceda, we are committed to protecting your privacy and handling personal information carefully, responsibly, and transparently.

This Privacy Policy explains how we collect, use, store, and share personal information when you interact with Xceda, including when you:

• invest with us through a term deposit or savings account
• borrow from us or apply for finance
• use our website or contact us
  
  

This policy applies to all customers, applicants, and website users.

2. Our Legal Obligations

Xceda complies with the Privacy Act 2020, including amendments that take effect from 1 May 2026, and any applicable codes of practice.

This includes obligations to:

• collect personal information only where it is lawful and necessary
• be transparent about how and where information is collected
• keep personal information secure
• allow individuals to access and correct their personal information

3. What Personal Information We Collect

Depending on your relationship with Xceda, we may collect personal information including:

• your name, contact details, and date of birth
• identification information used to verify your identity
• bank account, payment, and transaction details
• information about your current or previous employment, income, assets, expenses, liabilities, bank accounts and transactions, and other financial and personal circumstances
• information about your investments, loans, or applications
• credit-related information (for borrowers, where applicable)
• tax residency information, IRD number, tax status, FATCA/CRS information, and other information required for tax, AML/CFT, or regulatory reporting purposes
• communications you have with us
• limited information collected through our website
• information connected with your use of our online services including our website and customer portal, such as login activity, device information, browser information, IP address, and online activity records
  
  

Depending on the product or service, we may also collect information about authorised representatives, joint applicants, guarantors, trustees, directors, shareholders, beneficial owners, controlling persons, signatories, professional advisers, and other individuals connected with an application, account, loan, or investment.

We collect only information that is reasonably necessary to provide our services or meet legal and regulatory requirements.

If you are applying for credit or a loan, we will need to conduct credit checks and obtain information about your credit history from third parties. See the Privacy Waiver below for more details.

4. How We Collect Personal Information

Information collected directly from you

We collect personal information directly from you when you:

• apply for a product or service
• open or manage an account
• communicate with us by phone, email, or online
• provide information through our website
  
  

Information collected from other sources

Where permitted or required by law, we may collect personal information about you from third parties, including:

• banks and payment providers
• credit reporting agencies (for borrowers), such as Baycorp, Veda Advantage, Centrix, Equifax, and illion
• identity verification and anti-money laundering service providers
• public registers or government agencies, such as Waka Kotahi New Zealand Transport Agency, Land Information New Zealand, the Personal Property Securities Register, Ministry of Justice, Inland Revenue Department, and Work and Income New Zealand
• credit collection agencies
• professional advisers and service providers who support our operations external dispute resolution schemes, where a complaint arises 

We only collect information from other sources where it is relevant to assessing applications, managing accounts, meeting legal obligations, or protecting against fraud or misuse.

Where we collect personal information indirectly, we will take reasonable steps to make you aware of the collection, the purpose of the collection, who may receive the information, who holds the information, whether the collection is required or authorised by law, and your rights to access and correct that information, unless an exception applies under the Privacy Act 2020.

5. Why We Collect and Use Personal Information

We use personal information for purposes including:

• setting up and managing term deposits, savings accounts, and loans
• assessing applications and eligibility
• verifying your current credit obligations
• providing you with quotes
• processing payments, interest, and repayments
• communicating with you about your accounts or applications
• meeting our responsible lending obligations (which can be found on our website)
• meeting legal, regulatory, audit, and reporting obligations
• managing risk and preventing fraud or financial crime
• enforcing your contract with us if you default in your obligations to us
  
  

We may also use de-identified or aggregated information to improve our products and services.

6. Anti-Money Laundering and Identity Verification

Xceda is required to comply with the Anti-Money Laundering and Countering Financing of Terrorism Act 2009.

To meet these obligations, we may collect and use information such as:

• identification documents
• proof of address
• source-of-funds or source-of-wealth information
• information required for ongoing monitoring
  
  

This information may be obtained directly from you or from trusted third-party verification services, public registers, or government agencies.

Information collected for AML/CFT purposes may be shared with regulators or government agencies where required by law and must be retained for specific periods, even after your relationship with Xceda ends.

7. When We Share Personal Information

We may share personal information with:

• banks, payment system providers, and systems operators
• professional advisers such as auditors, lawyers, and insurers
• regulators, government agencies, or law enforcement where required by law
• credit reporting agencies (for borrowers, where applicable)
• external dispute resolution schemes
  
  

We take reasonable steps to ensure that any third party we share information with handles it securely and confidentially.

8. Your Consent

By applying for, holding, or using a Xceda product or service, you consent to Xceda collecting, using, and disclosing your personal information in accordance with this Privacy Policy. You will be required to provide express authorisation as part of the application process for any of our products and services. In respect of credit applications, see the privacy waiver in paragraph 15 of this policy.

You may withdraw consent for certain uses of your information where permitted by law. In some cases, withdrawing consent may mean we are unable to provide a product or service to you, and we will explain this clearly if it applies.

9. Marketing Communications

We may contact you about:

• your existing accounts or loans
• service updates or important changes
• relevant product or service information
  
  

You can opt out of receiving promotional communications at any time.

10. Storage and Security of Information

We take reasonable steps to protect personal information from loss, misuse, unauthorised access, or disclosure. These steps include secure systems, access controls, and confidentiality obligations for staff and contractors.

We retain personal information only for as long as it is required for the purposes it was collected or as required by law.

Some of our service providers may store, access, or process personal information outside New Zealand. Where this occurs, we take reasonable steps to ensure that personal information remains protected in accordance with the Privacy Act 2020.

11. Your Rights

You have the right to:

• request access to the personal information we hold about you
• request correction of information that is inaccurate or out of date
  
  

Access and correction requests can be made by contacting us using the details on our website. Some limitations may apply, including where information is restricted by law.

You can view a summary of the Privacy Act and find out more about your privacy rights on the Office of the Privacy Commissioner's website.

12. Website, Cookies, Analytics, and Online Services

When you visit our website or use our online services, including any customer portal, we may collect technical information such as your IP address, browser type, device information, pages visited, time and date of visit, referring website, and interactions with our website or online forms.

We use cookies and similar technologies to help our website operate, improve user experience, understand website traffic, measure marketing performance, and improve our products and services. You can manage or disable cookies through your browser settings.

We may use analytics and advertising tools, such as Google Analytics or similar services, to understand how people use our website and to help improve our marketing and digital services. These tools may use cookies or similar technologies to collect information about website activity and device/browser information. Google's privacy policy is available at http://www.google.co.nz/policies/privacy. To prevent your personal information from being used by Google Analytics, use the Google Analytics opt-out browser add-on — https://tools.google.com/dlpage/gaoptout/.

We may also use information about your interactions with our website, emails, and online advertising to help measure and improve our marketing, where permitted by law.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in law or how we operate. The most current version will always be available on our website.

14. Contact Us

If you have questions about this Privacy Policy or how Xceda handles personal information, please contact us using the contact details provided on our website.

If you have a complaint about how we have handled your personal information, please let us know so we can try to resolve it. We will consider your complaint and respond in accordance with our complaints process.

If you are not satisfied with our response, or if your complaint has not been resolved, you may be able to refer your complaint to an external dispute resolution scheme. See our Feedback and Complaints page for further information – Feedback and Complaints | Xceda Finance.

15. Privacy Waiver

I/We understand that the personal information Xceda Finance Limited requests and I provide may be used to obtain further information about me from third parties, to assist Xceda Finance in making a decision as to whether to provide me credit and for enforcement of my contract if I default on my obligations to Xceda Finance.

The personal information may include details of my credit history, outstanding fines as well as contact information and information about my assets, employment status, liabilities and income.

Xceda Finance may collect such information from:

• trading banks, finance companies, credit unions and other financial institutions
• credit reporting services or agencies, such as Centrix, Equifax and illion
• government agencies, such as Waka Kotahi New Zealand Transport Agency, Land Information New Zealand, the Personal Property Securities Register, Ministry of Justice, Inland Revenue Department and Work and Income New Zealand
• credit collection agencies
• other third parties as required for the purposes described in this waiver
  
  

Authorisation

I understand and agree that:

• by giving this authorisation, third parties may provide my personal information they hold to Xceda Finance
• neither Xceda Finance nor any third party needs to contact me before providing my personal information to Xceda Finance
• if I default in my obligations to Xceda Finance, information about that default may be given to a credit reporting agency
• any third parties that Xceda Finance provides my personal information to under this authorisation may retain that information and use it to provide their own services, although any use and disclosure by those third parties must be in accordance with the Privacy Act 2020