Privacy Policy

1.    Our Commitment to Privacy 

At Xceda, we are committed to protecting your privacy and handling personal information carefully, responsibly, and transparently.

This Privacy Policy explains how we collect, use, store, and share personal information when you interact with Xceda, including when you:

• • • invest with us through a term deposit or savings account

    • borrow from us or apply for finance

    • use our website or contact us

This policy applies to all customers, applicants, and website users.

2.    Our Legal Obligations

Xceda complies with the Privacy Act 2020, including amendments that take effect from 1 May 2026, and any applicable codes of practice. This includes obligations to:

• • • collect personal information only where it is lawful and necessary

    • be transparent about how and where information is collected

    • keep personal information secure

    • allow individuals to access and correct their personal information

3.    What Personal Information We Collect

Depending on your relationship with Xceda, we may collect personal information including:

• • • your name, contact details, and date of birth

    • identification information used to verify your identity

    • bank account, payment, and transaction details

    • information about your investments, loans, or applications

    • credit‑related information (for borrowers, where applicable)

    • tax residency information, IRD number, tax status, FATCA/CRS information, and other information required for tax, AML/CFT, or regulatory reporting purposes.

    • communications you have with us

    • limited information collected through our website

    • information connected with your use of our online services including our website and customer portal, such as login activity, device information, browser information, IP address, and online activity records.

Depending on the product or service, we may also collect information about authorised representatives, joint applicants, guarantors, trustees, directors, shareholders, beneficial owners, controlling persons, signatories, professional advisers, and other individuals connected with an application, account, loan, or investment.

We collect only information that is reasonably necessary to provide our services or meet legal and regulatory requirements.

4.    How We Collect Personal Information

Information collected directly from you

We collect personal information directly from you when you:

• • • apply for a product or service

    • open or manage an account

    • communicate with us by phone, email, or online

    • provide information through our website

Information collected from other sources

Where permitted or required by law, we may collect personal information about you from third parties, including:

• • • banks and payment providers

    • credit reporting agencies (for borrowers)

    • identity verification and anti‑money laundering service providers

    • public registers or government agencies

    • professional advisers and service providers who support our operations

    • external dispute resolution schemes, where a complaint arises

We only collect information from other sources where it is relevant to assessing applications, managing accounts, meeting legal obligations, or protecting against fraud or misuse.

Where we collect personal information indirectly, we will take reasonable steps to make you aware of the collection, the purpose of the collection, who may receive the information, who holds the information, whether the collection is required or authorised by law, and your rights to access and correct that information, unless an exception applies under the Privacy Act 2020.

5.    Why We Collect and Use Personal Information

We use personal information for purposes including:

• • • setting up and managing term deposits, savings accounts, and loans

    • assessing applications and eligibility

    • processing payments, interest, and repayments

    • communicating with you about your accounts or applications

    • meeting legal, regulatory, audit, and reporting obligations

    • managing risk and preventing fraud or financial crime

We may also use de‑identified or aggregated information to improve our products and services.

6.   Anti‑Money Laundering and Identity Verification

Xceda is required to comply with the Anti‑Money Laundering and Countering Financing of Terrorism Act 2009. To meet these obligations, we may collect and use information such as:

• • • identification documents

    • proof of address

    • source‑of‑funds or source‑of‑wealth information

    • information required for ongoing monitoring

This information may be obtained directly from you or from trusted third‑party verification services, public registers, or government agencies.

Information collected for AML/CFT purposes may be shared with regulators or government agencies where required by law and must be retained for specific periods, even after your relationship with Xceda ends.

7.    When We Share Personal Information

We may share personal information with:

• • • banks, payment system providers, and systems operators

    • professional advisers such as auditors, lawyers, and insurers

    • regulators, government agencies, or law enforcement where required by law

    • credit reporting agencies (for borrowers, where applicable)

    • external dispute resolution schemes

We take reasonable steps to ensure that any third party we share information with handles it securely and confidentially.

8.    Your Consent

By applying for, holding, or using a Xceda product or service, you consent to Xceda collecting, using, and disclosing your personal information in accordance with this Privacy Policy.

You may withdraw consent for certain uses of your information where permitted by law. In some cases, withdrawing consent may mean we are unable to provide a product or service to you, and we will explain this clearly if it applies.

9.    Marketing Communications

We may contact you about:

• • • your existing accounts or loans

    • service updates or important changes

    • relevant product or service information

You can opt out of receiving promotional communications at any time.

10.  Storage and Security of Information

We take reasonable steps to protect personal information from loss, misuse, unauthorised access, or disclosure. These steps include secure systems, access controls, and confidentiality obligations for staff and contractors.

We retain personal information only for as long as it is required for the purposes it was collected or as required by law.

Some of our service providers may store, access, or process personal information outside New Zealand. Where this occurs, we take reasonable steps to ensure that personal information remains protected in accordance with the Privacy Act 2020.

11.  Your Rights

You have the right to:

• • • request access to the personal information we hold about you

    • request correction of information that is inaccurate or out of date

Access and correction requests can be made by contacting us using the details on our website. Some limitations may apply, including where information is restricted by law.

12.  Website, cookies, analytics, and online services

When you visit our website or use our online services, including any customer portal, we may collect technical information such as your IP address, browser type, device information, pages visited, time and date of visit, referring website, and interactions with our website or online forms.

We use cookies and similar technologies to help our website operate, improve user experience, understand website traffic, measure marketing performance, and improve our products and services. You can manage or disable cookies through your browser settings.

We may use analytics and advertising tools, such as Google Analytics or similar services, to understand how people use our website and to help improve our marketing and digital services. These tools may use cookies or similar technologies to collect information about website activity and device/browser information. To prevent your personal information from being used by Google Analytics, use the Google Analytics opt-out browser add-on - https://tools.google.com/dlpage/gaoptout/.

We may also use information about your interactions with our website, emails, and online advertising to help measure and improve our marketing, where permitted by law.

13.  Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in law or how we operate. The most current version will always be available on our website.

14.  Contact Us

If you have questions about this Privacy Policy or how Xceda handles personal information, please contact us using the contact details provided on our website.

If you have a complaint about how we have handled your personal information, please let us know so we can try to resolve it. We will consider your complaint and respond in accordance with our complaints process.

If you are not satisfied with our response, or if your complaint has not been resolved, you may be able to refer your complaint to an external dispute resolution scheme. See our Feedback and Complaints page for further information - Feedback and Complaints | Xceda Finance