Privacy Policy
This Privacy Policy explains how LoanXP.com.au collects, uses, shares, stores and protects personal information when you browse our website, submit an enquiry, request a referral, contact us or interact with a business listing.
LoanXP is a loan information, comparison and referral platform serving Australia. We do not lend money, approve credit applications or determine lending terms.
1. Who is responsible for your information?
LoanXP.com.au is operated by Profitech Credit Solutions (Pty) Ltd, a South African company with registration number K2013214791. In this policy, “LoanXP”, “we”, “us” and “our” refer to this company.
We are responsible for the personal information we collect and handle through LoanXP. Lenders, brokers and other independent recipients are responsible for their own collection, use and disclosure of information. Sharing information with another organisation does not remove our responsibility for our own handling of it.
This policy is written for users in Australia and explains our approach by reference to the Privacy Act 1988 (Cth), the Australian Privacy Principles and other applicable privacy and communications laws. These laws apply according to their statutory scope. Our incorporation in South Africa does not displace applicable Australian obligations, and additional obligations may arise under South Africa’s Protection of Personal Information Act 4 of 2013 (“POPIA”).
For privacy enquiries or requests, contact our privacy contact at info@loanxp.com.au or write to Profitech Credit Solutions (Pty) Ltd, 1st Floor, 292 Surrey Avenue, Randburg, Johannesburg, 2194, South Africa.
This policy explains our practices and your choices. Visiting the website or reading this policy does not provide blanket consent to every use of information or waive any rights available under applicable law.
2. What personal information means
Under Australian privacy law, personal information generally means information or an opinion about an identified individual, or an individual who is reasonably identifiable. It can include contact details, financial information, correspondence and online identifiers, whether or not the information is accurate or recorded in a particular form.
Information solely about a company is not personal information under the Australian Privacy Act. However, information about sole traders, directors, employees and business representatives may be personal information where it identifies, or reasonably allows the identification of, an individual.
You can browse our informational pages without submitting a loan enquiry or providing your name. Some technical information may still be collected when you visit, as explained below. You may also deal with us anonymously or use a pseudonym where this is lawful and practicable, although we may need identifying information to arrange a referral or respond to a request concerning your records.
3. Information we collect
Enquiries and referrals: Depending on the form and service requested, we may collect your name, date of birth, telephone number, email address, city or area, loan type and requested amount. Relevant forms may also request employment details, monthly income, work contact details and information you provide about your credit history.
Business finance enquiries: Where relevant, we may collect business contact details, registration information, trading history, turnover and details of the person authorised to act for the business.
Communications and administration: We may keep correspondence, complaints, listing enquiries, advertising enquiries, referral records, consent records and communication preferences.
Website usage: Technical information may include your IP address, browser and device information, pages viewed, referring website, visit times, interactions and cookie or similar identifiers. Such information is not necessarily anonymous, particularly where it can be linked to an identifiable person.
Business listings: A listing may contain a representative’s name, role and published business contact details. Information about a sole trader or an identifiable person associated with a business may also constitute personal information.
We limit collection to information reasonably necessary for our functions and the service or enquiry involved. Please do not send passwords, online banking credentials, payment card security codes, tax file numbers or unnecessary identity documents. Do not provide information about another person unless you are authorised or otherwise lawfully entitled to do so.
Sensitive information, such as health information, receives additional protection under Australian privacy law. Please avoid including it in general enquiry fields unless it is relevant to a matter you ask us to address. If we need to collect sensitive information, we will explain why and seek consent unless a specific legal exception permits collection without it.
4. Where information comes from
We generally collect information directly from you through forms, correspondence and website interactions. Where lawful and appropriate, we may also obtain information from your authorised representative, referral partners, providers, official business websites and other public business sources. Collection from another source must satisfy applicable legal requirements, including restrictions on indirect collection.
A referral partner may provide limited information about the progress or outcome of an enquiry where needed to administer the referral, reconcile a referral payment, resolve a complaint or meet a legal obligation.
We take reasonable steps to explain relevant collection details before or at the time of collection, or as soon as practicable afterwards. These details may include how and why information is collected, usual recipients, the consequences of not providing it and relevant overseas handling. Public availability does not remove our privacy obligations.
If we receive personal information that we did not request, we assess whether we could lawfully have collected it. Where we could not, we take reasonable steps to destroy or de-identify it where doing so is lawful and reasonable.
5. Why we collect, use and disclose information
We handle relevant information to respond to enquiries, provide requested referrals, communicate about those requests, administer commercial relationships, maintain business listings, investigate complaints, protect the website and comply with applicable legal obligations.
We may also use website and referral information to understand traffic, measure referral performance, improve content and identify misuse. Where we use aggregated or de-identified information, we take reasonable steps to reduce the risk of individuals being identified from it.
Where the Australian Privacy Principles apply, we use or disclose personal information for the purpose for which it was collected, unless another use or disclosure is permitted. This may include a use you have consented to, a related purpose you would reasonably expect, or a use required or authorised by Australian law or another applicable exception. A reasonably expected secondary purpose involving sensitive information must generally be directly related to the original purpose.
Listing a possible use in this policy does not itself authorise unrestricted handling of your information. Optional marketing and disclosures requiring specific consent are addressed separately.
Forms and accompanying notices identify information needed for the requested service and the consequences of not supplying it. You may choose not to provide information, but we may be unable to process the enquiry or make the referral. Optional marketing consent is not a condition of submitting a loan enquiry. Where collection is required by a particular law, we will identify that requirement.
If we propose a materially different use of your information, we will provide additional information and obtain any further consent required by applicable law.
6. Loan referrals and paid introductions
If you request a referral, we may share relevant enquiry information with the lender, broker, referral network or other provider identified in the form or accompanying collection notice. Before submission, that notice will explain the recipient or meaningful recipient categories, the purpose of sharing and any choices available to you.
LoanXP may receive a fee or commission for a referral, introduction or resulting transaction. This may include payment for passing relevant enquiry information to a participating recipient. The commercial arrangement does not authorise unrelated marketing or unrestricted onward distribution of your information.
Recipients may contact you about the enquiry and handle information under their own privacy notices and legal obligations. They are responsible for their own lending assessments, identity checks and any credit reporting enquiries they conduct.
This policy does not itself authorise access to your credit report. A lender, broker or other recipient must have a lawful basis for any credit check, provide required notices and obtain any required permission. Information about credit reporting must be handled in accordance with the laws that apply to the recipient and the particular activity.
You may contact us to ask which recipients received your information or to stop future referrals that depend on your consent. Withdrawal does not reverse a disclosure already lawfully made, and a recipient may have a separate lawful reason to retain information. We can help identify the relevant recipient so you can raise your request with it.
Further information about our commercial arrangements is available in our Affiliate Disclaimer.
7. Other recipients of information
We may use service providers for hosting, storage, security, communications, analytics and website maintenance. We take reasonable steps to ensure that providers handling information on our behalf use it for authorised purposes and apply appropriate confidentiality and security safeguards, including contractual protections where appropriate.
Information may be disclosed to professional advisers, regulators, courts or other authorised parties where necessary and lawful, including to comply with a legal obligation or establish, exercise or defend legal rights. Disclosures are limited to what is justified for that purpose.
If our business undergoes a proposed sale, merger or restructuring, relevant information may be reviewed or transferred under appropriate confidentiality and privacy safeguards. We will minimise disclosure during due diligence and provide notice of a change in operator where required. Such a transaction does not remove your privacy rights or automatically permit unrelated uses of your information.
8. Cookies, analytics and similar technologies
We may use cookies and similar technologies to operate the website, maintain security, remember preferences, understand usage and attribute referrals. Third-party technologies on the website include a Google-hosted tag and Cloudflare Web Analytics. Advertising, affiliate links or other third-party content may involve additional technologies where disclosed.
Depending on the service and configuration, these technologies may involve device information, online identifiers, page addresses, browsing activity and website performance information. A provider may receive technical information when your browser connects to its service even where that service does not set cookies.
We do not assume that information is anonymous simply because it does not display your name. Different services have different data practices. Further information is available in Google’s Privacy Policy and Cloudflare’s Privacy Policy.
Where applicable law requires consent for particular tracking or processing, we obtain it before that processing occurs. Continuing to browse does not by itself provide blanket consent. You can manage cookies through your browser and any privacy controls offered on the website. Blocking some technologies may affect functionality.
See our Cookie Policy for further information. Cookie notices and controls should be read with this policy and cannot override your statutory rights.
9. Direct marketing and your choices
We distinguish communications needed to respond to your enquiry from optional promotional communications. Submitting an enquiry does not provide unrestricted permission for unrelated marketing by LoanXP or other businesses.
Where the Spam Act 2003 (Cth) applies, commercial emails, SMS messages and other covered electronic messages require consent. Consent may be express or inferred only where the legal requirements are met. We do not assume that a single enquiry automatically provides consent for ongoing promotions, and we do not send unsolicited commercial electronic messages merely to ask for marketing consent.
Marketing messages identify the sender, provide contact details and include a working unsubscribe option. You can also contact info@loanxp.com.au. We action electronic marketing unsubscribe requests within five working days and do not charge a fee, require an account login or demand unnecessary additional personal information to unsubscribe.
Telephone marketing must comply with the Do Not Call Register Act 2006 (Cth) and applicable telemarketing standards, including relevant consent or exemption requirements, calling restrictions, identification requirements and requests to end a call. A publicly available telephone number does not itself establish consent to receive marketing calls.
Where Australian Privacy Principle 7 applies to other direct marketing, we provide a simple way to opt out and comply with applicable requests to stop using or sharing information for that purpose. You may also ask where we obtained personal information used for direct marketing, subject to the exceptions permitted by law. Sensitive information is used for direct marketing only with consent where required.
Necessary, non-promotional communications about an enquiry, complaint or legal matter may continue after a marketing opt-out. Independent providers manage their own marketing preferences, and you may need to contact them directly about permissions you have given them.
10. Handling information outside Australia
Our operator is based in South Africa, so information you provide to LoanXP may be accessed and handled in South Africa in connection with operating the website, administering referrals and responding to enquiries. Information is not necessarily stored or handled only in Australia.
We also use international technology providers, including Google and Cloudflare, whose services may involve processing in the United States and other locations described in their privacy notices. Hosting, communications and referral arrangements may involve additional overseas recipients. We identify likely overseas recipient countries in this policy where practicable and update that information as our arrangements change. You may contact us for details relevant to your information.
Where Australian Privacy Principle 8 applies to a disclosure to a separate overseas recipient, we take reasonable steps to ensure that the recipient handles the information consistently with the applicable Australian Privacy Principles, unless a specific exception applies. Depending on the circumstances, Australian law may make us accountable for the overseas recipient’s handling of that information.
Access by our own personnel within the same legal entity is different from disclosure to a separate overseas organisation, but it remains subject to applicable privacy and security obligations.
Acceptance of this policy is not blanket permission to waive overseas-disclosure safeguards. If we propose to rely on informed consent to an exception, we will explain the relevant consequences and obtain that consent separately. We also comply with any international-transfer requirements imposed by other applicable laws.
11. Business listings and publicly available information
Our provider profiles and business listings may include information drawn from official websites, public business sources or submissions from authorised representatives. Although information solely about a company is not personal information under the Australian Privacy Act, a listing may include personal information about sole traders or identifiable individuals.
We seek to publish information that is relevant, accurate and proportionate to the listing’s purpose. A publicly available personal telephone number, residential address or other detail is not automatically appropriate for republication.
You can request correction or raise a concern about personal information in a listing. Where appropriate, a personal contact detail may be replaced with a general business contact, or information may be restricted or removed. A request concerning one detail does not automatically require removal of an entire listing; we assess the information, applicable obligations and the circumstances.
Our terms for business listings do not override applicable privacy law or justify keeping personal information indefinitely. Information that falls outside the Australian definition of personal information may still be subject to other legal protections.
12. Security and data breaches
We take reasonable technical and organisational steps to protect personal information against misuse, interference and loss, and unauthorised access, modification or disclosure. Safeguards must reflect the sensitivity of the information, foreseeable risks and the nature of the handling involved.
Information may be held in electronic records, correspondence, website systems and records maintained by service providers. We restrict access according to responsibilities, require appropriate confidentiality and review safeguards as risks change. No internet transmission or storage system is completely secure, but this does not reduce our legal obligations.
We assess suspected data breaches promptly and take reasonable steps to contain the incident and reduce harm. Where the Australian Notifiable Data Breaches scheme applies, we take all reasonable steps to complete an assessment of a suspected eligible data breach within 30 calendar days after becoming aware of grounds for that suspicion.
If we have reasonable grounds to believe that an eligible data breach has occurred, we notify the Office of the Australian Information Commissioner and affected individuals as soon as practicable, unless a lawful exception applies. An eligible data breach generally involves unauthorised access to or disclosure of personal information, or qualifying loss of that information, where serious harm to one or more individuals is likely and remedial action has not prevented that likelihood.
Notifications describe the incident, the kinds of information involved and recommended protective steps, together with other information required by law. We also comply with any notification obligations arising under other applicable laws.
If you suspect a security problem involving LoanXP, contact info@loanxp.com.au without sending passwords or unnecessary sensitive information.
13. How long we keep information
We retain personal information for as long as it is needed for a purpose permitted under applicable privacy law, subject to legal retention requirements. Relevant considerations include the progress of an enquiry, referral administration, payment reconciliation, complaints, applicable recordkeeping duties and legal claims.
Different records may require different retention periods. An enquiry record, a marketing preference and information in a public business listing are assessed separately. A commercial relationship does not justify keeping every associated record indefinitely.
We may retain a minimal record of an objection or unsubscribe request to respect your preferences. Such a record is not used to restart the marketing you declined.
When personal information is no longer needed for a permitted purpose, we take reasonable steps to destroy it or ensure that it is de-identified, subject to applicable legal retention requirements. This includes addressing copies held in archives and backups. Information awaiting deletion remains protected and is not used for unrelated purposes. Contact us if you need the retention period or criteria applicable to a particular record.
14. Access, correction and other privacy choices
You may request access to personal information we hold about you. You may also ask us to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading, having regard to the purpose for which it is held.
Contact our privacy contact using the details in section 1. Please describe the information or enquiry concerned so we can locate the relevant records. We may request proportionate proof of identity or authority before releasing or changing information.
We respond to access and correction requests within a reasonable period and any timeframe required by applicable law. We generally aim to respond within 30 calendar days. If a request requires more time, we will explain the reason and the expected response timeframe.
We do not charge for making an access or correction request, correcting information or associating a statement of disagreement with a record. If a charge for providing access is permitted, it will be reasonable and not excessive, and we will explain the proposed charge before proceeding.
If we refuse access or correction, we will provide written reasons, subject to lawful restrictions, and explain available complaint options. Where full access cannot lawfully be provided, we will consider whether partial access or another suitable arrangement is possible.
If a requested correction remains disputed, you may ask us to associate a statement with the information recording your position. Where we correct information previously disclosed to another organisation covered by the Australian Privacy Principles, you may ask us to notify that organisation. We will take reasonable steps to do so unless it would be impracticable or unlawful.
You may withdraw consent where our handling relies on that consent, opt out of direct marketing or ask us to delete information that is no longer needed. Withdrawal does not affect the lawfulness of earlier handling. Deletion requests are assessed against applicable privacy and retention obligations; they do not create an unconditional right to erase information that must or may lawfully be retained.
LoanXP does not make lending decisions. You may ask how your information was used to handle or route an enquiry, including questions about any relevant automated processing. Questions about a lender’s credit decision and any available review process should be directed to that lender.
This section does not limit any additional rights available to you under another applicable law.
15. Children’s information
Our loan enquiry and referral services are intended for people aged 18 or older. People under 18 should not submit loan enquiries through these services.
If we become aware that information about a person under 18 has been collected through an enquiry contrary to our service requirements or applicable law, we will assess the circumstances, stop inappropriate use and take reasonable steps to delete the information or otherwise handle it lawfully.
A parent, guardian or authorised representative may contact us about such information, subject to appropriate verification of their authority and the young person’s privacy rights. Our age requirement for loan enquiries does not remove the privacy protections available to children and young people.
16. Other websites and providers
Our website contains links to lenders, brokers, referral partners and other external websites. Their collection and use of information are governed by their own notices and legal obligations.
Review the relevant provider’s privacy notice before submitting information or accepting a service. An external link does not remove our responsibility for information we collect or disclose ourselves.
17. Complaints and changes to this policy
If you have a privacy concern, contact our privacy contact at info@loanxp.com.au. Please describe the issue and identify the relevant page, enquiry or communication, without including unnecessary sensitive information.
We will review the complaint, investigate relevant records and respond with our findings and any action we propose to take. We generally aim to provide a substantive response within 30 days. If more time is needed, we will explain why and keep you informed, subject to any applicable legal timeframe.
If you are dissatisfied with our response, or have not received a response within 30 days, you may complain to the Office of the Australian Information Commissioner (“OAIC”) where the matter falls within its jurisdiction. See the OAIC’s privacy complaints page for its procedures and online complaint form.
Concerns about unsolicited electronic marketing or telemarketing may also be raised with the Australian Communications and Media Authority. Where POPIA applies, you may have additional complaint rights through South Africa’s Information Regulator. Our complaints process does not restrict access to a regulator or another remedy available under applicable law.
We may update this policy to reflect changes in our services, information handling or legal obligations. The date above identifies the latest revision. We will provide additional notice of material changes where appropriate and obtain new consent where required. An updated policy does not retrospectively authorise unlawful handling, and continued browsing does not replace any consent that the law requires us to obtain.