Privacy Policy

Swoosh Finance NZ Privacy Statement

Effective 1 October 2026

Protecting your personal information is important to us. This Privacy Statement explains how Swoosh Finance NZ Limited (Swoosh, we, us or our) collects, holds, uses and discloses personal information when you apply for or use our services, visit our website or otherwise deal with us. It also explains your rights and how to contact us.

We collect and hold personal information at 36 Bridge Street, Ahuriri, Napier 4110, New Zealand, and through the systems and service providers described below. We handle personal information in accordance with the Privacy Act 2020 (Privacy Act), its information privacy principles and applicable codes of practice.

1. Personal information

Personal information means information about an identifiable individual, as defined in the Privacy Act. In this statement, it includes:

• Identification and contact information, including your name, date of birth, addresses and identity document details.
• Credit information, including credit applications, credit history, defaults and information about consumer credit accounts you hold or have held with us or other providers, including account status, opening and closing dates, credit type and amount or limit.
• Repayment history information, including whether required payments have been made or missed.
• Financial hardship information, including requests for assistance, repayment arrangements and information reasonably needed to assess or administer those arrangements.
• Credit reports, scores and other information supplied by a credit reporter, and assessments we derive from that information when considering your eligibility for credit.

Information sometimes described as “credit eligibility information” is included in the final category above. We use that description in its ordinary sense, rather than as a separate statutory category under New Zealand law. Credit information handled by credit reporters is subject to the Credit Reporting Privacy Code 2020. This statement does not authorise reporting information outside that Code.

2. What personal information we collect and hold

Depending on your dealings with us, we may collect and hold:

• Contact and identification details: your name, date of birth, residential and postal addresses, email address, telephone number, driver licence or passport details, copies of identity documents and a photograph or selfie for manual identity verification.
• Financial and credit information: income, expenses, assets, liabilities, bank statements, credit reports, repayment history and information about your financial circumstances and ability to meet repayments.
• Account and transaction information: application details, loan purpose, bank account details, account numbers, balances, payment instructions, repayments, fees, transactions and security interests.
• Employment and income information: your employment status, employer details, earnings, payslips and other evidence of income.
• Hardship and complaint information: correspondence and supporting information relevant to an assistance request, complaint, dispute or recovery matter. This may include health or other sensitive circumstances where reasonably necessary for that matter.
• Communication records: enquiries, emails, messages, application records and notes of our dealings with you. If we record a telephone conversation, we will notify you appropriately.
• Website and technical information: IP addresses, browser and device information, pages visited and cookie or similar identifiers, as explained in Section 13.

We collect only information necessary for a lawful purpose connected with our activities. Please avoid providing unrelated information about yourself or other people.

3. How we collect personal information

Where possible, we collect information directly from you through applications, supporting documents, telephone calls, emails, our website and other interactions.

We may collect information indirectly where you authorise this, where direct collection is not reasonably practicable, or where another exception under the Privacy Act applies. Relevant sources may include:

• Credit reporters (such as Centrix),
• Your employer or other income providers, financial institutions and bank statement services you authorise.
• Authorised representatives and people you authorise to provide information on your behalf.
• Government agencies and lawful databases or public registers, including the NZ Transport Agency Waka Kotahi, the Department of Internal Affairs, the Ministry of Justice, the Motor Vehicle Register and the Personal Property Securities Register.
• Debt collection agents, legal advisers and other service providers assisting with your account or a dispute.

Collection from these sources is limited to the purposes described in this statement and what the law permits. Where indirect collection occurs, we will take reasonable steps to ensure you are aware of the required collection information, unless you have already been appropriately informed or an applicable exception permits otherwise. We may provide a further notice identifying the source, purpose, recipients or other relevant details.

If you supply personal information about a partner or another person, you must have authority to provide it and should make this statement available to them. We remain responsible for meeting our own notification obligations to that person; your authority does not replace those obligations.

4. Why we collect, use and disclose personal information

We collect, use and, where appropriate, disclose information for the following purposes:

• Assessing applications: considering your requirements, objectives and financial circumstances, assessing suitability and affordability, conducting permitted credit checks and deciding whether to provide credit.
• Providing and managing loans: establishing and administering accounts, processing payments, communicating with you, managing security and considering variations, refinancing or further applications.
• Verifying identity and information: confirming that you are the person you claim to be, checking information supplied and preventing impersonation, fraud and other unlawful activity.
• Providing assistance and resolving disputes: assessing hardship requests, managing agreed arrangements and investigating and responding to complaints.
• Managing overdue accounts: contacting you about arrears, locating you where lawfully permitted, arranging repayment, enforcing agreements and recovering amounts owing.
• Meeting legal obligations: complying with applicable requirements under the Credit Contracts and Consumer Finance Act 2003, the Anti-Money Laundering and Countering Financing of Terrorism Act 2009 (AML/CFT Act), the Privacy Act and other relevant laws.
• Supporting our business: maintaining records, managing risks, conducting audits and improving our services in ways permitted by the Privacy Act.
• Marketing: communicating offers and information in accordance with Section 12 and your preferences.

We will not use your information for incompatible purposes unless the use is otherwise permitted by the Privacy Act or another applicable law. Where we rely on your authorisation for a materially different purpose, we will obtain it before proceeding.

5. Identity verification and selfies

We may ask for a photograph or selfie to help confirm that you are the true holder of an identity document and to prevent impersonation or fraud. Our staff manually review the photograph, including comparing it with your identification documents.

We do not use automated facial recognition or biometric matching technology for this verification. We do not use your selfie to profile you or infer your behaviour, health, ethnicity or other demographic characteristics. It is used for identity verification and fraud prevention as described here.

Identity verification helps us meet applicable legal obligations, including under the AML/CFT Act. This does not mean the law specifically requires a selfie in every case. If you cannot provide a requested photograph, contact us to discuss whether another verification method is available. We may be unable to proceed if we cannot adequately verify your identity.

6. Who we obtain information from and share it with

The table below describes relevant sources of personal information, the information involved and why we may need it. We collect information only where relevant to your application or account and where authorised or otherwise permitted by law.

Who provides information	Information collected	Why we need it
Banks and financial institutions	Identity documents or verification results, bank statements and relevant account or transaction information, where you authorise access or disclosure is otherwise permitted.	To verify identity and assess your income, expenses and financial circumstances. Information is obtained only where the institution is involved in your application or account.
Department of Internal Affairs	Identity document details and verification results; citizenship information where relevant and lawfully available.	To verify identity and relevant citizenship details through authorised services. Visa or immigration status checks, if needed, are made through an appropriate authorised source.
Ministry of Business, Innovation and Employment and the Personal Property Securities Register	Information recorded on the Personal Property Securities Register concerning you or proposed security.	To identify existing security interests and register, maintain or discharge a security interest where appropriate.
Property data providers and property registers	Relevant property ownership, address, valuation and registered interest information.	To verify property ownership and assess relevant assets or proposed security.
NZ Transport Agency Waka Kotahi and the Motor Vehicle Register	Relevant driver licence verification information and vehicle registration, registered person and vehicle details available through authorised access.	To verify identity and relevant vehicle details, and assess or administer vehicle security. Registered person details do not, by themselves, establish legal ownership. Access is subject to the applicable authorisation and legal restrictions.
Credit reporter — Centrix Group Limited	Permitted credit reports, credit history, credit scores, application enquiries, account information and repayment history.	To assess creditworthiness and conduct other permitted credit reporting activities described in Section 7.
Employers, income providers and authorised bank statement services	Employment details, income information, payslips, statements and relevant financial verification results.	To verify information supplied and assess affordability, loan variations or hardship requests.
Ministry of Justice, including through an authorised credit reporter	Identifying information and results of an authorised overdue fines status check.	To consider relevant financial obligations when assessing an application, subject to any required authorisation.
Debt collectors, repossession agents, legal advisers and dispute resolution bodies	Relevant account, payment, contact, debt collection, enforcement, complaint and dispute information.	To manage arrears, recover amounts owing, administer security, and investigate or resolve complaints and disputes.
Your authorised representatives	Information and instructions provided within the representative’s authority.	To communicate with and assist you through your nominated representative, including on hardship or complaints.

7. Credit reporting and Centrix

We use Centrix Group Limited (Centrix) for credit reporting. We may provide identifying information and details of your application to Centrix and obtain information about your credit history and creditworthiness (commonly referred to as a “credit check”) to assess your application. During your loan, we may obtain further reports or monitoring information only where the relevant purpose, authorisation and applicable rules permit it.

We may also provide permitted account information, repayment history and qualifying default information to Centrix. Any reporting must satisfy the applicable legal and Code requirements. Information supplied to us to support a hardship request is not automatically reportable: any account status or hardship-related reporting is limited to information permitted under the Code.

Centrix collects and holds information supplied by us and other permitted sources to maintain credit files and provide credit reporting services. It may disclose permitted information to authorised subscribers, including other credit providers and debt collectors, where the Code allows. Your application enquiry and information about account performance may affect future credit assessments.

Centrix’s collection, retention, use and disclosure are governed by the Code. Its privacy statement explains its sources, purposes, permitted recipients and your access, correction and credit file suppression rights. You can contact Centrix directly to exercise those rights.

Centrix Group Limited:
Postal address: PO Box 62512, Greenlane, Auckland 1546, New Zealand, Attention Consumer Services
Telephone: 0800 236 874
Email: helpdesk@centrix.co.nz
Privacy statement: https://www.centrix.co.nz/privacy-statement/

Where required, we will provide additional credit reporting notices or obtain specific authorisation. A general reference to credit reporting does not authorise every type of access or disclosure.

8. Overseas handling or personal information

Some service providers or related companies assisting us may be outside New Zealand, including in Australia. Your information may therefore be accessed, stored or processed overseas for the purposes described in this statement.

Where an overseas provider acts solely on our behalf in storing or processing information and does not use or disclose it for its own purposes, we remain responsible for that information under the Privacy Act to the extent required by law. We require appropriate contractual and security protections.

Where a transfer is a disclosure to an overseas recipient for its own purposes, we will ensure there is a permitted basis under information privacy principle 12 or another applicable legal provision. This may involve reasonable grounds to believe the recipient is subject to comparable safeguards, including through enforceable contractual obligations.

If we instead need your specific authorisation because comparable safeguards may not apply, we will explain that position and obtain informed authorisation before disclosure. Acceptance of this statement is not blanket authorisation for overseas disclosure without appropriate protection.

9. Storage security and retention

We take reasonable safeguards to protect personal information against loss, unauthorised access, use, modification or disclosure and other misuse. We restrict access to authorised personnel and providers who need it for their work and use appropriate technical, physical and organisational protections.

Where information is given to a service provider, we require appropriate protection and take reasonable steps within our power to prevent unauthorised use or disclosure. If a privacy breach is notifiable under the Privacy Act, we will notify the Privacy Commissioner and affected individuals as required, subject to applicable exceptions.

We retain personal information only for as long as needed for lawful purposes, including administering your account, resolving disputes and meeting legal and recordkeeping obligations. Different records may have different retention periods. Selfies are subject to these limits as well. We review information held and securely destroy it or remove identifying details when it is no longer required.

10. Your choices, access, and correction rights

You may choose not to provide requested information. However, withholding information reasonably needed to assess an application, verify identity, administer a loan or meet legal obligations may mean we cannot provide the relevant service. We will explain where particular information is optional or where collection is legally authorised or required, including the relevant law and whether supply is voluntary or mandatory.

You may request access to personal information we hold about you and ask us to correct information that is inaccurate, incomplete, misleading or out of date. We may take reasonable steps to verify your identity before responding.

We will make and communicate our decision as soon as reasonably practicable and within the applicable statutory timeframe, generally 20 working days, unless a lawful extension applies. If we extend the timeframe or refuse a request, we will explain this and your complaint rights as required by law. Where access is granted, information will be provided without undue delay.

If we do not make a correction you request, you may provide a statement of the correction sought and ask us to attach it to the information. We will take the steps required by the Privacy Act. We will also take reasonable steps, where required, to inform relevant recipients of corrections or attached statements.

You may withdraw an authorisation by contacting us. Withdrawal does not undo lawful handling that has already occurred or prevent handling otherwise authorised or required by law. We will explain any effect on services that depend on the authorisation.

11. Contacting us and privacy complaints

Please direct access or correction requests, privacy questions and complaints to:

Privacy Officer
Swoosh Finance NZ Limited
Address: 36 Bridge Street, Ahuriri, Napier 4110, New Zealand
Email: applications@swooshfinance.co.nz

We will acknowledge your complaint, investigate the matters raised and respond through our internal complaints process as promptly as reasonably practicable.

If you are dissatisfied with our response, you may complain to the New Zealand Office of the Privacy Commissioner. Its website explains the complaint process, including approaching us first and providing an opportunity to respond.

Office of the Privacy Commissioner
Telephone: 0800 803 909
Website: https://www.privacy.org.nz/
Postal address: PO Box 10 094, Wellington 6140, New Zealand

12. Communications and direct marketing

We may contact you by post, telephone, email, SMS or your account portal about your application, account, repayments, assistance requests or other necessary service matters. Where electronic delivery of a statutory document requires consent, your consent is taken and implied by this Privacy Statement and pursuant to the terms of the Credit Contract.

Where you have agreed, or we otherwise have a lawful basis, we may send information about Swoosh products, services and offers by the permitted contact methods.

You can opt out of direct marketing at any time by contacting our Privacy Officer, using the unsubscribe link in a marketing email or following the instructions in a marketing SMS. We will give effect to electronic marketing unsubscribe requests within five working days and action other marketing opt-outs promptly.

An opt-out does not prevent necessary account or legal communications.

If you had previously opted out of direct marketing, but subsequently make an application for a new Swoosh product, you will be re-opted in.

13. Cookies and website information

Cookies are small files stored on your device that help a website recognise a browser and remember information. We may use cookies and similar technologies to operate our website, support navigation and security, understand website use and personalise your experience.

Cookies may collect or be linked to personal information, such as IP addresses, device identifiers or account details. They do not necessarily identify you by name, but they are not always anonymous. We handle associated personal information in accordance with this statement.

You can manage or delete cookies through your browser settings and any cookie controls we provide. Blocking cookies may affect website functionality. If we use third-party analytics or advertising tools, we will provide appropriate information about those tools and any additional choices or consents required.

14. Changes to this statement

We may update this statement to reflect changes in our practices or the law. The current version and its effective date will be available on our website.

Applicant declaration and authorisations

I confirm that the information I provide in my application is true, correct and complete to the best of my knowledge. If I provide another person’s information, including information about shared household income or expenses, I confirm that I have authority to do so.

I acknowledge that I have been provided with this Privacy Statement. I authorise Swoosh to obtain information reasonably necessary to assess and verify my application from the relevant sources described in it, including credit checks with Centrix, and to provide the information necessary for those checks.

I authorise relevant third parties to provide that information to Swoosh to the extent they are lawfully permitted. I authorise permitted account and repayment reporting to Centrix as described in Section 7. These authorisations are limited to the purposes and information described and do not override restrictions imposed by law.

I agree to receive marketing emails and SMS messages from Swoosh about its products and services. I understand that I can unsubscribe at any time and that my choice will not affect the assessment of my application.