Privacy Statement.

1. Introduction

1.1 Overview

This Privacy Statement explains how Pioneer Finance collects, holds, uses and discloses personal information (including credit information and biometric information). It also sets out how you may access or request correction of your personal information, and how you may raise a privacy-related question or complaint.

Please read this Privacy Statement carefully. If you sign up or apply for, or access or use any of our Platforms, products or services, you acknowledge that you have read and understood this Privacy Statement.

If you have any questions in relation to this Privacy Statement or our handling of your personal information, please email Pioneer Finance using the details set out in the Contact Us section below.

1.2 Application of this Privacy Statement

This Privacy Statement applies to:

• any personal information you provide to Pioneer Finance directly (whether as an applicant, customer, partner or supplier to Pioneer Finance or a user of any of our Platforms); and
• where such collection is authorised by you or otherwise permitted by law, any personal information we may collect about you indirectly.

This Privacy Statement does not apply to personal information we collect and hold about our employees, including prospective employees. If you are an employee or prospective employee, please contact us for further information about how we collect and handle your personal information.

In this Privacy Statement, any reference to:

• "personal information" has the meaning given to that term in the Privacy Act;
• "Platforms" means the websites, mobile applications, customer portals and other digital application channels operated by, or on behalf of, Pioneer Finance, including, without limitation, the Finley app, the Pioneer Partner Portal and the websites and customer portals available at the following domains:
• pioneerfinance.co.nz;
• finley.co.nz;
• easycard.co.nz;
• personalfinance.co.nz; and
• personalloan.co.nz.
• "Privacy Act" means the Privacy Act 2020 (New Zealand);
• "we", "us", "our" or "Pioneer Finance" means Pioneer Finance Limited (NZBN 9429038589492). Further details about us are set out in the "who we are" section of this Privacy Statement below; and
• "you" and "your" means the individual applying for, or otherwise accessing, or using our Platforms, products or services.

1.3 Updates to this Privacy Statement

We may update this Privacy Statement from time to time to reflect changes to our Platforms, products and services, privacy practices or legal requirements. The updated version will be made available on our Platforms and will apply from the date specified in the updated Privacy Statement. If we make a material change to the way we collect, use or disclose personal information, we may take further steps to notify you of that change, including where required by law.

1.4 Our privacy obligations

Nothing in this Privacy Statement is intended to limit your rights or our obligations under the Privacy Act. We will handle personal information in accordance with the Privacy Act and other applicable New Zealand laws, as well as any specific contractual commitments we make concerning the handling of your personal information.

Where relevant, our handling of your personal information may also be affected by the Biometric Processing Privacy Code 2025, credit-reporting rules, anti-money laundering requirements and consumer-credit laws.

1.5 Important Notice: New Zealand residents

Our Platforms, products and services are intended for New Zealand residents only. If you are located in another country, you may be subject to other laws, including data protection laws. For that reason, if you are not located in New Zealand, you are not permitted to access or use, and must immediately cease any use of, our Platforms, products or services.

1.6 What happens if you choose not to provide personal information

You may generally choose not to provide personal information that we request. However, if you do not provide the information that we need to assess or administer your application, provide or manage a product or service, verify your identity, assess your creditworthiness or comply with our legal obligations, then we may be unable to process or approve your application, provide or continue to provide the relevant product or service, or complete or manage a transaction with you.

2. Collection of personal information

2.1 The personal information we collect

The personal information we collect will vary depending on the products and services that you use, and the nature of your interactions with Pioneer Finance. We may collect:

• contact and identification information, such as your name (including any previous names), address, telephone numbers, email addresses, mobile phone identifiers, nationality and date of birth;
• financial and credit information, such as information relating to your credit history, income information, employment details and creditworthiness (including information we obtain from credit reporting agencies);
• government identifiers and related verification information, such as your driver's licence, passport details, birth certificate, IRD number, identity-document images and other information used for identity verification and compliance with our obligations under the Anti-Money Laundering and Countering Financing of Terrorism Act 2009 (AML/CFT Act);
• information relating to your relationship with Pioneer Finance, for example, information about agreements or other arrangements or transactions you may have with Pioneer Finance;
• account and transaction information, including details of purchases, payments, repayments, advances, balances, statements, account activity and product selections;
• financial and payment information, including bank account details, nominated payment accounts, payment instructions and transaction information relating to payments made to or by us;
• details of vehicles, goods or other property offered as security, registration and valuation information, Personal Property Securities Register (PPSR) information and, where agreed and lawful, location information relating to secured property;
• records of communications, requests, applications, instructions, acceptances and other interactions with us through our Platforms;
• where you have set up a customer account through any of our Platforms, account-access and authentication information, including usernames, passwords, PINs, security credentials and records relating to access to our Platforms;
• if we are required to verify your identity, including where required for compliance with our obligations under the AML/CFT Act, we may collect certain biometric information about you. This biometric information will comprise a profile photograph of your face, and/or a short live video of your face. We use this information to verify your identity, meet our regulatory obligations and help detect, and protect both you and Pioneer Finance from, any fraudulent activity (e.g. identity theft). For more information, please see section 4 (Biometric information) below;
• any feedback that you provide us; and
• any other personal information you provide Pioneer Finance with or authorise Pioneer Finance to collect in connection with the provision of our Platforms, products or services.

2.2 How we collect personal information

Directly from you

Generally, we collect personal information directly from you. For example, we may collect your personal information when you:

• visit or use any of our Platforms, for example when you create an account through any of our web-portals or mobile applications, fill in an online form or submit an online enquiry;
• complete any required identity verification process;
• sign up, apply for, or make an enquiry about any of our products or services;
• sign a contract with Pioneer Finance;
• make a payment using any of our Platforms;
• communicate with Pioneer Finance for any reason; or
• subscribe to updates from Pioneer Finance, fill in surveys or research, or participate in promotions.

We may also generate new personal information by analysing information we hold, such as affordability calculations, application scores, risk indicators, customer-service notes and other insights.

Information we collect indirectly

We may also collect your personal information from third parties in some cases. We will only do this where it is not practical to collect that information directly from you, where you have authorised us to collect your information from another party or where we are otherwise permitted by law.

For example, we may collect personal information from:

• credit reporting agencies (refer to section 5.2 below);
• brokers, financial advisers and other partners through whom you enquire or apply for any of our products or services;
• service providers who we have engaged to assist Pioneer Finance with complying with our legal obligations (including under the AML/CFT Act and consumer credit legislation, as applicable);
• vehicle dealers and other businesses involved in dealings with either or both you and Pioneer Finance;
• accredited requesters approved to access customer data and perform specific actions under New Zealand's Consumer Data Right framework. When you apply for or use our products or services, we may ask you to provide bank statements or authorise an accredited requester (we currently work with Akahu Technologies Limited), to share your bank statements with us. If in connection with your application, we require your bank statements, you will be provided with specific information regarding the information requested and the period of access;
• accountants, lawyers, insurers, referees, vehicle or asset registries, suppliers or other parties in order to verify information you have provided to us;
• co-borrowers, guarantors, trustees, directors, shareholders, beneficial owners, representatives, referees and other people connected with your application for any of our products or services;
• your employer or other people you represent (where you engage with us in your capacity as an employee or other representative);
• debt collectors, repossession agents, tracing services, enforcement agencies and parties involved in administering or enforcing an agreement we have with you;
• publicly available sources and registers, including the Companies Register, Personal Property Securities Register, insolvency records, court records and other publicly available databases;
• [Smiths City Finance Limited (Smiths City). Pioneer Finance manages, on Smiths City's behalf, a run-off portfolio of credit contracts entered into by Smiths City. If you have entered into a credit contract with Smiths City, Pioneer Finance may collect your personal information from Smiths City in connection with the provision of Pioneer Finance's management services]; and
• our related companies.

2.3 Cookies and analytics and similar technologies

We use cookies and similar technologies on our websites, online application process and the Finley app to operate and secure our services, understand how they are used, diagnose technical issues, communicate with customers and measure the effectiveness of our marketing.

Some of these technologies are necessary for our services to work, while others help us improve our Platforms, products and services or understand the effectiveness of our communications and marketing. Further information about the cookies and third party analytics used by our Platforms is set out below.

Finley app

The Finley app uses information such as your email address, one-time codes, session tokens, PIN, optional SMS-based two-step verification and passkeys to authenticate you and protect your account. If you use Face ID or fingerprint authentication, the biometric match occurs on your device, and Pioneer Finance receives only a yes or no result.

We also use third party analytics tools:

• to understand how customers use the Finley app. This may include the screens viewed and actions taken in the app, linked to the customer’s user ID. We use this information to analyse use of the app and improve its features and performance;
• to collect crash logs and other app performance information. Our systems attach the relevant user ID to crash reports so that we can investigate and resolve technical issues affecting a customer.

We and our third party service providers may collect device model, operating system, app version, analytics device ID and push notification token. We use OneSignal, and Firebase Cloud Messaging on Android devices, to provide payment and account alerts. You can manage push notifications in your Finley app profile settings and through your device settings.

Our websites and online application process

When you use our websites or browser-based online application process, we may collect information about your browser and interaction with our services, including without limitation your IP address, browser information and referring page details.

Information collected through our web-based Platforms may be used to understand how applicants and customers interact with our Platforms, products and services, improve user experience, monitor performance and security, and support our business operations, including the effectiveness of our marketing.

For example, Google Analytics may provide us with information on how many people visit and use our Platforms. We use the information provided by Google Analytics to help Pioneer Finance improve our Platforms. You can choose to opt-out of Google Analytics across all websites you visit without impacting your ability to access our site. You can find out more information on how to opt-out of Google Analytics here. Google Analytics Opt-out Add-on (by Google) – Chrome Web Store.

Your choices

You can control browser cookies through your browser settings. You may be able to view or delete existing cookies, block some or all cookies, or receive a notification when a cookie is placed. Blocking necessary cookies may affect the operation of our Platforms, including our online application processes.

You can manage Finley push notifications through your Finley profile settings and your device settings.

External links and services

Our Platforms and digital services may link to or embed third-party websites or services. Their privacy practices are governed by their own notices. We encourage you to review those notices before providing information directly to them.

2.4 Information about other people

If you provide us with, or authorise us to collect, personal information about another person or a third party (such as a guarantor or trustee), you confirm that they have authorised you to provide Pioneer Finance, or authorise Pioneer Finance to collect, their personal information in accordance with our Privacy Statement and that you have informed them of their rights to access and request correction of their personal information, as set out below.

2.5 Minors and dependants

Our Platforms, products and services are intended for adults. We do not knowingly invite a person under 18 to apply for credit. We may collect limited information about dependants or household members where relevant to an affordability assessment, hardship request or another lawful purpose. We will not use that information for unrelated purposes.

3. Use of personal information

3.1 How we use personal information

We will use your personal information to deliver and administer our Platforms, products and services, fulfil our legal and regulatory obligations, and support and enhance our interactions with you. This may include using your personal information:

• to assess your application for our products or services, including establishing and verifying your identity. This includes complying with our identity verification obligations under the AML/CFT Act, which may require enhanced customer due diligence;
• to contact employers, referees, co-borrowers, guarantors or other relevant parties to verify information you had provided to us;
• to assess your, and any applicable guarantor's, creditworthiness, eligibility or fraud risk, if you apply for credit;
• to support operations and our relationship with you – including providing you with products or services that you have requested and ongoing administration, and including via brokers/dealers/vendors/suppliers/other finance companies;
• to manage our products and services, including notifying you about any changes to our products and services;
• [for any activity related to business or finance agreement funding];
• for accounting, billing, and other internal administrative purposes;
• to exercise our rights and fulfil our obligations under any agreements with you or at law, including undertaking debt collection activities, locating our security, and taking enforcement action including legal proceedings;
• to comply with any request from a regulator or as part of any legal investigation or proceedings;
• to comply with industry standards and our policies (including record-keeping standards and policies);
• to carry out surveys into your experience of our services;
• to send service communications and, where we have your consent, marketing or promotional material about products and services that may be relevant to you;
• to register security interests where required in connection with the provision of our products and services to you; and
• for any other purpose authorised by you or permitted by law.

3.2 Automated tools and credit decisions

We may use automated processing tools, and artificial intelligence technologies to help process applications, support credit decisioning, detect fraud and suspicious activities, enhance customer experience and otherwise manage products. These tools and technologies may support or make decisions about identity verification, fraud risk, affordability, creditworthiness, eligibility and application processing.

These tools may make or support application decisions in accordance with our credit policies. Their use is subject to human oversight, governance and review processes. Please contact us using the details set out below if you have any questions regarding our use of automated processing tools.

3.3 Marketing

We may use your personal information to send you marketing or promotional communications about products and services offered by Pioneer Finance. We will only send marketing or promotional communications by email, text message or other electronic means where you have consented to receive them in accordance with the Unsolicited Electronic Messages Act 2007.

You may withdraw your consent or ask us to stop sending these marketing and promotional communications at any time by using the unsubscribe facility included in the message or by contacting us. Opting out of marketing does not stop service, security, account, payment, legal, hardship, fraud or other non-marketing communications that are necessary or permitted in connection with your relationship with us.

4. Biometric information

This section provides additional information about how we collect and handle your biometric information.

If we are required to verify your identity, including where required for compliance with our obligations under the AML/CFT Act, we may collect biometric information about you. This biometric information will comprise a profile photograph of your face, and/or a short live video of your face.

We collect this biometric information directly from you, via an online platform, when you use your device's camera to take the required photograph or video during the online identification process.

This information is provided by you voluntarily, and you may choose not to carry out the online identity verification process, however we may not be able to process your application or provide you with our products or services if this information is not provided.

We use your biometric information for two purposes:

• to confirm you are who you claim to be when you apply for our products or services; and
• for fraud prevention, including to help detect and prevent identity theft or other unauthorised use of your identity or accounts.

We will not use your biometric information for any other purposes. We use biometric verification because it enables us to confirm identity with a high degree of assurance, supports compliance with our legal obligations and helps protect both our customers and our business against fraud. We consider this approach to be an effective and proportionate way to verify identity and mitigate fraud risk, having regard to the sensitivity of the information involved and the safeguards we have implemented.

Access to your biometric information is restricted to personnel who require it for authorised purposes. We may also provide this information to identity verification and fraud prevention providers that support us in confirming identities and detecting or preventing fraud. Those providers may handle biometric information on our behalf solely for those functions and must comply with appropriate contractual, privacy and security requirements. We may otherwise disclose biometric information where required by law, but will not use or disclose it for purposes unrelated to those for which it was collected.

We protect biometric information using technical and organisational measures designed to guard against loss, misuse and unauthorised access. A third-party verification provider may store and process this information for us. We require that provider to maintain appropriate security controls and to handle the information consistently with applicable New Zealand privacy requirements.

We retain biometric information only for as long as reasonably necessary for identity verification, fraud prevention, security, legal, regulatory and record-keeping requirements. Once no longer required, it is securely deleted or permanently anonymised.

You have the right to request access to, or correction of, biometric information we hold about you. For further information, please see section 7 (Access and correction of personal information) below. If you have concerns about how we’ve handled your biometric information or our biometric processes, please contact us using the details provided below.

5. Disclosure of personal information

5.1 Who we share personal information with

In certain circumstances, we may share your personal information with third parties. We generally share your personal information with third parties only for the purposes explained in this Privacy Statement or as otherwise permitted or required by law. The types of parties we commonly disclose your personal information to include:

• our related companies;
• our partners, contractors, suppliers, and service providers (including IT services providers), to assist us with the operation of our business, including compliance with applicable laws;
• [our business partners and principals (disclosed or undisclosed) for whom we may be acting];
• any other person directly relevant to your application or the services we provide to you - including your referee, guarantor, or co-borrower (or, if applicable, the referee, guarantor, or co-borrower of the person you engage with us on behalf of, such as a trust or partnership), and any relevant agents, dealers, vendors, suppliers, and brokers involved in your enquiry, application, purchase or account;
• any person directly or indirectly involved in providing funding to us or any of our related companies;
• [credit reporting agencies and identity verification agencies (see further details in section 5.2 below)];
• debt collectors, repossession agents, tracing services, enforcement agencies and parties involved in administering or enforcing an agreement we have with you;
• any person for the purpose of complying with our legal obligations (including under the AML/CFT Act and consumer credit legislation, as applicable);
• any organisation or person we consider assigning or transferring any of our rights or obligations under any agreement with you;
• insurers and our financial and other professional advisers;
• other participants in financial and payment systems who have a relationship with you, such as banks and other credit providers, where relevant;
• your guarantors and security providers, where relevant; and
• any other party authorised by you or to whom we are required or authorised to disclose personal information in accordance with applicable law.

5.2 Credit reporting and identity verification

Credit reporting

Pioneer Finance may collect personal information from, and disclose credit-related information about you to, credit reporting agencies for credit reporting purposes, including to obtain reports about your credit history or to monitor your credit status. The information which we may provide to credit reporting agencies may include [identity details, credit applications, account type and limits, repayment history, arrears, defaults, recoveries, insolvency information and other credit-account information].

A credit reporting agency may retain your personal information and use or disclose it to its subscribers in accordance with the Credit Reporting Privacy Code 2020 and the credit reporting agency's own privacy policy.

We exchange information with the following credit reporting agencies:

Equifax New Zealand (Equifax)

Website: www.equifax.co.nz

Address: Level 10, 48 Shortland Street, Auckland

Where we have provided your personal information to Equifax, Equifax collects your personal information for the purpose of providing its credit reporting services to us and other Equifax subscribers. Equifax will collect, use, disclose and otherwise handle your personal information in accordance with the Equifax Privacy Policy available here.

You have rights of access to, and correction of, your credit information and any other personal information held by Equifax as set out in the Equifax Privacy Policy.

Experian Data Registries (NZ) Limited (Experian)

Website: www.experian.co.nz

Address: Deloitte Centre, Level 5, 1 Queen Street, Auckland Central, Auckland

Where we have provided your personal information to Experian, Experian collects your personal information for the purpose of providing its credit reporting services to us and other Experian subscribers. Experian will collect, use, disclose and otherwise handle your personal information in accordance with the Experian Privacy Policy available here.

You have rights of access to, and correction of, your credit information and any other personal information held by Experian as set out in the Experian Privacy Policy.

Centrix Group Limited

Website: www.centrix.co.nz

Address: Level 4, 56 Cawley Street, Ellerslie, Auckland

Where we have provided your personal information to Centrix, Centrix collects your personal information for the purpose of providing its credit reporting services to us and other Centrix subscribers. Centrix will collect, use, disclose and otherwise handle your personal information in accordance with the Centrix Privacy Statement available here.

You have rights of access to, and correction of, your credit information and any other personal information held by Centrix as set out in the Centrix Privacy Statement.

Your credit-report rights

You may request a copy of your credit report and ask a credit reporting agency to correct inaccurate information. Centrix, Equifax and Experian websites each explain how to exercise those rights.

Identity verification

We may also collect and disclose relevant personal information, including identification details, from and to identity verification providers or authoritative databases as part of confirming your identity. These may include Waka Kotahi NZ Transport Agency for driver licence verification and the Department of Internal Affairs for passport verification. Those agencies may retain and use your information for their own lawful purposes in accordance with applicable law and their privacy statements.

6. Storage, security and retention of personal information

6.1 Storage and overseas disclosure

Some of our technology, cloud, communications, identity verification, analytics, support or other service providers may store or process personal information outside New Zealand, or allow authorised personnel outside New Zealand to access it. The countries involved may change as our providers and systems change.

Where we disclose personal information to a foreign person or entity, we do so in accordance with the requirements of Information Privacy Principle 12 under the Privacy Act. Depending on the circumstances, this may include confirming that the recipient is subject to the New Zealand Privacy Act, is subject to comparable privacy safeguards, or is contractually required to protect the information in a comparable way. If we rely on your express authorisation where comparable safeguards may not apply, we will tell you this before seeking that authorisation.

A service provider that stores or processes information on our behalf without using it for its own purposes may be treated differently under the Privacy Act, but we will still take reasonable steps to ensure appropriate security and confidentiality controls are in place to protect your information.

6.2 Security and privacy breaches

Security safeguards

We use reasonable technical, physical and organisational safeguards appropriate to the nature and sensitivity of the information we hold. These may include access controls, authentication, encryption, monitoring, secure development and change processes, staff training, confidentiality obligations, vendor controls, backups and incident-response procedures.

No system or transmission method is completely secure. You should protect your devices, passwords, passcodes and authentication methods, use secure channels, keep contact information current and tell us promptly if you suspect fraud, a scam, account compromise or unauthorised access.

Privacy breach response

If a privacy breach occurs, we will investigate, contain and remediate it. Where the breach has caused or is likely to cause serious harm, we will notify the Office of the Privacy Commissioner and affected individuals as soon as practicable, unless an exception applies. We may also notify regulators, law-enforcement agencies, funders, insurers or other parties where required or appropriate.

6.3 Retention and disposal

We retain personal information only for as long as it may lawfully be used for the purposes for which it was collected, or as required to meet legal, regulatory, funding, audit, accounting, fraud-prevention, dispute-resolution, enforcement and record-keeping obligations.

Retention periods vary according to the type of information, product, account status, applicable law, limitation periods, potential disputes and whether information is needed to protect Pioneer Finance or another person. Application information may be retained even if an application is withdrawn or declined where reasonably necessary for compliance, fraud prevention, audit, complaints or future enquiries.

When information is no longer required, we take reasonable steps to securely delete, destroy or de-identify it. Some information may remain in backups or archives until it is overwritten or securely removed in the ordinary course of our systems and retention processes.

7. Access and correction of personal information

7.1 Access and correction

Under the Privacy Act, you have the right to:

• know what personal information we hold about you, and to request correction of that information if it is inaccurate or out of date; and
• request access to the personal information we hold about you.

You can exercise these rights at any time by contacting us using the details set out in the Contact us section below.

We will facilitate your request in accordance with the Privacy Act. In some cases, we may require you to pay a reasonable charge in connection with our handling of your request.

7.2 Further details when seeking access and correction

In order to obtain access to your personal information, we may require you to provide proof of identity. This is necessary to ensure that personal information is provided only to the correct individual and that your privacy and the privacy of others are protected. To assist us with responding, please be as specific as possible about the information you require.

7.3 Deleting your Finley login and personal information

You can ask us to delete your Finley login at any time. How to make a request, what we delete and what we have to keep are set out at finley.co.nz/delete-account.

Deleting your login does not close your Finley Account or cancel any amount you owe. We will delete or de-identify personal information we no longer need, but New Zealand law, including anti-money laundering, tax and consumer credit rules, requires us to keep some records for up to 7 years after your account is closed (see section 6.3).

8. Who we are

Pioneer Finance Limited is a New Zealand financial service provider registered under FSP2861. Our principal place of business is 106/100 Parnell Road, Parnell, Auckland 1052, New Zealand.

Further information about us is available at www.pioneerfinance.co.nz/about.

9. Contact us

If you have any questions or requests relating to this Privacy Statement or personal information that we may hold about you, please contact us using the details set out below:

The Pioneer Finance Privacy Officer 106/100 Parnell Road Parnell, Auckland 1052 Tel: 0800 000 724 Email: [email protected]

If you are not satisfied with our response to a privacy concern, you may complain to the Office of the Privacy Commissioner at privacy.org.nz, by telephone on 0800 803 909, by email at [email protected], or by post to PO Box 10094, Wellington 6143.