Issuer privacy and credit reporting policy

Privacy Policy Effective 27 October 2026

Credit Union SA Ltd (‘we’, ‘us’, ‘our’) ACN 087 651 232 is bound by the Australian Privacy Principles under the Privacy Act 1988 (Cth) (Privacy Act). We are also bound by Division 3 of Part IIIA of the Privacy Act, which regulates the handling of credit information, credit eligibility information and related information by credit providers, and by the Privacy (Credit Reporting) Code. This Privacy Policy outlines how we deal with your personal information (including credit-related information), as well as our legal obligations and rights as to that information. If we agree with you to use or disclose any of your personal information in ways which differ to those stated in this Privacy Policy, the provisions of that agreement will prevail to the extent of any inconsistency.

1. Key types of information Certain words have special meanings when used in this Privacy Policy. These are shown below. ‘Personal information’ means information or an opinion about an identified individual, or an individual who is reasonably identifiable. Although we try to make sure that all information we hold is accurate, ‘personal information’ also includes any inaccurate information about the individual. ‘Credit eligibility information’ means information that has been obtained from a credit reporting body, or that has been derived from that information, that is about an individual’s credit worthiness. ‘Credit information’ means personal information that includes the following: • Information about an individual, like their name, age, address and employment details, that we may use to identify that individual. • Information about an individual’s current or terminated consumer credit accounts, an individual’s repayment history, or that the individual has agreed to be a guarantor. • Financial hardship information. • The type and amount of credit applied for in any previous consumer or commercial credit applications to any credit provider, where that credit provider has requested information. • Information about an individual from a credit reporting body. • Information about consumer credit payments overdue for at least 60 days and for which collection action has started. • Advice that payments that were previously notified to a credit reporting body as overdue are no longer overdue. • Information about new credit arrangements an individual may have made with a credit provider, in relation to consumer credit currently or previously held, to deal with any

defaults or serious credit infringements by that individual. • Information about court judgments which relate to credit that an individual has obtained or applied for. • Information about an individual on the National Personal Insolvency Index. • Publicly available information about an individual’s credit worthiness. • An opinion of a credit provider that an individual has committed a serious credit infringement of credit provided by that credit provider. We may not hold all of these kinds of information about a particular individual. However, if we hold any of these kinds of information, it is protected as ‘credit information’ under this Privacy Policy. ‘Credit-related information’ means credit information, credit eligibility information and related information.

2. Collection We may collect personal information from you by various means including in-person, by telephone, using video conferencing, by email, by letter and through our website, social media channels and mobile apps. Wherever possible, we will collect personal information (including credit information) directly from you. This information will generally come from what you provide in your application for membership or for one of our products or services and supporting documentation. We only ask for personal information relevant to our business relationship with a member. When you apply for a membership or for one of our products or services (including the provision of credit), we may request: • identifying information, like your name, date of birth, postal address, residential address, telephone number, mobile number, email and other contact details • information and documents that verify your identity to us or to use electronic verification service providers • information about your personal circumstances, like your significant life events, marital status, number of dependants and occupation • information about your financial position, like your income, expenses, savings and assets and any (other) credit arrangements • other information about credit standing, worthiness, history or capacity that credit providers can disclose under the Privacy Act, including a credit report • your employment details, including your employment income, history and related information • your tax residency details and taxpayer identification number (including tax file number) • your reasons for applying for a product

or service • passwords and passcodes, and • further information at any time to meet our obligations. We may also collect personal information (including credit-related information) about you from third parties, such as any referees that you provide, your employer, your employer service providers, brokers, other credit providers, other financial institutions and third party service providers including credit reporting bodies. Credit reporting bodies collect credit information about individuals which they provide as credit reports to credit providers and others in the credit industry to assist them in managing credit risk, collecting debts and other activities. You can also ask a credit reporting body, through contact details on their website, not to use or disclose your personal information if you believe on reasonable grounds that you have been or are likely to be a victim of fraud, including identity fraud. Some information is created through our internal processes, like credit eligibility scoring information. We will also collect location and activity information electronically from you when you use our online services such as IP address and device ID. If you do not provide (or continue to provide) us with the personal information we need for the products or services you are applying for or currently using, we may on reasonable grounds close your accounts and terminate our relationship with you.

3. Use We have a relationship with Credit Union Services Corporation (Australia) Limited ABN 95 087 822 455 (Cuscal), a company that provides payment services to us and which is a principal member of Visa International. We offer Visa products as a result of that relationship. Where we collect any personal information in connection with the provision or use of the services relevant to our business relationship with you, we may disclose your personal information to Cuscal. Also, the Anti-Money Laundering and Counter-Terrorism Financing Act (AML/ CTF Act) requires us to collect your personal information and without it, Cuscal may not be able to provide their services. When we collect information from you, we will let you know what we are going to use it for. We may use your personal information (including credit-related information) for the purpose of providing products and services to you, managing our business and complying with the law. This may include: • identity verification (including electronic verification) and customer due diligence. We may use electronic verification service providers to check

identity information or documents we collect from you. If you decline to consent you will need to verify your identity in another way. If we are unable to verify your identity, we will not be able to open a membership for you or provide you with one of our product or services (including the provision of credit) • assessing and processing your application for the products and services we offer • establishing and providing our systems and processes to provide our products and services to you • executing your instructions • employment and income verification • charging and billing • detecting, investigating and preventing suspicious, illegal, unauthorised or fraudulent activities • maintaining and developing our business systems and infrastructure

• statement printing and other mail out activities • card production and payment systems operators • insurers and re-insurers where insurance is provided in connection with our services to you • other financial institutions, for example, when you apply for a loan from another credit provider and you agree to us providing information ; or for the purpose of detecting, investigating and preventing suspicious, illegal, unauthorised or fraudulent activities • credit reporting bodies, including disclosing that you are in default under a credit agreement or commit a serious credit infringement, if that is the case • persons you use as a proposed or actual guarantor of a loan • lenders’ mortgage insurers, where relevant to credit we have provided

• research and development

• debt collecting agencies, if you have not repaid a loan as required

• notification and collection of overdue payments due under our credit products

• our professional advisors, such as accountants, lawyers and auditors

• managing our rights and obligations regarding external payment systems

• state or territory authorities that give assistance to facilitate the provision of home loans to individuals

• investigating disputes, complaints or mistaken payments • marketing, including direct marketing • complying with our legislative and regulatory obligations; or • other uses required or authorised by law. In general, we do not use or disclose your personal information (including creditrelated information) for a purpose other than: • a purpose set out in this Privacy Policy • a purpose you would reasonably expect • a purpose required or permitted by law, or • a purpose otherwise disclosed to you to which you have consented.

4. Disclosure We may disclose your personal information (including credit-related information) to other organisations, that provide services that assist us in supplying or administering the products and services that we offer. We also disclose your personal information as required by law. For example: • external organisations that are our assignees, agents or contractors • organisations that provide services to verify your identity including electronic verification • organisations that provide services to verify your employment income, history and related information • providers of electronic document execution services

• certain entities that have bought or otherwise obtained an interest in your credit product, or that are considering doing so, and their professional advisors • your representative, for example, lawyer, mortgage broker, financial advisor or attorney, as authorised by you, or • if required or authorised by law, to government and regulatory authorities or other organisations. We may also disclose your personal information to Cuscal, organisations which Cuscal advises us may disclose your personal information to for the purposes of providing payment services to us and to comply with the AML/CTF Act purposes. If your personal information is not provided to Cuscal, they may not be able to provide you with their services. We will take reasonable steps to ensure that these organisations are bound by sufficient confidentiality and privacy obligations with respect to the protection of your personal information. We may disclose your personal information overseas, including your credit information and credit eligibility information. Information that we provide to a third party provider for the electronic execution of documents by you will involve disclosure by the third party to their overseas providers. However, if we do disclose this information outside Australia we will do so on the basis that the information will be used only for the purposes set out in this Privacy Policy.

Before disclosing your personal information to any recipient outside of Australia who is not you or us, we will take reasonable steps to ensure that the overseas recipient does not breach the Australian Privacy Principles in relation to your information. However, we may disclose your personal information (including credit-related information) to an overseas recipient without taking these steps if: • the recipient is subject to a law or binding scheme that protects your information in a way that is substantially similar to the Australian Privacy Principles, and you can take action to enforce that protection • the recipient is subject to the laws of a country or a binding scheme prescribed by regulations, and meets any prescribed conditions • we expressly inform you that by consenting to the disclosure, the above protection steps will not apply, and you consent to the disclosure, or • the disclosure is required or authorised by Australian law or a court order. The Consumer Data Right gives you the right to: • access some of the data (including personal information) held about you by us and by other data holders (‘CDR Data’); and • consent to an accredited third party accessing your CDR Data held by us; We have a policy about our management of CDR Data. It is available through our website or on request.

5. Sensitive information Where it is necessary to do so, we may collect personal information about you that is sensitive. Sensitive information includes information about an individual’s health, and membership of a professional or trade association. Unless we are required or permitted by law to collect that information, we will obtain your consent. However, if the information relates directly to your ability to meet financial obligations (i.e. hardship application) that you owe to us, you are treated as having consented to its collection.

6. Refusal of credit applications We may refuse an application for consumer credit made by you individually or with other applicants. Our refusal may be based on credit eligibility information obtained from a credit reporting body about either you, another applicant or another person proposed as guarantor. In that case, we will give you written notice that the application has been refused on the basis of that information. We will tell you the name and contact details of the relevant credit reporting body and other relevant

information. If we obtain credit reporting information about you from a credit reporting body and, within 90 days of obtaining that information, we refuse an application for consumer credit made by you (whether alone or jointly with other applicants), we will provide you with a written notice of refusal that tells you the name and contact details of the relevant credit reporting body and other relevant information.

7. Security We take all reasonable steps (including technical and organisational measures) to ensure that your personal information (including credit-related information), held on our website or otherwise, is protected from: • misuse, interference and loss, and • unauthorised access, disclosure or modification. Your personal information may be held by us in paper or electronic form. All personal information is stored within secure systems which are in controlled facilities. There are restrictions on who may access personal information and for what purposes. Our employees, contractors, service providers and authorised agents are obliged to respect the confidentiality of personal information held by us. If we suspect or believe that there has been any unauthorised access to, disclosure of, or loss of, personal information held by us, we will promptly investigate the matter and take appropriate action, and we will comply with any obligations in relation to notifiable data breaches that are in force under the Privacy Act. We ask you to keep your passwords and personal identification numbers safe, in accordance with our suggestions. You can also help to keep the personal information that we hold about you secure by taking care before you authorise or otherwise assist any third party to obtain or gain access to that information (see ‘Disclosure’ above). You should never provide or disclose any of your passwords or personal identification numbers to any third party to enable the third party to obtain or access to your personal information. If you do, you may breach the ePayments Code and the terms and conditions applying to the products and services we provide to you and you may be liable for any unauthorised transactions that subsequently occur. When we no longer require your personal information (including when we are no longer required by law to keep records relating to you), we take reasonable steps to ensure that it is destroyed or deidentified.

8. Website This section explains how we handle

personal information (including creditrelated information) collected from our website. If you have any questions or concerns about transmitting your personal information via the internet, you may contact our Privacy Officer, whose details are in paragraph 14 of this Privacy Policy, as there are other ways for you to provide us with your personal information. Visiting our website Anytime you access an unsecured part of our website, that is, a public page that does not require you to log on, we will collect information about your visit, such as: • the time and date of the visit • any information or documentation that you download • your browser type, and • internet protocol details of the device used to access the site. Our website may also include calculators, which may require you to enter your personal details. If you save the data you enter on the calculator, this information will be stored. Cookies A “cookie” is a small text file which is placed on your internet browser and which we may access each time you visit our website. When you visit the secured pages of our website (ie pages that you have to provide login details to access) we use cookies for security and personalisation purposes. When you visit the unsecured pages of our website (ie public pages that you can access without providing login details) we use cookies to obtain information about how our website is being used. You may change the settings on your browser to reject cookies, but doing so might prevent you from accessing the secured pages of our website. Security We use up-to-date security measures on our website to protect your personal information (including credit-related information). Any data containing personal, credit or related information which we transmit via the internet is encrypted. However, we cannot guarantee that any information transmitted via the internet by us, or yourself, is entirely secure. You use our website at your own risk. Links on our website Our website may contain links to third party websites. The terms of this Privacy Policy do not apply to external websites. If you wish to find out how any third parties handle your personal information (including credit-related information), you will need to obtain a copy of their privacy policy.

9. Access You may request access to the personal information (including credit-related information) that we hold about you at any time from our Privacy Officer whose

details are in paragraph 14 of this Privacy Policy. We will respond to your request for access within a reasonable time. If we refuse to give you access to any of your personal information, we will provide you with reasons for the refusal and the relevant provisions of the Privacy Act that we rely on to refuse access. You can contact our Privacy Officer if you would like to challenge our decision to refuse access. We may recover the reasonable costs of our response to a request for access to personal information. You may request access to the personal information that Cuscal holds about you. You may contact Cuscal directly through their website http://www.cuscal.com to gain access to the personal information held by Cuscal. This information disclosure is required to provide services and comply with anti-money laundering laws. Without this information Cuscal may not be able to provide services to you.

10. Accuracy and correction We take reasonable steps to make sure that the personal information (including credit-related information) that we collect, use or disclose is accurate, complete and up-to-date. However, if you believe your information is incorrect, incomplete or not current, you can request that we update this information from our Privacy Officer whose details are in paragraph 14 of this Privacy Policy.

11. Marketing Where we are permitted to do so by law, we may use your personal information, including your contact details, to provide you with information about products and services, including those of organisations, which we consider may be of interest to you, unless you request not to receive marketing communications. If you are on the Do Not Call Register, while you are our member we will infer from our relationship with you that you consent to receiving telemarketing calls from us, unless you notify us that you do not wish to receive such calls. You may request, at any time, not to receive marketing communications or not to receive them through a particular channel, like email. You can make this request by contacting our Privacy Officer whose details are in paragraph 14 of this Privacy Policy, or by ‘unsubscribing’ from our email marketing messages, which always include an unsubscribe option. Unless we have first obtained your consent, we will not provide your personal information to other organisations to use for their marketing purposes. To help us reach the right people with our credit marketing communications, we may ask a credit reporting body to “pre-screen” a list of potential recipients of our marketing communications against our

eligibility criteria to remove recipients that who do not meet those criteria. The credit reporting body cannot use information about your existing loans or repayment history in carrying out its pre-screening and it must destroy its pre-screening assessment once it has given us, or a contractor acting on our behalf, the list of eligible recipients. If you do not want your credit information used for pre-screening by a credit reporting body that holds credit information about you, you can opt-out by informing that credit reporting body, whose contact details are on their website.

12. Changes to the Privacy Policy

please let us know and we will investigate further and respond to you. If you are still not satisfied, you can contact external bodies that deal with privacy complaints. These are the Australian Financial Complaints Authority, which is our external dispute resolution scheme, and the Office of the Australian Information Commissioner. Either of these bodies may forward your complaint to another external dispute resolution body if it considers the complaint would be better handled by that other body. Australian Financial Complaints Authority GPO Box 3, Melbourne VIC 3001 Telephone: 1800 931 678 Website: www.afca.org.au

We may make changes to this Privacy Policy from time to time (without notice to you) that are necessary for our business requirements or the law. Our current Privacy Policy is available on our website.

Office of the Australian Information Commissioner (OAIC) GPO Box 5288 Sydney NSW 2001 Telephone: 1300 363 992 Website: www.oaic.gov.au

13. Questions and complaints

14. Privacy Officer

Please contact our Privacy Officer whose details are in paragraph 14 of this Privacy Policy if you have any questions, concerns or complaints about: • this Privacy Policy • our handling of your personal information, including credit-related information • the collection, use and disclosure of your information • the privacy of your personal information and if you believe that it has been compromised or is not adequately protected.

Our Privacy Officer’s contact details are: The Privacy Officer Level 3, 400 King William Street Adelaide SA 5000 Telephone: 13 8777 Disclaimer This Privacy Policy is provided for the purposes of information only. While we have taken care to ensure that it is accurate and current, we provide no guarantee as to its accuracy or currency. We accept no liability for loss or damage suffered as a result of reliance on the information provided in this Privacy Policy.

Once a complaint has been lodged, we will respond to you as soon as possible. We will aim to deal with your complaint at the source of your complaint. If you are not satisfied with the response you receive,

Credit Union SA Ltd ABN 36 087 651 232 AFSL/Australian Credit Licence 241066

Credit Union SA Centre Level 3, 400 King William Street, Adelaide SA 5000 GPO Box 699 Adelaide SA 5001

BRC_1024 20261027