All emails, documents, images, or other recorded information held or used by CIS is Personal Information, as defined and referred to in clause 3, and therefore considered Confidential Information. CIS acknowledges its obligation in relation to the handling, use, disclosure and processing of Personal Information pursuant to the Privacy Act 1988 (“the Act”) including the Part IIIC of the Act being Privacy Amendment (Notifiable Data Breaches) Act 2017 (NDB) and any statutory requirements, where relevant in a European Economic Area (“EEA”), under the EU Data Privacy Laws (including the General Data Protection Regulation “GDPR”) (collectively, “EU Data Privacy Laws”). CIS acknowledges that in the event it becomes aware of any data breaches and/or disclosure of the Customer’s Personal Information, held by CIS that may result in serious harm to the Customer, CIS will notify the Customer in accordance with the Act and/or the GDPR. Any release of such Personal Information must be in accordance with the Act and the GDPR (where relevant) and must be approved by the Customer by written consent, unless subject to an operation of law.

Notwithstanding clause 1, privacy limitations will extend to CIS in respect of Cookies where the Customer utilises CIS’ website to make enquiries. CIS agrees to display reference to such Cookies and/or similar tracking technologies, such as pixels and web beacons (if applicable), such technology allows the collection of Personal Information such as the Customer’s:

• IP address, browser, email client type and other similar details;
• tracking website usage and traffic; and
• reports are available to CIS when CIS sends an email to the Customer, so CIS may collect and review that information (“collectively Personal Information”)

If the Customer consents to CIS’ use of Cookies on CIS’ website and later wishes to withdraw that consent, the Customer may manage and control CIS’ privacy controls via the Customer’s web browser, including removing Cookies by deleting them from the browser history when exiting the site.

• The Customer agrees that CIS may exchange information about the Customer with those credit providers and with related body corporates for the following purposes:
  • to assess an application by the Customer; and/or
  • to notify other credit providers of a default by the Customer; and/or
  • to exchange information with other credit providers as to the status of this credit account, where the Customer is in default with other credit providers; and/or
  • to assess the creditworthiness of the Customer including the Customer’s repayment history in the preceding two (2) years.

The Customer consents to CIS being given a consumer credit report to collect personal credit information relating to any overdue payment on commercial credit.

The Customer agrees that personal credit information provided may be used and retained by CIS for the following purposes (and for other agreed purposes or required by):

• the provision of Goods; and/or
• analysing, verifying and/or checking the Customer’s credit, payment and/or status in relation to the provision of Goods; and/or
• processing of any payment instructions, direct debit facilities and/or credit facilities requested by the Customer; and/or
• enabling the collection of amounts outstanding in relation to the Goods.

CIS may give information about the Customer to a CRB for the following purposes:

• to obtain a consumer credit report;
• allow the CRB to create or maintain a credit information file about the Customer including credit history.

The information given to the CRB may include:

• Personal Information as outlined in 3 above;
• name of the credit provider and that CIS is a current credit provider to the Customer;
• whether the credit provider is a licensee;
• type of consumer credit;
• details concerning the Customer’s application for credit or commercial credit (e.g. date of commencement/termination of the credit account and the amount requested);
• advice of consumer credit defaults (provided CIS is a member of an approved OAIC External Disputes Resolution Scheme), overdue accounts, loan repayments or outstanding monies which are overdue by more than sixty (60) days and for which written notice for request of payment has been made and debt recovery action commenced or alternatively that the Customer no longer has any overdue accounts and CIS has been paid or otherwise discharged and all details surrounding that discharge (e.g. dates of payments);
• information that, in the opinion of CIS, the Customer has committed a serious credit infringement;
• advice that the amount of the Customer’s overdue payment is equal to or more than one hundred and fifty dollars ($150).

The Customer shall have the right to request (by e-mail) from CIS:

• a copy of the Personal Information about the Customer retained by CIS and the right to request that CIS correct any incorrect Personal Information; and
• that CIS does not disclose any Personal Information about the Customer for the purpose of direct marketing.

CIS will destroy Personal Information upon the Customer’s request (by e-mail) or if it is no longer required unless it is required to fulfil the obligations of this Contract or is required to be maintained and/or stored in accordance with the law.

The Customer can make a privacy complaint by contacting CIS via e-mail. CIS will respond to that complaint within seven (7) days of receipt and will take steps to reach a decision on the complaint within thirty (30) days of receipt of the complaint. If the Customer is not satisfied with the resolution provided, the Customer can make a complaint to the Information Commissioner at oaic.gov.au.