Elevate Funding – Privacy Policy

Legal entity: Elevate Funding Pty Ltd ABN/ACN: 689 773 322 Contact: privacy@elevatefunding.com.au Website: www.elevatefunding.com.au

Depending on your relationship with us (e.g., applicant, guarantor, director, beneficial owner, broker, supplier), we may collect: 2.1 Personal Information • Identification details (name, date of birth, driver licence, passport, Medicare details where permitted, director ID, signatures). • Proof of ID (Australian Driving Licence or Australian Government-issued ID or International Passport). • Contact details (address, email, phone). • Employment/role and business association details (employer, title, ACN/ABN, directorships, beneficial ownership, trust relationships). • Financial information (income, assets, liabilities, bank statements, accounting records, BAS, ATO portals where authorised, trade references). • Application data (loan purpose, security/collateral details, declarations, consents). • Interaction data (call recordings, emails, chat transcripts, forms, feedback, complaints). • Usage data and device information (cookies, IP address, browser, analytics, page interaction, referrers). 2.2 Credit-Related Information (Credit Eligibility Information) • Credit history and repayment information, default information, court judgments and publicly available credit information. • Credit scores/risk ratings and credit reports from credit reporting bodies (CRBs). • Information about previous credit applications and credit arrangements. • Information from trade creditors and bank account verification providers (where authorised). 2.3 Sensitive Information We generally avoid collecting sensitive information (e.g., health, biometric, criminal records). Where necessary (e.g., identity checks or sanctions screening), we will only collect with your consent or as otherwise permitted by law.

• Directly from you when you enquire, apply, call us, email, complete forms, provide documents, or interact with our website or portals. • From your authorised representatives (e.g., brokers, accountants, lawyers, financial advisers) and from joint applicants/guarantors. • From your business systems with your permission (e.g., accounting platforms, bank feeds, payment service providers). • From third parties including: o Credit reporting bodies (e.g., Equifax and/or Creditorwatch) o Identity verification and fraud prevention service providers. o Public sources and registers (ASIC, PPSR, ABR, land titles, court records). o Trade references, suppliers, and industry partners. • Automatically via cookies and similar technologies when you visit our website(s). If you do not provide information we request, we may be unable to assess your application or provide services. At Elevate, we use the Document Verification Service (DVS) to verify a customer's identity by confirming that the details on their identity document match the government's records. The DVS can also confirm that the details are still valid and not expired or cancelled. We do not give you the option of dealing with us anonymously, or under a pseudonym. This is because it is impractical, and, in some circumstances, illegal for Elevate to deal with individuals who are not identified.

We use your information to: • Provide and manage credit: assess applications, verify identity, conduct KYC/AML checks, assess affordability and suitability, set limits and terms, administer accounts, and manage collections and recoveries. • Credit reporting: obtain your credit report, report defaults or serious credit infringements where lawful, and update CRBs about your credit status. • Risk, compliance, and security: sanctions screening, fraud detection, transaction monitoring, audits, dispute resolution, and legal compliance (including record-keeping). • Business operations: analytics, product development, training, service improvement, and quality assurance (including call recording). • Communications: send service messages, statements, notices, and respond to enquiries and complaints. • Marketing: send offers and information about our products and services or those of trusted partners, in accordance with consents and opt-out preferences. • Website and technology: operate, secure, maintain, and improve our websites, portals, and digital experiences. We may de-identify information for analytics, benchmarking, and reporting.

We handle Personal Information where reasonably necessary for our business functions and activities, with your consent where required, and as permitted or required by law (including AML/CTF obligations and credit reporting laws).

We may disclose Personal Information to: • Credit reporting bodies (CRBs) and other credit providers. • Identity verification, fraud prevention, and AML/CTF service providers. • Brokers, referrers, and your authorised representatives involved in your application or ongoing relationship. • Banking partners, funders, securitisation trusts, insurers, and reinsurers. • Service providers (IT hosting, cloud, analytics, communications, printing, mail houses, call centres, payment processors, document execution providers, digital signature services). • Professional advisors (lawyers, accountants, auditors) and regulators or law enforcement where required or authorised by law. • Debt buyers, external collections agencies, and mercantile agents if your account is in arrears or sold. • Assignees or potential assignees and acquirers in connection with business transfers or securitisations. • Other parties with your consent. 6.1 Overseas disclosures Some recipients may be located outside Australia (e.g. cloud hosting, analytics, or support providers). Where we disclose overseas, we take reasonable steps to ensure recipients protect Personal Information in a manner consistent with Australian standards.

When you apply for credit or agree to be a guarantor, you authorise us to: • Obtain and use credit reports and credit eligibility information from CRBs to assess applications, manage credit, and collect overdue payments. • Disclose to CRBs information about you and your credit, including defaults or serious credit infringements, as permitted by law. • Exchange credit information with other credit providers named in your application or identified in your credit report. Your rights with CRBs include requesting that a CRB: • does not use your information for pre-screening; and • places a ban if you believe you are (or are at risk of being) a victim of fraud. CRBs we may use: [Equifax Pty Ltd], CreditorWatch Pty Ltd

We use cookies and similar technologies to operate and improve our websites, remember preferences, measure performance, and support security and marketing. You can manage cookies in your browser settings; blocking some cookies may impact site functionality. We may use analytics tools and advertising partners that process pseudonymous identifiers (e.g., IP address, device IDs). Where required, we seek consent.

We may use your contact details to send you marketing communications about products and services that may be relevant to your business. You can opt out at any time by using the unsubscribe link in our emails or by contacting us at privacy@elevatefunding.com.au. Even if you opt out of marketing, we will still send you important service and account communications.

We implement administrative, technical, and physical safeguards designed to protect Personal Information against unauthorised access, modification, or disclosure. These include access controls, encryption in transit and at rest (where appropriate), secure development and logging practices, staff training, and vendor due diligence. Despite our efforts, no method of transmission or storage is completely secure; we continually improve our controls.

We retain Personal Information for as long as reasonably necessary for the purposes set out in this policy, including to comply with legal, regulatory, tax, and reporting obligations (e.g. AML/CTF record keeping), to resolve disputes, and to enforce our agreements. When no longer required, we take reasonable steps to deidentify or securely destroy it.

You may request access to the Personal Information we hold about you and ask us to correct it if it is inaccurate, out-of-date, incomplete, irrelevant, or misleading. • How to request: Contact privacy@elevatefunding.com.au. • Response time: We will respond within a reasonable period and, where we refuse access or correction (e.g. due to legal restrictions), we will explain the reasons and how you can complain. For credit eligibility information, you can also request access or correction from the relevant CRB(s).

If a data breach is likely to result in serious harm, we will assess promptly and, where required by law, notify affected individuals and the Office of the Australian Information Commissioner (OAIC).

As a lender, we are required to conduct customer due diligence and other checks under AntiMoney Laundering and CounterTerrorism Financing laws. This may include identity verification, sanctions screening, politically exposed person (PEP) checks, transaction monitoring, and reporting to the Australian Transaction Reports and Analysis Centre (AUSTRAC), as required or permitted by law.

Our website may contain links to thirdparty sites or services. We are not responsible for their privacy practices. We recommend you review their privacy policies before providing Personal Information.

Our products and services are designed for businesses and are not intended for individuals under 18. We do not knowingly collect Personal Information from children.

We may update this Privacy Policy from time to time. The latest version will be published at www.elevatefunding.com.au/privacy with the effective date. Where changes are material, we will take reasonable steps to notify you.

Privacy enquiries and requests Email: privacy@elevatefunding.com.au Phone: 0485 587 225 Complaints If you have a privacy complaint, please contact us first. We’ll acknowledge your complaint and aim to resolve it within 30 days. If you are not satisfied, you may contact the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or 1300 363 992.

• Personal Information: Information or an opinion about an identified individual, or an individual who is reasonably identifiable. • Credit Information / Credit Eligibility Information: Information used to assess and manage credit, including information sourced from CRBs and derived from it. • Sensitive Information: A subset of Personal Information including health information, biometric data, and criminal records. • CRB: Credit Reporting Body.

By submitting an application, acting as a guarantor, or engaging with us for credit, you acknowledge and consent to: 1. Our collection, use, and disclosure of your Personal Information as set out in this policy. 2. Our exchange of your credit information with CRBs and other credit providers as permitted by law. 3. Our identity verification and AML/CTF checks with thirdparty providers and official records. 4. Our use of electronic communications and signatures (where applicable). 5. Our marketing communications, subject to your right to optout at any time. Optional: Credit Reporting Bodies – contact details • Equifax Pty Ltd – www.mycreditfile.com.au | Phone: 13 83 32 • CreditorWatch Pty Ltd – www.creditorwatch.com.au | Phone: 1300 501 312