Client Information and Privacy Notice

1. About This Policy

Consumer Credit Management Ltd ("we", "us", "our") is committed to protecting the privacy of all individuals whose personal information we collect, use, or disclose. This Privacy Policy explains how we handle personal information in accordance with the Privacy Act 2020 (NZ), including the Information Privacy Principles (IPPs), and the Credit Reporting Privacy Code 2020 (CRPC).

This policy has been updated to reflect the new Information Privacy Principle 3A (IPP3A), effective 1 May 2026, which requires organisations to notify individuals when their personal information is collected indirectly.

2. Information We Collect

To provide repossession, debt recovery, and skip-tracing services, we may collect and process the following personal information:

• Debtor/Subject information: Full name, date of birth, contact details (phone, email, address), employment information, vehicle details, and financial information relevant to the debt or asset being recovered.

• Client information: Business name, contact details, and account information for our finance company and creditor clients.

• Agent/Contractor information: Name, contact details, licensing information, and operational data.

• Associates and related parties: Names and contact details of guarantors, co-borrowers, next of kin, and other related parties where relevant to a lawful repossession or recovery action.

3. How We Collect Personal Information

We collect personal information from the following sources:

• Directly from you: When you contact us, submit a job, or use our portal.

• From our clients: Finance companies, banks, and creditors provide debtor information when engaging our services.

• From third-party sources (indirect collection): We may collect personal information from credit reporting agencies (including Centrix Group Limited), the New Zealand Transport Agency (Waka Kotahi), the Personal Property Securities Register (PPSR), Land Information New Zealand (LINZ), the Companies Office, the Insolvency Register, and publicly available sources including social media and online directories.

• IPP3A Notice (Effective 1 May 2026) Where we collect your personal information indirectly (i.e. from a source other than you), we are required under the Privacy Act 2020 (IPP3A) to notify you that this collection has occurred. Our clients are required to notify you before providing your personal information to us. Where it is not practicable for us to notify you directly, this privacy policy serves as notification that we may collect and use your personal information as described herein.

4. Purposes of Collection

We collect and use personal information for the following purposes:

• Executing repossession and recovery actions under lawful authority (Credit Contracts and Consumer Finance Act 2003, Property Law Act 2007)
• Skip tracing and locating debtors and assets
• Credit reporting and credit checking through approved agencies
• Preparing legal documents including affidavits, statutory demands, and court filings
• Administering client accounts and invoicing
• Complying with our legal and regulatory obligations
• Training and quality assurance purposes

5. Credit Reporting Services

We use Centrix Group Limited and other credit reporting agencies for credit checking and skip-tracing purposes. When we access these services:

• Your personal information (including credit information) will be provided to Centrix for the purpose of providing credit reporting services to us and other subscribers.
• Centrix will collect, use, and disclose your credit information in accordance with the Centrix Privacy Statement
• You have rights of access to and correction of your credit information and any other personal information held by Centrix, as set out in the Centrix Privacy Statement.
• Our use of credit reporting services is governed by the Credit Reporting Privacy Code 2020 (CRPC) and our contractual obligations with Centrix under their Supply of Information Services Agreement.

6. Disclosure of Personal Information

We may disclose personal information to:

• Our clients (creditors and finance companies) for the purpose of managing debt recovery
• Credit reporting agencies (Centrix Group Limited) for credit reporting and skip-tracing
• Courts and tribunals where required for legal proceedings
• Government agencies (Ministry of Justice, NZTA, LINZ, Companies Office) as required by law
• Our contracted agents and sub-contractors, who are bound by confidentiality obligations
• Law enforcement agencies where required or permitted by law
• Our professional advisors (lawyers, accountants) as necessary
• We do not sell personal information to any third party. We do not transfer personal information outside New Zealand without appropriate safeguards.

7. Data Retention

We retain personal information for up to 7 years from the date of collection or the completion of the relevant job, whichever is later, in accordance with our legal and regulatory obligations. After this period, personal information is securely destroyed.

8. Your Rights

Under the Privacy Act 2020, you have the right to:

• Access: Request access to any personal information we hold about you (IPP6)

• Correction: Request correction of any personal information that is inaccurate, incomplete, or misleading (IPP7)

• Know the purpose: Be informed about why your information was collected and how it will be used

• Know about disclosure: Be informed about who your information may be disclosed to

To exercise these rights, please contact us using the details below. We will respond to access requests within 20 working days as required by the Privacy Act 2020.

If your information has been provided to Centrix Group Limited through our use of their credit reporting services, you may also exercise your access and correction rights directly with Centrix. Details are available in the Centrix Privacy Statement.

9. Security

We take reasonable steps to protect personal information from loss, unauthorised access, modification, or disclosure. Our security measures include:

• Encryption of data in transit and at rest
• Role-based access controls and authentication
• Audit logging of all access to personal information
• Regular security assessments
• Staff training on privacy and data protection obligations

10. Privacy Breaches

In the event of a notifiable privacy breach under Part 6A of the Privacy Act 2020, we will notify the Office of the Privacy Commissioner and affected individuals as required by law. We maintain a breach response plan and conduct regular reviews of our data handling practices.

11. Complaints

If you have a concern about how we have handled your personal information, please contact us first so we can try to resolve it. If you are not satisfied with our response, you may make a complaint to the Office of the Privacy Commissioner:

• Website: www.privacy.org.nz
• Phone: 0800 803 909

12. Contact Us

• Consumer Credit Management Ltd

• Email: enquiries@ccml.net.nz
• Phone: 09 3022317
• Location: Auckland, New Zealand

13. Changes to This Policy

We may update this privacy policy from time to time. Any changes will be posted on this page with an updated effective date. We encourage you to review this policy periodically.