Credit Reporting Policy

When we use the terms RAG entity, we, our, us; it means each member of the Rabobank Group based in Australia, being:

• Coöperatieve Rabobank U.A. (Australia Branch) (ABN 70 003 917 655)
• Rabobank Australia Limited (ABN 50 001 621 129)
• Rabo Australia Limited (ABN 39 060 452 217)
• Rabo Equipment Finance Limited (ABN 37 072 771 147)
• Soft Commodity Trading Pty Limited (ABN 45 085 595 562)
• GrainCorp Pools Pty Limited (ABN 45 095 759 890)

Each Rabobank Australia Group entity collects and processes the credit data it holds about you in accordance with the Privacy Act 1988 (Cth) ("Privacy Act") and the Australian Privacy Principles set out in that Act and the Privacy (Credit Reporting Code) Code.

Our management of your other personal data is set out in our Privacy Policy, available by visiting www.rabobank.com.au and selecting 'Privacy' at the bottom of the page.

We collect, handle, manage and use various types of credit data including:

• Identity particulars
• The fact that you have applied for credit and the type and amount of that credit
• The fact that we are a credit provider to you and the type, characteristic and maximum amount of credit provided to you
• The day on which the credit is entered into and day on which it is terminated or otherwise ceases to be in force
• Your repayment history data
• Payments owed to us in connection with credit provided to you which are overdue more than 60 days and for which collection action has commenced
• Cheques drawn by you which have been dishonoured more than once
• Advice that payments are no longer overdue
• In specified circumstances, that in our opinion you have committed a serious credit infringement
• That the credit provided to you by us has been paid or discharged
• Scores, ratings, evaluations and other information relating to your credit worthiness which is derived by us or a CRB.

Credit data is generally collected directly from the person concerned or from persons acting on their behalf, usually at the time of contact or when taking out a new product from us. The collection of most credit data will be made with your express consent which will usually be obtained at or around the time you take out a new product with us (i.e. when you sign an application for credit).

If your express consent is not provided, or you object to this processing then, we will not collect this data. However, this may mean that we will not be able to accept your application.

Sometimes credit data is also collected from a third party, for example a person's credit history from a CRB, such as Equifax or other credit providers such as other banks. At or before the time or, if that is not practicable, as soon as practicable after, where we collect credit data about an individual, we will take reasonable steps in the circumstances to let that individual know we have their credit data. The collection of credit data may also be collected where such data is in the public domain or is derived by us from your usage and (where applicable) repayment of any account held with us or other credit providers associated with us.

Your credit data can be accessed only by individuals who need to have access, owing to their position. All of these people are bound by a duty of confidentiality. We have practices and policies in place to provide a high level of security to protect credit data.

We take all reasonable precautions to protect your credit data by:

• Regularly assessing the risk of misuse, interference, loss and unauthorised access to credit data we hold from both internal and external threats;
• Taking action to address any identified risks such as the use of dedicated secure networks or encryption when we send credit data electronically or the implementation of physical security measures to our locations;
• Conducting regular reviews and audits to assess the quality of the actions we have implemented.

We may process your credit data on the following lawful grounds:

• Legal obligation: where we process your credit data to comply with our legal obligations.
• Perform an agreement: where we process your credit data to enter into an agreement or perform our agreement with you.
• Consent: where you have provided your consent to us to process your credit data.

In addition to the above common lawful grounds, we may also process your credit data if we have a legitimate interest in doing so, and as long as the legitimate interest does not prejudice your right to privacy. We will only process your credit data on the ground of legitimate interest if the other lawful grounds do not apply. Our legitimate interests include:

• Protecting our own financial position.
• Combatting fraud to prevent damage to us, but also the financial sector, and to protect yours and our security.
• Improving our business processes, taking measures in the context of company management and performing audits on our internal processes.
• Making sure that our clients are financially healthy. For example, identifying at an early stage that you may have payment problems.

We need to be in a good position to decide whether or not you are likely to repay your loan when you apply to us for credit.

We base our decision on your current financial position and on your credit history. This means that we will consider the data you give us in your application and may make enquiries with and obtain further data from a credit reporting body and other credit providers you have borrowed from previously.

We may collect, hold and disclose your credit data as reasonably necessary for our business purposes and as permitted by law such as:

• To make decisions as to whether to provide you with credit;
• Evaluate your credit worthiness as a borrower or guarantor;
• Manage credit provided to you;
• Participate in the credit reporting system and providing data to credit reporting bodies as permitted by Part IIIA of the Privacy Act and the Credit Reporting Code;
• Provide you with information about products and services;
• Administer products and services, answering your ongoing requests and complaints, varying and developing products and services, taking any required legal action in relation to our accounts and managing our relevant product portfolios;
• Derive evaluations relating to your credit worthiness used in our decision-making processes and ongoing reviews;
• Undertake securitisation activities;
• Assist you to avoid defaulting on your credit-related obligations; and
• Consider financial difficulty requests.

Where the Privacy Act applies, we can only give your credit data to a credit reporting body if we have told you first that we will do so and we can only obtain data about you from a credit reporting body if we have your consent.

We may collect credit data about you from the following CRBs:

Equifax Australia

Telephone: 13 83 32
Mail: Equifax Australia Information Services and Solutions Pty Limited, PO Box 964, North Sydney, NSW 2059
Email: customerserviceAU@equifax.com
Website: mycreditfile.com.au

You may obtain a copy of Equifax's policy about their management of credit reporting information by contacting them directly or visiting their website.

Experian

Telephone: 1300 784 134
Mail: Experian Australia Credit Services Pty Ltd, PO Box 1969, North Sydney NSW 2060
Email: creditreport@au.experian.com
Website: experian.com.au/credit-bureau

You may obtain a copy of Experian's policy about their management of credit reporting information by contacting them directly or visiting their website.

illion (formally known as Dun & Bradstreet)

Telephone: 1300 734 806
Mail: illion Australia Pty Ltd, PO Box 7405, St. Kilda Rd Melbourne VIC 3004
Email: pac.austral@illion.com.au
Website: checkyourcredit.com.au

You may obtain a copy of illion's policy about their management of credit reporting information by contacting them directly or visiting their website.

The Privacy Act and Privacy (Credit Reporting) Code limit what we can do with the data we obtain from a CRB. Generally, it can only be used in relation to the credit products you hold through us.

We operate our banking activities globally and we will disclose your credit data to overseas recipients including other Rabobank Group entities and external service providers.

We may disclose your credit data outside Australia to:

• Other members of the Rabobank Group of companies for consolidated reporting and compliance purposes (including regulatory and legislative requirements of any member of the group) and the administration and management of your facilities; and
• Entities which provide services required to supply you with your products and services.

Countries to which your credit data may be disclosed are The Netherlands, the United Kingdom, Belgium, Luxembourg, Singapore, Hong Kong, the United States, New Zealand, India and Canada.

Where we disclose credit data overseas we take reasonable steps to certify the recipient meets our privacy standards in protecting your credit data and complies with the Australian Privacy Act. We do so by entering into contracts with confidentiality arrangements in place and to confirm that they use or disclose personal data only for the specific service we ask them to perform or the product/service we ask them to provide.

To help us with the wide range of tasks associated with our business of the provision and management of credit, we may disclose your credit data to CRBs. Under the Privacy Act and Privacy (Credit Reporting) Code, CRBs are permitted to handle credit data. If you apply for any kind of credit or offer to act as guarantor, we may disclose your credit data to a CRB. We may process your credit data to evaluate your credit worthiness as a borrower or guarantor, for which we may disclose to a CRB. Other credit data which we may disclose to a CRB includes the conduct of your credit products with us. For example, if you fail to meet your payment obligations in relation to your credit products, or commit a serious credit infringement, we may be entitled to disclose this to a CRB. CRBs may include your credit data provided by us in reports provided to other credit providers to assist them to assess your credit worthiness (such as when you have applied for a loan from the provider). Each CRB has a policy for managing your credit data that you may access by contacting the CRBs using the details listed above.

In addition, CRBs offer a credit prescreening service to credit providers wishing to send direct marketing material about credit services to individuals. You may request that CRBs not use your data for this purpose. To opt out of credit pre-screening, contact the CRB, using the contact details on their websites noted above. You can also ask a CRB not to use or disclose your data for a period if you believe on reasonable grounds that you have been or are likely to be a victim of fraud.

Under the Australian Privacy Act, you have a right to request access to your credit data and to request its correction. Your rights to access your credit data are subject to some limitations. For example, we do not have to provide you with access to the extent it would be illegal to do so and we may need to give you access in a way that preserves the confidentiality of any methodology, data analysis methods, computer programs or other data used by us to derive relevant data.

If you request us to correct your credit data we hold, we will take such steps (if any) as are reasonable to confirm that, having regard to the purpose for which it is held, the information is accurate, up-to-date, complete, relevant and not misleading.

How do you make a request for Access or Correction of your credit data?

To make a rights request to your personal data please visit our Individual Rights Portal.

You may also contact us through the channels described in the section below.

If you make an access or correction request, we will answer this within one month after we have received the request.

If we refuse to provide you access or to correct the credit data as requested by you, we will give you a written notice that sets out:

• The reasons for the refusal except to the extent that it would be unreasonable to do so; and
• The mechanisms available to complain about the refusal.

If you have a concern or complaint about your credit data held by us, including a breach of the Australian Privacy Principles under the Privacy Act or the Privacy (Credit Reporting) Code, please contact us by using the details below:

Farm Business (Rural Banking) clients

• Visit our website and completing our online form: www.rabobank.com.au/compliments-and-complaints
• Phone: 1800 025 484 (free call), Mon-Fri 6am - 8pm (Sydney time) or call your local area manager. If you're overseas call: +61 2 8115 2240
• Email: Sydney.client.services@rabobank.com
• Mail: Client Services Manager, Rabobank, GPO Box 4577, Sydney, NSW 2001
• Call or visit your local branch and speak directly to your Rural Manager or contact your local Rabobank branch. Often a discussion with a staff member who is familiar with your business can provide a quick resolution. If you are not satisfied or uncomfortable addressing your complaint with your local team, you can ask to speak to a Branch Manager or Regional Manager by contacting your local Rabobank branch on 1300 30 30 33
• Contact the Office of the Australian Information Commissioner (OAIC) by visiting their website on www.oaic.gov.au, sending an email to enquiries@oaic.gov.au or phoning 1300 363 992

Rabobank Online Savings clients

• Visit our website and completing our online form: www.rabobank.com.au/compliments-and-complaints
• Phone: 1800 445 445 (free call), Mon-Fri 6am - 8pm (Sydney time). If you're overseas call: +61 2 8115 2558 y Email: clientservicesAU@rabobank.com
• Mail: Client Services Manager, Rabobank, GPO Box 4577, Sydney, NSW 2001
• Contact the Office of the Australian Information Commissioner (OAIC) by visiting their website on www.oaic.gov.au, sending an email to enquiries@oaic.gov.au or phoning 1300 363 992

When sending your message to us, please include your name, address and contact details, as well as your complaint and what action(s) you have taken (e.g. requested your card to be stopped with the Merchant). Also let us know what you would like to see as an outcome. For security reasons, please DO NOT provide any confidential or account specific information via email or post.

Our Client Services specialists will aim to promptly resolve your complaint and/or any issues identified. If more action is needed, they will escalate the matter to the appropriate person.

Should you require additional assistance to make your compliant, Rabobank has the following services available to you:

National Relay Service (NRS) A Government initiative that offers phone service for people who have speech and hearing impairments. It is available free of charge through the following channels by:

Phone

Voice Relay number: 1300 555 727
SMS Relay number: 0423 677 767
Talk to Text number: 133 677

Internet

National Relay Chat Call services:
https://nrschat.nrscall.gov.au/nrs/internetrelay

National Relay service:
https://www.infrastructure.gov.au/media-technology-communications/phone/services-people-with-disability/accesshub/national-relay-service

Free translation services are available to you, if you have limited English, where you can get the help of a translator or interpreter (telephonically or face to face) to help you lodge your complaint. Please contact us and we will make the necessary arrangements for a translator or interpreter through National Accreditation Authority for Translators and Interpreters (NAATI).

We will give you written acknowledgement of your complaint within 24 hours (one business day), of receipt of your complaint.

We will investigate and respond to your complaint within 30 calendar days.

If we are unable to resolve your complaint within 30 calendar days, we will tell you:

• The reasons for the delay;
• Your right to complain to Australian Financial Complaints Authority (AFCA) and/or the Office of the Australian Information Commissioner (OAIC); and
• Contact details of AFCA and OAIC.

In limited circumstances, we may need more time to resolve your complaint. If that's the case, we will inform you of the reasons for the delay, provide you with monthly updates and specify a date by which we will provide you with a resolution.

If you are not satisfied with the resolution offered or if your complaint is not resolved within 30 calendar days, you have the following options:

Access our external dispute resolution service, the Australian Financial Complaints Authority (AFCA).

Website: www.afca.org.au

Phone: 1800 931 678

Access the Office of the Australian Information Commissioner (OAIC).

Email: enquiries@oaic.gov.au

Phone: 1300 363 992

If you're overseas call: +61 2 9284 9749

Mail: GPO Box 5218, Sydney NSW 2001

AFCA provides a free and independent service to resolve complaints by consumers and small businesses about financial services firms where that complaint falls within AFCA's terms of reference. Decisions made by AFCA are binding on us. However, time limits may apply to complaints to AFCA so you should act promptly or consult the AFCA website to find out if or when the time limit relevant to your circumstances expires. For more information, please refer to AFCA's brochure 'How to Resolve your Dispute' from AFCA website or request a copy of this brochure from one of our staff members.

Yes, we review our Credit Reporting Policy on a regular basis and that means that it may change from time to time. This is possible if there are new data processes and these changes are important to you. We will of course keep you informed of material changes to this Policy. You can always find the most current version of our Credit Reporting Policy at www.rabobank.com.au.

Latest version: February 2023.

If you have any general feedback or queries regarding the way Rabobank handles your credit data, you may also contact the Privacy Officer:

• Email: sydney.privacy@rabobank.com
• Mail: The Privacy Officer, Rabobank Group, GPO Box 4577, Sydney NSW 2001