Lorem Ipsum Dolor Sit.

15 February 2022

Introduction

This policy describes your rights under the Consumer Data Rights (CDR) legislation (the Competition and Consumer Act 2010 and the Competition and Consumer (Consumer Data Rights) 2020 (CDR Rules). This Policy applies to Australian consumers, or account holders of Australian financial institutions consenting to the provision of their CDR Data.

Scope

The CDR Rules enables you, the consumer, to authorise the sharing of information held about you and your accounts (referred to as CDR Data) by your Accredited Data Holders (such as your financial institutions) with other CDR Rules accredited financial institutions and third parties, such as Yodlee. Open Banking is the term used to describe the implementation of the CDR Rules in the banking sector.

Yodlee’s CDR Rules Policy (CDR Policy) describes your rights to access your CDR Data and to authorise the release and use of your CDR Data by Yodlee.

This CDR Policy also describes how we handle your CDR Data as well as how we address your inquiries, requests and complaints.

A copy of this CDR Policy is available electronically or in hard copy. Please email [email protected] to request a copy.

Information That May Be Shared With Us

The information that may be shared with Yodlee includes:

• Information About You: Your name, occupation and contact details (physical, email, phone numbers). If you are a business, information about your business may be shared as well.
• Products You Use

• The types of banking and other financial products (i.e. accounts) you have and their features, such as interest rates and fees.
• Account balances and details of account transactions, including deposits, debits, payments and fees
• Payee details

Managing Your Data

We will provide the ability for you to securely manage your CDR Data within our application. You will be able to:  

• Initiate, change, maintain or withdraw CDR Data request authorisation consents
• Maintain, modify or revoke CDR Data consents
• View which products and account to be shared
• See the expiry date of current consents
• Review a summary of data retrieved from nominated Accredited Data Holders
• Confirm with whom your information is being shared and for what purposes
• Confirm who has authorised and who will be able to access your information we have received.

Roles we carry out under the CDR Rules

Being a Consumer Data Right accredited business, we may provide multiple services and hold different roles in the use of your information under the CDR:

Data Holder

The entity that holds your information is a Data Holder. Following receipt of your information as a Data Recipient if you request us to share this information to another accredited entity we will act as a Data Holder.

Data Recipient

We are a Data Recipient when we request and receive your (the consumer’s) CDR Data from a Data Holder on your behalf (and with your consent) to provide you with a Yodlee product or service.

Intermediary

We are an Intermediary when we receive CDR Data directly from a Data Holder, with your consent, and pass it on “as-is” or process it before we provide the processed data, to yourself or another accredited Data Recipient or accredited authorised third-party.

Outsourced Service Provider

We are an Outsourced Service Provider when we provide services to an Accredited Data Recipient to whom you have provided consent to obtain your information from an Accredited Data Holder. We may collect the data from the Data Holder on behalf of the Data Recipient, passing it on to them in its original state and retaining it only per their instructions.

We may also receive your information via an Accredited Data Recipient for processing, providing it back to them for their use or to be provided to you.

In all cases, your prior consent will be obtained from you before we carry out any of the above roles in relation to your information under Consumer Data Right. This consent may be revoked at any time.

How do you request the sharing of your information?

You may provide consent to sharing of your information held by a Data Holder through our secure dashboard. When your consent to share the data held is provided to us, we will securely send the request(s) to the entities holding your information for authentication, authorisation and subsequent provision of the information.

Modifications or revocation of consent may be made through our Consumer Data Right dashboard or advising us in writing. Revocation may also be made at the Data Holder financial institution from whom you share your information with us. Your Data Holder financial institution/s may also provide a non-electronic process for collection and processing of your consent.

How does it work?

1.Having given us consent through our CDR accredited dashboard that is available via our (or our partners in an Intermediary model) website or app, we collect your information from a Data Holder/s where we will send the request to the Data Holder/s via the API gateway using the registered certificate/token.

2.In addition to the information the Data Holder may request an additional form of authentication of you such as via a one-time password or confirmation sent to you via their mobile phone app or your internet banking account, or email address that will have been registered with them.

3.The Data holder may remind you that your information is being collected by us as an Accredited Data Recipient or Intermediary and to confirm which accounts, you would like to share with us.

4.You will be asked to authorise us to share your information with us for a period of time.

5.When the Data Holder/s have confirmed your authentication and authorisation to share your information we will receive it and use it as you have consented. We may also receive, with your consent, a token to refresh your information to provide you with the Yodlee services on an ongoing basis.

Any issues with the Data Holder’s authentication or authorisation of you should initially be taken up with them.

Use of the information you consent to share with Yodlee

We only collect information on your behalf that we need to provide you with our products and services.

We will advise you of how we will use your information and obtain your consent authorisation to do so. This may be used by ourselves or other authorised accredited parties under the Consumer Data Rights who you consent your information to be shared with.

If we will be sharing your information with other accredited third parties, we will tell you whom they are, for what purposes your information will be used and obtain your prior consent.

Examples of the use of your information may include:

• Providing you with budgeting and savings tools and product information
• Analysis and tips to save on the bills you pay.
• Automatic reminders or actual payment of your bills.
• Collection of your income and expenses for credit applications
• Verification of your account information for identity checking
• Comparison of your product data across Financial Institutions

We will not sell your CDR Data.

For more details about our general privacy data handling practices, please refer to our general Privacy Notice

Your control of the sharing of your information

• We only use your CDR Data as necessary to provide you with the Yodlee services you’ve selected, and for which you’ve consented. We will only retain your CDR Data for as long as is necessary to provide you with the Yodlee services you’ve selected or as required by law.
• We provide a secure dashboard where you can view, modify and revoke the consent you’ve provided to share your information with us. You can access it at any time via our application.

When you change or stop consent to share your information

If you change or revoke your consent authorisation at any time we will delete your corresponding data immediately (unless de-identified under the CDR de-identification process) and require anyone to whom we have shared the information to do the same. There are no penalties for withdrawal of consent by consumers.

If you have a loan application being processed your application may be cancelled. You will need to re-do your loan application and/or manually upload your financial information as we will delete the data you have shared.

By Australian law the CDR consumer would not be able to elect, in accordance with rule 4.16 of the CDR, to have the de-identified data deleted once it becomes redundant data

You will not be able to revoke your consent and require us to delete your data that we are required to retain under Australian law, a court/tribunal order, or where it relates to any or anticipated:

• Legal proceedings
• Dispute resolution proceedings to which we are a party.

Protection of the information you share

Protecting the personal information of those who use our and our customers’ products and services is a top priority. We incorporate the same principles of good faith and integrity that guide our fiduciary obligations to investment advisor clients when acting as responsible stewards of the financial data fueling Envestnet | Yodlee’s products and services.

We protect the information that your share and along with our aggregation clients comply with all applicable laws and regulations.

Specifically the information you share is protected from unauthorised access or use under the requirements of the Consumer Data Right legislation, the Australian Privacy Safeguards and as appropriate the Australian Privacy Principles of the Australian Privacy Act (1988).

Here is a link that provides details of the OAIC Consumer Data Right Privacy guidelines that we adhere: https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines

Additionally, we employ proprietary and third-party technical controls, such as encryption, to protect data while it resides on our systems, and further ensure the protection of consumer anonymity. We have built privacy protection into our enabling technology, business processes, and operational procedures.

For support of data analytics and insights, we adhere to leading industry practices for data security, regulatory compliance and privacy, and employ systems that monitor and remove all known identifiers from data elements that are collected. For these services, Envestnet | Yodlee imposes contractual, administrative, and technical measures to protect consumers’ identities, such as prohibiting analytics and insights providers from attempting to ascertain the identity of any consumer from the data.

Security Breaches of Your Information

We have built our CDR technology with secure protection of your information in mind. We follow best practices in keeping your data safe when you have shared it with us.

If a security breach occurs, we contain the data breach and take action to prevent any further leak of your personal information.

We will assess the breach and supporting facts to check the risk or potential harm to affected consumers. We will take action to reduce any risk of harm

We will notify consumers and the Commissioner if required. If the breach is defined as an eligible data breach under the Notifiable Data Breach scheme, we will notify the Commissioner.

Following stopping of the breach we will review the incident and take appropriate actions to prevent future breaches.

Your CDR Data and Third-parties

To assist us in providing your information and if applicable additional services by re-processing this information we may use services from other Australian based third parties.

We will only use third parties that have written agreements with us and are required to follow our terms and conditions. These include our obligations under the CDR and Privacy Act legislation and guidelines. However, your CDR Data is not shared with, or accessible by, any third-party providers of Yodlee.

Your information will not leave Australia without your consent, typically provided when you use a Yodlee-powered service hosted outside of Australia. In these cases we adhere to APEC Cross-Border Privacy Rules, for which we are independently certified. We will not transfer your CDR Data to any countries subject to sanctions by the United Nations Security Council, Australian autonomous sanctions regimes, or the United States Department of the Treasury.

Deletion of redundant data

We will only hold your information until:

• No longer required for the purpose we have advised it will be used or
• You request for it to be deleted

Redundant data will securely be deleted from our records and those of any held by third parties you had consented for us to share the information unless de-identified under the CDR de-identification process

If you do not agree with the information we hold or not satisfied in any way

If you do not agree with the information that we hold or are not satisfied in anyway, please tell us so we can make things right. We do not charge a fee for responding to or addressing a CDR complaint.

You may make a compliant by emailing us at [email protected].

In lodging a complaint, please provide the following information:

• Name/s the information is held
• Nature of the complaint for example consents, products, account details or Privacy breaches
• Details of the reason for the complaint for example consent revokation, inaccurate personal or account details.
• Supporting documentation or screen shots that may assist in our investigation and resolution of the complaint.
• Confirmation if you have also lodged the complaint with another Data Holder/Recipient For example unauthorised or revoked consents, accounts included or accuracy of the information
• Your preferred contact details including email and phone number.

Your complaint will be reviewed by our Data Protection and Customer Service teams and, if accepted, corrective action will be initiated.

If not accepted, or if your complaint is not resolved within 5 business days, you will receive an acknowledgement letter/email which will provide you with a case number for your complaint.

We will further investigate your complaint and attempt to provide you with a written response to resolve the complaint, within thirty (30) calendar days of receipt of your complaint.

If your complaint remains unresolved after thirty (30) calendar days, you will be advised in writing that additional time is required to complete the investigation and provide a response will contact you via phone, email or letter to notify you of the outcome of your complaint.

Outcomes of the resolution of your complaint may include:

• Correction of the CDR Data.

Where we receive corrected data after a data holder complies with your request to correct and disclose corrected data, we will notify you of collection of that data

• That we may consider that it is not appropriate to make any correction or qualifying statement at all, because (for instance) the CDR data as it exists is accurate, up to date, complete and not misleading, for the purpose it is held.

In such circumstances, we will give you a notice detailing the reasons why we consider that no correction or statement was necessary or appropriate and setting out the available complaint mechanisms

• Qualify the data by including a statement with it and
• Provide you with a notice setting out our response and what further compliant mechanisms are available.

We aim to resolve any complaints in a timely manner, but this may take up to 45 days. If you are not satisfied with the response, you may lodge a complaint with the Australian Financial Complaints Authority.

Online: www.afca.org.au

Email: [email protected]

Phone:1800 931 678

Mail:Australia Financial Complaints Authority, GPO Box 3, Melbourne, VIC 3001