Lorem Ipsum Dolor Sit.

Introduction

This policy describes your rights under the Consumer Data Rights (CDR) legislation (the Competition and Consumer Act 2010 and the Competition and Consumer (Consumer Data Rights) 2020 (CDR Rules). This Policy applies to Australian consumers, or account holders of Australian financial institutions consenting to the provision of their CDR Data.

Scope

The CDR Rules enables you, the consumer, to authorise the sharing of information held about you and your accounts (referred to as CDR Data) by your Accredited Data Holders (such as your financial institutions) with other CDR accredited financial institutions and third parties, such as Yodlee. Open Banking is the term used to describe the implementation of the CDR Rules in the banking sector.

Yodlee’s CDR Rules Policy (CDR Policy) describes your rights to access your CDR Data and to authorise the release and use of your CDR Data by Yodlee.

This CDR Policy also describes how we handle your CDR Data as well as how we address your inquiries, requests and complaints.

A copy of this CDR Policy is available electronically or in hard copy. Please email [email protected] to request a copy.

Information that you may share with us

The information that you may share with Yodlee includes:

• Information About You: Your name, occupation and contact details (physical, email, phone numbers). If you are a business, information about your business may be shared as well.
• Products You Use
  • The types of banking and other financial products (i.e. accounts) you have and their features, such as interest rates and fees.
  • Account balances and details of account transactions, including deposits, debits, payments and fees
  • Payee details

Our Commitment to Data Minimisation

We will only collect your information that is necessary to fulfill the use case to which you provided your consent. For example, if you are consenting access to share your CDR Data for a spending analysis and budgeting application, we will only obtain your accounts and transaction data and defer from obtaining your personal information.

Additionally, we will limit the data collection frequency and duration of access based on the use case. For example, if you are consenting to share your CDR Data for a one-time Bank Account verification, we will only access your data immediately at the time when you granted consent.

Managing Your Data

We will provide you the ability to securely manage your CDR Data within our application. You will be able to:

• Initiate, change, maintain or withdraw CDR Data request authorisation consents
• Maintain, modify or revoke CDR Data consents
• View which products and accounts to be shared
• See the expiry date of current consents
• Review a summary of data retrieved from nominated Accredited Data Holders
• Confirm with whom your information is being shared and for what purposes
• Confirm who has authorised and who will be able to access your information we have received

Roles we carry out under the CDR Rules

Being a Consumer Data Right accredited business, we may provide multiple services and hold different roles in the use of your information under the CDR:

Data Recipient

We are a Data Recipient when we request and receive your (the consumer’s) CDR Data from a Data Holder on your behalf (and with your consent) to provide you with a Yodlee product or service.

Where Yodlee is providing services requested by a consumer to collect the consumer’s CDR Data from a Data Holder and provide the CDR Data to a Trusted Advisor (TA), the Yodlee services are dependent on the consumer nominating the trusted advisor and providing a TA disclosure consent.

Where Yodlee is providing services requested by a business consumer to collect the business consumer's CDR Data from a Data Holder and provide the CDR Data to a registered business, the Yodlee services are dependent on the business consumer nominating the registered business and providing a business consumer disclosure consent.

Where Yodlee is providing services requested by a consumer to collect CDR Data from a Data Holder and provide the Insights to a 3rd party for one of the following purposes: to identify the consumer, to verify the consumer's account balance, or to verify the consumer's income or expenses, the Yodlee services are dependent on the consumer to provide a CDR compliant Insight Disclosure Consent for the specific purpose.

Outsourced Service Provider

We are an Accredited Outsourced Service Provider when we provide services to an Accredited Data Recipient to whom you have provided consent to obtain your information from an Accredited Data Holder. We will collect the data from the Data Holder on behalf of the Accredited Data Recipient, passing it on to them in its original state and retaining it only per their instructions and your consent requirements.

CDR Principal

We act as a CDR Principal when we pass your CDR data to another Data Recipient who is reliant on our Accredited Data Recipient license as a CDR Representative. We register CDR Representative Data Recipients with the Australian Competition and Consumer Commission (ACCC) after undergoing a strict review process following ACCC Guidelines.

For a list of Yodlee CDR Representatives, please visit https://www.cdr.gov.au/find-a-provider?provider=ADRBNK000061. Yodlee CDR Representatives are also included in a table at the end of this policy. The ACCC review and approval guidelines for CDR Representatives are located at https://www.cdr.gov.au/sites/default/files/2022-02/CDR-representative-FAQs-pubished-10-Feb-2022.pdf.

In all cases, we will obtain your consent before we carry out any of the above roles in relation to your information under the Consumer Data Right. You may revoke your consent at any time.

How do you request the sharing of your information?

You may provide consent to sharing of your information held by a Data Holder from within our application. When we receive your consent to share the data held by a Data Holder, we will securely send the request(s) to the entities holding your information for authentication, authorisation and subsequent provision of the information.

You may make modifications or revoke consent through our application, or by advising us in writing. Additionally, you may also revoke consent directly at the Data Holder financial institution from whom you shared your CDR Data.

How does it work?

• Having given us consent through our CDR accredited application that is available directly, or via our partners in an Outsourced Service Provider or CDR Principal model, we collect your information from a Data Holder/s where we will send the request to the Data Holder/s via the API gateway using the registered certificate/token.
• In addition to the information the Data Holder may request an additional form of authentication of you such as via a one-time password or confirmation sent to you via their mobile phone app, your internet banking account, or email address that will have been registered with them.
• The Data holder may remind you that your information is being collected by us as an Accredited Data Recipient, and to confirm which accounts, you would like to share with us and our partners.
• You will be asked for the Data Holder to authorise us to receive your CDR data for one time use or a finite period of time.
• When the Data Holder/s have confirmed your authentication and authorisation to share your information, we will receive your CDR Data and use it as you have consented. We may also receive, with your consent, a token to refresh your information to provide you with services on an ongoing basis.
• When you are a consumer of one of our Accredited Data Recipient or CDR Representative partners, your CDR data will be securely passed to the Data Recipient to provide the service for which the CDR Data is required.

If you encounter issues with Data holder authentication or authorisation, you should initially contact your Data Holder.

Use of the information you consent to share with Yodlee

We only collect information on your behalf that we need to provide you with services for our clients, who are either Accredited Data Recipients using Yodlee as an Outsourced Service provider, or CDR Representatives utilising our ADR license. For testing purposes, Yodlee also operates multiple direct Data Recipient application called Money by Envestnet | Yodlee (https://money.yodlee.com.au/pfm3/home).

We will advise you of how we will use your information and obtain your consent authorisation to do so.

Data shared with third party Yodlee Client Data Recipients

When we share your information with third parties in the Outsourced Service Provider and CDR Principal models, we will tell you whom they are, for what purposes your information will be used and obtain your prior consent.

Examples of the use of your information may include:

• Providing you with budgeting and savings tools and product information
• Analysis and tips to save on the bills you pay.
• Automatic reminders or actual payment of your bills.
• Collection of your income and expenses for credit applications
• Verification of your account information for identity checking

Purposes for Yodlee to hold your CDR Data

We hold your CDR data as a service to our Accredited Data Recipient and CDR Representative clients. Purposes for holding and disclosing your data may include:

• Storage of CDR data for access through our API interface for presentation to you through our third party partner
• Managing data quality by ensuring there are no duplicated or missing financial accounts or transactions during ongoing CDR Access
• Managing ongoing CDR Access including data refresh scheduling, Data holder access load balancing and optimisation, and access error handling.
• Providing a CDR compliant User Interface for you as the consumer to select your Data Holder, provide your consent, and manage your ongoing access if applicable
• Providing value added services by improving the data quality of your CDR data financial transactions including identifying your merchant and identifying the spending category for your financial transactions
• Providing value added APIs to your Data Recipient service including spending and cash flow analysis.

We will not sell your CDR Data.

For more details about our general privacy data handling practices, please refer to our general Privacy Notice.

Notification Events

As a consumer of a Yodlee Partner Data Recipient, you are a registered user of that service. Our Accredited Data Recipient or CDR Representative partner will notify you about key events pertaining to your CDR data including:

• Initial granting of consent to collect, use and/or disclose data
• Amendment or withdrawal of consent
• Initial collection of CDR Data
• Ongoing consent access (every 90 days)
• Consent expirations

If you are a user of Money by Envestnet | Yodlee, Yodlee will send these notifications to you directly.

Your control of the sharing of your information

We only use your CDR Data as necessary to provide you with the services you have selected, and for which you have consented. We will only retain your CDR Data for as long as is necessary to provide you with the services you have selected, or as required by Australian laws and regulations.

We provide the ability to a securely view, modify and revoke the consent you have provided to share your information with us. You can access it at any time via our application.

When you change or stop consent to share your information

If you change or revoke your consent authorisation, we will delete your corresponding data and require anyone to whom we have shared the information to do the same. There are no penalties for withdrawal of consent by consumers. If you revoke your consent, then our ability to support our clients to provide their services to you may be limited.

You will not be able to revoke your consent and require us to delete your data that we are required to retain under Australian laws, regulations, a court/tribunal order, or where it relates to any or anticipated:

• Legal proceedings
• Dispute resolution proceedings to which we are a party.

Protection of the information you share

Protecting the personal information of those who use Yodlee, and our customers’ products and services is a top priority. We incorporate the same principles of good faith and integrity that guide our fiduciary obligations to investment advisor clients when acting as responsible stewards of the financial data fueling Envestnet | Yodlee’s products and services.

We protect the information that you share and, along with our aggregation clients, comply with all applicable laws and regulations.

Specifically, we protect the information you share from unauthorised access or use under the requirements of the Consumer Data Right legislation, the Australian Privacy Safeguards and as appropriate the Australian Privacy Principles of the Australian Privacy Act (1988).

Here is a link that provides details of the OAIC Consumer Data Right Privacy guidelines that we adhere: https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines

Additionally, we employ proprietary and third-party technical controls, such as encryption, to protect data while it resides on our systems, and further ensure the protection of consumer anonymity. We have built privacy protection into our enabling technology, business processes, and operational procedures.

Security Breaches of Your Information

We have built our CDR technology with secure protection of your information in mind. We follow best practices in keeping your data safe when you have shared it with us.

If a security breach occurs, we contain the data breach and take action to prevent any further leak of your personal information.

We will assess the breach and supporting facts to check the risk or potential harm to affected consumers. We will take action to reduce any risk of harm.

We will notify consumers, the Information Commissioner and the Australian Cyber Security Center (ACSC) if required. If the breach is defined as an eligible data breach under the Notifiable Data Breach scheme, we will notify the Commissioner and the Australian Cyber Security Center (ACSC) no later than 30 days after becoming aware of the incident.

After stopping of the breach, we will review the incident and take appropriate actions to prevent future breaches.

Your CDR Data and Third parties

We have written legal agreements with all third parties that have access to your CDR data. Each of our third-party partners are required to follow our terms and conditions, which include our obligations under CDR and Privacy Act legislation and guidelines. This includes all Accredited Data Recipients using Yodlee Services in the Outsourced Service provider model, as well as our Data Recipient Partners leveraging our Accreditation in the CDR Principal model.

Yodlee leverages a third-party vendor for customer and production support called Tata Consultancy Services (TCS). TCS employees are in India. Yodlee provides our clients with a servicing capability called MyYodlee, which allows their Customer Service Representatives to log service requests (SRs) on your behalf. Members of TCS Client Services will process SRs, which may involve accessing your CDR data through the MyYodlee interface.

Envestnet | Yodlee is a global company servicing clients in Australia, New Zealand, United States, Canada, South Africa. India and the UK. We operate Data Centers in Australia, United States, and Canada, and your CDR data could be stored in any one of these data centers. The location of your CDR data has been included in our Representative Clients list at the end of this document.

Deletion of Redundant Data

We will only hold your CDR Data until:

• Your data is no longer required for the purpose we have advised it will be used or
• You request for it to be deleted

Redundant data will be securely deleted from our records and those of any held by third parties you had consented for us to share the information.

How we delete redundant data

There are several triggers for deleting redundant data including:

• You request to revoke consent in the Yodlee manage accounts service
• You request for account or Data Holder deletion through your Data Recipient application
• You un-register from your Data Recipient application
• Your Data Holder access expires
• Your Data Recipient terminates services with Yodlee

When any of the above events occurs, your CDR data is marked for deletion in the Yodlee database. Once marked for deletion, your CDR data cannot be viewed through our API services by you, or by our Data Recipient Partners. Subsequently, a batch job runs to remove your CDR Data permanently from our Database. When we delete your data from our database, we also remove backup copies used for redundancy.

We will not delete your CDR Data if we are required to continue holding the CDR Data to comply with any Australian laws, regulations, or a court/tribunal order

If you do not agree with the information we hold, or not satisfied in any way

Your primary point of access to your CDR Data will be through your Data Recipient application. If you need to view or manage your consent, your Data Recipient application will have a link to the Yodlee provided Manage consent screen where you can view your CDR accounts and renew or revoke access.

If you have an issue with your CDR data as presented by the Data Recipient to whom you permissioned access, you can log a service request directly with that service provider. As a Yodlee partner, their Customer Service representatives will log Service Requests with Yodlee if we are required for further research into any data issues that you encounter.

Internal Dispute Resolution Process

If you do not agree with the information that we hold or are not satisfied in anyway, please tell us so we can make things right.

You may make a complaint through our Privacy Access Request Portal at https://www.yodlee.com/yodlee-privacy-access-request-portal.

In lodging a complaint, please provide the following information:

• Name/s of the information owner
• Nature of the complaint including example consents, products, account details or Privacy breaches
• Details of the reason for the complaint including consent revocation, inaccurate personal or account details.
• Supporting documentation or screen shots that may assist in our investigation and resolution of the complaint.
• Confirmation if you have also lodged the complaint with another Data Holder/Recipient For example unauthorised or revoked consents, accounts included or accuracy of the information
• Your preferred contact details including email and phone number.

Our Information Security and Customer Service teams will review your complaint and if accepted, will initiate corrective action.

If not accepted, or if your complaint is not resolved within five business days, you will receive an acknowledgement email, which will include a case number for your complaint.

We will further investigate your complaint and attempt to provide you with a written response to resolve the complaint within thirty calendar days of receipt of your complaint.

If your complaint remains unresolved after thirty calendar days, you will be advised in writing that additional time is required to complete the investigation and provide a response will contact you via phone, email, or letter to notify you of the outcome of your complaint.

Outcomes of the resolution of your complaint may include:

• Correction of the CDR Data.
• Where we receive corrected data after a data holder complies with your request to correct and disclose corrected data, we will notify you of collection of that data.
• That we may consider that it is not appropriate to make any correction or qualifying statement at all, because (for instance) the CDR Data as it exists is accurate, up to date, complete and not misleading, for the purpose it is held. In such circumstances, we will give you a notice detailing the reasons why we consider that no correction or statement was necessary or appropriate and setting out the available complaint mechanisms.
• Qualify the data by including a statement with it and provide you with a notice setting out our response and what further compliant mechanisms are available.
• That we decide to delete your CDR data
• That we issue and apology to you for your difficulty with our service

External Dispute Resolution Process

We aim to resolve any complaints in a timely manner, but this may take up to 45 days. If you are not satisfied with the response, you may lodge a complaint with the Australian Financial Complaints Authority.

Online: www.afca.org.au

Email: [email protected]

Phone: 1800 931 678

Mail: Australia Financial Complaints Authority, GPO Box 3, Melbourne, VIC 3001

Additionally, you may request for an internal review of our process by contacting [email protected] or by directly contacting the Office of the Australian Information Commissioner at https://www.oaic.gov.au/privacy/privacy-complaints.

Representative Clients