Privacy policy

The CommBank Group provides a wide range of banking and financial services. This policy describes how your personal information is handled by the Group’s Australian members.

The Commonwealth Bank of Australia and its subsidiaries (the Group) provide banking, finance, insurance, funds management, financial planning and advice, superannuation, stockbroking and other services. The Group includes the CommSec, CommInsure, Commonwealth Financial Planning, Financial Wisdom, Bankwest and Colonial First State businesses. All of the Group’s Australian members must follow the Privacy Act and Australian Privacy Principles (APPs).

For more information about the Group, including a complete list of Group members, see CommBank’s latest Annual Report, available at commbank.com.au/shareholders.

Some of the Group’s Australian businesses have their own privacy policies — these are Aussie Home Loans and Residential Mortgage Group, Ausiex, Bankwest, CFS Global Asset Management and Commonwealth Bank Group Super. If you’re a customer of one of these businesses, please read their privacy policy. Website details can be found in Section 10.

In this policy, “we”, “us” or “our” means each Australian member of the Group, except the businesses that have their own privacy policy.

In addition to the Privacy Act, individuals located in the European Union (EU) may also have rights under EU based rules known as the General Data Protection Regulation (GDPR).  The GDPR has harmonised the data privacy laws of each individual EU country, giving more rights to individuals located in the EU and more obligations to organisations holding their personal information.

Details of additional rights of individuals located in the EU and how we meet them are outlined in Appendix 1.

We take privacy seriously and are committed to ensuring the protection of your personal information, no matter where you are located. 

Back to top

We protect your information, and aim to be clear and open about what we do with it. You can find more information in places like our application forms and terms and conditions.

We understand that your privacy is important to you, and we value your trust. That’s why we protect your information and aim to be clear and open about what we do with it. This policy explains how we handle your personal information. It also includes:

• Our policy on the handling of credit reports and other credit information
• Key information about credit reporting matters (see Section 6).

During your relationship with us, we may tell you more about how we handle your information— for example, when you fill in an application or claims form or receive terms and conditions.  You should always read these documents carefully.

Sometimes we update our privacy policy. You can always find the most up-to-date version on our websites.

Back to top

We collect information about you when you use our products or services, or deal with us. We may also collect information about you from other people and organisations.

Information we collect from you

We collect personal information about you when you contact us, use our products or services, visit our websites or use our mobile apps or deal with us in some other way. 

The information we collect from you may include:

• Information about your identity — including your name, address, date of birth, gender and marital status
• Your Tax File Number or tax residency status
• Health information — for example for insurance purposes 
• Financial and transaction information
• When you visit our websites or use our mobile apps — your location information, IP address, mobile device and network information, and any third-party sites you access. For more information about how we do this, visit commbank.com.au and click the Cookies link at the bottom of the page or visit commbank.com.au/app 
• Other personal information, such as details of your interactions with us.

Information we collect from others

We collect information about you from others, such as:

• Service providers
  
• Agents
  
• Advisers
  
• Brokers
  
• Employers
  
• Companies or bodies  that you own shares in or have an interest in
  
• Family members

For example, if you apply for credit, we may ask a credit reporting body for your credit report. If you apply for life, income protection or travel insurance, we might ask you or your doctor for your medical information. We may also collect information about you that is publicly available (for example, in public registers or on social media) or provided by businesses we deal with.

Sensitive information

The Privacy Act protects your sensitive information — such as information about your religion, ethnicity, health or biometrics (for example, your fingerprints). If we need this type of information, we’ll ask for your permission — except where otherwise allowed by law.

Back to top

We’re careful about how we use your information. We use it to deliver our products and services. We also use your information for other reasons, such as to better understand you and your needs, and to let you know about other products and services you might be interested in.

We collect, use and exchange your information so we can:

• Confirm your identity
  
• Assess your application for a product or service
  
• Design, manage, price and provide our products and services
  
• Manage our relationship with you
• Minimise risks and identify or investigate fraud and other illegal activities
  
• Contact you, for example, when we need to tell you something important
  
• Improve our service to you and your experience with us
  
• Comply with laws, and assist government or law enforcement agencies
  
• Manage our businesses.

We may also collect, use and exchange your information for other reasons where the law allows or requires us.

Bringing you new products and services

From time to time, we may also use your information to tell you about products or services we think you might be interested in. To do this, we may contact you by:

• Email
  
• Phone
  
• SMS
  
• Social media
  
• Advertising through our apps, websites, or third-party websites
  
• Mail

If you don’t want to receive direct marketing messages or want to change your contact preferences, log on to NetBank and click Message Preferences.

If you don’t use NetBank or want to know other ways to opt out — or if you’re a CommSec, Colonial First State, Financial Wisdom or Commonwealth Financial Planning customer — see Section 10 for how to opt out.

Using data to give you better customer service

We’re always working to improve our products and services and give you the best customer experience.

New technologies let us combine information we have about you and our other customers, for example transaction information, with data from other sources, such as third party websites or the Australian Bureau of Statistics. We analyse this data to learn more about you and other customers, and how to improve our products and services.

We sometimes use this combined data to help other businesses better understand their customers. When we do, we don’t pass on any personal information about you.

Back to top

We may share your information with other members of the CommBank Group. We may also share your information with others for the reasons mentioned in Section 4.

We may share your information with other members of the Group. This helps us offer you a high-quality customer experience. You can read about how Group members may use your information in Section 4.
We may also share your information with third parties for the reasons in Section 4 or where the law otherwise allows. These third parties can include:

• Service providers — for example, mortgage insurers, loyalty program partners and our product distributors
  
• Businesses who do some of our work for us — including direct marketing, statement production, debt recovery and IT support
  
• Brokers, agents, advisers and people who act on your behalf — such as your parent (if you are under 14), guardian, or a person with Power of Attorney
  
• Guarantors and other security providers
  
• Organisations involved in our funding arrangements — like loan purchasers, investors, advisers, researchers, trustees and rating agencies
  
• People who help us process claims — like assessors and investigators
  
• Other banks and financial institutions — for example, if we need to process a claim for a mistaken payment
  
• Auditors, insurers and re-insurers
  
• Current or previous employers  — for example, to confirm your employment
  
• Government and law enforcement agencies or regulators
  
• Credit reporting bodies and credit providers
  
• Organisations that help identify illegal activities and prevent fraud
  
• Other people (like cardholders) using the same account.

Sending information overseas

Sometimes, we may send your information overseas, including to:

• Overseas businesses that are part of the Group
  
• Service providers or third parties who store data or operate outside Australia
  
• Complete a transaction, such as an International Money Transfer
  
• Comply with laws, and assist government or law enforcement agencies

If we do this, we make sure there are arrangements in place to protect your information. You can find out which countries your information may be sent to at commbank.com.au/security-privacy/country-list.pdf. 

Back to top

If you ask us for credit, we may check your credit reports. We get these from credit reporting bodies. We also share your credit information with them so they can provide credit reports to others.

When you apply to us for credit or choose to be a guarantor, we may need to check your credit reports.

A credit report gives us information about your credit history. Credit reports are provided by credit reporting bodies, who collect and share credit information with credit providers like us, and other service businesses like phone companies.

The Privacy Act limits the information we can give to credit reporting bodies, and that they can give us. The Act also limits how we can use credit reports.

The information we can share with credit reporting bodies includes:

• Your identity
  
• Type and amount of credit you have — like credit cards, home loans, or personal loans
  
• How much you’ve borrowed
  
• If you’ve made all your repayments
  
• If you’ve committed fraud or another serious credit infringement.

Credit reporting bodies include this information in their reports to assist other credit providers to assess your credit worthiness.

We can also ask credit reporting bodies to give us your overall credit score, and may use credit information from credit reporting bodies together with other information to arrive at our own scoring of your ability to manage credit.

The credit reporting bodies we use are Equifax Pty Ltd, Experian Australia Credit Services Pty Ltd and Illion Australia Pty Ltd. You can download a copy of their privacy policies at:

• www.equifax.com.au/privacy
• experian.com.au/legal/privacy.html
  
• www.illion.com.au/privacy-policy

What do we do with credit information?

We use information from credit reporting bodies to:

• Confirm your identity
  
• Assess your credit applications
  
• Assess your ability to manage credit
  
• Manage our relationship with you
  
• Collect overdue payments

We keep your credit information with your other information. You can view this information or ask us to correct it if it’s wrong (see Section 8) or make a complaint to us (see Section 9).

Other rights you have

Direct Marketing — Credit providers like us can ask credit reporting bodies to use your credit information to pre-screen you for direct marketing purposes, but you can tell credit reporting bodies not to (see Section 10).

Preventing identity fraud — If you think you have been or could be a victim of fraud — for example, if someone else may be using your name to apply for credit — you can ask the credit reporting body not to use or give anyone your credit information.

Back to top

Our staff are trained in how to keep your information safe and secure. We use secure systems and buildings to hold your information. We aim to only keep your information for as long as we need it.

We store your hard copy and electronic records in secure buildings and systems, or using trusted third parties. Here are some of the things we do to protect your information.

Staff training

• We train our staff in how to keep your information safe and secure.

Secure handling and storage

• When we send information overseas or use third parties that handle or store data, we put arrangements in place to protect your information.
  

System security

• When you log into our websites or apps, we encrypt data sent from your computer to our systems so no one else can access it.
  
• We have firewalls, intrusion detection and virus scanning tools to stop viruses and unauthorised people accessing our systems.
  
• When we send your electronic data to other organisations, we use secure networks or encryption.
  
• We use passwords and/or smartcards to stop unauthorised people getting access.
  

Building security

• We use a mix of alarms, cameras, guards and other controls in our buildings to prevent unauthorised access.
  

Destroying or de-identifying data when no longer required

• We aim to keep personal information only for as long as we need it – for example for business or legal reasons. When we no longer need information, we take reasonable steps to destroy or de-identify it.
  

Back to top

You can contact us and ask to view your information. For more detailed information, you may need to fill out a request form. If your information isn’t correct or needs updating, let us know straight away.

Can you see what information we have?

You can ask us for a copy of your information, like your transaction history, by visiting a branch, going online or calling us. To get a copy of the credit information we have about you, you can visit a branch or call us.

For more detailed information, like what we’ve included in your loan file, you’ll need to fill out the Request for Access to Personal Information and Consumer Data Right (CDR) data form included at the end of this policy. Send it to us using the contact details in Section 10.

Is there a fee?

There is no fee to ask for your information, but sometimes we might charge an access fee to cover the time we spend finding and putting together the information you want. If there’s a fee, we’ll let you know how much it is likely to be, so you can choose if you want to go ahead. Generally, the fee is an hourly rate plus photocopying costs and other expenses. You’ll need to pay us before we start, or give us permission to take it out of your account.

How long will it take?

We try to make your information available within 30 days after you ask us for it. Before we give you the information, we’ll need to confirm your identity.

Can we refuse to give you access?

In some cases, we can refuse access or only give you access to certain information. For example, we might not let you see information that is commercially sensitive.  If we do this, we’ll write to you explaining our decision.

Updating your information

It’s important that we have your correct details, such as your current home and email addresses and phone number. You can check or update your information at any branch, or by logging in to one of our websites or calling us (see Section 10).

Can you correct or update your information?

You can ask us to correct or update any information we have (including credit information). See Section 10 for ways to contact us. If we’ve given the information to another party, you can ask us to let them know it’s incorrect. We won’t charge a fee for this.

If the incorrect information was given to us by a credit reporting body, we may need to check with them or the relevant credit provider before we can change it. We’ll try to do this within 30 days. If we can’t, we’ll let you know why it’s taking longer and agree on a new timeframe with you. We’ll also tell you when we’ve corrected the information.

What if we believe the information is correct?

If we don’t think the information needs correcting, we’ll write to let you know why. You can ask us to include a statement with the information that says you believe it’s inaccurate, incomplete, misleading or out of date.

Back to top

If you have a concern or complaint about your privacy, let us know and we’ll try to fix it. If you’re not satisfied with how we handle your complaint, there are other things you can do.

How can you make a complaint?

We try to get things right the first time —but if we don’t, we’ll do what we can to fix it. If you are concerned about your privacy (including credit information), you can make a complaint and we’ll do our best to sort it out.

To make a complaint, contact one of our staff or customer service teams. We’ll look into the issue and try to fix it straight away. If you’re not satisfied, you can call our Customer Relations team. See Section 10 for contact details.

How do we manage complaints?

We will:

• Keep a record of your complaint
  
• Give you a reference number, along with a staff member’s name and contact details if you want to follow it up
  
• Respond to the complaint within a few days if we can, or tell you if we need more time to look into it
  
• Keep you updated on what we’re doing to fix the problem
  
• Give our final response within 45 days (or 90 days for superannuation complaints). If we can’t give you a response in this time, we’ll get in touch to tell you why and work out a new timeframe with you

Credit information complaints

If your complaint is about your credit information, we may need to check with credit reporting bodies or the credit provider involved. We’ll let you know we’ve received your complaint within seven days. If we can’t sort it out within 30 days, we’ll get in touch to tell you why and work out a new timeframe with you.

What else can you do?

If you’re not satisfied with how we manage your complaint or our decision after you’ve been through our internal complaints process, the Australian Financial Complaints Authority (AFCA) offers a free independent dispute resolution service for consumer and small business complaints. You can contact AFCA between 9am and 5pm (Sydney time) Monday to Friday.

The Australian Financial Complaints Authority (AFCA) can consider most complaints involving financial services providers. 

If your complaint is about how we handle your personal information, you can also contact the Office of the Australian Information Commissioner.

Australian Financial Complaints Authority
GPO Box 3
Melbourne VIC 3001
Phone 1800 931 678 (free call)
Visit afca.org.au

Office of the Australian Information Commissioner
GPO Box 5218
Sydney NSW 2001
Phone 1300 363 992
Visit oaic.gov.au 

Back to top

If you want to update your personal information, or if you have a privacy concern, need more information, or want to update your preferences - help is just a phone call or a few clicks away.

To ask a question, access your personal information, make a correction or a complaint, or get a printed version of this policy, contact us.

If you’re deaf or hard of hearing, or have difficulty speaking:

National Relay Service

• TTY/Voice: 133 677
• SSR: 1300 555 727
• Visit relayservice.gov.au

If you’ve raised your concern with one of our staff and aren’t satisfied:

Complaints

• Phone: 1800 805 605
  or +61 2 9687 0756 from overseas
  8.30am–6pm (AEST) Monday to Friday
• Fax: 1800 028 542
  or +61 2 9841 7700 from overseas
• Visit commbank.com.au/feedback
• Write to us:
  
  CBA Group Customer Relations
  Reply Paid 41
  Sydney NSW 2001

To update your preferences about how we contact you or ask not to receive direct marketing:

If you use NetBank

• Log on to netbank.com.au, click More from the main menu and choose Message Preferences

If you don’t use NetBank

• Call us on 13 2221
• Drop into any branch

If you’re a customer of CommSec, Colonial First State, Financial Wisdom or Commonwealth Financial Planning:

Call:

• CommSec - 13 1519
• Colonial First State - 13 1336

For Financial Wisdom, or Commonwealth Financial Planning, contact your adviser directly

For more information about the Australian Privacy Principles and credit reporting rules:

The Office of the Australian Information Commissioner

• Visit oaic.gov.au

Australian Retail Credit Association (credit reporting rules only)

• Visit arca.asn.au

If you’re a customer of the following, each business has their own privacy policy, and processes for handling access and correction requests, complaints and marketing opt-outs.

You can find their privacy policies on their respective websites:

• Aussie Home Loans or Residential Mortgage Group
• Ausiex
• Bankwest
• CFS Global Asset Management
• Commonwealth Bank Group Super

If you are an EU resident and have an enquiry relating to your rights under the GDPR

• myprivacyrequest@cba.com.au

Request for Access to Personal Information and Consumer Data Right (CDR) data form

Back to top