1. Negroni Commitment to Privacy

Negroni Software Pty Limited (ACN 684 466 804) (Negroni) is committed to protecting the privacy of the Personal Information we collect and hold about you.

Negroni operates the website at www.negronisoftware.com (Website) and its cloud-based loan management software platform (Platform).

This Privacy Policy explains how we collect, hold, use, disclose, secure and dispose of your Personal Information.

We handle personal information in accordance with the Privacy Act 1988 (Cth) (Privacy Act), including the Australian Privacy Principles (APPs). Where we handle credit information or credit eligibility information, we also comply with Part IIIA of the Privacy Act and the Privacy (Credit Reporting) Code.

This Privacy Policy applies to:

a. our Clients who access and use our Platform;

b. users who access our Website; and

c. individuals and/or entities whose information is collected, stored, or processed through the Platform on behalf of a Client.

By using our Website, our Platform or otherwise providing your information to us, you acknowledge that we will handle your personal information in the manner described in this Privacy Policy.

2. Scope

Given the nature of our Platform and Website, we process the following categories of information:

a. Website User Information

Users of our Website seeking further information about our services may elect to provide Personal Information through our enquiry form.

b. Client Information

Personal Information provided by our Clients in connection with establishing, administrating, and managing their accounts with us for the use of our Platform, including organisation details, billing information, account administration records, and authorised user information.

c. Client Data

Personal information and credit information relating to borrowers, guarantors, applicants, or other individuals whose information is entered into, stored within, or processed by the Platform by our Clients as part of their loan origination, assessment, administration, servicing, and collection activities.

3. Our Privacy Role

In relation to Client Data, Negroni generally acts as a service provider or data processor on behalf of our Clients.

Our Clients determine the purposes for which Client Data is collected and used and remain primarily responsible for compliance with applicable privacy and credit reporting laws, including the APPs, providing privacy collection notices, and where applicable, credit reporting disclosures and consents.

If you are an investor, borrower, guarantor, applicant, or other individual whose information has been provided to us by one of our Clients, any questions regarding collection, use, disclosure, correction, or handling of your Personal Information should be directed to the relevant Client in the first instance.

4. What information does Negroni collect about you?

a. Website User Information

Negroni may collect the following Personal Information from users of the Website:

i. Name;

ii. Email address and telephone number;

iii. Company name;

iv. Marketing and communication preferences; and

v. IP address and technical usage data (collected via cookies).

b. Account and Client Personal Information

Negroni may collect the following Personal Information from our Clients and their personnel:

i. Name, job title and business contact details;

ii. Business email address and telephone number;

iii. Company name, ABN/ACN, business address and billing information;

iv. Account, login and authentication details, including usernames, securely hashed credentials, single sign-on identifiers and multi-factor authentication information;

v. Records of interactions and communications with us, including support requests, correspondence and service enquiries;

vi. Marketing and communication preferences; and

vii. Information obtained from third parties and publicly available sources, including employers, business contact databases, referrers and our Clients, where relevant.

c. Client Data Processed on Behalf of Clients

When our Clients use the Platform to originate, manage and administer loans, they may input, upload, or generate Personal Information relating to their investors, customers, borrowers, guarantors and loan applicants (Client Data).

Depending on how our Clients configure and use the Platform, Client Data may include:

i. Identity and contact information, including name, date of birth, address, contact details and identification documents collected for KYC/AML purposes;

ii. Financial and employment information, including income, assets, liabilities, bank account details and employment history;

iii. Loan and account information, including application details, loan terms, underwriting assessments, security or collateral information, disbursement records and repayment schedules;

iv. Identity verification information (we do not adopt government-related identifiers as our own identifiers and will use or disclose them only where permitted by APP 9 or another applicable law);

v. Documents uploaded for verification, assessment or underwriting purposes; and

vi. Communications, notes and records maintained within the Platform.

We do not use Client Data for our own purposes, and we do not sell it. Our handling of Client Data is governed by our agreement with the relevant Client.

d. Sensitive Information

We do not collect Sensitive Information via our Website or Platform.

e. Platform Data

From time to time the Platform generates and we may collect data such as logs, audit trails, timestamps, access records, workflow actions, device/browser data, IP addresses, API and integration records and AI prompts and outputs where applicable.

5. How does Negroni collect information?

Negroni generally collects Personal Information directly from you where it is reasonable and practicable to do so.

We may collect and update your Personal Information in a variety of ways, including by telephone, email, through our Website and social media channels, through our Platform, or in person.

We collect Personal Information when you:

a. submit enquires, request information, book a product demonstration, or commence onboarding;

b. register for, access, or use an account on our Platform;

c. contact us for support or otherwise communicate with us;

d. use our website, Platform, or related services; and

e. interact with cookies, analytics tools and similar technologies (see Section 12).

We may also collect from Personal Information from third parties and other sources, including:

f. our Clients and their authorised representatives;

g. your employer or organisation;

h. our affiliated and related companies;

i. third-party service providers, suppliers, contractors, and integration partners who assist us in operating our business and providing our services;

j. referrers and publicly available sources; and

k. any other sources that you have authorised or that are permitted by law.

Where we collect personal information from third parties and other sources, we take reasonable steps, at or before collection or, if that is not practicable, as soon as practicable afterwards, to notify you or otherwise ensure you are aware of the relevant matters required by APP 5, including:

l. our identity and contact details, and the fact and circumstances of collection, including the source of the information;

m. the purposes of collection, whether collection is required or authorised by an Australian law or court or tribunal order and details of that law or order, where applicable, and the main consequences if the information is not collected;

n. the persons or organisations to which we usually disclose information of that kind, whether overseas disclosures are likely and, where practicable, the relevant countries; and

o. how to access this Privacy Policy, which explains how you may request access to or correction of your personal information, make a privacy complaint and how we handle complaints.

Client Data is collected by our Clients during the course of their business and provided to us via the Platform.

We may arrange for the relevant Client or other person supplying the information to provide this notification on our behalf. Where we do so, we take reasonable steps to ensure that the notification is provided.

6. Why does Negroni collect, hold, use and disclose information?

Negroni collects, holds, uses and discloses Personal Information where reasonably necessary to operate the Platform, provide and improve our products and services, manage customer relationships, and comply with our legal and regulatory obligations.

Depending on the nature of your interaction with us, we may use Personal Information to:

a. Provide, operate, maintain, support and secure our Platform, Website, products and services;

b. Authenticate users, administer accounts, and manage access to our services;

c. Process loan calculations, repayment schedules, reporting and other services as instructed by our Clients;

d. Communicate with users regarding service updates, support requests, enquiries and account administration;

e. Process billing, invoicing, payments and other administrative functions;

f. Detect, investigate, prevent and respond to fraud, security incidents, misuse and other unlawful activity;

g. Comply with applicable legal, regulatory and professional obligations, including Anti-Money Laundering and Counter-Terrorism Financing (AML/CTF), taxation, financial record-keeping and other compliance requirements;

h. Conduct analytics, research and product development using aggregated or de-identified information where practicable;

i. Inform Clients and users about our products, services, events and activities, and send administrative, service-related and, where permitted by law or with consent, marketing communications;

j. Respond to enquiries, requests, feedback and complaints; and

k. Manage contracts, business relationships and other operational activities.

If we are unable to collect Personal Information that is reasonably necessary for these purposes, we may be unable to provide our products or services, administer your account, respond to your enquiries, or otherwise engage effectively with you or your organisation.

7. Disclosure of Personal Information

We may use and disclose Personal Information to provide and improve our services, administer our business, comply with legal obligations, and protect our legitimate interests. This may include disclosure to:

a. Cloud hosting, infrastructure, CRM, analytics, communication, payment, billing, identity verification, fraud prevention, and other technology service providers;

b. Contractors, suppliers, and integration partners engaged to support our services;

c. Our related bodies corporate and affiliated entities;

d. Professional advisers, including legal, accounting, audit, insurance, financial, and IT advisers;

e. Government agencies, regulators, law enforcement bodies, and courts where required or authorised by law;

f. A purchaser, investor, or prospective purchaser in connection with a proposed or actual merger, acquisition, financing, restructure, or sale of business assets; and

g. Any other person with your consent or as otherwise permitted by law.

We require third parties who handle Personal Information on our behalf to protect it in accordance with applicable privacy laws and to use it only for authorised purposes.

8. Overseas Disclosure of Personal Information

Some of our service providers, related entities, or business partners may be located, or may store or process Personal Information, outside Australia. This may include cloud hosting and other technology service providers.

A current list of the overseas countries in which we, our related entities, or key service providers store Personal Information are as follows:

a. Singapore.

Where we disclose Personal Information to overseas recipients, we take reasonable steps to ensure it is handled in a manner substantially consistent with the APPs, including through contractual data protection and confidentiality obligations.

Unless an exception under the Privacy Act applies, we will only disclose Personal Information overseas where appropriate safeguards are in place. A current list of the overseas countries in which we, our related entities, or key service providers disclose Personal Information are as follows:

a. Singapore.

9. Direct marketing

Negroni may use your Personal Information to provide you with information about our products and services, upcoming events, promotions, updates, and other opportunities that we believe may be of interest to you. We may also disclose your Personal Information to trusted service providers who assist us in delivering these communications on our behalf.

We will only send direct marketing communications where you have consented to receive them or where otherwise permitted under applicable laws, including the Privacy Act and the Spam Act 2003 (Cth).

You can opt out of receiving marketing communications from us at any time by using the unsubscribe facility included in our electronic communications or by contacting us using the details set out in section 20. We will process your request promptly.

Please note that if you opt out of marketing communications, we may still contact you regarding our ongoing relationship with you, including administrative, service-related, transactional, or other non-marketing communications.

We do not use Client Data for our own direct marketing purposes.

10. CreditorWatch Reports

Our Platform integrates with CreditorWatch to provide ASIC Extract, Credit Report Extract, Credit Score and Custom Credit Profile services of non-individual entities. Upon our Clients’ request, we may send CreditorWatch the identifiers required for a requested search, such as a business name, Australian Business Number (ABN), Australian Company Number (ACN).

The CreditorWatch reports supplied through this integration are commercial reports. We do not obtain individual consumer credit reports through this integration. Commercial reports may nevertheless contain Personal Information about directors, shareholders, sole traders or other individuals associated with a business, and we handle that information under this policy and applicable privacy law.

Any reports produced by CreditorWatch are made available to the relevant Client only. We do not use this information for any other purpose.

11. Consumer Data Right

a. Our Role

The Consumer Data Right (CDR) allows eligible consumers to authorise accredited businesses to collect specified data (CDR Data) from participating data holders. We use Fiskil, an accredited partner, to facilitate authorised data sharing.

Under our arrangement with Fiskil, Negroni receives data as a specified non-accredited recipient under a business consumer disclosure consent under rule 1.10A(11) of the Competition and Consumer (Consumer Data Right) Rules 2020. Negroni is not an accredited data recipient, CDR representative or outsourced service provider under this arrangement. Our accredited partner maintains and publishes the CDR policy governing its collection, handling and disclosure of the CDR data.

b. Use and Handling of CDR Data

Negroni handles the disclosed data in accordance with the applicable consent, privacy laws, our Privacy Policy, and our agreement with the accredited partner.

In handling data received via this pathway, Negroni:

i. uses the CDR data only for the purposes for which you have authorised disclosure to Negroni, and does not use it for any other purposes, including marketing or sale, without separate consent;

ii. will, where you revoke your consent with our accredited partner, act in accordance with Negroni’s agreement with that partner regarding data already received; and

iii. will, on request from you to delete your profile or data, remove the historical data received via this pathway from Negroni’s systems, consistent with Negroni’s obligations under this Privacy Policy and its agreement with the accredited partner.

12. How does Negroni interact with you online?

You may visit our Website without identifying yourself. If you choose to provide Personal Information, such as by submitting an enquiry, requesting information, creating an account, or otherwise interacting with us, any Personal Information you provide will be collected, used, stored, and disclosed in accordance with this Privacy Policy.

a. Cookies and Tracking Technologies

Our Website and applications may use cookies and similar technologies to support authentication, session management, website functionality, user preferences, security, analytics, and performance monitoring.

A cookie is a small file stored on your device or browser that helps websites recognise your browser and remember certain information. We may collect technical and usage information through cookies and similar technologies, including:

i. your device type and operating system;

ii. browser type and settings;

iii. IP address;

iv. pages viewed and features accessed on our website or application

v. referring websites; and

vi. usage patterns and interactions with our online services.

Unless combined with other information that identifies you, this information generally does not identify you personally. Information that does reasonably identify you will be treated as personal information.

We may also use third-party service providers, such as website analytics providers, to help us understand how our website and applications are used and how we can improve them. These providers may set and access their own cookies or similar technologies in accordance with their privacy policies.

You can control, restrict, or disable cookies through your browser settings. However, if you do so, some features, pages, or functionality of our website or applications may not operate properly.

b. Third-Party Websites

Our Website and Platform may contain links to third-party websites or services. We are not responsible for the privacy practices, content, or security of those third-party websites. We encourage you to review the privacy policies of any third-party websites you visit before providing your Personal Information.

13. Data Security

We take reasonable steps to protect Personal Information from misuse, interference, loss, and unauthorised access, modification or disclosure. Personal information is stored in secure electronic systems and databases operated by us or trusted service providers located in Australia and, where applicable, overseas.

Our security measures may include:

a. Encryption of Personal Information in transit and, where appropriate, at rest;

b. Role-based access controls and least-privilege access principles;

c. Multi-factor authentication and single sign-on (where applicable);

d. User authentication through unique identifiers and passwords;

e. Firewalls, network monitoring, logging, and other network security controls;

f. Regular security testing, system maintenance, and data backups;

g. Confidentiality obligations and privacy training for personnel; and

h. Incident detection, response, and recovery procedures.

While we take reasonable steps to safeguard Personal Information, no method of electronic transmission or storage is completely secure. Accordingly, we cannot guarantee absolute security.

14. Data Retention and Destruction

We retain Personal Information only for as long as necessary to fulfil the purposes for which it was collected, provide our services, comply with legal, regulatory, accounting and reporting obligations, and resolve disputes or enforce agreements.

Certain records, including those relating to lending, financial transactions, or regulatory compliance, may be retained for seven years or longer where required by law.

Where we hold Personal Information on behalf of a Client, the retention, return, or deletion of that information will be managed in accordance with our service agreement with the Client and applicable legal requirements.

When Personal Information is no longer required and we are not legally required to retain it, we take reasonable steps to securely destroy or permanently de-identify the information.

15. Data Breaches

We maintain procedures to detect, assess, investigate, and respond to suspected or actual data breaches.

If we become aware of an eligible data breach that is likely to result in serious harm to affected individuals, we will comply with our obligations under the Notifiable Data Breaches (NDB) scheme in Part IIIC of the Privacy Act.

We will take reasonable steps to notify affected individuals and the Office of the Australian Information Commissioner (OAIC), where required.

Where a data breach affects Personal Information that we process on behalf of a Client, we will notify the relevant Client within 30 calendar days and work with them in accordance with our contractual arrangements and applicable law to support any required assessment, notification, and remediation activities.

16. How can you access or seek correction of your Personal Information?

It is important that we hold accurate and up-to-date information about you.

You may request access to, or correction of, the Personal Information that Negroni holds about you by contacting us using the contact details provided below.

If you believe that any Personal Information we hold is inaccurate, out of date, incomplete, irrelevant or misleading, you may request that we correct it. We will take reasonable steps to consider and, where appropriate, correct the information within a reasonable period.

To protect your privacy, we may require you to verify your identity before processing an access or correction request.

There is no charge for making an access request or correction request. However, where permitted by law, we may charge a reasonable fee to cover the costs of providing access to your Personal Information. We will notify you of any applicable charges before proceeding with your request.

In some circumstances permitted by applicable privacy laws, including the APPs, we may refuse a request for access or correction. If we do so, we will provide written reasons for our decision and information about any available complaint mechanisms. Where a correction request is refused, we will also take any steps required by law, including associating a statement with the relevant information where appropriate.

If your request relates to Personal Information or Client Data that we hold on behalf of one of our Clients, we will record that request and provide reasonable assistance such as referring your request to that Client or directing you to contact them directly, as they are responsible for managing access and correction requests in relation to that information.

17. Can you deal with Negroni anonymously?

Where lawful and practicable, you may choose to deal with Negroni anonymously or by using a pseudonym, such as making a general enquiry. However, in many circumstances we need to identify you to provide our products or services, administer accounts, manage events, programs or activities, or comply with legal and regulatory obligations.

If you choose not to provide Personal Information when it is required, we may be unable to provide you with our services, process your request, or allow you to participate in our events, programs or activities. Consequently, it will generally not be practicable for us to deal with you anonymously or under a pseudonym on an ongoing basis.

18. Complaints

You may contact Negroni at any time if you have any questions or concerns about this Privacy Policy or about the way in which your Personal Information has been handled.

You may make a complaint about privacy to us at the contact details set out below.

We will first consider your complaint to determine whether there are simple or immediate steps which can be taken to resolve the complaint. We will generally respond to your complaint within 30 days.

If your complaint requires more detailed consideration or investigation, we will acknowledge receipt of your complaint within 30 days and endeavour to complete our investigation into your complaint promptly.

We may ask you to provide further information about your complaint and the outcome you are seeking. We will then typically gather relevant facts, locate and review relevant documents and speak with individuals involved.

In most cases, we will investigate and respond to a complaint within 30 days of receipt of the complaint. If the matter is more complex or our investigation may take longer, we will let you know.

If you are not satisfied with our response to your complaint, or you consider that Negroni may have breached the APPs or the Privacy Act, a complaint may be made to the OAIC. The OAIC can be contacted by telephone on 1300 363 992 or by using the contact details on the OAIC website.

19. How are changes made to this Privacy Policy?

Negroni may amend this Privacy Policy from time to time, without notice to you, by publishing it on our Website.

We recommend that you visit our Website regularly to keep up to date with any changes.

20. How to contact Negroni?

Attn: Negroni Software Pty Limited

Address: Suite 404, Level 4, 165 Phillip Street, Sydney NSW 2000

Email: info@negronisoftware.com

Telephone: 0488 072 385

21. Definitions

Accredited Data Recipient means an accredited data recipient under Part IVD of the Competition and Consumer Act 2010 (Cth).

APPs means the Australian Privacy Principles set out in Schedule 1 to the Privacy Act.

CDR Data has the meaning given in Part IVD of the Competition and Consumer Act 2010 (Cth).

CDR Rules means the Competition and Consumer (Consumer Data Right) Rules 2020 (Cth) as amended or replaced from time to time.

Client means the entity that has entered into a service agreement with Negroni to access and use the Platform.

Client Data means Personal Information and Credit-Related Information, relating to borrowers, guarantors, applicants, or other individuals whose information is entered into, stored within, or processed by the Platform by our Clients as part of their loan origination, assessment, administration, servicing, and collection activities.

Client Personal Information means information provided by or on behalf of Clients to establish, maintain, or manage their relationship and accounts with us for the use of the Platform, including organisation, billing, payment, account, contact, and authorised user information.

Credit Eligibility Information has the meaning given to it in section 6(1) of the Privacy Act.

Credit Information has the meaning given to it in section 6N of the Privacy Act.

CreditorWatch means the credit reporting body engaged to provide commercial Credit Information to the Platform via API integration.

Fiskil means the accredited open banking technology partner engaged to provide CDR Data to the Platform under the Consumer Data Right regime.

KYC/AML means the “know your customer” and anti-money laundering procedures and obligations applicable under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth).

Negroni means Negroni Software Pty Limited (ACN 684 466 804), its subsidiaries and affiliates in Australia.

OAIC means the Office of the Australian Information Commissioner.

Personal Information has the meaning given to it in section 6(1) of the Privacy Act and means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether or not the information or opinion is true and whether or not it is recorded in a material form.

Privacy Act means the Privacy Act 1988 (Cth).

Sensitive Information has the meaning given to it in section 6(1) of the Privacy Act and is a subset of Personal Information that is afforded a higher level of protection under the Privacy Act, including information such as health, biometric or similar information.

Platform means the end-to-end loan management software-as-a-service (SaaS) platform and related functionality made available by Negroni to the Client, together with any associated support, documentation, and updates from time to time.

Specified Person means a ‘specified person’ in accordance with a business consumer disclosure consent, as referred to in rule 1.10A(11) of the CDR Rules.

Website means www.negronisoftware.com.

This Privacy Policy was last updated on 16 October 2026.