Our Privacy Policy

Purposes of our collection of personal information

Export Finance Australia (we, us) is a statutory corporation established by the Export Finance and Insurance Corporation Act 1991 (Cth). We collect personal information that is reasonably necessary to perform our functions and activities including, consistent with our statutory functions:

• facilitating and encouraging Australian export trade and overseas infrastructure development;
• encouraging other financiers to support Australian export trade and overseas infrastructure development;
• providing information and advice about export and infrastructure finance products and opportunities;
• encouraging and facilitating various activities that support Australia’s economic resilience and security and the net zero transformation;
• engaging in, encouraging and facilitating eligible activities that secure, or are intended to secure, a supply of strategic materials in support of Australia’s national and economic security interests; and
• assisting certain other Commonwealth entities. 

Examples of how we use and disclose personal information include for:

• responding to your requests and enquiries;
• communicating with you during the course of your business or other relationship with us;
• responding to a complaint that you may make;
• developing and identifying products and services that may interest you;
• compliance with applicable laws;
• updating and maintaining our records;
• notifying you about important changes to, or development of, our functions, activities, services and website;
• managing your registration where we deliver webinars and other similar content to you;
• conducting direct marketing, market research campaigns or customer satisfaction research;
• using marketing automation, web personalisation and advertisement placement tools for customer/user-specific website experiences and targeted marketing communications. We use tools from third parties (such as LinkedIn, Meta, Google and Microsoft) to identify individuals who may be interested in our services, display relevant advertisements and personalise our web content;
• developing, establishing and administering arrangements with other parties consistent with our functions – including financiers, insurers and Commonwealth Government agencies and departments such as the Australian Trade and Investment Commission (Austrade), the Department of Foreign Affairs and Trade (DFAT), the Minister for Trade and Tourism, the Department of Finance and the Minister for Finance, the Department of Industry, Science and Resources and, where relevant, the Department of Defence – in relation to the administration of our respective products and services;
• for employment applicants, assessing your application for employment;
• for employees and contractors, security vetting and maintaining any employment relationship or engagement;
• providing assistance to other Commonwealth entities in relation to the operation and administration of financial and service arrangements and agreements between us and those Commonwealth entities;
• where reasonably necessary, notifying those potentially impacted that a person who has visited our premises may have contracted a communicable notifiable disease. Any such disclosures will be in line with applicable government health advice and on a need-to-know basis, disclosing only the minimum amount of information we consider reasonably necessary; and
• we may use your personal information in technology systems, including AI systems, in connection with our functions and activities, including to:
  • prepare drafts of correspondence, notes, financial reconciliations, operational documents, policies, governance documents, and internal reports and briefings;
  • perform administrative and operational tasks;
  • support and improve the performance of our functions, such as through improved information retrieval;
  • meeting transcription for record-keeping purposes;
  • support direct marketing activities;
  • assess applications for credit against our statutory mandate;
  • prepare draft credit assessments, consistent with our Credit Information Policy; and
  • support human resourcing activities, such as drafting position descriptions.

We may also de-identify your personal information and sensitive information. We may use de-identified information for various purposes, including:

• quality improvement, including for example organisational engagement and sentiment analysis; and
• to satisfy our reporting obligations.

Dealing with us anonymously

Generally, you can opt to deal with us anonymously or use a pseudonym. However, it might not be practical or possible for us to deal with you in this way in some circumstances. Also, there are circumstances where we may be required or authorised by law to know your identity to perform our functions and activities.

Please note in the Section below certain kinds of information are automatically collected when you are browsing our website

The types of personal information we collect, use and hold about you depend on the function or activity being performed. Examples of personal information we may collect, use and hold include:

• personal information provided when you make an enquiry or establish a business relationship with us (including, without limitation, whether as our customer, supplier/vendor or service provider);
• identification information such as your name(s), contact details (personal and/or business) including addresses, telephone numbers and email addresses, driver’s licence, passport details, Medicare card details, and date and place of birth (where we are authorised or required to collect such identification information in order to perform our functions);
• contact and identification details of any third party that you have authorised to negotiate or provide your personal information on your behalf;
• personal information in relation to employment applications/applicants, our employees and contractors, including (as applicable) employment record information such as education, qualifications, skills, training courses performance, conduct, referee comments or references, pay details, passport details, visa details, information required for the purposes of security screening, and information from employment background screening providers. Further information on the specific kinds of personal information we collect in relation to our employees and contractors is set out in our internal Employee Personal Information Privacy Statement available on our intranet, and which is also available on request to prospective employees and contractors;
• personal information captured via security cameras (CCTV) in office areas and in common areas within Export Finance House in Sydney (and the offices and common areas of Export Finance Australia’s other office locations), which may be collected and held where necessary, including for building security and work health and safety purposes. Occasionally, this may include sensitive information, such as health information, which may be captured incidentally by the CCTV;
• the names of building access card holders (including individuals employed by, or permitted invitees of, tenants of Export Finance House) for building security and related purposes;
• personal information collected while recording a Teams meeting (which may include your face, image or voice, or other visible information incidentally collected where your camera is turned on);
• IP addresses including via electronic signing platforms and direct marketing tools; and
• personal information contained in any correspondence between you and us.

In certain circumstances, we may also collect and hold sensitive information about you, for example:

• information about your membership of professional, trade or political associations;
• in relation to Export Finance Australia employees and contractors, criminal record information (as part of employment background screening), diversity/inclusion information, health information including details of medical conditions (including dietary requirements), disabilities and any other sensitive information you voluntarily provide to us;
• in relation to Export Finance Australia employees and contractors, biometric data may be used to identify or authenticate individuals using fingerprint or facial recognition technologies on Export Finance Australia devices. This biometric data is stored securely on Microsoft Windows or Apple iOS devices and cannot be removed, exported, or transferred to any other device or system by Export Finance Australia. Individuals can choose not to provide their biometric data or delete their biometric data at any time;
• information from publicly available sources, for example in relation to criminal activity; and
• if you are present at or have visited our premises, such information as is reasonably necessary to prevent or manage a communicable infectious disease from spreading in our workplace or premises. Generally, medical or health information will only be collected and held to the extent required to manage the risk.

We recommend generally that you do not provide sensitive information to us unless we specifically request it. We will only collect it where:

• you have consented and the information is reasonably necessary for, or directly related to, one or more of our activities or functions; or
• we are required or authorised to do so by law; or
• a permitted health or general situation exists, including where we are collecting the information in order to lessen or prevent a serious threat to the life, health or safety of any individual, or to public health or safety.
  
  

We may collect information about you because we are required or authorised by law to collect it.

In particular, in connection with our financing activities, we may be required or authorised by law to collect your personal information to verify your identity for the purposes of the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) and associated regulations (AML/CTF legislation).

To verify your identity and comply with AML/CTF and other legal obligations, we may use electronic identity verification services, including Equifax and the Document Verification Service (DVS). Individuals may choose to verify their identity using alternative methods in accordance with our requirements and policies. Information about your privacy rights and complaints is available in this Privacy Policy.When an eligible data breach declaration or an emergency declaration is in force, we may collect, use and/or disclose personal information about you if we reasonably believe that you may be at risk and the terms of the declaration are met. An eligible data breach declaration can be made by a Minister under the Privacy Act and permits the sharing of personal information in order to prevent or reduce the risk of harm to individuals arising from a misuse of personal information in the event of an eligible data breach.

(Note: in summary terms, under the Privacy Act an eligible data breach occurs where there is unauthorised access to, or unauthorised disclosure of, the information and a reasonable person would conclude it would likely result in serious harm to any of the individuals to whom the information relates; or where information is lost in circumstances where unauthorised access to, or unauthorised disclosure of, the information is likely to occur and, if so, a reasonable person would conclude that it would likely result in serious harm to any of the individuals to whom the information relates.

A Minister can also make an emergency declaration that permits the sharing of personal information for a purpose that directly relates to the Commonwealth’s response to an emergency or disaster. There are special provisions in the Privacy Act for the collection, use and disclosure of personal information in an emergency or disaster that affects Australians either in Australia or overseas.)

Site Visit Data 

Our website hosting provider makes a record of your visit and logs the following information for statistical purposes: 

This information is collected to facilitate our website and system administration. 

No attempt will be made to identify users or their browsing activities (outside of our website) except in the unlikely event of an investigation, for example, if a law enforcement issues a warrant to inspect our hosting provider's logs. 

External sites that are linked to or from our website are not under our control and users should view the privacy policies applicable to those websites separately. 

Our use of ‘Cookies’ 

Cookies are used on our website to supplement the site visit data described above.

A cookie is a small text/data file that a website server gives to a browser the first time you visit the site and updates with each return visit. The data file is stored on your device’s browser and helps the website keep track of your visits and activity. Cookies can store information such as username and password and what parts of the site were visited. Accepting a cookie does not give access to your computer and a cookie does not identify you personally (it identifies your browser). We use cookies on our website (first-party cookies) to monitor your use of our website, to observe behaviour (including to better target our website content to your interests), compile aggregate data, and provide users with an improved and more effective service and web experience. Where you have opted in to receive marketing communications from us about our products and services, our marketing platform also uses (first-party) cookies to track individual users' browsing and personalise content. A third-party cookie is sent by an organisation that supplies content (like advertising) on websites that you visit and we may engage with those websites (which involves the use of such cookies to track your browsing activities) to better target our content to your interests.

There are two types of cookies: temporary and log cookies. Temporary cookies are required and tell the website server which page to pull up next. They only last for a single browsing session i.e. until you close your browser. Our website uses traffic log cookies to show what pages are being used on our site.

Social media site settings may give you options in respect of viewing and managing your cookies or opting out of receiving targeted ads. While this will not remove advertising from the pages you visit, depending on site functionality and settings, it means the ads you see will not be targeted or matched to your interests (as gleaned from website browsing activity).

Social Media 

We categorise our followers on social media platforms at a high level by demographic features (such as business types, location, job titles) and may receive statistics on these categories. Our activities on social media (such as LinkedIn and Meta) also use cookies (third-party cookies) to better target our advertising content.

Digital Marketing

Tracking pixels may be used by third-party providers such as advertising platforms (including Meta, LinkedIn, Microsoft and Google) which we engage with to deliver content. A tracking pixel is a piece of code embedded on an organisation’s website, often for marketing and analytics purposes, and can collect information about a user’s activity, track browsing habits like clicks and webpage visits. We do not use these to personally identify you but their use by such providers does assist in personalising the content we deliver to you via those platforms.

By using our website or providing personal information to us, you acknowledge that your personal information will be handled in accordance with this policy.

How we use personal information 
We use and disclose personal information for the primary purposes for which we collect it (see section 3 and section 4 above). We may also use or disclose personal information we collect for secondary purposes that are otherwise permitted under the law, including where:

• we have obtained consent;
• you would reasonably expect the use or disclosure, and the secondary purpose is related to the primary purpose (or in the case of sensitive information, either the secondary purpose is directly related to the primary purpose, or otherwise where a permitted general situation exists);
• the use or disclosure is required or authorised by law or court/tribunal order; or
• we consider the use or disclosure is reasonably necessary for one or more enforcement related activities conducted by, or on behalf of, an enforcement body.
  
  

Automated decisions 
We may use your personal information in the operation of computer programs. However, unless you are an Export Finance Australia employee or contractor, these computer programs do not use your personal information to make, and are not used to do something that is substantially and directly related to the making of, decisions which could reasonably be expected to significantly affect your rights or interests (Automated Decisions).If you are an Export Finance Australia employee or contractor, any use of your personal information in relation to Automated Decisions will be described in our internal Employee Personal Information Privacy Statement available on our intranet, and which is also available on request to prospective employees and contractors. 

We sometimes need to share your personal information with others.

We disclose personal information to third parties located in Australia or overseas where we believe such disclosure is reasonably necessary to perform our functions and activities, including to provide our products and services, or to comply with a legal obligation. We may disclose your personal information to:

• our external advisers (for example, our lawyers, accountants and auditors);
• insurers;
• other financiers;
• government entities, agencies and departments, including Austrade, DFAT, the Minister for Trade and Tourism, the Department of Finance, the Minister for Finance, and the Department of Industry, Science and Resources (and in respect of defence industry related transactions to the Department of Defence);
• government agencies or other specified entities if an eligible data breach declaration or an emergency declaration is made by a Minister under the Privacy Act, to the extent permitted by law;
• our business partners and service providers we engage to support or assist us to perform our functions and activities, including for example in connection with our products and services and our IT and AI system service providers;
• authorised identity verification service providers, including to Equifax and through the DVS which enables identification information to be checked against records held by the Document Issuer or Official Record Holder. In this process we may disclose identification information and details contained in identity documents to verify an individual's identity, validate the authenticity of identity information provided to us, prevent fraud, and comply with our legal and regulatory obligations (including but not limited to our obligations under the AML/CTF legislation);
• third parties we engage for promotional activities or direct marketing purposes, to the extent permitted by law, including digital advertising and social media platforms (such as Meta and LinkedIn). This may involve providing limited personal information (such as name, phone and email addresses or business contact details) to those platforms to create customer-matched audiences, exclude certain audiences, and deliver advertising and communications that are relevant to your interests. These platforms use cross-device tracking for advertising personalisation and targeting;
• anyone to whom we are required or authorised to disclose information to, by or under Australian law, or a court/tribunal order; and
• with your consent, other entities.

The parties listed above may in turn disclose your personal information to other parties in accordance with their privacy policies, to the extent permitted by law.

In addition, third party service providers we disclose to or use to hold or process your personal information in pursuit of our functions (as set out above) may process your personal information overseas, including via cloud service providers located overseas. We take reasonable steps to assess and manage the associated privacy and security risks. These measures may include organisational and technical measures, such as encryption, access controls, restrictions on storage locations, and other appropriate contractual protections and mitigants. (See section 9 below for how we ensure your information is appropriately protected).

We may disclose personal information to third parties by electronic means, including via the internet.

If we send you information about products or services that you do not wish to receive, you can inform us that you wish to unsubscribe or opt out by contacting us in writing (via the contact details set out below).

If you have a complaint about how we handle your personal information, please contact us using the contact details below. Please note that we will ask you to lodge your complaint in writing. We will endeavour to understand and resolve your complaint as soon as possible, in accordance with our complaints mechanism.
If you make a privacy complaint to us and are not satisfied that the matter has been resolved, you can lodge a complaint with the Privacy Commissioner at the Office of the Australian Information Commissioner (OAIC). Further information about making a privacy complaint to the OAIC is available at: 

http://www.oaic.gov.au. 

You can make a complaint directly to the OAIC rather than to us. In most cases, however, it is likely that the OAIC would refer you to us at first instance to see if your complaint can be resolved without requiring their involvement.

If you wish to contact us regarding our handling of your personal information or any of the matters covered in this policy, you can contact our Privacy Officers by: