Consumer Data Right Policy

Consumer Data Right frameworks — including open banking style arrangements — are designed to give consumers more control over their data and more choice in how it is shared. With your authorisation, data holders (such as banks) can share your CDR data with organisations you choose, including accredited or authorised data recipients and other third parties you nominate.

Where we collect or receive CDR data under applicable Consumer Data Right, open banking, or similar consumer data-sharing arrangements (together, CDR arrangements), we manage that data in accordance with those arrangements, this CDR Policy, and New Zealand’s Privacy Act 2020 (and any other applicable laws).

We are committed to providing a high standard of service. Your privacy matters to us, and protecting it is a priority. This CDR Policy describes how we manage your CDR data, how you can access it, how you can request correction, and how you can ask questions or lodge a complaint.

This CDR Policy relates only to CDR data (including personal information that is CDR data). For how we protect other personal information that is not CDR data, please see our Privacy Policy and Privacy Collection Notice.

Dealbusters Ltd. (New Zealand) operates the nz.finance platform. Where we act as a recipient of consumer banking data under CDR arrangements, we maintain information security standards, internal dispute resolution processes, and other controls appropriate to those arrangements (including audits and reviews as required).

Outsourced service providers that process CDR data on our behalf do so under contractual arrangements that require appropriate protection of that data. We do not appoint CDR representatives to collect CDR data in their own right on our behalf unless we notify you otherwise.

We only collect and use CDR data in line with the consent you give us, and we limit collection to what we need to provide our products and services to you.

We provide a secure CDR dashboard where you can view and revoke consents you have provided, including any collection consent and disclosure consent. Through the dashboard, you can tell us to stop disclosing your CDR data, or to de-identify or delete your CDR data (subject to legal retention requirements).

If you withdraw consent for us to collect or use your CDR data before completing your NZ.Finance application or discovery journey, we may be unable to provide some product and service functionality that depends on that data.

The classes of CDR data we may collect include:

• account details such as product category, account type and product name, masked account number, account nickname, account status, and account metadata (for example credit cards, term deposits, loans);
• balance details, such as current balance and available funds; and
• aggregated insights and analytics on expenses, income and assets.

We apply a high level of security and privacy protection to CDR data we hold. We primarily store CDR data in New Zealand. Where a processing location outside New Zealand is used, we take steps that are reasonable in the circumstances to protect the information consistently with applicable privacy and CDR requirements.

We de-identify CDR data where practicable — for example by excluding account holder names from certain ingestions and by masking account numbers before storage — so that CDR data cannot readily be linked back to you outside your completed application journey. We only share your identifiable CDR data with your consent (or as otherwise required or authorised by law).

We collect, hold, use and disclose your CDR data in accordance with the consent you have provided, so that we can provide our products and services to you — including assessing applications, supporting brokers and advisers, and delivering related platform features.

We may also use de-identified CDR data for general research into how our products and services can be improved, so we can offer better or more personalised experiences. When we de-identify data, we remove identifiers such as account names and account numbers so the data cannot readily be linked back to you. De-identified data used for research may be disclosed to our affiliates for those research purposes only.

We only disclose your CDR data in accordance with applicable CDR arrangements and the law. That generally means we disclose CDR data with your consent and only to certain persons — for example accredited or authorised persons, trusted advisers you nominate (such as your mortgage broker), and any co-applicant — except where otherwise required or authorised by law.

Trusted advisers are often not CDR participants themselves and may not be subject to the same privacy safeguards that apply under a CDR system. CDR data disclosed to a trusted adviser may therefore no longer be protected by CDR-specific safeguards unless that adviser is also an accredited or authorised recipient under the relevant arrangement.

You have the right to request access to CDR data we hold about you, and to request its correction, at any time. We will respond as soon as practicable. For your protection, we will need to verify your identity before we give you access.

We will give you access within a reasonable time and in a manner you request where practicable. In exceptional circumstances we may be unable to give access or may refuse a correction request (for example where it would be unlawful). If so, we will tell you and explain why.

We take reasonable steps to ensure CDR data we collect, hold, use or disclose is accurate, complete, up to date, relevant and not misleading. That may include asking you to confirm details, or updating information from reliable sources where appropriate.

If your details have changed, or you believe CDR data we hold is inaccurate, out of date, incomplete, irrelevant or misleading, please contact us using the details in section 13. We aim to respond to correction requests within 30 calendar days. If we need more time, we will let you know. Correction requests are free of charge.

We may refuse a correction if we do not agree with the changes supplied. If we refuse, we will give you written notice of that decision.

In addition to your personal CDR data, you may also ask us to share certain generic information about our products — such as terms and conditions, eligibility criteria and general product availability — with you or an accredited / authorised data recipient.

We design our processes so that identifiable CDR data is primarily held and processed in New Zealand. Where disclosure or processing outside New Zealand is necessary for a service provider that supports our platform, we only do so where permitted under applicable CDR arrangements and privacy law, and we take reasonable steps to protect the information (including contractual safeguards where appropriate).

CDR data is encrypted in transit where appropriate and stored with access controls designed to keep it secure.

You can ask us to delete or de-identify your CDR data through our CDR dashboard (or by contacting us). If you request deletion or de-identification, personally identifiable CDR data will be de-identified or deleted in accordance with the law and any retention obligations that still apply.

Personally identifiable CDR data will also be de-identified or deleted when you withdraw consent for collection or use, or when your consent otherwise expires — except where we are required to retain records. De-identified data may continue to be used for general research.

If you withdraw consent before completing your NZ.Finance application or discovery journey, we will delete the CDR data collected for that incomplete journey where we are not required to keep it.

We keep you informed when certain events occur relating to consents you have granted. We will notify you when:

• you give, amend or withdraw consent for us to collect, use and/or disclose your CDR data;
• we collect your CDR data;
• we disclose your CDR data to an accredited or authorised third party;
• your consent is still current if a significant period (for example 90 days) has passed since certain events;
• your rights if your consent expires;
• the action we take in response to a request by you to correct your CDR data; and
• you are affected by a notifiable privacy or data breach relating to your CDR data, where we are required to notify you.

This CDR Policy may change from time to time as we consider necessary. Material changes will be published on our website. If you would like a copy of this CDR Policy in another form (such as a paper copy), please contact us.

This CDR Policy was last updated on 31 July 2026.

If you wish to complain about the way we have handled your CDR data, please email contact@nz.finance (or use the contacts above) and mark your message as a CDR complaint.

We will acknowledge your complaint as promptly as possible. Please include enough identification information for us to find your records, details of the complaint, and any supporting documents. We treat CDR complaints as a priority and aim to investigate and resolve them within 30 calendar days. Complex matters may take longer — if so, we will ask for more time and keep you updated.

If you are not satisfied with our response, you can lodge a complaint with the Office of the Privacy Commissioner (privacy.org.nz). Where your complaint relates to financial advice or a financial service we provide, you may also be able to escalate it through the dispute resolution scheme we belong to (details available on request or on our website).