Consumer Data Right

Riyadh Financial Services · issued by Columbus Capital Pty Ltd (ColCap)

Columbus Capital Pty Ltd ABN 51 119 531 252 · CDR data holder

Version 1.1 · Effective 16 October 2026

1Accessibility and support

ColCap Financial is committed to making our products and services accessible to all customers. We can provide support for customers with disability, illness, or customers who need assistance with language or communication.

For more information about the support available and how we can assist you, please visit our Customer Assistance page.

2What is this policy about?

This policy explains how Columbus Capital Pty Ltd (ABN 51 119 531 252) (ColCap, we, us, our) manages your data under the Consumer Data Right (CDR). It applies to data ColCap holds as a CDR data holder for loans we issue and administer, including loans offered under ColCap-branded products and white-labelled products distributed through our mortgage manager partners.

The CDR is established under Part IVD of the Competition and Consumer Act 2010, the Competition and Consumer (Consumer Data Right) Rules 2020 (CDR Rules) and the 13 Privacy Safeguards. It is co-regulated by the Australian Competition and Consumer Commission (ACCC) and the Office of the Australian Information Commissioner (OAIC). The CDR lets you direct ColCap to share certain data about you and our products with accredited data recipients of your choice.

This policy sets out: the CDR data we hold; who is eligible to share data; how data is accessed, shared, withdrawn and corrected; how we notify you; the outsourced providers we use; and how to make a complaint. Our general Privacy Policy, explains how we handle personal information outside the CDR.

To learn more about the Consumer Data Right, including how it works and your rights, you can visit the official website at www.cdr.gov.au.

3Key terms used in this policy

To make this policy easier to follow, here are some key terms we use:

• Accredited data recipient (ADR) - a business accredited by the ACCC to receive your CDR data with your consent.
• CDR data - the customer, account, transaction and product data that can be shared under the CDR.
• CDR Data Sharing Dashboard - the online dashboard you use to view, manage and withdraw your data sharing arrangements with ColCap.
• Data holder - an organisation, like ColCap, that holds your CDR data and shares it when you authorise it.
• Eligible CDR consumer - an individual who meets the eligibility criteria to share CDR data (see "Accessing your CDR data" below).
• Privacy Safeguards - the 13 privacy protections in Part IVD of the Competition and Consumer Act 2010 that apply to CDR data.
• Secondary user - a person an account holder authorises to share CDR data for an account, where this is supported.

4What can you do under the CDR?

Under the CDR, you can direct ColCap to share your CDR data with an accredited data recipient of your choice. You decide what data is shared, with whom and for how long. You can withdraw your authorisation at any time.

ColCap is an ‘initial provider’ under the CDR Rules for the non-bank lending sector. We will share product data for our brands in stages, starting 13 July 2026, with all brands covered by 30 April 2027. We will accept consumer data sharing requests from 9 November 2026.

5Disclosing your data to other parties

We have engaged Biza Pty Ltd (Biza), an Australian-based CDR technology provider, as our outsourced service provider to deliver and operate the systems that support our CDR data holder obligations (CDR services). Under that arrangement, Biza may handle CDR data, consent records, authorisation information, access and audit logs, system records and related operational metadata only to the extent necessary to provide, secure, monitor, maintain, support and evidence compliance of the CDR services. Biza must not use or disclose ColCap’s CDR data except as necessary to provide the CDR services and meet its legal obligations. Biza’s CDR policy is available here.

Aside from disclosures to Biza that you have authorised for the operation of our CDR services, ColCap does not disclose your CDR data to any third parties. We will update this policy should this change.

6Overseas disclosure of CDR data

ColCap does not disclose CDR data to overseas recipients. Our CDR data is held and processed in Australia. If this changes, we will update this policy and tell you which countries CDR data is likely to be disclosed to before any such disclosure occurs, consistent with Privacy Safeguard 8.

7About ColCap’s role as data holder

ColCap participates in the CDR only as a data holder. We do not receive CDR data from other organisations, and we are not an accredited data recipient.

We hold and, when authorised, share CDR data relating to the loans we issue and administer, including loans offered under our mortgage manager brands.

8Types of data covered by CDR

The CDR distinguishes between required data (which ColCap must share when authorised) and voluntary data (which a data holder may choose to share). The required CDR data we hold and may share falls into the following classes:

ColCap does not currently share voluntary data.

9Accessing your CDR data

You can direct ColCap to share your CDR data with an accredited data recipient of your choice if you are an eligible CDR consumer. You are eligible if you are aged 18 or over, hold a covered product with ColCap that is open and accessible online and that product is held in your name as an individual.

You initiate data sharing through the accredited data recipient’s app or website. You will be asked to select the brand under which your loan is held (covering ColCap and its mortgage manager brands) and then securely connected to ColCap to confirm your identity and review the request before authorising sharing.

ColCap will never ask for your online banking password during the CDR process. Authentication uses one-time codes or other secure methods consistent with the CDR Data Standards.

Once authorised, we share the data with the accredited data recipient through CDR-compliant interfaces. You can view, manage and withdraw your authorisation at any time through ColCap’s CDR Data Sharing Dashboard or by contacting us. Through the dashboard you can see the accredited data recipient receiving your CDR data, the CDR data covered by the authorisation, the date the authorisation was given, the period of authorisation, the expiry date, and the status of current and historical authorisations. Withdrawal stops further sharing immediately but does not affect data already shared.

CDR data sharing through ColCap is currently available only for loan accounts held in the name of a single individual. Joint accounts are not available from ColCap’s initial consumer data sharing commencement date and will be supported when required under the CDR Rules (including for complex requests), unless an exemption applies. Accounts held by or for trusts, companies, partnerships or other non-individual structures remain outside the scope of CDR data sharing.

10Cost of using the CDR

ColCap does not charge you any fee to authorise, manage, withdraw or correct CDR data sharing arrangements, or to make a CDR complaint.

11Keeping your CDR data secure

We take the security of your CDR data seriously. ColCap maintains controls aligned with the CDR Data Standards and our Information Security Policy, including encryption of CDR data in transit and at rest, multi-factor authentication for authorisation, access controls limited to authorised personnel, secure logging, monitoring of our CDR interfaces and regular independent assurance. If we become aware of an eligible data breach involving your CDR data, we will respond consistent with the Notifiable Data Breaches scheme and our CDR obligations.

12Notifications

We will notify you through your CDR Data Sharing Dashboard or your usual contact channel when a data sharing arrangement starts, when authorisations are amended or withdrawn, when sharing is about to expire and if data sharing is unavailable for an extended period.

13Correcting your CDR data

If you believe your CDR data is inaccurate, out of date or incomplete, you may request that ColCap correct it by contacting us. ColCap will confirm that your request has been received as soon as possible, verbally or in writing. ColCap will let you know in writing whether your CDR data has been corrected or not within 10 business days. If ColCap does not agree that the information is inaccurate, ColCap will tell you why and what you can do if you are not satisfied with the response. ColCap will not charge a fee for this.

You can contact us using any of the methods below.

If you have a general question about how ColCap manages CDR data, you can also contact us using the details above.

14How can you make a complaint?

ColCap is committed to resolving complaints about our CDR services and the way we handle CDR data. We handle CDR complaints through our internal dispute resolution process, consistent with our complaints handling obligations and the CDR Rules.

A CDR complaint may include a concern about how we have handled your CDR data, a CDR authorisation or withdrawal, access to or correction of CDR data, the availability or operation of your CDR Data Sharing Dashboard, a refusal to disclose CDR data, the accuracy or security of CDR data, or any other issue relating to our CDR obligations.

You can lodge a complaint with ColCap using any of the methods below. Please include your name, contact details and a description of your concern. You will not be charged a fee to make a CDR complaint. If you prefer, you can also have someone represent you, as long as ColCap has your written authority.

We will acknowledge receipt of your complaint within one business day, or as soon as practicable. We will provide a written response to your CDR complaint within 30 calendar days of receiving it. If we cannot respond within this timeframe, we will explain the reason for the delay and tell you when we expect to respond.

If your complaint is more complex, we may ask you for additional information or documentation to help us resolve it. We will keep you updated on its progress throughout.

If we do not respond within 30 days, or you are not satisfied with our response, you may refer your complaint to external dispute resolution.

To do this, you can contact the Australian Financial Complaints Authority at:

If your complaint relates to our handling of your CDR data, you may also contact the Office of the Australian Information Commissioner (OAIC), which can consider complaints about the mishandling of CDR data under the privacy safeguards or CDR Rules that relate to the privacy or confidentiality of CDR data.

Our general Complaints Policy is available on the ColCap website.

15Retention, de-identification and deletion of CDR data

ColCap retains CDR data only for as long as needed to meet its CDR, regulatory and record-keeping obligations. Records of CDR consents, authorisations, disclosures and complaints are kept for the period required by the CDR Rules and our document retention requirements.

When you withdraw a data sharing authorisation, ColCap stops sharing further CDR data with the accredited data recipient immediately, but this does not require ColCap to delete the underlying records we hold as your data holder for the loans you have with us. ColCap does not de-identify CDR data for general research or commercial use. If we ever propose to de-identify CDR data for a CDR-permitted purpose, we will do so in accordance with the Privacy Safeguards and ACCC/OAIC guidance and update this policy.

16Records, reporting and privacy obligations

ColCap is bound by the 13 CDR Privacy Safeguards in respect of CDR data. We keep records of CDR data requests, authorisations, disclosures and complaints in line with the CDR Rules and report to the ACCC and OAIC as required.

17Policy updates

We review this policy at least annually and update it when our CDR practices change. The current version is always available at colcap.com.au. On request, we will provide a copy in your preferred format free of charge.