Privacy Policy

Riyadh Financial Services

Islamic Finance Partners Pty Ltd ABN 20 660 262 840 trading as Riyadh Financial Services · Authorised Credit Representative 547213 of Kuone Pty Ltd, Australian Credit Licence 504193

Last updated 26 October 2026

1About this Privacy Policy

Islamic Finance Partners Pty Ltd ABN 20 660 262 840, trading as Riyadh Financial Services (‘Riyadh FS’, ‘we’, ‘us’ or ‘our’), is committed to protecting the privacy of the personal information we collect and hold about you.

Riyadh FS is an Authorised Credit Representative (ACR 547213) of Kuone Pty Ltd ABN 81 621 683 672, Australian Credit Licence 504193. We provide Shariah-compliant finance solutions to Australian households and businesses, including our Ijarah-based Ijaar Star and Ijaar Crescent products and our Diminishing Musharakah-based Al Mustaqbal product.

This Privacy Policy explains how we collect, hold, use, disclose, secure and dispose of your personal information and your credit-related information. It applies to our website at www.riyadhfs.com.au (the ‘website’), our broker and customer portals, our finance origination and management services, and every other dealing you have with us — whether online, by email, by telephone, by SMS or in person.

We handle personal information in accordance with the Privacy Act 1988 (Cth) (‘Privacy Act’), including the Australian Privacy Principles (‘APPs’). Where we handle credit information or credit eligibility information, we also comply with Part IIIA of the Privacy Act and the Privacy (Credit Reporting) Code.

By using our website, submitting an enquiry or application through it, or otherwise providing your information to us, you acknowledge that we will handle your personal information in the manner described in this Privacy Policy.

Our Shariah-compliant approach

Our products are structured to be free of riba. Depending on the product, your obligations to us are expressed as rental payments under an Ijarah arrangement, or as dividend and unit acquisition payments under a Diminishing Musharakah arrangement. Where this Privacy Policy uses general terms such as ‘finance’, ‘facility’ or ‘credit’ — including terms that appear in the Privacy Act and other legislation we must comply with — those terms are used in their legal sense and do not change the Shariah-compliant structure of your product.

Who else is involved

Because we operate as an Authorised Credit Representative, Kuone Pty Ltd (our licensee) also has obligations in relation to the credit activities we perform, and information about your application may be handled by the licensee and its systems. The following related businesses publish their own privacy policies on their own websites:

• 360 MMS — Kuone Pty Ltd ABN 81 621 683 672, Australian Credit Licence 504193.
• 360 Asset Finance and 360 SaaSFin — Kuone Consulting Pty Ltd ABN 75 647 329 002, Australian Credit Licence 566705.

A separate document — our Privacy Consent

When you apply for finance through us, you will also be asked to read and sign a Privacy Consent form. That form is a consent you give us and our funders, investors and insurers to collect, use, hold and disclose your personal and credit information for a finance application. This Privacy Policy is broader — it describes our overall information handling practices, including how our website works and what rights you have. Where the two documents deal with the same subject, read them together.

2The information we collect

2.1 Personal information

‘Personal information’ means information or an opinion about an identified individual, or an individual who is reasonably identifiable. Depending on your relationship with us, the personal information we collect may include:

• Identity information — your full name, any former names, date of birth, gender, residential and postal addresses, address history, and identity document details (for example passport, driver licence or Medicare card details) used to verify who you are.
• Contact information — telephone and mobile numbers, email addresses and preferred contact method.
• Financial information — income, employment and self-employment details, assets, liabilities, living expenses, bank account and transaction information, tax and accounting information, superannuation details, savings and deposit history, and details of the property or asset being financed.
• Application and facility information — the products you have applied for or hold with us, facility and account numbers, payment history, your ownership share under a Diminishing Musharakah arrangement, and correspondence about your facility.
• Relationship information — details of your dependants, marital status, guarantors, co-applicants, referees, your accountant, solicitor or financial adviser, and your broker.
• Broker and partner information — if you are a broker, aggregator, referrer, community partner or other business partner: your licensing or credit representative details, accreditation and professional indemnity details, qualifications, police and bankruptcy check outcomes, commission and payment details, and your dealings with us.
• Interaction information — records of telephone calls (which may be recorded or monitored for training, quality assurance and compliance purposes), emails, SMS messages, live chat transcripts, portal messages, meeting notes, complaints and feedback.

2.2 Credit information and credit eligibility information

Because we arrange and manage finance, we also collect ‘credit information’ and ‘credit eligibility information’ as those terms are defined in the Privacy Act. This can include:

• identification information;
• consumer and commercial credit liability information — the type and amount of finance provided to you, the provider, and the date the facility was opened and closed;
• repayment history information and financial hardship information;
• default information, payment information and information about serious credit infringements;
• details of applications you have made and credit enquiries about you;
• court proceedings information and personal insolvency information;
• publicly available information about your credit worthiness; and
• credit scores, credit ratings, assessments and summaries that a credit reporting body or we derive from the above.

2.3 Sensitive information

‘Sensitive information’ includes health information and information about your racial or ethnic origin, political opinions, religious beliefs, sexual orientation or criminal record. We collect sensitive information only where it is reasonably necessary for our functions and, in general, only with your consent.

We recognise that customers may tell us about their religious beliefs or observance when explaining why they are seeking a Shariah-compliant product, or when discussing their circumstances with us. We do not require you to disclose your religious beliefs in order to apply for or hold any of our products, and our products are available to anyone who meets our eligibility requirements. Where you do give us that information, we treat it as sensitive information, we use it only for the purpose for which you gave it to us, and we do not use it for direct marketing without your consent.

2.4 Government related identifiers

We may collect government related identifiers such as driver licence, passport and Medicare numbers to verify your identity, including through electronic verification services. We collect Tax File Numbers only where the law authorises or requires it. We do not use a government related identifier as our own identifier for you, and we do not disclose these identifiers except where the Privacy Act permits.

2.5 Information we collect through our website

You can browse most of our website without telling us who you are. When you do interact with the website, we may collect:

• Information you submit — details you enter into enquiry forms, calculators, accreditation forms, subscription forms, live chat and our broker and customer portals.
• Account and portal information — your username, access logs, and the pages and records you view or submit while logged in. We do not store your password in a readable form.
• Technical and usage information — your IP address, approximate location derived from that address, device type, operating system, browser type and language, screen size, the date and time of your visit, the pages you viewed and the time spent on them, the site you came from, and the links you clicked.
• Cookies and similar technologies — see section 8 below.

Some of this technical information does not identify you on its own. Where it is combined with other information so that you become reasonably identifiable, we treat it as personal information and handle it under this Privacy Policy.

2.6 Dealing with us anonymously or by pseudonym

Where it is lawful and practicable, you may deal with us anonymously or under a pseudonym — for example when making a general enquiry or using an online calculator. However, we cannot assess an application, arrange or manage a facility, or accredit a broker without knowing who you are and verifying your identity.

3How we collect your information

3.1 Directly from you

We collect most personal information directly from you — when you complete an application, enquiry form or accreditation form; when you speak with us by telephone; when you email, SMS or live chat with us; when you use our website or portals; when you attend a meeting, webinar, community event or seminar; and when you supply supporting documents such as payslips, bank statements, tax returns or identity documents.

3.2 From other people and organisations

Where it is unreasonable or impracticable to collect information directly from you, or where you have authorised us to do so, we may collect personal and credit information about you from:

• your broker, aggregator or referrer;
• your accountant, financial adviser, solicitor or conveyancer;
• your employer or other referees, to verify information you have given us;
• credit reporting bodies and other credit providers;
• our licensee, Kuone Pty Ltd, and its related entities;
• funders, investors, trustees and custodians;
• valuers, property data providers and land titles offices;
• banking data and document verification service providers you consent to use, including open banking and bank statement retrieval services;
• electronic identity verification providers and the Australian Government Document Verification Service;
• insurers and claims investigators;
• our related entities, contractors and service providers;
• regulators, courts, tribunals, external dispute resolution schemes and law enforcement agencies; and
• publicly available sources, including public registers, professional and business directories and social media pages you have made public.

If someone else gives us personal information about you, we will take reasonable steps to make you aware that we hold it, unless an exception under the Privacy Act applies.

3.3 If you give us information about someone else

If you provide personal information about another person — for example a co-applicant, guarantor, dependant, referee or a beneficial owner of a company or trust — you must have that person’s consent to do so, and you must tell them that we hold their information, why we hold it, and that they can read this Privacy Policy at www.riyadhfs.com.au.

4Why we collect, hold, use and disclose your information

We collect, hold, use and disclose personal information for the purposes set out below, and for related purposes you would reasonably expect. We do not use your information for an unrelated purpose without your consent, unless the law permits or requires it.

If you choose not to give us the personal information we ask for, we may not be able to assess your application, arrange or manage finance for you, accredit you as a broker, or provide you with other services.

5Direct marketing and your choices

We may use your personal information to send you direct marketing about our products and services, rental and dividend rate changes, industry updates, webinars, community events and offers. We may contact you by email, SMS, telephone, post and through our portals and social media platforms. We do not use sensitive information — including any information you have given us about your religious beliefs — for direct marketing without your consent, and we do not use credit eligibility information for direct marketing except as the Privacy Act permits.

How to opt out

You can ask us to stop sending you direct marketing at any time, at no cost. You can:

• click the ‘unsubscribe’ link in any of our marketing emails;
• reply STOP to any marketing SMS;
• update your preferences in our preference centre or portal; or
• contact our Privacy Officer using the details in section 13.

We will action your request within a reasonable period. Please note that even after you opt out of marketing, we will still send you service and compliance communications about your application, facility or accreditation — for example settlement notices, statements, rate change notices and hardship correspondence — because we are required or authorised to send these.

Pre-screening opt-out and credit marketing

Credit providers may use credit reporting body information to ‘pre-screen’ you for direct marketing of credit offers. You have the right to ask a credit reporting body not to use your credit reporting information for pre-screening. You also have the right to ask a credit reporting body not to use or disclose your credit reporting information if you believe you are, or are likely to be, a victim of fraud. Contact details for the credit reporting bodies we deal with are in section 6.

6Credit reporting

If you apply for finance through us, we may disclose personal and credit information to a credit reporting body and obtain a credit report about you. Credit reporting bodies may include information about you in reports they provide to other credit providers to help them assess your credit worthiness.

Credit reporting bodies we deal with

Each credit reporting body has a credit reporting policy that explains how it manages credit reporting information, how you can access and correct that information, and how you can complain. You can obtain a copy from the body’s website free of charge.

Notifiable matters

The Privacy Act requires us to tell you the following:

• We may disclose information about you to a credit reporting body, which may include it in reports provided to other credit providers to assist them to assess your credit worthiness.
• If you fail to meet your payment obligations in relation to consumer credit, or you commit a serious credit infringement, we may be entitled to disclose that information to a credit reporting body.
• You can request a credit reporting body not to use your credit reporting information for the purposes of pre-screening direct marketing offers of credit.
• You can request a credit reporting body not to use or disclose your credit reporting information if you believe you are, or are likely to be, a victim of fraud.
• You can obtain a copy of our credit reporting policy and of each credit reporting body’s policy, free of charge, using the contact details in this Privacy Policy or on the relevant body’s website.
• You can access and seek correction of the credit information and credit eligibility information we hold about you, and complain if you believe we have breached Part IIIA of the Privacy Act or the Privacy (Credit Reporting) Code — see sections 11 and 12.

7Who we disclose your information to

We disclose personal information, and where relevant credit information, only where it is necessary for the purposes described in section 4, where you have consented, or where the law requires or authorises it. The types of recipients are:

• Our licensee — Kuone Pty Ltd, which is responsible for the credit activities we perform as its Authorised Credit Representative, and its related entities and shared systems.
• Funders, investors, trustees and custodians — the organisations that provide, hold or fund the facility you apply for.
• Insurers — including property, mortgage and trade insurers, and claims investigators.
• Credit reporting bodies and other credit providers — for the purposes described in section 6.
• Brokers, aggregators, referrers and community partners — who assist us to provide our products and services to you.
• Our Shariah adviser — for product structuring, certification and audit, on a confidential basis and, wherever practicable, using de-identified or aggregated information. Details of our Shariah adviser are available on request.
• Valuers, property data providers, settlement agents, land titles offices, solicitors and conveyancers.
• Identity and data verification providers — including electronic identity verification, document verification and open banking service providers.
• Our professional advisers — lawyers, accountants, auditors, compliance consultants and insurers.
• Our related entities, contractors and service providers — including our offshore processing team, and providers of cloud hosting, customer relationship management, document storage and e-signature, telephony, email and SMS delivery, marketing automation, data analytics and IT support services.
• Payment and banking providers — including direct debit providers.
• Government agencies, regulators and law enforcement — including ASIC, AUSTRAC, the Australian Taxation Office, courts, tribunals and the Australian Financial Complaints Authority, where we are required or authorised to disclose.
• Your nominated representatives — anyone you authorise to act for you or to receive information about your facility.
• Prospective purchasers — any person considering acquiring an interest in our business or assets, or in a portfolio of facilities we manage, subject to appropriate confidentiality protections.

Funders and insurers

The funders, investors and insurers we may deal with are listed in our Privacy Consent form, which is provided to every applicant and is available on request. Each of them has its own privacy policy and credit reporting policy setting out how it handles your information, how you can access and correct it, and how you can complain. Those policies are available on their websites or on request from us.

We do not sell your information

We do not sell, rent or trade your personal information to third parties for their own marketing purposes.

Disclosure outside Australia

We store personal information in Australia. All of our cloud systems, including those we run on Amazon Web Services (AWS) and our chat service and AI assistant, are hosted in Australian data centres. We do not store your personal information overseas.

The only recipient outside Australia that we disclose personal information to is:

• Malaysia — our wholly owned back-office processor, CNL Automation Sdn Bhd, which performs application processing and administrative support for us. Its team works remotely inside our Australian-hosted systems; because that team is located overseas, the Privacy Act treats their access as a disclosure of your information outside Australia.

Before disclosing personal information overseas, we take steps that are reasonable in the circumstances to ensure the recipient does not breach the Australian Privacy Principles — including through contractual protections, role-based access controls, limiting access to only the information needed to perform the task and, where practicable, requiring data to be stored in Australian data centres. Where you consent to an overseas disclosure, or where the law otherwise permits it, APP 8.1 may not apply and we may not be accountable under the Privacy Act for how the overseas recipient handles your information.

Separately, some of the organisations we disclose your information to in Australia — such as funders, investors, insurers and credit reporting bodies — may make their own overseas disclosures. Those disclosures are governed by their own privacy policies, which are available on their websites or on request from us.

8Cookies, analytics and online tracking

8.1 What cookies are

A cookie is a small text file placed on your device by a website. Cookies allow a website to remember your actions and preferences over time. We also use similar technologies such as pixels, tags, local storage and software development kits. In this policy we refer to all of them as ‘cookies’.

8.2 The cookies we use

8.3 Managing cookies

Where our website presents a cookie banner or preference tool, you can use it to accept or decline non-essential cookies and to change your choice later. You can also manage cookies through your browser settings — most browsers let you view, delete and block cookies, and browse in a private mode. Blocking cookies may mean parts of our website, including the broker and customer portals, do not work properly.

Most browsers also offer a ‘Do Not Track’ signal. There is currently no consistent industry standard for responding to these signals, and our website does not respond to them.

8.4 Third party analytics and advertising

We use third party analytics and advertising services to measure and improve our website and campaigns. These providers may set their own cookies and collect information about your visit, subject to their own privacy policies. Where these services are provided by organisations located overseas, your information may be processed outside Australia — see section 7.

We do not build or use audience segments based on religion, ethnicity or any other sensitive attribute for advertising purposes.

8.5 Links to other websites

Our website contains links to third party websites, including funder sites, calculators, Islamic finance and community organisations, social media pages and industry bodies. We are not responsible for the content or privacy practices of those websites. We encourage you to read the privacy policy of any website you visit through a link from ours.

8.6 Social media

We maintain pages on social media platforms. If you interact with us on those platforms, the platform operator will collect and handle your information under its own privacy policy and terms. We may also use social media platforms to deliver advertising to audiences that match criteria we specify, or to email addresses we upload in a hashed form. We do not receive your personal information back from these platforms as a result of that advertising.

9How we hold and protect your information

We hold personal information in a combination of secure electronic systems and, where necessary, physical records. All of our systems are cloud-based platforms, including Amazon Web Services (AWS), hosted in Australian data centres, with access restricted to authorised personnel.

We take steps that are reasonable in the circumstances to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. These steps include:

• role-based access controls, so staff and contractors can access only the information they need to do their job;
• multi-factor authentication and device management controls on the systems that hold personal information;
• encryption of data in transit and at rest across our core systems;
• secure, managed devices, endpoint protection and network security controls;
• confidentiality and privacy obligations in employment contracts and service provider agreements;
• privacy and security training for our staff, and monitoring of access to sensitive records; and
• regular review of our systems, suppliers and controls.

No method of transmission or storage is completely secure. While we take reasonable steps to protect your information, we cannot guarantee the security of information you send to us over the internet, and you do so at your own risk. Please do not send us complete identity document numbers, account numbers or Tax File Numbers by unsecured email or social media — use our secure portal or telephone us instead.

Data breaches

We maintain a data breach response plan. If we suffer a data breach that is likely to result in serious harm to any individual whose information we hold, we will notify the affected individuals and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act.

How long we keep your information

We keep personal information for as long as we need it for the purposes described in this Privacy Policy, and for as long as the law requires us to keep it. In particular, the National Consumer Credit Protection Act 2009 (Cth) and the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) require us to keep certain credit and identification records for at least seven years after our relationship with you ends or the relevant transaction is completed. Some records must be kept for longer, for example where a complaint, dispute or legal proceeding is on foot. When we no longer need personal information and are no longer required to keep it, we take reasonable steps to destroy it or to de-identify it.

10Automated decision making

We use automated tools — including credit scoring, serviceability calculators, policy rules engines and, in some cases, artificial intelligence tools — to help assess enquiries and applications, to check documents, and to route work within our business. These tools support our people; a decision that affects you is reviewed by a person before it is made. If you would like to know more about how a decision about your application was reached, please contact us.

Our chat service and AI assistant

When you use the chat on our website or partner portal, or email us, an AI assistant called Noor may reply first. Noor gives general information only and does not give credit, financial, tax, legal or religious advice. You can ask to speak with a person at any time.

We collect the messages you send, any contact details you give us (such as your name, email address and phone number), and technical information about your device and the page you were on. If you are logged in to our partner portal, we also link the chat to your partner account and your accreditation status. We use this information to answer your enquiry, pass it to the right team, contact you about it, keep records of our dealings with you, and improve our service. If you ask about a type of finance we do not yet offer and choose to leave your phone number and email, we use them only to contact you about that enquiry and to let you know when it becomes available.

Our chat provider, Intercom, hosts chat information and runs the AI assistant in Australia. Please do not send tax file numbers, bank or card numbers, or identity documents in chat.

11Accessing and correcting your information

Access

You may request access to the personal information, credit information and credit eligibility information we hold about you. Please make your request to our Privacy Officer using the details in section 13. We will need to verify your identity before we release any information.

We will usually respond to a request for access within 30 days. We do not charge a fee for making a request. We may charge a reasonable fee for the time and cost of retrieving and providing the information, and we will tell you what that fee is before we incur it. We do not charge for access to credit eligibility information where the law says we must provide it free of charge.

In some circumstances we may refuse access — for example where giving access would have an unreasonable impact on the privacy of others, where the request is frivolous or vexatious, where the information relates to anticipated legal proceedings, or where the law requires or authorises us to refuse. If we refuse, we will tell you why in writing and how you can complain.

Correction

If you believe the information we hold about you is inaccurate, out of date, incomplete, irrelevant or misleading, please tell us and we will take reasonable steps to correct it. We will usually respond within 30 days. If the information came from, or has been disclosed to, a credit reporting body or another credit provider, we will consult with them and, where a correction is made, notify them and you. We will tell you in writing if we decide not to make a correction and why, and you may then ask us to associate a statement with the information or make a complaint.

12Complaints

If you believe we have breached the Australian Privacy Principles, Part IIIA of the Privacy Act or the Privacy (Credit Reporting) Code, or you are unhappy with how we have handled your personal information, please tell us. We take privacy complaints seriously and we will try to resolve them quickly and fairly.

Step 1 — Contact us

Contact our Privacy Officer using the details in section 13. Please describe your concern, what you would like us to do to resolve it, and include a telephone number and email address so we can contact you. We will acknowledge your complaint promptly and we will respond in writing within 30 days. If we need more time, we will tell you why and keep you updated. Because we are an Authorised Credit Representative, your complaint may also be handled by our licensee, Kuone Pty Ltd.

Step 2 — Australian Financial Complaints Authority

If you are not satisfied with our response, or we do not respond within 30 days, you can refer your complaint to the Australian Financial Complaints Authority (AFCA), the free and independent external dispute resolution scheme that covers us through our licensee. Islamic Finance Partners Pty Ltd is AFCA member 121013, and our licensee, Kuone Pty Ltd, is AFCA member 46066.

• Online: www.afca.org.au
• Email: info@afca.org.au
• Telephone: 1800 931 678 (free call)
• Mail: Australian Financial Complaints Authority, GPO Box 3, Melbourne VIC 3001

Step 3 — Office of the Australian Information Commissioner

You may also complain to the Office of the Australian Information Commissioner (OAIC). The OAIC will generally expect you to have raised your complaint with us first.

• Online: www.oaic.gov.au
• Email: enquiries@oaic.gov.au
• Telephone: 1300 363 992
• Mail: Office of the Australian Information Commissioner, GPO Box 5218, Sydney NSW 2001

13How to contact us

If you have a question about this Privacy Policy, want to access or correct your information, want to opt out of marketing, or want to make a privacy complaint, contact our Privacy Officer:

A copy of this Privacy Policy is available free of charge on our website at www.riyadhfs.com.au, and we will provide a copy in an alternative format on request.

14Changes to this Privacy Policy

We review this Privacy Policy regularly and may update it from time to time to reflect changes to our business, our systems or the law. The current version is always published at www.riyadhfs.com.au. The date it was last updated is shown at the start of this Privacy Policy. Where a change is significant, we will take reasonable steps to bring it to your attention. Your continued use of our website and services after a change takes effect means you accept the updated policy.