Privacy Policy

1. About this Privacy Policy

Endeavor Asset Management Pty Ltd (ACN 143 340 050) and the other members of the Freedom Finance Australia Group (referred to in this policy as “Endeavor,” “we,” “us” or “our”) recognise that the privacy of personal information is important, and are committed to handling personal information responsibly and in accordance with the law.

This Privacy Policy explains how we collect, hold, use, disclose and protect personal information about our clients, prospective clients, employees, contractors, job applicants and other individuals with whom we deal.

We handle personal information in accordance with:

the Privacy Act 1988 (Cth) (the Privacy Act) and the Australian Privacy Principles (APPs) set out in Schedule 1 of that Act;
the Privacy (Tax File Number) Rule 2015; and
other laws applicable to our business, including the Corporations Act 2001 (Cth), the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) and the Anti-Money Laundering and Counter-Terrorism Financing Rules Instrument 2007 (No. 1).

The APPs are available on the OAIC website at www.oaic.gov.au.

2. Who this policy covers

This policy applies to Endeavor Asset Management Pty Ltd and other members of the Freedom Finance Australia Group (the FFAU Group), including:

Endeavor Asset Management Pty Ltd (EAM);
FFA FP Pty Ltd, Freedom Finance Australia (Qld) Pty Ltd, Freedom Finance Australia Southern Metro Pty Ltd, Freedom Finance Australia (Essendon) Pty Ltd, FFA FP (Melb01) Pty Ltd, FFA FP (Ball01) Pty Ltd trading as Freedom Finance Australia (FFAU);
Boutique Wealth Australia Pty Ltd (BWA);
Cryptique Pty Ltd;
Freedom Finance Accounting Pty Ltd and FFAU Consulting Pty Ltd;
Freedom Finance MB Pty Ltd and Freedom Finance (MB) NSW Pty Ltd;
FIB Holdings Pty Ltd
Freedom Finance General Insurance Pty Ltd;
Planned Property Pty Ltd;
The Cleva Co Pty Ltd;
Freedom Business Services (Pvt) Ltd; and
other members of the FFAU Group from time to time.

Each entity in the FFAU Group applies the standards set out in this policy to the handling of personal information.

3. Anonymity and pseudonymity

Wherever it is lawful and practicable, you have the option of dealing with us anonymously or using a pseudonym. However, in most cases we will not be able to provide financial services, credit assistance, accounting services or other services to you without collecting information that identifies you — including because we are required by law to collect and verify your identity under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006. If you deal with us anonymously or by pseudonym, we may be limited in what we can do for you.

4. The personal information we collect

The kinds of personal information we collect depend on the nature of your dealings with us. It may include:

your name, date of birth, residential and postal addresses, telephone numbers, email address and other contact details;
proof-of-identity information required under the AML/CTF laws — including driver’s licence, passport, Medicare card, or other government-issued identification;
your tax file number and other government identifiers;
information about your family circumstances, dependants, occupation and employer;
information about your financial situation, including your income, expenses, assets, liabilities and existing insurances;
information about your investment experience, risk tolerance, goals and objectives;
bank account and payment details;
shareholding, portfolio and investment information;
your health information (only where you consent, and only for the purpose of providing personal insurance advice or arranging insurance);
records of communications between us (including telephone calls, emails, meeting notes and secure messaging);
login and access information for our client portals; and
information about your visit to our website (see section 5).

Sensitive information (which includes health information, racial or ethnic origin, political opinions, religious beliefs, sexual orientation and criminal record) is only collected with your consent and only where necessary for the purpose we have told you about. In the ordinary course, the only sensitive information we collect is health information relevant to an insurance recommendation, and only with your consent.

Where practicable, we will explain the purpose for which we are collecting information at the point of collection, and the consequences if you do not provide it.

5. How we collect personal information

Direct collection

We normally collect personal information directly from you when:

you complete an application, engagement or onboarding form for one of our services;
you attend a meeting with an adviser or team member (in person, by video or by phone);
you complete a questionnaire, fact-find or risk profile;
you correspond with us by email, secure message or letter;
you register on, or log in to, our client portal or website; or
you change your details or ask us to update our records.

Collection from third parties

With your consent (or where the law allows or requires it), we may collect personal information from third parties, including:

other members of the FFAU Group;
your accountant, solicitor, mortgage broker or other adviser (with your authority);
product providers, superannuation funds and insurance companies;
share registries;
ASIC and other government or regulatory bodies;
credit reporting bodies (where necessary for a credit-related service);
our service providers (see sections 7 and 8); and
publicly available sources.

Where it is practicable to do so, we will obtain a signed authority to collect information from third parties on your behalf.

Unsolicited information

If we receive personal information that we did not solicit, we will assess whether we could have collected it under APP 3. If not, we will destroy or de-identify it as soon as practicable, unless the law prevents us from doing so.

Website and online

When you visit our website, we may collect information about your visit through cookies and similar technologies, including your IP address, browser type, date and time of visit, and pages accessed. We use this information for website analytics and to improve our online services. Where you log in to our client portal, we also collect information about your session for security and service purposes.

6. Why we collect, hold, use and disclose personal information

We collect, hold, use and disclose personal information for the following purposes:

to provide financial product advice, credit assistance, accounting, tax, mortgage broking, general insurance broking, MDA and other services we offer;
to set up, manage and administer accounts, products and services;
to determine your needs and give you appropriate advice;
to complete customer due diligence and ongoing customer due diligence obligations under the AML/CTF Act, including verifying your identity and monitoring transactions;
to identify and manage risks (including credit, fraud and security risks);
to communicate with you and respond to your enquiries;
to send you information about products, services, reports and market commentary you may find useful (see section 12 for direct marketing);
to comply with legal and regulatory obligations, including under the Corporations Act, the Tax Administration Act, the AML/CTF Act and the Privacy Act;
to conduct internal auditing, compliance monitoring, complaint handling, dispute resolution and reporting;
to recruit, engage and manage employees, contractors and representatives;
for general management, reporting, billing and administration; and
other purposes made known to you at or around the time of collection.

7. Disclosure of personal information

We may disclose personal information to:

other members of the FFAU Group;
our advisers and staff, on a need-to-know basis;
product providers, superannuation trustees, custodians, insurers and other institutions relevant to providing our services;
share registries, settlement and clearing organisations;
your accountant, solicitor or other adviser with your authority;
our professional advisers (including auditors, legal advisers, insurance brokers and compliance consultants);
IT and communications service providers, including cloud hosting, secure document management and back-office administration providers;
credit reporting bodies (where necessary);
regulators, government agencies, courts, tribunals and law enforcement agencies where required or authorised by law (including ASIC, AUSTRAC, the ATO and the OAIC);
external dispute resolution schemes, including the Australian Financial Complaints Authority; and
any other person to whom you consent to us disclosing your information.

We will not sell or trade your personal information.

8. Overseas handling of personal information

Some of our employees are located outside Australia. Specifically, employees of Freedom Business Services (Pvt) Ltd — a related entity within the FFAU Group — work from our office in Sri Lanka and may access personal information as part of their day-to-day duties. Their functions include administrative processing, client servicing, account maintenance, IT operations and other operational support.

Our Sri Lanka-based employees are employed directly by a related entity within the FFAU Group. They are not engaged through a third-party outsourced service provider. They work within the same information security, privacy and confidentiality controls that apply to our Australian-based employees, and they are bound by the same confidentiality obligations.

How we comply with APP 8

In relation to this offshore handling:

we remain accountable for the acts and practices of our overseas personnel in relation to personal information, as required by Australian Privacy Principle 8.1 and section 16C of the Privacy Act; and
we have taken reasonable steps to ensure that our overseas personnel do not breach the APPs in relation to your personal information, including through internal policies, contractual obligations, staff training, technology controls and oversight.

Your consent

Consent to overseas handling

By providing personal information to us and continuing to use our services, you consent to your personal information being disclosed to, and accessed and handled by, our overseas employees in Sri Lanka for the purposes described above. This consent is given for the purposes of APP 8.2(b).

If you do not consent to this arrangement, please contact our Privacy Officer using the details in section 15 — although we may not be able to continue providing some or all of our services if we cannot share your information with our overseas team.

Other overseas providers

We may also use overseas service providers (for example, cloud hosting and secure document management providers) whose facilities may be located outside Australia. We take reasonable steps to ensure any such providers handle personal information in a manner consistent with the APPs.

9. Government identifiers

Tax file numbers

Where we collect tax file numbers, we do so in accordance with the Privacy Act, the Tax Administration Act 1953 and the Privacy (Tax File Number) Rule 2015. Providing your tax file number is not compulsory, but if you choose not to provide it we may be unable to complete some transactions on your behalf, and you may pay more tax than would otherwise apply. We use tax file numbers only for the purposes authorised by law and take reasonable steps to protect them from misuse, interference, loss and unauthorised access.

AML/CTF identification

As a holder of an Australian Financial Services Licence, and as a reporting entity under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006, we are required to collect and verify identification information from our clients. This may include your driver’s licence number, passport number, Medicare card details or other government-issued identifiers. This collection is required by law, and we cannot provide services to you if you do not provide this information. We handle these identifiers strictly for the purposes authorised by the AML/CTF laws.

Other government identifiers

We do not adopt any government-related identifier as our own identifier for you, except where permitted by law.

10. Security of personal information

We take reasonable steps to protect personal information we hold from misuse, interference and loss and from unauthorised access, modification or disclosure. These steps include:

staff training on privacy and information handling;
role-based access controls that limit access to personal information to authorised personnel who need it for their duties;
physical security controls for our offices and physical records;
technology controls, including firewalls, endpoint security, encryption of data in transit and (where appropriate) at rest, and multi-factor authentication;
secure disposal of physical and electronic records when no longer required;
due diligence and contractual protections when engaging service providers who handle personal information on our behalf; and
monitoring of our systems for unauthorised access or unusual activity.

No security measure is perfect. If you become aware of any suspected unauthorised access to your information, please contact us immediately using the details in section 15.

11. Notifiable data breaches

If we suspect there may have been an eligible data breach — broadly, unauthorised access to or disclosure of personal information, or loss of personal information in circumstances where unauthorised access or disclosure is likely, that is likely to result in serious harm to an individual — we will conduct an assessment within 30 days as required by section 26WH of the Privacy Act.

If we determine that an eligible data breach has occurred, we will:

notify affected individuals as soon as practicable; and
notify the OAIC as required by section 26WK of the Privacy Act.

Where notification to individuals is not practicable, we will publish a notification on our website in accordance with the Privacy Act.

12. Direct marketing

We may use your personal information to send you information about our products and services, market updates and research, invitations to events, and other information we believe may be of interest to you. We may also disclose your information to other members of the FFAU Group for the same purposes.

You can opt out at any time. Every direct marketing communication we send will include a simple unsubscribe mechanism. You can also opt out at any time by contacting our Privacy Officer using the details in section 15. Opting out of direct marketing will not affect the services we provide to you.

We do not sell or trade your personal information for direct marketing purposes.

13. Access and correction

You have a right to request access to the personal information we hold about you, and to ask us to correct any information that is inaccurate, out-of-date, incomplete, irrelevant or misleading.

To make a request, please contact our Privacy Officer using the details in section 15. We will normally respond to a request within 30 days. There is generally no fee to make a request, but we may charge a reasonable fee for the cost of retrieval, copying and delivery of your information — we will tell you if a fee applies before we incur any cost.

In some circumstances, we may refuse a request for access or correction, for example where the request is unlawful, would prejudice an investigation, or would unreasonably impact another person’s privacy. If we refuse a request, we will provide our reasons in writing and let you know how you can complain if you are not satisfied with our decision.

14. Retention and destruction

We keep personal information only for as long as we need it for the purposes we collected it for, or for as long as we are required to keep it by law.

Under laws that apply to us — including the Corporations Act, the Tax Administration Act and the AML/CTF Act — we are required to keep certain records for at least 7 years after our client relationship with you ends (or from the date of the transaction or advice, depending on the record).

When personal information is no longer required for a lawful purpose, we take reasonable steps to destroy it securely or to de-identify it.

15. How to contact us and complaints

Our Privacy Officer is the primary contact for privacy matters. You can contact the Privacy Officer to:

ask a question about this policy;
request access to, or correction of, your personal information;
opt out of direct marketing;
make a complaint about the handling of your personal information; or
raise any other privacy concern.

Contact details

Privacy Officer Endeavor Asset Management Pty Ltd
Address: Level 7, 5 Queens Road, Melbourne VIC 3004
Phone: 1800 662 891

Email: operations@endeavoram.com.au

How we handle privacy complaints

We take privacy complaints seriously. We will acknowledge your complaint within 5 business days, investigate promptly, and respond in writing within 30 days. If we need more time to complete our investigation, we will let you know.

If you are not satisfied with our response

If we have not resolved your complaint to your satisfaction within 30 days, you can:

refer your complaint to the Australian Financial Complaints Authority (AFCA) — where the complaint relates to a financial service we provide to you. AFCA is free to consumers. You can contact AFCA at www.afca.org.au, info@afca.org.au or 1800 931 678; or
refer your complaint to the Office of the Australian Information Commissioner (OAIC), which can consider privacy complaints. You can contact the OAIC at www.oaic.gov.au or 1300 363 992.

16. Changes to this policy

We may update this policy from time to time to reflect changes in our practices, our services, or the law. The current version is always available at endeavoram.com.au.

You should check our website periodically for updates.

If you are an existing client, we will also let you know about material changes through our normal client communication channels.