1 INTRODUCTION
1.1 OVERVIEW
This First American group of companies consists of the following (jointly and severally, as relevant, the “Group”,“We” and “Us”):
• First Mortgage Services Limited (incorporated in NZ). (“FMS”)
• FMS Administration Limited (incorporated in NZ).
• First Mortgage Services Pty Ltd ABN 49 110 202 429 (incorporated in Aust) (“FMSA”)
• First Mortgage Services Australia Pty Ltd ABN 37 159 300 580 (incorporated in Aust).
• First American Title Insurance Company of Australia Pty Ltd ACN 075 279 908 (“First Title”)
• Propel-lc Ltd Company Number 3061754
• First American Title Insurance Company of Australia Pty Ltd Company Number 1022212
We respect your and each individual’s (together “you” and “your”) right to privacy and are committed to protecting any personal information provided to us.
FMS and FMSA provide back office services to the mortgage industry from both New Zealand and Australia and First Title provides refinance services to New Zealand lenders. We collect personal information from individuals on behalf of various lenders and other entities in the mortgage industry in order to provide those services. In providing such services, FMS, FMSA and First Title acknowledge we are bound by:
• The New Zealand Privacy Act 2020.
• The Australian Privacy Act 1988, as amended (both the “Acts”).
• The New Zealand Information Privacy Principles. A summary of the Principles is found in NZ Privacy Principles.
• The Australian Privacy Principles (both the “Principles”). The Principles set out the minimum standard of privacy protection in relation to the collection, holding, use, disclosure, management, access, correction and disposal of personal information.
1.2 SCOPE AND PURPOSE OF POLICY
This Policy applies to all Group employees. The Policy sets out minimum standards Group employees must observe when dealing with any personal information relating to customers and clients. Personal information is any information or an opinion about an individual from which their identity is apparent or can reasonably be ascertained.
This policy is not intended to apply to personal information held in relation to employees and contractors.
1.3 YOUR ROLE
You should be familiar with the contents of our internal policies relating to privacy and our external Privacy Policy. Compliance with privacy legislation and our policies and procedures is mandatory.
We have set out in this Policy further detail on how we collect, use and disclose personal information. You should not collect, use or disclose personal information unless you have a good reason and in accordance with our internal policies (including this Policy). In general, you should only use and share personal information where necessary to carry out the functions for which we collected it, or if required by law.
1.4 PRIVACY BREACH
We are required to notify certain privacy breaches to regulators (such as the New Zealand Privacy Commissioner) and affected individuals.
Privacy breaches can be categorised as one or more of the following:
• Confidentiality or integrity breach – unauthorised or accidental access to, or disclosure, alteration, loss, or destruction of, the personal information; or
• Availability breach – an action that prevents us from accessing the information on either a temporary or permanent basis.
If you suspect or become aware of a privacy breach, it is very important that you refer to our Incident Management Policy and Incident Management Guidelines. The breach must be managed following our approved and regularly reviewed Incident Management Policy and Incident Management Guidelines. This Policy and Guidelines include further detail on notifying individuals and regulators (such as the Office of the Privacy Commissioner) when a notifiable data breach has occurred.
1.5 RELATED DOCUMENTS
• Information Security Policy
• Incident Management Policy and Incident Management Guidelines
• Records Management Policy
1.6 MORE INFORMATION
Should you have a question or require further information regarding this Policy or the way we manage personal information, please contact:
The Privacy Officer
First Mortgage Services Limited
Level 1, 110 Mount Eden Road, Mount Eden, Auckland 1024
PO Box 2873, Auckland 1140
Tel + 61 2 4003 6873
www.firstms.com
privacy@nz.firstms.com
2. PERSONAL INFORMATION
2.1 TYPES OF PERSONAL INFORMATION HELD
Generally, FMS, FMSA and First Title holds personal information about all parties to an application for a secured loan, as well as the settlement, transactional history and discharge of such loans. The personal information may consist of various types of information and data relating in some way to the above, including the:
• Name, address and contact details.
• Age, marital relationship and dependants.
• Ownership of property and estimated property value.
• Amounts and nature of a secured financial transaction.
• Loan and mortgage terms and conditions and nature and extent of each individuals’ obligations.
• Financial transactions and interest allocations for the life of the loan
• In the case of a refinance transaction, details of the outgoing and incoming lender and details as to the quantum of the outgoing loan.
2.2 HOW PERSONAL INFORMATION IS COLLECTED
Generally, FMS, FMSA and First Title act for lenders in the mortgage industry, though in some instances may act for individual borrowers. Accordingly, FMS, FMSA and First Title collects personal information by way of the following sources (as authorised by the individual):
• The individual.
• The individual’s mortgage broker or consultant.
• Legal adviser.
• Lender.
• Lender’s title or mortgage insurer.
The information comes to FMS, FMSA and First Title either through direct data links between FMS, FMSA and First Title and those sources (data transported over these links is secured using firewall-to-firewall IPSEC protocols) or as forms, both paper and electronic, by telephone, facsimile or e-mail.
You must not collect information via unlawful means or by means that are unfair or intrude to an unreasonable extent on the personal affairs of the individual concerned.
2.3 HOW PERSONAL INFORMATION IS USED
Unless otherwise permitted by our policies, you should only use the personal information we collect in furtherance of the services we provide to our clients. Those services include:
• Verification of the individual’s identity and assisting in providing information regarding the loan transaction and providing a quality service.
• The approval process and underwriting of mortgage lending.
• The preparation of loan and mortgage documentation.
• Obtaining title insurance and updating the insurer’s network.
• The settlement of loan transactions.
• The registration of mortgage documentation.
• The enforcement of outstanding loans.
• The provision of relevant refinance services to the incoming lender.
• For other uses that are specifically authorised by the individual.
Within the Group, access by Group employees to data and personal information is limited to only that access required by the role of the employee in order to perform their role. This means that you should only access personal information on a “need to know” basis.
2.4 SHARING PERSONAL INFORMATION
You should only use personal information for the purposes for which it was collected.
Unless we obtain the individual's consent or we are compelled by law, you should only share the individual’s personal information with the following parties:
• The individual concerned;
• The individual’s mortgage broker or consultant, adviser, lender or lender’s insurer
• The individual’s legal adviser
• Any other party as authorised by the individual
• Members of the Group
• Sanderson Weir Pty Ltd ABN 97 110 336 359 (incorporated in Australia) where this is required to complete a refinance
• Sanderson Weir Ltd Company Number 4163338 where this is required to complete a refinance or a multi-party eDealing; and/or Governmental authorities or regulatory bodies where it is required to complete a transaction (for example rates enquiries or registration of a security) or we are under a legal obligation to do so (for example, in connection with an investigation of fraud or any activity that is illegal or that exposes us to legal liability)
From time to time, it may also be necessary for us to disclose an individual's personal information to external service providers we engage to assist with the services we provide to our clients (as set out in How Personal Information is Used above).
When dealing with an individual’s legal adviser, we rely on the information we have already received to take reasonable steps in the circumstances to verify whether the legal adviser is acting for the individual concerned. For example, the individual will normally specify on an application for a loan who is acting as their legal adviser.
FMS does not sell, rent or otherwise make available any personal information, or any information regarding the loan and mortgage transaction to any other party unless specifically authorised by the individual.
2.5 STORAGE AND SECURITY OF PERSONAL INFORMATION
We comply with the Acts and ensure that all personal information is protected by a security system as is reasonable under the circumstances, against loss, unauthorised access, use, modification, disclosure or misuse. This includes physical security, computer and network security, communications security and personnel security.
We store personal information in the form of data, correspondence and other documentation within the confines of the secure offices in New Zealand and Australia during the life of an individual transaction. We also employ professional agents to attend to storage of completed correspondence files for individual transactions. We must only retain personal information for as long as we have a lawful purpose to keep it. You should destroy or de-identify personal information that is no longer needed for a business activity or function and where it is not required to be held in accordance with applicable legislation. Unless an exception exists, completed files are retained either electronically or in storage for 7 years, after which period they are destroyed, pursuant to our Information Security Policy and Records Management Policy.
We use 128-bit encryption technology to help prevent unauthorised access. All Internet-accessible data can only be accessed via authorized logons to https websites secured using a combination of Verisign and Thawte digital certificates.
You must protect the confidentiality of personal information and comply with the Information Security Policy.
2.6 HOW TO GAIN ACCESS TO YOUR PERSONAL INFORMATION
An individual has the right to request access to their personal information held by us. By requesting access, we will confirm whether or not we hold information about an individual and, if so, arrange for the individual to inspect the documents or obtain either a copy, summary, written transcript or oral summary of the information where required. There may be a cost for accessing such information depending on where it is held and how accessible it is and the resources required to provide that access.
If the information held is inaccurate, incomplete or not up to date, the individual may request us to correct the information.
Under the Acts, we may withhold personal information within the exceptions that are provided. We are required by law to respond to privacy requests within certain time periods. It is therefore important that you notify the Privacy Officer (at privacy@nz.firstms.com) as soon as possible to ensure that we can meet the response time requirements.
2.7 MANAGING A COMPLAINT ABOUT HOW PERSONAL INFORMATION IS HANDLED
Individuals have a right to complain about the way we handle personal information. Complaints should be directed to the Privacy Officer whose contact information is detailed below. If you become aware of a complaint, please notify the Privacy Officer as soon as possible.
