This Privacy Policy explains how Hobart Loans collects, holds, uses and discloses personal information when you read our website, use our tools, subscribe to our newsletter or ask us for a free loan-readiness review. We have written it to be read, not just to exist, so it describes what our website actually does and nothing more.
Privacy at a glance
- We only collect personal information you choose to give us through our forms or by emailing us.
- We do not set third-party advertising or analytics cookies by default, and our fonts, scripts and icons are self-hosted. The few items saved in your browser stay on your device (see our Cookie Policy).
- We do not sell, rent or trade personal information, and we only refer you to a credit licensee if you ask and consent, after disclosing any referral fee.
- You can access or correct your information, unsubscribe at any time, and complain to us or to the OAIC.
Scope of this policy
This policy applies to personal information handled by Hobart Loans in connection with:
- the website at hobartloans.com, including our articles, guides, glossary, FAQ and loan calculator and other tools;
- our free loan-readiness guidance service described on our services page;
- our email newsletter; and
- emails and other correspondence you send to us.
It does not apply to websites or services operated by others, including lenders, brokers, advertisers and government agencies we link to, which have their own privacy policies.
In this policy, "Hobart Loans", "we", "us" and "our" refer to the operator of hobartloans.com. "You" and "your" refer to anyone who visits our website or deals with us. "Personal information" has the meaning given in the Privacy Act 1988 (Cth): information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether true or not and whether recorded in a material form or not.
Who we are
Hobart Loans is an independent personal- and business-finance publication based in Hobart, Tasmania, Australia. We publish general information and education about borrowing, and we offer a free loan-readiness guidance service that helps people understand their options, organise their documents and prepare before they speak to a lender or broker. You can read more on our About us page.
We are not a lender, we do not hold an Australian Credit Licence, and we do not provide personal financial advice.
Our publication is funded by advertising and sponsorship (see Advertise here) and, where a reader asks to be referred and agrees to it, possibly by referral fees that we disclose in advance. Sponsored content on our website is always labelled as such.
The Privacy Act and the Australian Privacy Principles
The Privacy Act 1988 (Cth) (Privacy Act) regulates how many organisations in Australia handle personal information. At its centre are the 13 Australian Privacy Principles (APPs), which set standards for the collection, use, disclosure, quality, security, access and correction of personal information.
Some small businesses are not required to comply with the Privacy Act. Regardless of whether a legal exemption might apply to us at any point in time, we have chosen to handle personal information in line with the APPs, because readers trust us with information about their finances and we think that trust should be met with clear, consistent standards.
This policy is our APP 1 privacy policy. It covers anonymity (APP 2), collection and notification (APPs 3 to 5), use and disclosure (APP 6), direct marketing (APP 7), cross-border disclosure (APP 8), government related identifiers, which we do not collect (APP 9), quality and security (APPs 10 and 11), and access and correction (APPs 12 and 13).
You can read more about the APPs on the OAIC's website at oaic.gov.au.
What personal information we collect
We aim to collect only the information we reasonably need for the purpose for which you give it to us. The table below sets out each source of personal information, what we collect and why.
| Source | Information collected | Purpose |
|---|---|---|
| Contact / free review request form | Name; email address; phone number (optional); the service you are interested in; an approximate amount range (optional); your preferred contact method; your message; your consent confirmation (the consent checkbox) | To respond to your enquiry, provide free loan-readiness guidance you request, and, only if you ask and agree, arrange a referral to an Australian Credit Licence holder |
| Newsletter sign-up form | Email address only; a record of your confirmation (double opt-in) and any later unsubscribe | To send you our newsletter, to prove your consent, and to make sure we stop emailing you when you unsubscribe |
| Emails and other correspondence you send us | Your email address, name (if included) and anything you choose to write, including any attachments | To read and reply to your message, handle corrections, complaints or privacy requests, and keep a record of our dealings |
| Server logs kept by our hosting provider | IP address, browser and device type (user agent), pages requested, date and time of requests | Website security, preventing abuse and diagnosing technical faults |
| Browser storage on your own device | Your cookie consent choice, bookmarked articles, ticked checklist items, last calculator inputs, and your first name for the thank-you page (session only) | Making website features work for you. This information stays in your browser and is not sent to us. See our Cookie Policy |
Information we do not ask for
We do not ask for, and you should not send us:
- your tax file number (TFN) or any other government related identifier, such as a Medicare number, driver licence number or passport number;
- internet banking usernames, passwords or security codes;
- credit card or debit card numbers; or
- copies of identity documents such as passports, driver licences or birth certificates.
Email is not a secure way to send identity documents. If a licensed lender or broker you are referred to needs to verify your identity, they will tell you how to provide documents through their own secure processes.
How we collect personal information
We collect personal information directly from you when you:
- complete and submit our contact / free review request form;
- sign up for our newsletter and confirm your subscription through the confirmation email;
- email us, or reply to an email we have sent you; or
- make a privacy request, correction request or complaint.
When you submit a form, the information is processed by our website's hosting and form-processing provider and delivered to the Hobart Loans email inbox. We do not buy personal information from data brokers.
Technical information in server logs is collected automatically by our hosting provider when your browser requests pages from our website. This is standard for almost all websites and is used for security and reliability.
Unsolicited information
If we receive personal information we did not ask for (such as an identity document attached to an email) and could not have collected it under the APPs, we will destroy or de-identify it as soon as practicable where lawful and reasonable.
Sensitive information
Under the Privacy Act, "sensitive information" includes health, racial or ethnic origin, political opinions, religious beliefs, sexual orientation, criminal record, union membership and certain biometric and genetic information.
We do not seek sensitive information, and our forms do not ask for it. Please do not include sensitive information in your messages. If you do choose to tell us something sensitive (for example, that a health issue has affected your income and you want to understand hardship options), we will only use it to respond to your enquiry, we will not disclose it without your express consent unless required by law, and we will delete it when it is no longer needed.
Why we collect and how we use personal information
We use personal information for the primary purpose for which it was collected, and for related secondary purposes you would reasonably expect, or otherwise as permitted or required by law. Specifically, we use it to:
- respond to your questions and requests through your preferred contact method;
- provide the free loan-readiness guidance you ask for, which is general in nature and helps you understand options and prepare documents;
- with your express consent, refer you to an Australian Credit Licence holder and tell you about any referral fee or commission beforehand;
- send you our newsletter if you have subscribed and confirmed your subscription;
- handle correction requests, feedback, complaints and privacy requests;
- keep our website secure and prevent spam and misuse;
- keep business records (including referral fee records) and comply with our legal obligations.
We do not make automated decisions about you, build advertising profiles or assess your creditworthiness. Credit decisions are made by lenders, not by us.
The calculators and checklists on our website run in your browser. The figures you enter are used to produce an estimate on your screen and are not sent to us.
Direct marketing and the Spam Act 2003
Our only marketing emails are our newsletter, which you receive only after signing up and confirming through the link in a confirmation email (a "double opt-in").
We comply with the Spam Act 2003 (Cth) and APP 7. In particular:
- Consent: we only send commercial electronic messages with your consent.
- Identification: every newsletter clearly identifies Hobart Loans as the sender and includes our contact email address.
- Unsubscribe: every newsletter contains a working unsubscribe link. You can also unsubscribe by emailing [email protected]. We action unsubscribe requests promptly, and in any event within five business days.
Submitting the contact / free review request form does not subscribe you to the newsletter. We will use your details to reply to your enquiry, but we will not add you to marketing emails unless you separately sign up.
We do not give personal information to advertisers or sponsors, and advertising on our website is not targeted using your personal information.
When we disclose personal information
We disclose personal information only in the limited circumstances described below, or where you have consented, or where it is otherwise required or authorised by law.
| Recipient | What may be disclosed | Why |
|---|---|---|
| Website hosting and form-processing provider | Form submissions and server log data | To host our website, process form submissions and deliver them to our inbox, and keep the website secure |
| Email service providers | Emails you send and we send, and your newsletter subscription details | To operate our inbox and send the newsletter, including confirmation and unsubscribe functions |
| Australian Credit Licence holders (lenders or brokers) | Only the details you agree we can share for your referral | To make a referral that you have asked for and expressly consented to |
| Professional advisers | Information relevant to the matter | Where we need advice from our lawyers, accountants or auditors, who are bound by confidentiality obligations |
| Courts, regulators and law enforcement agencies | Information required by the request or by law | Where we are required or authorised by law, for example under a subpoena, warrant or notice, or to report suspected unlawful activity |
Our service providers
Our service providers handle personal information on our behalf and receive only what they need to provide their services.
Referrals to Australian Credit Licence holders
We will never pass your details to a lender or broker without your express consent. Before any referral, we will tell you who we propose to refer you to, what information will be shared, and whether we will receive a referral fee or commission and, where known, how much or how it is calculated. You are free to say no. Once your information has been passed to a licensee with your consent, that licensee's own privacy policy and credit-related legal obligations apply to how it handles your information.
If our publication is ever sold or restructured, personal information may transfer to the new operator on condition that it continues to be handled consistently with this policy.
Overseas disclosure
Some of the service providers we use to host our website, process forms and handle email may store or process information outside Australia, for example in the United States or countries of the European Union, including on cloud infrastructure that spans several countries. The exact location can depend on the provider's infrastructure at any given time.
In line with APP 8, before personal information is disclosed to an overseas recipient, we take reasonable steps to ensure that the recipient does not breach the APPs in relation to that information. These steps include choosing established providers that publish privacy and security commitments, reviewing their terms on how they handle customer data, and limiting what is shared with them to what is needed for the service. Where we cannot be satisfied that a provider will handle information appropriately, we will not use it.
How we protect personal information
We take reasonable steps to protect the personal information we hold from misuse, interference and loss, and from unauthorised access, modification or disclosure. These steps include:
- serving our website over an encrypted HTTPS connection, so form submissions are encrypted in transit between your browser and our hosting provider;
- self-hosting our fonts, scripts and icons, so loading our pages does not send your data to third-party content networks;
- using strong, unique passwords and multi-factor authentication on the accounts we use to access email, hosting and newsletter services, where these are available;
- keeping software and devices we use up to date; and
- deleting or de-identifying information we no longer need (see Retention).
No method of transmitting or storing information is completely secure, which is one reason we ask you not to email identity documents or account credentials.
How long we keep personal information
We keep personal information only for as long as we need it for the purposes described in this policy, or as long as required by law. When it is no longer needed, we take reasonable steps to securely delete or de-identify it.
| Type of information | Retention period |
|---|---|
| Contact / free review enquiries that do not lead to a referral | Up to 24 months after our last contact with you, so we can follow up on your enquiry if you return, then deleted |
| Records of referrals and any referral fees received | At least five years after the referral, as needed to meet tax and record-keeping obligations |
| General correspondence, corrections and feedback | Up to 24 months after the matter is resolved |
| Privacy requests and complaints | Up to five years after the matter is closed, so we can show how it was handled |
| Newsletter subscription | Until you unsubscribe. After that, your email address is kept only on a suppression list so we do not email you again |
| Server logs kept by our hosting provider | A limited period set by the provider for security and troubleshooting, after which they are deleted or overwritten |
| Browser storage on your device | Local storage items stay until you clear them; session storage is cleared when you close the tab. See our Cookie Policy |
We may keep information for longer if we are required to by law, or if it is reasonably needed to deal with a dispute, complaint or legal claim.
Accessing and correcting your information
Access (APP 12)
You may ask for access to the personal information we hold about you. To do so, email [email protected] with the subject "Privacy" and tell us what you are asking for. We may need to verify your identity before providing information, usually by confirming details through the email address we have on file. We will not ask you to send identity documents by email.
We do not charge for making a request. We will respond within a reasonable period, and in any event within 30 days of receiving your request. We will generally provide access in the way you ask, such as by email.
In limited circumstances permitted by the Privacy Act (for example, where access would unreasonably affect someone else's privacy or would be unlawful) we may refuse access. If so, we will explain why in writing and tell you how to complain.
Correction (APP 13)
We take reasonable steps to make sure the personal information we hold is accurate, up to date, complete, relevant and not misleading (APP 10). If you believe information we hold about you is wrong, email us and we will correct it. We will respond within 30 days. If we decide not to make a correction, we will tell you why, and you may ask us to attach a statement to the information noting that you believe it is inaccurate. If we have previously disclosed the information to another organisation, you can ask us to notify them of the correction, and we will do so unless it is impracticable or unlawful.
Deleting information
You can also ask us to delete personal information we hold about you. We will do so unless we need to keep it to meet a legal obligation (such as tax record-keeping for referral fees) or to deal with a dispute or complaint, in which case we will explain this to you.
Anonymity and pseudonymity
You can read every article on our website, use our loan calculator and other tools, and download or tick off our checklists without telling us who you are. You can also email us a general question using a pseudonym.
However, we cannot respond to a form submission without a way to contact you, and we cannot make a referral to a lender or broker on your behalf without your real name and contact details. Our general guides remain open to everyone.
Notifiable data breaches
The Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act requires organisations covered by the Act to notify affected individuals and the OAIC about an eligible data breach. An eligible data breach is one involving unauthorised access to, unauthorised disclosure of, or loss of personal information that is likely to result in serious harm to any of the individuals concerned, where the harm has not been prevented by remedial action.
If we suspect a data breach, we will act quickly to contain it, assess it, and take steps to reduce any harm. Consistent with the NDB scheme, we will aim to complete our assessment within 30 days. Where a breach is likely to result in serious harm, we will notify the people affected and the OAIC as soon as practicable, and tell you what happened, what information was involved, and what steps we recommend you take.
Children
Our website and services are intended for adults. They are not directed to people under 18, and we do not knowingly collect personal information from anyone under 18. Our free review service and newsletter are only available to people aged 18 or over. If you believe a person under 18 has given us personal information, please contact us and we will delete it.
Visitors in the European Union and United Kingdom
To the extent that the EU General Data Protection Regulation (GDPR) or the UK GDPR and Data Protection Act 2018 apply to our handling of your personal information, this section explains additional rights. Hobart Loans is the controller of personal information collected through our website.
Lawful bases for processing
| Processing activity | Lawful basis |
|---|---|
| Responding to your enquiry or free review request | Steps taken at your request, and our legitimate interest in answering people who contact us |
| Referring you to an Australian Credit Licence holder | Your consent |
| Sending our newsletter | Your consent (confirmed by double opt-in) |
| Keeping a suppression list after you unsubscribe | Our legitimate interest in, and legal obligation of, not emailing you again |
| Server logs for security | Our legitimate interest in keeping the website secure and working |
| Optional browser storage (preferences such as bookmarks and calculator memory) | Your consent, given through our cookie banner |
| Keeping business and tax records; responding to lawful requests | Legal obligation |
Your rights
Subject to conditions and exceptions in the law, you have the right to:
- be informed about how your personal data is used (this policy);
- access a copy of your personal data;
- have inaccurate data rectified;
- have your data erased;
- restrict our processing of your data;
- receive data you provided to us in a structured, commonly used, machine-readable format (data portability);
- object to processing based on our legitimate interests, and to direct marketing at any time;
- withdraw consent at any time, without affecting the lawfulness of processing before you withdrew it; and
- not be subject to decisions based solely on automated processing that produce legal or similarly significant effects (we do not make such decisions).
To exercise these rights, email [email protected] with the subject "Privacy". We will respond within one month, which may be extended where the law allows. You also have the right to lodge a complaint with the data protection supervisory authority in the EU member state where you live or work, or, in the United Kingdom, with the Information Commissioner's Office (ICO). We would appreciate the chance to address your concern first.
California and other jurisdictions
Residents of California and some other places have rights under local privacy laws, such as the right to know what personal information is collected, to request deletion, and to opt out of the "sale" or "sharing" of personal information. We do not sell personal information, and we do not share it for cross-context behavioural advertising. Wherever you live, you can ask us to access, correct or delete your personal information as described in this policy, and we will not discriminate against you for making a request.
Making a privacy complaint
If you are concerned about how we have handled your personal information, please tell us. We take complaints seriously and will deal with them fairly.
Contact us in writing
Email [email protected] with the subject "Privacy". Describe your concern, what happened and, if you can, what outcome you are seeking.
We acknowledge your complaint
We will acknowledge your complaint within 5 business days of receiving it, and let you know if we need more information.
We investigate and respond
We will look into your complaint and give you a written response within 30 days. If a matter is complex and we need more time, we will tell you why and when to expect a response.
Escalate to the OAIC if you are not satisfied
If you are not satisfied with our response, or you have not heard from us within 30 days, you can complain to the Office of the Australian Information Commissioner (OAIC). Visit oaic.gov.au or call 1300 363 992. The OAIC generally expects you to have raised your complaint with the organisation first.
Complaints about a lender or broker you were referred to should be raised with that business, and then with the Australian Financial Complaints Authority (AFCA) if unresolved.
Changes to this policy
We may update this policy from time to time, for example if we change service providers, add a new feature, or if the law changes. In particular, if we ever enable website analytics, we will use a privacy-friendly analytics tool, we will only run it after you consent through our cookie banner, and we will update this policy and our Cookie Policy before doing so.
Updates will be published here with a new "last updated" date, and if a change materially affects information we already hold, we will take reasonable steps to let affected people know.
Contact us
For questions, requests or complaints about privacy, contact:
- Hobart Loans, Hobart, Tasmania, Australia
- Email: [email protected] (please use the subject line "Privacy")
You can also reach us through our Contact us page. Related documents: Cookie Policy, Terms and Conditions and Disclaimer.
