1. About us and this policy

Trivelli Capital Pty Ltd (ABN 52 694 935 941, Credit Representative No. 577722 (authorised under AFG ACL 389087)) ("Trivelli Capital", "we", "us", "our") is a specialist mortgage broking business operating under the National Consumer Credit Protection Act 2009 (Cth) (NCCP Act). We provide credit assistance to consumers seeking residential mortgage products, with a focus on property investors.

This Privacy Policy explains how we collect, hold, use and disclose personal information, and how we comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

This policy applies to all personal information we collect in connection with our mortgage broking services, our website at trivellicapital.com.au, and any other interaction you have with us.

2. What personal information we collect

The types of personal information we collect depend on the nature of your engagement with us and may include:

Identity and contact

• Full name, date of birth, and marital status
• Residential address (current and previous)
• Phone number and email address
• Driver's licence number and expiry date
• Citizenship and residency status, visa type and expiry
• Foreign tax residency status and Tax Identification Number (FATCA/CRS)

Financial information

• Employment type, employer details, income, and occupation
• Business details, ABN, and financial statements (if self-employed)
• Assets — property, savings accounts, vehicles, superannuation, investments
• Liabilities — existing loans, credit cards, BNPL, HECS/HELP
• Monthly living expenses and household budget information
• Loan purpose, loan amount sought, and deposit details
• Financial goals and investment strategy

Credit information

• Credit history, including any defaults, judgements, or bankruptcy
• Credit report information obtained from credit reporting bodies with your consent
• Repayment history on existing credit contracts

Sensitive information

In certain circumstances we may collect sensitive information as defined under the Privacy Act, including information about financial hardship or adverse credit history. We will only collect sensitive information with your express consent, or as otherwise permitted by law.

Identity verification

• Identity document type and details (passport, driver's licence, or other government-issued ID)
• Politically Exposed Person (PEP) status
• Information collected as part of our Verification of Identity (VOI) process under the AML/CTF Act 2006

3. How we collect your information

We collect personal information in the following ways:

• Directly from you — via our client fact find, meetings, phone calls, email, and other direct communications
• Via our website — through contact and enquiry forms, and cookies (see Section 12)
• Through referral partners — we may receive basic contact and context information from Smash Property Investing (SPI) when they refer a client to us. We collect full information directly from you when we engage with you
• From third parties with your consent — including credit reporting bodies (Equifax, Illion, Experian), your employer (for income verification), valuers, and government agencies
• From lenders — in connection with processing and settling your application

Where practicable, we collect personal information directly from you and will notify you at the time of collection of the purposes for which it is being collected, consistent with APP 5.

4. Why we collect your information

We collect and use personal information for the following purposes:

• To assess your financial situation, needs, objectives, and suitability for credit products
• To prepare a Preliminary Credit Assessment as required under the NCCP Act
• To recommend suitable credit products and prepare a Credit Proposal
• To submit loan applications to lenders on your behalf
• To verify your identity under the AML/CTF Act 2006
• To communicate with you about your application and our services
• To comply with legal and regulatory obligations under the NCCP Act, Privacy Act, AML/CTF Act, and other applicable laws
• To maintain records as required by ASIC (7-year retention requirement)
• To conduct annual reviews of your loan to assess whether it remains in your best interests
• To improve our services and internal processes
• To send you information about our services where you have consented to receive such communications

We will not use your personal information for purposes other than those listed above without your consent, unless permitted or required by law.

5. Who we share your information with

In providing credit assistance we may share your personal information with the following categories of recipients:

We will only share your personal information where reasonably necessary for the purposes in Section 4, or where required or authorised by law. We do not sell your personal information to third parties for marketing purposes.

6. Overseas disclosure

Some of the third parties we work with — including technology platforms, cloud storage providers, and service providers used by AFG — may store or process personal information on servers located outside Australia.

Where we disclose personal information to overseas recipients, we take reasonable steps to ensure that the recipient does not breach the Australian Privacy Principles, as required under APP 8. This may include contractual arrangements requiring overseas recipients to handle personal information consistently with Australian privacy law.

Overseas recipients may be located in countries including the United States, India, and other countries where our technology providers operate. By providing us with your personal information, you consent to its potential transfer overseas in the circumstances described above.

7. Credit reporting information

With your consent, we may obtain a consumer credit report about you from one or more credit reporting bodies — Equifax, Illion, and/or Experian — in connection with assessing your application.

The credit information we may use or disclose includes identification information, consumer credit liability information, repayment history, default information, court proceedings, personal insolvency information, and credit enquiry information.

We handle credit reporting information in accordance with the Privacy (Credit Reporting) Code 2014 and Part IIIA of the Privacy Act, and will only use or disclose it for permitted purposes.

You may contact the credit reporting bodies directly about their own privacy practices:

8. How we store and protect your information

We take reasonable steps to protect personal information we hold from misuse, interference, loss, and from unauthorised access, modification, or disclosure, consistent with APP 11.

Our security measures include:

• Encrypted transmission of data (TLS/HTTPS) between your device and our systems
• Password protection and access controls on systems containing personal information
• Secure cloud storage with reputable, established providers
• Limiting access to personal information to those who need it to perform their role
• Using AFG's compliance infrastructure, which includes industry-standard security controls

While we take all reasonable precautions, no method of electronic transmission or storage is completely secure. If you have concerns about transmitting information electronically, please contact us to discuss alternatives.

9. How long we keep your information

We are required by law to retain records relating to credit assistance for a minimum of 7 years from the date on which credit assistance was provided, as required under s67 of the NCCP Act.

Where personal information is no longer needed for any legal, regulatory, or business purpose, we will take reasonable steps to destroy or de-identify it in accordance with APP 11.2.

If you made an enquiry but did not proceed to an application, we will retain your information for a reasonable period to allow us to respond to future contact, and will then destroy or de-identify it.

10. Your rights — access, correction and complaints

Access and correction requests

Contact our Privacy Officer at nick@trivellicapital.com.au . We will acknowledge promptly and respond within 30 days.

Privacy complaints

Please contact our Privacy Officer first (Section 15). We will acknowledge within 1 business day and aim to resolve within 30 days. If unresolved, you may escalate to the OAIC:

Credit assistance complaints

Complaints about our credit assistance (rather than privacy) should go to AFCA:

11. Direct marketing

We may use your personal information to send you information about our services, relevant market updates, and products that may interest you — but only where you have consented to receive such communications.

We will not share your personal information with third parties for their direct marketing purposes without your express consent.

You may opt out at any time by using the unsubscribe link in any marketing email, or by contacting our Privacy Officer at nick@trivellicapital.com.au. We will action your request promptly at no cost to you.

12. Cookies and website data

Our website at trivellicapital.com.au may use cookies and similar tracking technologies to improve your experience, analyse traffic, and understand how visitors use our site.

• Essential cookies — required for the website to function correctly
• Analytics cookies — to understand visitor behaviour (e.g. Google Analytics)
• Preference cookies — to remember your settings

You can control cookies through your browser settings. Disabling certain cookies may affect your ability to use some features of our website. Our website is built on Webflow and their platform privacy terms also apply to the underlying infrastructure.

13. Notifiable data breaches

We are subject to the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act. If we experience a data breach likely to result in serious harm to any individual, we will:

• Contain the breach and assess its severity as quickly as possible
• Notify the OAIC as soon as practicable
• Notify affected individuals as soon as practicable
• Take steps to remediate the breach and prevent recurrence

If you believe your personal information held by us may have been compromised, please contact our Privacy Officer immediately using the details in Section 15.

14. Updates to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or business. When we make material changes, we will update the effective date above and where appropriate notify you directly.

The current version is always available at trivellicapital.com.au/privacy. Your continued use of our services after any update constitutes acceptance of the updated policy.

15. Contact our Privacy Officer

For questions, requests, or complaints relating to this policy or our handling of your personal information, please contact:

We will acknowledge your enquiry within 1 business day and respond substantively within 30 days.