Privacy policy

At MatchMe Money Limited, we are committed to protecting your privacy

This policy explains how MatchMe Money Limited (MatchMe Money, we, us, our) collects, uses, holds, and shares your personal information, and how you can exercise your privacy rights. We handle personal information in accordance with the Privacy Act 2020, the Credit Reporting Privacy Code 2020, the Credit Contracts and Consumer Finance Act 2003 (CCCFA), and the Anti-Money Laundering and Countering Financing of Terrorism Act 2009 (AML/CFT Act).

MatchMe Money Limited (FSP1007463) is a Class 2 Financial Advice Provider registered under the Financial Service Providers (Registration and Dispute Resolution) Act 2008. Our role is to match you to suitable Finance Partners (lenders) — we are not a lender ourselves. We also give financial advice on personal and property lending, and help businesses apply for business lending, which isn't financial advice under our licence; see our financial advice disclosure. When you submit a finance application through MatchMe Money, we share your information with one or more Finance Partners on your behalf as part of the matching process.

About this policy

This policy applies to all personal information collected through our website, online and offline application forms, telephone calls and email or SMS exchanges with our team, and through introducers, partners, and other third parties who provide information to us about you.

This policy does not cover the privacy practices of our Finance Partners, credit reporting agencies, or other third parties — each manages your information under its own privacy policy.

Information we collect

The personal information we collect depends on how you interact with us. It typically includes:

• Identity information — your full name, any other names you have used, date of birth, gender, residency status, and identification documents (such as your driver's licence or passport, including the document number, photograph, and biometric data extracted during identity verification).
• Contact details — your residential and postal addresses, email address, and phone number.
• Financial information — your income, expenses, assets, liabilities, banking history (including bank-statement data obtained through a secure read-only data feed), credit history, and details of existing or previous credit arrangements.
• Employment and personal circumstances — your employer, occupation, length of employment, dependents, accommodation arrangements, and other circumstances relevant to a responsible-lending assessment under the CCCFA.
• Information about other parties — where relevant, information about co-applicants, guarantors, beneficial owners, or other people connected with your application (you confirm you have their authority to provide this).
• Interaction information — records of your communications with us (calls, emails, chat, SMS), and information about your use of our website and online application forms (IP address, device, browser, pages visited, referring URLs, the advertisement or link that brought you to us, how you move through our forms, and cookies — see Cookies and online tracking below).

How we collect your information

We collect personal information directly from you when you submit an application, contact us, use our website, or otherwise engage with us.

When you apply online, we save what you enter as you go, step by step, so you can come back and finish later using the link we email or text you. If you start an application but don't finish it, we keep what you have entered and we may contact you to help you complete it.

We also collect personal information from third parties, including:

• Credit reporting agencies, including Centrix and Equifax (equifax.co.nz/privacy), under the Credit Reporting Privacy Code 2020;
• Bank statement analysis and account data providers, including illion, who provide secure read-only access to your bank transaction data with your consent at the point of application;
• Identity verification and biometric verification providers;
• Our Finance Partners, where you have an existing relationship with them or where they refer you to us;
• Referral partners, introducers, and marketing affiliates;
• Public registers (including the Companies Office and the Personal Property Securities Register);
• Government agencies, where authorised by law.

If you provide personal information to us about another person (for example, a co-applicant, guarantor, or beneficial owner), you confirm that you have their authority to do so and that you have informed them about this Privacy Policy and their right to access it.

Why we collect and use your information

We collect and use your personal information to:

• Assess your eligibility for credit, including responsible-lending affordability and suitability inquiries required under the CCCFA;
• Match your application to one or more suitable Finance Partners;
• Verify your identity and meet our customer-due-diligence obligations under the AML/CFT Act;
• Communicate with you about your application, our services, and any product you obtain through us;
• Manage our relationship with you, including handling enquiries, complaints, hardship requests, and audit matters;
• Improve, develop, and operate our products, services, decisioning models, and technology platforms;
• Comply with our legal, regulatory, and industry-code obligations;
• With your consent — or where otherwise permitted under the Privacy Act 2020 — market our products and services to you and tailor our advertising.

Who we share your information with

With our Finance Partners

When you submit a finance application through MatchMe Money, your application and supporting personal information may be disclosed to one or more of our Finance Partners (lenders) for assessment.

When a Finance Partner receives your information from us, they collect it indirectly under Information Privacy Principle 3A of the Privacy Act 2020 and become a separate data controller of that information. Each Finance Partner manages your information under its own privacy policy.

Our current Finance Partners for personal and consumer lending, their registered offices, and links to their privacy policies are set out below. This list is updated from time to time as our panel changes. The Finance Partner(s) your application is submitted to will depend on the loan product, your individual circumstances, and the matching outcome.

For property-secured lending, mortgage advice, and business funding, we work with a separate panel of providers. Where any of those providers receives your information from us, the same IPP 3A treatment applies and the relevant provider's details will be supplied to you at the point your application is submitted.

When your application is submitted to a Finance Partner, we will notify you by email and/or SMS confirming the submission and the Finance Partner concerned. You can also contact us at any time at or 0800 696 282 to confirm which Finance Partner has received your information.

With credit reporting agencies

We exchange information with credit reporting agencies — including Centrix and Equifax — to assess your creditworthiness and verify the information you have provided. This sharing is governed by the Credit Reporting Privacy Code 2020. You have the right to obtain a copy of your credit report directly from the relevant credit reporter and to request corrections to any information they hold about you.

With identity verification and bank statement providers

To verify your identity and to assess affordability, we use secure third-party providers, including biometric identity verification services and bank statement analysis services such as illion. Where bank-statement data is obtained, this is done on a read-only basis with your consent and using bank-grade encryption. Your internet banking credentials are never seen, stored, or retained by us, our Finance Partners, or our service providers.

With service providers

We share information with third parties who help us operate our business, including cloud-hosting providers, IT and software providers, customer relationship management platforms, communications providers, security services that protect our online forms from automated attacks (such as Cloudflare), address-lookup services that suggest your address as you type (Google), and professional advisers. These providers are bound by confidentiality and data-protection obligations consistent with this Privacy Policy.

With marketing and analytics partners

We work with advertising and analytics platforms, including Google (Google Analytics and Google Ads), Microsoft Advertising and Meta (Facebook and Instagram), to:

• show you relevant advertising on third-party websites and platforms;
• build custom and lookalike audiences for advertising;
• measure and improve the effectiveness of our marketing.

To do this, we share:

• contact information, including email addresses and hashed identifiers;
• when you came to us by clicking an advertisement, the identifier for that click and whether it led to an application, an approval or a loan, with an estimated value. We do not send your name, contact details or financial information with it.

When you submit an application, we send Google and Meta your email address and mobile number in a scrambled (hashed) form, so they can tell whether one of our advertisements brought you to us. The scrambled values can't be read back as your email address or number.

We also use our own form analytics, hosted in New Zealand, to see where people find our application forms difficult, for example which questions take longest or show an error. It records the names of the questions, how long each step takes and any error messages. It never records what you type, and we keep it for 30 days.

You can opt out of marketing communications at any time by clicking the unsubscribe link in our emails, contacting us at , adjusting your Google advertising preferences at adssettings.google.com, your Microsoft advertising preferences at account.microsoft.com/privacy/ad-settings, your Meta ad preferences in your Facebook or Instagram settings, or opting out of personalised advertising through the Digital Advertising Alliance at optout.aboutads.info.

With government agencies and regulators

Where required or authorised by law, we may share your information with government agencies, regulators, courts, and law-enforcement authorities — including the Financial Markets Authority, the Commerce Commission, Inland Revenue, and the New Zealand Police.

With successors and acquirers

If MatchMe Money is sold, restructured, or merged, we may transfer personal information to the acquirer or successor entity for the purposes set out in this Privacy Policy.

How we store your information

Our main systems, which hold your personal information, are secure cloud-based platforms hosted in Australia and New Zealand. We apply strong technical and organisational measures — including encryption in transit and at rest, access controls, multi-factor authentication, and regular security testing — to protect your information against unauthorised access, loss, modification, and disclosure. Despite these measures, no method of transmission or storage is completely secure; we will respond promptly if a privacy breach occurs (see Privacy breaches below).

International transfers of personal information

Some of our service providers, Finance Partners, marketing platforms, and technology partners are located outside New Zealand — including in Australia, the United States, the European Union, and other jurisdictions. For example, the service that sends and receives our text messages, Make, is hosted in the United States; it handles your mobile number and first name. Where we transfer your information overseas, we take reasonable steps to ensure that the recipient handles it in accordance with privacy standards comparable to those required under New Zealand law, including through contractual protections.

In some cases — for example when sharing data with global advertising platforms — your information may be processed in countries whose privacy laws are not equivalent to the Privacy Act 2020. By providing your information and accepting this Privacy Policy, you consent to these international transfers.

Cookies and online tracking

Our website and online application forms use cookies, web beacons and similar technologies to provide functionality, remember your preferences, analyse traffic and deliver targeted advertising. We use first-party and third-party analytics and advertising tools, including Google Analytics, Google Ads, Microsoft Advertising, the Meta pixel, and our own form analytics (see With marketing and analytics partners above). On our application forms, these tools are told which page or step you are on, the type of finance you are applying for, and whether your application was received. They are never told the answers you type, except your email address and mobile number, which are scrambled (hashed) first.

You can control cookies through your browser settings — disabling cookies may affect the functionality of our website. You can also opt out of personalised advertising through the platforms identified in With marketing and analytics partners above.

Information Privacy Principle 3A — collection from third-party sources

Where we collect your personal information from a source other than you, we will take reasonable steps to ensure that you are aware of:

• The fact that the information has been collected;
• The purpose for which the information was collected;
• The intended recipients of the information;
• The name and address of our agency (MatchMe Money Limited, Ranger House, 190 Jack Lachlan Drive, Beachlands, Auckland 2018);
• The source of the information, where known, including the name and address of that source and a link to its privacy policy where available;
• Your rights to access and correct the information;
• Any consequences if information is not provided.

This notification will normally be given through this Privacy Policy, through application disclosures, or through direct communication with you at the time of collection or as soon as practicable afterwards.

Data retention

We retain personal information only for as long as we need it for the purposes set out in this Privacy Policy, or as required by law:

• Credit application data — at least seven years from the date of application or completion of the credit facility, whichever is later, to comply with regulatory and audit requirements.
• AML/CFT records — at least seven years from the end of the business relationship or completion of the relevant transaction, as required under the AML/CFT Act 2009.
• Marketing data — until you opt out of marketing communications or request deletion, unless we are required to retain it for legal purposes.
• Website analytics data — 26 months in accordance with our analytics provider settings.
• Advertising click identifiers kept with your application — for the same period as your credit application data.
• Form-analytics data — 30 days.

After these periods, we take reasonable steps to securely destroy or de-identify the information.

Privacy breaches

If we experience a privacy breach that we believe has caused, or is likely to cause, serious harm to any individual, we will notify the Office of the Privacy Commissioner and the affected individuals as soon as practicable, in accordance with the Privacy Act 2020. We maintain incident-response and breach-management procedures and will work to contain and remedy any breach quickly.

Children

Our services are intended for adults aged 18 and over. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information about a child, please contact us at so we can take appropriate steps to delete it.

Your rights and choices

Under the Privacy Act 2020 you have the right to:

• Access the personal information we hold about you;
• Request corrections to information that is inaccurate, incomplete, or out of date;
• Withdraw consent for marketing communications at any time;
• Make a complaint about how we have handled your personal information.

We respond to access and correction requests as soon as reasonably practicable and within the timeframes required by the Privacy Act 2020 (generally within 20 working days). In some circumstances we may be required to charge a reasonable fee or to withhold information; if so, we will tell you and explain why.

To exercise any of these rights, contact our Privacy Officer at or 0800 696 282.

Changes to this policy

We may update this policy from time to time to reflect changes in legal requirements or our practices. This policy is reviewed at least annually on 1 July. Material changes will be communicated through our website or directly to affected individuals.

Additional privacy information

For additional information about how we handle your information, please refer to our Terms and Conditions, which contain privacy-related provisions that complement this Privacy Policy.

Contacting us

If you have any questions or concerns about this Privacy Policy, wish to access or correct your personal information, or wish to make a complaint, please contact our Privacy Officer:

Email:
Phone: 0800 696 282
Post: Privacy Officer, MatchMe Money Limited, PO Box 28-2241, Beachlands 2018

Complaints about our financial advice service go to (see our financial advice disclosure). We are a member of the Insurance & Financial Services Ombudsman Scheme (IFSO Scheme), membership number 5007682. ifso.nz.

If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner:

Website: www.privacy.org.nz
Phone: 0800 803 909
Post: PO Box 10 094, Wellington 6143

Governing law

This policy is governed by New Zealand law. Disputes are subject to the exclusive jurisdiction of the New Zealand courts and the Office of the Privacy Commissioner.