All templates

Privacy Policy Template for Mortgage Brokers

Build a privacy policy for your brokerage website that covers credit information, lenders and AI tools. Answer a few questions and copy an editable policy.

Business and information

Leave empty to omit it. An arithmetic check does not confirm registry status.

Give the privacy role, email, phone and postal address.

List categories. Include website data and sensitive information where collected.

Describe direct and other sources, including website forms, logs and cookies.

Describe storage, access safeguards and retention or disposal in general terms.

Purposes and sharing

Explain why you collect, hold, use and disclose the information.

Name usual recipient categories and roles, including lenders and aggregators.

Choose your reviewed role. Broking alone does not establish credit-provider status.

Confirm provider and support arrangements before choosing.

AI and computer programs

Assess decisions affecting rights or interests, including substantial software support.

Requests and complaints

Explain access and correction requests, identity checks and how you respond.

Explain how to complain, how you investigate and how you respond.

Select AFCA only if the publishing business is a member.

Your policy draft

Every form detail is filled. Review the policy against your actual practices before publishing.

The draft updates from the form. Unresolved details remain blank lines.

Review before publication

Review each item after completing the policy.

The starting policy is fictional. Your entries stay in this browser. Enter business practices without borrower records.
PRIVACY POLICY Example Harbour Brokerage Privacy enquiries: Privacy officer. Email: privacy@harbour.example. Phone: 02 0000 0000. Post: Example Harbour Brokerage, Example Street, Example NSW 2000. Information we collect and hold We collect and hold contact details, identity documents, employment details, income, expenses, assets, liabilities and loan application documents. How we collect information We collect information from you through meetings, telephone calls and our application form. With your authority, we also collect supporting information from your accountant and selected lender. Our website records enquiry details and basic visit logs. How we hold and protect information We hold records in access-controlled electronic systems. Staff access is limited to their work. We use multi-factor authentication and secure document transfer. We retain records for applicable legal and business requirements, then securely destroy or de-identify information when it is no longer required. Why we handle information We collect, hold, use and disclose information to assess your borrowing needs, prepare and manage your loan application, provide ongoing loan support and meet our legal obligations. Usual recipients We share relevant information with your selected lender and our aggregator for application processing and compliance support. Credit information We do not obtain consumer credit reports. Overseas disclosure We are not likely to disclose personal information to overseas recipients. AI tools We do not use AI tools to handle personal information. Computer-assisted decisions We do not arrange for computer programs to make decisions that significantly affect your rights or interests. We do not arrange for them to perform a substantial and direct part of making those decisions. Access and correction You can request access to personal information we hold about you and ask for its correction. You can request access to your personal information or ask us to correct it by contacting our privacy officer. We check identity before releasing information and explain our response, including any lawful reason for refusing a request. Privacy complaints Contact our privacy officer and describe what happened and the outcome you seek. We acknowledge the complaint, investigate the handling of your information and give you a written response. We tell you if more information or time is needed. External complaints We are a member of the Australian Financial Complaints Authority (AFCA). If we do not resolve your complaint, you can ask AFCA whether it can consider your complaint. AFCA provides a free dispute resolution service to consumers. Contact AFCA on 1800 931 678 or visit www.afca.org.au. You can also contact the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or on 1300 363 992. Complain to us first. An approved external dispute resolution scheme may need to consider your complaint before the OAIC. Obtaining this policy Contact our privacy contact for a free copy of this policy. Tell us if you need it in another form. Policy changes We update this policy when our handling practices change. The version published on our website explains our current practices.

What a Brokerage Privacy Policy Must Cover

This privacy policy template builds an editable website policy from your brokerage's information-handling practices. It keeps unknown details visible, with optional sections for credit reports and AI tools. Complete the draft and review its wording before publication.

For a business covered by the Australian Privacy Principles, APP 1 requires a clearly expressed, current policy. The OAIC's APP 1 guidance lists the matters it must explain.

  • The kinds of personal information the business collects and holds.
  • How it collects information and how it holds it.
  • The purposes of collection, holding, use and disclosure.
  • How people request access and correction.
  • How people complain about privacy breaches and how the business handles complaints.
  • Likely overseas disclosures, including recipient countries where practicable.

A privacy statement can be a shorter explanation of these practices. Its label does not determine whether it meets the policy requirements. A collection notice explains the particular collection when you request information. Publishing a policy does not itself obtain consent or replace the collection notice.

Credit reporting needs a separate role assessment. A broker handling a client's report must describe that handling accurately. A credit provider subject to section 21B of the Privacy Act has additional policy matters. Those cover credit and credit eligibility information, derived information, handling purposes, access, correction, complaints and applicable overseas disclosures. The Act exempts certain non-participating credit providers. The generator therefore asks for a reviewed credit policy section when you select the credit-provider role.

Complete the Template With Your Facts

Enter the legal or trading business name and its privacy contact. Include the contact role, email, phone and postal address so clients can make requests. The ABN field is optional. Its arithmetic check catches a mistyped number without establishing the business's registration.

List information categories instead of entering borrower records. Describe direct collection and other sources, including website enquiries, logs and cookies that actually operate. Explain storage and safeguards in general terms. State retention and disposal practices without publishing security details that expose your systems.

Describe why the brokerage handles the information and which recipients receive it. Name lenders, your aggregator and support providers by their actual roles. If you obtain credit reports, explain the authority, sources and permitted handling. Confirm your credit reporting role with the person responsible for that process before selecting it.

Review service contracts and support access to establish likely overseas disclosure. List the countries where practicable. If specifying them is impracticable, record the reason in the relevant field. Leaving the choice unconfirmed keeps a blank line and a detail to resolve.

The AI section asks about personal information in AI tools separately from computer-assisted decisions. Complete each applicable description. Then explain access, correction and complaints, including how staff investigate and respond. Select AFCA only if the publishing business is a member. For another scheme, enter its name, contact details and process.

Resolve an unknown detail with the staff member or provider responsible for it before publishing. Selecting “Not likely” or “No relevant decisions” states a fact about your arrangements. Keep an unconfirmed choice open until you establish that fact.

A Privacy Policy Example for a Brokerage

The tool opens with the fictional Example Harbour Brokerage and a reserved .example email address. It collects financial and identity documents directly from clients, with authorised supporting information from their accountant and selected lender. Its website records enquiry details and basic visit logs.

The example's recipient section reads, “We share relevant information with your selected lender and our aggregator for application processing and compliance support.” It states that overseas disclosure is not likely. The fictional business obtains no consumer credit reports and uses no AI tools for personal information.

Suppose the brokerage adds a processing provider in New Zealand. Change Usual recipients to “Selected lender and New Zealand processing provider”. Select “Likely: list countries” and enter “New Zealand”. The generated policy now names that recipient and country, and removes the earlier overseas assurance.

The example is a set of fictional handling facts, not a policy for another brokerage to adopt unchanged. The privacy officer's contact details and complaint process must match the publishing business.

Adding AI Tools to Your Privacy Policy

Describe what an AI tool does with personal information in your actual workflow. Identify the information categories and purposes, relevant recipients, retention arrangements and human review. Explain training use only on the terms and settings you have confirmed. Match the overseas section to the same arrangements.

The OAIC's commercial AI guidance calls for clear policy and notification information about AI use. A policy disclosure does not authorise every AI use. Assess the collection, use and disclosure itself, including consent where required. The AI disclosure guide explains wording for client communication.

From 10 December 2026, APP 1.7 to 1.9 add policy disclosures for certain computer-assisted decisions. They apply when an entity arranges for a program to use personal information to make a relevant decision, or perform a substantial and direct part of it. The decision must be reasonably expected to significantly affect a person's rights or interests.

The OAIC's automated decision transparency guidance identifies the required categories. Describe the personal information used, decisions made solely by programs and decisions substantially and directly supported by programs. The tool has a field for each. Enter “None” for a category that genuinely does not occur. Human review does not automatically take a process outside the rule.

Publish and Review the Policy

Make the completed policy available free of charge through a clear website link. The footer is a useful location. Provide a copy in another form when reasonably requested. Put the relevant collection notice beside forms or at the other collection point.

Check the complaint path before publication. AFCA asks consumers to contact the financial firm first. Its complaint line is 1800 931 678. Include AFCA membership wording only when it is true for the publishing business. The OAIC explains when an approved external scheme needs to consider a privacy complaint first.

Review the policy when you change collected information, purposes, providers, overseas access, AI handling or complaint arrangements. Include it in regular business reviews. Keep an internal record of the version and its approval, and use the policy's actual update date when publishing.

You can edit the policy directly. Form changes then stop replacing your text until you choose “Discard edits and rebuild from the form”. “Reset example” restores the fictional form and policy, discarding your edits. Copy, download and print use the displayed policy. Changing the form or document clears the review checkboxes.

This tool assembles the draft on your device and does not save your entries. Download or print the draft before leaving. The output needs review against your business and applicable law before use. It does not determine Privacy Act coverage or guarantee compliance.

Track My Trail Team

Read more

We develop software to simplify trail book management for mortgage brokers. Our tools provide fast and practical insights to help brokers get the most out of their trail books.