Privacy Policy

Last updated: 4 October 2026

This policy explains how Whitesquare Pty Ltd (ABN 44 701 512 165), trading as White Square (White Square, we, us or our), collects, holds, uses and discloses personal information. White Square is a finance broker: we help businesses arrange equipment and asset finance from lenders and other funders.

We are bound by the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth) (Privacy Act) and, where they apply to us, Part IIIA of the Privacy Act and the Privacy (Credit Reporting) Code (CR Code), which govern credit-related information. Part A of this policy covers personal information generally. Part B is our credit reporting policy.

Part A: Privacy policy

1. Who this policy covers

Personal information means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether or not it is true and whether or not it is recorded in a material form.

Most of our customers are businesses, but the Privacy Act protects individuals. This policy therefore covers information about sole traders, partners, company directors and officers, trustees, guarantors, contacts at our customers and anyone else we deal with.

It does not cover employee records about our current and former employees, which are exempt from the Privacy Act.

2. The personal information we collect

What we collect depends on how you deal with us. It may include:

• Identity and contact details: name, phone number, email address, residential and postal address, date of birth, and identification documents (such as a driver's licence or passport) used to verify your identity.
• Business details: business and trading names, ABN and ACN, business structure, directors, shareholders, partners, trustees and beneficiaries, guarantors, industry and trading history.
• Financial information: income, assets, liabilities and expenses; bank statements; financial statements and tax returns; tax and debt position; and existing finance commitments.
• Credit-related information: credit history, credit reports and scores, repayment history and defaults (see Part B).
• Asset and purchase details: the equipment you are buying or financing, its price and seller, the dealer, marketplace or auction involved (including registration, lot and bidding details), deposits and trade-ins.
• Records of our dealings with you: enquiries, emails, SMS messages, call records and notes, and the progress and outcome of any application.
• Online information: information you submit through our website and information collected by cookies and similar technologies (see section 9).

Sensitive information. We don't usually need sensitive information, such as health information. If we do (for example, if you tell us about a hardship situation), we will only collect it with your consent or where the law otherwise allows.

Information about other people. If you give us personal information about someone else, such as a co-director or guarantor, please make sure they know you have done so and that they can read this policy.

3. How we collect it

We collect personal information directly from you wherever it is reasonable and practicable to do so: for example, when you complete a form on our website, call, email or message us, or complete a finance application.

We also collect personal information from others, including:

• auction houses, equipment marketplaces, dealers and other partners that refer you to us, for example when you register to bid on, buy, or ask about finance for equipment through them;
• lenders, funders and finance aggregators we work with;
• credit reporting bodies, generally through the lenders we approach on your behalf (see Part B);
• your accountant, adviser or other representative, with your authority; and
• public registers and business information sources, such as ASIC, the Australian Business Register and the Personal Property Securities Register.

When we collect personal information about you from someone else, we take reasonable steps to let you know that we hold it and why, usually when we first contact you.

If we receive personal information we did not ask for and could not otherwise have collected, we will destroy or de-identify it where it is lawful and reasonable to do so.

Anonymity. You can make a general enquiry without identifying yourself or by using a pseudonym. We cannot arrange finance on that basis, because lenders need to know who they are dealing with.

If you don't provide information we ask for, we may not be able to help you, and lenders may not be able to consider your application.

4. Why we collect, hold and use it

We collect, hold and use personal information to:

• respond to your enquiries and contact you about finance you may need, including finance for equipment you have registered to bid on or have bought at auction;
• understand your business and needs, and identify suitable lenders, products and structures;
• prepare, submit and manage finance applications through to settlement;
• verify your identity and help prevent fraud;
• manage our relationship with you, including contacting you when you may need finance again;
• manage our arrangements with lenders, aggregators and referral partners, including commissions and referral fees;
• run, improve and secure our business, systems and website, and train our people;
• meet our legal, regulatory and record-keeping obligations;
• handle complaints and disputes;
• send you direct marketing (see section 8); and
• for any other purpose you consent to, or that is required or authorised by law.

We only use or disclose personal information for a purpose other than the one we collected it for if you would reasonably expect us to and the purpose is related (or, for sensitive information, directly related) to the original purpose; if you consent; or if the Privacy Act otherwise permits it, for example to lessen a serious threat to life, health or safety, to act on suspected unlawful activity or serious misconduct, or where required or authorised by law.

5. Who we disclose it to

For the purposes in section 4, we may disclose personal information to:

• lenders, financiers, lessors, rental and rent-to-own providers and other funders we approach on your behalf, and their agents;
• finance aggregators, and the holder of any Australian credit licence we operate under, that provide our lender panel, systems, licensing and compliance support;
• the auction house, marketplace, dealer or other partner that referred you to us, limited to what is needed to manage the referral, such as the status and outcome of your enquiry and any fees payable;
• sellers, dealers, auction houses, valuers and inspectors, to confirm asset and purchase details and arrange settlement;
• your accountant, adviser or other representative, and any guarantor, with your consent;
• service providers who support our business, such as customer relationship management, cloud hosting, email and SMS, telephony, document management, identity verification, electronic signing and IT providers, outsourced support staff, and our professional advisers;
• our related bodies corporate;
• credit reporting bodies, in the circumstances described in Part B;
• the Australian Financial Complaints Authority, regulators, courts, government agencies and law enforcement bodies, where required or authorised by law;
• a prospective buyer of all or part of our business, under confidentiality obligations; and
• anyone else you authorise.

We require our service providers to handle personal information consistently with the Privacy Act. We do not sell, rent or trade your personal information.

6. Overseas disclosure

Some of our service providers and partners store or access personal information outside Australia. These recipients are likely to be located in the United States, Canada and the Philippines, and may be in other countries where our cloud service providers operate data centres.

Before we disclose personal information to an overseas recipient, we take reasonable steps to ensure it handles the information consistently with the APPs, unless an exception under the Privacy Act applies.

7. Calls, automated tools and AI

We may record phone calls for quality, training and compliance purposes. If a call is being recorded, we will tell you at the start of the call.

We use software, including automated and AI-assisted tools, to help us capture and prioritise enquiries, direct them to the right person, draft communications and keep accurate records. If we contact you using an AI-assisted voice or messaging tool, we will tell you, and you can ask to speak with a person at any time.

We do not use computer programs to decide whether you receive finance. Credit decisions are made by the lenders we approach, using their own processes; their privacy policies explain how they handle your information. If we start using a computer program to make, or substantially help make, decisions that could significantly affect your rights or interests, we will update this policy to describe the kinds of personal information used and the kinds of decisions involved.

8. Direct marketing

We may use your contact details to tell you about finance products, services and offers that may interest you, by email, SMS, phone or post, where you have consented or the law otherwise allows us to. We comply with the Spam Act 2003 (Cth) and the Do Not Call Register Act 2006 (Cth).

Every marketing email and SMS we send identifies us and includes a simple way to unsubscribe. You can opt out at any time by using the unsubscribe link, replying STOP to an SMS, or contacting us. Opting out is free, and we will action your request within five business days.

We will not disclose your details to anyone else for their own marketing without your consent.

9. Our website, cookies and analytics

Our website runs on HubSpot, which we also use to manage enquiries and customer records. Information you submit through a form on our website goes directly into that system so we can respond to you.

When you visit our website, we and our service providers may collect information such as your IP address, device and browser type, the pages you view, the date and time of your visit, the site that referred you, and how you interact with our pages. We collect this using cookies and similar technologies, which help us remember your preferences, understand how our website is used, link form submissions to your enquiry, and measure our marketing.

We may also use analytics and advertising tools, such as Google Analytics and social media advertising platforms, which set their own cookies. You can:

• set your browser to refuse cookies or to alert you when cookies are being sent (some parts of our website may not work properly if you do);
• opt out of Google Analytics using the Google Analytics opt-out browser add-on; and
• read about the cookies HubSpot sets in HubSpot's cookie guide.

Our website may contain links to other websites. We are not responsible for the privacy practices or content of those sites.

10. Security, data breaches and retention

We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. These steps include access controls and multi-factor authentication on our systems, encryption of data in transit, confidentiality obligations for our people, and requiring our service providers to protect the information they handle for us.

No transmission over the internet is completely secure. If you would rather not send documents by email, call us and we will arrange another way.

Data breaches. If we experience a data breach that is likely to result in serious harm, we will notify you and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.

Retention. We keep personal information only for as long as we need it for the purposes in this policy or to meet our legal obligations. For finance arranged through us, that is generally at least seven years. When we no longer need personal information, we take reasonable steps to securely destroy or de-identify it.

11. Accessing and correcting your information

You can ask to access the personal information we hold about you by contacting us. We may need to verify your identity first. We will respond within a reasonable time, usually within 30 days. There is no fee to make a request, but we may charge a reasonable fee for the cost of giving you access; we will tell you about any fee before we proceed.

We may refuse access in limited circumstances permitted by the Privacy Act, for example where giving access would unreasonably affect someone else's privacy, the request is frivolous or vexatious, the information relates to legal proceedings between us, or giving access would be unlawful. If we refuse, we will tell you why in writing and how you can complain.

If you believe information we hold about you is inaccurate, out of date, incomplete, irrelevant or misleading, please tell us and we will take reasonable steps to correct it. If you ask, we will also notify anyone we have disclosed it to. If we don't agree that a correction is needed, we will explain why in writing, and you can ask us to attach a statement to the information noting your view.

12. Complaints

If you have a concern about how we have handled your personal information, please contact us first so we can try to fix it. We will acknowledge your complaint within one business day, investigate it, and give you our response in writing within 30 days. If we need more time, we will tell you why and when you can expect our response.

If you are not satisfied with our response, you can contact:

Part B: Credit reporting policy

13. About this part

This part explains how we manage credit-related information, meaning the kinds of information the Privacy Act calls credit information, credit eligibility information and CP derived information.

As a broker, we arrange finance rather than provide it. Lenders usually obtain credit reports from credit reporting bodies when they assess an application. We collect and hold credit-related information while helping you arrange finance and, where we are permitted to, we may obtain credit reporting information ourselves or receive it from a lender.

14. Kinds of credit-related information

The credit-related information we collect and hold may include:

• identification information;
• the fact that you have applied for credit, and the type and amount of credit;
• details of credit you currently hold, including credit providers, limits and terms;
• repayment history information;
• default information, payment information and new arrangement information;
• court proceedings and personal insolvency information, and publicly available information about your creditworthiness;
• an opinion of a credit provider that you have committed a serious credit infringement; and
• credit scores, ratings and assessments derived from credit reports.

15. How we collect, use and disclose it

We collect credit-related information from you, your representatives, the lenders and funders we work with and, where permitted, credit reporting bodies.

We use it to understand your finance needs, identify suitable lenders, help lenders assess your application (and any guarantee), manage your application, meet our legal obligations and handle complaints.

We may disclose it to the lenders and funders we approach on your behalf; to finance aggregators and the holder of any credit licence we operate under; to guarantors or proposed guarantors, with your consent; to AFCA, regulators and others where required or authorised by law; and to our service providers, including those overseas described in section 6.

We do not ourselves disclose credit information to credit reporting bodies. Lenders that provide you with credit may do so, for example to report repayment history or defaults.

16. Credit reporting bodies and your rights

Lenders we approach on your behalf may obtain information about you from, and disclose information about you to, these credit reporting bodies. Each publishes a credit reporting policy on its website explaining how it manages credit reporting information.

You should know that:

• a credit reporting body may include information a credit provider gives it in reports it provides to other credit providers, to help them assess your creditworthiness;
• if you fail to meet your payment obligations or commit a serious credit infringement, a credit provider may be entitled to disclose this to a credit reporting body;
• you can ask a credit reporting body not to use your credit reporting information to pre-screen you for direct marketing by credit providers;
• if you believe on reasonable grounds that you have been, or are likely to be, the victim of fraud, you can ask a credit reporting body not to use or disclose your credit reporting information for a period (a ban period);
• a credit reporting body must give you access to your credit report free of charge once every three months; and
• you can access and seek correction of the credit-related information we hold, and complain about how we handle it, as set out below.

17. Access, correction and complaints

Access. You can ask for access to the credit-related information we hold about you by contacting us. We will respond within 30 days, unless unusual circumstances apply. For the most complete picture, you may also want to request your credit report directly from the credit reporting bodies above.

Correction. If you ask us to correct credit-related information and we are satisfied it is inaccurate, out of date, incomplete, irrelevant or misleading, we will correct it within 30 days (or a longer period you agree to in writing) and give you written notice of the correction. If the correction relates to information held by a lender or credit reporting body, we may need to consult them. If we decide not to make the correction, we will tell you why in writing and how you can complain.

Complaints. Complaints about credit-related information follow the process in section 12. We may consult a lender or credit reporting body to resolve your complaint, and we will give you our decision in writing within 30 days unless you agree in writing to a longer period. If you are not satisfied, you can contact AFCA or the OAIC using the details in section 12.

General

Contact us

For privacy questions, access or correction requests, or complaints, contact our Privacy Officer:

This policy is available free of charge at whitesquare.com.au. If you would like a copy in another form, such as a printed copy, just ask.

Changes to this policy

We may update this policy from time to time to reflect changes in the law, our services or how we handle personal information. The current version will always be published on our website, showing the date it was last updated.