Privacy

What we collect, and who sees it

A deal on this platform carries a borrower’s figures, their directors and guarantors, and their documents. This says what we do with all of it.

Who we are.

On Panel is operated by On Panel Pty Ltd. In this policy, “we” and “us” mean On Panel Pty Ltd, and “you” means whoever the information is about: the broker who lodged the deal, the borrowing entity, and each director and guarantor named on it.

The Australian Privacy Principles in the Privacy Act 1988 (Cth) govern how personal information is handled here. Write to us at enquiries@onpanel.com.au about anything in this policy.

What we collect.

Six groups, collected at six different moments. Most of it comes from a broker rather than from the person it is about, which is why the platform asks the broker to tell them.

From a broker joining the panel

Name, firm, the firm’s ABN and business address, email, phone, aggregator, credit licence or authorisation and its number, how many brokers are in the firm, answers about bankruptcy, findings of fraud, dishonesty, drug trafficking or money laundering, and whether an accreditation has ever been refused or revoked. A signature, and a record of the broker agreement accepted: which version, and when.

From a quick quote

Loan amount, security address, values, term and exit. Nothing is saved unless you ask for the quote by email, and then the email address is saved with it.

From a lodged scenario

The borrowing entity, its ABN or ACN and entity type, the security addresses, the guarantors by name, the loan amount, the term, the purpose and any debt already against the security.

From an application

For each director and guarantor: name, date of birth, residential address, driver licence number and expiry, phone numbers, email, employer, occupation, income and credit history. The borrower’s assets and liabilities. The accountant’s and solicitor’s details.

From documents uploaded to a deal

Identity documents, a Director ID, credit reports, company and title searches, rates and land tax notices, trust deeds, contracts of sale, valuations, insurance certificates and financial statements.

From using the platform

Who lodged a deal, who opened a document, who sent terms and who signed, each with its time. This log cannot be edited after the fact.

Why we collect it.

To assess a scenario against each panel lender’s written credit policy, to prepare the credit submission, to run the deal through valuation, searches, legals and settlement, and to keep a record of what was done and when.

We also collect a broker’s licence details, and their answers about bankruptcy and offences, to decide whether to accredit them. Those answers are kept with the accreditation record, so the basis for that decision survives.

We do not use any of this to market to borrowers, and we do not sell it.

Sensitive information, and identifiers.

Some of what a deal carries needs your consent before we can collect it, and we ask for that consent on the screen where it is collected.

A broker’s answers about findings of fraud, dishonesty, drug trafficking or money laundering are criminal record information. They are collected on the accreditation form and used to assess that accreditation.

Identity documents and a Director ID are collected to verify who is party to the loan. We use a government identifier for that purpose and for the searches the file needs, and not as our own reference for you.

A credit report on a director or guarantor is credit information. It is used to assess the application, on the authority given in the privacy agreement signed with it.

Who we disclose it to.

The whole point of the platform is that a deal reaches lenders, so this is the section that matters most.

The lenders a broker sends the deal to

Each one chosen by the broker, and each sees the deal in full: the security and its address, the borrowing entity, the guarantors, the project and the computed metrics. Every lender on the panel has signed On Panel’s lender agreement before it is shown a deal.

The one lender your client proceeds with

Assets and liabilities, the application and the documents go to that lender alone. Every other lender loses access and is told the deal is not proceeding.

Valuers, searchers and solicitors

Instructed on the deal so the file can settle. A disbursement is estimated to the applicant and ordered only once they agree to it.

The services the platform runs on

Hosting, the database and the document store, email delivery, malware scanning on every upload, and off-platform backups. Each holds information on our instructions and for no purpose of its own.

Lookup services, queried with what you type

The Australian Business Register, for an entity name and ABN. A property data service, for the land, zoning and hazards at an address.

Where the law requires it

A court order, or a statutory notice.

What a lender is not given.

A lender is not told which other lenders received the deal, how many did, what any of them said, or what any of them quoted. A lender is not given the broker’s name or their brokerage.

Consent to send a file to a lender.

Nothing about a deal reaches a lender until a broker chooses that lender and presses send. That press is the disclosure, and the screen says so before it happens.

A broker acts on the borrower’s authority. Before an application is submitted, every individual borrower, guarantor and director agrees to a privacy agreement that sets out who their information may be given to, and the broker confirms that agreement was read and agreed to by each of them. The version they agreed to is stored with the application, so the record says what was agreed and in which words.

You can withdraw that consent by writing to us at enquiries@onpanel.com.au. We will stop disclosing your information to lenders from that point. It does not reach back into a file a lender already holds, and a lender assessing a live application will have their own obligations to you.

Where it is held, and how it is protected.

Deal records sit in a database, and documents in a separate store. Both are reachable only by an account the platform has admitted, and each account reads only what its role allows: a lender reads its own deals, a broker their own, and nobody reads across that line. That separation is enforced by the database itself rather than by the screens on top of it.

Every uploaded file is scanned before anything can send it. A file the scanner will not clear is never sent. Every open of a document is written to the log, and a document link expires sixty seconds after it is issued.

How long we keep it.

A deal record, the documents on it and the log of what happened to it are kept for at least seven years after the file closes. A credit file has to be able to answer questions about itself years later, and a log that could be trimmed would not be a log.

Backups are taken nightly and held separately from the platform. A quick quote nobody asks to save is not kept at all.

Information sent outside Australia.

Text a broker pastes into the scenario box, and the deal figures a credit paper is drafted from, are sent to a service in the United States that reads them and returns what it read. A person confirms every figure before it counts.

An email address you give us is also held by the provider that delivers our mail, and an uploaded file passes through the scanner that clears it.

Getting a copy, and correcting it.

Write to enquiries@onpanel.com.au and ask. We will ask you to establish that you are the person the information is about, and then give you a copy of what we hold, or tell you why we cannot and what to do about it.

If something we hold is wrong, tell us and we will correct it. Where the wrong figure has already gone to a lender, we will tell them of the correction as well.

Some of what we hold cannot be changed after the fact: the log of what happened on a deal is written once and never edited, because a log that could be edited would not be evidence of anything. A correction to a figure is recorded as a new entry rather than as an edit to an old one.

Complaints.

Write to enquiries@onpanel.com.au and say what happened. We will answer within thirty days.

If our answer does not resolve it, you can take the complaint to the Office of the Australian Information Commissioner at oaic.gov.au, which is the regulator for the Privacy Act.

Ask us about your file.

Email the desk Who sees what, and when