Privacy Policy

1. Introduction

Mayfair Securities Pty Limited (ACN 635 437 946) trading as Compo Pronto ("Compo Pronto", "we", "us" or "our") is committed to protecting your privacy.

This Privacy Policy describes how we collect, use, hold and disclose personal information about you. We handle your information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

This Privacy Policy applies to the Compo Pronto website at compopronto.com, our application and customer-management processes, and any other dealing you have with us.

2. What is personal information?

"Personal information" means information or an opinion about an identified individual, or an individual who is reasonably identifiable. The personal information we hold about you may include your:

• name, date of birth, and contact details (postal and email addresses, mobile and other phone numbers)
• residential address and residency or visa status
• employment details, occupation and approximate income at the time of your accident
• bank account details for the purpose of paying your advance to you
• details of your personal injury claim, including the date, nature and location of the incident, the type of claim, and your treating practitioners and treatment
• the name and contact details of your solicitor and the firm representing you
• identification documents (such as a driver's licence, passport, or Medicare card) and supporting documents (such as payslips, medical certificates and insurer correspondence)
• any communication you have with us by phone, email, online form, post or any other means

3. How we collect your personal information

We collect personal information directly from you whenever possible. The main ways we collect information are when you:

• complete our online application form
• contact us by email or through our website
• upload identification or supporting documents
• respond to our follow-up enquiries about your application
• enter into a loan agreement with us
• contact us during the term of your loan

We also collect personal information about you from your solicitor and law firm (with your consent), from the at-fault party's insurer or scheme regulator (where required to verify your claim), and from third-party verification services for identity, fraud-prevention and anti-money-laundering checks.

4. How we use your personal information

We collect, hold and use your personal information to:

• assess your application for a Compo Pronto advance
• verify your identity in line with our anti-money-laundering and counter-terrorism financing obligations
• verify the basics of your claim with your solicitor
• prepare and administer your loan agreement and Irrevocable Repayment Authority
• process and pay your advance to your nominated Australian bank account
• communicate with you about your loan, including reminders and updates
• coordinate repayment with your solicitor at the time of settlement
• respond to your enquiries and any complaints you make
• comply with our legal, regulatory and tax obligations
• operate, manage and improve our business and services

We will not use your personal information for direct marketing without your consent. If you do consent to receive communications from us about new products or services, you can withdraw that consent at any time by emailing privacy@compopronto.com.au.

5. When we disclose your personal information

We only disclose your personal information where it's needed to provide our service to you, comply with the law, or run our business. The people and organisations we may disclose to include:

• Your solicitor and law firm, to confirm the basics of your claim and to coordinate repayment at settlement
• Identity-verification and fraud-prevention service providers, to confirm your identity and check for unusual patterns of activity
• Banks and payment providers, to pay your advance and to receive repayment
• Our professional advisers, including our lawyers and accountants, as needed
• Our parent and related companies, including our parent entity Atlas Advisory LLC (United Arab Emirates), for the purposes of capital management and consolidated business operations
• Government and regulatory bodies, including the Australian Securities and Investments Commission (ASIC), AUSTRAC, the Australian Taxation Office (ATO), and law-enforcement agencies, where we are required or authorised by law to do so
• Service providers who help us operate our business, including IT, document-management, and customer-communication providers

Where we share your information with our parent entity, this disclosure occurs in the course of internal business operations between related corporate entities. Our parent entity is bound by confidentiality obligations and we take steps to ensure your information continues to be protected in accordance with Australian standards.

6. Sensitive and health information

Because of the nature of our service, we collect health information about you — including details of your injuries, your treatment and your medical history relating to your claim. Health information is treated as "sensitive information" under the Privacy Act and we apply additional protections to it.

We collect this information only with your consent, and only to the extent necessary to assess your application and to verify the basics of your claim with your solicitor. We do not disclose your health information to anyone other than your solicitor, our professional advisers, our internal underwriting and risk team, and (where you authorise this) the insurer handling your claim.

7. Your solicitor and trust account information

When you apply for a Compo Pronto advance, we may communicate with your solicitor to confirm the existence and status of your claim. By submitting an application, you authorise us to contact your solicitor and authorise your solicitor to share with us information about your claim that is relevant to our assessment.

If we approve your application, your solicitor will be asked to sign an Irrevocable Repayment Authority — a separate document under which they undertake to repay us, from settlement funds held in their trust account, the amount owing under your loan agreement at the time of settlement. This document is given to your solicitor before any funds are advanced, and is shared with you.

8. Cookies, IP addresses and analytics

When you visit our website, we may collect your IP address, browser type, operating system, and information about how you navigate the site. We do this for the purposes of site security, fraud prevention, and analytics.

We use cookies (small text files placed on your device) to remember your preferences, manage your session if you're logged in, and understand how visitors use our site. You can disable cookies through your browser settings — though doing so may affect the functionality of the site.

We may use Google Analytics or similar de-identified-data analytics tools to understand site usage patterns. These tools do not enable us to identify you personally.

9. Storage and security

We take reasonable steps to protect your personal information from misuse, interference, loss, unauthorised access, modification or disclosure. Our security measures include:

• encryption of data in transit (https) and at rest where appropriate
• access controls and authentication for our internal systems
• regular reviews of our security practices
• secure storage of physical documents
• training of our staff on privacy and security responsibilities

We retain your personal information for as long as is necessary to provide our services to you and to meet our legal obligations — including obligations under taxation, anti-money-laundering, and dispute-resolution legislation. We then take reasonable steps to destroy or de-identify it.

Some of our service providers (including cloud storage and email providers) may be located outside Australia. Where this is the case, we take reasonable steps to ensure that overseas recipients handle your personal information in line with Australian standards.

10. Accessing and correcting your information

You have the right to access and correct personal information that we hold about you, subject to limited exceptions under the Privacy Act.

To request access or correction, contact our Privacy Officer at privacy@compopronto.com.au or by post:

Privacy Officer
Mayfair Securities Pty Limited
Level 2, 327 George Street
Brisbane QLD 4000

We will respond to your request as quickly as possible — usually within 30 days. We may need to verify your identity before processing your request. In limited circumstances we may decline access (for example, where giving access would be unlawful, would unreasonably affect another person's privacy, or would prejudice an investigation). If we do, we will give you reasons.

We don't charge a fee for making a privacy request. If retrieving a large volume of information involves cost to us, we may charge a reasonable fee for retrieval, but never for the request itself.

11. Complaints

If you believe we have breached your privacy or this Privacy Policy, please contact our Privacy Officer (details above). We take privacy complaints seriously and will investigate and respond within a reasonable time, generally within 30 days.

If you're not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC):

• Website: oaic.gov.au
• Phone: 1300 363 992
• Post: GPO Box 5288, Sydney NSW 2001

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The current version will always be available on our website, with the "Last updated" date at the top. We encourage you to review this policy periodically.

This Privacy Policy is provided in good faith and reflects our current practices. It does not constitute a legal contract or a representation about future practices. For specific legal advice relating to your personal circumstances, please consult a lawyer.