CDR Policy

Data you may share with Fiskil

You can consent to share your data with Fiskil or other CDR regulated customers (accredited persons).

Fiskil will only collect, hold and use your CDR data for the purpose of providing it to another participant that you have consented to share it with, potentially including one of our CDR Representatives

The types of CDR data we may ask you to share will depend on the service being provided to you. We will always clearly explain which types of data we need and why we require it before asking you to share any of your data. You may withdraw your consent at any time although this action may affect our ability to provide our services to you.

Fiskil adheres to the data minimisation principle, we only collect data necessary to provide a specified product or service to you. As an unrestricted Accredited Data Recipient, Fiskil operates within all designated CDR sectors and is therefore permitted to collect any of the following types of data having first secured appropriate consumer consent.

You can share the following CDR Data with us:

Banking Data

Energy Data

Overall Rights

As a consumer you have control over who you share your data with.

Any recipient of data is regulated by the ACCC and must meet requirements like

• Continuous quality monitoring
• Internal dispute resolution;
• Information security measures;
• Service level agreements;
• Audits; and
• Other stipulations in place by the Data Accreditation Body.

You may choose to share your data that is held by an existing data holder (like a banking institution or Energy Provider) with an accredited data recipient (like another banking institution, Energy retailer or fintech).

We will only use your data for the purpose you have agreed to, and we will delete it after it has been used for that purpose. Fiskil does not hold any redundant data.

How we collect your CDR Data

When you request a service from a Fiskil Partner and provide your consent, Fiskil facilitates the provision of that service by the Partner. Fiskil collects your CDR Data for this purpose directly from yourEnergy provider, bank or other financial institution via an application programming interface (API).

The types of services that will involve the collection of your CDR Data (with your consent) include:

• Personal Financial Management: uses this information to provide users with insights about where their money is going, and tools to manage their money more effectively
• Data Aggregation and Enrichment: your CDR Data is aggregated, enriched and demystified to provide a single view of your finances across each of your banks.
• Spending Insights: your CDR Data is analysed to provide insights into spending, including the category of spend.
• Income Insights: your CDR Data is analysed to identify your income streams including surfacing patterns around regularity and stability.
• Affordability Report: insights above are presented in an easy to read PDF report.

When we can share your CDR Data

• When you request a service from a Partner and provide your consent, Fiskil will support the provision of that service and share your CDR Data with the Partner as reasonably necessary for that purpose
• When we share your CDR data with Partners, they are required to operate in accordance with CDR controls and privacy protections.

Consent Management

You have rights to decide which data types you will share, such as profile, payments, transaction, or product information; how long you will be sharing, whether it is a one-time sharing or an ongoing process; and whether you want to receive marketing material based on the data you have shared.

Consent can only last for a maximum of twelve (12) months, After 12 months your consent expires and you can either re-confirm your consent or explicitly withdraw your consent. If you don’t actively state your preference, your consent will automatically be withdrawn..

You are able to review, modify or withdraw any CDR consent you have provided through the relevant Partner application. You can also withdraw your consent by contacting us in writing, or via the data holder consent dashboard (provided by your Energy provider, bank or other financial institution).

Your consent can be withdrawn at any time, in several ways, such as by using the dashboard that the Data Recipient uses to gain consent, the one that the Data Holder uses, or via a letter.

With written notification, the revocation must be completed within two business days. Your change in consent status (for example, active, expired, or withdrawn) will be reflected in the consent dashboard in near real-time. Fiskil will remove your data if you revoke your consent.

Consent notifications

You’ll receive a notification every 90 days to confirm the data you have shared, the expiry date and other consent information. You’ll also receive a notification with a summary of these details any time you:

• Grant consent to Fiskil for the collection, use, or disclosure of your CDR data
• Anytime Fiskil collects your CDR data;
• Anytime Fiskil discloses your CDR data to third parties;
• Amend your consent(e.g., change the scope or duration of data sharing);
• Withdraw consent; or
• When your consent expires.

These notifications are mandatory and cannot be opted out of

Withdrawing Consent

You can withdraw your consent at any time and we will stop collecting, using or disclosing your CDR Data for the agreed purpose.

Data Management

You must contact us to request data correction. Erroneous data must be provided for data analysis and data correction. Fiskil will, upon notification by phone or email, update the consumer dashboard with the request and notification of the corrective action, if applicable.

Where applicable, all notices are emailed out via the consumer&spos;s dashboard. The notice lists Fiskil&spos;s response to the request, any action taken, and any options for resolving any dissatisfaction that the consumer may have.

Data Deletion

Fiskil follows a strict policy of data minimisation, which requires that a data recipient can only ask you for data that is absolutely necessary and can only hold it for the minimum amount of time it is needed to provide their service.

Consumers do not need to elect to have redundant CDR data deleted, as Fiskil automatically deletes all redundant CDR data once it is no longer needed for the agreed purpose. When you give consent to Fiskil to collect and use your CDR data, we will also inform you that your redundant CDR data will be automatically deleted when it becomes unnecessary, in accordance with our general policy. This will be clearly communicated at the time of consent, as per rule 4.16(3) of the CDR Rules.

We will only use your data for the purpose you have agreed to, and we will delete it after it has been used for that purpose. Fiskil does not hold any redundant data.

Fiskil will automatically irretrievably destroy your data within seconds of any of the following events:

• your consent expires;
• you stop sharing data with us before consent expires via an election on your consent dashboard;
• you request data sharing to stop via the data holder that provided your data;
• an accredited person requests that we delete your data; or
• you notify Fiskil in writing that you withdraw your consent, by sending an email to

  support@fiskil.com.au

  .

Data Disclosure

To ensure customer control over their data, Fiskil does not provide information to third parties to engage in direct marketing. This means that:

• Fiskil does not share or use your personal data (including energy or banking data) for commercial purposes.

• Fiskil does not provide personal banking data to non-accredited or accredited individuals, regardless of their location.

• Fiskil does not release your data to anyone. If these arrangements change, this list will also be adjusted using the outsourcing arrangements.

Outsourced Service Providers

Fiskil does not provide CDR data to any outsourced providers. Fiskil develops and maintains its own software for use with banking data collected under the CDR Rules.

Data Storage Locations

Your data is onshore and only resides in Australia. Storage policies from outsourced parties will be used for this list's maintenance.

Events for notifying you

Fiskil maintains a Data Breach Response Plan. In the event of a data breach (such as where an unauthorised party accesses your CDR Data, we will notify you as soon as practical. This is so you can take action to mitigate any potential damage or loss caused by the data breach.

If a security breach occurs, we will:

• Contain the data breach to prevent any further leak of personal information;

• Investigate the data breach by gathering the facts and taking action to reduce any risk of harm;

• Notify the Commissioner if the breach is an ‘eligible data breach’ under the Notifiable Data Breach scheme; and

• Review the incident and improve our processes, policies and controls to prevent future breaches.

Complaint Management and Dispute Resolution

If you have a question or complaint about how your personal information is being handled by us or our Partners or supporting parties, please contact us at any time by using the contact details below. Our internal dispute resolution process is easy to access and is free of charge.