Privacy Policy

1. Who we are

In this policy, “we”, “us” and “our” mean Andorra Capital Solutions Pty Ltd (ACN 675 464 623 / ABN 32 675 464 623), trading as Private Credit Loans. We are a commercial finance broker and introducer. We arrange property-secured business-purpose loans between Australian corporate borrowers and a panel of non-bank lenders and private investors. We are not a lender; we do not provide credit.

We are bound by the Privacy Act 1988 (Cth) (the Privacy Act) and the 13 Australian Privacy Principles (APPs) set out in Schedule 1 of that Act. This policy explains how we collect, hold, use and disclose personal information, and how you can access and correct it or make a complaint.

2. What information we collect

We collect personal information that is reasonably necessary for our functions as a commercial finance broker. The categories of personal information we collect include:

• Identification information: full name, date of birth, residential address, identity-document details (driver licence, passport), photographs and signatures.
• Contact details: phone number, email address, postal address.
• Entity details: company name, ABN/ACN, trust deeds, partnership agreements, beneficial ownership information, director and shareholder details.
• Financial information: income, assets, liabilities, bank statements, tax returns, business activity statements, financial statements, valuation reports, security property details, existing loan information.
• Loan-purpose information: business plans, contracts, invoices and other documents evidencing the business purpose of the funds.
• Correspondence: emails, phone records, file notes, written communications between you and us.
• Technical information: IP address, browser user-agent, referrer URL, pages viewed, device type, and (where you accept analytics) anonymised behavioural data collected through Google Analytics 4 and Microsoft Clarity (see section 8).

We generally collect personal information directly from you when you submit an enquiry, send us documents, or correspond with us. In limited circumstances we may collect information from third parties (for example, your accountant, a referring broker, or a panel valuer) with your authority.

Sensitive information. We do not ordinarily collect “sensitive information” as defined in the Privacy Act (health information, racial or ethnic origin, political opinions, religious beliefs, sexual orientation, criminal record, etc.). If we ever need to collect sensitive information (for example, where it appears on an identity document), we will only do so with your express consent and only to the extent reasonably necessary.

3. Why we collect it

We collect personal information for purposes related to arranging finance and complying with our legal obligations, including:

• Assessing your enquiry and packaging your loan application for submission to panel lenders and private investors.
• Performing identity verification, Know Your Customer (KYC) and Anti-Money Laundering / Counter-Terrorism Financing (AML/CTF) checks as required by law.
• Verifying that the proposed loan has a genuine business or investment purpose and that the borrower is an entity (consistent with our model — see our Business Purpose Declaration page).
• Communicating with you about your enquiry and any loan we are arranging on your behalf.
• Meeting record-keeping, tax and regulatory obligations (including under the Corporations Act 2001, the AML/CTF Act 2006, and Australian Taxation Office requirements).
• Improving our website, our enquiry form, and our service.
• Responding to complaints, disputes and regulatory enquiries.

If you do not provide the personal information we ask for, we may not be able to arrange finance for you or progress your enquiry.

4. Who we share it with

This is fundamental to our broker model. We arrange loans by presenting your application to panel lenders and private investors. We cannot do this without disclosing personal information about you and your transaction to those parties. By submitting an enquiry, you authorise us to disclose your personal information for this purpose. We disclose personal information to:

• Panel lenders and private investors to whom we present your loan application for credit assessment.
• Panel valuers to obtain independent valuations of any security property.
• Panel solicitors and conveyancers to prepare loan and security documentation and to attend to settlement.
• Quantity surveyors and project monitors where construction or progress-claim funding is involved.
• Your professional advisors (accountants, lawyers, financial planners, mortgage brokers referring you) with your authority.
• Our service providers listed in section 5.
• Government agencies, regulators and law-enforcement bodies where required or authorised by law.

We do not sell personal information. We do not disclose your personal information for the marketing purposes of any third party.

5. Where it is stored and processed

We use the following service providers to operate our website, hold your data, and communicate with you:

• Supabase (database and document storage) — primary instance hosted in the ap-southeast-2 (Sydney) region. Personal information you submit through our enquiry form is stored in Australia.
• Vercel (website hosting and edge delivery) — global edge network with primary compute in the region nearest the visitor; static content may be served from edge nodes outside Australia.
• Resend (transactional email delivery, United States) — processes the contents of emails we send to you and our internal notifications.
• Cloudflare (security, bot protection, including the Turnstile CAPTCHA on our forms, global) — processes IP address and basic request metadata.
• Google Analytics 4 (only if you have accepted analytics — see section 8, United States).
• Microsoft Clarity (only if you have accepted analytics — see section 8, United States).
• Our internal email accounts and document-management systems, used by our credit team to communicate with you and panel lenders.

Disclosure to overseas recipients (APP 8). By using our website and submitting an enquiry, you acknowledge that some of the recipients listed above process personal information outside Australia (principally in the United States, and at Cloudflare and Vercel edge locations worldwide). We take reasonable steps to ensure those recipients do not breach the Australian Privacy Principles in relation to your personal information.

6. How we hold and protect your information

We take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification and disclosure, including:

• Encryption in transit (TLS 1.2 or higher) for all web traffic.
• Encryption at rest for data held in Supabase and our email providers.
• Role-based access controls so that only authorised personnel can access stored personal information.
• Multi-factor authentication on administrative accounts.
• Rate-limiting, CAPTCHA and other measures against bots and abuse.
• Periodic review of our security practices and our service providers’ security certifications.

7. How long we keep it

We retain personal information for as long as it is needed for the purposes for which it was collected, and for as long as required by law. As a guide:

• Settled loans: at least seven (7) years from the end of the loan relationship, in line with AML/CTF Act 2006 and Australian Taxation Office record requirements.
• Declined or withdrawn applications: generally up to two (2) years from the date the application ceased to be active, after which the file is destroyed or de-identified.
• Partial enquiries (those that never reached submission): up to twelve (12) months, after which the file is destroyed or de-identified.
• Email and correspondence: aligned with the underlying file retention above.

When personal information is no longer needed and we are not required to retain it by law, we destroy or de-identify it.

8. Cookies, analytics and tracking

We use a small number of strictly necessary cookies to operate our website (for example, to remember that you have started an enquiry so you can resume it). These do not require your consent.

We also use the following analytics tools, but only if you accept analytics in the consent banner shown when you first visit:

• Google Analytics 4 (GA4) — provided by Google LLC (United States). Collects information about how you use our website (pages viewed, time on page, referral source, device type). We have enabled IP anonymisation and disabled Google advertising signals. See Google’s privacy policy.
• Microsoft Clarity — provided by Microsoft Corporation (United States). Collects anonymised heatmaps and session recordings (with form input masking) to help us understand how visitors interact with the site. See Microsoft’s privacy statement.
• Google Tag Manager — a tag-deployment utility (no analytics data of its own).

Withdrawing consent. You can withdraw your consent at any time by clearing the pcl_consent cookie in your browser, or by emailing us at nicholas@andorraprivate.com.au. You can also use your browser’s standard cookie controls and the opt-out tools published by Google and Microsoft.

We do not use third-party advertising pixels (Meta, LinkedIn, Google Ads conversion pixel) at this time. If we add any advertising pixel in the future, we will update this policy and re-prompt you for consent.

9. Direct marketing

We do not currently send marketing communications. If we ever do, we will only send them to people who have an existing business relationship with us, we will identify ourselves as the sender, and every message will contain a simple unsubscribe mechanism in accordance with the Spam Act 2003 (Cth).

10. Automated decision-making

We do not use solely automated processes to make decisions that significantly affect you. Credit assessment, declines and offers are made by human credit officers — either at panel lenders or private investors who consider your application, or by our own brokers when assessing whether to put your enquiry forward.

We may use automated tools to assist with non-decisional tasks (for example, basic eligibility filtering at the enquiry stage, spam detection, document classification). These tools support human judgement; they do not replace it.

11. Access and correction

You have the right under APP 12 to request access to the personal information we hold about you, and under APP 13 to request correction of personal information that is inaccurate, out of date, incomplete, irrelevant or misleading. To make a request, email nicholas@andorraprivate.com.au and put “Privacy request” in the subject line.

We will respond within a reasonable period (generally 30 days). We may need to verify your identity before providing access. If we decline a request, we will give you written reasons.

12. Complaints

If you believe we have handled your personal information in a way that breaches the Privacy Act or the Australian Privacy Principles, please contact us first at nicholas@andorraprivate.com.au. We will acknowledge your complaint within five (5) business days and aim to resolve it within thirty (30) days.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):

• Website: oaic.gov.au
• Phone: 1300 363 992
• Post: GPO Box 5288, Sydney NSW 2001

For complaints relating specifically to a loan we have arranged (rather than to our handling of your personal information), see our Complaints page.

13. Children

Our services are directed to Australian businesses (Pty Ltd and other entity borrowers) and are not intended for individuals under 18. We do not knowingly collect personal information from children. If you believe a child has provided personal information to us, please contact us and we will delete it.

14. Changes to this policy

We may update this policy from time to time. The current version and the date last updated are shown at the top of this page. If we make a change that materially reduces the protections we offer to your personal information, we will give you reasonable advance notice (for example, by email or by a prominent notice on our website).

15. Contact us

Privacy queries, access and correction requests, and complaints can be directed to:

• Privacy Officer, Andorra Capital Solutions Pty Ltd
• Email: nicholas@andorraprivate.com.au
• Phone: 0480 521 605
• Post: Suite R1926, 38-40 Pitt Street, Sydney NSW 2000