Book a HeroPrivacy Policy
How we collect, use, store and disclose your personal and credit information while we help you with a loan — and the choices you have about it.
Effective date: 12 August 2026
1. About this policy
Eliteway Finance Pty Ltd trading as Mortgage Superheroes (“Mortgage Superheroes”, “we”, “us”, “our”) is a finance and mortgage broking business. We help Australians compare and apply for home loans, refinances, equity release, debt consolidation, self employed and business lending, and commercial finance.
This policy explains how we handle your personal information. It applies to mortgagesuperheroes.com.au, our online tools, forms and booking pages, our advertising, and every other way you deal with us. We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Where we handle credit related information we also comply with Part IIIA of the Privacy Act and the Privacy (Credit Reporting) Code. Our marketing complies with the Spam Act 2003 (Cth) and the Do Not Call Register Act 2006 (Cth), and our credit activities with the National Consumer Credit Protection Act 2009 (Cth).
Before we collect detailed financial information for a credit application, we also give you a separate Privacy Disclosure Statement and Consent, and a Credit Guide where required. Where that document differs from this policy for a particular application, it applies.
2. What we collect and how
What we collect depends on what you ask us to do. It may include:
- Identity and contact details: name, date of birth, address history, phone, email, residency and visa status, and identity documents such as your driver licence or passport, which we verify to meet anti money laundering and lender requirements.
- Financial information: income, employment, assets, liabilities, living expenses, bank statements and transaction data, business financials, details of the property or security, and your goals, requirements and objectives.
- Credit information: credit reports, scores, repayment history, defaults, judgments and insolvency information (see section 3).
- Sensitive information, only with your consent and only where relevant: health information for a hardship or insurance discussion, and relationship and dependant details where a lender assesses them.
- Website and advertising data: IP address, device and browser type, pages viewed, figures entered into our calculator, the ad or search that referred you, campaign tracking parameters, and cookies and similar identifiers (see section 7).
- Records of our dealings: emails, SMS, file notes of calls and meetings, application records and the basis for our recommendations, which we are required to keep.
Wherever reasonable we collect information directly from you, through our enquiry form, calculator, online booking tool, a lead form inside Google or Meta advertising, phone, email, or a fact find. We may also collect it, where you have consented or the law permits, from credit reporting bodies, lenders and insurers, your accountant, adviser or conveyancer, co applicants and guarantors, referral partners, our aggregator and software platforms, identity, valuation and bank statement services, and public registers.
If you give us information about another person, please make sure they know and agree. If we receive information we did not ask for and could not lawfully collect, we destroy or de identify it.
3. Credit reporting information
With your written consent, we or a lender may obtain a credit report about you from a credit reporting body. The credit reporting bodies in Australia are Equifax, Experian and illion, and each publishes its own credit reporting policy. We use credit related information only to help you obtain or vary credit, to assess whether a loan is not unsuitable for you, to support a lender assessment or hardship request, and to meet our legal obligations. You can:
- obtain a free copy of your credit report from each body once every three months, and free of charge if you have been refused credit in the past 90 days;
- ask a credit reporting body, or ask us to assist, to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading;
- ask a credit reporting body not to use your information for pre screening direct marketing offers of credit; and
- ask a credit reporting body to place a ban period on your information if you believe you are or may become a victim of fraud. A ban runs for 21 days initially and can be extended.
4. Why we use it and who we share it with
We use personal information to respond to your enquiry, assess your position and borrowing capacity, compare and recommend loan products, prepare and lodge applications, verify your identity, meet anti money laundering and fraud obligations, support hardship requests and variations, review your loan over time, administer our relationship with you, handle complaints, comply with our legal, licensing and audit obligations, operate and improve our website and systems, measure and improve our advertising, and send you updates where permitted.
We disclose personal information only as needed for those purposes, to: lenders, mortgage managers and mortgage insurers; our aggregator, licensee and their compliance staff; credit reporting bodies and other credit providers as permitted by Part IIIA; valuers, solicitors, conveyancers, accountants, advisers and agents involved in your transaction; insurers and insurance brokers where you ask us to refer you; referral partners; service providers including hosting, email, CRM, e signature, document collection, telephony and SMS, online booking, identity verification and IT security; analytics and advertising platforms (section 7); our lawyers, accountants, auditors and insurers; government agencies, regulators, courts and dispute resolution bodies where required or authorised by law; a purchaser of our business, subject to confidentiality; and anyone else you direct or consent to.
We do not sell your personal information or rent client lists. We use or disclose information for another purpose only with your consent, where you would reasonably expect it and the purpose is related (directly related, for sensitive information), or where required or authorised by law.
5. Sending information overseas
Your information is primarily stored in Australia, but some providers store, process or access data overseas. It is likely to be disclosed to recipients in the United States (hosting, email, CRM, e signature, booking, analytics and advertising platforms), Ireland and other European Union states and the United Kingdom (regional data centres and support), and Singapore and New Zealand (regional infrastructure and technical support). Before disclosing information overseas we take reasonable steps to ensure the recipient does not breach the APPs, usually through contractual protections. This list reflects our current providers and may change; contact us for the current position.
6. Marketing and your choices
If you have dealt with us or enquired, we may send you rate and market updates, guides, offers and news by email, SMS, phone, post and through advertising platforms. Every marketing email and SMS identifies us and includes a working unsubscribe option, as the Spam Act requires. To stop marketing, use the unsubscribe link, reply STOP to an SMS, or contact us using the details in section 11. We action requests promptly and within five business days. Opting out does not stop us contacting you about an application in progress, an existing loan or a complaint. We do not disclose your information to other organisations for their own marketing unless you ask us to make an introduction or separately consent.
8. Automated decisions
We do not make decisions that could significantly affect your rights or interests solely by automated means. A person at Mortgage Superheroes always reviews and is accountable for the advice we give. We do use software that processes your information automatically to support that work: our borrowing power and serviceability calculators produce indicative estimates only, which are not credit decisions, offers or pre approvals; product comparison tools rank or filter loans against the information we hold, which a broker then reviews; identity, bank statement, credit scoring and fraud screening tools return a result or score that a person assesses; and our marketing systems may segment contacts and trigger emails or advertising audiences based on your enquiry and activity. Lenders use their own automated credit assessment systems, which their privacy policies describe. If you would like a decision explained or reviewed by a person, contact us and we will do that.
9. Security, data breaches and how long we keep information
We hold information electronically in our business systems and those of the providers in section 4, and a limited amount in paper form. We take reasonable steps to protect it from misuse, interference, loss and unauthorised access, including access controls, multi factor authentication, encryption in transit and at rest, secure document collection instead of plain email, endpoint protection and patching, staff confidentiality obligations and training, provider due diligence, and secure destruction. No system is perfectly secure, so please do not email complete identity documents or full account numbers unless we have given you a secure method.
If a data breach is likely to result in serious harm and we cannot prevent that harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) under the Notifiable Data Breaches scheme, and any relevant credit provider or credit reporting body. Tell us immediately if you think your information has been compromised.
We keep information only as long as we need it or the law requires. Credit assistance records, application files and identity verification records generally must be kept for at least seven years after our engagement ends, and longer where a complaint or claim is unresolved. We then destroy or de identify the information securely.
10. Access, correction, anonymity and identifiers
You can ask for access to the personal information we hold about you and ask us to correct it. Contact us using the details in section 11, describing what you need. We verify your identity first and respond within 30 days. There is no charge to make a request or to correct information; we may charge a reasonable fee for the work of giving access, and will tell you the amount first. The Privacy Act allows us to refuse access in limited cases, such as where it would unreasonably affect the privacy of another person, or relate to anticipated legal proceedings. If we refuse access or a correction, we tell you why in writing and how to complain. If we have already passed incorrect information to a lender or credit reporting body, you can ask us to notify them of the correction.
You can browse our site, use our calculator and ask general questions without identifying yourself. Once you ask us for credit assistance we cannot act anonymously, because lenders and the law require verified identity. We do not adopt government identifiers such as your tax file number, Medicare or licence number as our own identifier for you, and use them only for the purpose they were collected.
11. Complaints and contact
If you think we have breached the APPs, the Privacy (Credit Reporting) Code or Part IIIA, please tell our Privacy Officer at support@mortgagesuperheroes.com.au or (03) 6144 9669, marking your message “Privacy complaint”. We acknowledge complaints within five business days and give you a written response within 30 days.
- Phone
- (03) 6144 9669
- Post
- Level 6/150 George Street, Parramatta, NSW, 2150
If you are not satisfied, you can contact the Australian Financial Complaints Authority (AFCA), our free external dispute resolution scheme, at afca.org.au, info@afca.org.au, 1800 931 678, or GPO Box 3, Melbourne VIC 3001. You can also complain to the OAIC at oaic.gov.au or 1300 363 992, or GPO Box 5218, Sydney NSW 2001. For credit reporting issues you may also complain directly to the credit reporting body or credit provider.
We review this policy regularly and may update it. The current version is always at mortgagesuperheroes.com.au/privacy-policy with its effective date shown above, and we will take reasonable steps to tell you about significant changes. A copy of the Australian Privacy Principles is available at oaic.gov.au.