INTRODUCTION

BOLT NZ PTY LIMITED (NZCN 9280499) and, where applicable, its related entities (we, us or our) respects the privacy of all customers, third parties, suppliers and visitors (you, your or yours) and is committed to protecting your personal information. The Privacy Act 2020 (Privacy Act) defines personal information as information about an identified individual, which includes information identifying an individual or relates to an identifiable individual (personal information).

This Privacy Policy applies to all personal information collected by us, or submitted to us, whether offline or online, including personal information submitted by you through our website and any mobile sites (Websites), applications, widgets and other mobile interactive features (collectively, our Apps), or through our official social media pages that we control (our Social Media Pages), as well as through HTML-formatted email messages that we send to you (collectively, the Apps, Social Media Pages and Websites, are the Sites).

This Privacy Policy describes how we deal with information we collect and demonstrates our commitment to the protection of your privacy. By visiting the Sites and otherwise providing personal information to us, you are accepting and consenting to the practices described in this Privacy Policy. If you do not agree with any of the terms of this Privacy Policy, please do not use the Sites or submit any personal information to us.

Any personal information we collect about you will only be used for the purposes we have collected it for as set out in this Privacy Policy or as allowed under applicable law, including the Privacy Act. We comply with the Information Privacy Principles for the protection of personal information, as set out in the Privacy Act.

KINDS OF PERSONAL INFORMATION WE COLLECT

We collect personal information from you for the purposes of dealing with you and assisting us to arrange for the products and services you request to be provided to you. We may also collect your personal information for the purposes of direct marketing (provided we have your consent) and managing our relationship with you.

The personal information we collect, and hold may include your photos, location data, contact details, such as your name, address, telephone numbers and email address, your personal details, such as date of birth, your employment information, residential status, ID photos and details, and information about your financial position, like your income, expenses, savings and assets, your reasons and objectives for applying for a product or service. We may also hold records of your communications with us.

We may collect and hold identification and transaction information about you for the purpose of our compliance with the Anti-Money Laundering and Countering Financing of Terrorism Act 2009. Your identity information may be verified with the issuer or official record holder. In certain cases, we collect your personal information from third parties, such as your nominated representative (such as a legal or financial adviser), your employer, or publicly available sources of information.

HOW DO WE COLLECT PERSONAL INFORMATION

We collect personal information about you when it is reasonably necessary for one or more of our activities or functions stated in this Privacy Policy or otherwise notified to you. This personal information is collected in a number of ways, including through the Sites. For example, we may:

• collect personal information from the Sites, such as when you visit, use or register on our Websites, Social Media Pages or Apps;
• collect personal information from you when you contact, do business or interact with us by phone, email or other channels;
• receive your personal information from other sources, such as public databases, acquired contact lists, professional bodies (for example under reciprocal arrangements), your employer, regulators and government and statutory bodies.

The provision of your personal information is voluntary. However, if you cannot, or will not, provide us with the personal information we reasonably require, we may not be able to verify your identify, assess your application for a product or service, manage our relationship with you, contact you or otherwise interact with you, perform our statutory functions, or provide you with some or all of our products and services.

We may use cookies, web beacons, and similar technologies (including analytics tools) on our Sites to automatically collect certain information, such as device identifiers, browser type, pages viewed, and usage patterns. This information may be used by us and our third-party service providers to recognise your device; track traffic patterns to and from the Site; enhance security by identifying your browser; and provide personalised features.

USE OF PERSONAL INFORMATION

We will not collect or use your personal information unless it is lawful for us to do so. We collect and use personal information for the following purposes:

• considering any application made by you for products or services offered by us;
• maintaining, reviewing and developing our business systems, procedures and infrastructure;
• working with our partners in financial transactions, including financial institutions, remitters, payment organisations and securities brokers;
• working with organisations involved in our normal business practices;
• fulfilling orders or requests for information, products or services (with your consent, if required);
• fulfilling our role as a financial services provider, including maintaining customer records, providing information on our services, products and benefits;
• for promotional and marketing purposes, including communicating information about our products and services (with your consent, if required);
• monitoring, moderating and improving our Sites;
• managing complaints, disputes and claims;
• providing information to regulators, government and statutory bodies;
• assessing or improving our products and services, as well as for training and quality purposes, including building profiles, monitoring, recording and analysing online interactions and communications between you and us;
• engaging with relevant registries using third party systems to match details contained in your passport, driver licence, birth certificate or any other identification documents you provide to us;
• providing information to third parties as authorised or required by law or a court or tribunal; and
• where the law permits or requires us to.

In addition to the specific circumstances above, we will only use your personal information with your consent when we process your personal information to send you carefully selected marketing communications about our products and services (or those of our third party partners) by email, text or push notification, depending on your operating system settings. You have the right to opt out of receiving such direct marketing at any time by following the unsubscribe instructions in our messages or by contacting us.

Our Sites may contain hyperlinks to websites operated by third parties. We are not responsible for the content of such websites, or the manner in which those websites handle any personal information you provide. In these cases, your personal information may be collected by that third party and not by us and will be subject to the third party's privacy policy, rather than this Privacy Policy. We have no control over, and are not responsible for, that third party's use or disclosure of your personal information.

DISCLOSURE OF PERSONAL INFORMATION

We do not use your personal information or disclose it to another organisation unless:

• it is reasonably necessary for one of the purposes described above or a directly related purpose you would reasonably expect;
• it is required or authorised by law, a regulator, or a court or tribunal;
• it is necessary to protect the rights, property, health or personal safety of a customer, the public or our interests, and it is unreasonable or impracticable to obtain your consent;
• it is necessary to assist any entity, body or person to locate a person who has been reported missing;
• we have reason to suspect that unlawful activity, or misconduct of a serious nature, that relates to our functions or activities has been, is being or may be engaged in, and we believe that the collection, use or disclosure is necessary in order for us to take appropriate action;
• it is necessary to obtain third party services stated in this Privacy Policy, for example to carry out data analysis or provide information processing services (where use of your information by third parties is strictly controlled);
• it is necessary to enforce our agreements, policies and terms and conditions;
• it is permitted under applicable data protection and privacy laws; or
• you have authorised the use or disclosure.

We may disclose your personal information to the following persons, where required so that we can identify, onboard or provide services to you:

• our related and associated companies, affiliates and subsidiaries, including those established in the future;
• guarantors and security providers;
• credit bureaus, credit providers, brokers, agents, remitters, financial advisors and people who act on your behalf;
• organisations involved in our funding arrangements, such as banks and financial institutions, and auditors;
• organisations that help identify illegal activities and prevent fraud;
• any data processors processing your information on our behalf;
• where applicable, third parties who provide related financial services or products in connection with our business such as our vendors, business partners, and any party assisting us in carrying out the purposes described above;
• where we have obtained your consent, parties which participate in joint marketing schemes with us;
• any agent, contractor or service provider who provides verification of identity, administrative, order processing, payment clearing, credit reference, debt collecting or other services necessary to the operation of our business;
• government agencies, statutory authorities and industry regulators, our auditors, consultants, accountants, lawyers or other financial or professional advisers; or
• third party service or product providers that provide services to us or assist us to provide our products and services.

OVERSEAS DISCLOSURES

We may use the services of certain third party service providers which may have offices or operations outside of New Zealand. As a result, your personal information may be disclosed to recipients in those foreign countries. All service providers that have access to personal information held by us are required to keep the information confidential and not to make use of it for any purpose other than on our behalf to provide services in accordance with their engagement. We will take all steps that are reasonably necessary to ensure your personal information is treated securely and in accordance with this Privacy Policy as well as applicable data protection laws.

CORRECTION / CONCERNS ABOUT PERSONAL INFORMATION

Individuals may request access to their personal information that we hold, and you may also request the correction of any personal information which is inaccurate, incomplete or out of date by contacting our Privacy Officer at privacy@bolt.app.

To request access and seek the correction of personal information held by us, please email, call or write to us. We will endeavour to respond to any access or correction request no later than 20 working days from the date on which we receive your request. We will comply with any valid request to access your personal information, except where the Privacy Act allows us to refuse to do so. If we refuse your request to access and/or correct your personal information, we will provide you with reasons for the refusal.

If you would like any further information about our handling of personal information, or to make a complaint about our handling of your personal information, or you believe there has been a breach by us of the Privacy Act, please lodge a complaint addressed to our Privacy Officer at privacy@bolt.app.

Once we receive your complaint, we will consider and respond to you within a reasonable period of time, usually within 7 working days. If you are unsatisfied with the outcome of your complaint, you may contact us further to advise of your concerns and, if we are unable to reach a satisfactory resolution, you may wish to take your complaint to the Office of the Privacy Commissioner which may be contacted via its website (https://www.privacy.org.nz/) or on 0800 803 909.

SECURITY OF PERSONAL INFORMATION

We use reasonable organisational, technical and administrative measures and security safeguards to protect, as is reasonable in the circumstances, the personal information that we hold from misuse, loss, interference and/or unauthorised access, use, disclosure or alteration. Where practicable, we implement measures to require organisations to whom disclosure is made to comply with applicable data protection and privacy laws. If a third party is given access to personal information, we take reasonable steps to ensure that the information is held securely and used only for the purpose of providing the relevant service or activity. Unfortunately, no data transmission over the internet or data storage system can be guaranteed to be 100% secure.

We will only retain your personal information for as long as is necessary for the purpose for which that personal information was collected and to the extent permitted by applicable laws. When we no longer need to use personal information, we will remove it from our systems and records and/or take steps to anonymise it so you can no longer be identified from it, subject to any legal record-keeping requirements.

VARIATIONS TO THE PRIVACY POLICY

We reserve the right to modify this Privacy Policy at any time by publishing an updated version on our Website and taking any further action as required by law, after which, your continued use of the Website or your provision of any further personal information will indicate your acknowledgement to the modified terms of this Privacy Policy.

This Privacy Policy was last updated on 8 December 2025.