Privacy Policy – HQ Mortgage

Effective date: 14 October 2026
Last reviewed: 14 October 2026

1. About this Privacy Policy

HQ Mortgage is the trading name of INRIM Consulting Group Pty Ltd (ABN 77 620 129 679) (we, us or our).

We hold Australian Credit Licence 559779 and provide finance and credit assistance services, including home loans, refinancing, investment property finance, vehicle and equipment finance, and commercial property finance.

We are committed to protecting personal information and handling it in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), and other applicable privacy, credit and financial services laws.

This Privacy Policy explains how we collect, hold, use, disclose, protect, access and correct personal information in connection with our website and business activities.

This policy applies when you visit our website, contact us, enquire about our services, provide information to us, or engage us for finance-related services.

This policy should be read alongside any separate privacy collection notice, consent, credit reporting authority, application documentation or other disclosure we provide in connection with a particular service or transaction.

2. What Personal Information Do We Collect?

The personal information we collect depends on your enquiry, circumstances and the services you request.

It may include the following categories.

2.1 Identity and contact information

Full name, date of birth and residential address.
Telephone number and email address.
Identification documents and identity verification information.
Contact details of relevant representatives, co-applicants or guarantors.

2.2 Financial and employment information

Employment, occupation and income details.
Living expenses, assets, liabilities and existing financial commitments.
Bank statements, payslips, tax returns and notices of assessment.
Financial statements, business records and other supporting financial documents.

2.3 Credit and lending information

Existing loan details and repayment information.
Information about credit applications and lending history.
Credit reports and credit-related information, where lawfully obtained.
Information relevant to assessing a finance application or providing credit assistance.

2.4 Property, vehicle and asset information

Property ownership details, contracts and valuations.
Vehicle, truck, equipment and other asset details.
Information about proposed purchases, refinancing or other finance transactions.

2.5 Business, company and trust information

Company, trust and business details.
Relevant ownership, directorship and control information.
Business financial statements and supporting records.
Information about directors, trustees, beneficiaries, guarantors and other relevant parties where necessary for a transaction.

2.6 Communications and application information

Enquiries, instructions, correspondence and records of our dealings with you.
Finance application details and supporting documents.
Information required for administration, compliance, complaints and dispute resolution.

2.7 Website and technical information

IP address, browser type and device information.
Website usage information.
Cookie, analytics and similar technology information, where applicable.

2.8 Sensitive information

We do not ordinarily seek sensitive information unless it is reasonably necessary for a relevant function or activity and its collection is permitted by law. If sensitive information is required, we will handle it in accordance with applicable legal requirements, including any consent requirements.

We aim to collect only information reasonably necessary for our functions and activities, subject to applicable law.

3. How Do We Collect Personal Information?

We may collect personal information directly from you when you:

Submit an enquiry or contact form through our website.
Contact us by telephone, email, messaging or other communication channels.
Discuss your financial circumstances or finance requirements with us.
Provide documents or information for a finance application.
Complete client onboarding, privacy or consent documentation.
Use our website or interact with our electronic communications.

Where permitted by law and reasonably necessary for our services, we may also collect personal information from third parties, including:

Lenders, banks and other finance providers.
Mortgage and finance aggregators and their associated platforms.
Credit reporting bodies and identity verification providers.
Employers, accountants, solicitors and other professional advisers.
Co-applicants, guarantors and authorised representatives.
Valuers, insurers and other parties involved in a transaction.
Public registers and other lawful sources.

Where required by law, we will take reasonable steps to notify you of relevant matters when we collect personal information, including the circumstances of collection, purposes of collection, usual disclosures, consequences of not providing information and how you can access further privacy information.

If you provide personal information about another person, you should ensure you are authorised to provide it and, where appropriate, inform that person about the disclosure.

4. Why Do We Collect, Hold and Use Personal Information?

We may collect, hold, use and disclose personal information for purposes including:

Responding to enquiries and providing information about our services.
Understanding your objectives, requirements and financial circumstances.
Assessing whether a finance product or proposed transaction may meet your stated needs.
Assisting with the preparation, submission and management of finance applications.
Communicating with lenders, finance providers and relevant service providers.
Verifying identity and checking information supplied in connection with a transaction.
Obtaining or using credit information where legally permitted and appropriately authorised.
Managing client relationships, records and administration.
Meeting legal, regulatory, licensing, compliance and recordkeeping obligations.
Preventing, detecting or investigating fraud and other unlawful activity.
Handling complaints, disputes and legal proceedings.
Maintaining and improving our business systems, services and website.
Sending marketing communications where permitted by law.

We will only use or disclose personal information for the purpose for which it was collected, a related purpose where permitted by law, or another purpose authorised or required by law.

Where consent is required for a particular use or disclosure, we will seek that consent in the applicable circumstances.

5. What Happens If You Do Not Provide Personal Information?

You may choose not to provide certain information. However, where information is reasonably necessary to respond to your enquiry or provide a requested service, we may be unable to proceed without it.

For example, insufficient information may prevent us from assessing your circumstances, verifying your identity, preparing a finance application or providing credit assistance.

Where applicable, we will explain the information required and the consequences of not providing it.

6. Who May Receive Your Personal Information?

Depending on the service, application and circumstances, we may disclose relevant personal information to the following categories of recipients.

6.1 Lenders and finance providers

We may provide information to banks, lenders and other finance providers when assisting with a finance application or transaction.

6.2 Mortgage and finance aggregators

We use mortgage and finance aggregation services and associated platforms to support our business and the provision of finance assistance. These arrangements include LMG’s MyCRM and Connective’s relevant systems, including Mercury, where applicable.

6.3 Credit reporting and verification providers

Where permitted by law and appropriately authorised, information may be provided to or obtained from credit reporting bodies, identity verification providers and fraud prevention services.

6.4 Transaction-related service providers

Depending on the transaction, we may disclose relevant information to valuers, insurers, solicitors, accountants and other professional advisers or service providers.

6.5 Technology and document-processing providers

We may use CRM, remote access, cloud, document management, electronic signature, document-processing, email and IT support services. These may include AWS-hosted remote access infrastructure and Soda PDF, where applicable.

6.6 Staff and contractors

Authorised staff and contractors may access relevant information where required to perform their duties and where access is appropriately permitted.

This includes authorised personnel located outside Australia, as explained in Section 7.

6.7 Regulators and other authorised recipients

We may disclose information to courts, government agencies, regulators, law enforcement bodies or other parties where required or authorised by law, or where otherwise permitted by law.

We may also disclose information to another party where you have authorised the disclosure or where the disclosure is otherwise lawful.

Not every category of recipient receives information in every case. Disclosures depend on the particular transaction, the services being provided and applicable legal requirements.

7. Overseas Access, Disclosure and Processing

Our business uses an AWS-hosted remote access environment with a server located in Sydney, Australia.

Some authorised staff or contractors located in India and the Philippines may remotely access personal information held in our business systems to perform authorised business, administrative, document-processing or support tasks.

Our AWS remote access server is located in Australia. However, the location of that server does not, by itself, establish the storage or processing location of every third-party platform or service we use.

Where a separate overseas contractor or service provider receives or is given access to personal information, this may constitute an overseas disclosure under applicable privacy law, even if the information remains stored on an Australian server.

We recognise that overseas access and handling may give rise to privacy obligations. We maintain arrangements intended to protect personal information accessed by overseas staff and contractors, including appropriate confidentiality, access, security and data-handling requirements.

We will take the steps required by applicable law in relation to overseas disclosures, including reasonable steps to protect personal information and, where required, to ensure overseas recipients handle it consistently with applicable Australian privacy requirements.

Depending on the circumstances, safeguards may include:

Restricting access to authorised personnel.
Limiting access to information required for the relevant task.
Applying confidentiality and data-handling obligations.
Using access controls and secure remote access arrangements.
Establishing appropriate contractual protections with overseas service providers or contractors.
Taking reasonable steps to address subcontracting, security incidents and unauthorised disclosures.

We do not represent that the presence of an Australian server alone guarantees compliance with all overseas privacy obligations.

If our overseas access arrangements, service providers or processing locations change materially, we will review this policy and update it where appropriate.

8. Credit Reports and Credit Information

Where relevant to a finance application, we may need to obtain or use credit information in accordance with applicable credit reporting, privacy and credit laws.

Before obtaining a credit report or undertaking a credit check, we will seek the required client authorisation through the relevant onboarding or application process.

Our client onboarding arrangements include privacy information and consent documentation through our CRM process, as applicable.

This website Privacy Policy does not itself constitute consent or authority for HQ Mortgage to obtain a credit report or conduct a credit enquiry.

Any required consent or authority must be obtained separately through the relevant client documentation and process.

We handle credit information in accordance with applicable legal requirements and the relevant authorisations provided by the client.

9. How Do We Hold and Protect Personal Information?

We may hold personal information electronically or in physical records, including within:

CRM and finance-related platforms.
Document management and processing systems.
Email and business communication systems.
Remote access environments and other business systems.
Records maintained for legitimate business, compliance and legal purposes.

Our business systems include platforms provided by LMG through MyCRM, Connective through its relevant systems, and Soda PDF or similar document-processing services where applicable. Our remote access environment uses an AWS-hosted server located in Sydney, Australia.

The storage and processing arrangements of each third-party provider may differ. We do not assume that all information processed through those platforms is stored exclusively in Australia without confirming the relevant provider arrangements.

We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification or disclosure. Depending on the system and circumstances, safeguards may include:

Restricting access to authorised personnel.
Applying account permissions and access controls.
Using appropriate secure remote access and transmission methods.
Maintaining confidentiality requirements for staff and contractors.
Using relevant technical and organisational security measures.
Reviewing access and handling arrangements where appropriate.

No method of electronic storage or transmission can be guaranteed to be completely secure. We take reasonable steps to manage security risks and respond appropriately to suspected data breaches.

We retain personal information for as long as reasonably necessary for the purposes for which it was collected, including to meet applicable legal, regulatory, recordkeeping and dispute-resolution requirements.

When personal information is no longer required, we take reasonable steps to destroy or de-identify it where appropriate and lawful.

10. Direct Marketing

We may use your contact details to send information about our services, finance products, offers or other relevant updates where permitted by law.

Our email and SMS marketing processes are intended to comply with applicable consent, sender identification and unsubscribe requirements.

You can opt out of marketing communications by using the unsubscribe facility provided or by contacting us directly at finance@hqmortgage.com.au.

We will action opt-out requests in accordance with applicable requirements.

Opting out of marketing communications will not necessarily stop service-related communications, application updates or notices that we are legally required to send.

11. Website, Cookies and Electronic Communications

When you visit our website, certain technical information may be collected automatically, including your IP address, browser type, device information and website usage data.

Our website may use cookies, analytics tools, embedded content or similar technologies to operate the website, understand usage and improve the user experience. The information collected depends on the technologies enabled on the website and your browser settings.

Third-party website features or embedded services may collect information according to their own privacy policies and settings.

You may be able to manage or restrict cookies through your browser settings. However, disabling certain cookies may affect website functionality.

If you contact us through our website, email or other electronic channels, we may retain the information you provide and records of our communications for legitimate business and compliance purposes.

12. Unsolicited Personal Information

If we receive personal information that we did not request, we will assess whether we could have collected that information lawfully for our functions or activities.

Where required by law, we will take reasonable steps to destroy or de-identify unsolicited personal information that we could not have collected lawfully, provided it is lawful and reasonable to do so.

13. Automated Decision-Making

As at the date of this policy, we do not use computer programs to make, or substantially contribute to, decisions of the kind that are required to be disclosed under applicable automated decision-making privacy requirements.

We may use digital systems to store, organise, process or assist with information and administration. This does not necessarily mean that a system makes a significant decision about an individual.

If our practices change and applicable law requires additional disclosures about automated decision-making, we will review and update this policy.

14. Accessing and Correcting Your Personal Information

Subject to applicable law, you may request access to personal information we hold about you or ask us to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading.

To make a request, contact us using the details in Section 18.

We may need to verify your identity before processing your request. We will respond within a reasonable period and in accordance with applicable legal requirements.

In some circumstances, the law may permit or require us to refuse access or limit disclosure. If we cannot provide access or make a requested correction, we will explain the reasons where required by law.

Where appropriate, we will take reasonable steps to correct information we hold or notify relevant recipients of a correction where required.

15. Privacy Complaints

If you have a concern or complaint about how we have collected, used, held or disclosed your personal information, please contact us in writing and explain the issue.

We will acknowledge, investigate and respond to your complaint within a reasonable period, in accordance with applicable requirements.

We may ask you for further information to help us investigate the complaint. We will consider the relevant circumstances and explain the outcome of our review.

If you are not satisfied with our response, you may be able to lodge a complaint with the Office of the Australian Information Commissioner (OAIC), subject to its jurisdiction and applicable requirements.

Office of the Australian Information Commissioner

Website: https://www.oaic.gov.au
Telephone: 1300 363 992

You may contact us first so that we have an opportunity to consider and address your concerns.

16. Data Breaches

We take reasonable steps to protect personal information against unauthorised access, disclosure, loss or other misuse.

If we become aware of a suspected or actual data breach, we will assess and respond to the incident in accordance with applicable legal requirements.

Where the Notifiable Data Breaches scheme applies and a breach is likely to result in serious harm, we will take the notification steps required by law, including notifying affected individuals and the OAIC where required.

17. Third-Party Websites and Services

Our website may contain links to third-party websites or use third-party tools and services.

We do not control the privacy practices of independent third parties. When you visit another website or use a third-party service, its own privacy policy and terms may apply.

We encourage you to review the relevant third party’s privacy information before providing personal information directly to it.

18. Contact Us

For privacy enquiries, access or correction requests, or privacy complaints, please contact:

HQ Mortgage
Trading name of INRIM Consulting Group Pty Ltd
ABN: 77 620 129 679
Australian Credit Licence: 559779

Business address:
10/857 Doncaster Road
Doncaster East VIC 3109
Australia

Phone: 0433 371 658
Email: finance@hqmortgage.com.au
Website: https://hqmortgage.com.au

19. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our business practices, systems, services or legal obligations.

The current version will be published on our website, together with the date it was last updated.

We encourage you to review this page periodically to remain informed about how we handle personal information.

Important Information

This Privacy Policy describes our general website privacy practices. It does not replace any privacy collection notice, consent, credit reporting authority or other disclosure that must be provided for a particular client, application or transaction.

Where separate client documentation is required by law, we will use the relevant documentation and process to provide the required information and obtain any necessary authorisation.