Runway Privacy & Data Use Policy

1. Introduction

We collect, use and protect personal information to provide lending and financial services, manage risk responsibly, meet our legal obligations, and continually improve our systems and customer experience.

We comply with the Privacy Act 2020, the Information Privacy Principles (IPPs), the Credit Reporting Privacy Code 2020 and the Anti-Money Laundering and Countering Financing of Terrorism Act 2009.

This policy explains how Runway collects, uses, stores and discloses personal information when providing lending and related services. It also applies to any fund managed by Runway.

Investors using the Runway investor portal are also covered by the Investor Portal Privacy Policy.

2. What information we collect

We collect information necessary to:

• identify you;
• assess creditworthiness;
• provide and manage lending facilities;
• meet compliance obligations; and
• operate and improve our services.

This may include identity, financial, credit, transactional, behavioural, and technical information as described in our detailed data schedule. This includes information about borrowers, guarantors, directors, and other individuals we interact with in connection with our services.

3. How we use your information

We use your personal information to:

• verify your identity and comply with AML/CFT obligations;
• assess credit risk and affordability;
• make and manage lending decisions;
• monitor ongoing risk and performance;
• detect and prevent fraud;
• meet legal and regulatory obligations;
• communicate with you; and
• improve our products, services, systems and processes.

This includes the use of automated systems, statistical analysis, predictive models, and machine-learning technologies to support responsible lending and operational efficiency.

We do not use your information for purposes that are unlawful or unrelated to the services we provide.

4. Use of automated decision-making & AI

We may use automated processing tools, analytics systems, and artificial intelligence technologies to:

• support credit decisioning;
• monitor portfolio risk;
• detect fraud or suspicious activity;
• improve operational efficiency; and
• enhance customer experience.

These tools are designed to assist and not replace responsible oversight and governance. Decisions that have a significant impact on you are subject to appropriate review and controls.

Where required by law, or where a decision is made solely by automated means that significantly affects you, we will provide appropriate transparency and review rights.

We do not sell personal information or provide it to external AI developers for their independent commercial use.

5. Data improvement and model development

We may use information we collect to:

• test, validate and improve our internal risk models;
• enhance fraud detection systems;
• improve underwriting accuracy;
• strengthen compliance monitoring; and
• develop new financial products.

Where possible and appropriate, we use aggregated or de-identified information for model development and analytics.

If we intend to use identifiable personal information for materially different purposes beyond service provision and improvement, we will seek additional consent.

6. De-identification and aggregated use

We may transform personal information into de-identified or aggregated datasets for:

• analytics;
• research;
• product development;
• risk modelling; and
• strategic planning.

Information that is properly de-identified and cannot reasonably be re-identified is no longer treated as personal information.

We apply safeguards to reduce re-identification risk.

7. Disclosure

We may disclose personal information to:

• credit reporting agencies;
• financial institutions;
• regulators;
• identity verification providers;
• cloud and technology service providers;
• professional advisers;
• debt collection agencies;
• any person authorised by you; and
• any party where required or permitted by law.

We require service providers to meet appropriate privacy and security standards.

We are required by law to collect and verify certain information to comply with the AML/CFT Act. This may include identity documents, proof of address, source-of-funds information and other verification data. We may disclose this information to government agencies or reporting entities where required.

Where you authorise or consent (including through our application or onboarding processes), we may obtain credit information from, and provide relevant information to, credit reporting agencies; you can request access to, and correction of, personal information we hold in accordance with section 13 of this policy.

We do not sell personal information.

8. Overseas processing

Where information is stored or processed outside New Zealand, we ensure:

• comparable privacy safeguards apply; or
• contractual protections meet IPP12 requirements.

9. Data security

We use reasonable technical and organisational safeguards including:

• encryption;
• access controls;
• monitoring;
• staff confidentiality obligations;
• secure infrastructure; and
• governance oversight of automated systems.

10. Retention

We retain information only as long as necessary for:

• service provision;
• legal and regulatory compliance;
• risk management; and
• dispute resolution.

When no longer required, information is securely destroyed or irreversibly anonymised.

11. Website analytics

Our website uses cookies and similar technologies to improve your browsing experience and analyse website usage.

We also use website analytics, which collects aggregated information about website traffic.

You can disable cookies in your browser settings, although some website features may not function fully.

12. Marketing

We may contact you about relevant services. You may opt out at any time.

13. Your rights

You may request access to, or correction of, the personal information we hold about you.

To make a request, contact our Privacy Officer using the details below. We may need to verify your identity before responding.

We will respond as soon as reasonably practicable, and within any timeframes required by law.

14. Complaints

If you have concerns about how we handle your information, contact us first so we can investigate and respond. If you are not satisfied with our response, you may escalate your complaint to the Office of the Privacy Commissioner.

Privacy Officer

Runway Group Limited
Email: hello@runway.co.nz
Phone: 0800 275 562
Address: 1/18 Railway Street, Newmarket, Auckland