header logo
Apply now

Legal centre · Privacy policy

Home Energy Saver - Privacy policy

How we handle your personal information.

On this page
Introduction and Governance

Creditex Pty Ltd (referred to as “Creditex”, “we”, “us”, or “our”) manages the Home Energy Saver Program (HES) Discounts stream (“Program”) on behalf of the NSW Department of Climate Change, Energy, the Environment and Water (“the Department”).

In handling personal information for the Program, Creditex must comply with:

  • the Australian Privacy Principles (“APPs”) set out in the Privacy Act 1988 (Cth) (“Privacy Act”);
  • the privacy obligations that apply under Creditex’s arrangements with the Department, including requirements designed to support the Department’s compliance with the Privacy and Personal Information Protection Act 1998 (NSW); and
  • where applicable, the Health Records and Information Privacy Act 2002 (NSW) and other applicable Program privacy requirements.

This HES Privacy Policy outlines how and when Creditex collects, uses, shares and stores personal information through our management and administration of the Program.

This HES Privacy Policy applies in conjunction with Creditex’s Privacy Policy. To the extent of any inconsistency between this HES Privacy Policy and Creditex’s Privacy Policy, the terms of this HES Privacy Policy shall prevail as applicable to personal information collected and used under the Program.

This HES Privacy Policy explains how Creditex handles personal information in connection with the Program. Creditex also provides privacy collection notices, or links to those notices, at relevant points where personal information is collected. Where consent is required for a particular collection, use, disclosure or verification activity, Creditex will seek that consent separately.

Types of Information We Collect

Personal information is information or an opinion about an identified individual or an individual who is reasonably identifiable, whether or not the information is true or recorded in a material form.

We segment personal information and data collection into two distinct categories based on your stage in the customer journey as either a ‘potential customer’ and/or ‘confirmed customer’.

We only collect information that is necessary for us to administer the Program. If you do not provide information that we request, you may not be eligible to participate in, and receive the benefits under, the Program.

Potential Customer Information (Marketing & Awareness)

During the promotional and enquiry phase, Creditex collects personal information to facilitate program awareness and eligibility pre-checks. This includes:

  • Identity Data: Full Name, Date of Birth (DOB).
  • Contact Data: Email address, mobile number, residential address, and Postcode.
  • Engagement Data: Interactions with our digital marketing campaigns and HES website enquiries to track application drop-off rates.

Confirmed Customer Information (Application & Assessment)

If you proceed to a formal application, you will be deemed a ‘confirmed customer’ and Creditex will collect the following personal information required for verification:

  • Identity Verification Documents: Details from an identity document such as your driver’s licence or passport and, where applicable and after you provide a specific consent, a facial image or liveness check. The check is carried out through a specialist identity verification service, including IDVerse by LexisNexis, and may include a check against the Document Verification Service (DVS). We collect and use this information to verify your identity for your application. Where a driver’s licence or passport is unavailable, we may collect details from other accepted identification documents as reasonably required.
  • Eligibility Verification:
    • Concession Details: Pensioner Concession Card, Health Care Card or DVA Gold Card information, and verification results obtained through Centrelink Confirmation eServices (CCeS), where you select this pathway and provide the required specific consent; OR
    • Financial Data: income information and documents, such as an ATO Notice of Assessment or non-lodgement advice, for means-testing purposes (where applicable).
 

Property & Energy Data:

  • Council rates notices (proof of ownership), residential tenancy agreements, lease or bond documents, and other property evidence.
  • The property address, the National Metering Identifier (NMI) associated with the electricity connection and, where applicable, the Delivery Point Identifier (DPI) associated with the gas connection, together with relevant energy bills.
  • Limited landlord/property-owner contact details where you are a tenant, so that we can seek the approvals required for works at the property. See “Information about landlords” below.
 

Transaction Data: Payment details and transaction records for the required customer or landlord co-contribution, processed via secure tokenisation by our payment provider (Stripe); we do not store raw card data. Where you elect to finance the co-contribution, relevant application, quotation, invoice, payment and contact information may be shared with an approved finance provider, such as Brighte or Plenti.

  • Application Records: records of privacy notices provided to you and any acknowledgements, specific consents, verification results and eligibility or application declarations made through the Program.

Information about landlords

If you are a tenant, we ask you to provide the name and contact details of your landlord so that we can contact them to seek the approvals required for proposed works at the property. We collect this limited information from you because we may not otherwise know the identity or contact details of the property owner. We ask you to provide only the information reasonably necessary to identify and contact them, and we collect any further information we require directly from them wherever reasonably practicable.

When we first contact the landlord, we tell them that you provided their contact details, explain why we are contacting them and provide the HESP Landlord Privacy Collection Notice. No consent or approval to the proposed works is assumed merely because you provided their contact details. We use their information to administer the application and obtain and manage the required consents and approvals, and may disclose relevant information to the Department and the Approved Provider. They may request access to or correction of their information using the contact details in this policy.

Sensitive information

We only collect sensitive information (as defined in the Privacy Act) from you to the extent that it is reasonably necessary for us to administer the Program to you, if:

  • we have obtained any consent required for the particular collection (including specific consent where required); or
  • the collection is required by law and is consistent with the provisions of the APPs. 
How We Collect Your Information

We generally collect personal information directly from you when you use HESMAT, contact us, complete a form or agreement, upload documents, participate in an assessment or installation, seek support or respond to a survey.

We may also collect relevant information from the Department; Services Australia through Centrelink Confirmation eServices (CCeS); identity-verification services and the Document Verification Service; Approved Providers and installers; finance providers where selected; and other persons or services involved in administering or verifying your participation. Where we collect information about you from another source, we provide a privacy collection notice or otherwise take reasonable steps to ensure you are aware of the collection.

Information collected during installation

When your upgrades are assessed and installed, the Approved Provider and its installers collect information about you and your property to carry out the works. This can include site and property details, photographs of the work area, product and serial numbers, and completion records.

This information is collected on our behalf and shared back to Creditex, and with the NSW Government (DCCEEW), to administer the program, process the discount, create energy certificates, and meet audit and reporting obligations. You can access or correct the information we hold about you using the contact details in this policy. At relevant collection points, the Approved Provider or installer will provide or link to the applicable HESP privacy collection notice.

How We Use Your Information

Program Administration and Verification

We will use your personal information to:

  • Inform you of your HES eligibility.
  • Direct you to, and coordinate installation with, our network of Approved Providers for assessments, quotations, and installation.
  • Assess eligibility against program criteria (Income, NSW residency, Concession status).
  • Process the applicable HES discount and manage the collection of the customer co-contribution.
  • Verify the relevant property, occupancy or ownership and energy connection information, including the NMI and, where applicable, the DPI.
  • Administer consents, approvals, payments and optional finance arrangements, facilitate the creation of eligible energy certificates, and meet Program integrity, audit, compliance and reporting requirements.

Program Evaluation and Feedback

We may use your contact details and Program information for quality assurance, customer feedback, surveys, case studies and evaluation of the Program. Participation in surveys and case studies is voluntary unless we tell you otherwise.

Information collected after installation (support and evaluation)

In addition to the evaluation and feedback uses described below, after your installation we may also collect further information from you directly to provide support, handle enquiries or complaints, and honour warranties.

We may use your personal information to:

  • Facilitate random on-site audits by the NSW Building Commission or independent safety auditors.
  • Allow the NSW Government to contact you for feedback, surveys, or case studies to evaluate the success of the program.
  • Contact a random sample of approximately 25% of customers post-installation to complete a satisfaction or quality assurance survey.
Disclosure and Sharing

Disclosure to third parties

We share your personal information only with the following authorised parties to facilitate your application, installation, and compliance:

NSW Government (The Department):

Daily batch transfers of designated program data via secure API for oversight and reporting.

Non-aggregated customer account data is provided to the Department’s data warehouse.

Verification Services:

  • Services Australia: where the concession-card pathway is selected and specific consent is given, relevant concession information is disclosed through CCeS and Creditex collects the verification response and related information needed to complete the check.
  • Identity Verification: where identity verification is required and specific consent is given, relevant identity-document details and, where applicable, facial image or liveness information are disclosed to an identity-verification service, including IDVerse by LexisNexis, and identity-document details may be checked using the DVS. Creditex collects the verification result and related information needed to complete the check.

Approved Providers & Quoting Partners:

Property and energy information, including the address, NMI and, where applicable, DPI, may be shared with quoting partners such as Spendwatt to prepare accurate quotations and verify the relevant connection.

Contact and site details are shared with accredited installers (e.g., JLG Group) to schedule works.

Where a tenant applies, we may disclose relevant information about the application and proposed works to the landlord so that required approvals can be obtained.

Accredited Certificate Providers

Technical installation data required for compliance is shared with Creditex Trading, our Accredited Certificate Provider, to generate ESCs, PRCs, and STCs. This data does not include your financial or eligibility information, and is hosted within Australia.

Compliance Platforms:

Technical installation data is shared with scheme administrators (e.g., Dataforce) to generate Energy Savings Certificates (ESCs) or Small-scale Technology Certificates (STCs).

Audit and Compliance Bodies:

Data may be shared with the NSW Building Commission, the Auditor-General, or IPART for safety and financial auditing purposes.

Payment Processing: The mandatory customer co-contribution (Gap payment) is processed by our payment-gateway provider, Stripe, using secure tokenisation. Stripe may process payment data outside Australia (see “Overseas disclosure”).

Financial Settlement & Accounting: Transaction and settlement records are processed in our accounting and general-ledger system (Xero) for invoicing and reconciliation. Xero may process data outside Australia (see “Overseas disclosure”).

Digital Contract Execution: Your name, contact details, ID verification, and signature are shared with our digital-signing provider (DocuSign) to generate and execute the Qualifying Customer Discount Agreement. DocuSign stores this data in its Australian data region.

Communications & Customer Support: Your contact details are used by our communications providers to deliver service messages — Aircall (voice and SMS gateway, hosted in AWS Sydney) and Amazon SES (transactional email). Customer support enquiries are handled through our call-centre and ticketing platform (Zoho CRM/Zoho Desk), and an AI-assisted chatbot provides initial (Level 1) triage. Customer data is not used to train AI models.

Finance Providers (where applicable): If you elect to finance your co-contribution, relevant application and contact details are shared with our accredited loan providers (Brighte and Plenti) to assess and administer that finance. This disclosure occurs only where you choose a finance option.

Overseas disclosure

Most Program personal information is stored and processed in New South Wales, Australia. Subject to any approval required from the Department under the Program arrangements, a limited number of financial and payment functions may be performed by providers that store or process data outside Australia:

  • Payment processing (Stripe): payment and transaction data may be processed in the United States and Ireland. Stripe is certified to ISO 27001 and SOC 2, and validated to PCI DSS for services that handle payment data.
  • Accounting and settlement (Xero): financial and settlement records may be processed in the United States. Xero is certified to ISO/IEC 27001:2022 and SOC 2.

Where we disclose personal information to an overseas recipient, we take reasonable steps to ensure the recipient handles it consistently with the Australian Privacy Principles, including through contractual data-protection obligations. Creditex does not access, process, store, transfer or make Program Data accessible outside New South Wales unless any required prior written Department consent has been obtained and the applicable Program data-location conditions are satisfied.

Storage and Security

We will store and secure your personal information as follows:

  • Data Residency: Core HES Program Data collected by Creditex is stored and processed on secure servers located in New South Wales, Australia (AWS Sydney Region).
  • Financial Data: reconciliation functions are performed by providers (Stripe and Xero) that may process limited data outside Australia, subject to the Program arrangements and any required Department approval. See “Overseas disclosure” above.
  • Security Protocols: Creditex utilises TLS 1.3 encryption for data in transit and AES-256 encryption for data at rest.
Retention and Destruction of Information

We adhere to strict data minimisation principles regarding financial eligibility:

  • Financial Documents: Highly sensitive financial documents (such as detailed income statements) collected for means-testing are retained only for as long as necessary to verify eligibility or meet immediate audit requirements.
  • Destruction: Once verification is complete, or upon the expiry of the program, raw financial documents are securely destroyed or de-identified in accordance with NSW Government directions and the State Records Act 1998 (NSW).
  • Verification and Declaration Records: verification results and records of privacy notices, acknowledgements, specific consents and application declarations may be retained for Program integrity, audit, compliance and evidentiary purposes.
  • Operational Retention: Technical installation records and warranty data are retained for the duration of the warranty period (up to 10 years) to ensure ongoing customer support.
Direct Marketing, Consent and Privacy Rights
  • Direct Marketing Opt-In/Out: where you have provided your consent (expressly or impliedly) or we are permitted by law to do so, we may use your personal information to inform you about offers, products or services that may interest you. We may send this information to you via the communication channels specified at the time you provide your consent including email, SMS, mail or telephone.  You may unsubscribe from receiving such marketing communications at any time by contacting us or using the unsubscribe function in the email or SMS.
  • Program Privacy Notices and Consents: Creditex provides privacy collection notices, or links to those notices, at relevant collection points. Where a particular activity requires consent or authority, Creditex seeks it separately, including before CCeS concession verification and identity verification using IDVerse and the DVS. The Eligibility and Application Declaration is an application-integrity declaration, not privacy consent.
  • Access: Individuals have the right to access and correct the personal information Creditex holds about them.
Contact

If you have any issues about this policy or the way we handle your personal information, please contact us using the details below and provide full details of your complaint and any supporting documentation.

  • Entity: Creditex Pty Ltd
  • Attention: Privacy Officer / Operations Manager
  • Contact: hello@hes.creditex.com.au
 

At all times, privacy complaints will:

  • be treated seriously;
  • be dealt with promptly;
  • be dealt with in a confidential manner; and
  • not affect your participation in, or eligibility for benefits under, the Program.
 

Our Privacy Officer will endeavour to:

  • respond to you within 10 business days; and
  • investigate and attempt to resolve your concerns within 30 business days or any longer period necessary and notified to you by our Privacy Officer.
Changes to this Policy

We may update this policy from time to time. The current version will be published at https://www.creditex.com.au/hes/privacy-policy. Where a change materially affects how we collect, use or disclose personal information, we will take reasonable steps to notify affected individuals and, where required by law, obtain consent.