1. Introduction

We understand that your personal information and credit information is important to you and we value your trust. This policy sets out how the Lexus Group handles your personal information. It also includes how we handle personal information collected from third parties, such as your credit report through the credit reporting system if you obtain finance with us.

This policy is structured around the ways you might interact with Lexus, and how we collect, use and disclose your personal information in each of these scenarios. We recommend reading the full policy to understand in detail how Lexus collects, uses and discloses your personal information.

However, if you want a snapshot of how Lexus may collect, use and disclose your information in particular scenarios, please refer to the section below that is most relevant to you:

• you purchase and use goods or services from Lexus (including services provided as part of the Encore Program), submit product enquiries or respond to our surveys, visit Lexus premises or engage with us online;
• you use Lexus Connected Services;
• you engage with us online (e.g. visiting our website);
• What information does Lexus collect when you engage with us online?
• you apply for credit from Lexus Financial Services; or
• you apply for a job with us.

Where you engage in more than one of these scenarios (e.g. you visit our website to research a vehicle and then purchase that vehicle from Lexus), the information set out in both sections will apply.

We are committed to providing you with a seamless and innovative experience across the whole OneLexus Network. The information (including in some cases, personal information) that we gather from your interactions with us helps us to better understand and influence how we:

• develop and provide you products and services across the whole OneLexus Network; and
• inform you of products, services, special offers or events from the OneLexus Network.

Please contact our privacy team using the contact details at the end of this policy if you, or a person you assist, would like:

• further information about our handling of personal information; or
• the information in this Privacy Policy explained to you or in a different format.

This Privacy Policy is current as of the date noted above. We may make changes to this Privacy Policy from time to time, in which case we will notify you of the change by displaying an updated version on our website, and/or by sending it to you via email.

1.1 Who are we?

In this policy the “Lexus Group” (or “we” or “us”) is:

• Lexus Australia, a division of Toyota Motor Corporation Australia Limited ABN 64 009 686 097 (“Lexus Australia”); and
• Lexus Financial Services, a division of Toyota Finance Australia Limited ABN 48 002 435 181 (“Lexus Financial Services”).

The Lexus Group is part of the OneLexus Network of Lexus organisations in Australia. More information about the OneLexus network is provided in the next sub-section, titled “OneLexus Network”.

We are bound by the Privacy Act 1988 (Cth) (“Privacy Act”) and its Australian Privacy Principles (“APPs”). Lexus Financial Services is a participant in the negative credit reporting system and is bound by the credit reporting rules in the Privacy Act. For more information about Lexus Financial Services’ credit reporting practices, see section 6 on “Lexus Financial Services’ privacy practices when you apply for credit”.

1.2 OneLexus Network

The OneLexus Network includes:

• the Lexus Group (Lexus Australia and Lexus Financial Services);
• authorised Lexus dealers in Australia; and
• Aioi Nissay Dowa Insurance Company Australia Pty Ltd trading as “Lexus Insurance”.

The Lexus Group collects and shares your personal information with other members of the OneLexus Network so that the OneLexus Network can provide you with an integrated OneLexus customer experience. This experience includes allowing you to be known across the OneLexus Network regardless of which OneLexus entity you choose to deal with and to provide you with products, services, information and assistance, respond to your enquiries and help keep your information up to date. As further discussed below in section 4 “Who does Lexus disclose this information to?”, your information may be disclosed to OneLexus Network service providers in Australia and overseas for these purposes.

Authorised Lexus dealers operate in Australia as independent franchises. For more information about how authorised Lexus dealers in Australia handle your information, please see the dealer’s privacy policy, available from the dealer’s website.

2. What is personal information?

When we use the term “personal information” in this policy, we are using the term as it is defined in the Privacy Act. Under the Privacy Act, “personal information” means information or an opinion about an identified individual, or an individual who is reasonably identifiable:

(a) whether the information or opinion is true or not; and

(b) whether the information or opinion is recorded in a material form or not.

3. What kinds of personal information do we collect?

The kinds of personal information that we collect and hold about you will depend on the nature of your dealings with us. Our specific privacy practices, relevant to each way you might engage with us, are outlined below.

If you do not wish to provide us with your personal information, we may not be able to respond to your query, provide you with our products and services or assess your application or eligibility for a product or service.

Sensitive information: We will only collect sensitive information about you with your consent (unless we are otherwise allowed or required by law to collect that information). Sensitive information has the meaning given in the Privacy Act and includes information about your health, race, ethnic origin and religious beliefs.

Providing someone else’s personal information: If you provide us with personal information about another person (such as a joint vehicle owner or authorised driver or contact person, or as part of a social media post or in relation to a trade promotion, competition, survey or other interaction with us), you need to tell the other person about this policy so they are aware that you have provided their information to us and that they can read this policy to understand how their information will be handled. You must obtain all necessary consents from the other person before supplying their personal information to us (including a parent or legal guardian’s permission for minors).

4. Lexus's privacy practices when you purchase or use goods or services from Lexus, submit product enquiries or respond to our surveys, visit Lexus premises or engage with us online or by telephone

When you purchase or use goods or services from Lexus, submit product enquiries to us, visit Lexus premises, respond to our surveys or engage with us online or by telephone, we collect personal information about you (both from you and from third parties) to assist us in providing our goods and services to you. We may also disclose this personal information to third parties to assist us with providing our goods and services to you, to enable us to improve the quality of our goods and services, or to meet our regulatory obligations.

When you purchase or use goods or services from us, submit a product enquiry or respond to our marketing or surveys or visit Lexus premises, the kinds of personal information about you which we may collect (both directly and through the OneLexus Network or our service providers) includes:

• contact information and identification such as your name, date of birth, telephone number(s), email address(es), residential and/or business address(es), demographic information (such as postcode, age, gender) and driver’s licence details;
• payment confirmation and payment-related information in connection with your purchase of our products and/or services;
• vehicle and servicing details including vehicle registration and identification number, vehicle purchase details, name of your selling or servicing Lexus dealer, service appointment bookings, vehicle service and repair history (including in relation to Lexus Service Advantage, warranty, repairs and recalls, if applicable);
• CCTV footage of you when you visit any Lexus premises;
• recordings of calls you make to or receive from the Lexus Australia or Lexus Financial Services customer support centres (including call notes in relation to calls to and from Lexus Australia and transcripts in relation to calls to and from Lexus Financial Services); and
• information collected from marketing campaigns, product research, customer surveys, your interactions with us including via social media or your creation of an account in relation to a service Lexus provides (e.g. the Encore Lifestyle Benefits), via Lexus community platforms such as Lexus Community, or publicly available information that you post or publish or broadcast in relation to Lexus products or services.

Any credit card details that you provide to the OneLexus Network or our service providers will be collected via a secure third party payment processing platform which will process the payment. The third party will then provide us with confirmation of your payment. The third party does not share your credit card details with us.

Usage Information we may collect includes:

• your IP address or other unique identifier for the device used to access a Platform;
• email address, username, or other unique user identifier;
• aggregated multi-platform information about Google users who have enabled personalised advertising on their Google accounts (Google Signals Data);
• browser information;
• “Device” type (computer, mobile phone, tablet or other device);
• operation system and/or application version; and
• date and time of visit, pages viewed, preceding page views and your use of features or applications on the Platform such as interactions with connections or groups.

Usage Information helps us keep our Platforms relevant to users and allows us to tailor content to a user’s interests. Usage Information is generally non-identifying, but if we associate it with you as a specific and identifiable person, we will treat it as personal information.

We collect this personal information directly from you, including:

• when you complete a form to order a vehicle, parts or accessories, book your vehicle for servicing, apply for credit or make a general enquiry about our products and services;
• when you contact or interact with us whether in person, by email, telephone, SMS or other forms of communication (such as through the Lexus Connected App or Lexus App), or via our website or social media;
• when you create an account in relation to a service Lexus provides (e.g. to access the Encore Lifestyle Benefits or Lexus Connected Services)either through:
  • in the case of Encore Lifestyle Benefits, completing a membership registration form at the time of delivery of an eligible new or certified pre-owned Lexus vehicle; and/or
  • signing up through the Lexus Encore App or Lexus Connected App;
• when you participate in our surveys, competitions, promotions, events, sponsorships or other activities; and
• when you make a booking to use a vehicle and also when you use the vehicle.

Where you have engaged with other organisations within the OneLexus Network, we may collect this personal information from organisations within the OneLexus Network, including:

• our authorised Lexus dealers, if you interact with or purchase products or services from that dealer; and
• Lexus Insurance, if you make enquiries, purchase and/or renew your insurance with Lexus Insurance.

We may also collect this personal information from third parties, including:

• agents or contractors performing a service or function on our behalf and our partners, such as entertainment and travel partners who assist us in facilitating the provision of Encore Lifestyle Benefits;
• regulatory authorities or other Government bodies who make this information lawfully available to us;
• social media platforms, marketing agencies and suppliers of marketing lists which are lawfully acquired by us;
• your employer, contractor or another person who makes a vehicle available to you; and
• any other parties you refer us to or who refer us to you.

We, or other organisations within the OneLexus Network, may also collect this information through the use of pixels (small graphic images placed embedded on our Platforms), cookies and remarketing. Please see our Cookies Policy for more information about the information we may collect through the use of pixels, cookies and remarketing and how you may opt-out of this collection.

The Lexus Group collects, holds, uses and discloses your personal information for a variety of purposes including:

• providing you with an integrated OneLexus customer experience;
• assessing your application for a product or service;
• determining your eligibility to acquire or access a product or service (e.g. Encore Lifestyle Benefits);
• providing a Lexus product or service to you (including via our authorised Lexus dealers, agents, partners and/or contractors where applicable);
• providing customer assistance and support such as vehicle order tracking, vehicle service reminders, recalls and assisting with warranty claims;
• responding to your enquiries, concerns or complaints and administering and managing our relationship with you, including by verifying your identity in order to provide a requested service;
• informing you about products, services, special offers and/or events from the OneLexus Network. For more on Direct Marketing, see section 8 below titled “Direct marketing”;
• improving your customer experience and our marketing, product planning, product development and research, including through data analytics and analysis of aggregated data sets;
• inclusion in aggregated data sets for analysis to assist with product planning, product development and research;
• as part of customer and video testimonials that we may publish (including on social media), with your consent;
• protecting our interests, including by registering a security interest on the Personal Property Securities Register or checking against sanctions or other reference lists;
• where required or authorised by or under an Australian law (which may include assisting government and law enforcement agencies, bodies or regulators), or an order of a court or tribunal;
• where your employer is paying for some or all of the cost for you to use a vehicle, your information is used to provide reporting to your employer regarding your usage of our vehicles, including location, time, dates and any notices or information received in relation to the booking; and
• any other purpose which we notify you about when we collect your information or to which you have provided your consent.

From time to time, Lexus may contact you to seek feedback in relation to Lexus’s products and services (including in relation to Encore Program). You may contact us using our contact details as set out at the bottom of this policy if you do not wish to be contacted for this purpose.

4.5 Who does Lexus disclose this information to?

We may disclose your personal information (excluding information collected from your use of Lexus Connected Services) to others for the purposes described above, including to:

• the Lexus Group’s related bodies corporate (including our parent company Toyota Motor Corporation in Japan), other companies in the OneLexus Network within Australia, and Lexus entities overseas such as Toyota Connected Europe and Lexus Motors North America; (see section 11 “Disclosing your information overseas” below for details on overseas disclosure of personal information)
• a person that subsidises or makes a vehicle available to you (for example, your employer, your former employer or principal) including to conduct a reference check for finance applications, or for marketing purposes (when you have given us your express or implied consent); or
• our third party agents or contractors which perform a particular function or service on our behalf.

Examples of our third party agents or contractors include:

• call centre operators;
• advertising agencies;
• mailing houses;
• printers;
• organisations that assist us to conduct promotions or market research;
• customer support providers;
• information technology service providers; and
• accountants, lawyers and other professional advisors.

Your vehicle logbook data, and service and repair history (including in relation to warranty and recalls, if applicable) may be made available to subsequent owners (if any) of your vehicle.

If you consent, we may also disclose your personal information to:

• suppliers of third party services, which may include our travel and entertainment partners who assist us in facilitating the provision of Encore Lifestyle Benefits;
• selected third parties to help you obtain discounts or services from those third parties; or
• social networks, advertising networks, insurance providers.

We may also disclose your personal information to third parties where required or authorised by or under law or to government and law enforcement agencies, bodies and regulators, or a dispute resolution body of which we are a member (for example, the Australian Financial Complaints Authority (AFCA)).

5. Lexus's privacy practices when you use Lexus Connected Services

Please see our Lexus Connected Services Privacy Policy to learn about how we handle information collected from your use of Lexus Connected Services. Please note that the Lexus Connected Services Privacy Policy specifically deals with how we use, handle and disclose your personal information in respect of Lexus Connected Services. The contents of Lexus Connected Services Privacy Policy will prevail to the extent of any inconsistency in respect of our privacy practices relating to Lexus Connected Services.

6. Lexus Financial Services' privacy practices when you apply for credit

In this section, references to “we”, “us” or “our” refer to Lexus Financial Services only, not Lexus Australia. Lexus Financial Services participates in the credit reporting system to make better and more informed decisions about providing credit to our customers. When you apply for credit with Lexus Financial Services, or propose to be a guarantor, we may request a credit report about you from a Credit Reporting Body (CRB). Credit reports contain information about your credit history that will help us assess your credit worthiness and your ability to repay credit.

When you apply for credit with Lexus Financial Services, the information we collect includes:

• finance details including financial, insurance or credit information, marital status, employment details and history;
• your identification details (name, date of birth, address);
• the type of credit you hold;
• the amount of credit you have borrowed;
• the terms and conditions of your credit;
• when your credit was opened or closed;
• whether or not you have met your repayment obligations under your loan contract and loan contracts with other credit providers; and
• information about your credit worthiness.

We collect this information directly from you, where you provide us with a credit report.

We may also collect this information from third parties, including

• your accountant for the purposes of assessing a credit application;
• where an individual is an officer of a company that has applied for credit, we may collect information about the officer from public records or from other officers of the company who arranged that company's credit application;
• when named as a personal referee by you, we collect that personal referee's personal information from the written credit application form;
• another credit provider where you have or had a credit account;
• the Credit Reporting Body (“CRB”) where we obtain your credit report; and
• providers of Identity Verification Services ("IVS") administered by the Australian Government in partnership with state and territory governments where you have provided your consent for us to do so; and
• your insurer or broker.

We collect, hold, use and disclose credit information and credit eligibility information about you for purposes which include:

• confirming your identity;
• assessing your consumer or commercial credit or guarantor application;
• managing your account and collecting any overdue payments;
• helping you avoid defaulting on your loan; and
• complying with any relevant laws and regulations.

We will use the information obtained from a CRB, and combine it with information we already hold about you, to calculate our own rating or score to help us assess your creditworthiness.

We may disclose this information to:

• finance and insurance product suppliers in relation to in relation to any finance or insurance products you apply for or acquire through Lexus Financial Services;
• a guarantor if a finance arrangement we provide to you is guaranteed; and
• debt collection agencies in relation to any unpaid debts you owe to us.

We may disclose to the relevant CRB if you have not met the payment obligations under your loan contract or if you have committed a serious credit infringement (for example fraud). Some of the information we disclose to a CRB may be included in your credit report and provided to other credit providers to help them assess your creditworthiness.

We may disclose your information to any of the following CRBs:

• illion - illion.com.au - 13 23 33
• Experian - experian.com.au - 1300 783 684
• Equifax - equifax.com.au - 13 83 32

If you would like to know how these organisations manage your information, you can view their privacy policies on their websites or contact them directly by calling the numbers above.

You have the right to ask a CRB not to use your information for the purpose of pre-screening or direct marketing by a credit provider. You can ask them not to use or disclose this information for a period of time if you reasonably believe that you have been, or are likely to be, a victim of fraud.

7. Lexus’s privacy practices when you apply for a job with us or work for us

When you apply for a job with us, we collect the personal information that you provide during that process, including in your application, such as your work history and education details. In some circumstances we may also ask you to provide certain health information or a criminal history check. We also collect demographic information, if you choose to provide it, to support our diversity and inclusion goals.

The personal information you provide when applying for a job with us will be used to assess your eligibility for the relevant role and may also become a part of your employee file if you are successful in your application.

We may collect and disclose personal information about you to third parties as part of our recruitment process including:

• third party providers of recruitment services, and work eligibility checks (for example, criminal history checks); and
• your current employer or former employer, or their representative (for example, to conduct a reference check for potential employment or finance applications).

We will identify on any job advertisement or application form whether we use a third party as part of our recruitment processes, and whether you will need to deal with that third party directly or if your personal information will be disclosed to that third party by us.

Lexus Australia and Lexus Financial Services each have employee privacy policies that outline how they handle the personal information of their respective current and former employees within the scope of their employment relationship. In addition to the terms of those employee privacy policies, Lexus Australia and Lexus Financial Services may also collect personal information (including, with your consent, sensitive information) about you if you are an employee or contractor of Lexus Australia or Lexus Financial Services (as applicable) for the purpose of Lexus Australia and Lexus Financial Services providing services and support to each other, including human resources and return-to-work support.

8. Direct marketing

The OneLexus Network (or any of the entities which make up the OneLexus Network including their agents and contractors (if any) acting on their behalf) may send you direct marketing to inform you about products or services, special offers, programs, promotions and events that may be of interest to you, where you have consented for us to do so. These marketing communications may include joint promotions with Lexus dealers or other promotion partners and may be sent to you using any contact details provided by you, such as post, telephone, email or SMS.

Please note that the organisations comprising the OneLexus Network are separate organisations. If you do not wish to receive marketing communications and surveys from a member of the Network, you can let that organisation know at any time using the contact details in their respective privacy policies or utilising the “unsubscribe” or other opt-out function offered by the organisation in each marketing communication.

If you do not wish to receive any marketing communications from Lexus Australia or Lexus Financial Services, you can let the relevant organisation know using the contact details provided in section 15 “Contacting us” below, or by utilising the “unsubscribe” function in electronic communications from the relevant organisation. In some circumstances we may need to contact you to obtain additional information, verify your identity or to clarify your request, in order to action it.

If the law requires us to provide you with information about our products or services (for example, product recalls), we will provide that information even if you have elected not to receive information about our products and services generally.

9. Protecting your personal information

We may hold information about you in digital and paper forms. We take reasonable technical and organisational measures to protect your information from misuse, loss, interference, and from unauthorised access, modification or disclosure. Some of the ways we protect your information include:

• external and internal premises security;
• utilising secure servers;
• restricting access to your information only to personnel who need it to perform their functions; and
• utilising and maintaining information security applications to prevent unauthorised access or damage to electronically stored information, such as requiring identifiers and passwords, firewalls, encryption and anti-virus software as appropriate.

However, particularly for electronic data stores and due to the fact that the Internet is inherently insecure, we cannot guarantee the security of transmission of personal information disclosed to us online. Accordingly, you transmit your personal information to us online at your own risk and are encouraged to exercise care in sending personal information via the internet. Please notify us immediately if you know or reasonably suspect that your personal information has been subject to any data breach, breach of security or other unauthorised activity.

10. Data Retention

We store, process, and retain your information only for as long as we need it for the purposes described in this Privacy Policy. When we no longer need your information, we take reasonable steps to destroy or de-identify it, unless we are required or authorised by law to retain your information for a longer period.

11. Disclosing your information overseas

We may disclose your information to organisations located overseas to support the purposes described in this policy. These include:

• our parent company Toyota Motor Corporation in Japan and other Lexus entities overseas including in the UK, USA, and Singapore such as Toyota Connected Europe and Lexus Motors North America; or
• our service providers that are located in, or hold data overseas including in the USA, Japan, Singapore, India, the UK, Ireland, the Philippines and Sweden.

Lexus Financial Services may also disclose your information to service providers located in Vietnam to support the Lexus Financial Services purposes described in this policy.

If we share your personal information overseas, we make sure that there are appropriate privacy, data handling and security arrangements in place to protect your personal information. Please be aware that overseas organisations may be required to disclose information we share with them under a foreign law.

12. Accessing and correcting your personal information

You can generally access and request the correction of personal information we hold about you by contacting us in any of the ways set out at the bottom of this policy. Please note that the organisations comprising the OneLexus Network (that is, each of Lexus Australia, Lexus Financial Services, each Lexus dealer, and Lexus Insurance) are separate organisations, and each organisation may hold different information about you (if any, dependent upon your interactions with them).

Where you access information we hold about you, we may charge an access fee to recover the reasonable costs incurred in providing this access. This charge is only designed to help us reasonably recover the costs associated with providing you with access and does not apply to the making of the request. Before we act on a request, we will provide an estimate of any applicable access fee and ask you to agree to it.

We will respond to your request and provide access or inform you that your request for access is refused within 30 calendar days. Access to your information may be refused in a number of circumstances as prescribed in the Privacy Act, such as where the information relates to anticipated legal proceedings or if the request for access is frivolous or vexatious. If we deny or restrict your access, we will write to you to let you know why, unless, having regard to the grounds for the refusal, it would be unreasonable for us to do so. You may make a complaint about a refusal to the Office of the Australian Information Commissioner (website: www.oaic.gov.au, telephone: 1300 363 992).

We rely on the information that we hold about you to provide our products and services to you, and to perform our business functions. Therefore, it is very important that the information we hold is accurate, complete, up to date and relevant. This means that, from time to time, we may ask you if your information is still accurate and up to date. If you find that any information that we hold about you is incorrect, you should contact us immediately and we will take reasonable steps to correct it.

13. Your Responsibilities

To ensure the information we hold is accurate, complete, up to date and relevant, we require that you:

• notify us of the sale or transfer of your Lexus vehicle;
• notify us if you have purchased or acquired your Lexus vehicle outside of the Lexus Dealer network; and
• if your vehicle has an enabled Lexus Connected Services functionality, inform passengers and drivers of your connected vehicle that vehicle data is collected and used by us for Lexus Connected Services and refer them to the Lexus Connected Services Privacy Policy for specific details of that use and collection. .

If you do not notify us of a sale, purchase, acquisition or transfer of a vehicle, we may continue to send communications in relation to that vehicle to the last known registered owner in our records.

14. Resolving concerns

If you believe that we have breached Privacy Act you are entitled to make a complaint. Complaints can be made by contacting the person or department you were dealing with, or by contacting us using our contact details set out at the bottom of this policy.

If you are a Lexus Financial Services customer and you would like to make a complaint relating to the collection, use and disclosure of your identification information for the purposes of using the IVS, please contact us by using our contact details as set out at the bottom of this policy.

We endeavour to respond to you within two business days to acknowledge the complaint and explain how we will investigate it. If the complaint relates to your credit information, this may include consulting with the CRB or other credit providers. We will try to resolve your complaint within 30 calendar days and write to you to explain the reasons for our decision. When this is not possible, we will contact you and let you know how long it will take for us to resolve your complaint.

If your complaint about our handling of your personal information is not satisfactorily resolved, you can contact us to discuss your concerns or lodge a complaint with Office of the Australian Information Commissioner by visiting oaic.gov.au, calling 1300 363 992 or emailing [email protected]. If your complaint relates to your finance with us you may access the Australian Financial Complaints Authority at afca.org.au or by calling 1800 931 678.