Privacy Policy

Evolve Broker Pty Ltd ABN 78 691 317 307 Shop 1, 65 Brisbane St, Launceston TAS 7250
Last updated: October 2026

Evolve Broker Pty Ltd (“Evolve Broker”, “we”, “us”) builds technology for Australian
mortgage brokers. Our products and services include:

• EBCRM, a CRM for mortgage brokers, provided on a platform operated by Effi
• Evolve Broker OS, a platform that connects to a broker’s email and CRM to match
  emails to the right client and deal and turn them into tasks
• AI audit and consulting services for brokerages

We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian
Privacy Principles.

This policy covers personal information about:

• Brokers and their staff who use our products or services
• Clients of those brokers, whose information reaches us through the broker’s use of our
  products
• Visitors to our website and people who contact us

When we handle a broker’s client information, we do so on the broker’s behalf and on their
instructions. The broker remains responsible for their relationship with their clients, so
clients should usually contact their broker first about their information

From brokers and their staff: name, email, phone number, business details, account and
login details, and billing information.

From brokers’ clients: contact details, and the information in the records, emails and
attachments a broker manages through our products. This can include loan, property and
financial details.

We don’t ask for sensitive information, but records and emails can contain it. Where they
do, it is handled with the same protections as everything else.

From website visitors: information you send us through forms, and basic usage
information collected through cookies and analytics.

• Directly from you, when you sign up, contact us or use our services
• From a broker, when they enter information into our products or connect their email
  account or CRM and authorise us to access it
• Through our website

We use personal information to:

• Provide our products, including managing client records, matching emails to clients
  and deals, creating tasks, sending communications on the broker’s behalf, and syncing
  records with the broker’s other systems
• Provide support, and keep our services secure and working
• Deliver our audit and consulting services
• Bill for our services and meet our legal obligations

We do not sell personal information and we do not use it for advertising. We do not use
personal information from broker or client data to train AI models without the broker’s
agreement.

Where a broker connects a Google account, our use of information received from Google
APIs follows the Google API Services User Data Policy, including the Limited Use
requirements.

That means we only use Gmail data to provide the features the broker has asked for. We do
not use it for advertising, we do not sell it, and we do not transfer it to anyone except as
needed to provide the service, for security, or where the law requires. Our staff do not read it
unless the broker asks us to for support, it is needed for security, or the law requires it.

Our products use rules and automation to organise information, match emails to clients and
deals, create tasks and send communications set up by the broker. This helps the broker’s
staff, who review and act on it.

Our products do not make decisions about a person’s credit, eligibility or other rights. If we
introduce features that do, we will update this policy before they are used

We share personal information only:

• With the broker it belongs to
• With the broker’s CRM, aggregator or other systems, when the broker directs us to
• With service providers who help us run our products, including Effi, which operates
  the EBCRM platform, Amazon Web Services, which hosts Evolve Broker OS, and
• Google Workspace for email and documents. Each is bound by its own security and
  privacy obligations
• Where the law requires it

Evolve Broker OS is hosted on Amazon Web Services in Sydney, Australia. EBCRM is
hosted by Effi as part of its platform.

Some of our team and service providers are located outside Australia, including in India and
the Philippines. Where they access our systems, that access is limited to what their role
needs, logged, and subject to the same security controls as our Australian team. Some
service providers, such as Google, may also process information outside Australia.

• Data is encrypted in transit and at rest
• Every person on our team has their own account, with multi-factor authentication
• Access is limited to the people who need it, and reviewed regularly
• Devices that access our systems run managed security software and use full disk
  encryption
• Access to our systems is logged

We keep personal information only as long as the broker needs it for the service, or as long
as the law requires. When a broker stops using our products or asks us to delete their data,
we delete it. Backups are cleared on a rolling basis.

You can ask for access to the personal information we hold about you, or ask us to correct it,
by contacting us below. If your information came to us through your broker, we may refer
you to them, since they control that information.

If a data breach is likely to cause serious harm, we will notify the affected broker, and notify
the people affected and the Office of the Australian Information Commissioner as required
under the Notifiable Data Breaches scheme.

If a data breach is likely to cause serious harm, we will notify the affected broker, and notify
the people affected and the Office of the Australian Information Commissioner as required
under the Notifiable Data Breaches scheme.

Privacy Officer Evolve Broker Pty Ltd privacy@evolvedecosystem.com Shop 1, 65 Brisbane
St, Launceston TAS 7250

We may update this policy from time to time. The latest version will always be on this page,
with the date it was last updated.