The Consumer Data Right (CDR), also known as "open banking", gives you the right to consent to organisations accredited by the Australian Competition and Consumer Commission (ACCC) accessing specified data about you (CDR data).
The CDR regime is designed to give Australian consumers greater choice and control over how their data is collected, used, and disclosed. It allows you, with your consent, to share your data for specific purposes with any organisation that is accredited under the CDR regime. You can also choose to send a copy of your own data to someone else, which is explained in Sections 6.2 and 8.
In this policy, references to "you" or "your" mean you as a user of our Services and a CDR consumer.
WeMoney Pty Ltd ACN 633 007 860, Australian Credit Licence 526330 (WeMoney or we or us) is an Accredited Data Recipient participating in the government's open banking scheme under the CDR regime.
WeMoney provides a smart money management service that connects all of your financial accounts in one place, tracks your overall financial health, provides details about your credit score, and offers information and tools to help you compare a range of products, credit providers and services. We may also tell you about products or promotions from our connected network of product providers. WeMoney provides its services via its website and mobile applications (the Services).
As part of delivering our Services, and in accordance with the consents you provide during the CDR consent process, we may collect, use, and share your CDR data for purposes including enrichment, transaction categorisation, personalised insights, and, where you have provided a de-identification consent, de-identifying certain CDR data and securely retaining it to train and improve our transaction categorisation models and for general research purposes.
This Consumer Data Right (CDR) Policy (CDR Policy) has been created in accordance with the requirements of Division 5 of Part IVD of the Competition and Consumer Act 2010, the Competition and Consumer (Consumer Data Right) Rules 2020 and the CDR Privacy Safeguard Guidelines (CDR Legislation). In this CDR Policy, we explain how we manage your CDR data, how you can access and correct your CDR data, how you can make a complaint, and how we de-identify, retain, and destroy your CDR data in line with your consents and the CDR regime.
The CDR data we collect from you and hold is classified as your "required consumer data" within your banking records which may include:
WeMoney as an accredited organisation under the CDR regime:
We also set out in this CDR Policy how we will treat your data when it becomes redundant.
The great benefit is that you control and decide when to share your CDR data with us, what CDR data you share, and for how long.
You can also choose to let a third party view your CDR data inside the WeMoney platform, or send a copy of it to someone else. Those features work differently, and Sections 6.1 and 6.2 explain how each one works and how it ends.
As an accredited data recipient, we will only receive your CDR data with your consent.
We will also continue to manage your personal information in line with WeMoney's Privacy Policy and our obligations under the Privacy Act (1988). Please visit our Privacy Policy at www.wemoney.com.au/privacypolicy for further information.
WeMoney collects and holds your data that you provide to us as our consumer, which enables us and assists us to provide you with our Services.
This data that we hold and collect, may include data that is classified as "CDR data" upon us receiving it after you have given your consent as an accredited data recipient under the CDR regime.
Under the CDR regime a:
Data Holder: is the organisation that holds your data and upon your consent shares your data with an accredited data recipient, for e.g., your financial services provider.
Accredited Data Recipient: is an organisation accredited under the CDR regime that you have provided your consent to receive and use your CDR data from the Data Holder. WeMoney is an Accredited Data Recipient.
In this policy, "Accredited Data Recipient" and "Data Holder" have the meanings given in the Competition and Consumer Act 2010 (Cth).
When you provide your consent to an Accredited Data Recipient to collect and use your CDR data, it's important to know that you are then entering into an agreement with them.
At WeMoney, we will hold your data for a period of time as specified by you when you provide your consent or until you withdraw your consent. Once you withdraw your consent or the period of time that you have specified in your consent has expired, or we can no longer hold it under the CDR regime we will delete your CDR data that we hold about you, unless that data has been de-identified (see Sections 11 and 12).
Access you have allowed a third party under Section 6.1 works differently, and Section 6.1 explains how it ends.
WeMoney does not accept consumer requests to access additional voluntary products or consumer data that our Services does not already make available.
We will keep your CDR data in a cloud-based, or other types of networked or electronic storage centres. The security of your CDR data is important to us. We will take appropriate technical and organisational precautions to secure your CDR data as required under the CDR regime.
You can choose to share your CDR data with WeMoney so we can provide you with our Services.
You will need to give your consent to WeMoney as an accredited data recipient to receive your CDR data from your nominated financial institution or financial services provider (Data Holder).
Prior to actioning your request to share your CDR data with WeMoney, we will:
IMPORTANT: Please note that your Data Holder will have their terms and conditions that you need to comply with when requesting to share your data with WeMoney.
You can log in with your Data Holder and manage your data sharing to view your data sharing, manage your data sharing and stop your data sharing.
Please note that managing or stopping your CDR data sharing with your Data Holder does not affect any copies of your CDR data that you have previously exported or downloaded for your own use, because the CDR rules no longer apply to a copy you hold.
WeMoney uses the entities listed below as its outsourced service providers (OSP) to provide the following services:
| Name of Service Provider | Description of Services provided by the Service Provider | CDR Accreditation | CDR Policy |
|---|---|---|---|
| Yodlee Inc (Yodlee) | Manage its consent process with respect to accessing CDR data as an accredited data recipient, and to provide additional insights by enhancing merchant and payer identification and category details around your transactions. | Accredited Data Recipient | Yodlee CDR policy |
| Tata Consultancy Services Limited (TCS) (based in India) | To provide customer servicing support, technology and infrastructure, and data processing services to Yodlee Inc. | No | Yodlee Service Provider and covered in Yodlee's CDR policy |
| Experian Australia Pty Ltd (Experian) (based in Australia) | Provide transaction enrichment and categorisation services. These services assist us in enhancing the information we present to you about your transactions. | No | - |
| Mastercard Asia/Pacific Pte. Ltd. (Mastercard) | Consent management, CDR connectivity, data aggregation and additional transaction enrichment services, which may include categorisation and income verification services. | Accredited Data Recipient | Mastercard CDR Policy |
| Mastercard Technologies LLC (based in the United States) | Customer servicing support, technology and infrastructure, and data processing services to Mastercard. | No | Mastercard Service Provider and covered in Mastercard's CDR Policy |
| Mastercard International Incorporated (based in the United States) | Customer servicing support, technology and infrastructure, and data processing services to Mastercard. | No | Mastercard Service Provider and covered in Mastercard's CDR Policy |
| Mastercard Asia/Pacific (Australia) Pty Ltd (based in Australia) | Customer servicing support, technology and infrastructure, and data processing services to Mastercard. | No | Mastercard Service Provider and covered in Mastercard's CDR Policy |
| Finicity Corporation (based in the United States) | Customer servicing support, technology and infrastructure, and data processing services to Mastercard. | No | Mastercard Service Provider and covered in Mastercard's CDR Policy |
| Finicity Technologies Private Limited (based in India) | Customer servicing support, technology and infrastructure, and data processing services to Mastercard. | No | Mastercard Service Provider and covered in Mastercard's CDR Policy |
Some of our OSPs, such as Mastercard, are also accredited data recipients (ADRs) under the CDR regime. However, in their role providing services to WeMoney, they do not act in that capacity. When processing or enriching your data under our instructions, they operate solely as OSPs under a CDR outsourcing arrangement with WeMoney. Their access and use of your CDR data is limited to what is permitted under that arrangement and your consent.
Where you have provided de-identification consent in the CDR consent process, certain OSPs (such as Mastercard and Yodlee) may create and retain de-identified datasets in accordance with that consent and the CDR regime. These de-identified datasets may be used for the purposes specified in your consent, including training and improving transaction categorisation models and for general research purposes, as described in Sections 8, 9, 10, and 11 of this policy.
We may, with your consent, disclose your CDR data to other Accredited Data Recipients.
You can also choose to send a copy of your CDR data to someone else, using the WeMoney app. When you do that, you are the person sharing your data, not WeMoney. Section 6.2 explains how it works and what it means for you.
Where a third party is not an Accredited Data Recipient, the handling of your data by that third party will not be subject to the CDR Privacy Safeguards. The website www.cdr.gov.au gives you more information regarding the accreditation process.
You can use the WeMoney app to let a third party you choose view some of your CDR data inside the WeMoney platform. You decide whether to do this, and who can view your data. We decide which of your CDR data is included, and we show you a summary of it before you choose. You do not have to let anyone view your data to keep using our Services, and you can decline at any point before you allow access.
Before you allow access, we will show you:
When you allow access:
Access lasts for up to 30 days and then ends automatically. Only allow access if you are comfortable with the third party seeing that data for the whole period we show you.
You can use the WeMoney app to send specified CDR data to one or more third parties or third-party applications that you choose. You decide whether to do this, and who receives your data. You do not have to share anything to keep using our Services, and you can decline at any point before you send.
Before you send, we will clearly tell you:
When you choose to send your CDR data this way:
We record each send in our CDR audit logs.
The CDR data we still hold remains protected. Sending a copy to someone you choose does not change our obligations for the data that stays with us: it is still CDR data, and the CDR Privacy Safeguards continue to apply to it, including our obligations to keep it secure and to destroy or de-identify it when it is no longer needed.
CDR data that we have received will be made available to you securely via our Services. In addition, WeMoney allows you to update specific CDR data such as account holder information securely via our Services. Please note that for any data updates to other organisations that are Data Holders you will need to contact them directly to correct and update your CDR data.
You can log in to the WeMoney Services to view your data sharing, manage your data sharing, and stop your data sharing with us. Access you have allowed a third party under Section 6.1 works differently, and Section 6.1 explains how it ends.
If you think CDR data we hold about you is wrong, out of date, incomplete, irrelevant or misleading, you can ask us to correct it. Email us at hello@wemoney.com.au or contact us through the Services.
We will take reasonable steps to correct it, and we will respond within a reasonable period. If we correct your CDR data we will tell you, as described in Section 14. If we decide not to correct it, we will tell you why.
Some of your CDR data comes to us from your Data Holder and we cannot change it at its source. Where that is the case we will tell you, and you will need to ask your Data Holder to correct it with them.
Where you have provided a de-identification consent in the CDR consent process, some of your CDR data may be de-identified and retained in accordance with that consent. Once your data has been de-identified, it can no longer be used to identify you and will not be available to viewed, updated, or deleted as your CDR data will not be able to be linked to you. For more information, see Sections 8, 10, and 11.
You may ask us to export or make available a copy of your CDR data in a downloadable or otherwise accessible format. This includes any feature within the WeMoney Services that allows you to download or export your bank transactions, account information, or other data that may originally have been obtained as CDR data.
When you request an export or download:
Once exported or downloaded, the CDR rules no longer apply to that copy. It is personal information that you control. You may choose to store, use, or share that exported information with third parties for your own purposes.
Any use or disclosure of exported or downloaded data is your responsibility.
Other than to the outsourced service providers listed in Section 6, WeMoney does not disclose your CDR data to third parties who are not accredited under the Consumer Data Right regime. Where you send your CDR data to someone you choose under Section 6.2, or give someone access to information you have exported or downloaded, that sharing is undertaken by you and is outside the scope of the CDR regime.
WeMoney does not oversee or control how any third party handles exported or downloaded information you choose to provide to them.
Exporting or downloading your CDR data does not affect your existing consent arrangements or your ability to withdraw consent at any time.
You may choose to provide exported or downloaded information to a third party (such as an adviser, accountant or broker). This activity is not a disclosure of CDR data by WeMoney, because it is you who provides the information, not us.
If a third party accesses exported or downloaded information:
WeMoney offers its Service online, which enables users to manage their personal finances. Features include account aggregation of Australian bank accounts, calculating a user's net worth, providing insights into income and spending, defining and tracking savings goals, and participating in the WeMoney community.
WeMoney uses your data to deliver its Services to you and to improve the overall service quality in the long-term. Preparing a portable copy of your CDR data at your request does not constitute a use of CDR data for our own purposes; it is an action taken under your instruction to provide you with a copy of your data outside our accredited CDR data systems.
As part of delivering our Services, and in accordance with the de-identification consent you provided during the CDR consent process, certain transaction data is de-identified and processed using our categorisation algorithms. These de-identified datasets may be securely retained and used to train and improve our models that support transaction categorisation models, budgeting tools, and other personal finance insights.
We will only collect and use the CDR data that is reasonably needed to provide our Services to you, including the de-identification and retention of selected transaction data for these purposes.
We may also use your data that has been de-identified or becomes redundant as set out in section 11 (De-identified or Redundant Data).
WeMoney enhances your CDR data to provide more meaningful and personalised financial insights. This involves identifying the parties to your transactions (such as merchants and payers) and assigning categories to your income and expenditure. Enrichment helps us deliver features like spending analysis, income and expense tracking, and selecting which products and offers we show you.
We also use enriched data to select which loan and credit offers we show you, based on your transaction patterns and income insights. This helps us decide which information to put in front of you and improve the personalisation of our Services.
We personalise which offers you see. We do not advise you on whether a product is right for you, and showing you an offer is not a recommendation that you take it up. Where we provide credit assistance, we do so under our Australian Credit Licence 526330.
Enrichment may be performed by WeMoney directly or by our outsourced service providers (OSPs). Where enrichment is performed by an OSP, it is applied only to CDR data that the provider has either collected on our behalf (e.g. Mastercard and Yodlee) or that WeMoney has shared with them in accordance with your consent and the CDR regime (e.g. Experian).
Where enrichment results in de-identified datasets being created, and you have provided de-identification consent in the CDR consent process, those de-identified datasets may be securely retained and used in accordance with Sections 11 and 12 of this policy.
For more information about third-party roles in enrichment, see Section 6. For more information about how de-identified or redundant data is handled, see Sections 11 and 12.
As an OSP of WeMoney, Mastercard collects CDR data on our behalf and provides additional enrichment services, which may include categorisation and income verification services. This enables WeMoney to deliver insights about the income sources that have been identified from your transaction data, your spending and your overall financial behaviour. This enrichment is applied only to the CDR data collected by Mastercard as our OSP. WeMoney then uses these categorised outputs, along with other internal processing, to generate insights and deliver enhanced services. Where enrichment produces de-identified datasets, these may be retained in de-identified form in accordance with your de-identification consent (see Sections 11 and 12).
Yodlee provides transaction categorisation and assists with account connectivity as an OSP appointed by WeMoney. Where Yodlee collects your CDR data on our behalf, it applies enrichment by identifying merchants and payers and assigning categories to the transactions. WeMoney uses this categorised data to produce insights about your financial situation. Where enrichment produces de-identified datasets, these may be retained in de-identified form in accordance with your de-identification consent (see Sections 11 and 12).
For more information about how redundant or de-identified data is handled following enrichment, see Sections 11 and 12.
WeMoney may share your CDR data with Experian to provide transaction enrichment and categorisation services. Experian processes this data and returns the categorised outputs to WeMoney, which we then use to generate insights about your spending and income.
This section describes how WeMoney handles your CDR data when it becomes redundant or is de-identified in the course of providing our Services.
During the consent process, we may also seek your consent to de-identify certain CDR data and use the resulting de-identified data for:
Once your data has been de-identified it can no longer be linked to you, so we do not delete it when your CDR data becomes redundant. It continues to be held in de-identified form.
For the purposes of this section, "general research purposes" includes providing feedback to the ACCC and participants of various data standard workgroups regarding WeMoney's CDR connection statistics, using high level de-identified data for statistics about CDR connections in WeMoney press releases, and identifying opportunities for improvement in how we collect, handle and use CDR data to deliver better Services to you.
Any CDR data that we no longer need for the purposes as disclosed in this policy and for which we have no other lawful basis under the CDR regime to retain, will be treated as redundant data.
For data accessed via Mastercard:
Redundant CDR data will be deleted. Note however that where you have provided de-identification consent in the CDR consent process and your CDR data has been de-identified in accordance with that consent, it may be retained in accordance with Sections 11 and 12.
For data accessed via Yodlee:
During the consent process, you may choose to have your redundant CDR data deleted. If you do not make a deletion choice, we may either delete or de-identify it at our discretion. Please note that once your CDR data has been de-identified, it can no longer be deleted upon expiry or revocation of your consent, as it will no longer be able to be used to identify you as an individual. In such cases, the data will continue to be retained in its de-identified form.
This section describes how third-party outsourced service providers (OSPs) may handle de-identified data after completing their services for WeMoney.
Some of our OSPs may perform de-identification of CDR data as part of providing enrichment, categorisation, verification, or other processing services. Where you have provided de-identification consent in the CDR consent process, an OSP may, in accordance with that consent and the CDR regime, securely retain de-identified datasets for the purposes specified in your consent, including training and improving transaction categorisation models and related personal finance tools, and for general research purposes (such as aggregated analysis, reporting, and identifying ways to improve their services).
These practices apply whether the CDR data was originally collected by the service provider on WeMoney's behalf or was shared with them by WeMoney under a CDR outsourcing arrangement.
Before any data set is retained, it must be de-identified so that no one is identifiable, or reasonably identifiable, from it or from other information anyone holds. That means removing personal information and any transaction attributes that could reasonably be used, alone or in combination with other information, to re-identify you.
WeMoney requires that where our OSPs retain de-identified data sets, they may do so only on these conditions:
We store your CDR data in Australia, in data centres operated for us by Amazon Web Services. Those data centres are covered by Amazon Web Services' certification to ISO/IEC 27001, the international standard for information security management, and by its System and Organization Controls reporting. Those certifications are held by Amazon Web Services, not by WeMoney.
We keep your CDR data stored securely and encrypted in electronic form in accordance with this policy, the CDR regime and WeMoney's Privacy Policy.
Where your CDR data is accessed or processed from overseas, for example by certain OSPs listed in Section 6, such access will occur only in accordance with the CDR regime (including the Privacy Safeguards). All overseas access is subject to contractual and technical safeguards, and our obligations under the CDR regime continue to apply to your CDR data wherever it is accessed from.
Some of the outsourced service providers listed in Section 6 are based in, or access your CDR data from, the United States and India. Their countries are shown in the table in Section 6.
Where you choose to send your CDR data to a third party under Section 6.2, that third party may be located overseas. If that happens:
On several occasions, you will receive notifications via the Services. Such notifications will include:
You can withdraw your consent authorisation to share your CDR data with or by WeMoney at any time via the Services or simply by letting us know by email that you are withdrawing your consent. Our email address to withdraw consent is hello@wemoney.com.au.
You may also withdraw your consent by:
Once WeMoney receives your consent withdrawal in any form, we will, in accordance with the CDR regime, permanently delete your CDR data from our systems as soon as practicable and in any event no later than 30 days of receiving your request, unless it has been de-identified in accordance with your de-identification consent you provided in the CDR consent process, and is retained as described in Sections 11 and 12 of this policy.
Once your CDR data is permanently deleted you will not be able to access it unless you provide a new consent for us to receive your CDR data.
Where you have allowed a third party to view your CDR data within the WeMoney platform under Section 6.1, that access runs for up to 30 days and then ends automatically. Withdrawing your consent does not end it, and you cannot end it earlier. This means a third party may still be able to view your data for a period after you have asked us to stop holding it.
Sending a copy of your CDR data to someone you choose under Section 6.2 works differently. Once your data has been sent, it cannot be recalled, and we cannot control what the recipient does with it.
WeMoney is here to help. If you want to know how we hold and manage your CDR data or you want to request a copy of your CDR data please contact us via either our Services, call us on 1300 629 510 or email us at hello@wemoney.com.au or by writing to us at WeMoney Pty Ltd, Level 1, 63-73 Ann Street, Surry Hills, NSW 2010, Australia.
If you have questions about exported or downloaded copies of your data, please note that we do not keep a copy once we have made it available to you. The copy you hold is yours to manage.
If you are concerned about how we have handled your CDR data or you want to make a complaint or provide us with any feedback, please email us at complaints@wemoney.com.au, or contact us on the other details outlined in section 16.1 above. We will attempt to the best of our abilities to resolve any issue that you may have.
In order for us to assist you, please include your full name, email and contact details, as well as a preferred contact method in your email to us. We may ask for additional information to identify and verify you. Please note a WeMoney representative will never ask you for your log-in account information such as your password via phone or email.
We will do our best to:
If you are not satisfied with the final outcome, you may choose to lodge a complaint with the Australian Financial Complaints Authority (AFCA). AFCA provides a free and independent dispute resolution service for individuals and small business consumers who are unable to resolve their complaints directly with WeMoney.
Australia Financial Complaints Authority
Online: www.afca.org.au
Email: info@afca.org.au
Phone: 1800 931 678
Mail: GPO Box 3, Melbourne, VIC 3001
You may also raise any CDR concerns directly with the Office of the Australian Information Commissioner (OAIC). OAIC acts as an impartial third party when investigating and resolving a complaint in relation to the handling of your CDR data. You can contact the OAIC on:
Office of Australian Information Commissioner
Mail: GPO Box 5218, Sydney, NSW 2001
Phone: 1300 363 992
Online: www.oaic.gov.au
Email: enquiries@oaic.gov.au
From February 2018, the Privacy Act includes a new Notifiable Data Breaches scheme (NDB) which requires us to notify you and the Office of the Australian Information Commissioner (OAIC) of certain data breaches and recommend steps you can take to limit the impacts of a breach (for example, a password change).
The NDB scheme requires us to notify you about a data breach that is likely to result in serious harm to affected individuals. There are exceptions where notification is not required. For example, where we have already taken appropriate remedial action that removes the risk of serious harm to any individuals.
If we believe there has been a data breach that impacts your CDR data and/or your personal information and creates a likely risk of serious harm, we will notify you and the OAIC as soon as possible and keep in close contact with you about the nature of the breach, the steps we are taking and what you can do to reduce the impacts to your privacy. If we believe there has been an information security incident, we will notify the Australian Cyber Security Centre (ACSC) as soon as practicable.
If you believe that your CDR data or personal information has been the subject of a data breach, you can contact us using the contact details outlined in Section 16.1 above.
This CDR Policy is available electronically by selecting "Settings", then "CDR Policy" within our Services. It is also available on the WeMoney website by visiting www.wemoney.com.au/policies/cdr-policy, and on request by contacting us at hello@wemoney.com.au.
We reserve the right to change this CDR Policy, at any time and when we do, we will post the current version on our website and will be available in "Settings", then "CDR Policy" within our Services.
The revised CDR Policy shall apply from the date of publication of the revised CDR Policy on our website, and is made available in "Settings", then "CDR Policy" within our Services.
We will not file a copy of the CDR Policy specifically in relation to each user or consumer and, if we update the CDR Policy, the version to which you originally agreed may no longer be available on our WeMoney website or made available in "Settings", then "CDR Policy" within our Services. We recommend that you consider saving a copy of the CDR Policy for future reference.
This CDR Policy is Version 6.5 dated 29 September 2026.
ABN: 88 633 007 860 WeMoney Pty Ltd
All rights reserved.
Built with ❤️ in Australia
Australian Credit Licence (ACL): 526330
AFCA member: 79896
WeMoney acknowledges and pays respect to the past, present, and emerging Traditional Custodians of the land in which we live and work.
Information on this website is general in nature and is not financial or credit advice. It does not take into account your objectives, financial situation or needs. Consider whether it is appropriate for your circumstances, and read our Terms of Use, Credit Guide and Privacy Policy before acting on it.
.png)
