If you see something, Speak Up!

Equifax A/NZ, through its Whistleblowing Program, is committed to the highest standards of business conduct.

We encourage the reporting of any instances of suspected unethical, illegal, fraudulent or undesirable conduct involving Equifax A/NZ and provide a full range of protections and measures to ensure that any person who makes a report under our Whistleblowing Program can do so anonymously or confidentially and without fear of intimidation, disadvantage or reprisal.

The Equifax Whistleblower Protection Policy – New Zealand (Public Version) is published below and should be referenced when making any report under our Program. It is one of the central pillars of our Whistleblowing Program and is intended to promote core values of honesty, integrity and corporate social responsibility across Equifax A/NZ’s business operations and activities. It formalises our approach to the prevention, detection and reporting of wrongdoing and the protection of those persons who make whistleblower disclosures through the provision of a convenient and safe reporting mechanism.

In addition to the Equifax A/NZ Whistleblower Protection Officer who has overall responsibility for our Program, we have engaged the Independent Whistleblowing services of Stopline Pty Ltd, to receive, manage and investigate all reports of disclosable conduct or serious wrongdoing made in reliance on the Policy and to be available to fully support all eligible Whistleblowers who choose to speak up.

At Equifax A/NZ - we Listen, we Protect & we Respect.

Equifax A/NZ Whistleblower Protection Policy - New Zealand

1. INTRODUCTION

This Public Use Version of the Equifax A/NZ Whistleblower Protection Policy - New Zealand ("this Policy") documents the commitment of Equifax Australia & New Zealand ("Equifax A/NZ" or "Equifax") to maintaining an environment that encourages Disclosers in New Zealand who are not currently employees, officers or employed contractors of Equifax A/NZ to speak up about Serious Wrongdoing (as defined below) without being subject to retribution, victimisation, harassment and/or discriminatory treatment. In accordance with this Policy, Equifax will appropriately listen to, respect and protect persons making a disclosure of Serious Wrongdoing in accordance with this Policy.

All disclosures made under this Policy will be treated in a manner that is fair, prompt, sensitive and confidential (to the extent possible) and provide the appropriate protections to those involved in any whistleblower complaint process.

This Policy:

• encourages Disclosers (as defined below) to promptly report Serious Wrongdoing if they have reasonable grounds to do so;  
• outlines how Equifax will deal with and investigate Serious Wrongdoing;  
• sets out the avenues available to Disclosers to report Serious Wrongdoing; and
• sets out how Equifax will afford fair treatment to Whistleblowers and any person who is involved in a Whistleblowing  disclosure.

This Policy does not cover the reporting of personal work-related grievances.

2. SCOPE AND APPLICATION

2.1 To whom does this Policy apply?

This Policy applies to Equifax and all of its business units in New Zealand and covers Disclosers (as defined below) who are not current employees, officers or employed contractors of Equifax. Current employees, officers and employed contractors of Equifax are covered under an equivalent internal policy which should be used in place of this one.

Any Discloser - also called a "Whistleblower" in this Policy - may raise concerns regarding Serious Wrongdoing under this Policy as a Whistleblower.

A "Discloser" under this Policy includes any individual who has been:

• an officer or employee of Equifax A/NZ,
• a homeworker (as defined in section 5 of the NZ Employment Relations Act 2000) engaged by Equifax A/NZ,
• a secondee to Equifax A/NZ
• an individual who supplies services or goods to Equifax A/NZ (whether paid or unpaid),
• an employee of a person who supplies services or goods to Equifax A/NZ (whether paid or unpaid),
• an individual who is an associate of Equifax A/NZ,
• a relative of an individual referred to in any of the above, or
• a dependent of an individual referred to in any of the above.

2.2  Who can help with this Policy?

The Equifax A/NZ General Manager Enterprise Risk Management & Compliance (the "GMC")  has been nominated as Equifax's Whistleblower Protection Officer (the "WPO"), with overall responsibility for this Policy. Those responsibilities include policy development, policy review, and the full implementation of the objectives of this Policy.

Further information on this Policy can be provided upon request by contacting Equifax A/NZ's Independent Whistleblower Service - Stopline. (Stopline's contact details are set out below). Alternatively, the GMC or Equifax A/NZ's Human Resources team can also assist in providing information regarding this Policy.

3. SERIOUS WRONGDOING

3.1 What types of conduct should be disclosed?

Equifax encourages and relies on Disclosers who are aware or suspect the occurrence of or presence of Serious Wrongdoing (as defined below) to promptly report it and to follow the processes set out in this Policy.

To make a disclosure under this Policy, a Discloser must have reasonable grounds to suspect that there is or has been Serious Wrongdoing. That means they must have some supporting information for holding that suspicion. It is not enough to merely make an unsupported allegation.

"Serious Wrongdoing" refers to any conduct in relation to Equifax A/NZ (including the conduct of an officer or employee of Equifax A/NZ) whether actual or suspected, which a Discloser believes on reasonable grounds:

• to be dishonest, fraudulent or corrupt;
• to involve bribery or corruption;
• may result in an improper state of affairs or otherwise amount to an abuse of authority;
• to be illegal, including theft, drug sale or use, violence, or threatened violence, harassment, intimidation;
• to represent criminal damage to property;
• to be in breach of government legislation or local authority by-laws;
• to be unethical, including dishonestly altering company records or data, adopting questionable accounting practice;
• constitutes the unauthorised disclosure of confidential information;
• to be a breach of Equifax A/NZ  business policies or a substantial wasting of company resources;
• to be potentially damaging to Equifax A/NZ, an employee or a third party, or to the public or the financial system;
• to be a serious risk to public health, public safety, the health or safety of any individual; or the environment;
• to amount to an improper state of affairs or circumstances, in relation to the tax affairs, a related company or associated entity and this information may assist the recipient to perform their functions or duties in relation to those tax affairs;
• may cause financial or non-financial loss, damage its reputation or be otherwise detrimental to the business interests; or
• to be an attempt to conceal or delay disclosure of any of the above conduct.

"Serious Wrongdoing" does not need to involve a breach or the breaking of any particular law. For example, information that indicates a significant risk to public safety or the stability of, or confidence in, the financial system, is also Serious Wrongdoing.

3.2 What types of disclosure are not protected under this Policy?

A disclosure which does not relate to Serious Wrongdoing or is knowingly false, or otherwise made in bad faith, will not qualify for protection under this Policy. However a disclosure of any nature made to a legal practitioner for the purposes of obtaining legal advice will be protected.

This Policy does not, in most cases, cover reporting of  personal work-related grievances. In other words, this Policy does not apply to making a disclosure about any matter relating to a person's employment or former employment which has or tends to have implications for them personally.

Some examples of disclosures that are not generally permitted or protected under this Policy are:

• reports about interpersonal conflicts between individuals;
• decisions relating to the engagement, transfer or promotion of an individual;
• decisions relating to the terms and conditions of engagement of an individual; or
• decisions relating to the disciplinary treatment, suspension or termination of employment/engagement of any individual.

However, there can be exceptions where personal work-related grievances may be Serious Wrongdoing and may qualify for protection. These exceptions may be in situations where:

• the disclosure of the grievance has significant implications for Equifax and also includes information about Serious Wrongdoing;
• the Discloser suffers from (or is threatened with) detriment for making a disclosure or assisting in the  investigation of a disclosure;
• is a mixed report that includes Serious Wrongdoing and a personal work-related grievance; or
• relates to information suggesting misconduct beyond the Discloser's circumstances.

4. HOW, WHO AND WHEN TO REPORT

4.1 Reporting – to whom?

Disclosers can make a report of Serious Wrongdoing to any of the Receivers mentioned below ("Receiver").

Independent Whistleblowing Service - Stopline

Any intending Whistleblower is encouraged, at first instance, to make a disclosure via Equifax's external Independent Whistleblower Service ("IWS") which is managed by Stopline Pty Ltd ("Stopline").

The IWS is available 24 hours a day/365 days a year and offers a number of channels as  detailed in the table below to use to make a report under this Policy. Stopline will put together a report based on the  information disclosed by a Discloser for each disclosure that comes through the IWS. Disclosures can be made anonymously if a Whistleblower so prefers.

To raise a concern, you may also scan the QR Code below:

WPO and Internal Receivers

If a Discloser does not want to use the IWS, the disclosure should be made directly to the Equifax A/NZ WPO. Alternatively, they can choose to report the Serious Wrongdoing directly (either orally or in writing) to another of Equifax's internal Receivers.

In addition to the WPO, Equifax's internal Receivers include:

• an officer or senior manager of Equifax A/NZ;
• an auditor (or member of an audit team) conducting an audit of Equifax A/NZ;
• an actuary of Equifax A/NZ; or
• any other person authorised under this Policy to receive reports of Serious Wrongdoing.

Equifax's internal Receivers are required to comply with the terms of this Policy, including keeping the identity of the Whistleblower making the report confidential (unless an exception applies) and providing any support necessary (including if requested by the Whistleblower, providing a support contact person) in any investigation conducted into the Serious Wrongdoing reported.

Other Receivers

A Whistleblower may also choose to report Serious Wrongdoing to any of the following external Receivers:

• Equifax's auditors;
• A legal practitioner for the purpose of obtaining legal advice;
• The Ombudsman; or
• Other appropriate authorities (including, but not limited to, the Human Rights Commission in relation to bullying, harassment and discrimination and the Financial Markets Authority in relation to financial reporting and conduct as a financial services provider).

Whilst Serious Wrongdoing may be made to internal or other external Receivers, Equifax strongly encourages Whistleblowers making a report under this Policy, to use Equifax's IWS in the first instance as this will allow Equifax to promptly investigate, action and address the matters raised as part of a Serious Wrongdoing report.

4.2 Not sure whether to report?

If the Whistleblower is not sure whether or not to report Serious Wrongdoing, they can discuss any concerns with the IWS or any other Receiver (as identified in this Policy) before making a report of Serious Wrongdoing. Once contacted, a Receiver must keep the identity of a Whistleblower confidential at all times (unless an exception applies).

Any discussion prior to deciding to make a formal report under this Policy can, if preferred, be undertaken anonymously between the Whistleblower and any chosen Receiver.

4.3 What should a report include?

Disclosures should provide as much detail as possible to allow Equifax or its IWS - Stopline, to make full and proper inquiries into the Serious Wrongdoing, including:

• the Discloser's name and contact details (or, if the report is anonymous and where possible, an anonymised email address or other anonymised contact point);
• a statement describing the Serious Wrongdoing;
• name of the person(s) involved;
• dates, times and locations;
• details of any relevant transactions;
• copies of any relevant documents;
• names of possible witnesses; and
• any steps already taken to report or address the matter

If any assistance is required to complete making a report in accordance with this Policy, a Discloser may seek to directly contact the Equifax IWS - Stopline or any of the other Receivers identified in this Policy to obtain any necessary support to make that report. This can be done confidentially or anonymously by using any of the methods of contact set out under this Policy

5. PROTECTION FOR WHISTLEBLOWERS

To qualify for protection under the law a report of Serious Wrongdoing by a Whistleblower must be made via the IWS or directly to another Receiver identified in this Policy.

5.1 Protection of Identity & Confidentiality

A Whistleblower can choose to remain anonymous while making a disclosure, during the course of the investigation and/or after the investigation is finalised and may change their mind at any stage of the process, and choose to consent to partial or full disclosure of their identity.

In determining whether to remain anonymous, it is important to understand that it may be difficult for Equifax to properly investigate completely anonymously received reports. However, Equifax and the IWS will always respect the Whistleblower's choice as to anonymity and will maintain confidentiality at all times, regardless of being anonymous or not.

The Equifax IWS, WPO or any other Receiver is legally prohibited from disclosing any particulars about the disclosure that might identify, or be likely to lead to the identification of, the individual reporting the conduct, without first obtaining the relevant individual's express consent except if there are reasonable grounds to believe that the release of the identifying information is essential —

• for the effective investigation of the disclosure or to comply with the principles of natural justice (subject to prior consultation with the Discloser); or
• to prevent a serious risk to public health, public safety, the health or safety of any individual, or the environment or to an investigation by a law enforcement or regulatory agency for the purpose of law enforcement (subject to prior consultation with the Discloser, if practicable).

After releasing any identifying information for these reasons the Discloser will be informed accordingly.

The Equifax IWS, WPO or any other Receiver under this Policy may also disclose particulars about the disclosure to a New Zealand legal practitioner for the purposes of -

• Equifax obtaining legal advice or representation;
• a court or tribunal finding it is necessary in the interests of justice, or;
• otherwise as permitted by law.

Steps that Equifax may take to protect the confidentiality of the Whistleblower's identity include:

• redacting personal information in the report and related documentation;
• referring to the Whistleblower in a gender-neutral way;
• speaking to the Whistleblower about aspects of the Whistleblower's disclosure that may inadvertently identify the Whistleblower;
• keeping documents relating to the Whistleblower's report secure and limiting access;
• reminding persons involved of the confidentiality requirements under any New Zealand laws.

Whistleblowers should also take their own steps to protect the confidentiality of their identity both prior to and after making a disclosure.  However, if a regulator or other government authority takes further legal action in relation to a disclosure, it may become necessary for a Discloser to identify themselves to the relevant regulator or authority.

Whistleblowers may seek information and guidance from an Ombudsman about the duty of confidentiality under the Protected Disclosures (Protection of Whistleblowers) Act 2022 at any time.

5.2 Freedom from Retaliation or Unfavourable Treatment

Disclosers who have information which they suspect, on reasonable grounds, relates to Serious Wrongdoing and who subsequently make a report of that information in accordance with this Policy will not be discriminated against or disadvantaged in their employment or engagement with Equifax, even if the report is subsequently determined to be incorrect or not substantiated.

Equifax does not tolerate any form of unfair treatment, threat, retaliation or other action against any individuals who have made or assisted in the making of a disclosure or are involved in an investigation of a report under this Policy and will take steps to ensure that Whistleblowers do not suffer detriment as a result of their act of disclosure and reporting.

Detriment or adverse treatment may include actual or threatened:

• dismissal, demotion, suspension. alteration of an employee's position/duties or injury to an employee in his or her  employment;
• discrimination between an employee and other employees of Equifax;
• damage to property, reputation or financial position;
• harassment, intimidation, harm or injury including psychological harm; or
• any other damage to a person

Any unfair treatment, threat, retaliation or other action should immediately be reported to a member of Equifax's Human Resources Team or the Equifax General Counsel A/NZ or the Equifax Group Managing Director, Australia/New Zealand (GMD). If the matter involves the Equifax General Counsel and/or the GMD, it should be reported to the WPO to investigate and address.

For guidance, detrimental treatment does not include any:

• administrative action taken by Equifax that is reasonable to protect a Discloser from detriment (for example, moving a Whistleblower to another work location); or
• reasonable management action regarding a Whistleblower's unsatisfactory work performance or conduct.

5.3 Other Protections

Protection of files and records

All files and records created in relation to a report and/ or an investigation into Serious Wrongdoing under this Policy will be securely stored and retained by Equifax in a confidential repository. Access to the confidential repository will be limited on an as needs basis, to the GMD, the GMC, and,where applicable, other persons authorised by the GMD or the GMC.

Additional Legal Protections

A Whistleblower who makes a report of Serious Wrongdoing under this Policy, may be entitled to additional  protections under New Zealand law. One such example is a protection against the  commencement of certain legal proceedings or actions in relation to the report itself.

Other legal protections ensure that Whistleblowers in certain circumstances, are protected  against civil, administrative and criminal liability, and from the enforcement of certain contractual remedies in respect of those disclosures. Some legal protections may also apply regarding the admissibility of evidence against a Whistleblower in criminal  proceedings or proceedings for the imposition of a penalty (except in respect of disclosures of false information). Equifax encourages Whistleblowers to seek their own independent legal advice.

5.4 Compensation & Remedies

Whistleblowers may be entitled to seek compensation and other remedies from Equifax for loss, damage or injury they have suffered as a result of a whistleblower disclosure or if Equifax has failed to take reasonable precautions and has not  exercised appropriate due diligence to prevent the loss, damage or injury from occurring.

A Whistleblower may also have rights to compensation for loss, damage or injury and other remedies under New Zealand law if the Whistleblower's identity has been improperly or carelessly disclosed or where the Whistleblower has been subject to detrimental treatment as a result of making a disclosure under this Policy.

5.5 When do the Protections apply?

Access to the Whistleblower protections under New Zealand law are available under this Policy if  any report made under this Policy is a legally protected disclosure which meets the following criteria:

• the Whistleblower is a Discloser;
• the disclosure is made directly to a Receiver;
• the information disclosed relates to Serious Wrongdoing; and
• the Whistleblower has reasonable grounds for their suspicions.

However, it should be noted that this Policy will not protect anyone making a report if they are also involved in, or connected to, the Serious Wrongdoing.

5.6 How can we support you?

Equifax is committed to protecting, respecting and supporting Whistleblowers who wish to make a report of Serious Wrongdoing under this Policy. If a Whistleblower chooses to make a report under this Policy in person, they are entitled to do so with a support person present. Equifax will take all reasonable steps to ensure that Whistleblowers who make a report of Serious Wrongdoing receive appropriate support and engagement.

Equifax provides support to Whistleblowers, which includes the following:

• where possible, keeping the Whistleblower informed of the progress and outcomes of the enquiry or investigation (subject to any privacy and confidentiality obligations and as required by law) including any proposed remedial actions;
• keeping the Whistleblower's identity confidential and/or anonymous, if requested by the Whistleblower to do so;
• endeavouring to resolve any concerns that the Whistleblower has regarding actual or threatened detrimental  treatment because the Whistleblower has made, or is considering making, a report under this Policy; and
• providing training (and re-training as required) to Equifax A/NZ employees, managers and officers about this Policy.

Additional support for Whistleblowers is available via independent support service providers such as Lifeline and the Mental Health Foundation (see contact details below). Whistleblowers should understand that use of these support services may require them to  consent to the disclosure of their identity or information that may lead to the discovery of their identity.

5.7 False or Frivolous Reports

A Whistleblower must have reasonable grounds to make a report of Serious Wrongdoing under this Policy.

Reports made under this Policy are treated very seriously and can have significant consequences for anyone named or involved or having a role in the reported Serious Wrongdoing.

For this reason Disclosers will not receive the protections under this Policy if the report is made falsely or in bad faith.

A Whistleblower will not be considered to have made a report on the basis of reasonable grounds to suspect that the Serious Wrongdoing has, or will shortly, take place, if the report is frivolous, raised for a malicious reason or ulterior motive, or if it is not based on facts and/or circumstances to substantiate a reasonable basis for the report. Repeated reports about trivial matters may also be considered frivolous.

6. FAIR TREATMENT OF ALL PERSONS

This Policy requires that principles of fairness and natural justice be afforded to all persons concerned.

This Policy objective will be balanced in its application by fully respecting the rights and protections afforded to any Discloser, including wherever possible and practicable the entitlements to confidentiality and anonymity.

Equifax will also take all reasonable steps to provide any person or persons directly named or indirectly identified or mentioned in a report of Serious Wrongdoing with an opportunity to respond to all or any allegations as part of any whistleblower inquiry or investigation.

This Policy recognises the importance of striking an appropriate balance of assuring that the whistleblowing protections of confidentiality and immunity from any reprisal, detriment or unfair treatment are respected and at the same time meeting the principles of natural justice, and a person's right to defend themself and treated with fairness generally.

Support is also available and may be provided by Equifax should a person subject to allegations contained in a received report of Serious Wrongdoing feel they need legal or other representation in the process to ensure procedural fairness.

7. INVESTIGATIONS

7.1 Who investigates Serious Wrongdoing?

A Serious Wrongdoing report raised with either the IWS or any Receiver identified under this Policy will normally be investigated by either the Equifax IWS or by the Equifax A/NZ WPO.

However, under this Policy any necessary investigation conducted on receipt of a report of Serious Wrongdoing may be done in any of the following manners:

• independently by the Equifax A/NZ  IWS - Stopline; or
• Independently by the Equifax A/NZ WPO;  or
• by either the Equifax A/NZ IWS - Stopline or the Equifax A/NZ WPO in collaboration with the other; or
• by either the Equifax A/NZ IWS - Stopline or the Equifax A/NZ WPO separately or collaboratively together with the support of an appointed support person (chosen for instance because of their specialised knowledge or skills in respect to a particular Serious Wrongdoing report).

The preferred method of conducting any investigation though is through the IWS - Stopline. Stopline has considerable experience and expertise in handling and managing Whistleblowing matters arising from reports of Serious Wrongdoing and is considered to be best placed to investigate these matters on behalf of Equifax A/NZ.

7.2 Investigation Process

The following flow chart diagram illustrates the approach and process taken under this Policy by the IWS - Stopline upon the receipt of a report of Serious Wrongdoing from a Discloser. A similar approach will also be taken by an Equifax A/NZ Receiver in the event that a report of Serious Wrongdoing is received directly by Equifax A/NZ.

If, for any reason, it is not considered appropriate or desirable for Stopline to investigate a Serious Wrongdoing Report it will be automatically conducted by the WPO or, as decided at the discretion of  the WPO, by one of the following:

• a lawyer employed by Equifax; 
• a Equifax A/NZ HR employee;
• a Senior Equifax A/NZ Leader;
• an external party such as a lawyer or other expert engaged for the specific investigation purpose; or
• another person nominated by the WPO.

7.3 How Equifax approaches investigations of Serious Wrongdoing

Serious Wrongdoing reported under this Policy will be investigated as soon as possible after being reported. The identity of the Whistleblower will be kept confidential (unless an exception applies) or anonymous (if so requested by the Whistleblower).

Any investigation of reported Serious Wrongdoing will be done by Equifax's IWS or internally by the Equifax A/NZ WPO.

The  investigation will be conducted in an objective and fair manner and otherwise as is reasonable and appropriate having  regard to the nature of the Serious Wrongdoing and the circumstances.

If it will assist the investigation an independent person (internal or external to Equifax) may be appointed to support the process. This may be necessary or desirable where expert or specialist skills are required to investigate a particular report of Serious Wrongdoing.

Where appropriate, and where the Whistleblower has provided their contact details, the Whistleblower in most instances will be provided with regular feedback regarding any investigation's progress and/or its outcome (subject to any considerations being applied to the privacy and confidentiality of those against whom any allegations are made in regards to the report of Serious Wrongdoing.).

At the conclusion of any investigation under this Policy into Serious Wrongdoing, a confidential report will be provided to the Equifax A/NZGMC in their capacity of WPO. If appropriate, depending on the seriousness and nature of the matter the GMD may also receive a copy of the report.

While regular feedback will be provided to the Discloser (where the Discloser has provided either the IWS or an Receiver of Equifax with contact details) they will not receive a copy of the final report.

Any recommendations arising at the completion of an investigation under this Policy will be considered by the Equifax A/NZ WPO. If substantiated, the reported Serious Wrongdoing may lead to disciplinary action being taken including termination of employment or engagement and/or legal referral or legal action. Any determined action will be measured and appropriate based on the nature and extent of the substantiated Serious Wrongdoing.

8. MISCELLANEOUS

8.1 Where can I find this Policy?

This Policy is publicly available on the Equifax New Zealand website. An equivalent policy is also published on Equifax A/NZ's internal intranet web pages for the reporting of Serious Wrongdoing by current Equifax employees and contractors (or Disclosers associated with current employees or contractors) who are able to access that content.

8.2 When is this Policy reviewed?

As with all of its Policies, this Policy will be reviewed and amended by Equifax A/NZ at suitable intervals to ensure that it remains effective and relevant; and that it continues to comply with all relevant current legislative and regulatory requirements.