Consumer Data Right (CDR) Policy

Last updated: 23 July 2026

1. About this policy

This policy explains how WealthX Pty Ltd (ABN 72 681 110 832) (“WealthX”, “we”, “us”, “our”) collects, uses, discloses and deletes your Consumer Data Right (CDR) data, and how you can manage your consents, correct your data and make a complaint.

This is a standalone policy about CDR data. Our handling of other personal information is covered by our Privacy Policy. Where this policy and the Privacy Policy overlap in relation to CDR data, this policy applies.

You can ask us for a copy of this policy in electronic or hard copy form at any time using the contact details in section 13.

2. What is the Consumer Data Right

The Consumer Data Right (CDR) is an Australian government initiative that gives you control over your data. In banking (often called open banking), it lets you securely share your banking data with accredited recipients and their representatives so you can access better products and services. The CDR is regulated by the Australian Competition and Consumer Commission (ACCC) and the Office of the Australian Information Commissioner (OAIC).

3. Our role: CDR representative of Basiq

WealthX is a CDR representative of Basiq Pty Ltd (“Basiq”), an unrestricted accredited data recipient under the CDR. When you connect your accounts through WealthX, your CDR data is collected from your bank by Basiq on your instruction and made available to WealthX under our CDR representative arrangement with Basiq.

Basiq’s CDR Policy applies to the data Basiq collects and handles as our principal. You can read it at Basiq’s Consumer Data Right Policy.

4. The CDR data we collect

We only collect the CDR data you consent to share, and only what is reasonably needed to provide our services to you. The permissions you can grant when connecting your accounts are:

  • Name and occupation;
  • Name, occupation and contact details;
  • Organisation profile, and organisation profile and contact details (for business accounts);
  • Account name, type and balance (required to provide the service);
  • Account balance and details;
  • Transaction details;
  • Saved payees details.

The consent screens you see when connecting your accounts show you exactly which of these permissions you are granting, with whom your data is shared, and for how long.

5. Why we collect and use your CDR data

We do not hold our own store of your CDR data. Your data is held securely by Basiq, and we access it through Basiq’s secure API when needed to provide our services. With your consent, we collect and use your CDR data to:

  • Build an accurate picture of your financial position and make it available to your nominated trusted adviser, such as your mortgage broker, financial adviser or accountant, so they can provide you with advice and assistance;
  • Provide you with personalised financial insights within the WealthX app;
  • Send you service updates and notifications aligned with your preferences;
  • Produce de-identified, aggregated analytics as described in section 8.

We do not sell your CDR data. Your CDR data is not processed by artificial intelligence services or large language model providers.

6. Who we disclose your CDR data to

We only disclose your CDR data to the people and systems needed for your trusted adviser to provide you with advice and assistance. Specifically:

Your trusted adviser

When you connect your accounts, you authorise WealthX to make your CDR data available to your nominated adviser. Advisers on the WealthX platform belong to the following classes of trusted adviser recognised under the CDR rules:

  • Mortgage brokers;
  • Financial advisers and financial planners;
  • Qualified accountants.

Your adviser’s professional tools

At your adviser’s direction, your data may be delivered into the software platforms your adviser uses to provide advice and assistance to you. These may include financial planning platforms, advice production tools, and mortgage aggregation and lender application systems. These platforms receive your data on behalf of your adviser, and your adviser is responsible for handling it in accordance with the Privacy Act 1988 (Cth).

Our principal, Basiq

Basiq collects your CDR data from your bank and handles it under its own CDR Policy as our accredited principal.

No one else

  • We do not disclose your CDR data to any other non-accredited person;
  • We do not sell your CDR data;
  • We do not disclose your CDR data overseas;
  • We do not disclose your CDR data to AI sub-processors or large language model providers.

7. How your CDR data is stored and secured

Your CDR data is held securely in Australia by Basiq, our accredited principal, under its CDR obligations. WealthX does not maintain its own store of your CDR data; we access it through Basiq’s secure API when needed to provide our services. When we process your data, it is handled on infrastructure located in Australia (Amazon Web Services, Sydney region) and protected with encryption in transit, role based access controls, and monitoring. Our information security program is aligned with ISO 27001.

8. De-identified data

We produce de-identified, aggregated analytics from CDR data, for example category level spending trends across many users. De-identification removes your name, account identifiers and any information that could reasonably identify you, and results are only ever produced at an aggregate level.

We may share these aggregated insights, for example in industry reporting. Aggregated insights can never identify you or your accounts, and we never share or sell identifiable CDR data.

9. Managing and withdrawing your consent

You are in control of your consents and can manage or withdraw them at any time in the WealthX app:

  1. Open the WealthX app and go to Settings;
  2. Select Personal Settings;
  3. Scroll down to Show Connections;
  4. Select Unlink Account.

You can also withdraw consent by contacting our support team using the details in section 13.

If you withdraw a consent, we stop collecting your CDR data under that consent and your adviser loses access to it through the platform. Withdrawing consent may mean we and your adviser can no longer provide you with some or all of the services that rely on that data. Consents also expire automatically at the end of the period you agreed to when you gave them.

10. Deletion of your CDR data

When your CDR data is no longer needed for the purposes you consented to, including when you withdraw consent or your consent expires, it is deleted in accordance with the CDR rules through Basiq’s deletion process. We do not retain identifiable CDR data once it is redundant.

Deleting identifiable CDR data does not affect de-identified, aggregated analytics that were produced before deletion, as these can never identify you.

You can ask us to delete your CDR data at any time using the contact details in section 13.

11. Accessing and correcting your CDR data

You can see the CDR data we hold about you in the WealthX app at any time. If you believe your CDR data is inaccurate, incomplete or out of date, contact us using the details in section 13. Where the data originates from your bank, we will work with Basiq and your bank to have it corrected, and we will let you know the outcome.

12. What we will notify you about

We will notify you, through the app or by email, when:

  • You give, amend or withdraw a consent;
  • We collect your CDR data under a consent;
  • A consent is approaching expiry, or expires;
  • We respond to a correction or deletion request;
  • A data breach occurs that is likely to result in serious harm, in accordance with our legal obligations.

13. Questions and complaints

If you have a question or complaint about how your CDR data has been handled, contact us first:

WealthX Support
Email: support@wealthx.au
Phone: 0416 338 438

We will acknowledge your complaint promptly and aim to resolve it within 30 days. Complaints that relate to the collection of your CDR data through the CDR system are handled together with Basiq under Basiq’s complaints process.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner:

Office of the Australian Information Commissioner
Telephone: 1300 363 992
Email: enquiries@oaic.gov.au
Online: www.oaic.gov.au
Address: GPO Box 5288, Sydney NSW 2001