KBI Group Pty Ltd

Version: 25 August 2026

1. About this policy

KBI Group Pty Ltd (ABN 56 167 437 121, Australian Financial Services Licence 494792) and KBI Pty Ltd trading as KBI (ABN 93 167 078 953, authorised representative 450152) (together, KBI, we, us or our) are committed to managing personal information openly and responsibly. This policy explains how KBI collects, holds, uses and discloses personal information under the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs) and the Notifiable Data Breaches scheme.

This policy applies to individuals whose personal information KBI handles, including clients and prospective clients, directors, officers, employees and representatives of business clients, claimants, witnesses, suppliers, referral partners, job applicants and website visitors. It does not apply to information about a company or other organisation unless the information is also about an identifiable individual.

KBI primarily provides business and commercial general insurance services. Depending on the service, KBI may act for a client as insurance broker or for an insurer under a binder or agency. We will explain the capacity in which we act where relevant.

2. Personal information we collect

The kinds of personal information we collect and hold depend on the service or interaction. They may include:

• identity and contact information, such as name, job title, date of birth, postal address, email address, telephone number and signature;
• business, professional and employment information, including a person’s role, qualifications, work history, directorships and business relationships;
• insurance and risk information, including insured assets, business activities, turnover, payroll, claims history, policy details, risk surveys and information relevant to underwriting;
• financial and transaction information, including premium, payment, bank-account and premium-funding information;
• claims information, including circumstances of an event, loss or injury, witness details, photographs, supporting documents and communications with insurers and claims service providers;
• records of enquiries, advice, instructions, complaints, calls, meetings, correspondence and service history;
• website and device information, including internet protocol address, browser and device details, pages viewed, referral source, cookie or similar identifiers and advertising click identifiers;
• recruitment and supplier information; and
• government-related identifiers where reasonably necessary or authorised by law.

Some insurance or claims matters require sensitive information, such as health information, criminal history, professional memberships or associations. KBI collects sensitive information only where permitted by law, including where the individual has consented and the information is reasonably necessary for our functions or activities, or another exception applies.

3. How we collect personal information

We usually collect personal information:

• directly from the individual by telephone, email, meetings, forms, questionnaires, portals, websites or other communications;
• from a business client or another person authorised to provide information about its directors, employees, contractors or other individuals;
• from insurers, underwriting agencies, wholesale brokers, premium funders, claims managers, loss adjusters, investigators, medical or legal advisers and other service providers;
• from referral partners, associations, strata managers, authorised representatives or distributors;
• from public sources and registers, including company, professional and sanctions registers, websites and social media; and
• automatically when a person uses our website or digital services, through logs, cookies and similar technologies.

Where it is lawful and practical, an individual may deal with us anonymously or using a pseudonym. This will usually not be practical for insurance broking, policy administration, claims, identity verification, payment or complaint handling.

If KBI receives unsolicited personal information, we will decide whether we could have lawfully collected it. If not, we will take reasonable steps to destroy or de-identify it, unless it is contained in a Commonwealth record or the law requires or permits us to keep it.

4. Why we collect, hold, use and disclose information

KBI may handle personal information to:

• understand a client’s business, insurance needs and risks, provide advice and arrange, renew, vary, cancel or administer insurance;
• obtain and compare quotations, negotiate terms and place insurance or reinsurance in Australia or overseas;
• arrange premium funding, collect premiums and fees, make payments and manage accounts;
• assist with claims and communicate with insurers, claimants, experts and other participants;
• provide client service, answer enquiries, manage complaints and resolve disputes;
• comply with legal, regulatory, licensing, professional and contractual obligations, and respond to regulators, courts and law-enforcement bodies;
• identify and manage fraud, sanctions, conflicts, security, misconduct and other business risks;
• manage relationships with suppliers, referral partners, authorised representatives and distributors;
• recruit and manage personnel;
• operate, secure, analyse and improve our systems, website, services and business processes; and
• send relevant service updates and, where permitted, marketing communications.

We generally use or disclose personal information for the purpose for which it was collected, for a related purpose the individual would reasonably expect, with consent, or as otherwise required or authorised by law. Consent is not the only lawful basis on which the Privacy Act permits KBI to handle personal information.

5. If information is not provided

KBI may be unable to provide advice, obtain quotations, arrange or administer insurance, assist with a claim, process a payment, respond to an enquiry or meet legal obligations if relevant information is not provided. The information an insurer requires, and any duty or obligation that applies to an applicant or insured, depends on the policy, the applicable law and the insurer’s questions or notices. KBI will provide or refer clients to the relevant policy-specific information rather than treating every insurance contract as subject to the same disclosure duty.

6. Who we disclose personal information to

KBI may disclose personal information to recipients including:

• insurers, underwriting agencies, Lloyd’s brokers and underwriters, wholesale brokers, reinsurers and insurance-market participants;
• premium funders, payment providers, banks and accountants;
• claims managers, loss adjusters, assessors, investigators, repairers, medical providers, lawyers, experts and other claims service providers;
• technology, cloud, cybersecurity, website, analytics, communications, document management, archiving, printing and mailing providers;
• authorised representatives, distributors, referral partners, associations, advisers and professional service providers;
• regulators, external dispute resolution schemes, courts, law-enforcement bodies and other persons where disclosure is required or authorised by law;
• a prospective purchaser, adviser or participant in a proposed or actual merger, acquisition, restructure or transfer of KBI’s business or assets, subject to appropriate confidentiality controls; and
• other recipients notified to the individual or authorised by the individual.

KBI does not sell or rent personal information. We do not disclose personally identifiable information to third parties for their independent marketing unless the individual has consented or the disclosure is otherwise permitted by law.

7. Overseas disclosures

KBI may disclose personal information to overseas recipients when arranging international insurance, placing cover in overseas markets, assisting with claims or using service providers that support our broking and administration systems.

The countries in which recipients are currently likely to be located include the United Kingdom, New Zealand and the Philippines. Other countries may be relevant for a particular insurer, reinsurer, risk, claim or service arrangement.

In limited circumstances, we may ask you to consent to disclosure of your personal information to an overseas recipient without requiring us to take the steps ordinarily required by Australian Privacy Principles (APP) 8. Before seeking your consent, we will explain that, if you consent, we may not be accountable under the Privacy Act 1988 for the overseas recipient’s handling of your information, and you may not be able to seek redress from us under that Act if the recipient mishandles it.

8. Direct marketing

KBI may use contact details to send information about our services, insurance developments, events, articles and offers where permitted by law. Each electronic marketing message will provide a simple way to unsubscribe. A person may opt out at any time by using the unsubscribe facility or contacting us. We will action the request within a reasonable period and will not charge for it. Service and policy administration messages are not marketing and may still be sent where required to manage the relationship or insurance arrangements.

9. Our website, cookies and online forms

Website data

When a person visits kbi.com.au, KBI and its service providers may collect technical and usage data such as internet protocol address, device and browser type, date and time of access, pages viewed, links selected, referring page and approximate location. Some of this data may be personal information when it identifies or can reasonably identify an individual.

Cookies, analytics and advertising identifiers

Our website may use cookies, pixels, tags, local storage and similar technologies for essential site functions, security, preferences, analytics, client relationship management, chat or interactive features, advertising measurement and remarketing. We may collect an advertising click identifier and associate it with an enquiry submitted through a form so we can measure the campaign that led to the enquiry. Third-party providers may process information under their own privacy terms.

A person can use available cookie controls and browser or device settings to restrict certain technologies. Blocking some cookies may affect website functions. Where consent is required, KBI will seek it through an appropriate notice or consent control. This policy does not replace a collection notice or cookie choice presented at the point information is collected.

Online forms and communications

Information submitted through website forms is used to respond to enquiries, provide requested services, manage relationships and for the other purposes described in this policy. Internet transmissions cannot be guaranteed to be completely secure. Do not send highly sensitive claim, health, identity or financial information through a general contact form. Contact KBI to agree an appropriate method for providing sensitive information.

External links

Our website may link to third-party websites. KBI is not responsible for the privacy practices of those websites. Individuals should review the relevant third party’s privacy information before providing personal information.

10. Artificial intelligence and automated processing

KBI may use analytics, automation and artificial intelligence enabled tools to support administration, security, marketing analysis, document handling and internal workflows. KBI personnel remain responsible for our insurance broking advice and placement activities.

If KBI arranges for a computer program to use personal information to make, or do something substantially and directly related to making, a decision that could reasonably be expected to significantly affect an individual’s rights or interests, KBI will describe the relevant kinds of decisions and personal information in this policy as required by law. KBI will update this section before introducing any such process.

11. Security and retention

KBI takes reasonable technical, physical and organisational steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. Measures may include access controls, authentication, network and endpoint protections, encryption where appropriate, secure premises, staff training, confidentiality obligations, monitoring, backups and supplier controls. No security measure can eliminate all risk.

We keep personal information for as long as reasonably necessary for our functions, insurance and claims administration, dispute management, legal and regulatory obligations and legitimate record-keeping needs. When personal information is no longer required and no law or lawful basis requires it to be retained, we take reasonable steps to destroy or de-identify it.

12. Data breaches

KBI maintains processes for responding to suspected loss, unauthorised access or unauthorised disclosure of personal information. Where the Notifiable Data Breaches scheme applies, KBI will assess a suspected eligible data breach and notify affected individuals and the Office of the Australian Information Commissioner (OAIC) where required. Notifications will include practical steps individuals should take in response.

13. Accessing and correcting personal information

An individual may ask to access personal information KBI holds about them or ask us to correct it. The request does not need to use a particular form, but enough information should be provided to identify the person and the information requested. KBI may need to verify identity or authority before acting on a request.

KBI will respond within a reasonable period, generally within 30 calendar days. We do not charge for making an access or correction request. We may charge reasonable costs for giving access, but not where the Privacy Act prohibits a charge, and we will explain any proposed charge first. If KBI refuses access or correction, we will provide written reasons and available complaint mechanisms unless the law allows otherwise.

14. Privacy enquiries and complaints

Contact the KBI Privacy Officer using the details below. A complaint should describe the concern, relevant dates and communications, and the outcome sought. KBI will acknowledge the complaint promptly, investigate it fairly and aim to provide a written response within 30 calendar days. If more time is reasonably required, we will explain why and provide an expected response date.

If the matter is not resolved, an individual may be able to complain to the Australian Financial Complaints Authority (AFCA), where the complaint is within AFCA’s jurisdiction, or to the OAIC. The OAIC generally expects a person to first give the organisation 30 days to respond and may require use of an approved external dispute resolution scheme where applicable.

15. Contact details

Privacy Officer

KBI Group Pty Ltd

Level 2, 140 St Georges Terrace, Perth WA 6000

PO Box Z5102, St Georges Terrace, Perth WA 6831

Email: info@kbi.com.au

Telephone: (08) 6467 7999

Website: kbi.com.au

External complaint bodies

Australian Financial Complaints Authority (AFCA): afca.org.au | 1800 931 678

Office of the Australian Information Commissioner (OAIC): oaic.gov.au/privacy/privacy-complaints

16. Changes to this policy

KBI may update this policy when our practices, technology, service providers or legal obligations change. The current version and effective date will be published on our website. Material changes will be communicated where reasonably appropriate. A copy is available free of charge in an alternative form on request where it is reasonable and practicable to provide it.

This policy is general information about KBI’s privacy practices. It does not limit any rights or remedies available under applicable law.