# Consumer Data Right > Clova’s planned approach to connected banking, which is not yet available. Canonical HTML: https://getclova.com/legal/cdr-policy Last updated: 2026-10-28 The [Consumer Data Right (CDR)](https://www.cdr.gov.au/) lets you choose to share eligible information from your bank with a service you want to use. You decide what to share, why and for how long. Clova is still in development and does not currently connect to banks or collect CDR banking information. Connected banking is planned for a future release. This page describes the planned approach, subject to the required arrangements being in place before launch. ## Clova and [Fiskil](https://www.fiskil.com) Clova plans to support connected banking through [Fiskil](https://www.fiskil.com). Under the planned arrangement, Fiskil would collect the banking information you authorise and share it with Clova for budgeting and money-management features. Clova is not independently accredited. The final arrangement and available features will be confirmed before connected banking launches. Once available, the planned connection would work in three steps: 1. You review the requested information, purpose and sharing period in the consent process. 2. You authorise your bank to share the selected information with [Fiskil](https://www.fiskil.com). 3. [Fiskil](https://www.fiskil.com) securely provides the authorised information to Clova for the agreed purpose. [Fiskil's CDR Policy](https://www.fiskil.com/legal/cdr-policy) governs the CDR information handled through this arrangement. It explains CDR handling, access, correction, deletion and complaints. This page accompanies that policy; it does not replace it or represent Clova as independently accredited. Our [Privacy Policy](/legal/privacy) explains other personal information and our [Terms of Service](/legal/terms) describe use of Clova. Neither document provides CDR consent. The sections below describe the controls planned for a future connected-banking service. They do not mean that banking connections or consent controls are available today. ## Information and purpose Connected banking is intended to support Clova’s planned budgeting and money-management features. Depending on the feature, information may include account details, balances and transactions. The consent process identifies the exact categories and history requested, the purpose, the sharing period and the parties involved. We request only information reasonably needed for that purpose. A categorised transaction or an insight derived from banking information remains protected where it can be linked to you. CDR connections require the applicable eligibility, including being at least 18. This does not restrict access to public material or app downloads. Bank authorisation takes place through the supported connection journey. Do not send banking passwords through Clova's contact form or email. ## Consent and stopping sharing Connecting is your choice. You can review the relevant consent and withdraw it through the service's consent controls, your bank's data-sharing controls or the channels in [Fiskil's CDR Policy](https://www.fiskil.com/legal/cdr-policy). Withdrawal ends the collection, use or disclosure authorised by the affected consent. Some features may stop working. The consent process explains the effect of withdrawing each consent, including any distinction between collection and use. You can also contact [support@getclova.com](mailto:support@getclova.com) for help or [support@fiskil.com.au](mailto:support@fiskil.com.au) to notify [Fiskil](https://www.fiskil.com) in writing. [Fiskil](https://www.fiskil.com)'s policy explains its withdrawal process and timing. ## Retention and deletion Redundant CDR data is information no longer needed for an authorised purpose and not required to be retained by law. [Fiskil](https://www.fiskil.com)'s policy provides for automatic deletion of redundant data. Clova deletes redundant CDR data rather than retaining it for research or training. We delete affected CDR data in response to: - withdrawal or expiry of the relevant consent; - your election to have redundant CDR data deleted; - information becoming redundant; and - a direction from [Fiskil](https://www.fiskil.com) to delete service data. We also comply with [Fiskil](https://www.fiskil.com)'s deletion directions and provide records of the deletion. The scope includes relevant source information, consumer-linked derivatives, temporary copies and applicable provider copies. Required deletion cannot be replaced with de-identification. De-identification requires that a person can no longer reasonably be identified. Removing a name or hashing an identifier is not enough. Clova does not create a research or general AI training dataset from CDR data when an account closes. Account recovery does not delay CDR deletion. Reactivation cannot restore banking information that must be deleted. A new connection and consent may be required. Necessary consent, complaint and deletion evidence may remain under applicable legal requirements. That does not justify retaining unnecessary financial content. Our deletion process also covers backups and prevents deleted information from being restored to ordinary use. You can contact us for the status of a deletion request, including any information retained for a legal obligation. ## Providers and security Our [service provider list](/legal/sub-processors) separates website services from app infrastructure and banking connections. Providers handling CDR information are subject to the applicable contractual, security and overseas handling requirements. The provider list explains their roles; [Fiskil](https://www.fiskil.com)'s policy sets out the relevant CDR arrangements. App product analytics excludes financial content and CDR access or viewing events. Required security and CDR audit records are kept separately. Marketing tracking, heatmaps and session recording are excluded from authenticated app surfaces. ## Access, correction and complaints Email [support@getclova.com](mailto:support@getclova.com) to request access, a copy, correction or deletion of your information, or to raise a complaint. Explain the request and how we can reply without including financial credentials. Identity checks may be needed to protect your information. You can contact [Fiskil](https://www.fiskil.com) directly through its [CDR Policy](https://www.fiskil.com/legal/cdr-policy). Complaints can be sent to [complaints@fiskil.com.au](mailto:complaints@fiskil.com.au). [Fiskil](https://www.fiskil.com)'s policy explains its response timeframes and external review options, including the [Australian Financial Complaints Authority](https://www.afca.org.au). No special form or wording is needed to raise a complaint with Clova. The [OAIC's CDR complaints guidance](https://www.oaic.gov.au/consumer-data-right/consumer-data-right-complaints) explains regulator complaint options. ## Further information The [CDR Rules](https://www.legislation.gov.au/F2020L00094/latest/text) govern the relevant consent, security and data-handling requirements. The [OAIC's CDR guidance](https://www.oaic.gov.au/consumer-data-right/consumer-data-right-guidance-for-business) explains privacy obligations. The applicable Rules and [Fiskil](https://www.fiskil.com) representative arrangement govern Clova's service. This page is updated when arrangements or handling practices change. You can request a copy or help understanding your choices through [Contact us](/contact).