Privacy Policy

We collect your personal information in several ways, including:

• through your use, or orders, of our products or services (and our records of these);

• when you visit the Site or submit information through the Site, contact us, or complete any forms or documents for our products or services;

• when you participate in our surveys, competitions, promotions, questionnaires or other promotional activities we may run from time to time;

• from third parties (which we discuss further below in this policy); and

• from publicly available sources of information.

The personal information we collect will track and enhance your use of the Site or our products or services, and assist us in providing a better service to you.

We will only collect personal information that is necessary for one or more of our functions or for a purpose outlined in this policy or otherwise disclosed to you.

By providing your personal information to us, you acknowledge that you are authorised to provide such information to us.

When we collect personal information directly from you, we will take reasonable steps to notify you (using a collection notice) at, before, or as soon as practicable after, the time of collection.

As a collection notice is specific to a particular collection of personal information, it will provide more specific information about our information-handling practices than this policy.

This policy is subject to any specific provisions contained in our collection notices and the terms and conditions of any offers, products and services. We therefore encourage you to read those provisions carefully.

When we collect your personal information from your authorised representative, we will take reasonable steps to make sure you are aware of the collection.

If you provide us with personal information about another individual (as their authorised representative), we rely on you to:

• inform them that you are providing their personal information to us; and

• advise them that they can contact us for further information.

You must take reasonable steps to ensure the individual is aware of, and consents to, the matters outlined in this policy, including that their personal information is being collected, the purposes for which that information is being collected, the intended recipients of that information, the individual’s right to access that information, and who we are and how to contact us.

Upon our request, you must also assist us with any requests by the individual to access or update the personal information you have collected from them and provided to us.

We only use and disclose your personal information for the purposes for which it is collected and any other purposes permitted by law.

In particular, we use your personal information to:

• provide you with our products or services, or the Site (including customer support and using AI/ML);

• improve, develop and manage our products, services and the Site (including using AI/ML);

• operate, maintain, test and upgrade our systems;

• notify you of important changes to our Site; and

• notify you of opportunities and promotions we think you might be interested in, including new product or service offerings.

We may also use your personal information:

• to communicate with you and provide information that we think may interest or benefit you, including information about our products or services, the Site, offers, competitions, promotions, events and surveys we may run from time to time;

• to charge and bill you for our products and services;

• to verify your identity;

• to conduct fraud, risk reduction and creditworthiness checks;

• to perform research and analysis about our products, services and the Site;

• to comply with regulatory or other legal requirements;

• for any purpose to which you have consented; or

• for any other purpose notified to you at the time of collection.

In the event of a merger, acquisition or sale of the whole or part of our business or assets, we reserve the right to transfer your personal information as part of the transaction, without your consent or notice to you.

We may provide your personal information to:

• our employees, related entities, business partners, contractors, suppliers and agents from time to time for the purpose of delivering, providing and administering our products, services or Site; and

• third party service providers for the purpose of performing functions on our behalf, but those service providers may not process or use such information for any other purpose. Examples of these third party service providers include service providers that assist us with billing, customer support, hosting and storage, data analytics, security, marketing and email services,

(collectively, Authorised Affiliates).

When we disclose your personal information to any of our Authorised Affiliates, we will use reasonable endeavours to ensure that they undertake to protect your privacy. These Authorised Affiliates are not permitted to use the information for any purpose other than the purpose for which they have been given access.

Our Authorised Affiliates may also provide us with personal information collected from you. If you disclose personal information to an Authorised Affiliate, we rely on you to provide the Authorised Affiliate with consent for us to collect, store, use and disclose your personal information.

We may also disclose any personal information we consider necessary to comply with any applicable law, regulation, legal process, governmental request or industry code or standard.

Our Authorised Affiliates may be located in or outside Australia, including in the United States of America and other countries from time to time.

Before we disclose your personal information overseas, we will take reasonable steps to ensure that our overseas Authorised Affiliate:

• treats your personal information securely; and

• complies with the relevant APPs.

By accessing or using our products, services or Site, or providing your personal information to us, you explicitly and freely consent to the transfer of your personal information to our overseas Authorised Affiliates.

If you do not wish to receive information from any of our Authorised Affiliates, please contact us.

We will not disclose your personal information to any third party (other than our Authorised Affiliates) without your written consent, unless:

• we are required or authorised by law;

• we are permitted to under this policy; or

• such disclosure is, in our opinion, reasonably necessary to protect our rights or property, avoid injury to any person or ensure the proper functioning of the Site.

This policy only covers the use and disclosure of information we collect from you. The use of your personal information by any third party is governed by their privacy policies and is not within our control.

We take reasonable steps in the circumstances to keep your personal information safe and secure. We use a combination of technical, administrative and physical controls to protect and maintain the security of your personal information.

Our officers, employees, agents and third-party contractors are expected to observe the confidentiality of your personal information.

Wherever possible, we procure that Authorised Affiliates who have access to your personal information take reasonable steps to:

• protect and maintain the security of your personal information; and

• comply with the relevant APPs when accessing and using your personal information.

The transmission of information via the internet is not completely secure. While we do our best to protect your personal information, we cannot guarantee the security of any personal information transmitted through the Site.

You provide your personal information to us at your own risk and, to the extent permitted by law, we are not responsible for any unauthorised access to, and disclosure of, your personal information.

Except as set out below, we will destroy or de-identify personal information where it is no longer required, unless we are required or authorised by law to retain the information.

We will retain your Order Information for our records, unless you request in writing that we delete this information.

We have a comprehensive data breach notification policy and response plan (Response Plan), which outlines the steps our personnel are required to take in the event of a data breach. This allows us to identify and deal with a data breach quickly to mitigate any harm that may result.

As part of the Response Plan, we will notify you as soon as practicable if we:

• discover or suspect that your personal information has been lost, accessed by, or disclosed to, any unauthorised person or in any unauthorised manner;

• believe that you are likely to suffer serious harm as a result; and

• are unable to prevent the likely risk of harm.

If you would like more information about our Response Plan, please contact us.