Tarac Australia Limited ABN 23 007 583 904, Tarac Technologies Pty Ltd ABN 28 007 513 813, Tarac Barossa Pty Ltd ABN 88 007 874 160, Tarac Pty Ltd ABN 89 009 759 040, Tarac Properties Pty Ltd ABN 92 126 737 255, Tarac New Zealand Ltd NZCN 5479412 (‘we’, ‘our’, ‘us’, “Tarac Technologies”) are bound by the Australian Privacy Principles (APPs) contained in the Privacy Act 1988 (Cth) (Privacy Act). This Privacy Policy (Policy) sets out how we collect, use, hold, and share your personal information and how to contact us with any queries or concerns.

By voluntarily supplying us with your personal information you are agreeing to be bound by this Policy. While we may update our Policy from time to time, the most recent version of this Policy will always be available on our website. If we change the Policy in any material way we will post a notice on our website along with the updated Policy. We may also contact you via your contact information on file, for example by email, notification or some other equivalent measure.

If you reside outside of Australia, you may have rights under the European Union’s General Data Protection Regulations (EU Regulation 2016/679) (“GDPR”), the United Kingdom’s Data Protection Act 2018 (UK) (“UK GDPR”) and New Zealand’s Privacy Act 2020 (NZ) (collectively, ”Overseas Privacy Laws”). For the purposes of the GDPR and UK GDPR, Tarac is a Data Controller.

A reference to ‘personal information’ in this Policy is to be read as a reference to ‘personal data’ as defined by the GDPR and UK GDPR.

If you have any queries, concerns or complaints about how we handle your personal information, please contact our Privacy Officer in the first instance:

Privacy Officer

Robert Pelton

Email: rob.pelton@tarac.com.au

Postal Address

Attention: Privacy Officer

Tarac Technologies Pty Ltd

PO Box 78, Nuriootpa, South Australia 5355

Our website contains links to other websites. When a user clicks on a link to another site they are no longer subject to this Policy. These websites may use cookies. It is the responsibility of those third parties to collect appropriate consents from you in order to permit their own cookies (to the extent this is required by law) and to inform you about the cookies they use. You should check the Privacy Policy on all third-party websites to ensure you are comfortable with third party cookies. We have no responsibility for linked websites and provide them solely for your information and convenience. We specifically disclaim responsibility for their content, privacy practices and terms of use, and we make no endorsements, representations or warranties about their accuracy, content, or thoroughness. Your disclosure of Personal Information to third party websites is at your own risk.

1. What types of information do we collect and why?

In the course of providing our goods and services to you, we collect personal and other information about our customers and suppliers and how they interact with us, our goods, and our services. We collect personal information through a number of mechanisms, including:

1.1 Collection from you

We collect and store information you provide directly to us (either in person, by email, by phone, or by any other direct means) in order to deliver our goods and services. This includes:

• Contact information: such as your name, address, email address, telephone number;

• Personal information: such as date of birth and driver’s licence details:

• Financial and credit information: such as your payment information (credit card, bank account, etc);

• Business details: such as your Australian Business Number or if you reside in New Zealand, your Company Number; and/or

• Credit information: such as consumer credit liability information, type and amount of credit sought, default information, repayment history information, payment information relating to overdue payments.

You can choose not to provide your personal information, but it may mean that we are unable to provide you with our products and services.

1.2 Automatic

We use cookies (small text files stored on your devices that provide us with information such as your internet protocol (IP) address, server information, internet service provider, and information on how you interact with our website) and other services that allow us to understand how you use our online media. This information is not linked to you personally.

We use Mailchimp and Google-analytics which tracks and measures user interaction and provides data to help improve our products and services. Mailchimp tracks emails, name and location (i.e., country/ state/ suburb) and Google-analytics quantifies how many users have interacted with Tarac’s website and specifically the time, device type, IP address and time spent on Tarac’s website.

If you opt-out of third-party tracking technologies or elect to prevent the use of cookies, this may result in the loss of website functionality, restrict your use of the website or delay or affect the way in which the website operates.

1.3 Device

If you use our services or interact with us through a mobile device, we receive technical information about your device, numbers that identify the device and you location information. This information is associated with you.

1.4 Communications

When you communicate with us, we collect information such as your contact details (such as email address or phone number). We also engage third party services that provide us with information about how you interact with some communications we distribute. You can elect to not receive communications from us by contacting our Privacy Officer.

1.5 Digital platforms

If you access our goods or services by connecting a social media login (such as Facebook, Instagram, or Google) we collect information derived, associated or connected with that platform where permitted by the platform’s terms of service. Any information we collect from social media, or other online, platforms is collected in accordance with that platform’s terms and conditions.

1.6 Through other sources

Where necessary, we also collect your information from publicly available records. This can include information relating to an individual’s credit worthiness and other information from credit providers, subject to legal restrictions. Where appropriate and necessary to do so we use collect information from public records such as those maintained by the Australian Securities and Investments Commission, Australian Financial Security Authority (PPSR), and land titles offices in each state. We may do this where it is unreasonable or impractical to collect this information from you. If you reside in New Zealand, we may also collect information from New Zealand Financial Markets Authority, the New Zealand Personal Property Securities Register and Land Information New Zealand (LINZ).

If you have previously applied for a position with us we may have received your personal information from third parties such as recruiters or external websites. We use the information we receive to contact you about any potential opportunities or to evaluate your candidacy.

Third party service providers may be allowed to use technologies including mobile monitoring and tracking technologies in relation to the products and services which we provide to you. These third party service providers may collect information sent by your browser or mobile device.

1.7 Information you provide about someone else

If you provide Tarac with personal information about someone else, you must ensure that you are authorised to disclose that information to Tarac and that, without Tarac taking any further steps required by applicable privacy laws, Tarac may collect, store, use and disclose such information for the purposes described in this policy.

This means that you must take reasonable steps to ensure the individual concerned is aware of and/or consents to the various matters detailed in this policy, including the fact that their personal information is being collected, the purposes for which that information is being collected, the intended recipients of that information, the individual’s right to obtain access to that information, Tarac’s identity, and how to contact Tarac.

Where requested to do so by Tarac, you must also assist Tarac with any requests by the individual to access or update the personal information you have collected from them and provided to Tarac.

If you are someone who does not have a relationship with us but believe that one of our customers has entered your personal information into our servers, you will need to contact that customer for any questions you have about your personal information (including where you want to access, correct, amend, or request that we delete, your personal information). This is because information our customers enter into our servers is generally only held by us for and on behalf of that particular customer.

1.8 Sensitive Information

We collect information considered to be sensitive information in the Privacy Act. We collect information pertaining to the following:

• Membership of a professional or trade association to support employee development & recognition of credentials;

• Criminal records for financial/ sensitive roles via police checks to mitigate opportunities for financial/ company fraud;

• Health information by way of pre-employment criteria to measure ability to work in heavy industrial environments; and

• Biometric information for digital sign ins and time of attendance system.

We will only collect this information directly from you or where we have consent to collect the information from a third party.

You have the option of not identifying yourself or interacting with us using a pseudonym. However, this may not be practicable when engaging our services or purchasing our goods.

2. How do we use your information?

We will only use your information for the purposes for which it was collected (primary purpose) or a purpose related to that primary purpose if it would be reasonably expected by you or where we have separately obtained your consent.

We use personal information for the primary purpose of providing our products and services to you.

How we use the information we collect depends, in part, on which services you use, how you use them and any preferences you have communicated to us. If you would like to restrict how your personal information is handled beyond what is outlined in this Policy, please contact our Privacy Officer.

2.1 Related party Transfers

We may transfer your personal information to related parties in order to provide our services to you. This transfer of information is compliant with s 13B of the Privacy Act. Transfers are subject to the security information obtained in paragraph 3 below.

2.2 Disclosure of personal information to third parties

We may disclose your information to third parties who assist us in providing, managing and administering our goods and services. We will also disclose your personal information where such disclosure is required by law. We disclose your personal information to third parties that:

• Deliver products;

• Manage and enhance our customer database;

• Process information;

• Assess your interest in our products or services;

• Conduct customer research or satisfaction surveys;

• Send marketing information to you on our behalf;

• Other organisations listed as trade references in a credit application; and

• Other purposes related to the above.

We will not sell or license your information to third parties or otherwise disclose your personal information unless we believe on reasonable grounds that you have provided your authorisation. In certain circumstances we may be required to disclose your personal information without your consent in order to comply with any court orders, subpoenas or other legal process or investigation including by tax authorities, if such disclosure is required by law. Where possible and appropriate, we will notify you if we are required by law to disclose your personal information.

3. How do we store and secure the information we collect?

We store your personal and credit information in physical files and on our electronic data base system and on computers with appropriate back up and security systems.

3.1 Security and management of personal information

We will take reasonable steps to protect the personal information we hold from misuse, loss, and unauthorised and accidental access, modification, disclosure, destruction, or other action which prevents or otherwise hinders our access to your personal information on a temporary or permanent basis. We do this by:

• Putting in place physical, electronic and procedural safeguards in line with industry standards;

• Requiring any third party providers to have acceptable security measures to keep personal information secure;

• Limiting access to the information we collect about you;

• Imposing confidentiality requirements on our employees; and

• Only providing access to personal information once proper identification has been given.

While we take all steps reasonable in the circumstances to protect your information, in the unlikely event a data breach occurs, in the unlikely event of a data breach we will notify you in accordance with our obligations under the Privacy Act and Overseas Privacy Laws.

Where there is a risk of serious harm arising from the breach, we will notify you and any relevant authorities.

We will only keep your personal information for as long as we require it for the purpose for which it was collected. However, we may also be required to keep some of your personal information for specified periods of time, for example under certain laws relating to companies, money laundering and financial reporting legislation. If we no longer require your personal information, and are not legally required to retain it, we will take reasonable steps to destroy or de-identify the personal information.

3.2 Sending information overseas

Personal information is sent overseas, outside of Australia and New Zealand in limited circumstances. We send personal information to external service providers that assist our organisation such as with internal operations (including training, website hosting or cloud storage), market research and the distribution of newsletters, standards and other publications.

We take all steps reasonable in the circumstances to ensure that those we disclose personal information to overseas protect your information. This includes the use of contractual arrangements to control how third parties use and handle personal information overseas.

We do not utilise data centres located in countries overseas to store personal data. However, we use platforms such as Mailchimp (marketing platform) and google analytics on our website; it is likely these servers are based overseas. When we disclose your Personal Information to overseas recipients, we ensure that the recipients of your Personal Information are required to protect it in a way that overall provides comparable safeguards to those in Australia and New Zealand.

3.3 Export of personal information out of the EU and UK

We process all personal information in Australia. If you are based in a jurisdiction outside of Australia, we are required to import your personal information into Australia. To provide you with our services, we may also be required to export personal information from Australia into other countries.

When importing and exporting personal information, we take steps as are reasonable in the circumstances to ensure that the transfer of Personal Information is undertaken in a secure manner. As part of this process, we may enter into binding contractual arrangements with third parties to ensure the protection of personal information.

4. How to access and control your information?

4.1 Accessing the information we hold about you

Under the APPs and Overseas Privacy Laws you may be able to obtain a copy of the personal information that we hold about you. To make a request to access this information please contact us in writing. We will require you to verify your identity and specify what information you wish to access. If eligible, we will grant you access to the information within 30 days.

We may charge a fee to cover the costs of verifying your application, and retrieving, reviewing and copying any material requested.

4.2 Updating your personal information

We endeavour to ensure that the personal information we hold about you is accurate, complete and up-to-date. Please contact us at the details above if you believe that the information we hold about you requires correction or is out of date. We endeavour to process any request within 30 days and will provide written reasons if your request is rejected, as well as providing details for making a complaint about the refusal if necessary.

For corrections to credit information we will provide, where practicable, written notice of the correction to any entity we have disclosed this information to previously.

5. Complaints

If you are concerned that we have not complied with your legal rights or the applicable privacy laws, contact our Privacy Officer in the first instance. Please contact our Privacy Officer (contact details above) with a thorough description of your concerns and a response will be provided within a reasonable period. All complaints must be in writing.

When processing a compliant, we will require you to provide us with information to confirm your identity before processing a request related to information we may hold about you.

We expect our procedures will deal fairly and promptly with your complaint. However, if you remain dissatisfied, you can also contact the Office of the Australian Information Commissioner (OAIC) as follows:

Director of Compliance Office of the Australian Information Commissioner

GPO Box 5218 Sydney NSW 2001

For more information on privacy visit the Office of the Australian Information Commissioner’s (OAIC) website or the Office of the New Zealand Privacy Commissioner’s (ONZPC) website.

If you reside in New Zealand, you can make a formal complaint to the ONZPC online here.