1. Introduction

SABR Group Pty Ltd (ABN 31 648 366 063) ("we", "us" or "our") is committed to protecting the privacy of your personal information. We handle personal information in accordance with the Privacy Act 1988 (Cth) (the Privacy Act) and the Australian Privacy Principles (APPs).

This Privacy Policy explains how we collect, hold, use and disclose personal information, how you can access and correct it, and how you can make a complaint. It applies to all personal information we handle in the course of our business, including through our website [sabrgroup.au], our services, and our dealings with clients, contractors, suppliers and other individuals.

2. What is personal information

Personal information is information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether true or not and whether recorded in a material form or not. This can include technical identifiers such as your IP address, device identifiers and online identifiers where they can reasonably identify you.

Sensitive information is a subset of personal information (for example, health information, or information about your race, religion, or criminal record) and is given a higher level of protection. We only collect sensitive information where it is reasonably necessary for our functions or activities and you have consented, or where the collection is otherwise permitted or required by law.

3. The kinds of personal information we collect and hold

Depending on your dealings with us, the personal information we collect may include:

• your name, job title and the organisation you represent;

• contact details, including email address, phone number and postal address;

• information you provide in enquiries, applications, contracts and correspondence;

• financial and billing information necessary to provide or pay for our services;

• information collected when you visit our website, including IP address, device and browser information, and website usage data collected via cookies and analytics tools;

• [for job applicants / personnel, if applicable] employment history, qualifications, references and other information relevant to recruitment; and

• any other information reasonably necessary for the purposes described in this policy.

You are not generally required to identify yourself, and you may deal with us anonymously or using a pseudonym, where it is lawful and practicable to do so. In most cases it will not be practicable for us to provide our services without collecting your personal information, and we will tell you where this is the case.

4. How we collect personal information

We collect personal information in a number of ways, including:

• directly from you — for example, when you contact us, submit an enquiry, enter into a contract, or use our services;

• through our website and online tools, including via cookies and analytics; and

• from third parties, such as your employer, referees, our contractors and suppliers, or publicly available sources — where it is reasonable and practicable to do so.

Where we collect your personal information from a third party, we take reasonable steps to ensure you are made aware of the matters set out in this policy.

If you do not provide the personal information we request, we may be unable to provide our services to you, respond to your enquiry, or otherwise deal with you effectively.

5. How we use and disclose personal information

We use and disclose personal information for the purposes for which it was collected, related purposes you would reasonably expect, and as otherwise permitted or required by law. These purposes include to:

• provide, maintain and improve our services and our website;

• communicate with you, including responding to enquiries and requests;

• manage our contracts, projects, billing and business relationships;

• manage recruitment and personnel matters [if applicable];

• meet our legal, regulatory and contractual obligations; and

• protect our legal rights and the safety of individuals.

We may disclose personal information to:

• our personnel, contractors and related entities, where reasonably necessary for the above purposes;

• third-party service providers who assist us to operate our business (for example, IT, cloud hosting, accounting, payment processing and professional advisers);

• government bodies, regulators and law enforcement, where permitted or required by law; and

• other parties where you have consented or the disclosure is otherwise permitted under the APPs.

We do not sell your personal information.

6. Direct marketing

We may use your personal information to send you information about our services that may be of interest to you. You can opt out of receiving direct marketing communications from us at any time by using the unsubscribe facility in the relevant communication, or by contacting us using the details in section 13. We will not use sensitive information for direct marketing without your consent.

7. Cookies and website analytics

Our website uses cookies and similar technologies to operate the site, analyse traffic and improve your experience. Some cookies are necessary for the website to function; others (such as analytics and tracking cookies) are only set where you have given consent. You can manage your preferences through the consent options provided on our website, and you can disable cookies through your browser settings, though some features of the website may not function properly as a result.

8. Disclosure of personal information overseas

Some of our third-party service providers (for example, cloud hosting and software providers) may store or process personal information overseas. The countries in which overseas recipients are likely to be located include the United States and Singapore.

Before disclosing personal information to an overseas recipient, we take reasonable steps to ensure the recipient does not breach the APPs in relation to that information, as required by APP 8. You acknowledge that, where you consent to an overseas disclosure or where an exception under APP 8 applies, we may not be accountable under the Privacy Act for how the overseas recipient handles your information in those circumstances.

9. Security, retention and destruction of personal information

We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. These steps include role-based access controls, multi-factor authentication, and hosting with reputable cloud service providers.

We retain personal information only for as long as it is reasonably necessary for the purposes for which it was collected, or as required by law [INSERT any specific retention periods that apply, e.g. financial records retained for 7 years under tax law]. When personal information is no longer needed and we are not required by law to retain it, we take reasonable steps to destroy it or de-identify it.

10. Data breaches

We have procedures in place to identify, contain, assess and respond to data breaches. Where a data breach is likely to result in serious harm to affected individuals and meets the threshold for an "eligible data breach", we will notify the affected individuals and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme under the Privacy Act.

11. Automated decision-making

We do not use automated decision-making technology to make, or to substantially and directly support, decisions that could reasonably be expected to significantly affect your rights or interests.

12. Access and correction

You have the right to request access to the personal information we hold about you and to request that we correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading. To make a request, please contact us using the details in section 13.

We will respond to your request within a reasonable period. We may need to verify your identity before processing your request. If we refuse access or correction, we will give you reasons in writing (except where it would be unreasonable to do so) and tell you how you can complain about our decision.

13. Contact us

For any questions about this Privacy Policy, to access or correct your information, or to make a privacy complaint, please contact us:

• Email: info@sabrgroup.au

• Post: Unit 3 / 6 Portside Crescent, Maryville NSW 2293

• Phone: 0489 082 066

14. Complaints

If you believe we have breached the APPs or the Privacy Act, please contact us using the details in section 13. Please set out the details of your complaint. We will acknowledge your complaint, investigate it, and respond to you within a reasonable period.

If you are not satisfied with our response, you can refer your complaint to the Office of the Australian Information Commissioner:

• Website: www.oaic.gov.au

• Phone: 1300 363 992

• Post: GPO Box 5288, Sydney NSW 2001

15. Changes to this Privacy Policy

We may update this Privacy Policy from time to time as our practices, technology or the law change. The current version will be published on our website and takes effect when posted. We encourage you to review it periodically. Material changes will be notified to you where appropriate.