T&G Global Limited Privacy Statement – US

We will only collect personal information for a lawful purpose, in ways that are fair, reasonable, and not unreasonably intrusive, and only where the personal information is necessary for that purpose.

Personal information may be collected directly from you, automatically from your devices, or, where permitted by law, indirectly from third parties.

When you provide personal information to us, we will collect, use, store and disclose that information in accordance with this Privacy Statement.

You may choose not to provide personal information to us. However, if you do not provide information requested, we may not be able to:

• provide or continue to provide products or services to you;
• process your employment or contracting application; or
• provide access to some or all of our Digital Platforms.

If you do not want us to collect or use your personal information as outlined in this Privacy Statement, please contact our customer service team to discuss how we might assist.

Lawful basis for collecting and processing

Unless explicitly advised, you are not legally required to provide us with your personal information. However, certain information may be required so that we can deal with you effectively as a customer, supplier, contractor, applicant, or other stakeholder in an efficient and effective manner.

Where we collect personal information, we do so in accordance with the Privacy Act 2020 and only where:

• you have consented;
• the information is necessary for a contract with you;
• the collection is required or authorised by law; or
• the collection is necessary for a legitimate business purpose and does not unreasonably intrude on your privacy.

How and when we might collect personal information

We collect personal information in different ways, but most of this personal information we collect will be directly from you in circumstances where you voluntarily provide personal information to us such as on or around the time you contact us or purchase a product or service from us. For example, when you:

• open a vendor or customer account;
• apply for employment with us;
• visit any of our locations, or talk to us face to face;
• phone us or our customer service team (we may monitor or record your calls for quality control and/or staff training purposes and will let you know when we do, at the time of the call);
• write to us (for example, by letter, email, SMS, or by following or participating in our social media);
• request, receive or use our products or services, or products and services you receive through us;
• complete one of our forms (such as a customer registration, credit application, competition or survey form);
• use our Digital Platforms (for example, our websites or apps);
• subscribe to any update services we currently or may provide in the future; or
• participate in our promotions and competitions.

We may also collect personal information about how you use third-party websites containing our content. You can learn more about how we collect this information in Digital Platforms, Cookies and Analytics.

Where permitted by law, we may also receive your personal information from other parties who can legally share your personal information with us, such as referees, police for employment checks, and credit check agencies.

We may also obtain your personal information from public sources like newspapers, public registers (e.g., New Zealand Companies Register), websites and open sources of social media.

We may use camera surveillance at any number of our locations. Unless otherwise specified, audio recordings are not made as part of the footage. Covert use of camera surveillance systems may be considered only in circumstances where the law permits it.

Collection from third parties

In addition to collecting personal information directly from you, we may collect personal information about you from third parties where this is permitted by law, including:

• referees and recruitment agencies;
• credit reporting agencies;
• financial institutions;
• government agencies (such as for identity, work entitlement or compliance checks);
• law enforcement agencies where required for employment or security checks;
• related companies;
• service providers;
• publicly available sources, including public registers and online sources; and
• third parties you authorise to provide personal information to us.

Where we collect personal information from someone other than you, we will take reasonable steps to notify you at or before the time of collection, or as soon as reasonably practicable afterwards, to ensure you are aware of:

• the fact that the information has been collected;
• the source of the information;
• the purpose for which the information is collected;
• the intended recipients of the information; and
• your rights of access and correction.

Categories of Personal Information we collect

We may collect personal information including, but not limited to:

Categories of Personal Information We May Collect	Examples of Personal Information We May Collect
Identifiers	Name, alias, home and work addresses, home and work phone numbers, mobile phone number, social security number, driver’s license number, passport number, tax identification number, other government-issued identification numbers, place and date of birth, personal and work email address, username and password, social media name, signature, customer identification number.
Commercial and Financial information	Financial account number, credit card number, debit card number, account balance, trading activity, transactions, credit history, credit score, products purchased, services used, payment information.
Confidential communications	Recordings of conversations.
Protected classifications under California or federal law (“Protected Class Information”)	Age, sex, gender, national origin, citizenship, race, ethnicity, marital status, and disability status.
Internet or similar network activity	Browsing history, search history, clickstream data, session information, navigation paths, and other information about how you interact with our websites and mobile applications.
Geolocation data	Physical location or movements.
Professional or employment-related information	Employment information (including employer name), employment history, professional licenses or registrations, and employment identification number, salary or compensation, role, officer status.
Education information	Academic record, degrees, and schooling.
Inferences from other personal information	Preferences, behaviors, characteristics (including, for example, age, gender, race, and marital status), number of persons in household, and similar information.
Sensitive Personal Information (note this is a subset of Personal Information)	Social security, driver’s license, state identification card, or passport number account log-in, financial account, credit card number in combination with any required security or access code, password, or credentials allowing access to an account precise geolocation racial or ethnic origin, religious or philosophical beliefs, or union membership contents of a consumer’s mail, email, and text messages unless the business is the intended recipient of the communication.

De-Identified Data

We may de-identify personal information for our business purposes, including, but not limited to, improving the products and features of our services, maintaining the security and integrity of our systems, for analytics, and other legitimate business purposes. “De-Identified Data” means information that cannot reasonably be used to infer information about, or otherwise be linked to, a particular individual. De-Identified Data is no longer “personal information” under applicable data protection laws.

Where we process De-Identified Data, we commit to maintain and use the information in de-identified form and not attempt to re-identify the information, except where permitted by law. We may disclose De-Identified Data to third parties who commit to maintaining such data in de-identified form and not attempt to re-identify the data. To the extent any non-personal information is combined with personal information, T&G will treat the combined data as personal information as described in this Privacy Statement.

For what purpose is my personal information being collected?

Sensitive personal information is only used for permitted business purposes as detailed in the table under How and when we might collect personal information. To limit the use of your sensitive personal information, contact us at .

We may use your personal information:

• to enable us to provide the products and services you have requested;
• evaluate employment applications;
• to improve our website and services;
• to respond to communications from you, including enquiries and complaints;
• to conduct research, statistical analysis and service improvements; and
• for any other lawful purpose or otherwise as allowed by any applicable law.

We may be legally or otherwise required to contact you for service messages which we need to send you. If you wish to stop or change the channel in which we contact you, please contact us.

We do not sell personal information, including personal information of children under 16 years old, unless permitted by law or authorized. You have the right to opt-out of any sale or sharing of personal information using the links or contact details below.

Who might your personal information be disclosed to?

Depending on the product or service we provide to you, we may disclose your personal information to Third Parties located in New Zealand, Australia and overseas, including members of the T&G Global Group comprising T&G’s parent companies and subsidiaries (“T&G Group”), service providers, advisers and regulators, or as required by law.

Where personal information is disclosed overseas, we take steps to ensure that the overseas recipient is required to protect the personal information in a manner consistent with the requirements of Applicable Privacy Laws in US and California (as applicable), including through contractual protections or other permitted safeguards.

Third parties we may disclose your personal information to include:

• product and service providers so you can be provided with the product or service you seek or have expressed interest in;
• a person acting on your behalf, including an adviser or similar;
• auditor and regulators in the US, New Zealand and overseas as required by legislation and under non-disclosure agreements;
• engaging financial institutions to obtain funding;
• arranging insurance cover with our providers;
• for evaluating the financial and operational health of the company;
• credit reporting agencies as required to provide you with products and services;
• members of the T&G Global Group comprising T&G’s parent companies and subsidiaries (including those outside New Zealand); and
• if you have been referred to us, the person who made the referral,

(together, the “Third Parties“).

We will not share your personal information with Third Parties unless one of the following conditions or reasons apply:

• the disclosure is required to fulfil any of the purposes of collection set out in this Privacy Statement;
• for legal purposes: We may transfer your personal information to Third Parties and/or Government authorities as required or allowed to by applicable law or regulation;
• further disclosures: We reserve the right to disclose any personal information if we reasonably believe that such action is necessary to protect or defend the legal rights or property of T&G, our Sites or Apps and the users of them; or in an emergency to protect the health and safety of our Site’s or App’s users or the general public.

The table below details the sources of personal information, the categories collected, and the purposes for which that information is collected, processed, and disclosed.

Sources of Personal Information	Categories of Personal Information We May Collect	Purposes of Collecting and Disclosing Personal Information	Categories of Third Parties to Whom Personal Information Is Disclosed
Applications and Forms We may collect personal information from you or your authorized representatives during the customer or job application or account creation process, or through other forms.	Identifiers Financial information Protected Class Information Professional or employment-related information Commercial information Education information	Provide the Services Enhance the Services Review an application for employment Market, advertise, and promote the Services Protect against unauthorized access, security incidents, fraud, and other malicious or illegal activity Comply with legal and regulatory obligations, and to establish, enforce, and otherwise exercise our rights and defend against claims	Service Providers Representatives / Advisers Auditors / Regulators Financial Institutions Insurance Financial & Operational Evaluations Credit Reporting Agencies T&G Group Companies Referrals
Communications and Interactions with Us We may collect personal information from you or your authorized representative when you communicate with us, including, but not limited to, when you contact customer support, submit inquiries, request information from us, provide feedback, or participate in a promotion, survey or conference.	Identifiers Financial information Protected Class Information	Provide the Services Enhance the Services Market, advertise, and promote the Services Protect against unauthorized access, security incidents, fraud, and other malicious or illegal activity Comply with legal and regulatory obligations, and to establish, enforce, and otherwise exercise our rights and defend against claims	Service Providers Representatives / Advisers Auditors / Regulators T&G Group Companies Referrals
Transaction Activity We may collect personal information from you and from records we create about you when you make transactions with or through us.	Identifiers Financial information	Provide the Services Enhance the Services Market, advertise, and promote the Services Maintain system and process functionality Protect against unauthorized access, security incidents, fraud, and other malicious or illegal activity Comply with legal and regulatory obligations, and to establish, enforce, and otherwise exercise our rights and defend against claims	Service Providers Representatives / Advisers Auditors / Regulators Financial Institutions Financial & Operational Evaluations T&G Group Companies Referrals
Our Websites and Mobile Applications We may collect personal information from your Device when you visit or interact with our websites or mobile applications.	Identifiers Internet or similar network activity Geolocation data	Provide the Services Enhance the Services Maintain system and process functionality Market, advertise, and promote the Services Protect against unauthorized access, security incidents, fraud, and other malicious or illegal activity Comply with legal and regulatory obligations, and to establish, enforce, and otherwise exercise our rights and defend against claims	Service Providers Representatives / Advisers Auditors / Regulators T&G Group Companies
Social Media and Online Forums We may collect personal information from third-party social media platforms and sites, when you engage with our social media pages, online communities and forums, and when you mention us on your own or other social media pages, online communities or forums. Please note that online forums may be publicly accessible and other users may view information you post in the forums. We encourage you to exercise care in deciding what information and content you wish to disclose on the areas of the website that are accessible to the general public.	Identifiers Internet or similar network activity Professional or employment-related information	Provide the Services Enhance the Services Market, advertise, and promote the Services Comply with legal and regulatory obligations, and to establish, enforce, and otherwise exercise our rights and defend against claims	Service Providers Representatives / Advisers Auditors / Regulators T&G Group Companies
Our Physical Sites We may collect personal information both directly and indirectly from you when you visit our branches, offices, and other physical locations (“Sites”).	Identifiers	Protect against unauthorized access, security incidents, fraud, and other malicious or illegal activity Comply with legal and regulatory obligations, and to establish, enforce, and otherwise exercise our rights and defend against claims	Service Providers T&G Group Companies
Affiliates We may collect personal information from our affiliates, including, for purposes of this section, our T&G Global affiliates.	Identifiers Financial information Protected Class Information Commercial information Internet or similar network activity Geolocation data Professional or employment-related information Education information	Provide the Services Market, advertise, and promote the Services Maintain system and process functionality Protect against unauthorized access, security incidents, fraud, and other malicious or illegal activity Comply with legal and regulatory obligations, and to establish, enforce, and otherwise exercise our rights and defend against claims	Service Providers Representatives / Advisers Auditors / Regulators Financial Institutions Insurance Financial & Operational Evaluations Credit Reporting Agencies T&G Group Companies
Service Providers, Data Brokers, and Business Partners We may collect personal information from service providers and business partners.	Identifiers Financial information Commercial information Protected Class Information Biometric information Internet or similar network activity Geolocation data Sensory Data Professional or employment-related information Education information Inferences	Provide the Services Enhance the Services Market, advertise, and promote the Services Protect against unauthorized access, security incidents, fraud, and other malicious or illegal activity Comply with legal and regulatory obligations, and to establish, enforce, and otherwise exercise our rights and defend against claims	Service Providers Representatives / Advisers Auditors / Regulators Financial Institutions Insurance Financial & Operational Evaluations Credit Reporting Agencies T&G Group Companies
Government Entities We may collect personal information from government agencies and regulators.	Identifiers Financial information Protected Class Information Internet or similar network activity Geolocation data Professional or employment-related information Education information	Provide the Services Protect against unauthorized access, security incidents, fraud, and other malicious or illegal activity Comply with legal and regulatory obligations, and to establish, enforce, and otherwise exercise our rights and defend against claims	Service Providers Representatives / Advisers Auditors / Regulators Financial Institutions Insurance Financial & Operational Evaluations Credit Reporting Agencies T&G Group Companies
Consumer Reporting Agencies We may collect personal information from consumer reporting agencies.	Identifiers Financial information Protected Class Information Inferences	Provide the Services	Service Providers Representatives / Advisers Auditors / Regulators Financial Institutions Insurance Financial & Operational Evaluations Credit Reporting Agencies T&G Group Companies

We may utilise automatic data collection technology solutions such as browser cookies to collect information about how our systems are being used. For more information refer to the Digital Platforms, Cookies and Analytics section.

The below statements provide details of our use of AI tools:

• We may use artificial intelligence (“AI“) tools provided by third party vendors to assist with certain business functions, including the creation of marketing content such as copy, images and videos.
• We do not use your personal information to train any AI tools.
• All AI-generated marketing content is reviewed and approved before use.
• Where AI has been used for marketing purposes this will be clearly disclosed.

How do we secure your personal information?

We ensure there are reasonable security safeguards in place to prevent loss, misuse, unauthorised access, modification, disclosure, or other misuse of your personal information.

Personal information may only be accessed by T&G employees, contractors, professional advisors, authorised third parties, and other service providers on a need-to-know basis, for the purpose(s) for which the personal information has been collected and only in support of legitimate purposes.

We will use all reasonable endeavours when selecting and engaging third parties to whom we will disclose your personal information to ensure that they meet the privacy standards required by Applicable Privacy Law.

We also take reasonable precautions to protect your personal information, including regularly assessing and addressing risks of misuse, interference, loss and unauthorised access, and conducting regular reviews and audits of our security measures.

How long is personal information retained?

Personal information is retained only for as long as necessary to meet legal and regulatory requirements and business needs. Retention may be extended if we are required to preserve personal information in connection with litigation, investigations, and proceedings. The retention period is based on the:

• Purpose of collection
• Legal/regulatory requirements
• Dispute resolution timing
• Security and fraud prevention

If you believe we no longer have the right to retain your personal information, please contact us and we will assess your request.

How do I access my personal information?

You have the right to ask us whether we hold any personal information relating to you and request access to any of your personal information that we may hold.

We will make all reasonable attempts to provide the personal information in the format requested by you or, failing which, will offer it in a format that we feel should be acceptable. To make a request, please contact us.

How can I correct my personal information?

Before using or disclosing personal information, we will take all reasonable steps to ensure it is accurate, complete, relevant, up to date and not misleading.

If you believe we hold incorrect personal information, you can ask us to correct this by providing the details you believe are incorrect and any new information you would like recorded in its place. Please contact us if you would like to request a correction.

Affiliated Sites

Our Digital Platforms may contain links to other websites that are not controlled or maintained by T&G. We are not responsible for the privacy practices employed by these other websites.

In addition, our Digital Platforms may link to websites owned or operated by subsidiaries or companies affiliated with T&G (“Affiliated Sites”). Please note that the Affiliated Sites may also be subject to the terms of use and policies posted on those sites.

Social media features may be hosted by a third party or by us on our Digital Platforms. If you use the social media features, the privacy policies of the applicable social media providers will apply to that use. We are not responsible for the actions of any social media providers, or any loss incurred as a result of using the social media features.

Cookies

When you use our Digital Platforms, we may collect and use personal information about you through cookies and similar technologies. The collection of personal information may be facilitated by our Digital Platforms directly, through the use of cookies, or by using external third-party services including Google Analytics.

Below are examples of the personal information we may collect:

• your activity on our Digital Platforms, including pages visited and actions taken;
• information about your device, browser, app, operating system and IP address; and
• information gathered through cookies, digital tracking tools and location data.

Cookies and identifying information are an important way we interact with your internet browser. We use them to:

• give you better and more customised services;
• improve our website and advertise more effectively; and
• present more relevant information and advertising to you.

We may provide our analysis and certain non-personal information to potential partners, advertisers (who may use this information to provide advertisements or other information tailored to your interests) or other third parties, but we will not disclose any personal information, except as provided in this Privacy Statement.

You have the option of deciding whether or not to accept a cookie by resetting your browser to notify you whenever a cookie is being sent to your hard drive. You may also delete a cookie manually from your hard drive. Please note, however, that some parts of our Digital Platforms may not function properly or may be considerably slower if you refuse to accept a cookie or choose to disable your cookies settings.

What analytics is occurring?

We may use analytics to monitor performance and improve user experience on our Digital Platforms.

Analytics is about understanding how our Digital Platforms are used, including when, how and by which type of customer.

We may use this information for various reasons, for example, to:

• analyse collective user behaviour — from user statistics such as the number of page views, number of unique visitors, time spent on the platform, time of visits and types of devices used. We use this information for the purposes explained in our Privacy Statement;
• monitor how our Digital Platforms perform, identify issues and proactively improve your customer experience — application performance monitoring (APM) technology tells us how our platforms work on different browsers; and
• if you log on to secure areas, we can combine your identifying information with your other information (including personal information), for the purposes explained in our Privacy Statement.

We may also use third party software and services to measure the performance of our digital platforms and third party websites that may have T&G content.

We do not share your data for cross context behavioral advertising.

Do-Not-Track Signals

Many web browsers and some mobile operating systems include a “do-not-track” feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. No uniform technology standard for recognizing and implementing do-not-track signals has been finalized and, as such, we do not currently respond to do-not-track browser signals or any other mechanism that automatically communicates your choice not to be tracked online. We will update this Privacy Statement if that changes in the future.

Universal Opt-Out Mechanism

You may use an opt-out preference signal, such as the Global Privacy Control (GPC), to opt out of the sale or sharing of your personal information. If you use such a preference signal, we will process the signal as a request to opt out for the browser or device through which the signal is sent.

This section describes your rights under the U.S. state laws that may apply to you, including the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), and how to exercise those rights.

Description of your rights

If you are a California resident, you have additional rights:

• Right to Know: Request categories and specific pieces of personal information we have collected
• Right to Delete: Request deletion of your personal information
• Right to Opt-Out: Prevent sale or sharing of your personal information
• Right to Correct: Request correction of inaccurate personal information
• Right to Limit Use of Sensitive Information: Restrict use of sensitive personal information
• Non-Discrimination: You will not face adverse treatment for exercising your privacy rights
• Right to Appeal: If we decline to take action regarding your request to exercise any privacy right, you have the right to appeal the decision.

To exercise these rights, you may submit a request in the following ways:

Email us at

You may also use the Cookie Preferences link located in the footer of our website to manage your cookie preferences.

Verification of Identity

In order for us to process your request, we may first need to verify your identity. For example, if you make a request, we will ask you to confirm your name and email address. For certain requests, we will use a combination of your email address, name, and/or zip code to verify your identity. As permitted by California privacy law, any request you submit is subject to an identification and verification process, which may include attestation under penalty of perjury. We will respond to your request within 45 days of receiving it. If we need more time (up to an additional 45 days), we will notify you in writing.

Authorized Agents

You may designate an authorized agent to make privacy requests on your behalf. Authorized agents must provide us with valid written authorization confirming the agent’s authority to act on your behalf, including the agent’s name, email address, and phone number. You must also verify your own identity by following the instructions above. We reserve the right to verify the validity of any third-party request to exercise privacy rights on behalf of our customers to the fullest extent permitted under applicable data protection law.

Appealing a Denied Request

If we deny all or part of your privacy request, you may have a right to appeal that decision. If you would like to make an appeal, please contact us using the methods in the “How to contact the T&G Privacy Officer” section below, and include your name, email address, physical address, the type of request you made, and the reason for requesting an appeal.

If you have questions or comments about our Privacy Statement, or if you wish to review, amend or delete any personal information you have provided to us, or if you wish to modify the permission you have given us regarding use of your personal information, you can contact us via email at . Verification may be required for these requests, we will respond within 45 days of receiving your request.

Complaints

Please contact our Privacy Officer using the details above. We may ask you to put your complaint in writing and to provide relevant details.