T&G Global Limited Privacy Statement – New Zealand & Australia

We will only collect personal information for a lawful purpose, in ways that are fair, reasonable, and not unreasonably intrusive, and only where the personal information is necessary for that purpose. Personal information may be collected directly from you or, where permitted by law, indirectly from third parties.

When you provide personal information to us, we will collect, use, store and disclose that information in accordance with this Privacy Statement, the New Zealand Privacy Act 2020 and Australian Privacy Act 1988 (Cth) (as well as any applicable regulations and codes of practice), each as applicable (“Applicable Privacy Law“).

You may choose not to provide personal information to us. However, if you do not provide the personal information requested, we may not be able to:

• provide or continue to provide products or services to you;
• process your employment or contracting application; or
• provide access to some or all of our Digital Platforms.

If you do not want us to collect or use your personal information as outlined in this Privacy Statement, please contact our customer service team to discuss how we might assist.

Lawful basis for collecting and processing

Unless explicitly advised, you are not legally required to provide us with your personal information. However, certain personal information may be required so that we can deal with you effectively as a customer, supplier, contractor, applicant, or other stakeholder in an efficient and effective manner.

Where we collect personal information, we do so in accordance with Applicable Privacy Law and only do so where the collection is necessary for a lawful and legitimate business purpose in accordance with this Privacy Statement.

How and when we might collect personal information

We collect personal information in different ways, but most of this personal information we collect will be directly from you in circumstances where you voluntarily provide personal information to us such as on or around the time you contact us or purchase a product or service from us. This may include when you:

• open a vendor or customer account;
• apply for employment with us;
• visit any of our locations, or talk to us face to face;
• phone us or our customer service team (we may monitor or record your calls for quality control and/or staff training purposes and will let you know when we do, at the time of the call).
• write to us (for example, by letter, email, SMS, or by following or participating in our social media);
• request, receive or use our products or services, or products and services you receive through us;
• complete one of our forms (such as a customer registration, credit application, competition or survey form);
• use our Digital Platforms (for example, our websites or apps);
• subscribe to any update services we currently or may provide in the future; or
• participate in our promotions and competitions.

We may also collect personal information about how you use third-party websites containing our content. You can learn more about how we collect this personal information in Digital Platforms, Cookies and Analytics.

We may also obtain your personal information from public sources.

We may use camera surveillance at any number of our locations. Unless otherwise specified, audio recordings are not made as part of the footage. Covert use of camera surveillance systems may be considered only in circumstances where the law permits it.

Collection from third parties

In addition to collecting personal information directly from you, we may collect personal information about you from third parties where this is permitted by law, including:

• credit reporting agencies;
• financial institutions;
• government agencies (such as for identity, work entitlement or compliance checks);
• law enforcement agencies where required for security checks;
• related companies;
• service providers;
• publicly available sources, including public registers and online sources; and
• third parties you authorise to provide personal information to us.

Where we collect personal information from someone other than you, we will take reasonable steps to ensure that, either before or as soon as reasonably practicable after collection, you are made aware of the matters required under Applicable Privacy Law unless an exception applies.

What personal information might we collect?

The personal information we collect will depend on the nature of your interaction with us. Not all personal information will be collected in every case, but the types of personal information we collect may include:

• your name;
• address;
• date of birth;
• email address;
• telephone number;
• IRD number;
• your image (only via CCTV where operating);
• credit history or other financial details;
• services used; and
• records of conversations.

We may also utilise automatic data collection technology solutions such as browser cookies to collect information about how our systems are being used. For more information about this, please refer to the Digital Platforms, Cookies and Analytics section below.

For what purpose is my personal information being collected?

We may use your personal information:

• to enable us to provide the products and services you have requested;
• to evaluate employment applications;
• to improve our website and services;
• to respond to communications from you, including enquiries and complaints;
• to conduct research, statistical analysis and service improvements; and
• as otherwise permitted or required by applicable law.

We may contact you for service messages. If you wish to stop or change the channel in which we contact you, please contact us.

Who might your personal information be disclosed to?

Depending on the product or service we provide to you, we may disclose your personal information to Third Parties located in New Zealand, Australia and overseas, including members of the T&G Global Group comprising T&G’s parent companies and subsidiaries (“T&G Group“), service providers, advisers and regulators, or as required by law.

Where personal information is disclosed overseas, we take steps to ensure that the overseas recipient is required to protect the personal information in a manner consistent with the requirements of Applicable Privacy Law in New Zealand or Australia (as applicable), including through contractual protections or other permitted safeguards.

Where we disclose personal information to overseas recipients, those recipients are likely to be located in countries where T&G Group entities or service providers operate. If it is not practicable to specify the countries in a particular case, we will take reasonable steps to ensure the overseas recipient handles personal information in accordance with applicable privacy laws.

Third Parties we may disclose your personal information to include:

• product and service providers, advisers or persons acting on your behalf;
• auditors, regulators and government agencies in New Zealand and overseas;
• financial institutions and insurance providers;
• credit reporting agencies as required to provide you with products and services;
• members of the T&G Global Group (including those outside New Zealand); and
• if you have been referred to us, the person who made the referral, (together, the “Third Parties“).

We will not share your personal information with Third Parties unless one of the following conditions or reasons apply:

• the disclosure is required to fulfil any of the purposes of collection set out in this Privacy Statement;
• for legal purposes: We may transfer your personal information to Third Parties and/or Government authorities as required or allowed to by applicable law or regulation; or
• further disclosures: We reserve the right to disclose any personal information if we reasonably believe that such action is necessary to protect or defend the legal rights or property of T&G, our Sites or Apps and the users of them; or in an emergency to protect the health and safety of our Site’s or App’s users or the general public.

The below statements provide details of our use of AI tools:

• We may use artificial intelligence (“AI“) tools provided by third party vendors to assist with certain business functions, including the creation of marketing content such as copy, images and videos.
• We do not use your personal information to train any AI tools.
• All AI-generated marketing content is reviewed and approved before use.
• Where AI has been used for marketing purposes this will be clearly disclosed.

How do we secure your personal information?

We ensure there are reasonable security safeguards in place to prevent loss, misuse, unauthorised access, modification, disclosure, or other misuse of your personal information.

Personal information may only be accessed by T&G employees, contractors, professional advisors, authorised third parties, and other service providers on a need-to-know basis, for the purpose(s) for which the personal information has been collected and only in support of legitimate purposes.

We will use all reasonable endeavours when selecting and engaging third parties to whom we will disclose your personal information to ensure that they meet the privacy standards required by Applicable Privacy Law.

We also take reasonable precautions to protect your personal information, including regularly assessing and addressing risks of misuse, interference, loss and unauthorised access, and conducting regular reviews and audits of our security measures.

How long is personal information retained?

We retain personal information for as long as necessary to fulfil the purposes for which it was collected, including legal, regulatory, tax, and accounting obligations. Retention periods vary depending on the data type and are reviewed regularly.

If you believe we no longer have the right to retain your personal information, please contact us and we will assess your request.

How do I access my personal information?

You have the right to:

• request confirmation of whether we hold personal information about you;
• request access to that information; and
• request correction of any personal information that you believe is inaccurate, out of date, incomplete or misleading;
• request deletion of your personal information.

These rights apply regardless of whether the information was collected directly from you or from a third party.

We will respond to requests for access to personal information as soon as reasonably practicable. We will make all reasonable attempts to provide the personal information in the format requested by you or failing which will offer it in a format that we feel should be acceptable. To make a request please contact us.

How can I correct my personal information?

If you believe we hold incorrect personal information about you, you can ask us to correct this by providing the details you believe are incorrect and any new information you would like recorded in its place. Please contact us if you would like to request a correction.

Affiliated Sites

Our Digital Platforms may contain links to other websites that are not controlled or maintained by T&G. We are not responsible for the privacy practices employed by these other websites.

In addition, our Digital Platforms may link to websites owned or operated by subsidiaries or companies affiliated with T&G (“Affiliated Sites”). Please note that the Affiliated Sites may also be subject to the terms of use and policies posted on those sites.

Social media features may be hosted by a third party or by us on our Digital Platforms. If you use the social media features, the privacy policies of the applicable social media providers will apply to that use. We are not responsible for the actions of any social media providers, or any loss incurred as a result of using the social media features.

Cookies

When you use our Digital Platforms, we may collect and use personal information about you through cookies and similar technologies. The collection of personal information may be facilitated by our Digital Platforms directly, through the use of cookies, or by using external third-party services including Google Analytics.

Below are examples of the personal information we may collect:

• your activity on our Digital Platforms, including pages visited and actions taken;
• information about your device, browser, app, operating system and IP address; and
• information gathered through cookies, digital tracking tools and location data.

Cookies and identifying information are an important way we interact with your internet browser. We use them to:

• give you better and more customised services;
• improve our website and advertise more effectively; and
• present more relevant information and advertising to you.

We may provide our analysis and certain non-personal information to potential partners, advertisers (who may use this information to provide advertisements or other information tailored to your interests) or other third parties, but we will not disclose any personal information, except as provided in this Privacy Statement.

You have the option of deciding whether or not to accept a cookie by resetting your browser to notify you whenever a cookie is being sent to your hard drive. You may also delete a cookie manually from your hard drive. Please note, however, that some parts of our Digital Platforms may not function properly or may be considerably slower if you refuse to accept a cookie or choose to disable your cookies settings.

What analytics is occurring?

We may use analytics to monitor performance and improve user experience on our Digital Platforms.

Analytics is about understanding how our Digital Platforms are used, including when, how and by which type of customer. We may use third party software and services to measure the performance of our platforms and third party websites that have T&G content.

We may use this information for various reasons, for example, to:

• analyse collective user behaviour — from user statistics such as the number of page views, number of unique visitors, time spent on the platform, time of visits and types of devices used. We use this information for the purposes explained in our Privacy Statement;
• monitor how our Digital Platforms perform, identify issues and proactively improve your customer experience — application performance monitoring (APM) technology tells us how our platforms work on different browsers; and
• if you log on to secure areas, we can combine your identifying information with your other information (including personal information), for the purposes explained in our Privacy Statement.

We may also use third party software and services to measure the performance of our digital platforms and third party websites that may have T&G content.

If you have questions or comments about this Privacy Statement, or if you wish to make a complaint or exercise your rights under the New Zealand Privacy Act 2020 or the Australian Privacy Act 1988 (Cth) (including access or correction), please contact the T&G Privacy Officer using the details below.

T&G Privacy Officer

Email:

Address: PO Box 56, Shortland Street, Auckland 1140, New Zealand

Complaints

Please contact our Privacy Officer using the details above. We may ask you to put your complaint in writing and to provide relevant details. We will respond to your complaint in a reasonable period of time, usually within 30 days. You also have the right to complain to the Office of the Privacy Commissioner at https://www.privacy.org.nz or by telephone on 0800 803 909, or, if you are located in Australia, with the OIAC at https://www.oaic.gov.au or by telephone on 1300 363 992.