Last Updated: May 2024

Xcend Pty Ltd ACN 662 440 959 (XCEND) provides a comprehensive range of services to listed and unlisted entities, and to public and private organisations. XCEND is committed to protecting your privacy and any personal information we collect. XCEND complies with the Privacy Act 1988 (Cth). This policy explains how we may collect, use, disclose and otherwise handle personal and sensitive information.

By accessing the XCEND website (www.xcend.co), or by using our services, you are agreeing to be bound by the terms of this policy.  We may amend this Privacy Policy occasionally to take account of changes to law or If we make changes to any of our practices.

XCEND is committed to safeguarding personal privacy. It recognises that individuals have a right to control how their personal information is collected and used. Providing personal information is an act of trust and it is taken seriously. Unless given consent to do otherwise, XCEND will only collect and use personal information as set out below.

For the purposes of this Privacy Policy and in our capacity as a securities registrar and employee equity plan administrator, personal information may mean some or all of the following: your name, contact details including email and phone, date of birth, gender, securityholding or plan participation details and balances, bank account and or credit card details, tax file numbers, employment details, investment transaction history, payment history, sensitive information and any additional personal information you provide to us, or authorise us to collect, as part of your interaction with XCEND.

We only collect personal Information when we need It to provide our services.  If you do not provide us with the Information we need, we may not be able to provide our services.

Prospective Employees/Applicants

We collect personal information when recruiting personnel, such as your contact details, name, qualifications and work history. Generally, we will collect this information directly from you.

We may also collect personal information from third parties in ways which you would expect (for example, from recruitment agencies or referees you have nominated). Before offering you a position, we may collect additional details such as your tax file number and superannuation information and other information necessary to conduct background checks to determine your suitability for certain positions.

We may also collect relevant information from third party sources such as [LinkedIn] and other professional websites.

Other Individuals

In our capacity of maintaining securities registers and administering employee equity schemes, XCEND may collect personal information about other individuals during interactions with our customer services representatives,  on paper or electronic documents provided to us (such as application forms, banking instructions, statutory declarations or tax file numbers) or through individual service providers and contractors to XCEND; and other individuals who interact with XCEND on a commercial basis. We may also receive Information from securities exchanges, stockbrokers or financial advisors, securities Issuers and our online Internet-based capabilities.

The kinds of personal information we collect will depend on the capacity in which you are dealing with XCEND. Generally, it would include name, contact details, and information regarding our interactions and transactions with you.

You can always decline to give XCEND any personal information we request, but that may mean we cannot provide you with some or all of the services you have requested. If you have any concerns about personal information we have requested, please let us know.

Collecting Personal Information

XCEND will not collect or monitor any personal information about an individual without their consent. The only personal information collected is what is provided voluntarily by a participant or prospective participant.

We collect personal information primarily to enable us to provide participants with our services. XCEND may also use the information for marketing to you or for any other purpose permitted under the Privacy Act 1988 (Cth).

When you have completed the sign up process online, personal information will be requested in order to provide the required information and follow up service regarding registration and participation, and advise of other XCEND products, which may be of interest. You are not obligated to provide personal information however failure to do so may result in XCEND being unable to provide services or products to you.

Collecting Sensitive Information

Sensitive information will only ever be used for providing services to participants. Such information will not be used or disclosed for any other purposes without consent, except in exceptional cases when disclosure may be required by law or is necessary to protect the rights or property of XCEND, any XCEND group company, or any member of the public, or to lessen a serious threat to a person’s health or safety. For the purposes of this Privacy Policy sensitive information is a subset of personal information.

Use of Tracking Technologies

XCEND uses tracking technologies such as cookies or web beacons to make use of the website and services as convenient as possible. Cookies are pieces of information that a web site transfers to a computer’s hard disk for record keeping purposes. Web Beacon is a technical method that sends information related to the access to websites, when you browse websites, open or preview an HTML-formatted email. Most web browsers are set to accept tracking technologies such as cookies or web beacons. These tracking technologies do not themselves personally identify users, although they do identify a user’s browser. These tracking technologies allow XCEND to monitor the XCEND web site, and to record how many people are using the different parts of the site. It is possible to set the browser to refuse tracking technologies such as cookies or web beacons, however, this may limit the services provided by XCEND’s web site.

Using and Disclosing Your Personal Information

Personal Information will be used for the following primary purposes:

• maintaining security registers, which Issuers of securities are obliged to maintain under the Corporations Act 2001 (Cth);

• providing services related to registry and employee equity plan administration, Including dividend and distribution payments and corporate communications;

• providing services relating to voting management;

• to fulfil obligations under a participant’s agreement and/or any other contract between him/her and XCEND;

• administering billing and payments and debt recovery;

• to fulfil our obligations under any reporting agreement entered into with any tax authority or revenue service(s) from time to time;

• to provide information about products, service and/or special offers to participants;

• to comply with any requirement of any applicable statute, regulation, rule and/or good practice, whether originating from Australia or elsewhere;

• recruitment processes;

• to obtain opinions or comments about products and/or services from participants; and

• to record statistical data for marketing analysis from participants.

We may also disclose personal Information to organisations with whom we have professional relationships Including the Issuer of the securities you hold, regulatory authorities (like the ATO), authorised security brokers or financial advisors and external service providers (like printers and mail houses).

XCEND may employ other companies or service providers to assist us in providing our services, including (but not limited to) printing and mail houses, marketing, market research, hosting and product development services, analysis of member lists and/ or consulting services. These third parties may have access to personal information that is needed to perform their specific function. They cannot use that information for other purposes.

XCEND recognise the trust with which individuals provide personal information, and such information will not be used or disclosed for any other purposes without consent, except in exceptional cases when disclosure may be required by law or is necessary to protect the rights or property of XCEND, any XCEND group company, or any member of the public, or to lessen a serious threat to a person’s health or safety.

Public Forums and Social Media

XCEND operates on social media platforms including but not limited to Facebook, Twitter and Instagram. It is worthwhile to remember that generally any content posted to, or disclosed in these sorts of environments becomes public information and care should be taken when deciding to disclose any personal or sensitive information in these sorts of environments. As these environments are public, XCEND cannot be held responsible for the privacy of any information you choose to disclose in these environments.

Contact by XCEND

XCEND does not send advertising information without obtaining prior consent. If an individual receives communications from XCEND which they do not wish to receive, they may remove their name from the database by contacting XCEND at support@xcend.co.

Individual’s Right of Access

Individuals have the right to review, amend or delete personal and/or sensitive Information that may be recorded on the XCEND database. Information may be reviewed, amended or deleted by completing the access request form provided by emailing support@xcend.co. Requests for information may be denied if XCEND cannot establish an individual’s right to access the requested data.

A request may be made to delete personal and/or sensitive information, and all reasonable steps to delete the information will be made, except where it is required for legal reasons. Deletion of information may result in XCEND being unable to sell products directly and/or provide certain services including after sales services.

Storage and Security of Personal and/or Sensitive Information

XCEND takes all reasonable steps to keep secure personal information recorded and to keep this information accurate and up to date. The personal information is stored on secure servers if in digital format, or in locked areas if in hardcopy format: these repositories are protected in controlled facilities. XCEND employees and data processors are obliged to respect the confidentiality of any personal and/or sensitive information held by Xcend. XCEND only permits authorised personnel to access your information and information will only be disclosed to third parties where they have the appropriate authority. We destroy or de-identify personal information we no longer need, wherever possible.

We also maintain computer and network security; for example, we use firewalls (security measures for the Internet) and other security systems such as user identifiers and passwords to control access to our computer systems.

How Long will Your Personal Information be Kept by XCEND

We will only keep the personal information we collect about you for as long as is necessary for the purposes set out in this Privacy Policy or as required to comply with any legal obligations to which we are subject. The retention periods we apply take account of:

• legal and regulatory requirements and guidance;

• limitation periods that apply in respect of taking legal action;

• our ability to defend ourselves against legal claims and complaints;

• good practice; and

• the operational requirements of our business.

We take steps to destroy or de-identify information that we no longer require or as required by an applicable law.

Does XCEND Disclose Your Personal Information for Direct Marketing?

XCEND may use or disclose your personal information for the purpose of informing you about our services, upcoming promotions and events, or other opportunities that may interest you or as otherwise permitted under applicable privacy laws.

This means under certain privacy laws we do not always need your consent to send you marketing communications such as our member newsletter. However, where consent is required under applicable privacy laws, we will ask for this consent separately and clearly. If you do not want to receive direct marketing communications, you can opt-out at any time by contacting us using the contact details below or using the opt-out functionality contained in the electronic message.

If you opt-out of receiving marketing material from us, XCEND may still contact you in relation to its ongoing relationship with you.

Disclosure to Contractors and Other Service Providers

XCEND may disclose information to third parties we engage in order to provide our services, including contractors and service providers used for data processing, data analysis, customer satisfaction surveys, information technology services and support, website and app maintenance/development, printing, archiving, mail-outs, and market research. Personal information may also be shared between related and affiliated companies of XCEND, located in Australia and overseas. Third parties to whom we have disclosed your personal information may contact you directly to let you know they have collected your personal information and to give you information about their privacy policies.

Does XCEND Disclose Your Personal Information Overseas?

Unless we are required to by law, we will not disclose personal Information to an overseas recipient.  However, if requested by one of our clients, a related party of ours wherever situated may use personal Information that we have collected in order to assist us In providing services to the client who made the request.

XCEND works with, service providers, sponsors and commercial interests across the globe. It is likely that your personal information will be disclosed to overseas recipients including service providers who may handle, process or store your personal information on our behalf.

It is likely that your personal information will be transferred outside of the jurisdiction it was collected. We only ever disclose your personal information outside the jurisdiction it was collected where we are permitted to do so under applicable privacy laws. Generally this means we will take reasonable steps to ensure your personal information is treated securely and in accordance with applicable privacy laws.

XCEND and Links to other Web Sites

XCEND may provide links to websites outside of the XCEND site or app. These linked sites are not under the control of XCEND, and XCEND is not responsible for the conduct of companies linked to the XCEND website or app, nor for the performance or otherwise of any content and/or software contained in such external websites. We recommend that you familiarise yourself with these external websites privacy policies before using them.

How Can You Access and Seek Correction of Your Personal Information?

You are entitled to access your personal information held by XCEND on request. To request access to your personal information please contact our Privacy Office by using the contact details set out below. We will take reasonable steps to ensure that the personal information we collect, use or disclose is accurate, complete and up-to-date. You can help us to do this by letting us know if you notice errors or discrepancies in information we hold about you and letting us know if your personal details change. However, if you consider any personal information we hold about you is inaccurate, out-of-date, incomplete, irrelevant or misleading you are entitled to request correction of the information.

Problems, Queries or Complaints

For further information regarding this Privacy Policy or to make a complaint about the steps taken by XCEND to protect your personal information or privacy, please contact XCEND’s Privacy Officer by emailing support@xcend.co. We will investigate any complaints received in writing and do our best to resolve them as soon as possible.

If you are not satisfied with the result of your complaint to us, you can refer your complaint to the:

Office of the Australian Information Commissioner

• Phone 1300 363 992

• Post GPO Box 5218, Sydney NSW 2001

• Online Form: www.oaic.gov.au (Privacy Complaint Form).

XCEND reserves the right to review, amend, update and change this Privacy Policy from time to time to reflect its practices and obligations. Any changes will take effect when they are made or posted on our website.