ORAFOL AUSTRALIAPRIVACY AND CREDIT REPORTING POLICY
1.

2.

Introduction
1.1.

ORAFOL Australia Pty Ltd ABN 24 065 420 706 (and its related body corporates and associates) (collectively referred
to in this Privacy Policy as the “company”, “we”, “us”) is sensitive to the concerns that you, our customers, may havewith the confidentiality and handling of your personal, sensitive and/or credit-related information.

1.2.

We take your privacy very seriously.

1.3.

We are committed to complying with (as may be applicable) the Privacy Act 1988 (Cth) (as amended by the Privacy
Amendment (Enhancing Privacy Protection) Act 2012 (Cth)) (the ‘Privacy Act’), the Australian Privacy Principles
contained in Schedule 1 of the Privacy Act (the ‘Australian Privacy Principles’), the Privacy (Credit Reporting) Code2014 (Version 2.1) (Cth) (as may be amended from time to time) (the ‘CR Code’) and the European Union General
Data Protection Regulation (the ‘EU GDPR’).

1.4.

We ask that you take the time to read this document which sets out how we may collect, hold, use and/or disclose
your personal, sensitive and/or credit-related information (our ‘Privacy Policy’). A reference to an “individual” in thisPrivacy Policy is a reference to a person or an entity, as the case may be. A reference to “you” in this Privacy Policy
is a reference to you, our customer, and any guarantors, contractors, legal entities and/or persons that may deal with
us in relation to our provision of goods, services and/or credit to you.

1.5.

Whilst you are allowed to deal with us on an anonymous basis or by using a pseudonym, there may be circumstanceswhere you are required to identify yourself to us, for example, if we are required or authorised by or under an Australianlaw, or a court/tribunal order, to deal with you only if you have identified yourself or it is impracticable for us to deal
with you if you have not identified yourself or if you use a pseudonym.

What is the Purpose of this Privacy Policy?
The purpose of this Privacy Policy is to inform you about:

3.

2.1.

the kinds of personal, sensitive and/or credit-related information that we may collect about you;2.2.

how we manage personal, sensitive and/or credit-related information;

2.3.

how you can seek access to, and the correction of, personal, sensitive and/or credit-related information; and2.4.

how you can make a complaint relating to our handling of your personal, sensitive and/or credit-related information.

Your Consent to us
Important Notice: By providing your personal, sensitive and/or credit-related information to us, you are consenting (andgiving permission) to us in respect of all matters set out in this Privacy Policy, including, without limitation, as to how we may
choose to collect, store, use and/or disclose your personal, sensitive and/or credit-related information in accordance withthe terms of this Privacy Policy (or as otherwise permitted to us under the Privacy Act, CR Code and/or the EU GDPR). If
you do not wish to provide your consent to any of the matters set out in this Privacy Policy, please contact us immediately
to discuss your concerns and do not provide your personal, sensitive and/or credit-related information to us.

4.

What is Personal, Sensitive and Credit-Related Information?
4.1.

This Privacy Policy applies to personal, sensitive and/or credit-related information collected by us.

4.2.

Under this Privacy Policy:(a)“personal information” means information or an opinion about an identified individual, or an individual who isreasonably identifiable, whether the information or opinion is true or not and whether the information or opinion
is recorded in a material form or not (and includes ‘personal data’ as that term is defined under the EU GDPR);(b)“sensitive information” means personal information about an individual which is sensitive in nature which may
include, for example, information or an opinion about an individual’s political opinions, membership of a politicalassociation, religious beliefs or affiliations, philosophical beliefs, membership of a professional or tradeassociation, criminal record or health information; and(c)“credit-related information” means personal information (other than sensitive information) that relates to theindividual’s eligibility to apply for credit, or the individual’s application for credit with us or other credit providers,or the individual’s existing credit accounts held with us or other credit providers, or any other credit-related
matters. This information may include (and as otherwise permitted by the Privacy Act and/or the CR Code):(i)information that we obtain from a credit reporting body or credit report about you (or information which isderived from those sources) that has any bearing on your credit worthiness or eligibility to apply for credit;(ii)

your repayment history, default history, payment history and/or new arrangement history in respect of credit
with either us or other credit providers;
Page | 1

4.3.

5.

(iii)

the type of consumer and/or commercial credit, and the amount of credit, that you have applied for in yourcredit applications with either us or other credit providers; or(iv)

court proceedings, personal insolvency, and publicly available information, about you.

Any reference to personal information henceforth in this Privacy Policy refers to personal information (which includes
personal data under the EU GDPR), sensitive information and credit-related information.

What Personal Information do we Collect?
5.1.

5.2.

5.3.

We will generally only collect sensitive information from you if it is necessary in the circumstances and you haveconsented to the collection of that information by us. However, we may ask you for sensitive information or collectsensitive information from you or about you revealing racial or ethnic origin, political opinions, religious or philosophicalbeliefs, trade union membership or details of health, disability or sexual orientation or any other personal sensitive
information in the following circumstances (or as otherwise permitted under the Privacy Act):(a)the personal information is reasonably necessary for, or directly related to, one or more of the functions or
activities that we carry out;(b)

the collection of that personal information is specifically required or authorised by or under an Australian law or
a court/tribunal order;(c)

the collection is necessary to lessen a serious or imminent threat to your health or safety, or the health or safetyof another person;(d)a permitted general situation exists in relation to the collection of that personal information by us;(e)a permitted health situation exists in relation to the collection of that personal information by us; or(f)the collection of that personal information is necessary for the establishment, exercise, or defence, of a legal or
equitable claim by us.

The type of personal information that we may collect from you or about you will depend on the circumstances andthe nature of the goods, services and/or credit that you have applied for, or that is being provided to you, but generally,
the personal information that we may collect from you or about you may include (or as otherwise permitted by thePrivacy Act and the Australian Privacy Principles):(a)your contact details (such as your full legal name, entity details, age, gender, date of birth, residential andbusiness addresses, telephone number and email address);(b)

your trade, financial and/or billing information (such as your trade or occupation, assets, expenses, revenue,
income, credit accounts, bank accounts and other relevant information);(c)your buying habits and transactional history with us or third parties (such as the goods and/or services you may
have previously purchased and your payment history); or(d)other relevant information (which depends on the circumstances and may include personal information such as
your driver’s licence number, government identifiers information or other identifying information, if relevant to
identifying you).

The type of credit-related information that we may collect from you or about you in relation to your eligibility to apply
for credit, or your credit application with us or in relation to any other credit-related matter, may include (or as otherwise
permitted by the Privacy Act and the CR Code):(a)the type, and amount of credit, the name of the credit provider, and any information obtained from a credit
reporting body or other person to assess your credit application;(b)

the type, and amount of credit, that have been provided or will be provided to you by another credit provider orby us in relation to an existing credit account or another credit application;(c)the date that any credit contract entered with us or another credit provider commenced and the date that thecredit contract will come to an end;(d)payments that you owe to us or another credit provider, in connection with credit provided to you or in relation towhich you are a guarantor of another customer;(e)whether you have entered into new arrangements with us or other credit providers in connection with credit
provided to you under the original credit contracts;(f)administrative information relating to credit, such as account numbers and customer identifier numbers;(g)court and/or tribunal proceedings information, personal and/or corporate insolvency information (including
information about you that is entered or recorded on the National Personal Insolvency Index) and other credit
related publicly available information; andPage | 2

(h)

5.4.

6.

credit scores, ratings, summaries, evaluations, and other information, relating to your credit worthiness or
eligibility to apply for credit from a credit reporting body or which is derived by us or the credit reporting bodies
on the basis of this information.

There may also be certain laws, whether in Australia or from overseas, which may require us to collect other personal
information from you or about you from time to time. Where these apply, we will provide you with information about
our legal requirements when we collect that personal information from you or about you.

How do we Collect your Personal Information?
6.1.

There are a number of ways or sources from which we may collect personal, sensitive and/or credit-related informationfrom you or about you, which may include, without limitation:(a)purchase orders;(b)credit application forms;(c)letters, emails and/or other electronic writings;(d)our website (including cookies);(e)telephone conversations;(f)when you purchase anything from us via your credit card;(g)directly from you, or your co-credit applicants, agents and/or any guarantors;(h)our agents, contractors, partners, related bodies and/or associates;(i)other credit providers;(j)credit reporting bodies;(k)third parties;(l)information that is in the public domain; or(m) information that is derived from your (or a related body’s) usage, trade and transactional history on any accountheld with us or a related body.

7.

8.

6.2.

We will generally only collect personal information from someone other than yourself in the circumstances where it isunreasonable or impracticable for us to collect the personal information directly from you.

6.3.

We will only collect personal information by lawful and fair means (and as otherwise permitted by the Privacy Act, theAustralian Privacy Principles, the CR Code and/or the EU GDPR).

Our use of Cookies
7.1.

When you visit our website, we automatically collect certain non-personal data by various means, one of which is“cookies.” A cookie is an alphanumeric string of text (a unique identifier) that our web-server stores in your computer
by means of your web-browser. The cookie allows us to recognise your computer when you revisit our site. We canthen improve your use of the site; for example by providing quick log-in, displaying only products, and saving you fromretyping information in a standard form.

7.2.

Cookies also allow us to analyse aggregate traffic on the site, in order to streamline navigation and keep the content
accessible and valuable for all visitors. You can configure your browser to reject cookies but doing so may disable
some of our website’s features. Cookies do not contain personal data, nor can they read or transmit any data on yourcomputer’s hard drive. They can, nonetheless, be combined with personal data, that you knowingly provide, to createa profile. We do not use cookies in this manner without your express consent.

7.3.

All web-browsers however transmit the IP address of the computer on which they are running (so that the web-server
knows where to send the requested web page). We analyse IP addresses only in extraordinary circumstances toattempt to track hackers. We may also track your viewing habits to allow us to tailor your web surfing experience.

Our Use of Direct Marketing
8.1.

By providing your personal information to us, you are consenting (and giving permission) to us to collect personal
information from you or about you for direct marketing purposes (and to market directly to you, whether in relation to
our goods and/or services or someone else’s goods and/or services).

8.2.

We will only directly market to you, provided that:(a)you can opt-out, unsubscribe or be taken off the mailing list at any time;(b)

you have not previously asked us to be taken off the mailing list; andPage | 3

(c)
8.3.

9.

we display our contact details clearly in each direct marketing publication.

If you wish to be taken off any mailing list, you may choose to opt-out or unsubscribe from our direct marketing
services, or by following any instructions given by us, or in the alternative, by contacting our Customer Service
Department to submit your withdrawal request (noting that the contact details are contained at paragraph 15 below).

Why do we Collect Personal Information?
As a provider of goods, services and/or credit, we sometimes find it necessary to collect certain personal, sensitive and/or
credit-related information from you or about you. If you do not provide us with correct, relevant, up-to-date and complete
personal information, we may not be able to provide you with the goods, services and/or credit that you require.

10. The Purposes for which we Collect, Hold, Use, and /or Disclose your Personal Information
10.1. The purposes for which we may collect, hold, use and/or disclose your personal, sensitive and/or credit-related
information will be as reasonably necessary for our business functions and/or activities (or as otherwise permitted by
the Privacy Act, the Australian Privacy Principles, the CR Code and/or the EU GDPR) which may include, without
limitation, the following purposes depending on the circumstances:(a)communicate with you about our goods, services and/or credit products;(b)communicate with you about our new or improved goods, services and/or credit products;(c)communicate with you in order to build and maintain our business relationship with you;(d)

conduct, monitor and analyse our business and internal operations;(e)comply with an Australian law, a foreign law, court/tribunal order or any other regulatory, accounting, reportingor industry obligations;(f)establish, exercise or defend a legal or equitable claim;(g)process and respond to your requests, enquiries or complaints;(h)assess your, or a co-credit applicant’s, credit application;(i)assess your, or a co-credit applicant’s, credit worthiness;(j)assess the guarantors’ credit worthiness;(k)determine whether to provide you with credit or accept any person as a guarantor;(l)review existing credit accounts and credit terms;(m) provide goods, services and/or credit to you;(n)collect due and overdue payments and deal with credit defaults;(o)undertake debt recovery and enforcement activities, including in relation to guarantors;(p)participate in the credit reporting system and provide your personal information to credit reporting bodies incertain circumstances (as permitted or required by the Privacy Act and/or the CR Code);(q)

obtain your personal information from credit reporting bodies and other credit providers (as permitted under thePrivacy Act and/or the CR Code);(r)deal with serious credit infringements and assist other credit providers to do the same;(s)conduct marketing, sales and business development, whether alone or jointly with other agents, contractors,
partners, related bodies or associates; or(t)conduct directing marketing.

11. We May Disclose your Personal Information to Third Parties
11.1. We will generally only grant access to others to view your personal information where we believe it is necessary, andin your best interests, for those people to view your personal information. In general, only our employees and/or
subcontractors may view your personal information. We may however disclose your personal information to third
parties in relation to our business functions and/or activities (or as otherwise permitted by the Privacy Act, the CR
Code and/or the EU GDPR), which may include, without limitation, in the following circumstances:(a) the disclosure is required to give effect to the purposes for which we collected the personal information from youor about you;(b) we have your consent to that disclosure;
Page | 4

(c) we believe that the disclosure may lessen a risk of harm to your health or safety, or to the health or safety of
another person, or to public health or public safety;(d) we are required by law to disclose the personal information;(e) the disclosure is required for the enforcement of a criminal law or a law imposing a pecuniary penalty or for theprotection of public revenue;(f)to our agents, contractors, partners, related bodies and/or associates (for direct marketing or other lawful
purposes), provided that the personal information is required by us to be kept confidential by them and used only
for the purposes for which it is disclosed;(g) to your co-credit applicant, guarantor or another security provider, if any;(h) the agents that you may authorise to act on your behalf or that are otherwise connected with you (such as youraccountant or legal representative);(i)

law enforcement and/or government regulatory agencies;(j)entities providing services to us, including, without limitation, legal services, financial services, market researchand data providers;(k) entities who wish to be involved in our business, collaborate with us and/or acquire an interest in our business;(l)

suppliers and/or retailers of any goods and/or services financed with credit we provide;(m) financial institutions and/or entities such as banks and credit providers;(n) identification service providers;(o) insurers, assessors, underwriters, brokers and other distributors;(p) organisations involved in debt assignment or securitisation arrangements; or(q) debt collectors or other enforcement bodies.
11.2. We may also share your personal information with other members of the ORAFOL Group (which includes entities
carrying on a business under the name ORAFOL and derivatives of that name and/or other entities) which may haveoffices throughout the world including countries such as the United States of America, United Kingdom, Germany,
Canada, Ireland, Turkey, United Arab Emirates, South Africa, Japan, China, Taiwan or India. If we transfer yourpersonal information overseas, we will first obtain your written consent before doing so and we will take reasonable
steps to ensure that the overseas organisation complies with our Privacy Policy obligations to you.
12. We may Disclose your Personal Information to Credit Reporting Bodies
12.1. Credit reporting bodies are able, under the Privacy Act and applicable privacy regulations, to handle personal
information relating to your credit. If we provide your personal and/or credit-related information to any credit reporting
body, that credit reporting body may include your personal and/or credit-related information in reports to other credit
providers to assist such other credit providers to assess your credit worthiness or eligibility to apply for credit. The
personal and/or credit-related information that we provide to a credit reporting body or bodies may reflect adversely
on your credit worthiness and this may negatively impact on your ability to obtain credit from other credit providers.
12.2. In addition to any other personal and/or credit-related information that we may be permitted to disclose to a credit
reporting body under the Privacy Act and/or the CR Code, please be aware, for example, that if you fail to meet yourpayment obligations to us in relation to consumer credit or you commit a serious credit infringement, we may beentitled to disclose this to the credit reporting body. We may provide personal and/or credit-related information aboutyou (or any credit guarantor) to any or all of the credit reporting bodies set out below. We may in the future disclose
your personal and/or credit-related information to a credit reporting body not named below, however, before we doso, we will amend this Privacy Policy to contain the details of any such credit reporting body.
Equifax
https://www.equifax.com.au/contact
GPO Box 964
North Sydney NSW 2059
Tel: 138 332

Illionhttps://www.illion.com.au/
PO Box 7405
St Kilda Rd Melbourne VIC 3004
Tel: 1300 734 806

Creditor Watch
https://creditorwatch.com.au/
GPO Box 276
Sydney NSW 2001
Tel: 1300 501 312

Experian
https://www.experian.com.au/
GPO Box 1969
North Sydney NSW 2060
Tel: 1300 783 684

12.3. For details on how these credit reporting bodies manage your personal and/or credit-related information, you may
wish to review their respective privacy and credit reporting policies which are, or ought to be, available on theirrespective websites listed above.

Page | 5

12.4. You are also entitled to exercise the following rights under the Privacy Act:(a)

opt out of direct marketing pre-screenings, by you contacting the relevant credit reporting body and requestingthat you be excluded from direct marketing pre-screenings, if you do not want the credit reporting body to use
your credit information to assist credit providers to market their goods and/or services to you and others; and(b)request a ban (or non-disclosure) period, if you believe on reasonable grounds that you have been or are
likely to be the victim of fraud, in which case you may request from a credit reporting body or bodies that they
not use or disclose your personal and/or credit-related information for a period of time.

13. Our compliance with the European Union General Data Protection Regulation
13.1. We may have certain additional obligations to you under the EU GDPR in certain circumstances, including:(a)where we have an establishment in the European Union and process personal data, whether in the European
Union or elsewhere, in the context of the activities of that establishment;(b)where we do not have an establishment in the European Union, but nonetheless, we process the personal dataof residents of the European Union in relation to activities that relate to:(i)offering goods and/or services to the residents of the European Union; or(ii)monitoring the behaviour of the residents of the European Union (in so far as the behaviour takes place inthe European Union).

13.2. Accordingly, if you are a resident of the European Union, you may have the benefit of certain rights and protections
under the EU GDPR (which are in addition to your rights under this Privacy Policy) in relation to the processing of yourpersonal data by us in accordance with the terms, and for the purposes, set out in this Privacy Policy. For the
avoidance of any doubt, we are the ‘controller’ under the EU GDPR. You may enquire with us as to whether we havea ‘processor’ and/or ‘data protection officer’ appointed with us, from time to time, for the purposes of the EU GDPR.
We may collect, store, use and/or disclose your personal data in any way permitted under this Privacy Policy and thePrivacy Act, unless (and only to the extent) prohibited by any article of the EU GDPR.
13.3. The EU GDPR defines various important terms, including, without limitation, the following terms:(a)‘consent’ means any freely given, specific, informed, and unambiguous, indication of your wishes by which you,by a statement or by a clear affirmative action, signify agreement to the processing of the personal data relating
to you;(b)‘controller’ means the natural or legal person, public authority, agency, or other body, which, alone or jointly withothers, determines the purposes and means of the processing of personal data;(c)‘personal data’ means any information relating to an identified or identifiable natural person. An identifiable
natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier suchas a name, an identification number, location data, an online identifier or to one or more factors specific to thephysical, physiological, genetic, mental, economic, cultural, or social identity, of that natural person;(d)‘processor’ means a natural or legal person, public authority, agency or other body which processes personal
data on behalf of the controller; and(e)‘processing’ means any operation or set of operations which is performed on personal data or on sets ofpersonal data, whether or not by automated means, such as collection, recording, organisation, structuring,storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination orotherwise making available, alignment or combination, restriction, erasure, or destruction.

13.4. We will not collect personal data (revealing racial or ethnic origin, political opinions, religious or philosophical beliefs,
or trade union membership), genetic data, biometric data for the purpose of uniquely identifying a natural person, data
concerning health or data concerning a natural person’s sex life or sexual orientation, unless circumstances exist
requiring us to collect such data and it is otherwise permitted under the EU GDPR. We will also notify you, at the timeof collecting any personal data, about the period for which your personal data will be stored with us, or if that is notpossible, the criteria used to determine that period.
13.5. Lawfulness of processing. We may rely on the following grounds for the purpose of processing your personal data:(a)you have given us consent (as defined under the EU GDPR) to the processing of your personal data for one ormore specific purposes set out in this Privacy Policy;(b)

for the performance of a contract to which you are a party or in order to take steps at your request prior to entering
into a contract;(c)

for compliance with our legal obligations;(d)in order to protect your vital interests or such interests of others;(e)for the performance of a task carried out in the public interest or the exercise of official authority vested in us; orPage | 6

(f)for the purposes of the legitimate interests pursued by us or by a third party, except where such interests areoverridden by your interests or fundamental rights and freedoms.

13.6. Additional rights and protections. In addition to the rights and protections afforded to you under this Privacy Policy,
you may be entitled to various additional rights and protections under the EU GDPR, including, without limitation:(a)right to transparent information and communication (we will take appropriate measures to provide any
information and communications to you in relation to the processing of your personal data in a concise,transparent, intelligible, and easily accessible form, using clear and plain language);(b)right to certain information (you may be entitled to obtain information in relation to your personal data from us,irrespective of whether it was obtained from you or another person);(c)right of access to certain information (you may be entitled to access certain other information, including,
without limitation, the recipients, or categories of recipient, to whom your personal data has been or will be
disclosed by us, the source from which the personal data originated, and if applicable, whether it came frompublicly accessible sources (in circumstances where you did not provide the personal data), and whether theprovision of personal data is a statutory or contractual requirement);(d)right to rectification (we will rectify, without undue delay, any inaccurate personal data about you);(e)right to erasure (‘right to be forgotten’) (provided you have legal grounds under the EU GDPR to make therequest, we will erase, without undue delay, any personal data that we hold about you);(f)right to restriction of processing (you may be entitled to restrict us from processing your personal data incertain circumstances);(g)right to data portability (in certain circumstances, you may be entitled to receive personal data about you in a
structured, commonly used, and machine-readable format, and have personal data transmitted to anothercontroller without hindrance from us);(h)right to object (you may have certain legal grounds to object or withdraw your consent to the processing of yourpersonal data);(i)right to reject cookies (we will give you the right to opt-in for, or opt-out of, the use of cookies by us at the time
you access our website); and(j)right not to be subject to automated processing (in certain circumstances, especially where a decision based
solely on automated processing is used for profiling purposes).

13.7. Exercising your rights. Depending on the circumstances, you may be able to exercise your rights under the EU
GDPR by:(a)opting out of any email, mobile or other notifications;(b)following any instructions that you may have received from us;(c)clicking unsubscribe in any email or other notifications; or(d)contacting us (using the details set out at paragraph 15 of this Privacy Policy).

13.8. Exercising our rights. In certain circumstances, and despite you having withdrawn your consent, whether in full, orin part, to the processing of your personal data by us, we may nonetheless have a legal right or obligation under the
EU GDPR or otherwise to continue processing your personal data.
13.9. Confidentiality. We will maintain the confidentiality of your personal data. However, we may disclose your personal
data for the disclosure purposes set out in this Privacy Policy, but only in so far as it is permitted, and to the extent of
any limitations imposed by, the EU GDPR.
14. How do we Hold and Protect your Personal Information and Credit Card Details?
14.1. We may store your personal information in both hard and soft copy. Hard copy information is kept under lock and key.
Soft copy information is stored on computer and is generally password protected.
14.2. To safeguard your credit card details, we will not collect or store your credit card details. Sensitive cardholder data is
managed independently by either SecurePay Pty Ltd or Westpac Pty Ltd through the SecurePay or Westpac internet
payment gateway. All credit card transactions are SSL encrypted by the payment gateway provider with fraud
minimisation tools such as 3D Secure or FraudGuard for your added security.
15. Your Ability to Access and Correct your Personal Information
15.1. Under the Privacy Act, you have the right to request access to, and/or the correction of, any personal information that
we hold about you. You are entitled to specify how you wish to access your personal information, provided yourrequest is reasonable and practicable.

Page | 7

15.2. In order to access your personal information, please contact our Customer Service Department. We verify the identityof anyone requesting access to personal information, so as to ensure that we do not provide personal information toa person or people that do not have the right to access that personal information.
15.3. When making your request, please ensure that your request for access to personal information is as specific as
possible so that we may properly accommodate your request. We will use our best efforts to respond to your request
within 30 days after your request is made or such longer period as may be agreed between us.
15.4. If your request for access to personal information relates strictly to personal information (other than credit-related
information), then we may charge you a reasonable fee for providing access to your personal information. If yourrequest relates strictly to credit-related information, we will respond to your request at no cost, however we may charge
you a reasonable fee for providing access to your credit-related information.
15.5. We will respond to any requests for the correction of personal information within a reasonable time, but in any event
by no later than 30 days after the date that you make the request. We will not charge you for responding to yourrequest or for correcting the information. If we refuse to correct personal information about you, we will provide reasons
to you for such refusal.
15.6. If at any time you believe that any of your personal information that we hold is not accurate, relevant, complete and/or
is out-of-date, please let us know by contacting our Customer Service Department by either telephone on (07) 3823
6000, or by way of email at sales.au@orafol.com or please send your request to us by way of post to 8 Blanck Street,
Ormeau QLD 4208.
16. When we may Withhold Access to your Personal Information
16.1. We may withhold access to your personal information in a number of circumstances, including, without limitation (butonly in so far as it is permitted under, or to the extent of any limitations imposed by, the Privacy Act):(a)providing access would pose a serious and imminent threat to the life, health or safety of a person or publichealth or public safety;(b)

providing access would have an unreasonable impact on the privacy of other individuals;(c)the information is subject to confidentiality where the person who provided the information to us did so expresslyon the condition that it remains confidential;(d)the request is vexatious or frivolous;(e)

the information relates to existing or anticipated legal proceedings between us and you and the information would
not be accessible by the process of discovery in those proceedings;(f)

we are in commercial negotiations with you and the information would reveal our intentions in such a way as toprejudice those negotiations;(g)providing access would be unlawful or we are required by a law or a court/tribunal order to withhold access;(h)providing access could prejudice the investigation or detection by our organisation or by a government body ofan unlawful activity or some serious or improper misconduct;(i)

we have reason to suspect that unlawful activity, or misconduct of a serious nature, that relates to our functions
or activities, or otherwise, has been, is being or may be engaged in;(j)giving access would be likely to prejudice the taking of appropriate action in relation to a matter;(k)giving access would be likely to prejudice one or more enforcement related activities conducted by, or on behalfof, an enforcement body; or(l)giving access would reveal evaluative information generated by us in connection with a commercially sensitive
decision-making process.

16.2. Where we do withhold your personal information, we may instead choose to give you a summary of that personal
information. If we withhold access to your personal information, we will provide you with written reasons for withholding
the personal information and we will consider whether the provision of access to an independent third party will meetboth of our needs.
17. Complaints and Disputes
17.1. If you think we have breached the Privacy Act, the Australian Privacy Principles, the CR Code and/or the EU GDPR,
or you wish to make a complaint about the way we handled your personal information, you should contact ourCustomer Services Department by either telephone on (07) 3823 6000, or by way of email at sales.au@orafol.com orsend your complaint to us by way of post to 8 Blanck Street, Ormeau QLD 4208. Your complaint will be investigated
and the outcome of that investigation will be communicated to you within a reasonable time, but in any event by nolater than 30 days after the date that you make the complaint (or such longer period as may otherwise be agreed
between us). Where your complaint relates to credit-related information, we may consult with a credit reporting body,other credit providers or third parties, in order to properly investigate and attempt to resolve your complaint.

Page | 8

17.2. If you are not satisfied with the outcome of our internal complaints procedure, you may wish to refer your complaint to
the Office of the Australian Information Commissioner (website: www.oaic.gov.au) or the relevant European dataprotection authority, as the case may be.
18. Modification of this Privacy Policy
We may modify this Privacy Policy at any time in our sole discretion. We will make all modifications available on our websites.
You may access a copy of this Privacy Policy (as amended from time to time) at http://credit.orafol.com.au/ or request, by
contacting the Customer Services Department, that a hard copy of the Privacy Policy be provided to you.

Page | 9