• Your rights in relation to privacy

Mills & York Pty Ltd ACN 640 406 131 (Mills & York) understands the importance of protecting the privacy of an individual’s personal information. This policy sets out how Mills & York aims to protect the privacy of your personal information, your rights in relation to your personal information managed by Mills & York and the way Mills & York collects, holds, uses and discloses your personal information.

In handling your personal information, Mills & York complies with the Privacy Act 1988 (Cth) (Privacy Act), the 13 Australian Privacy Principles in the Privacy Act and all relevant Australian privacy laws.

This policy may be updated from time to time.

• What kinds of personal information does Mills & York collect?

Personal information is information or an opinion about an identified, or reasonably identifiable, individual. During the provision of its products and/or services, Mills &amps; York may collect your personal information.

In some circumstances Mills & York may also hold other personal information provided by you.

• How does Mills & York collect personal information?

Generally, Mills & York collects your personal information directly from you, through the completion of an online form, an interaction or exchange in person or by way of telephone, facsimile, email, post or through the use of the Mills & York website.

There may be occasions when Mills & York collects your personal information from other sources such as from:

• an entity you represent (including but not limited to your employer or a company of which you are a director), where necessary for Mills & York to provide its products or services to that entity through you or where necessary for that entity to supply products or services to Mills & York;
• organisations that facilitate payment or identity verification services in connection with your use of our platform;
• an information services provider
• a publicly maintained record or other publicly available sources of information including social media and similar websites, such as Facebook;
• if for recruitment purposes, an external recruitment, labour hire, or background screening services provider or third parties with whom you have previously worked;
• a government agency.

Generally, Mills & York will only collect your personal information from sources other than you if it is unreasonable or impracticable to collect your personal information from you.

• Why does Mills & York need your personal information?

Mills & York collects, holds, uses and discloses your personal information where it is reasonably necessary for the purposes of:

• providing the services you have requested, ordered or purchased from Mills & York including:
• to enable access to our online platform, and provide associated services;
• to process transactions you may enter with members via our online platform;
• for invoicing purposes;
• to respond to any inquiries, feedback or complaints made by you;
• providing Mills & York's services to you or the organisation you represent and all associated purposes;
• enabling Mills & York to promote its products and services to you;
• assisting Mills & York to improve its products and services;
• processing and assessing employment applications for current and future positions;
• accounting, billing and other internal administrative purposes;
• understanding a supplier's capacity to service Mills & York's needs;
• emailing newsletter registration;
• otherwise managing Mills & York's internal business operations and processes; and any other legal requirements.

Mills & York may also use your personal information for purposes related to the above purposes and for which you would reasonably expect Mills & York to do so in the circumstances, or where you have consented, or the use is otherwise in accordance with law.

The principal legal grounds for Mills & York’s use and disclosure of your personal information are as follows:

• Consent: where you have consented to Mills & York's use or disclosure of your personal information.
• Contract performance: where Mills & York is required to collect and handle your personal information in order to provide you (or the organisation you represent) with the products and services that Mills & York has contractually agreed to provide to you (including through our online platform);
• Legal obligation: where Mills & York needs to use or disclose your personal information to comply with its legal obligations.

Where personal information is used or disclosed, Mills & York takes steps reasonable in the circumstances to ensure it is relevant to the purpose for which it is to be used or disclosed. You are under no obligation to provide your personal information to Mills & York. However, without certain information from you, Mills & York may not be able to provide its products and/or services to you.

• To whom does Mills & York disclose your personal information?

Mills & York discloses your personal information for the purpose for which Mills & York collects it. That is, generally, Mills & York will only disclose your personal information for a purpose set out at paragraph 4. This may include disclosing your personal information to:

• third parties engaged to perform administrative or other business management functions, including debtor management, delivery and courier companies, shipping agents, call centres, mailing houses, financial institutions, cheque clearance houses, mercantile agents, and web-hosting organisations;
• Mills & York's professional advisors, agents, contractors, consultants and related bodies corporate;
• insurance providers;
• recruitment and labour hire agencies (as required).

Mills & York's disclosures of your personal information to third parties are on a confidential basis and/or otherwise in accordance with law. Mills & York may also disclose your personal information with your consent or if disclosure is required or authorised by law.

• Direct marketing

Mills & York may use and disclose your personal information in order to inform you of products and services that may be of interest to you. In the event you do not wish to receive such communications, you can opt-out by contacting Mills & York via the contact details set out in paragraph 11 or through any opt-out mechanism contained in a marketing communication to you.

• Security of your personal information

Mills & York takes steps reasonable in the circumstances to ensure that the personal information it holds is protected from misuse, interference, and loss and from unauthorised access, modification, or disclosure. Mills & York holds personal information in both hard copy and electronic forms in secure databases on secure premises, accessible only by authorised staff.

Mills & York will destroy or de-identify personal information in circumstances where it is no longer required, unless Mills & York is otherwise required or authorised by law to retain the information.

• Can you access and correct the personal information that Mills & York holds about you?

Mills & York takes steps reasonable in the circumstances to ensure personal information it holds is accurate, up-to-date, complete, relevant and not misleading. Under the Privacy Act, you have a right to access and seek correction of your personal information that is collected and held by Mills & York. If at any time you would like to access or correct the personal information that Mills & York holds about you, or you would like more information on Mills & York's approach to privacy, please contact Mills & York's Privacy Compliance Officer on the details set out in paragraph 11 below.

Mills & York will grant access to the extent required or authorised by the Privacy Act or other law and take steps reasonable in the circumstances to correct personal information where necessary and appropriate.

To obtain access to your personal information:

• you will have to provide proof of identity to ensure that personal information is provided only to the correct individuals and that the privacy of others is protected;
• Mills & York requests that you be reasonably specific about the information you require; and
• Mills & York may charge you a reasonable administration fee, which reflects the cost to Mills & York for providing access in accordance with your request.

Mills & York will endeavour to respond to your request to access or correct your personal information within 30 days from your request.

• Links

Mills & York's website may, from time to time, contain links to the websites of other organisations which may be of interest to you. Such links are provided as a convenience to you and should not in any way be interpreted as an endorsement of any company, content or product that may be linked. Any access to a third party website that is linked to Mills & York's website is at your own risk and Mills & York has no control over and is not responsible for the accuracy, validity or ownership of any content of a linked site and the privacy practices of those linked websites. You should check those websites for their respective Privacy Policies.

• Cookies

Mills & York's website uses 'cookies' which are small pieces of information sent from the website and stored by your browser on your computer's hard drive. Cookies that Mills & York uses enable its systems to provide features of its services and allow you to visit its website without re-entering your username and/or password, personalize and improve your experience, and to improve the functionality and user-friendliness of its services and monitor how its website is used through your computer.

This information is used by Mills & York to improve and tailor its website functionality and better understand how you interact with Mills & York's services and to monitor aggregate usage and web traffic routing on its website. You can modify your browser setting by editing your browser options to reject Mills & York's cookies or to prompt you before accepting a cookie. However, if a browser does not accept cookies or if you reject a cookie, some portions of Mills & York's online services may not function properly.

• How to contact us

For further information or enquiries regarding your personal information, or if you would like to opt-out of receiving any promotional or marketing communications, please contact Mills & York's Privacy Compliance Officer at:

info@millsandyork.com

Mills & York Pty Ltd

Level 17, 44 Market Street

Sydney, New South Wales, 2000

• Privacy complaints

Please direct all privacy complaints to Mills & York's Privacy Compliance Officer. At all times, privacy complaints:

• will be treated seriously;
• will be dealt with promptly;
• will be dealt with in a confidential manner; and
• will not affect your existing obligations or affect the commercial arrangements between you and Mills & York.

Mills & York's Privacy Compliance Officer will commence an investigation into your complaint. You will be informed of the outcome of your complaint following completion of the investigation. In the event that you are dissatisfied with the outcome of your complaint, you may refer the complaint to the Office of the Australian Information Commissioner.