Privacy Policy

Policy Owner: Group Finance Version: December 2024

1General

1.1This Privacy Policy sets out how Lynch Group Holdings Limited (ACN 608 543 219) and its subsidiaries and other related bodies corporate (together, LGA) collects, uses, discloses or holds your personal information.

2.0In this Privacy Policy, we use the terms:

1. ‘customers’ to refer to individuals who engage us to provide goods and services, and individuals at businesses who engage us to provide goods and services;
2. ‘drivers’ to refer to individuals who are engaged to drive for us (whether engaged by us or another company we contract with to provide transport services);
3. ‘suppliers’ to refer to individuals who provide us with goods or services (including our contractors and consultants), and individuals at businesses who provide us with goods or services;
4. ’visitors’ to refer to individuals who engage with us on our website, or who enquire about our functions or activities via electronic means;
5. ‘users’ to refer to users of our mobile applications in connection with our transport management system or stay in front merchandising system (Apps);
6. ‘applicants’ to refer to individuals who apply for employment or other engagement with us.

2Your privacy is important to LGA

2.1 This Privacy Policy has been developed in accordance with the Privacy Act 1988 (Cth) (Privacy Act) and the Australian Privacy Principles (APPs) (together, Privacy Laws).

2.2 A copy of the Australian Privacy Principles may be obtained from the website of The Office of the Australian Information Commissioner at www.oaic.gov.au

3What is Personal Information and what do we collect?

3.1 ‘Personal Information’ is information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information or opinion is true or not, and whether the information or opinion is recorded in material form or not. LGA only collects personal information where the information is reasonably necessary for one or more of our functions or activities. The kinds of information we collect about you depends on our relationship with you. Generally, we will collect your name, commentary or opinion about you, and other information relevant to providing you with the information, goods and services (as applicable) you or someone on your behalf are seeking

3.2 If you are a customer, we may also collect your email and mailing addresses, contact numbers, information about your role, marketing and communications preferences any other personal information you provide us with during your interactions with us. We may collect your business name and ABN, which is considered Personal Information if you are a sole trader or in a partnership.

3.3 If you are a supplier, we will also collect your contact details, ABN (for sole traders and partnerships), business name, bank account details (for payment of your invoices), information about your role.

3.4 If you are a driver using any Apps, we will collect location information which tracks you and your vehicle’s location (in live time) and location-related data while using the relevant App. This data is collected when the App is running in the foreground (app open and on-screen) or background (app open but not on-screen) of your device. We collect this data from the time you log into the App and begin a trip or have an active trip, until such time as you end that trip or log out of the App. We use this data to comply with Australian transportation safety requirements, improve efficiency of our transportation fleets and track vehicles for delivery compliance.

3.5 If you are a user, we collect data when you create or update your App accounts. This may include your first name, last name, email, phone number, login name, user settings and password. We use this data for the purposes of providing a secure login platform as well as to secure our services from use by unwanted parties. Whenever you use the Apps, in a case of an error in the Apps we collect data and information (through third party products) on your device called Log Data. This Log Data may include information such as your device Internet Protocol (IP) address, device name, operating system version, the configuration of the App when using it, the time and date of your use of the App, and other statistics. The App will access your device’s location, to send GPS feeds to the server for tracking and visibility purposes. The App will also access your device’s camera to take photos at proof of delivery stage. Note: the App does not allow for users to access and select photos from the device’s photo library - only the photo taken via the App is sent to the server. The Apps do not collect or access financial and payment information, authentication information, phonebook, contacts, SMS and call related data, Inventory of other apps on the device, web usage or history, or microphone. The Apps also do not use cookies explicitly. However, they may use third party code and libraries that use cookies to collect information and improve their services. You have the option to either accept or refuse Privacy Policy, Document Number: CG-009, Issue Number: 2, Issue Date: 1 March 2021 Page 3 of 9 3472-5611-2691, v. 3 these cookies and know when a cookie is being sent to your device. If you choose to refuse our cookies, you may not be able to use some portions of the App.

3.6 If you are a visitor, will also collect your email address, information about your use of our website and the device you are using (including numbers that identify your device, IP address, geographic location of your IP address and device where that is relevant to the services and information we are providing, cookie information, and user preferences). You may choose to enable or disable information you share with us via the website in your browser or device settings. Disabling the sharing of some information may affect your ability to use certain features of the website, and your visitor experience generally.

3.7 If you are an applicant, and depending on the prospective workplace participant’s potential position with us, we will generally collect your date of birth, Personal Information contained within an application and CV/resume, employment history, Personal Information derived from a reference, Personal Information derived from an interview, Personal Information derived through testing (including psychometric and aptitude testing), health information derived from a health declaration or pre-employment medical testing, licences and other certificates and qualifications, and Personal Information included in a passport, birth certificate, visa or other documentation demonstrating a prospective workplace participant’s right to work in Australia.

3.8 When we collect Personal Information we will, where appropriate and where possible, explain to you why we are collecting the information and how we plan to use it.

Sensitive Information

3.9 If you are an applicant, we are likely to collect sensitive information about you through the application process. By submitting a job application and engaging in the application process, you consent to our collection, use, disclosure, and handling of your sensitive information for the purpose of assessing your application. Otherwise, we do not generally collect sensitive information about you, but in the event that we do need to collect sensitive information, we will only do so where the collection is required or authorised by law or with your prior consent. Consent may be implied by the circumstances existing at the time of collection.

3.10 If you are a supplier or driver and provide us with certain services, for example as a contractor or consultant, we may collect your Personal Information and, in some circumstances, sensitive information. Examples of where we collect this information include carrying out safety inductions, where we require you to provide driving records or medical certificates, and if we carry out criminal record checks.

3.11 If you do not provide the Personal Information requested, or it’s incomplete or inaccurate, it may limit our ability to:

1. provide you with information about our products and services; and
2. process your job application, or engage you as an employee, personnel, contractor or business partner.

4. How do we collect your Personal Information?

4.1 We collect personal information by various means (including, but not limited to, in person, by phone, when you view our website, use our Apps, fill in a form, send us an e-mail or correspondence, engage with our employment and engagement application process, engage with our surveys, interact with us on social media or speak to one of our representatives – including during candidate interviews). If you are a visitor, we may also obtain Personal Information when you interact with our website as we may automatically collect technical data about your browsing actions and patterns by using cookies and other similar technologies. Please refer to our Cookies Policy for further details.

4.2 When collecting personal information by whichever means, LGA will take reasonable steps to provide the appropriate notices and obtain relevant consents in accordance with the Australian Privacy Principles.

4.3 Most information is collected directly from the individual but LGA may also obtain some personal information from third party sources when it is unreasonable or impracticable to collect it from you directly, when you have given us permission to do so, or as otherwise authorised or required by law. Those third parties include:

1. if you are a customer or supplier: publicly available records such as the Australian Securities Investment Commission;
2. if you are a visitor: technology service providers and social media platforms;
3. if you are a driver who is not engaged directly by us: the company you are engaged with, who supplies us with services;
4. if you are an applicant, recruitment agencies, referees when they provide references, academic institutions or training and certification providers, providers of licensing and background-checking services, and other service providers who assist in the engagement process, and other publicly available sources such as social media. If we collect information in this way, we will take reasonable steps to ensure the you are aware of the collection of such Personal Information.

Third Parties

4.4 If you provide Personal Information to us about someone else, you must ensure that you are entitled to disclose that information to us. For example, you should take reasonable steps to ensure the individual concerned is aware of the various matters detailed in this Privacy Policy and has consented to the collection, use and disclosure of their Personal Information as described in this Privacy Policy.

5. Using Personal Information

5.1 We use your Personal Information primarily for the purpose for which it has been provided, any other purpose you have consented to and any other purpose permitted under the Privacy Laws. Privacy Policy, Document Number: CG-009, Issue Number: 2, Issue Date: 1 March 2021 Page 5 of 9 3472-5611-2691, v. 3 The primary purpose for which we collect, use and disclose Personal Information is to manage our operations and promote our business. This may include using your Personal Information for any of the following purposes:

1. to provide you with information about our products or services, and the products or services of third parties;
2. to manage our relationships with customers, suppliers, investors, staff and other stakeholders;
3. if you are an applicant, supplier, or driver: to assess your application for employment, engagement, contracting or consulting services;
4. if you are a supplier or driver: so that you can provide us with services;
5. for handling of complaints;
6. to contact you to ask for feedback or a testimonial;
7. to review, develop and improve the products and services we offer, including to conduct market research, data analytics and statistical analysis in relation to our business;
8. to ensure compliance with our legal and regulatory obligations;
9. for corporate transactions such as business mergers and acquisitions, e.g. to assess or facilitate those transactions and manage the transition of the business;
10. in relation to investors, assessing applications, managing your investment and providing investor services;
11. if you are a driver who is using our Apps, we will use location information collected through or in connection with the Apps for the purpose of monitoring the performance of any distribution services or merchandising services (as applicable to the relevant App), whether by our employees and contractors or our third party service providers, and their employees and contractors;
12. if you are a visitor or customer: streamlining and personalising your experience with LGR and tailoring our information, goods and services for you;
13. if you are an applicant: considering your application with us;
14. to provide you with information about other goods and services that we or our related entities and other affiliated organisations offer that may be of interest to you. You may unsubscribe from our mailing/marketing lists at any time by using the unsubscribe feature on any emails we send, or otherwise by contacting us in writing. We do not use your Sensitive Information for direct marketing purposes;
15. to de-identify and aggregate Personal Information about you and your use of our goods and services to improve the quality of our goods and services, and for research purposes. After we delete Personal Information, we may retain de-identified and anonymised information (that can no longer be associated with you) and may continue to use this de-identified data indefinitely without further notice to you; and
16. for any other purpose identified at the time of collection.

5.2 We will not sell any Personal Information that you give us to any third party.

6. Disclosure of Personal Information

6.1 We may disclose your Personal Information to third parties for the same purposes for which we may use your information as described in section 5.1 above. This may include disclosing information:

1. within the LGA – that is, to our subsidiaries and related entities;
2. to third party organisations who assist us with operating our business and Apps, and with providing information, resources, goods and services on our behalf, including our affiliates, business partners, advertising partners, mailing and printing houses, IT providers, analytics providers, recruitment providers, and professional advisors;
3. to third parties to whom you have agreed we may disclose your information and where the information was collected from you (or from a third party on your behalf) for the purposes of passing it on to the third party;
4. if you are a driver, then in respect of location information collected via any App, to your employer or engaging entity, to third parties who assist us in providing the Apps, and to any other third parties as permitted by our agreement with your employer or engaging entity in relation to the distribution services or merchandising services (as applicable to the relevant App);
5. for investors, to third party organisations such as the share registry, information relating to your application or shareholding, e.g. information about the number of shares you hold or seek, any power of attorney, proxy or corporate representative appointed by you, your shareholder reference number or holder identification number and your tax file number if you choose to provide it;
6. anyone who is considering acquiring an interest in our assets or businesses (or any part of them) as part of a due diligence or sale process; and / or
7. any other individual or third party for any authorised purpose with your consent or when authorised or required by law.

6.2 We will only disclose your Personal Information for other purposes if you consent, if we are required or authorised by law to do so, where the disclosure is authorised under the Privacy Laws, or where we believe you would reasonably expect us to disclose your Personal Information for a purpose which is related to (or in the case of sensitive information, directly related to) the primary purpose of collection.

6.3 If there is a change of control in our business or a sale or transfer of business assets, we reserve the right to transfer (to the extent permissible at law) our databases, together with any personal information and non-personal information contained in those databases.

6.4 We are assisted by a variety of external service providers to operate our business, some of whom may be located overseas, such as Microsoft and Google who are based in the USA. We take reasonable steps to ensure that overseas recipients have appropriate security for your Personal Information, use your Personal Information only for the purposes for which it was collected, and do not otherwise breach the Privacy Laws in their handling of the Personal Information.

7. Accuracy and Security of Personal Information

7.1 We take reasonable steps to keep your personal information accurate and up-to-date. If you believe the information we hold about you is incomplete, not up to date or inaccurate, please advise us as soon as practicable.

7.2 Your Personal Information is stored by us in a manner that reasonably protects it from misuse and loss and from unauthorised access, modification or disclosure, whether held electronically or physically. We take reasonable steps to ensure that third parties who assist us in operating our business and who have access to your Personal Information have appropriate security for your Personal Information.

7.3 When your Personal Information is no longer needed for the purpose for which it was obtained, we will take reasonable steps to destroy or permanently de-identify your Personal Information.

7.4 If you are an applicant and your application is unsuccessful but you would like us to hold on to your application to consider you for other employment which may arise from time to time, please provide your written consent for us to do so.

8. Access to or Correction of Personal Information

8.1 You may request access to the Personal Information we hold about you and to update and/or correct it, subject to certain exceptions. If you wish to access your Personal Information, please contact us in writing to the Proper Officer (details below).

8.2 LGA will not charge any fee for your access request, but may charge you a reasonable fee if your request for access is clearly unfounded or excessive.

8.3 We will respond to your requests for access or correction within a reasonable period after the request is made. There may be situations where we are not required to provide you with access to your Personal Information, such as where the request relates to an existing or anticipated legal proceeding, or if your request is unfounded or excessive.

8.4 We may need to verify the accuracy of new information you provide us before making corrections to your Personal Information held by us, and in order to protect your Personal Information we may require identification from you before releasing the requested information.

9. Cookies and analytics

9.1 Our website uses cookies to provide the functionality necessary to deliver our products and services. Cookies in use may identify individuals who log into our website. You can reject cookies by changing the settings on your browser but doing so may limit your functionality and user experience within our site. For further information, please refer to our Cookies Policy.

9.2 Our website uses analytics platforms that allow us to better understand how users experience our website and applications. Generally, the type of information that is collected includes (but may not be limited to):

1. type of device being used to access the website;
2. country where user is located;
3. time on a page;
4. bounce rate - the number of users that enter and leave the same page (expressed as a percentage);
5. channel; and
6. other metrics as required.

9.3 LGA uses Google Analytics to collect and process anonymous and aggregated data. Details and information about these services and how Google uses the collected data is available at www.google.com/policies/privacy/partners/

10. Policy Updates

10.1 From time to time it may be necessary for us to review and revise this Policy. We reserve the right to amend this Policy at any time and to notify you by posting an updated version of the Policy on our website.

11 Privacy Policy Complaints and Enquiries

11.1 If you have any queries or complaints about our Privacy Policy, please contact us by:
Phone: (02) 8778 5388 - Ian Lilley, General Manager Human Resources
Email: hr@lynchgroup.com.au
Post: The Privacy Officer

11.2 8B Williamson Road, Ingleburn NSW 2565We will take reasonable steps to investigate the complaint and respond.

11.3 If after the above process, you are not satisfied with our response, you can submit a complaint to the Office of the Information Commissioner (OAIC). To lodge a complaint, visit the Privacy Policy, Document Number: CG-009, Issue Number: 2, Issue Date: 1 March 2021 Page 9 of 9 3472-5611-2691, v. 3 ‘complaints’ section of the OAIC’s website, located at https://www.oaic.gov.au/privacy/privacycomplaints/, to obtain the relevant complaint form, or contact the OAIC’s office.

Classification: Public
Privacy Policy, Document Number: CG-009, Issue Number: 2, Issue Date: 1 March 2021

<Download Privacy Policy>

Cookies Policy

1.0 Cookies are small text files that are placed on, and stored through, your web browser of choice. The services LGA provides and use internally, utilise cookies to provide these services. This may include personalising content and advertising, for security and session management, and to enhance your experience when using our website.

2.0 Third party cookies may also be used on our website. LGA does not control the third parties or their cookies and we refer you to the third party’s website for details as to how they use their cookies.

3.0 Each cookie used on our website has a specific purpose and are generally categorised as either: (i) essential cookies; and (ii) non-essential cookies.

4.0 Essential cookies are those which are necessary for the website to operate or function effectively. Essential cookies do not generally collect personal information. All other cookies are non-essential, and may, in some cases, collect your personal information. To the extent the cookies we use collect your personal information, details about how we use your personal information are in our Privacy Policy list above: https://lynchgroup.com.au/privacy-policy

5.0 The types of cookies placed on your browser when you visit our website (some of which are set by LGA and by third parties) are set out below:

6.0 You may choose to accept or reject certain cookies by managing your browser settings. However, if you reject cookies (especially essential cookies), you may be limiting the functionality and your user experience within our Website.

7.0 You can also opt out of the collection and use of their information for ad targeting. Mechanisms for exercising that choice are available here http://www.aboutads.info/choices and http://www.youronlinechoices.eu/.

Classification: Public
Cookies Policy, Document Number: CG-010, Issue Number: 2, Issue Date: 1 March 2021

<Download Cookie Policy>