PRIVACY POLICY

Privacy Principles

Modac Capital (“ Modac Capital ”) recognises the importance of the personal information we hold about individuals and the trust they place in us.

By explaining our Privacy Policy to you, we hope that you will better understand how we keep personal information private and secure while using it to provide services and products.

This Privacy Policy applies to the Australian operations of Modac Capital unless specifically stated otherwise. For these purposes, Modac Capital ABN 16 162 292 195 and any of its branches, affiliates, subsidiaries, shareholders or such shareholders' subsidiaries, as applicable, and shall include any successors including, without limitation, an assignee or successor or any affiliate or subsidiary of such entity or any person who, under the laws of the jurisdiction of incorporation or domicile, has assumed the rights and obligations of Modac Capital , National Association, or any of its branches, affiliates, subsidiaries, shareholders or such shareholders' subsidiaries or to which under such laws the same have been transferred. In this Policy, the members of this group are individually and collectively referred to as " Modac Capital ", "we" or "us".

We are committed to safeguarding your personal information in accordance with the requirements of the Australian Privacy Principles of the Privacy Act 1988.

In general, we will not use or disclose such information collected about you otherwise than for the purposes set out in this Policy, for a purpose you would reasonably expect, a purpose required or permitted by law, or a purpose otherwise disclosed to, or authorised by you.

Your personal and/or sensitive information may be used by us to administer our products and services, for prudential and risk management purposes and, unless you tell us otherwise, to provide you with related marketing information. We also use the information we hold to help detect and prevent illegal activity. We cooperate with police and other enforcement bodies as required or allowed by law.

We may, in connection with particular services we offer or provide to you, make other privacy disclosures to you or seek your authority to use your personal information in ways which are different from or more specific than those stated in this Privacy Policy. In the event of any inconsistency between the provisions of this Privacy Policy and those additional materials, the provisions of the additional materials will prevail.

What is Personal Information?

Personal Information is information or an opinion about an identified individual, or an individual who is reasonably identifiable:

• whether the information or opinion is true or not; and
• whether the information or opinion is recorded in a material form or not.

Why we collect information

We collect personal information when it is reasonably necessary for one or more of our functions or activities.

These include:

• (a) providing customers with the products and services they request and, unless they tell us otherwise, to provide information on products and services offered by us and external product and service providers for whom we act as agent. (If you have provided us with your email or mobile phone details, we may provide information to you electronically with respect to those products and services);
• (b) complying with our legal obligations;
• (c) monitoring and evaluating products and services;
• (d) gathering and aggregating information for statistical, prudential, actuarial and research purpose;
• (e) assisting customers with queries; and
• (f) taking measures to detect and prevent frauds.

Kinds of Personal Information we collect and hold

The kind of Personal Information we may collect about you generally includes:

• name;
• address;
• date of birth;
• gender;
• nationality;
• residency status;
• telephone number;
• e-mail address;
• financial information;
• tax file number;
• employment history;
• education history;
• information contained in identity document, such as a passport number and drivers licence number; and
• information necessary to make or receive payments to or from you or necessary to effect security transactions on your behalf.

We are required by law to identify you if you are opening a new account or adding a new signatory to an existing account. Anti-money laundering laws require us to sight and record details of certain documents (i.e. photographic and non-photographic documents) in order to meet the standards set under those laws.

Where it is necessary to do so, we also collect information on individuals such as:

• (a) trustees;
• (b) partners
• (c) company directors and officers;
• (d) officers of co-operatives and associations;
• (e) customer’s agents;
• (f) beneficial owners of a client; and
• (g) persons dealing with us on a “one-off” basis.

We may take steps to verify the information we collect; for example, a birth certificate provided as identification may be verified with records held by the Registry of Births, Deaths and Marriages to protect against impersonation, or we may verify with an employer that employment and remuneration information provided in an application for credit is accurate.

In certain circumstances, we may also collect Personal Information which is sensitive. This may include information about your:

• racial or ethnic origin;
• political opinion or membership of political association;
• religious or philosophical beliefs;
• membership of professional or trade associations or trade union; and
• criminal record.

Your health, genetic and biometric information and biometric templates are also sensitive information.

How we collect Personal Information

We will collect Personal Information directly from you when you:

• apply for a product or a service; apply for a product or a service;
• update your Personal Information or another person’s Personal Information held by us;
• deal with us as a key contact or employee of an institutional client;
• deal with us as a key contact or employee of a non-client relationship such as vendors;
• deal with us over the telephone or in person;
• send us a letter; or
• visit the Modac Capital Australia web site.

On occasions, we may need to collect Personal Information about you from third parties. This may include, but is not limited to:

• where an institutional client has applied for a product or a service and the details of the institutional client's officeholders, account signatories and/ or beneficiaries are provided to us by the individual applying on behalf of the institutional client;
• our agent and service providers which may be located overseas;
• law enforcement bodies;
• statutory and regulatory bodies;
• publicly available sources including the Internet and telephone directories;
• industry databases; and
• marketing organisation including through the use of purchased lists.

Unless the collection of sensitive information is required or permitted by or under law, we will obtain your consent to its collection.

Other matters regarding our collection of Personal Information

If at any time you provide us with Personal Information about another person, you acknowledge that you will ensure that the person has been notified of all relevant matters required under the Privacy Act relating to our collection of such information and has consented to the collection, use and disclosure of their Personal Information by us as set out in this Privacy Policy.

If we are not provided with certain Personal Information we may not be able to provide some or all of our services.

In certain circumstances, we may be required or authorised to collect Personal Information under certain laws that apply to Modac Capital including the Anti‐Money Laundering and Counter‐Terrorism Financing Act 2006 and the Anti-Money Laundering and Counter-Terrorism Financing Rules Instrument 2007 (No. 1).

Consent

In most cases, before or at the time of collecting your personal information, we will obtain your consent to the purposes for which we intend to use and disclose your personal information.

If you don’t give us consent, we may not be able to provide you with the products or services you want. This is because we are required to collect this information to provide you advice.

Withdrawing consent

Having provided consent, you are able to withdraw it at any time. To withdraw consent, please contact our office. Please note that withdrawing your consent may lead to us no longer being able to provide you with the product or service you enjoy given that, as mentioned above, it is impracticable for us to treat some customers differently.

Sensitive information

In addition to the above conditions of collecting personal information, we will only collect sensitive information about you if we obtain prior consent to the collection of the information or if the collection is required or authorised by law.

Dealing with unsolicited personal information

If we receive personal information that is not solicited by us, we will only retain it, if we determine that it is reasonably necessary for one or more of our functions or activities and that you have consented to the information being collected or given the absence of your consent that it was impracticable or unreasonable for us to obtain it under the circumstances.

If these conditions are not met, we will destroy or de-identify the information.

If such unsolicited information is sensitive information we will obtain your consent to retain it regardless of what the circumstances are.

How we hold Personal Information

Your Personal Information may be held within our (or our service providers'):

• premises in paper records;
• computer systems including email, servers, hard drives and applications;
• data storage systems; and
• in certain circumstances, in sound recordings of your telephone discussions with Modac Capital .

Security of Personal Information

Modac Capital will take reasonable steps to protect the Personal Information it holds from interference, misuse and loss and from unauthorised access, modification or disclosure. In line with our internal authorisation and access policies, employees only have access to information on a need to know basis.

Our security measures include, but are not limited to:

• (a) educating our staff as to their obligations with regard to your personal information;
• (b) requiring our staff to use passwords when accessing our systems;
• (c) encrypting data sent from your computer to our systems during Internet transactions and customer access codes transmitted across networks;
• (d) employing firewalls, intrusion detection systems and virus scanning tools to protect against unauthorised persons and viruses from entering our systems;
• (e) using dedicated secure networks or encryption when we transmit electronic data for purposes of outsourcing;
• (f) providing secure storage for physical records; and
• (g) employing physical and electronic means such as alarms, cameras and guards (as required) to protect against unauthorised access to buildings.

To the extent permitted by law, Modac Capital will take reasonable steps to destroy or permanently de-identify Personal Information if it is no longer needed for any purpose for which the information may be used and disclosed under this Policy except in circumstances where Modac Capital is required or authorised to retain such Personal Information (including as a result of the operation of tax, financial services or other applicable law).

Purposes for which we collect, hold, use and disclose Personal Information

Personal Information may be collected, held, used or disclosed for the purpose of undertaking Modac Capital ’s obligations and providing services and products or for any of the following purposes:

• managing client relationships and/or servicing you globally;
• carrying out or facilitating the client's instructions or responding to the client's queries or requests;
• all existing or future customer due diligence, client verification procedures and ongoing account administration (including but not limited to monitoring, screening and sanctions risks assessment);
• daily operation of the accounts, services, products and/or other banking services and facilities provided to or to be provided to the client;
• performing our administrative operations, including accounting, record keeping, archiving, systems development and testing and staff training;
• performing control and risk management functions – including monitoring credit exposure, conducting credit checks and audits generally, and anti-money laundering regulatory screening, reporting and monitoring;
• developing and identifying products and services that may interest you;
• enhancing operational, technology, finance, compliance and other support function efficiencies;
• enforcing the obligations of the client including collection of amounts outstanding from the Client and its guarantor(s) or security provider(s);
• assisting other financial institutions or financial intermediaries to conduct credit checks and collect debts;
• managing our rights and obligations in relation to external payments systems;
• handling complaints and managing legal matters and litigation;
• conducting market or customer satisfaction research;
• (unless you ask us not to) telling you about other products and services we offer;
• inviting you to other events that may interest you;
• assessing and processing employment applications and conducting due diligence as part of pre-employment screening;
• when considered necessary by Modac Capital to comply with any law, regulation, court order or requirement of a regulatory or self-regulatory body, tax authority or industry bodies; and
• any other purpose relating to or in connection with the business or dealings of Modac Capital .

Use or Disclosure

If we hold personal information about you that was collected for a particular purpose (“the primary purpose”), we will not use or disclose the information for another purpose (“the secondary purpose”) unless:

• (a) We have obtained your consent to use or disclose the information; or
• (b) you would reasonably expect us to use or disclose the information for the secondary purpose and the secondary purpose is:
• (i) if the information is sensitive – directly related to the primary purpose; or
• (ii) if the information is not sensitive – related to the primary purpose;
• (c) the use or disclosure of the information is required or authorised by or under an Australian law or a court/tribunal order; or
• (d) a permitted general situation exists in relation to the use or disclosure of the information by us; or
• (e) a permitted health situation exists in relation to the use or disclosure of the information by us, in which case we will de-identify the information before disclosing it; or
• (f) we reasonably believe that the use or disclosure of the information is reasonably necessary for one or more enforcement related activities conducted by, or on behalf of, an enforcement body; or

Where we use or disclose personal information, we will keep a copy of this disclosure (e.g.: the email or letter used to do so).

Disclosure of Personal Information

We may disclose your Personal Information to the following parties:

• employees, agents, subcontractors, insurers, consultants, exchanges, repositories, depositories, clearing houses, affiliated or unaffiliated providers of outsourced or other services in connection with provision of services or products or otherwise in connection with the operation of Modac Capital business;
• professional advisers of Modac Capital ;
• any financial institution or financial intermediary with which the client has or proposes to have dealings or otherwise is in connection with provision of services or products;
• governmental, regulatory, supervisory, law enforcement or similar authority (including tax authority) or industry body in any jurisdiction;
• trade repositories or similar facilities or institutions (and related third party service providers), whether pursuant to legislation, regulation, supervisory directive or otherwise;
• any court of competent jurisdiction in defence of claims or enforcement of rights;
• auditors of Modac Capital or Auditors of the Client;
• an assignee or a proposed assignee of any of Modac Capital ’s rights or obligations;
• any person or organisation who introduces you to us;
• credit reference agencies;
• any person with whom Modac Capital may enter a transaction under which payments may be made by reference to an agreement with the Client;
• debt collection agencies (in the event of default) (except for information of referees and third parties other than debtors and guarantors); and
• any person to the extent necessary, in our view, in order to carry out the instructions you give to us.

Outsourcing

We disclose personal information when we outsource certain functions, including bulk mailing, card and cheque book production, market research, direct marketing, statement production, debt recovery and information technology support. We also seek expert help from time to time to help us improve our systems, products and services.

We use banking agents, for example, local businesses, to help provide you with face-to-face banking services. These agents collect personal information on our behalf.

In all circumstances where personal information may become known to our contractors, agents and outsourced service providers, there are confidentiality arrangements in place. Contractors, agents and outsourced service providers are not able to use or disclose personal information for any purposes other than our own.

We take our obligations to protect customer information very seriously we make every effort to deal only with parties who share and demonstrate the same attitude.

Disclosure required by law

We may be required to disclose customer information by law e.g. under Court Orders or Statutory Notices pursuant to taxation or social security laws or under laws relating to sanctions, anti-money laundering or counter terrorism financing.

Disclosing personal information to cross border recipients

We will only disclose your personal information to a recipient who is not in Australia and who is not our entity after we ensure that:

• (a) the overseas recipient does not breach the Australian Privacy Principles; or
• (b) you will be able to access to take action to enforce the protection of a law or binding scheme that has the effect of protecting the information in a way that is at least substantially similar to the way in which the Australian Privacy Principles protect the information; or
• (c) you have consented to the disclosure after we expressly you that there is no guarantee that the overseas recipient will not breach the Australian Privacy Principles; or
• (d) the disclosure of the information is required or authorised by or under an Australian law or a court/tribunal order; or
• (e) a permitted general situation (other than the situation referred to in item 4 or 5 of the table in subsection 16A(1) of the Privacy Act) exists in relation to the disclosure of the information.

Modac Capital 's internet website

Our compliance with the Australian Privacy Principles also extends to when you transact business via our web site. Our web site terms and conditions and any privacy notices are posted on the web site.

When you use a link from the Modac Capital web site to the web sites of third parties, those web sites are not subject to Modac Capital 's privacy standards and are outside our control. Those third parties are responsible for informing you of their own privacy policies. We are not responsible for the security or privacy of any information collected by third-party websites or other services.

For statistical purposes we may collect information on web site activity (such as the number of users who visit the web site, their country, the date and time of visits, the number of pages viewed, navigation patterns and the operating systems and browsers used to access the site). This information on its own does not identify an individual but it does provide us with statistics that we can use to analyse and improve our website.

When you use our web site, we may send you a temporary cookie. A ‘cookie’ is a packet of information that allows the server to identify and interact more effectively with your computer that gives you a unique identification number. This identification number is sent each time you use our web site. Cookies do not identify individual users, although they do identify a user’s browser type and your Internet Service Provider. You can configure your browser to accept all cookies, reject all cookies, or notify you when a cookie is sent, however, if you do not accept cookies, you may not be able to make full use of the Modac Capital web site. At the end of your interaction with our web site, the cookie no longer exists and it cannot be used for further identification or access to your computer.

Adoption of government related identifiers

We will not adopt a government related identifier of an individual as our own identifier unless required or authorised to do so by or under an Australian law, regulation or court/tribunal order.

Use or disclosure of government related identifiers

Before using or disclosing a government related identifier of an individual, we will ensure that such use or disclosure is:

• (a) reasonably necessary for us to verify your identity for the purposes of the our activities or functions; or
• (b) reasonably necessary for us to fulfil its obligations to a government agency or a State or Territory authority; or
• (c) required or authorised by or under an Australian law, regulation or a court/tribunal order; or
• (d) within a permitted general situation (other than the situation referred to in item 4 or 5 of the table in subsection 16A(1) of the Privacy Act); or
• (e) reasonably necessary for one or more enforcement related activities conducted by, or on behalf of, an enforcement body.

Access to your Personal Information

If at any time you would like to request access to the Personal Information we are holding about you, you are welcome to ask us in a form or manner which identifies the nature of the Personal Information requested. Requests can be made to your Modac Capital business contact.

Generally, we will provide you with access to the Personal Information we hold about you within a reasonable time. Under certain circumstances however, we may not be able to provide you with access to the Personal Information we hold about you. This includes where:

• it would have an unreasonable impact on the privacy of another individual;
• the request is frivolous or vexatious
• information relates to legal proceedings;
• the information would reveal a commercially sensitive decision-making process; or
• we are prevented by law from disclosing the information, or providing access would prejudice certain investigations.

We will not charge you for making the request for access, however access charges may apply to cover our costs in locating, collating and explaining the information you request.

We will respond to your request as soon as possible and in the manner requested by you. We will endeavour to comply with your request within 14 days of its receipt but, if that deadline cannot be met owing to exceptional circumstances, your request will be dealt with within 30 days. It will help us provide access if you can tell us what you are looking for.

Your identity will be confirmed before access is provided.

Unless we are unable to do so, we will inform you of the reason(s) for refusing access.

Refusal to give access and other means of access

If we refuse to give access to the personal information or to give access in the manner requested by you, we will give you a written notice setting out the reasons for the refusal, the mechanisms available to complain and any other relevant matter.

Additionally, we will endeavour to give access in a way that meets both yours and our needs.

Access to a credit report about you

You have the right to ask for a copy of any credit report we have obtained about you from a credit-reporting agency. However, as we may not have retained a copy after we have used it in accordance with Part IIIA of the Privacy Act the best means of obtaining an up-to-date copy is to get in touch with the credit-reporting agency direct.

You have a right to have any inaccuracies corrected or, if there is any dispute as to accuracy, to have a note added to your credit reporting agency file explaining your position.

If we decline your credit application wholly or partly because of adverse information on your credit report, the Privacy Act, requires us to tell you of that fact and how you can go about getting a copy of your credit report.

The major credit-reporting agency in Australia is Equifax, https://www.equifax.com.au/. As the largest agency, it is likely that it will be Equifax that you will need to contact in relation to access to an up-to-date copy of your credit report and any correction of information on your file. You can contact Equifax at https://www.equifax.com.au/contact.

Corrections to your Personal Information

We will take reasonable steps to ensure that your Personal Information is accurate, complete and up to date. This includes correcting Personal Information we identify as being incorrect or where you are able to demonstrate that the Personal Information we hold about you is incorrect.

We may not be able to provide you with the products or services you are seeking if you provide incomplete or inaccurate information.

If at any time, you find that the Personal Information we hold about you is inaccurate, incomplete, out-of- date, irrelevant or misleading please advise your Modac Capital contact or our Privacy Officer immediately using the contact details above.

If you request a correction to the Personal Information we hold about you and we consider that we are not able to correct the Personal Information in the manner you have requested, then, unless we are unable to do so, we will inform you of the reason(s) for refusing to correct the Personal Information.

We may also take steps to update personal information we hold, for example, an address, by collecting personal information from publicly available sources such as telephone directories or electoral rolls.

Refusal to correct information

If we refuse to correct the personal information as requested by you, we will give you a written notice setting out the reasons for the refusal, the mechanisms available to complain and any other relevant matter.

Request to associate a statement

If we refuse to correct the personal information as requested by you, you can request us to associate with the information a statement that the information is inaccurate, out of date, incomplete, irrelevant or misleading. We will then associate the statement in such a way that will make the statement apparent to users of the information.

Direct marketing

We may use your personal details, including your address, to provide you with newsletters and information about products, services or other events that may be of interest to you.

If at any time you do not wish to receive such marketing information, you have the option to ask us not to send you any further such material and you may do so by writing to your Modac Capital contact or our Privacy Officer using the contact details above.

Making a privacy complaint

We offer a free internal complaint resolution scheme to all of our customers. Should you have a privacy complaint, please contact us to discuss your concerns.

You will also have free access to an external dispute resolution scheme in which we are member.

To assist us in helping you, we ask you to follow a simple three-step process:

• (a) Gather all supporting documents relating to the complaint.
• (b) Contact us and we will review your situation and if possible resolve your complaint immediately.
• (c) If the matter is not resolved to your satisfaction, please contact our Privacy Officer on 02 8046 7488 or put your complaint in writing and send it to Modac Capital at Tower 1 Level 35, 100 Barangaroo Avenue, Barangaroo NSW 2000.

If you are still not satisfied, you have the right to contact the Office of the Australian Information Commissioner (“OAIC”). You can contact the OAIC to make a query concerning your privacy rights, or to lodge a complaint with the OAIC about how we have handled your personal information. You can contact the OAIC’s hotline on 1300 363 992 or visit their website at www.oaic.gov.au. The OAIC has the power to investigate a complaint and make a determination.