We collect personal information that is reasonably necessary to provide our accounting, taxation and advisory services to you. This includes: • Your name, contact details (email, phone, address) and profession • Tax file number (TFN), ABN and Medicare provider numbers • Financial information including income, expenses, assets and liabilities • Identification documents, only where we are legally required to verify your identity and subject to the firm's applicable AML/CTF obligations and procedures (PROFESSIONAL/LEGAL REVIEW REQUIRED) • Information you provide through the client portal, enquiry forms, or during consultations We do not collect sensitive information (such as health information) unless it is directly relevant to your tax affairs and you provide it voluntarily.

We collect personal information directly from you when you: • Complete an enquiry or registration form on our website • Upload documents through the client portal • Communicate with us by email, phone or in person • Engage us to provide accounting or tax services We may also collect information from third parties — such as the Australian Taxation Office, banks, or your employer — when you authorise us to do so, or where it is necessary to provide our services.

We use your personal information to: • Provide accounting, tax, BAS, payroll and advisory services • Lodge tax returns and other documents with the ATO and regulatory bodies • Communicate with you about your affairs, deadlines and opportunities • Maintain records as required by tax law and professional standards • Improve our services and develop new offerings We do not use your personal information for direct marketing without your consent. You can opt out of any communications at any time.

We only share your personal information in the following circumstances: • With the ATO and other regulatory bodies as required to lodge documents and meet our legal obligations • With your express consent, such as when you request a referral to an approved partner • With service providers who help us deliver our services (including our hosting platform, CRM, email and AI providers), under confidentiality obligations. We maintain an internal Third-Party Processor Register; processing locations, retention and sub-processors are confirmed with each provider (UNVERIFIED where not yet confirmed) • Where required by law, such as in response to a lawful request from a government authority We never sell your personal information. We never share it with third parties for their marketing purposes without your explicit consent.

We take information security seriously. Your data is: • Held within the Base44 platform under role-based access controls • Storage-layer encryption is UNVERIFIED and subject to confirmation with the platform provider (PROFESSIONAL/LEGAL REVIEW REQUIRED) • Protected by audit trails that record material actions • Never shared with third parties without your consent (unless required by law) We retain personal information for the period required by tax law (a minimum of five years from lodgement or the relevant transaction is common) and otherwise in accordance with our documented retention policy. Automated retention and destruction is implemented as a configurable engine; no records are destroyed until an approved, formally-determined retention rule applies (PROFESSIONAL/LEGAL REVIEW REQUIRED).

Under the Privacy Act 1988 (Cth) and the Australian Privacy Principles, you have the right to: • Access the personal information we hold about you • Request correction of inaccurate or out-of-date information • Request that we not use or disclose your information for certain purposes • Lodge a complaint if you believe we have breached your privacy To exercise any of these rights, please contact us using the details below. We will respond to your request within a reasonable timeframe, typically within 30 days.

Our website uses cookies and similar technologies: • Strictly necessary cookies required for the portal and authentication to function • Analytics cookies that collect aggregated, non-identifiable usage patterns to improve our services • Marketing/advertising cookies (Google Ads conversion tracking) — these are loaded only after you give consent via the cookie banner, and you can accept or reject them at any time We do not use cookies to track you across other websites without your consent. You can control cookies through your browser settings. (POLICY WORDING REVIEW REQUIRED)

If you believe we have mishandled your personal information, please contact us first. We take all privacy concerns seriously and will investigate promptly. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or by calling 1300 363 992.