Capti is committed to protecting the privacy and personal information of our customers. As a telecommunications provider, Capti supplies telecommunications products and services, including data network, internet, data centre, cloud, and voice products and services to corporate, government, and residential customers. This privacy policy explains how Capti safeguards your privacy and handles your personal information.

Privacy Laws Applicable to Capti

At Capti, we are committed to complying with the applicable privacy laws and regulations that govern our business. We operate in accordance with the Privacy Act 1988 (Cth) and adhere to the Australian Privacy Principles (APPs) outlined in that Act. These principles establish the minimum standards for the collection, use, disclosure, and handling of personal information in various forms, including written, verbal, and digital formats. You can access the APPs on the website of the Australian Information Commissioner at www.oaic.gov.au.

In addition to the Privacy Act, we also comply with other Australian laws that protect personal information. These laws include the Telecommunications Act 1997 (Cth), Spam Act 2010 (Cth), Do Not Call Register Act 2006 (Cth), data retention laws, and relevant state legislation concerning health records. In this privacy policy, the following terms have the following meanings unless stated otherwise:

• "Privacy law" refers to any legislative or legal requirement that applies to our collection, use, disclosure, or handling of personal information.
• "Personal information" refers to information or opinions about an identified individual or an individual who can be reasonably identified. This information or opinion may be true or false, recorded in any form, and includes sensitive information.
• "Sensitive information" refers to personal information that includes an individual's racial or ethnic origin, political opinions or memberships, religious beliefs or affiliations, philosophical beliefs, professional or trade association/union memberships, sexual preferences and practices, or criminal record.

We take the protection of personal information seriously and ensure compliance with these privacy laws to safeguard your privacy and maintain the confidentiality of your personal information.

Whose Personal Information Do We Collect?

At Capti, we collect personal information from various individuals, whom we refer to collectively as "customers." These individuals include:

• Prospective customers: This category encompasses individuals whom we believe may have an interest in our products and services. It includes people who have expressed interest in obtaining or learning more about our offerings, individuals who visit our webpages, as well as current and past customers.
• Current customers: This category includes individuals who have purchased our products or services or who hold an active account with us.
• Past customers: These individuals have previously purchased our products or services but do not currently maintain an active account with us.

We collect personal information from these customer categories to provide our services effectively and ensure a seamless customer experience.

Anonymous or Pseudonymous Interactions

In certain circumstances, individuals, including customers, have the option to interact with Capti anonymously or by using a pseudonym. For instance, you can make a general inquiry to our call centers without disclosing any personal information. Similarly, you have the option to lodge an anonymous complaint or report a service fault, unless the inquiry or complaint is specific to a particular account.

However, it is important to note that if you choose not to disclose your identity, we may be unable to provide you with the requested information or assistance.

Personal Information Collected

At Capti, we only collect personal information when it is reasonably necessary for our functions and activities, as required by law. The types of personal information we collect include:

• Proof of identity information: This may include details such as passport numbers, driver's license numbers, Medicare numbers, or other government identifiers. We collect this information to verify your identity, ensure the accuracy of our customer records, and comply with legal requirements. For example, the Telecommunications Act 1997 mandates us to obtain specific proof of identity information before providing mobile telephone services.
• Financial and credit information: We collect financial and credit information, such as credit history, employment history, remuneration details, bank account and credit card information, asset and income information, and details of relevant court judgments and bankruptcies. This information is necessary to assess the creditworthiness and financial suitability of both current and prospective customers.
• Information about medical conditions and concession entitlement: In certain cases, having a specific medical condition may entitle individuals to concessional tariffs or other benefits associated with our products or services. For example, for electricity and gas services, we may require information about medical conditions to ensure a secure power supply for medical devices.
• Information relating to occupancy: We may collect information to establish a customer's right to occupy the property to which we provide services. This may include copies of tenancy agreements, mortgage records, utility bills, or supply records.
• Information relating to change of name or status: We may collect information to establish a customer's right to occupy the property to which we provide services. This may include copies of tenancy agreements, mortgage records, utility bills, or supply records.
• Employment information: We may collect information about employment history, including current and past employers, to assess the financial position of individuals applying to become our customers.
• Integrated Public Number Database (IPND): As a telecommunications service provider, we are obligated by law to collect certain personal information, including name, address, telephone service number, and other public number customer details. This information is provided to the operator of the Integrated Public Number Database (IPND) for inclusion in the database.

Additionally, we collect information about the usage of our products and services, including:

• Service usage, such as energy consumption patterns, communication service usage, and internet usage.
• Responses to offers and promotions provided by us or our affiliates.
• Payment patterns and history.
• Inquiries and complaints.

We may also collect personal information about associates of our customers, such as family members, employees, or agents. For instance, we may collect personal information about authorized representatives, credit card holders used for account payments, secondary account holders, guarantors for credit contracts, landlords of tenanted properties, or nominated contacts on business accounts. If you provide us with personal information about another individual, we request that you refer them to this Privacy Policy.

When collecting personal information from young individuals, we follow the guidance proposed by the Privacy Commissioner. We make an objective determination to ensure that the person has a sufficient understanding and maturity to provide informed consent for the use of their personal information.

We also collect personal information about individuals involved in providing our products and services, including:

• Our staff and the staff of other companies within the Vocus Group.
• Service providers, suppliers, agents, and affiliates, along with their staff members.

How We Collect Personal Information

Capti collects personal information directly from customers, as well as through our agents, service providers, and affiliates. We may collect this information through various channels, including:

• Call centers: We collect personal information when customers interact with us through our call centers.
• Websites:Personal information is collected when customers visit our websites or websites operated by our affiliates.
• Social media platforms:We may collect personal information through social media platforms like Twitter and Facebook, as customers engage with our online presence.
• Marketing lists and data aggregation services:We may acquire personal information through the purchase of marketing lists, databases, or data aggregation services.

When customers apply to become our customers, we may seek their consent to collect information from specific third parties. We will only collect personal information from these third parties if consent is provided. If consent is not given, we may be unable to provide the requested service or product. It is important to note that under Privacy Law, we are authorized to collect certain personal information from third parties.

Capti handles any unsolicited personal information received in accordance with our obligations under Privacy Law, ensuring its proper management and protection.

Purposes for Collecting Personal Information

At Capti, we collect personal information for various reasons, including:

• Providing products and services:We collect personal information to deliver our products and services to customers effectively.
• Managing and administering products and services:Personal information is used for purposes such as billing, credit control, identity verification, assessing entitlement to concessions, connecting and servicing products, investigating and resolving complaints or faults, and overall management and administration of our offerings.
• Relationship management:We use personal information to manage and administer relationships with our suppliers, customers, and shareholders. This includes billing, credit control, and investor-related activities.
• Communication and notificationss:We inform customers about changes, improvements, and updates regarding our products and services.
• Aggregate data analysis:Personal information may be used to create aggregate data through demographic profiling and statistical analysis. This helps us improve the efficiency of our business operations.
• Marketing:We may use personal information to market our own products and services to customers. Additionally, we may use it to promote products and services offered by our affiliated entities or third parties.
• Job applications:Personal information is collected and used for managing job applications.
• Relationship management with staff and stakeholders:We use personal information to maintain relationships with our staff, contractors, agents, affiliates, and service providers.
• Legal purposes:Personal information may be used to establish, exercise, or defend legal claims.
• Compliance with legal obligations:We collect and use personal information to fulfill our legal obligations as required by applicable laws and regulations.

It is important to note that the personal information collected may be shared within the Vocus Group for the purposes outlined above.

The collection of personal information is necessary for many of our business activities, and the specific information required depends on the circumstances. Failure to collect the necessary personal information may result in us being unable to meet customer expectations or provide the requested products and services.

Direct Marketing

When it comes to direct marketing, personal information collected for such purposes will only be obtained, used, or disclosed with the customer's consent. In cases where obtaining practical consent from a customer is not feasible, we will:

• Provide an 'unsubscribe' option: We will include an easy-to-use 'unsubscribe' facility, allowing customers to opt out of receiving further marketing communications from us at any time.
• Offer opt-out details: We will provide clear instructions for customers to opt out of receiving future direct marketing communications.
• Highlight customer rights: We will prominently state that customers have the right to request the cessation of direct marketing communications.

Dealing with Capti Online

1. Cookies:

When you visit our website, we store the internet protocol (IP) address of your computer. This information is used solely to generate broad demographic summaries of our user base.

Cookies are small data units sent to a user's browser by a visited website. We utilize cookies to:

• Facilitate the use of our website.
• Enhance our customers' browsing experience on our website.
• Monitor and analyze our customers' usage of our site and affiliated third-party sites.
• Enable us to deliver customized messages and offerings to our customers.

The cookies we use do not store personal data or collect personal information. However, if an individual is logged into "My Account" as a customer, the information collected via cookies may be linked to their personal information.

You have the option to configure your internet browser to delete cookies from your computer's hard drive, block cookies, or receive a warning before a cookie is stored. Please note that disabling or deleting cookies may limit access to certain content and functionalities on our websites.

2. Google Analytics:

Our website(s) may employ Google Analytics, a web analytics service provided by Google. Google utilizes the data collected to help us analyze how users utilize our websites. The information generated by the cookie regarding a customer's website usage, including their anonymized IP address, will be transmitted to and stored by Google on servers in the United States. Google will use this information to evaluate customer website usage, compile reports on website activity for website operators, and provide other related services.

Google will not associate your IP address with any other data held by Google. We may combine information collected through Google Analytics with other data we gather to provide you with relevant marketing content.

3. Use of Remarketing Tools:

We may utilize Google remarketing, Facebook remarketing, pixel tags, web beacons, clear GIFs, or similar technologies to collect information about a customer's visit to any of our websites. We may customize advertising or content based on the customer's usage of these sites. Third-party vendors may deliver these advertisements when you visit our websites or other internet sites. You have the option to opt-out of sharing information about your usage of this site or affiliated third-party sites by adjusting the settings on your device or browser.

We collect information about other websites visited by computers that access our site. This information may be aggregated to provide us with insights about the webpages and websites visited by users of our site.

Please note that this privacy policy does not apply to, and we are not responsible for, the use of information you provide to other websites linked from our website.

Disclosure of Personal Information to Third Parties

At Capti, we may disclose personal information about our customers to various third parties. Examples of such disclosures include:

• Telecommunications services: Disclosure may be made to the Telecommunications Industry Ombudsman for complaint management purposes.
• Directory assistance, emergency service calls, and urgent services: Personal information, including name, address, telephone service number, and other public number customer details, may be disclosed to the operator of the Integrated Public Number Database (IPND) for inclusion in the IPND. This information is used to develop directories and assist emergency service organizations. For unlisted phone numbers, appropriate privacy controls are applied within the IPND.
• Law enforcement agencies: Personal information may be disclosed to law enforcement agencies for law enforcement or security purposes.

We may also make the following disclosures:

• Government agencies: Personal information may be disclosed to government agencies, such as Centrelink, for the purpose of establishing or verifying eligibility for concessions and similar entitlements.
• Credit reporting agencies: Personal information may be disclosed to credit reporting agencies or credit collection agencies for credit checking, collection, or credit reporting purposes, in accordance with the requirements of the Privacy Act 1988.

Personal information obtained in connection with the provision of telecommunications services may be disclosed in compliance with the Telecommunications Act 1997 (Cth) and the Telecommunications (Interception and Access) Act 1979 (Cth). This includes disclosure to:

• Telecommunications Industry Ombudsman: Personal information may be disclosed to government agencies, such as Centrelink, for the purpose of establishing or verifying eligibility for concessions and similar entitlements.
• Credit reporting agencies: Personal information may be disclosed to credit reporting agencies or credit collection agencies for credit checking, collection, or credit reporting purposes, in accordance with the requirements of the Privacy Act 1988.
• Law enforcement agencies: Personal information may be disclosed to law enforcement agencies for law enforcement or security purposes.

Personal information obtained in connection with the provision of electricity and gas services may be disclosed in accordance with federal and state-based electricity and gas legislation and codes. This includes disclosure to:

• State-based energy Ombudsmen: Personal information may be disclosed to the relevant state-based energy Ombudsmen for complaint management purposes.
• Electricity and gas safety cases and urgent services: Disclosure may be made in connection with electricity and gas safety cases or other urgent services.
• Law enforcement agencies: Personal information may be disclosed to law enforcement agencies for law enforcement or security purposes.

We may also disclose personal information if required by law.

Disclosure of Personal Information Outside Australia

At Capti, we may disclose certain personal information to individuals or organizations located outside of Australia. These disclosures include:

• Customer service, systems and network and marketing operations: Our organization has departments based in the Philippines and India, who manage segments of our customer service, systems and network, and marketing operations. These personnel may access personal information about prospective, current, and past customers for sales and marketing activities, credit information management, customer service, correspondence, provisioning, fault management, and technical support.
• Database and web hosting: as part of our database and web hosting services, personal information may be transferred to IT service providers located in various countries, including India, Philippines, Singapore, New Zealand, the United Kingdom, Canada, and the United States of America. When we disclose personal information outside of Australia, we take necessary precautions to ensure the privacy and security of the information. We implement reasonable measures to establish appropriate safeguards and contractual arrangements in accordance with applicable privacy laws and regulations. These measures are designed to protect the confidentiality and integrity of your personal information throughout its transfer and storage process.

Protection of Your Personal Information

At Capti, we understand the importance of safeguarding your personal information and ensuring its completeness, accuracy, currency, and relevance.

When you contact us regarding your account or service, we conduct an ID check to verify your identity and ensure the accuracy of the details we have on record. For safety-critical information, such as medical data necessary for maintaining a secure power supply or ensuring priority assistance, we perform annual checks to verify the information.

We have established documented processes for verifying personal information collected for specific transactions, such as proof of occupancy, change of occupier, and priority assistance. Our staff undergo comprehensive training to handle different types of information, especially sensitive data. We have implemented quality assurance measures to monitor calls and ensure adherence to our processes.

While some personal information is kept in hardcopy format, the majority is stored in secure electronic databases. We have robust processes in place to maintain the security of our information systems and files, guarding against unauthorized access and interference.

We have contractual agreements with our agents, service providers, and affiliates, which require them to comply with applicable privacy laws and our privacy policies. For third parties located outside Australia, we ensure that the same level of protection is applied to the personal information we transfer to them, aligning with the standards set within Australia.

Accessing and Correcting Personal Information

You have the right to access the personal information we hold about you. If you wish to obtain details about the information we have provided to the Integrated Public Number Database (IPND), you are entitled to request it from us. To exercise this right, please contact us, and we will endeavor to provide you with the requested information within a reasonable timeframe, typically within 20 business days.

In cases where your request to access personal information is complex or requires extensive searching of our records, the Privacy Act allows us to charge a reasonable cost for providing you with this information. We will inform you of any applicable charges before proceeding with the request.

We are committed to providing access to the information we hold about individuals, including facilitating corrections or updates to that information, unless an exception under the Australian Privacy Principles (APPs) applies.

If you believe that the information we hold about you contains errors, is outdated, incomplete, irrelevant, or misleading, you have the right to request us to correct it. We will make the necessary corrections, ensuring compliance with the requirements set by the Integrated Public Number Database (IPND). There is no charge for accessing or correcting your information in the IPND.

Complaints and Additional Information

If you have a complaint regarding a breach of the Australian Privacy Principles, you can contact our Privacy Officer using the contact details provided below.

Our Privacy Officer will thoroughly investigate your complaint and provide you with a response within a reasonable timeframe, typically within 30 days. If you are not satisfied with our decision or the outcome of the investigation, you have the option to escalate your complaint to the Office of the Australian Information Commissioner (OAIC). To initiate this process, you can visit the OAIC website at www.oaic.gov.au.

For further information on how we manage personal information, to request access to or correction of your personal information, or to lodge a complaint, please reach out to:

• Privacy Officer Attention: The Privacy Officer
• Email: privacy@capti.com.au
• Address: Shop 1, Level 1/9 Sherwood Rd, Toowong QLD 4066, Australia

We are committed to addressing any concerns or inquiries you may have and ensuring the proper handling of your personal information.