PRIVACY & CONTACT CONSENT POLICY

ROIC Business Group

Last updated: June 2026

Protecting your privacy

Protecting your privacy and the confidentiality of your personal information is important to ROIC Pty Ltd ACN 661 241 318, trading as ROIC Business Group, and its divisions ROIC Business Sales, Geelong Business Sales, ROIC Advisory and ROIC Commercial (we, us, our). This Privacy & Contact Consent Policy applies across all ROIC divisions. We value your trust and are bound by the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth), which set out how we must handle your personal information.

In this policy we describe how we meet our privacy obligations concerning the collection, use, and disclosure of your personal information.

This Privacy & Contact Consent Policy explains:

• how we collect, manage, and protect your personal information.

• how you can access the information we hold about you.

• how you can request that we correct your information.

• how you can make a complaint if you have concerns about how your information is managed; and

• how we may contact you by email.

Personal information

The Privacy Act sets out the information that it protects.

Personal information means information or an opinion about an individual whose identity is apparent, or can reasonably be ascertained, from the information or opinion. It does not matter whether the information or opinion is true, or whether it is recorded in a material form.

Some personal information is sensitive. Sensitive information is information or an opinion about an individual:

• racial or ethnic origin.

• political opinions or membership of a political association.

• religious beliefs or affiliations.

• philosophical beliefs.

• membership of a professional or trade association.

• membership of a trade union.

• sexual orientation or practices.

• criminal record.

• health information.

• genetic information; or

• biometric information.

We will not collect, use, or disclose sensitive information about you unless it is necessary to provide our services to you and we have your consent, or we are otherwise required or authorised by law.

What personal information is collected?

We only collect personal information that is relevant to assist us in conducting our business activities and to provide you with the range of services we offer. If we do not collect your personal information, we may not be able to provide you with a service.

The kind of information we are likely to collect includes your name, address and contact details, your date of birth, and details about your financial circumstances, goals, and strategies. We generally collect this information directly from you — for example, when you fill out a form, when we speak on the phone, when you use one of our websites, or when you meet with one of our representatives.

We may also collect publicly available information, or collect information from third parties such as:

• credit reporting bodies, with your consent, if we require information about your credit history; and

• our related divisions, so that we can provide a comprehensive service to you.

Consequences of not providing your personal information

You are not obliged to give us your personal information. However, if you decide not to give us your information, we may not be able to provide our services to you.

How is your personal information collected?

We usually only collect your personal information directly from you.

It may be necessary to collect personal details from third parties — for example, issuers or operators of financial products or financial services.

If we collect sensitive information, we will not do so without your consent (subject to some exceptions, for example where collection is required by law). We will endeavour to collect such information directly from you wherever possible.

When we collect personal information about you, we will tell you why it is being collected, the organisations (or types of organisations) to whom we usually disclose that kind of information, any law that requires the information to be collected, and the main consequences for you if the information (or part of it) is not provided. We will also give you our contact details and tell you how you can access the information.

We store personal information in Australia and overseas, including the United States, where some of our service providers are located.

How is your personal information used?

Personal information is collected so that we can provide you with the services you request. This is known as the primary purpose for the collection of personal information.

The types of secondary purposes for which we would ordinarily use or disclose your personal information include contacting you regarding other services that we believe may be of interest to you. We will also use or disclose information where such use or disclosure is required by law or is necessary in connection with dealing with unlawful activity or threats to life, health, or safety.

Some of the uses described above will require disclosure of your personal information to third parties. We will require that any third party to whom we disclose personal information only uses that information for the purposes for which we disclosed it to them, and on the basis that they comply with their privacy obligations.

How is your personal information disclosed?

We may use your personal information to identify a product or service that may be of interest to you and may contact you to let you know about new or existing products or services. We may disclose your personal information to associated entities or businesses, the seller of a business, or another client, where relevant to the services we provide.

We may also disclose your information to overseas recipients (including in the United States) where we use service providers to perform some functions on our behalf, and only when it is necessary.

Data quality and protection

We take reasonable steps to protect your personal information from misuse, interference, and loss, and from unauthorised access, modification, and disclosure. We have processes in place to ensure that your personal information is only accessible by those who are authorised to access it.

We may store your personal information in hardcopy documents or by electronic means. We maintain physical and electronic security systems to ensure your personal information is protected at all times.

Once your personal information is no longer required by us, we will take reasonable steps to destroy or permanently de-identify that personal information.

Data access and correction

We strive to maintain current records. To help us do this, please let us know as soon as possible if any of your details change, or if there is any change to your circumstances.

If you think the personal information we hold is not accurate, complete, or up to date, you should contact us.

We will need to verify your identity before providing you with any personal information. We will usually provide access to you at our office at Level 4, 90 William Street, Melbourne, Victoria 3000.

If you require access to the personal information we hold about you, please send us an email. We will allow access, unless certain exceptions apply — for example, if providing access would pose a serious threat to the life, health or safety of any person, would prejudice action being taken by an enforcement body, or would be unlawful.

Your request should specify the information to which you require access. We will keep a record of your request for access and how it was dealt with.

We will not charge you for requesting access to your personal information. We may, however, charge you the costs associated with meeting your request — for example, a processing fee, or photocopying and postage costs.

We will aim to respond to your request within 30 days of receipt. If we cannot meet your request for access or correction, we will provide our reasons by email.

Use of this website

This website contains links to other websites, whose operators may or may not adhere to a privacy policy or be governed by the Australian Privacy Principles.

The information collected about you by this website depends on the options you access on the website. Anonymous data is collected from our website to evaluate its performance. Our website may use ‘cookies’ that allow us to identify your browser while you are using our site. Cookies do not identify you; they simply allow us to track usage patterns so that we can measure the level of interest in various areas of our site. All browsers allow you to be notified when you receive a cookie, and to elect to either accept it or not. Your internet service provider should be able to assist you in setting your preferences.

We will retain any emails submitted by you to us and may use your email address to send information that may be of interest to you. You can at any time request us to remove your email address from our mailing list.

Your personal information that is recorded on our server is protected by encryption technology and a system of secure passwords, logons, and other security procedures.

If you are concerned

If you believe your privacy has been compromised, or that we have breached the Privacy Act or the Australian Privacy Principles, you are entitled to complain. Please contact the ROIC representative you have been dealing with, or write to us using the details below:

• Email: support@roicbusinessgroup.com.au

• Address: Level 4, 90 William Street, Melbourne, Victoria 3000

If you are not satisfied with our response, you may refer your complaint to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or on 1300 363 992.

How this policy changes

This policy may change from time to time. The current version will be published on our website; with the date it was last updated shown at the top of this policy.

ROICBUSINESSGROUP.COM.AU