Privacy Policy

This policy explains how Relait Pty Ltd ACN 681 274 760 (“Relait”, “we”, “us”) handles personal information. It covers our website, our platform and the services we provide to listed companies, referred to together as the “Services”.

We handle personal information in accordance with the Privacy Act 1988 (Cth) (“Privacy Act”) and the Australian Privacy Principles (“APPs”).

1. Whose information this policy covers

This policy applies to personal information about:

• people who use our Services, including staff and officers of our customers;
• people who contact us, request a demonstration or subscribe to our communications;
• holders of securities in our customers, and the beneficial owners behind those holdings, where we handle that data as part of delivering the Services (see clause 2);
• our own shareholders; and
• our contractors, suppliers, job applicants and employees.

2. Register, holder and beneficial ownership data

Most of the personal information we handle is not about our own users. It is data about the shareholders of the listed companies we provide the Services to. This clause explains how we treat it, because it is the most sensitive information we hold.

2.1 What it is
Acting on our customer’s instructions, we receive and process share register data, holder contact details, holding balances and movements, nominee and custodian account data, beneficial ownership data obtained through disclosure notices issued under section 672A of the Corporations Act 2001 (Cth), and records of shareholder engagement such as email delivery and website activity. We call this “Register Data”.

2.2 Our role
We handle Register Data on behalf of, and under the instructions of, the listed company that holds the subscription. That company decides what data enters the platform and what it is used for. We do not decide those things.

2.3 What we will and will not do with it
• We use Register Data only to deliver the Services to the customer that supplied it.
• We do not sell Register Data.
• We do not use Register Data to market to the individuals in it on our own behalf.
Relait Pty Ltd ACN 681 274 760 Page 1 of 6
45 St Georges Terrace, Perth WA 6000 | hello@relait.com.au
• We do not disclose Register Data to any other customer, and we do not combine one customer’s Register Data with another’s.
• We may create data that has been irreversibly aggregated and de-identified, so that no company, holder or individual can be identified or re-identified from it, and use that aggregated data to operate and improve the Services or for other business purposes.

2.4 Individual enquiries about Register Data
If you are a shareholder and you want to access or correct your details, contact the company you hold shares in, or its share registry. They hold the source record. If you contact us directly we will refer you to them, and we will assist them in responding.

2.5 Disclosure notices
Where we issue or manage a disclosure notice under section 672A of the Corporations Act on a customer’s behalf, we do so as the customer’s agent. Responses to those notices are the customer’s information. We retain them for the customer and handle them under this policy.

3. What information we collect

The personal information we collect about users and contacts may include name, business address, telephone number, email address, job title, company name, billing details and records of your communications with us.

For our own shareholders we may also collect tax file numbers and bank account details in order to register a holding, in some cases through a share registry provider we engage.
For job applicants and staff we collect information about education, qualifications and employment history.
We also collect information that does not identify you, such as aggregate usage statistics.

4. How we collect it

4.1 Directly from you. When you complete a form on our website, request a demonstration, contact us, register for or use the Services, or correspond with us.

4.2 Automatically through your use of the Services. Including your IP address, approximate location derived from it, device and browser type, pages viewed, features used and files uploaded. We use this to operate the Services and to understand how they are used.

4.3 From our customers. Where a customer gives you access to the Services, or provides your details as an administrator, billing contact or technical contact.

4.4 From third parties. From share registry providers and other service providers engaged to deliver the Services, from our channel partners, and from public sources such as ASX announcements and company registers.

4.5 If you give us personal information about another person, you must have that person’s authorisation and must tell them how we handle personal information under this policy.

5. Why we use personal information

We use personal information for the following purposes:

• to provide the Services, including creating and administering accounts and providing support;

• to operate, maintain, secure and improve the Services;

• to communicate with you about the Services, including service, security and administrative messages;

• to bill and collect payment;

• to market our Services to business contacts, subject to your right to opt out under clause 11;

• to recruit and manage staff and contractors;

• to meet our legal and regulatory obligations, and to establish, exercise or defend legal claims; and

• for any other purpose you have consented to.

Where we use data to improve the Services, we do so using aggregated and de-identified data wherever it is practicable to do so. Register Data is subject to the additional restrictions in clause 2.3.
If you choose not to provide personal information we ask for, we may not be able to provide the Services to you.

6. When we disclose personal information

6.1 To service providers. We engage providers for cloud hosting and storage, backup, payment processing, email delivery, customer support tooling, analytics and professional services. Where a provider needs access to personal information to perform its work, it does so under our instruction and under obligations of security and confidentiality. We will give a customer details of the providers that handle its data on request.

6.2 To our customers. Where you access the Services through an organisation, that organisation’s administrator can access information about your account and your use of the Services.

6.3 To channel partners. Where a partner has introduced or resells a subscription, we may share account and billing information with that partner for the purpose of servicing the subscription.

6.4 To share registries. Where necessary to connect a customer’s account, obtain register data or issue disclosure notices on the customer’s instruction.

6.5 Where required or permitted by law. Including to comply with a law, regulation, court order or request from a government agency, to enforce our agreements, or to protect the security of the Services or the rights of Relait, our customers or others.

6.6 On a corporate transaction. We may disclose information in connection with a merger, financing, or sale of all or part of our business. We will notify affected customers if that occurs.

6.7 With your consent. For example, where you agree to be named in a testimonial or case study.

We do not sell personal information.

7. Overseas disclosure

7.1 The platform, and the customer data held in it including Register Data, is hosted in Australia. Some of the supporting services we use, such as email delivery, payment processing and support tooling, operate from outside Australia.

7.2 Some of the service providers we engage are located overseas, or may access data from overseas, principally from the United States. Where that happens we take reasonable steps to ensure the provider handles personal information consistently with the APPs, including through contractual obligations.

7.3 A customer may ask us at any time for the current list of providers that handle its data and the countries involved.

8. Security

8.1 We use technical and organisational measures appropriate to the sensitivity of the information we hold. These currently include:

• encryption of data in transit and at rest;
• access limited by role, so that personnel can access only the data they need for their duties;
• logging of administrative and support access to customer data;
• regular backups, held under the same protections as production data; and
• assessment of service providers before they are given access to customer data.

8.2 We review these measures and improve them over time. Where we change a specific measure, we do not reduce the overall level of protection.

8.3 We ask you to help by choosing a strong, unique password, keeping it private, and signing out when using a shared device.

8.4 No system is free from risk. We implement safeguards designed to protect information, but we cannot guarantee that information transmitted over the internet or held in our systems is secure against every form of intrusion.

9. Data breaches

9.1 If we become aware of unauthorised access to, unauthorised disclosure of, or loss of personal information we hold, we will assess it promptly and take steps to contain and remedy it.

9.2 Where the information affected belongs to a customer, we will notify that customer in writing without undue delay, and in any event within 72 hours of becoming aware of the incident. A customer’s subscription agreement may set a shorter period, in which case that period applies.

9.3 Where an eligible data breach under Part IIIC of the Privacy Act is likely to result in serious harm, we will notify the Office of the Australian Information Commissioner and affected individuals as the Privacy Act requires, and will co-operate with any customer in meeting its own obligations.

10. Retention

10.1 We keep personal information only for as long as we need it for the purposes described in this policy, or for as long as the law requires.

10.2 Customer data, including Register Data, is retained for the term of the customer’s subscription. On termination we provide an export on request and then delete identifiable customer data, subject to routine backups and any legal retention requirement. The customer’s subscription agreement sets out the detail.

10.3 Where we cannot delete information immediately, for example because it sits in backup archives, we isolate it from further use until deletion is possible.

10.4 Marketing information is kept for a reasonable period after you last engaged with us.

11. Your rights

11.1 Access and correction. You may ask us to confirm what personal information we hold about you and to provide a copy. You may ask us to correct it. We may ask you to verify your identity first. We will respond within 30 days. If we refuse a request, we will explain why in writing.

11.2 Deletion. You may ask us to delete personal information we hold about you. We may need to retain some information to complete a transaction, keep records or meet a legal obligation, and we will tell you if that applies.

11.3 Marketing opt-out. Every marketing email includes an unsubscribe link. You can also ask us to stop marketing to you by writing to the address in clause 15. You will continue to receive service messages relating to any subscription you use.

11.4 Anonymity. We generally cannot provide the Services to you anonymously or under a pseudonym.

11.5 Access through an organisation. If your access to the Services was provided by an organisation, contact that organisation’s administrator first. We will assist them.

12. Complaints

12.1 If you believe we have handled your personal information in breach of the Privacy Act or this policy, write to us at the address in clause 15. We will acknowledge your complaint within 5 business days and respond substantively within 30 days.

12.2 If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

13. Cookies and website analytics

13.1 Our website uses cookies, small files stored on your device, to remember your preferences, to keep forms and subscriptions working, and to measure how the site is used.

13.2 We use third-party analytics on our website to understand which pages are read and how visitors arrive. Those providers set their own cookies and handle the data under their own privacy policies.

13.3 You can block or delete cookies through your browser settings. Some parts of the website may not work correctly if you do.

14. Other matters

14.1 Individuals outside Australia. Where we handle personal information about individuals in the European Economic Area, the United Kingdom or California, we handle it in accordance with this policy and take the steps applicable law requires of us. Contact us if you wish to exercise a right available to you under the law of your jurisdiction.

14.2 Children. The Services are designed for use by listed companies and their advisers, and are not directed at people under 16. We do not knowingly collect personal information from a person under 16. If we become aware that we have, we will take reasonable steps to delete it.

14.3 Changes to this policy. We may amend this policy. We will publish the amended version on our website with a new version number and date. Where a change materially affects a customer, we will give that customer at least 30 days’ written notice, and where the customer’s subscription agreement states that a particular version applies, that version applies for the period stated.

15. Contact us

Write to our privacy officer with any question, request or complaint about personal information.

Entity Relait Pty Ltd, ACN 681 274 760
Attention Privacy Officer
Address 45 St Georges Terrace, Perth WA 6000
Email hello@relait.com.au
Version 2.0, July 2026