1. Introduction

Hancock Victorian Plantations Pty Limited and its subsidiary Grand Ridge Plantations Pty Ltd (“HVP, we, us, our”) are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) (collectively Privacy Law).

HVP is committed to protecting your personal information. Personal information is information or an opinion that either identifies, or has the potential to, identify you. This policy outlines what information we collect and hold and how we collect, hold, use, disclose and manage your personal information. It also explains how you can access and correct your personal information and how you can contact us.

2. What information do we collect and hold?

During the course of our business we may collect personal information about you. We only collect personal information reasonably necessary to conduct our business including:

• to undertake fire prevention, management and response (contact details, qualifications, health checks, location data);
• to supply our customers (e.g. contact details, financial information, purchasing history);
• to engage suppliers of goods or services (e.g. contact details, bank account details, insurance details);
• to engage with stakeholders (including our neighbours) (e.g. contact details, history of interactions);
• to allow you to access our plantations (e.g. contact details, video footage on surveillance cameras and information in connection with the permitted purpose);
• to engage with us, including to answer enquiries and deal with complaints (contact details, details about the reason for contact and appropriate actions);
• to provide you access to our website (e.g. IP address, domain name, contact details and other information that you submit to us via our website);
• when you apply for a job with us (e.g. the information you include in your application);
• when you are an employee or contractor of ours (e.g contact details, identification information, bank details, financial and superannuation information, health checks, qualifications, location data).

We may collect sensitive information (as defined in the Privacy Law) in some circumstances, for example, for employee and contractor health checks. Unless permitted by law, we will only collect sensitive information with your consent.

You may choose to remain anonymous, or to use a pseudonym when dealing with us where it is lawful and practical for you to do so, however in many cases identification may be necessary.

In some cases, we may receive personal information about you that we did not ask for. If this occurs, we will handle the personal information in the same way as we handle personal information we collect from you. If we could not have collected this information from you, we will delete or deidentify the information as soon as practicable (provided that it is lawful and practical for us to do so).

3. How we collect and hold your personal information

We generally collect personal information from you directly. We may collect your personal information by telephone, online via our website (including through the use of cookies), electronically by email, through written correspondence and through the use of surveillance systems.

We may collect location data via our mobile and remote telemetry devices to help manage the risks associated with driving, working in remote locations, lone work, accessing operational sites, for fire emergency response and other safety related reasons.

We may also collect personal information from publicly available sources (such as land databases and business registers) or from third parties (such as government departments or credit reporting agencies).

4. Using or disclosing your personal information

We use and disclose your personal information for the purposes for which we collect it (the primary purpose).

We will not use or disclose it for another purpose (secondary purpose) unless:

• you have consented;
• you would reasonably expect us to use or disclose the information for the secondary purpose and the secondary purpose is related to the primary purpose;
• it is otherwise required or authorised by law;
• a permitted general situation exists;
• a permitted health situation exists; or
• it is reasonably necessary for an enforcement activity of an enforcement body.

In relation to sensitive information any secondary purpose will be directly related to the purpose for which it was collected.

We may disclose your personal information to third parties to enable us to conduct our business, including to:

• our Related Bodies Corporate and our directors and officers including in Australia, the United States and Canada;
• our auditors, including in Australia and elsewhere; and
• regulatory or government agencies.

Some of your personal information may be disclosed, processed or stored overseas (including by our third-party service providers), including in the United States of America and Asia. We take reasonable steps to ensure that overseas recipients comply with the Privacy Laws.

We will never use your personal information with a public or untrusted Artificial Intelligence (AI) tool (examples include ChatGPT, Claude and Gemini). Our use of AI will be in accordance with our AI Policy (available upon request).

5. Management and security of your personal information

We store your personal information in various ways, primarily in electronic form which is predominantly managed internally by us but may, in some circumstances, be managed by a third-party service provider. HVP will take reasonable steps to keep any information we hold about you secure and protect it from misuse, loss, unauthorised access, modification or disclosure.

We keep personal information only for as long as it is required for its purpose or as otherwise required by law.

If we become aware of a suspected personal information data breach, we will conduct an appropriate assessment to determine if there is a likely risk of serious harm to any individual associated with a data breach in accordance with our IT Data Breach Response Policy and Procedure and otherwise comply with all applicable laws.

6. Other linked websites

Where HVP provides a link to other websites which are outside of the HVP Network, we advise you to examine the terms and conditions of using the other websites. These linked websites are not under the control of HVP, and we cannot accept responsibility if you provide your personal information on any other website.

7. How can I access and correct my personal information

Under Privacy Law you have a right to seek access to personal information we hold about you. You also have the right to ask us to correct information we hold about you that is inaccurate, incomplete or out of date. We will comply with any such request except where Privacy Law allow us to refuse to do so.

While we try to ensure that your personal information is complete and up to date, this is not always possible, so please notify us of any changes or errors in your information held by us.

8. Contacting us with a question or compliant

If you have any questions or complaints about how we handle your personal information, you can contact us during business hours at:

HVP Plantations
Attention: Privacy Officer
Level 12, Tower 4, World Trade Centre,
18-38 Siddeley Street, Melbourne, Victoria, 3005
telephone 613 9289 1400,
email privacy@hvp.com.au

Any complaints notified to us will be considered within 30 business days and responded to.

If you are not satisfied with how we handle your enquiry or complaint, you can contact the Office of The Australian Information Commissioner on Tel: 1300 363 992 or email: enquiries@oaic.gov.au.

For more information about privacy in Australia and protecting your privacy, visit the Office of the Australian Information Commissioner’s website at www.oaic.gov.au.

9. Review

We may vary this policy from time to time by publishing an updated version on our website. If you would like a copy of our privacy policy, please contact us.