G&G Advisory Partners Pty Ltd (G&G, we, us or our) provides mergers and acquisitions, business sale, acquisition, valuation, exit-readiness and related corporate advisory services.

This policy explains how we collect, hold, use and disclose personal information, how individuals may access or correct their information, and how privacy concerns may be raised. We are committed to complying with the Privacy Act 1988 (Cth), including the Australian Privacy Principles (APPs), to the extent they apply to us. We may also choose to follow these standards as a matter of good practice where they do not strictly apply.

This policy applies to personal information handled through our website, enquiries, professional relationships, mandates and transaction processes. It does not form part of our website terms of use or any client engagement agreement.

Personal information is information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information is true or not and whether it is recorded in a material form or not.

Sensitive information is a category of personal information that includes information about matters such as a person's health, racial or ethnic origin, religious beliefs, political opinions, professional or trade association membership, union membership, sexual orientation or practices, biometric information and criminal record.

The kinds of personal information we collect and hold depend on the nature of our relationship with you and the transaction or service involved. They may include:

• identity and contact information, including names, job titles, addresses, telephone numbers and email addresses;
• professional and business information, including employment history, qualifications, directorships, shareholdings, business interests and professional relationships;
• financial and transaction information, including ownership interests, remuneration, bank or payment details, financial position, tax information and information relevant to valuing or negotiating a business or transaction;
• verification and compliance information, including identification documents and information collected for conflict, sanctions, anti-money laundering, fraud prevention or other legal and risk-management checks;
• information contained in transaction materials or data rooms, which may include information about directors, shareholders, employees, contractors, customers, suppliers, guarantors and other stakeholders;
• communications and records of our dealings with you, including meeting notes, correspondence, instructions, preferences, complaints and feedback;
• website and technical information, including IP address, device and browser information, pages viewed, referral source, cookies and similar technologies; and
• marketing preferences and information about attendance at events or engagement with our communications.

Where lawful and reasonably necessary, we may also collect sensitive information. We do not seek to collect sensitive information merely because it is included in a broader transaction file.

We may collect personal information:

• directly from you, including through meetings, calls, emails, website forms, questionnaires, engagement documents and other communications;
• from our clients, prospective clients, transaction counterparties, buyers, sellers, investors, lenders and their respective representatives;
• from professional advisers and service providers, including lawyers, accountants, consultants, insurers, brokers and due-diligence providers;
• through virtual data rooms, management presentations, financial models, reports and other transaction materials;
• from referees, introducers, industry contacts and referral partners;
• from publicly available sources, including company registers, professional profiles, websites, media, court or regulatory records and commercial databases; and
• automatically when you use our website or interact with our electronic communications.

Where reasonable and practicable, we collect personal information directly from the individual concerned. If we receive unsolicited personal information, we will determine whether we could lawfully have collected it. If not, we will take reasonable steps to destroy or de-identify it, unless we are required or authorised by law to retain it.

You may interact with us anonymously or using a pseudonym where lawful and practicable. In many advisory and transaction contexts, however, we need to know who we are dealing with and may be unable to provide services without sufficient identifying information.

We may handle personal information for purposes including to:

• respond to enquiries and assess whether and how we can assist;
• provide, administer and improve our advisory services, including business sales, acquisitions, valuations and exit-readiness engagements;
• prepare transaction materials, identify and engage potential buyers or targets, evaluate strategic fit, conduct or coordinate due diligence, support valuation analysis, negotiate and complete transactions;
• communicate with clients, prospective clients, counterparties and advisers, manage relationships and provide updates;
• verify identity, authority and ownership, undertake conflict and risk checks, and comply with legal, regulatory, professional and contractual obligations;
• protect confidential information, prevent fraud or misconduct, manage disputes and establish, exercise or defend legal claims;
• engage suppliers, administer contracts, issue invoices, process payments and maintain business records;
• operate, secure, analyse and improve our website, systems and business processes;
• send relevant insights, event invitations and other marketing communications in accordance with law; and
• carry out internal governance, insurance, audit, training, quality assurance, business planning and reporting.

We may use or disclose personal information for a related secondary purpose where you would reasonably expect us to do so, with your consent, or where otherwise required or authorised by law.

M&A processes can involve information about people who are not directly engaging us, including employees, contractors, customers, suppliers, shareholders and guarantors. We may receive this information from a client or another transaction participant and handle it to the extent reasonably necessary for the mandate, subject to confidentiality arrangements and applicable law.

Clients and other persons providing transaction materials should only provide personal information that is reasonably necessary for the relevant purpose. Where practicable, personal information should be aggregated, de-identified or redacted before it is uploaded to a data room or shared with potential transaction participants. Particularly sensitive records—such as identity documents, health information, individual bank details or full employee files—should not be provided unless specifically requested and a lawful basis and appropriate safeguards have been established.

We will generally collect sensitive information only with the individual's consent and where it is reasonably necessary for our functions or activities, or where another exception under applicable law permits collection. We will use and disclose sensitive information only for the purpose for which it was collected, for a directly related purpose where permitted, with consent, or as required or authorised by law.

Depending on the circumstances and subject to applicable confidentiality obligations, we may disclose personal information to:

• our clients and their authorised personnel;
• actual or prospective buyers, sellers, acquisition targets, investors, lenders, funders, counterparties and their representatives where authorised or reasonably necessary for a transaction process;
• professional advisers and transaction service providers, including legal, accounting, tax, financial, insurance, valuation, specialist due-diligence and consulting providers;
• technology and operational service providers, including cloud hosting, data-room, document management, customer relationship management, cybersecurity, website, analytics, communications and payment providers;
• our insurers, auditors and other advisers;
• courts, regulators, law-enforcement bodies, government agencies or other persons where required or authorised by law; and
• a purchaser, investor or successor in connection with a proposed or completed sale, merger, reorganisation or transfer of all or part of our business, subject to appropriate confidentiality and privacy protections.

We do not sell personal information.

Some recipients of personal information may be located outside Australia. This may occur where a transaction involves overseas buyers, targets, investors, advisers or counterparties, or where our technology and service providers operate or store information overseas.

The countries involved will depend on the particular transaction and the systems we use. They may include New Zealand, the United Kingdom, the United States, countries in the European Economic Area, and other jurisdictions in which relevant transaction participants or service providers are located. It is not always practicable to identify every country in advance.

Where required, we will take reasonable steps to ensure that an overseas recipient handles personal information consistently with the APPs, unless an exception applies. Overseas recipients may be subject to different privacy laws and, in some circumstances, foreign authorities may lawfully access information held in their jurisdiction.

When you visit our website, our systems and service providers may collect technical information such as your IP address, browser and device type, pages viewed, time and date of access and the website from which you arrived. We may use cookies, analytics tools, pixels and similar technologies to operate and secure the website, remember preferences, understand usage and improve our services and communications.

You can adjust your browser settings to block or delete cookies. Doing so may affect how parts of the website function. Where required, we will seek consent before using non-essential tracking technologies. Third-party tools are also subject to their providers' privacy policies.

We may use personal information to send professional updates, insights, invitations and information about services that we reasonably believe may be relevant to you, where permitted by law. You may opt out at any time by using the unsubscribe facility in a communication or contacting us. We will action opt-out requests within a reasonable period and will not charge you for doing so.

We take reasonable technical and organisational steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. Measures may include access controls, multi-factor authentication, secure cloud and data-room platforms, encryption where appropriate, confidentiality obligations, staff training, vendor due diligence, backups and incident-response processes.

No method of electronic transmission or storage is completely secure. While we take reasonable steps to protect information, we cannot guarantee absolute security. If you become aware of a suspected privacy or security incident involving information held by us, please contact our Privacy Officer promptly.

We retain personal information for as long as reasonably necessary for the purposes described in this policy, to meet legal, regulatory, insurance and professional obligations, to resolve disputes and to maintain appropriate business records. Client and transaction files will generally be retained for at least seven years after completion of the relevant engagement or transaction, and may be retained longer where reasonably necessary or required by law.

When personal information is no longer required, we will take reasonable steps to destroy it securely or de-identify it, subject to any legal or legitimate retention requirement. Backup copies may remain for a limited period until overwritten in the ordinary course.

You may request access to personal information we hold about you or ask us to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading. Please contact our Privacy Officer using the details below and provide enough information for us to identify you and the relevant records.

We may need to verify your identity before responding. We will respond within a reasonable period. We will not charge for making a request, although we may charge a reasonable amount for the cost of providing access where permitted by law. In some circumstances, the law permits or requires us to refuse access or correction. If so, we will generally provide written reasons and information about available complaint mechanisms, unless it would be unreasonable or unlawful to do so.

If you believe we have mishandled your personal information or breached an applicable privacy obligation, please contact our Privacy Officer. Please describe the issue and provide any relevant supporting information.

We will acknowledge the complaint and aim to provide a substantive response within 30 days. If more time is needed, we will let you know. We will investigate fairly, keep you informed where appropriate and explain the outcome and any steps we propose to take.

If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC). Information about making a complaint is available at www.oaic.gov.au/privacy/privacy-complaints.

We maintain processes for responding to suspected data breaches. Where the Notifiable Data Breaches scheme applies and a breach is likely to result in serious harm, we will assess the incident and notify affected individuals and the OAIC as required by law. We may also notify individuals in other circumstances where we consider it appropriate to help them protect themselves.

Our website may contain links to third-party websites. We are not responsible for the privacy practices or content of those websites and encourage you to review their privacy policies before providing personal information.

We may update this policy from time to time to reflect changes to our practices, services, technology or legal obligations. The current version will be published on our website and will state its effective date. Material changes may also be notified through other appropriate channels.

For access or correction requests, privacy questions, complaints or suspected data breaches, please contact:

• Contact: Privacy Officer
• Entity: G&G Advisory Partners Pty Ltd (ABN 47 701 174 478)
• Email: contact@ggpartners.com.au
• Telephone: +61 402 023 840
• Website: www.ggadvisorypartners.com.au

Postal correspondence may be addressed to the Privacy Officer at G&G Advisory Partners Pty Ltd's principal business address, as published on our website or otherwise provided on request.

These Website Terms of Use (Terms) apply to your access to and use of www.ggadvisorypartners.com.au and any related webpages operated by G&G Advisory Partners Pty Ltd (G&G, we, us or our) (Website).

By accessing or using the Website, you agree to be bound by these Terms and our Privacy Policy. If you do not agree, you must not use the Website. You should read these Terms before relying on any Website content or submitting information through the Website.

G&G provides mergers and acquisitions, business sale, acquisition, valuation, exit-readiness and related corporate advisory services (Advisory Services). The Website provides general information about G&G, our experience, our approach and matters relevant to businesses, owners and acquirers.

In these Terms, Content means all text, reports, articles, transaction commentary, graphics, photographs, videos, downloads, branding, software and other material made available through the Website.

Website Content is provided for general information only. It is not financial product advice, investment advice, legal advice, tax advice, accounting advice, valuation advice or a recommendation to enter into, avoid or complete any transaction.

Business values, transaction outcomes and market conditions depend on facts that may not be apparent from publicly available information. Any valuation ranges, transaction multiples, case studies, market observations, forecasts or examples on the Website are illustrative or historical only. They are not a promise, prediction or guarantee of value, timing, saleability or outcome.

You should obtain advice appropriate to your circumstances before acting or refraining from acting in reliance on Website Content. You remain responsible for your own decisions and enquiries.

Accessing the Website, downloading Content, subscribing to updates or contacting us does not create an adviser-client, fiduciary, confidential or other professional relationship between you and G&G.

G&G only accepts an advisory engagement after completing its acceptance procedures and entering into a written engagement agreement with the relevant client. Until then, we do not owe you duties arising from an advisory engagement and may act for another person whose interests differ from or conflict with yours, subject to law and our professional obligations.

Nothing on the Website constitutes an offer to provide Advisory Services, an offer or invitation to buy or sell a business, security or financial product, or a representation that any opportunity is available. We may accept or decline a proposed engagement in our discretion.

If G&G provides Advisory Services to you, those services will be governed by a separate written engagement agreement, mandate letter or other agreed terms. If there is any inconsistency between these Terms and that agreement in relation to the Advisory Services, the engagement agreement prevails to the extent of the inconsistency.

We grant you a limited, revocable, non-exclusive and non-transferable right to access and use the Website and Content for your personal or internal business information purposes, in accordance with these Terms and applicable law.

You may print or download reasonable extracts of Content for those purposes, provided you do not remove any copyright, trade mark, source or proprietary notice and do not alter the Content in a misleading way.

You must not, and must not attempt to or assist another person to:

• use the Website unlawfully, fraudulently, deceptively or in a way that infringes another person's rights;
• copy, reproduce, publish, distribute, sell, license, modify, adapt or commercially exploit Content except as expressly permitted by these Terms or with our prior written consent;
• misrepresent G&G's Content, credentials, involvement, endorsement or relationship with any person or transaction;
• introduce malware or harmful code, probe or breach security, interfere with Website operation, or gain unauthorised access to systems, accounts or data;
• scrape, harvest, index or systematically extract Content or personal information using automated means, except for ordinary search-engine indexing that complies with our technical instructions;
• reverse engineer or attempt to derive source code from any Website software, except to the extent a right cannot lawfully be excluded; or
• use the Website in a manner that could damage, disable, overburden or impair it or another person's use of it.

You warrant that information you submit through the Website is accurate, lawful, not misleading and that you are authorised to provide it. You must not submit material that infringes another person's rights or contains malicious code.

Unless we have agreed otherwise in writing, do not send confidential transaction information, data-room materials, personal identity documents, legally privileged material or other sensitive information through a general Website form. An enquiry does not create confidentiality obligations beyond those imposed by law or expressly accepted by us. If we ask you to provide sensitive material, use the secure method we nominate.

You retain ownership of material you submit. You grant us a non-exclusive right to use, reproduce and disclose it to the extent reasonably necessary to respond to your enquiry, operate and secure the Website, comply with law and exercise or defend legal rights, subject to our Privacy Policy and any applicable written confidentiality agreement.

Unless otherwise stated, G&G or its licensors own all intellectual property rights in the Website and Content, including copyright in original articles, reports, layouts, graphics, photographs, databases and software. All rights not expressly granted are reserved.

You must not use G&G's name, logos, business names, trade marks or branding without our prior written consent. Third-party names and marks appearing on the Website remain the property of their respective owners and do not imply endorsement or affiliation.

The Website may contain links to, or content, tools or services supplied by, third parties. They are provided for convenience or information only. Unless expressly stated, we do not control, endorse or approve them and are not responsible for their availability, security, privacy practices, terms, accuracy or content.

Your use of a third-party website or service is at your own risk and may be subject to separate terms. You may link to our home page or an article in a fair and lawful way that does not suggest association, approval or endorsement. We may ask you to remove a link at any time.

We take reasonable care in preparing the Website, but Content may be incomplete, generalised, out of date or affected by errors or omissions. Market, regulatory and transaction information can change quickly. We do not undertake to update Content or notify users when it changes.

We may change, suspend, withdraw or restrict any part of the Website without notice. We do not guarantee uninterrupted, timely, secure or error-free access, or that the Website will be free from viruses or other harmful components. You are responsible for using appropriate security protections and maintaining backups.

Nothing in these Terms excludes, restricts or modifies any consumer guarantee, right, remedy or liability that cannot lawfully be excluded, restricted or modified, including under the Competition and Consumer Act 2010 (Cth) and the Australian Consumer Law.

To the maximum extent permitted by law, the Website and Content are provided on an "as is" and "as available" basis. We exclude all representations, warranties and conditions not expressly set out in these Terms or imposed by law and incapable of exclusion.

To the maximum extent permitted by law, G&G and its directors, officers, employees, contractors and agents are not liable for any loss arising from or in connection with your access to, inability to use, or reliance on the Website or Content, including indirect, consequential or special loss, loss of profit, revenue, opportunity, goodwill, data or anticipated savings.

Where a guarantee or other liability cannot lawfully be excluded but may be limited, our liability is limited, at our option and to the extent permitted by law, to supplying the relevant Website service again or paying the reasonable cost of having it supplied again.

This clause does not exclude or limit liability for fraud, wilful misconduct, death or personal injury caused by negligence, or any other liability that cannot lawfully be excluded or limited.

To the maximum extent permitted by law, you indemnify G&G and its directors, officers and employees against third-party claims, liabilities, losses and reasonable costs arising directly from your unlawful use of the Website, your material breach of these Terms, or material you submit that infringes another person's rights. Your liability under this clause will be reduced to the extent that G&G's act or omission contributed to the relevant loss.

Our collection, use, holding and disclosure of personal information is governed by our Privacy Policy, available on the Website. By providing contact details or subscribing to communications, you acknowledge that we may contact you in accordance with your request and applicable law. You may unsubscribe from marketing communications at any time using the unsubscribe facility provided or by contacting us.

We may update these Terms from time to time by publishing the revised version on the Website. The effective date at the beginning of the document indicates when the current version took effect. Revised Terms apply from publication. Your continued use of the Website after that time constitutes acceptance of the revised Terms.

We may suspend or terminate your access to the Website where we reasonably consider this necessary to protect the Website, G&G or another person, respond to unlawful or prohibited conduct, or comply with law. Rights and obligations that by their nature are intended to survive termination continue to apply, including those concerning intellectual property, liability, indemnity and governing law.

These Terms are governed by the laws of New South Wales, Australia. You and G&G submit to the non- exclusive jurisdiction of the courts of New South Wales and courts entitled to hear appeals from them. The Website may be accessed outside Australia, but we do not represent that it or its Content complies with the laws of every jurisdiction.

If any provision of these Terms is invalid or unenforceable, it will be read down to the extent necessary or severed, and the remaining provisions will continue in effect. A failure or delay to exercise a right is not a waiver. These Terms and the Privacy Policy constitute the entire agreement between you and G&G concerning use of the Website, subject to any separate written agreement between us.

Questions about these Terms or requests concerning Website Content may be submitted through the contact details or contact form published at www.ggadvisorypartners.com.au.