Privacy Policy

1. About this Privacy Policy

This Privacy Policy applies to two separate legal entities that operate together under common ownership and management:

• Siteguard Rentals Pty Ltd (ABN 18 656 617 917) — which provides solar-powered CCTV trailer hire, remote site monitoring, and access to the Foreman and OLOGY Intelligence platforms (Siteguard Rentals);
• GPW Group Pty Ltd (ABN 38 628 213 267) — which designs, manufactures and supplies the hardware, components and related equipment used in the Siteguard product range, supplies similar products to other customers, and provides access to the Foreman and OLOGY Intelligence platforms (GPW Group).

Siteguard Rentals and GPW Group are separate legal entities. Each is an "APP entity" in its own right under the Privacy Act 1988 (Cth) (Privacy Act) and is independently responsible for its compliance with the Australian Privacy Principles (APPs).

Because the two entities share common ownership, leadership, systems, and certain customers and suppliers, they have agreed to adopt a single, common Privacy Policy. In this Policy:

• "we", "us" and "our" refer to Siteguard Rentals and GPW Group jointly, except where the context indicates a specific entity;
• references to Siteguard Rentals or GPW Group are to that specific entity only; and
• each entity is responsible for its own handling of personal information.

This Policy explains how we collect, hold, use, disclose and protect personal information about individuals who interact with our businesses, including customers, prospective customers, suppliers, contractors, job applicants, visitors to monitored sites, and users of our websites, apps and platforms (including Foreman and OLOGY Intelligence).

By interacting with us, or by providing your personal information to us, you acknowledge that you have read this Privacy Policy and understand how we will handle your personal information, including that personal information may be shared between Siteguard Rentals and GPW Group as described in Section 7.

2. The personal information we collect

The personal information we collect depends on how you interact with us and with which entity. We only collect personal information that is reasonably necessary for our business functions and activities. The kinds of personal information we typically collect include:

• Identity and contact information: your name, job title, employer, business address, postal address, email address, and telephone numbers.
• Account and platform information: user IDs, usernames, hashed passwords, account preferences, role permissions, and activity logs within Foreman, OLOGY Intelligence, and related apps.
• Commercial and transactional information: company name, ABN, billing and delivery addresses, purchase orders, quotes, invoices, payment details (processed by our payment providers), credit application information, and trade references.
• Site, asset and operational information: site addresses, site contacts, deployment locations, asset identifiers, configuration data, and information you submit in service tickets or support requests.
• Surveillance footage and sensor data: video footage, still images, audio recordings (where lawful and disclosed), thermal imagery, motion detection events, and analytics derived from these (such as person, vehicle or licence-plate detection events) captured by Siteguard CCTV trailers and connected devices deployed at customer sites.
• Manufacturing and supply chain information: supplier contact details, purchase order information, technical specifications, quality records, and warranty and defect data (collected primarily by GPW Group).
• Device and technical information: IP address, device identifiers, browser type, operating system, referring URLs, pages viewed, session duration, geolocation (where enabled), cookies and similar tracking technologies.
• Communications: records of your communications with us, including emails, helpdesk tickets, phone call notes, SMS, chat messages, and meeting notes.
• Recruitment information: if you apply for a role with either entity, your CV, cover letter, work history, qualifications, references, right-to-work documentation, and information obtained in interviews or background checks.
• Marketing preferences: your subscription status, preferences, and engagement with our marketing communications.

Sensitive information

We generally do not seek to collect sensitive information (as defined in the Privacy Act, including health information, biometric information, or information about racial or ethnic origin). If we need to collect sensitive information for a specific purpose, we will only do so with your consent or as otherwise permitted by law.

3. How we collect personal information

We collect personal information in a number of ways, including:

• directly from you when you contact us, request a quote, place an order, sign up to a platform, attend a meeting, apply for a role, or correspond with us;
• automatically when you visit our websites, use our apps or platforms, or interact with our marketing (including via cookies and analytics tools);
• from CCTV, sensors and connected devices deployed at sites under our customers' control;
• from your employer or principal, where you are an authorised representative, employee or contractor of one of our customers or suppliers;
• from third parties, including credit reporting bodies, business information providers (for example, the Australian Business Register), referees, recruitment agencies, publicly available sources, and social media platforms;
• from our service providers, dealers and channel partners in the ordinary course of providing our products and services; and
• from the other entity covered by this Policy, where information is shared between Siteguard Rentals and GPW Group as described in Section 7.

Where it is reasonable and practicable to do so, we will collect personal information directly from you.

4. Why we collect, hold, use and disclose personal information

We collect, hold, use and disclose personal information for purposes connected with our businesses, including:

• providing, supporting, billing, monitoring and improving our products, services, apps and platforms (including hardware hire, remote monitoring, and Foreman and OLOGY Intelligence) (Siteguard Rentals);
• designing, manufacturing, supplying, installing, servicing and warranting hardware and equipment (GPW Group);
• verifying your identity and authority to act on behalf of a customer or supplier;
• processing quotes, orders, payments, deliveries, returns and warranty claims;
• communicating with you about your account, service requests, technical issues, and product updates;
• performing site monitoring, security analytics, incident detection and post-incident review services for our customers;
• operating, maintaining and improving the security, reliability and performance of our network, products and platforms;
• complying with our legal obligations and assisting law enforcement and regulatory bodies where lawfully required;
• managing risk, including credit risk and fraud prevention;
• assessing job applications and managing our workforce and contractor arrangements across both entities;
• conducting market research, customer satisfaction surveys, and product development;
• sending you marketing communications about products and services we think may be of interest to you (you can opt out at any time — see Section 10).

If we propose to use or disclose your personal information for a purpose that is not described in this Privacy Policy, we will seek your consent or otherwise comply with the APPs.

5. CCTV footage, audio and site monitoring

A core part of Siteguard's business involves the deployment of solar-powered CCTV, fixed cameras, and connected sensors at customer sites. These devices may capture video footage, still images, audio (where applicable and disclosed), and analytics events relating to individuals who enter or are present at those sites.

Our role

In most cases, our customer (the site occupier or principal contractor) determines the purposes for which footage is captured and is the data controller for that footage. Siteguard typically acts as a service provider, providing the equipment, connectivity, storage and remote monitoring services. The customer is responsible for ensuring appropriate on-site signage, notifications and consents are in place at the monitored site, and for compliance with applicable surveillance device laws in the relevant State or Territory.

How we use footage

We may access, view, store, analyse and disclose footage to:

• provide remote monitoring, alerting, verification and incident response services to our customer;
• train, test, calibrate and improve detection and analytics features within Foreman and OLOGY Intelligence and related products (using de-identified, aggregated or sample data where practicable);
• investigate technical issues, false alarms or service quality matters;
• respond to lawful requests from law enforcement or regulatory bodies; and
• protect our rights, property, customers and personnel, and the safety of individuals.

Retention of footage

Footage is generally retained for a period set out in our customer agreement (typically between 7 and 90 days), after which it is automatically overwritten or deleted, unless we are required to retain it for longer to comply with a legal obligation, respond to an incident, or pursue or defend a legal claim.

Requests about footage

If you believe you appear in footage captured by a Siteguard device and wish to request access, you should generally direct your request to the occupier of the site where the device is deployed. You may also contact us using the details in Section 14 and we will assist where we are able and lawfully permitted to do so.

6. Who we disclose personal information to

We may disclose your personal information to third parties in connection with the purposes described above, including:

• our customers (where you are an end user, site visitor, or authorised contact in connection with a customer's account);
• our authorised dealers, channel partners and sales contractors;
• our service providers, including IT and cloud hosting providers, software platforms, payment processors, telecommunications carriers, courier and logistics providers, monitoring and alarm response providers, marketing and analytics providers, and professional advisers (such as accountants, auditors and lawyers);
• contract manufacturers and component suppliers where necessary for product fulfilment, warranty or repair;
• credit reporting bodies and other entities involved in credit assessment and debt recovery;
• law enforcement, regulators, government agencies and courts, where required or permitted by law; and
• any prospective or actual purchaser of either entity's business or assets, and their advisers, in connection with any sale, merger, restructure or financing.

We require our service providers to handle personal information consistently with this Privacy Policy and the APPs, and only for the purposes for which it is disclosed to them.

7. Sharing of personal information between Siteguard Rentals and GPW Group

Siteguard Rentals and GPW Group are separate legal entities. They are not "related bodies corporate" within the meaning of the Corporations Act 2001 (Cth), but they have common ownership and management and operate in an integrated manner. As a result, personal information may be shared between them in the ordinary course of business.

By interacting with either entity, you acknowledge and agree that personal information collected by one entity may be disclosed to, and used by, the other entity for purposes including:

• designing, manufacturing, supplying, installing, servicing, warranting and replacing hardware and equipment supplied by GPW Group and deployed by Siteguard Rentals;
• investigating and resolving customer issues, defects, complaints, warranty claims and quality matters that span both businesses;
• administering shared back-office functions, including finance, accounting, IT, helpdesk, human resources, and management oversight;
• managing shared customers, suppliers, dealers and channel partners;
• assessing creditworthiness, fraud risk, and debt recovery across both businesses; and
• strategic planning, reporting and group-level decision-making by their common owner.

Each entity remains independently responsible under the Privacy Act for the personal information it holds, even where that information was originally collected by the other entity. Each entity will handle personal information it receives from the other in accordance with this Policy and the APPs.

8. Data location and overseas disclosure

Australian data storage as our default

Wherever reasonably practicable, we host and store personal information on servers physically located in Australia. Our primary platforms, databases and footage storage are configured to use Australian-based data centre regions provided by our cloud and infrastructure suppliers as our default. We prefer Australian-based service providers where they are available and commercially viable.

When information may be stored or accessed overseas

Despite our Australian-default approach, some of our service providers and counterparties are located, or may store or access data, outside Australia. This typically occurs where:

• a specialised service we rely on (for example, certain analytics, support, communications or AI tooling) is only available from overseas providers;
• a provider's support, engineering or operations staff are located overseas and may access systems from there; or
• we engage overseas manufacturing partners or suppliers in connection with the design, manufacture, supply, servicing or warranty of hardware.

The countries to which we are likely to disclose personal information, or in which personal information may be stored or accessed, include:

• the United States of America (cloud, platform, analytics and AI services);
• Vietnam (contract manufacturing and product fulfilment);
• Mexico (manufacturing and supply chain partners); and
• other countries in which our service providers or manufacturing partners operate from time to time, which may include countries in the European Union, the United Kingdom, Singapore and other parts of Asia

Where we disclose personal information to overseas recipients, we take reasonable steps to ensure they handle that information in a manner consistent with the APPs. By providing us with your personal information, you acknowledge that overseas recipients may not be subject to the Privacy Act, and we may not be accountable for their acts and practices under that Act.

9. Cookies, analytics and our websites

When you visit our websites, we and our service providers may use cookies, pixels, tags, and similar technologies to collect information about your visit, including your IP address, device, browser, the pages you view, the date and time of your visit, and the website from which you arrived.

We use this information to analyse website usage, improve performance and content, personalise your experience, and measure the effectiveness of our marketing. You can manage cookies through your browser settings, although disabling cookies may affect the functionality of our websites.

10. Direct marketing and your choices

We may send you marketing communications by email, SMS, post, telephone or via our platforms about our products and services, or those of our partners. We will only send you marketing communications where you have consented or where we are otherwise permitted by law (for example, the Spam Act 2003 (Cth)) to do so.

You can opt out of marketing communications at any time by:

• using the unsubscribe link in any electronic marketing communication;
• replying "STOP" to a marketing SMS;
• contacting us using the details in Section 14.

Where you opt out, we will apply your preference across both Siteguard Rentals and GPW Group. Even if you opt out of marketing communications, we may still send you non-marketing communications relating to your account, services, security, or legal notices.

11. Automated decision-making and use of AI

Our products, platforms and services — including Foreman and OLOGY Intelligence — use artificial intelligence and machine learning to detect, classify, prioritise and surface events captured by CCTV and connected devices (for example, detecting the presence of a person or vehicle, or filtering out non-events such as wind movement). These systems may operate substantially without human intervention.

Where automated processes inform decisions made by us or our customers, those decisions are typically operational in nature (for example, prioritising alerts for human review). We do not currently use AI to make solely automated decisions that produce legal effects on individuals or that significantly affect their rights or interests.

If we change our practices in a way that involves substantially automated decision-making with significant effects on individuals, we will update this Privacy Policy and any required collection notices to describe:

• the kinds of personal information used in those automated processes;
• the kinds of decisions made solely by the operation of those automated processes; and
• the kinds of decisions for which something substantially and directly related to making the decision is done by the operation of those automated processes, consistent with our obligations under the Privacy Act.

12. How we hold and secure personal information

We hold personal information in a combination of secure cloud-based systems and physical records, with Australian-based storage as our default (see Section 8). Some of these systems are shared between Siteguard Rentals and GPW Group, with access controlled by role. We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure, including through:

• access controls, role-based permissions and authentication on our systems;
• encryption of data in transit and, where appropriate, at rest;
• network security controls, monitoring and vulnerability management;
• staff training, confidentiality obligations and acceptable use policies;
• vendor due diligence and contractual data protection requirements; and
• physical security at our premises.

No method of transmission or storage is completely secure. While we strive to protect personal information, we cannot guarantee absolute security.

We will retain your personal information only for as long as is necessary for the purposes for which it was collected, to comply with our legal obligations, resolve disputes, and enforce our agreements. When personal information is no longer needed, we will take reasonable steps to destroy or de-identify it.

13. Accessing and correcting your personalinformation

You have the right to request access to, and correction of, the personal information we hold about you, subject to certain exceptions under the Privacy Act.

Each of Siteguard Rentals and GPW Group is responsible for personal information that it holds. A single request directed to the contact in Section 14 will be treated as a request to both entities unless you specify otherwise.

We may need to verify your identity before processing your request. We will respond within a reasonable period (generally within 30 days). We do not usually charge a fee for access requests, but may charge a reasonable fee for retrieving and providing information where a request involves significant effort.

If we refuse your request, we will give you written reasons and information about how to complain about our decision.

14. Complaints and contact details

Siteguard Rentals and GPW Group share a Privacy Officer. If you have any questions about this Privacy Policy, or if you believe either entity has breached the Privacy Act or the APPs, please contact:

Privacy Officer

Siteguard Rentals Pty Ltd / GPW Group Pty Ltd

Postal address: PO Box 6037, Westdale NSW 2340 AUSTRALIA

Email: helpdesk@siteguard.net.au

Phone: 1300 479 000

Please tell us which entity your enquiry or complaint relates to (or both). We will acknowledge your complaint promptly and aim to investigate and respond within 30 days. If we need more time, we will let you know.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):

• Website: www.oaic.gov.au
• Phone: 1300 363 992
• Post: GPO Box 5288, Sydney NSW 2001