1. Introduction

1.1. Smartlox Pty Ltd (including its wholly owned subsidiaries) (“Smartlox”, “we”, “us”) respects your privacy. This Privacy Policy explains how we collect, use, disclose, and protect personal information when you use our website, our platform, and our services, and how you can exercise your rights.

1.2. We comply with applicable data protection laws globally. We process your personal information in accordance with applicable laws which may include, depending on your location, the Privacy Act 1988 (Cth) in Australia, New Zealand’s Privacy Act 2020, the EU and UK General Data Protection Regulation (GDPR), Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and Quebec’s Act Respecting the Protection of Personal Information in the Private Sector (Law 25), Saudi Arabia’s Personal Data Protection Law (PDPL), as well as relevant US State privacy laws to the extent applicable (Applicable Law). Where US State privacy laws apply to our processing of your personal information, the Addendum below applies in addition to the terms of this Policy.

2. What Is Personal Information?

“Personal information” means any information or opinion about an identified or reasonably identifiable individual. This includes any information that, either alone or in combination with other information, can be used to identify a natural person, directly or indirectly. It also includes “personal data” as defined in Applicable Law.

3. Who This Policy Applies To

3.1. This Policy applies to anyone whose personal information we handle, including visitors to our website, users of our platform, and personnel of our business customers who use our products, but does not apply to the personal information of our employees.

4. What Personal Information We Collect

4.1. The types of personal information we collect depend on how you interact with us and the nature of our engagement with you. Examples of personal information we may collect include, but are not limited to:

● name;

● email address;

● mobile phone number;

● home or work address;

● work information (e.g. employer, role / position);

● platform usage data including log data, location data and device information;

● any content you upload into our software or software as a service products or online services.

● We may collect information at other times, including where you apply for employment, provide feedback, when you provide information about your personal, employment or business affairs, changes to your contact or email preferences, respond to surveys and/or promotions or provide financial or credit card information. Additionally, we may also collect other information you provide while interacting with us.

4.2. Note that when customers use our products and services, they may input or collect personal information such as employee names, mobile phone numbers, email addresses, positions or roles and site locations, which we refer to in this Policy as “Product Data”.

5. Why We Collect, Hold and Use Your Personal Information

5.1. We collect, hold and use your personal information so that we can:

● verify your identity;

● provide you with products (including our platform) and services, and manage our relationship with you, or to provide an organisation with whom you have a relationship (e.g. your employer), with products (including our platform) and services and manage our relationship with them;

● contact you, for example, to respond to your queries or complaints, or if we need to tell you something important, e.g. about products and services you consume or your relationship with us;

● comply with our legal obligations and assist government and law enforcement agencies or regulators, subject to Applicable Law; and

● show you personalised or targeted advertising about our products and services, including via third party platforms such as Google (see section 7.3 below).

5.2. We also use your personal information to help us improve our services. When we use it for this purpose, we de-identify and aggregate that personal information with other data, to provide a statistical analysis.

5.3. We collect and hold Product Data to provide our products and services to the customer who is using them, and fulfil our agreements with them.

6. Controller vs Processor

6.1. Where we process Product Data on behalf of our customers who use our products and services, and that data contains personal information, then we are acting as a “data processor” (or service provider) and our customer is the “data controller” (or customer business). Our processing of Product Data is governed by our agreement with the customer, including any applicable data processing agreement. We also handle all Product Data in accordance with our obligations under Applicable Law.

6.2. Where we process personal information in other circumstances, we are the “data controller” and process the personal information in accordance with this Policy. This includes where:

● we engage with you outside the context of our products and services; and

● you use our products on behalf of our customer (e.g. if your employer is our customer) and we collect metadata relating to your use of our products, such as: which Product Data you upload, when you log in, product usage metadata, location and device data and information you share when you request product support.

6.3. For the purposes of the Australian Privacy Act 1988 (Cth), the provisions in this Policy regarding storage, security, disclosure, and breach response apply to all personal information we hold, even if it is part of Product Data, subject to the contract we have agreed with our customer concerning that Product Data.

7. Lawful Basis

7.1. Where we process Product Data, our customer determines the lawful basis for that processing, and we process it in accordance with our agreement with the customer (including any data processing agreement).

7.2. Where we process your personal information as “data controller”, we use and process it on one or more of the following bases:

● to perform our contract with you;

● to comply with legal obligations;

● to pursue our legitimate interests in operating, improving, and promoting our services (unless those interests are overridden by your rights under Applicable Law);

● with your consent, where we rely on it (e.g. for marketing, including cookie-based advertising where consent is required under Applicable Law, see section 7.3); or

● to protect vital interests where necessary.

7.3. Where you are a Saudi Arabian data subject, we will rely on your explicit consent as our primary basis for processing your personal information as a “data controller” and will only process your personal information without consent as permitted under the PDPL and associated regulations. We will not rely on the broader “legitimate interests” basis described above to process your personal information and will only use and process your personal information (excluding sensitive data) to achieve our legitimate interests where it does not prejudice your rights and interests.

8. Sensitive Data

8.1. We do not generally collect sensitive or special category personal data.

8.2. Our products and services may be used by customers to process Product Data that includes special category data or sensitive data. In those situations, we act as a data processor only. We process that Product Data subject to our customers’ instructions and agreements with them. Our customers are responsible for determining and obtaining the appropriate legal basis, consents, or notices required under Applicable Law for processing the special category data or sensitive data.

9. How We Collect Personal Information

9.1. We collect personal information from you in a variety of ways, including:

● when you interact with us electronically or in person;

● when you access our website or use our products or services;

● when we provide our products or services to you (or your employer or another organisation that supplies your data to us as part of their use of our products and services); and

● we may receive personal information from your employer or third parties.

9.2. Generally, we collect personal information from you directly. However, in some cases we may collect your personal information from a third party such as your employer (for example, if your employer creates a user profile on your behalf in our online services).

10. Website

10.1. We may collect information about how you access, use and interact with our website (including any support sites and web chat functionality available on our website), including by using a range of third-party tools such as Google Analytics or other web analytic tools.

10.2. This includes the use of third-party cookies and technologies controlled by third-party suppliers, such as Google which controls the cookies saved by Google Analytics and Google Ads.

10.3. The information stored in cookies may include your region and time zone, your device IP address, when you accessed our website, your browser details and your referring domain name. We may also track page interaction information such as scrolls, clicks and search terms.

10.4. The collected information is used to provide website functionality, usage analytics, to improve your experience and to deliver our advertising to appropriate audiences, including through geographic targeting.

10.5. We configure the tags and pixels used on our website, including those associated with Google Analytics and Google Ads, to collect only the personal information that is reasonably necessary for the purposes described in this Policy.

10.6. You may refuse to use cookies by selecting the appropriate settings on your browser and you can adjust your Google Ad settings (http://www.google.com/settings/ads) or following the prompts we provide when you access our website. However, disabling cookies can limit website functionality, and some tools like Google Analytics may still be able to collect data without using cookies.

10.7. Where required by law, we only set non-essential cookies after you have given consent.

11. Storage of Personal Information

11.1. We store most personal information about you in computer systems and databases operated by either us or our external service providers.

11.2. We implement and maintain processes and security measures designed to protect personal information we hold from misuse, interference, or loss, and from unauthorised access, modification or disclosure. These processes and systems include:

● the use of identity and access management technologies to control access to systems on which personal information is processed and stored;

● requiring all employees to comply with internal personal information security policies and keep personal information secure; and

● ensuring only personnel who need access to perform their duties, have access, and have signed agreements binding them to comply with our relevant policies.

11.3. We will also take reasonable steps to destroy or de-identify personal information once we no longer require it for the purposes for which it was collected, or for any secondary purpose permitted under Applicable Law, as otherwise required or permitted by Applicable Law or as required for legitimate business needs (e.g. to maintain business records, enforce agreements or to initiate or manage disputes and legal claims). When determining how long to retain data, we consider factors such as the nature of the information, the purposes of processing, legal or regulatory requirements under Applicable Law, and our need to maintain records to resolve disputes or enforce agreements.

11.4. Information collected via advertising cookies and used to build remarketing or similar audience lists is retained only for the membership duration permitted by the relevant advertising platform (for example, Google Ads), after which it expires automatically.

11.5. If we collect copies of identification documents from Saudi Arabian data subjects, we will ensure these are not retained for longer than is necessary to meet the purpose they were collected for.

12. Disclosure of Personal Information

12.1. We may disclose personal information for the purposes described in this Policy to:

● our employees and related bodies corporate;

● third party suppliers, service providers (including providers for the operation of our website and/or our business or in connection with providing our products and services to you); and

● our agents, business partners and professional advisors.

12.2. We may also disclose personal information where (i) required or authorised by law to do so; (ii) you have consented to the disclosure; or (iii) we are otherwise permitted to disclose the information under Applicable Laws.

12.3. If there is a change of control in our business or a sale or transfer of business assets, we reserve the right to transfer (to the extent permissible by Applicable Law) our data and databases, including all personal information and Product Data contained in them. This information may be disclosed to a potential purchaser under an agreement to maintain confidentiality. We would only disclose information in good faith and where required by any of the above circumstances.

12.4. If we handle your personal information as part of any Product Data, we disclose it where permitted by our contract with the customer who provided it.

13. Overseas Recipients

13.1. For Product Data (including any personal information contained in that data), we store and process data in the locations and using the sub-processors identified at trust.smartlox.io, and ensure that cross-border transfers occur under a lawful mechanism under Applicable Law.

13.2. For other personal information, we may disclose your personal information to recipients located outside Australia or your country of residence, including in the United States, to Google LLC, in connection with our use of Google Analytics and Google Ads as described under section 7.3. Some of our related companies are located outside Australia, such as in Saudi Arabia.

13.3. We may transfer personal information to countries outside your country of residence, including locations where our group companies, service providers, or cloud hosting partners operate. Where we do so, we ensure that appropriate safeguards are in place to protect the information, such as adequacy decisions issued by relevant authorities or the use of Standard Contractual Clauses approved by the relevant authorities, and limit the personal information transferred to what is reasonably necessary for the relevant purpose. Copies or details of these safeguards are available on request by contacting us. (When we process

personal information as a “data processor”, for example, as part of our processing of data provided by customers who use our products and services, our transfer of personal information is governed by our agreement, including any applicable data processing agreement, with the customer.)

14. Do We Use Your Personal Information for Marketing?

14.1. We will use your personal information to offer you products and services we believe may interest you, newsletters, surveys, information about offers and events, and product improvements only where you have given us your explicit, opt-in consent. These products and services may be offered by us, our related companies, our other business partners or our service providers. This is separate from our use of cookies to deliver advertising to appropriate geographic audiences, which is described under section 7.3.

14.2. Where you receive electronic marketing communications from us, you may opt out of receiving further marketing communications by following the opt-out instructions in the communication, or by contacting us (see below).

15. Data Security

15.1. We apply technical and organisational measures to protect personal information against unauthorised access, loss, misuse or alteration through the controls of our integrated management system (IMS), which is designed to comply with ISO/IEC 27001. These measures include: encryption of data in transit and at rest; access restricted on a least-privilege, need-to-know basis with multi-factor authentication; logging and monitoring; secure development practices; secure storage; supplier security assessment; regular security reviews and an incident response process. Access to personal information is limited to personnel and contractors who need it for their role.

15.2. If we become aware of a data breach involving personal information, we will investigate and notify affected individuals and regulators where required by Applicable Law.

16. Automated Decision-Making

16.1. We do not use automated decision-making that produces legal, or similarly significant, effects on individuals. Access and lockout/tagout decisions within our platform are determined by deterministic, rule-based logic that is configured by authorised users at the customer organisation, not by artificial intelligence or machine learning models, and not by profiling. If this changes in future, we will update this Policy and provide the disclosures required under Applicable Laws.

17. Your Rights

17.1. Depending on your location and Applicable Law, you may have the following rights in relation to your personal information:

● to access and obtain a copy of your personal information and data;

● to request correction or update of inaccurate or incomplete information and data;

● to request deletion of your personal information and data where it is no longer needed or where required by law;

● to restrict or object to certain processing, including direct marketing;

● to request transfer of your personal information and data to another organisation (data portability);

● to withdraw consent at any time where we rely on consent as the lawful basis;

● to request the purpose and legal basis for the processing of your personal information; and

● to obtain information about how we collect, use, and disclose your personal information, including the third parties with whom it is shared.

17.2. To exercise these rights, please contact us using the details below. We will respond as required by Applicable Law. You may also have the right to lodge a complaint with your local data protection authority.

18. Children

18.1. Our services are intended for use by businesses and their personnel, not by children. We do not knowingly collect the personal information of children. If you believe we have, please contact us and we will delete it.

19. How To Make A Complaint

19.1. If you have a complaint about the way in which we have handled any privacy issue, including your request for access or correction of your personal information, you should contact us. Our contact details are set out below.

19.2. We will consider your complaint and determine whether it requires further investigation. We will notify you of the outcome of this investigation and any subsequent internal investigation.

19.3. If you are not satisfied we have handled a privacy issue, you may approach an independent advisor, contact the Office of the Australian Information Commissioner (www.oaic.gov.au) or contact a local data protection authority for guidance on alternative courses of action which may be available.

20. Changes to This Policy

20.1. We may update and modify this Policy from time to time in our sole discretion and all modifications will be effective immediately upon posting of the modifications on our website. Please check back from time to time to review our current Privacy Policy.

20.2. You may obtain a copy of our current policy from our website or by contacting us at the contact details below.

21. Contact Us

21.1. If you have any questions, comments, requests, or complaints, contact us at:

privacy@smartlox.io

C/o Jaquillard Minns, 65 Gilbert Street, Adelaide SA 5000, Australia

21.2. We may take steps to verify your identity before responding, to protect your privacy.

22. US Addendum

22.1. Residents of certain US states (including California, Connecticut, Utah and Virginia) have additional rights regarding their personal information. These may include the right to:

● know what categories of personal information we collect, use and disclose;

● request access to or deletion of your personal information;

● request correction of inaccurate information; and

● opt out of the sale or sharing of personal information for targeted advertising.

22.2. We do not sell or share (including for cross-context behavioural advertising) personal information as those terms are defined under US State laws. To exercise any applicable rights, please contact us using the contact details given above.

25SL00004 – Rev 2 (2026-09-06)