EPC Pacific Group Pty Ltd
General Privacy Policy

---

The purpose of this privacy policy is to tell you what kind of information we may gather about you, how we may use that information, and whether we will disclose it to anyone else and why. It also explains how we store the information you provide to us, how you may access or correct it, and how you can contact us. This privacy policy (“Policy”) covers your dealings with any company in the EPC Pacific Group Pty Ltd (EPC) and any entities owned or controlled by EPC. This document will be available on our website and will be provided free of charge to anyone who requests it. By providing personal information to us, you consent to our collection, use, storage, disclosure and management of your personal information in accordance with the Privacy Act and this Policy.

Our commitment to you

EPC (“EPC”, “us”, “our” or, “we”) recognises the trust you are placing in us through your dealings with us and we value your trust. We take privacy seriously and strictly adhere to the Australian Privacy Principles contained in the Privacy Act 1988 (Cth), as amended by the Privacy and Other Legislation Amendment Act 2024 (Cth) (together, “the Act”). EPC is an owner, manager and developer of properties. Members of EPC and their respective controlled and managed entities may collect personal and/or other information in the circumstances set out below.

Collection of Personal Information Customers Information we collect

We will not collect personal information unless the information is necessary for one or more of the primary purposes of providing services to our properties, our customers, our occupiers, our internal and external management needs and/or our marketing activities. We will collect personal information only by lawful and fair means, and not in an unreasonably intrusive way. We will only collect personal information that is necessary for us to provide our services, as outlined in this policy.

Collection of Personal Information

We will not collect personal information unless the information is necessary for one or more of the primary purposes of providing services to our properties, our customers, our occupiers, our internal and external management needs and/or our marketing activities. We will collect personal information only by lawful and fair means, and not in an unreasonably intrusive way. We will only collect personal information that is necessary for us to provide our services, as outlined in this policy.

What type of information we collect and hold
The personal information we may collect and hold includes, but is not limited to:

• contact details – name, address, email address, phone number and other contact details;
• your username, password and e-mail address when you subscribe to a properties’ membership programme;
• usage and location data where electronic devices are connected to a properties’ WiFi network;
• information you provide in submitted competition forms, enquiry or complaint details and other records of communications;
• information our tenants provide us about any security or safety incident you may be involved in;
• information including an individual’s image collected via our CCTV systems;
• other information you provide to us.

Why we collect and hold information

We collect personal information for the purpose of providing our customers with the relevant product, services or information. Personal information is also used to notify our customers of any competitions or special offers as well as marketing through our website and social media. Additionally, information may be collected in the connection with the management and security of the properties we manage, own and/or control.

Tenants/Purchasers

We may collect the following information from tenants, retailers, purchasers, guarantors and other related parties while in negotiations for and during the term of your lease or your purchase:

• information to identify an individual’s identity such as a driver’s licence and/or passport;
• contact details;
• insurance details;
• ABNs;
• financial information and history;
• information about the individual that is required or authorised by law; and
• any other related information that may be required in order to facilitate your dealings and transactions with us.

Why we collect this information

We collect this information to assess whether a lease, licence, sale or other agreement should be entered into, to manage our relationships with tenants and purchasers and help monitor our properties. We may be required to share this information with third parties such as our bank and share the information in connection with transactions involving the ownership or management of our properties or business. If a tenant, customer, or purchaser provides EPC with credit, BPAY or direct debit details, we will disclose this information to our bank to facilitate the provision of that service.

Employees and prospective employees

If you are employed by EPC or are seeking employment with EPC, we may collect your personal information in connection with your employment or to assess your application. This information will be used as part of the recruitment process and if you join our staff, for purposes related to managing your employment in accordance with our statutory obligations. You must provide personal information which is true and up to date in accordance with our policies and procedures.

Service providers and suppliers

If you or the company you are employed by provides services to us, we may collect personal information such as your contact information, date of birth, ABNs and any other information from you or on your behalf. The personal information we collect will be used to manage the supply of goods and services as well as to help us manage our relationship with service providers.

Other information we collect, use and disclose

In connection with the management and security of our properties, we rely on CCTV surveillance in the properties, their carparks, and surrounding areas. We may collect your personal information and images from the surveillance footage. We may provide this information:

• to law enforcement or government bodies if required or authorised to do so;
• to our insurers, for the purpose of pursuing claims which affect EPC interests;
• to our tenants in the event of a serious security or safety incident that we consider may affect them; or
• to other entities and individuals where required or authorised by law.

When you log onto and accept the terms of use of the WiFi provided in any property, we and our third party providers may collect data including usage, location and type of device from those electronic devices from time to time. We will use this information to inform customers of various events, competitions, promotions or other activities as nominated by you.

Cookies

In addition to the information mentioned above, we may use cookies to collect information about how you use the EPC and associated entities websites. Cookies are small text files that websites or apps may place on your computer or device. We use cookies to provide you with a more consistent experience across our services. We reserve the right to ask advertisers or other partners to serve ads or services to your devices, which may use cookies or similar technologies placed by us or the third party. We record a variety of information from interactions with our online services including IP address, locations data (where available and not disabled by the user), dates, times, and other user activity. In most cases we will not be able to reasonably identify an individual from the information collected. However, if cookie information is linked with personal information we hold about you as set out above, this cookie information becomes personal information and will be treated in the same manner as the personal information to which it has been linked. You can remove or reject cookies by adjusting the settings on your web browser.

Anonymity

If possible, we will give you the option of using a pseudonym when dealing with us. However, if we are required to collect personal information under legislation or for employment purposes, anonymity or pseudonymity will not be allowed.

Unsolicited information

If we receive personal information that we have not requested, or we determine that the personal information we have received is not reasonably necessary to provide our services, we will take reasonable steps to de-identify or destroy that personal information.

How we protect your information

We understand the importance of protecting your personal information, so we ensure that all personal information is stored securely in accordance with the Act. We implement technical and organisational measures to protect the personal information we hold, including password-protected databases, access controls, staff training, encryption, and system firewalls. We will take reasonable steps to destroy or permanently de-identify personal information if it is no longer needed for the purpose for which the information was used or disclosed. If we ever transmit your personal information over the internet (for example to third parties who hold data outside Australia relevant to our business) we will take reasonable steps to maintain the security of any personal information to prevent misuse and unauthorised access. Despite these protection mechanisms, you should be aware there are inherent risks associated with the transmission of data over the internet and we cannot guarantee any transmission will be completely secure.

Sharing your information

Personal information collected may be shared, to the extent permitted by law, with our tenants and law enforcement agencies as part of our statutory obligations. Personal information may also be shared with our insurers for the purpose of pursuing claims which affect EPC interests. If we contract out any service to a third party, including information gathering platforms used via our websites, we will seek a commitment from the third party that it will treat all personal information in accordance with the Act and this Privacy Policy. Only that information vital to performing the specific contracted functions for and on behalf of us will be disclosed. We will also seek agreement that third parties to whom we release CCTV footage will only use it for the purpose for which it is disclosed. Sometimes we use third party services to store data and information, provide web support or otherwise deliver information. These services are managed by external organisations, some of which may be located overseas. We will take reasonable steps to ensure that those third parties handle personal information in a manner consistent with the Australian Privacy Principles and the Act, including APP 8 obligations for cross-border disclosures.

How you can access your information

You have the right to access and correct your personal information held by us. We aim to make sure that the personal information we collect, use or disclose is accurate, complete and up-to-date. If you believe your personal information is not accurate, complete or up to date, please contact us on the details below. If you wish to access, correct or delete any personal information we hold about you, please contact our Privacy Officer on the details below.

Opting out

In communicating with you, you may be asked to consent to receiving communications from us. You can unsubscribe from receiving these communications at any time by using the unsubscribe link in our electronic correspondence or by contacting our privacy officer using the details below.

Complaints about privacy

If you believe there has been a breach of privacy or wish to discuss any issues about our Privacy Policy, please contact our Privacy Officer on the details below. We will endeavour to respond to your request within 30 days. All such enquiries or complaints will be handled with the appropriate discretion. You can contact our Privacy Officer on enquiries@epcpacific.com.au. Further information on the Act and the Australian Privacy Principles, can be found at www.privacy.gov.au.

Your right to take legal action

From 10 June 2025, the Privacy and Other Legislation Amendment Act 2024 (Cth) introduced a statutory tort for serious invasions of privacy. This means that individuals may have the right to take legal action against any person or organisation that seriously invades their privacy, whether by intruding upon their personal seclusion or by misusing their personal information. EPC is committed to handling your personal information responsibly and in accordance with the Act to minimise the risk of any such invasion of privacy.

Penalties and enforcement

The Office of the Australian Information Commissioner (OAIC) has enhanced powers to investigate and enforce compliance with the Act, including the ability to issue infringement notices and seek civil penalty orders. Significant civil penalties may apply for interference with privacy, including penalties of up to AUD$3.3 million for organisations. We are committed to complying with the Act and will cooperate with the OAIC in any investigation or inquiry. If you believe EPC has interfered with your privacy, you may make a complaint to the OAIC at www.oaic.gov.au.

Automated decision-making

From 10 December 2026, APP entities will be required to disclose in their privacy policies the use of substantially automated decision-making processes that may significantly affect individuals. EPC is currently reviewing its use of automated decision-making and will update this Policy prior to 10 December 2026 to include any required disclosures. If you have questions about how decisions are made about you, please contact our Privacy Officer.

Changes to our privacy policy

We may change or update this Privacy Policy at any time to reflect legal requirements and changes in our services so we encourage you to review this Privacy Policy at regular intervals. When we change this policy, we will let you know by posting an updated version on our website. Last updated: June 2026