Privacy Policy

Because BNV provides services to wholesale clients, most of the personal information we hold relates to individuals who represent, or are associated with, the organisations we deal with, as well as visitors to our website and candidates for employment. The information we collect may include:

• your name, job title and the organisation you represent;

• contact details, such as postal address, email address and telephone numbers;

• records of our dealings and communications with you, including notes and correspondence;

• your voice and image where you take part in a recorded meeting (for example, a video conference);

• technical information collected when you use our website, such as your IP address and usage data (see section 3); and

• other information reasonably necessary for our functions and activities.

Sensitive information. We do not usually collect sensitive information (such as health information or information about your background). Where we do need to — for example, as part of a recruitment or background-checking process — we will only collect it with your consent, unless we are required or authorised by law to collect it.

We collect, hold and use personal information to:

• provide our financial and investment consulting services to the organisations we deal with;

• communicate with you and manage our relationship with you;

• respond to your enquiries, requests and complaints;

• conduct market research and improve our services and our website;

• consider applications for employment; and

• comply with our legal and regulatory obligations.

If you do not provide the personal information we request, we may be unable to provide our services to you or the organisation you represent, or otherwise deal with you effectively.

Direct marketing. We may use your contact details to send you information about our services that we believe may be of interest to you or your organisation. You can ask us to stop sending you marketing communications at any time using the contact details below, and we will action your request as soon as practicable.

We collect personal information in a number of ways, including:

• directly from you — for example, when you contact us, meet with us, correspond with us, or attend a meeting;

• from the organisation you represent, or from your colleagues or representatives;

• from publicly available sources and third parties, where permitted; and

• through your use of our website.

Website and cookies. When you use our website, we may collect technical information such as your IP address, the pages you visit and the dates and times of your visits. Some of this is collected using "cookies" — small text files stored on your device. This information is generally used in aggregate to understand and improve how our website is used, and does not usually identify you as an individual. You can set your browser to disable cookies, although some parts of our website may not function properly if you do.

We keep personal information only for as long as we need it for the purposes described in this Policy, or for as long as we are required to keep it by law (for example, under the Corporations Act 2001 (Cth) or anti-money laundering legislation). When we no longer need it, we take reasonable steps to destroy it or permanently de-identify it.

We hold personal information in both physical and electronic form, and we take reasonable steps to protect it from misuse, interference and loss, and from unauthorised access, modification or disclosure. These steps include staff confidentiality and privacy obligations, access controls and physical security, and electronic security measures such as firewalls and encryption. Where we use third-party service providers to store or process information, we use contractual arrangements to require them to protect it.

We may disclose your personal information to:

• Sandford Capital Pty Ltd (ABN 82 600 590 887), as the holder of the Australian Financial Services Licence (AFSL 461981) under which we operate;

• third-party service providers who help us run our business (for example, IT, data storage and professional advisers such as our accountants, auditors and lawyers);

• government and regulatory bodies, where required or authorised by law; and

• other parties where you have consented, or at your request.

We store personal information on servers located in Australia. We do not disclose your personal information to overseas recipients. If this position changes in the future, we will update this Policy and, where required, take reasonable steps to ensure any overseas recipient handles your information consistently with the APPs.

You can ask us to give you access to the personal information we hold about you, and to correct it if it is inaccurate, out of date or incomplete, by contacting us using the details below. We will respond within a reasonable time. Before giving you access, we will need to verify your identity. Access is usually free, though we may charge a reasonable fee where a request requires substantial effort. If we cannot give you access or make a correction, we will tell you why in writing.

We comply with the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth). If we become aware of a data breach that is likely to result in serious harm to any affected individual, and we are unable to prevent that harm through remedial action, we will notify the affected individuals and the Office of the Australian Information Commissioner (OAIC) as required by law.

If you believe we have breached your privacy or the APPs, please contact us using the details on this website. We will acknowledge your complaint and aim to investigate and respond within a reasonable time (usually within 30 days). If you are not satisfied with our response, you can escalate your complaint to the Office of the Australian Information Commissioner:

‍ ‍

• Website: oaic.gov.au/privacy

• Phone: 1300 363 992

• Email: enquiries@oaic.gov.au

‍ ‍

(A privacy complaint about how we handle personal information is handled through the process above. A complaint about our financial services more broadly is handled through our Complaints Resolution Process.)

We may update this Privacy Policy from time to time by publishing the updated version on our website. Please check our website periodically for the current version.