Code of Conduct

Policy

Clients give Epcotec access to their systems, their data and their source code. Repaying that trust calls for honest, professional and ethical behaviour from everyone connected with the group (Epcotec Pty Ltd in Australia and Epcotec Ltd in Canada): the Founder, leads and managers, employees, clients, contractors, consultants, subcontractors and suppliers.

Our mission, to invest in the success of our clients and to create an environment where our people do their best work, underpins the Values below and shapes every interaction we have with clients and with each other. Founded in 2011, Epcotec is a senior software engineering and applied R&D studio, and this Code is the benchmark for how we conduct ourselves.

Our six Values are:

1. Excellence: senior-grade craft, and the highest professional and engineering standards.
2. Integrity: honesty and candour; if we are not the right team, we say so.
3. Ownership: we own delivery and accountability; our clients own their code and IP.
4. Courage: challenge assumptions, do the hard right thing, give and take honest feedback.
5. Collaboration: one team across practices; direct, unmediated work with the people who build.
6. Care: for our people, our clients, our communities and the environment.

Epcotec pursues its strategic and operational objectives in accordance with all legal and contractual requirements and the principles of good governance, so that we build a business that lasts.

Scope

This Code applies to all employees, consultants, subcontractors, contractors and suppliers providing services or goods to Epcotec and its clients. Upholding it is a shared commitment that runs through every role and responsibility at Epcotec, and through every interaction with Epcotec.

People engaged by Epcotec (including independent contractors and contracted professional personnel) must comply with this Code when representing or acting on behalf of Epcotec:

a) in the delivery of software, cloud, data, AI, security, systems integration, telephony and applied R&D services; b) during work-related activities, events and social functions; and c) in all forms of communication and interaction, including on social media.

The Code also guides behaviour outside work. Conduct contrary to it, in public or in personal settings, can damage Epcotec, its brand and its clients.

Expected Behaviours

Epcotec conducts business professionally, with integrity and in accordance with applicable laws and regulations. The behaviours we expect are organised around the Values above.

Excellence

• Maintain the highest standards of professional and ethical conduct.
• Understand and comply with all legal, statutory and regulatory requirements, including the codes of conduct of any professional bodies and industry associations with which staff are licensed or registered (such as cloud, security and engineering certifications, and APEGA or Engineers Australia registration where a person is licensed).
• Deliver engagements in accordance with contractual requirements, Epcotec's policies and procedures, and our quality (ISO 9001-aligned) and security (ISO 27001-aligned and Essential Eight) practices.
• Keep accurate records and store all project and corporate information belonging to Epcotec and its clients safely, keeping project files, code repositories and documents structured and indexed so they can be readily located, including for audit purposes.
• Protect Epcotec's intellectual capital, and respect the integrity of client and third-party intellectual property rights.

Integrity

• Act with respect, fairness, honesty and integrity at all times.
• Do not allow anyone to improperly influence decisions relating to government approvals or the procurement of goods or services by Epcotec or on behalf of its clients. This includes never taking advantage of personal or professional relationships, or offers of gratuities or inducements, to obtain favourable treatment or advantage for Epcotec, its clients or a third party.
• Ensure all financial, accounting and other record keeping for payments and transactions incurred for or on behalf of Epcotec and its clients is accurate and transparent.
• Make no public statements, including to media organisations or on social media platforms, about Epcotec or any of its clients or engagements without Epcotec's approval. Refer all media enquiries to the People & Compliance lead.

Ownership

• Own delivery and accountability for the work we commit to; our clients own their code and IP, and we act to protect that ownership.
• Use Epcotec's resources and assets responsibly, protecting them against waste, damage, misuse, theft, misappropriation or fraud.
• Apply "human judgment, AI assistance" in everything we produce: a human owns every merge, estimate and answer, and AI assistance never replaces that accountability.

Courage

• Challenge assumptions, ask the hard questions, and do the hard right thing even when it is inconvenient.
• Give and take honest, direct feedback in a respectful way.
• Speak up when conduct or decisions are not consistent with this Code.

Collaboration

• Work as one team across practices, with direct, unmediated access to the senior engineers who scope and build the work.
• Uphold Epcotec's commitment to equal employment opportunity and to eliminating unlawful discrimination, bullying and harassment, in accordance with our Equal Employment Opportunity (EEO) policy.
• Observe and respect the cultural, social and personal beliefs of our colleagues, clients and members of the community, and the right of all people to be treated with dignity and to express themselves without fear of discrimination, humiliation or vilification.

Care

• Support the health, safety and wellbeing of colleagues. As a remote-first studio, this covers physical and psychological safety wherever we work. Do not attend an office or client site when unwell or potentially exposed to an infectious disease.
• Consider the social, environmental, cultural, economic and safety impacts of the services we provide and the products and cloud infrastructure we select, and strive for sustainable outcomes for our clients and the communities in which they operate, now and into the future.

Epcotec holds itself, and expects everyone bound by this Code to hold themselves and each other, accountable to the Code.

Behaviour or conduct not consistent with this Code must be reported to the person's manager, the People & Compliance lead, the Founder, or through Epcotec's Whistleblower Policy.

Confidentiality

Clients entrust Epcotec with sensitive commercial information (source code, data, credentials, infrastructure details, recordings and intellectual property), and it must be treated with the utmost respect and good faith.

Never use information provided by a client for any purpose other than the purpose for which it was provided. Store and communicate information in a manner that minimises the risk of disclosure, in accordance with our ISO 27001-aligned and Essential Eight security controls.

Cyber security threats grow more sophisticated every year, so take utmost care to prevent loss of data or breach of Epcotec's security systems, including when working from home, from public places, or in transit. Exercise caution when reviewing code, documents or screens, speaking on the phone, or joining meetings in public places (including on planes, in restaurants and coffee shops) so that confidential information is not inadvertently disclosed.

Client code, data and IP are the client's property. We protect them as if they were our own, and we transfer them in full at the completion of an engagement.

Conflicts of Interest

Conflicts of interest can damage client relationships and Epcotec's reputation, and can expose us to legal consequences. Stay alert, and communicate, so that your personal interests or relationships never conflict with those of Epcotec or its clients.

You must be professional, unbiased and impartial when you represent Epcotec and work with clients. Your decisions must not be influenced, or be perceived to be influenced, by any personal or private opportunity, interest or relationship, potential financial gain, or other benefit to you or a third party (including a friend, relative or business associate).

Epcotec must also ensure conflicts of interest do not arise in its relationships with clients, or between clients. Before submitting a proposal or entering into a contract with a client, check Epcotec's records of clients and projects to confirm that no conflict of interest is apparent.

Epcotec maintains a Conflict of Interest Register to record disclosed personal interests and other matters relevant to conflicts of interest. Steps include checking the Register and assessing the transaction or arrangement to ensure that:

a) it is transparent and all parties involved are reasonably known; b) Epcotec is not placed in a position of conflict on a project, between two clients, between Epcotec and a third party, or otherwise, which might reasonably be perceived as Epcotec being unable to act impartially or independently; c) there are no reasonably known personal, financial, contractual or commercial relationships, interests or commitments which might interfere with, compromise or undermine the transaction or arrangement; and d) no person will improperly benefit from the transaction or arrangement.

Before submitting a proposal or entering into a contract or agreement with a client, subcontractor, supplier or any other third party, employees must undertake due diligence and report any issue that arises to the People & Compliance lead or the Founder.

Fraud and Illegal Practices

Any behaviour or transaction that seeks to divert or appropriate financial or other benefits to you or to a third party, including misappropriation of Epcotec's assets or those of a client, is not only a breach of this Code and the terms of engagement but a criminal act in most jurisdictions.

Epcotec will report any fraudulent or illegal practices to the relevant authorities, in addition to exercising any other rights we hold in relation to the issue.

Anti-Bribery and Corruption

Epcotec's reputation rests on being trustworthy in our commitment to clients and in our dealings with consultants and suppliers. We do not tolerate bribery or corruption in any form.

This Code applies to all business transactions directly or indirectly involving Epcotec, and must be followed by all employees, business partners and third parties who deal with others on Epcotec's behalf. It applies in Australia, Canada and wherever else we operate, in accordance with applicable anti-bribery laws in each jurisdiction.

We prohibit making, or causing to be made, the offer, promise, gift or any payment or other benefit, favour or hospitality to:

a) any government official, to influence (or with the intention of influencing) any action, inaction or decision to obtain or retain business or a business advantage for Epcotec; or b) anyone else, in order to induce, or intend to induce, that person or any other person to perform (or reward them for performing) their job improperly, or to secure an award in favour of Epcotec or any other party which is not based on merit or genuine entitlement.

A "government official" includes any officer or employee of a government at any level, a government-owned or controlled entity, a public official or public organisation, or their employees.

We do not structure or enter into any bid, agreement, arrangement or understanding which disguises or hides any benefit for a third party that will or may be delivered (directly or indirectly) to a government official.

We do not allow facilitation payments, regardless of local practices. Epcotec prohibits kickbacks, facilitation payments, secret commissions and any other payments disguised for an improper purpose. This includes cash payments, and may include other things such as gifts, hospitality and travel.

Our interactions with government and government officials must be transparent and conducted with integrity. Exercise caution in employing or engaging government officials (or their relatives) or any associated entities where that official may be able to make decisions on projects in which Epcotec is involved, or influence outcomes involving Epcotec.

Give and receive gifts with care and in proportion to the circumstances. From time to time we may give or receive gifts or hospitality, and must exercise judgement about their frequency and value. Gifts and hospitality must be given voluntarily and be modest in the circumstances. Excessive or extravagant gifts or hospitality offered to a client or government official with an intention to directly influence a specific decision in Epcotec's (or a client's) favour are not permitted.

Services and favours (including hospitality, travel or other benefits) cannot be given directly or indirectly to government officials without the approval of the People & Compliance lead or the Founder. Gifts or hospitality are not permitted during an open or pending proposal or bid evaluation process.

Fair Dealing and Transparent Tendering and Procurement

The Competition and Consumer Act 2010 (Cth) and the Competition Act (Canada) promote fair and open competition, and impose heavy penalties for any conduct designed to lessen the competitiveness of a transaction, including price fixing, cartel conduct and other anti-competitive behaviour.

We are committed to conducting business ethically and demonstrating fair dealing in all our relationships. Probity is fundamental to the way we work.

We follow the client's processes and directions for how our proposals are submitted. We never seek to gain advantage or information through any means other than the manner the client intends, or that our competitors would expect.

Epcotec expressly prohibits conduct which seeks to constrain or interfere with an open market or restrict a client's ability to make free and informed decisions. Any activity which seeks to manipulate the tendering process is not permitted.

Never seek an improper advantage, or manipulate a client's procurement of goods or services, by enquiring about (or sharing) pricing information with peer organisations, agreeing with competitors to boycott a client, fix prices, or restrict the content, number or quality of proposals submitted to a client.

We engage subcontractors, contractors and suppliers who provide quality services and value for money. We never dictate to a client or third party that it must engage a particular supplier, contractor or consultant. Where necessary, we make recommendations based solely on our assessment of the skills, value and quality of the product or service, and we support open and impartial tendering processes on the client's behalf.

Any arrangement or agreement with a supplier or contractor which secures a secret commission, kickback, discount or other benefit to you or to Epcotec as a result of our recommendation or endorsement is prohibited. Ultimately, the client must be free to make an informed decision about the service provider it engages or the product it procures.

Supply Chain Transparency (Modern Slavery)

Epcotec considers all forms of modern slavery abhorrent and wholly inconsistent with our Values.

Modern slavery, as defined by the Modern Slavery Act 2018 (Cth) and addressed in Canada by the Fighting Against Forced Labour and Child Labour in Supply Chains Act, is characterised by the exploitation of vulnerable people for personal or commercial gain, and has permeated supply chains around the world.

Epcotec delivers its services in a way that respects human rights and protects the fundamental dignity of workers. We take steps to ensure there is no slavery, servitude, forced or compulsory human labour, human trafficking, child labour, debt bondage, deceptive recruiting for labour, or any other form of modern slavery in any part of our business or in our supply chains.

Our supply chain is that of a software studio, not a construction site: cloud hosting and SaaS providers, hardware and device procurement, subcontracting of specialised development and research services (including any offshore work), and general consumables. We evaluate critically whether the providers we engage, and the products and infrastructure we specify, rely on the exploitation of workers or slavery-like practices.

Before engaging a service provider or purchasing goods, Epcotec undertakes modern slavery due diligence using a risk-based approach to assess:

• Geographic risk: are workers recruited, or goods manufactured, in countries with a high prevalence of modern slavery? Does the country regulate employment of workers, including minimum wages and working conditions?
• Industry risk: are workers in a group at special disadvantage or risk of exploitation, due to their level of education, access to fundamental human needs, or socio-economic imperatives?
• Recruitment risk: what is the relative negotiating power of workers? Do they pay to be recruited? Are they free to choose employment?
• Transparency risk: do we have clarity on what workers are paid, and is that payment reasonable and consistent with a reasonable cost of living?

Epcotec expects its service providers, suppliers, subcontractors and contractors to share our commitment to act lawfully and ethically, and to work to ensure modern slavery is not taking place within their organisation or within their supply chains.

Anti-Money Laundering and Counter-Terrorism Financing

Money laundering is the process of concealing the source of money obtained by illicit means through legitimate business transactions. We must never allow ourselves to be used or exploited as a vehicle for money laundering, the financing of criminal activities or terrorism, or support for illegal activities of any kind.

Our resources and systems must not be used for any criminal or illegal activity. Exercise due caution whenever a transaction or activity appears suspicious, unusual or out of the ordinary, or where a request is made to do something that does not strictly comply with Epcotec's requirements for finance and accounting, risk assessment, record keeping and review processes.

Suspicious requests vary, but examples include requests to receive payment in currencies other than those in the ordinary course of the engagement, from foreign bank accounts, or to transact with a party not clearly connected with the subject of Epcotec's services.

All employees must report any suspicious request, activity or transaction to the People & Compliance lead or the Founder.

Failure to Comply

Epcotec treats every departure from or breach of this Code seriously, no matter how small it might seem. Breaches are likely to carry severe consequences and will trigger an immediate investigation by Epcotec, which could result in termination of engagement and, in some cases, legal proceedings. If Epcotec considers that a breach of this Code may also be a breach of applicable law, Epcotec will refer the issue to the relevant authorities.

Any person who does not comply with this Code of Conduct may have their access to Epcotec systems and premises revoked and/or have their engagement terminated.

---

Approved: Eugene Pivnev, Founder & Managing Director, Epcotec

Version 1.2, 2 October 2026