Personal Protective Equipment Policy

Policy

Epcotec supplies personal protective equipment ("PPE") for the small share of our work that involves physical hazards. Most of what we do is software engineering at a desk, and needs no PPE at all. Where hazards do arise, they fall into two settings: our applied R&D lab, where lasers, optics and high-voltage discharge experiments are run, and client sites, most often telecom facilities and data centres.

Who this policy covers

This policy applies to:

• Epcotec employees working in the applied R&D lab, at an Epcotec office hub, on a client's premises or work site, or at a data centre or telecom facility; and
• independent contractors, subconsultants, suppliers, visitors and tradespeople ("third parties") on Epcotec premises, or representing Epcotec at a client's premises or work site.

It also applies while travelling for work between any of those places. Before undertaking any task with a physical hazard, everyone covered must assess the risk, apply mitigations and use appropriate PPE.

Read this policy with our Work Health and Safety (WHS) Policy and our Equipment Policy.

Employees and third parties must use PPE in accordance with this policy. Where a third party arrives without the PPE needed for the task, Epcotec may refuse entry to the premises or site, or elect to supply the PPE at the third party's cost.

Where a client's site safety rules specify PPE, the more stringent requirement applies to our people and to third parties acting on our behalf while on that site.

Risk assessment comes first

PPE is the last line of defence, not the first. We follow the standard hierarchy of controls: elimination, substitution, isolation, engineering controls and administrative controls before PPE. PPE does not remove a hazard at its source, and it protects only when it is selected, worn and maintained correctly.

In the lab this ordering is deliberate: laser interlocks, beam enclosures, shrouds, barriers and safe working distances come before anyone reaches for laser safety eyewear.

Where a risk cannot be removed or avoided, mitigations must be applied and the relevant safe-work documentation completed before the task proceeds. Depending on the task, that may mean:

• holding off on part of the activity until a safer option or the right person is available;
• engaging an appropriately licensed contractor for specialised high-voltage work; or
• sourcing and using suitable PPE, supplemented wherever possible by higher-level controls.

Selecting and maintaining PPE

We manage PPE by:

• selecting the right equipment for the task with regard to applicable Australian, Canadian and international standards, regulatory requirements and codes of practice;
• assessing suitability for the work: hazard type, size and fit, comfort over the intended duration, and any restriction of dexterity, movement, communication, vision or breathing;
• maintaining, repairing and replacing PPE in line with the manufacturer's specifications, and keeping a register of Epcotec-owned PPE;
• training users in the selection, use, care, cleaning, maintenance, storage and limitations of approved PPE, including residual risk;
• inspecting PPE routinely against the register to confirm it is clean, in date and in working order;
• re-reviewing PPE suitability whenever a project changes, new equipment is introduced, an incident occurs, someone requests it, or at least annually; and
• keeping records of training.

Provided and personal PPE

Epcotec provides, at no cost, the PPE reasonably required for the work a person is asked to do, including laser safety eyewear for lab work and any site-specific items for client visits. Anyone may choose to supply their own PPE, such as personal safety footwear or prescription laser eyewear, provided it meets the applicable standard, is approved before use and is maintained to the same standard as Epcotec-provided equipment. Personal PPE remains the owner's responsibility to maintain; Epcotec-owned PPE is maintained and replaced by Epcotec.

Minimum requirements

Schedule A sets out our minimum PPE requirements. Where a risk assessment identifies additional needs, the additional PPE must be used on top of the minimum.

PPE must be worn as instructed, never misused or deliberately damaged, and any damage, defect or contamination that could make it unusable must be reported. Consumed, damaged or expired PPE should be flagged for replacement immediately.

Where PPE is not required

Ordinary remote work needs no PPE. Software development, design, documentation, meetings and video calls from a home office, an Epcotec office hub or a co-working space carry no PPE requirement where no physical hazard has been identified. Desk ergonomics are handled through our workstation arrangements and the Work Health and Safety (WHS) Policy, not through PPE.

Incidents

All incidents and accidents must be reported under our incident and injury reporting procedure.

Non-compliance

Anyone, employee or third party, who refuses to comply with this policy, including the proper use of PPE, will be directed to leave Epcotec or client premises and may not resume work for or on behalf of Epcotec until approved to return. A breach may result in removal from premises, disciplinary action or termination. We also carry reporting obligations to statutory authorities and may be required by law to report work health and safety breaches, including those involving the misuse or refusal of PPE.

Schedule A: minimum PPE requirements

The lab and the field have different needs, so the minimum requirements are listed by setting. Items in the second table are worn where the site or the risk assessment requires them.

Applied R&D lab

Client sites and field visits

---

Approved: Eugene Pivnev, Founder & Managing Director, Epcotec

Version 1.2, 2 October 2026