Privacy Policy

Introduction

Epcotec builds and operates software for its clients, and in doing so it holds personal information: contact details of client representatives, candidate and recruitment records, supplier information and employee records. This Policy explains what personal information Epcotec (the group comprising Epcotec Pty Ltd in Australia and Epcotec Ltd in Canada) collects, why it collects it, how it is protected, and the rights available to the people it describes.

Because Epcotec operates in two jurisdictions, we manage personal information in accordance with:

• the Privacy Act 1988 (Cth) and the Australian Privacy Principles ("APPs") in Australia; and
• the Personal Information Protection and Electronic Documents Act ("PIPEDA") and applicable provincial privacy laws in Canada.

Where the standards differ, we apply the higher of the two.

What is personal information?

Personal information means information, or an opinion, about an identified individual (or an individual who is reasonably identifiable), which may or may not be true, and whether recorded in a material form or not.

Sensitive information includes, but is not limited to, information or an opinion about membership of a professional or trade association or union, political opinions, religious beliefs or affiliations, criminal record, or health information.

Employee and candidate records

This Policy covers how Epcotec handles personal information about clients, candidates, suppliers and members of the public. Personal information collected in the context of a current or former employment relationship (employee records) is managed under our internal employee records practices and, where applicable, is exempt from parts of the Privacy Act in Australia.

For candidates and job applicants, see the collection statement under "Recruitment" below.

Personal information we collect

To operate its business, it is reasonably necessary for Epcotec to collect personal information. What we collect depends on the person's relationship with Epcotec. For example:

• Client: we may collect and hold your name, address, email address, contact telephone number, role and organisation, login and account details for the client portal, billing and payment details, and records of the engagements we deliver for you.
• Supplier (including contractors and subcontractors): we may collect and hold your name, address, email address, contact telephone number, business records, billing information, information about the goods and services you supply, licensing, industry associations and professional affiliations.

Epcotec collects sensitive information only where you consent to the collection and the information is reasonably necessary for one or more of Epcotec's functions or activities.

How Epcotec collects and holds personal information

Epcotec manages personal information in an open and transparent way, and collects it only by lawful and fair means. We collect personal information directly from you if it is reasonable or practicable to do so.

Epcotec may collect personal information in a number of ways, including:

• through application and onboarding forms;
• by email or other written communications;
• over a telephone or video call (see "Telephony and voice services" below);
• in person;
• through commercial transactions and the procurement of services;
• through our website and client portal (portal.epcotec.com), including cookies and analytics;
• through technology used to support communications between us; and
• through publicly available information sources and direct marketing database providers.

When Epcotec collects personal information, it manages that information in accordance with the APPs and PIPEDA.

At or before the time we collect personal information (or, if that is not reasonably practicable, as soon as practicable afterwards), we will take reasonable steps to notify you, or otherwise ensure you are made aware of:

• the identity and contact details of Epcotec;
• that Epcotec has collected personal information from someone other than you, or that you are otherwise unaware such information has been collected;
• whether collection is required by law;
• the purposes for which we collect the information;
• the consequences if we do not collect some or all of the information;
• any third party to which we may disclose the information;
• that this Policy contains information about how you may access and seek correction of personal information held by Epcotec, and how you may complain about a breach of the APPs; and
• whether Epcotec is likely to disclose personal information to recipients in another country, and the countries in which those recipients are likely to be located.

Unsolicited personal information is personal information Epcotec receives which it did not solicit. Unless we determine that we could have collected it in accordance with the APPs, we will destroy the information or ensure it is de-identified.

Epcotec stores personal information within secure electronic and paper storage systems. We limit access to personal information to those representatives of Epcotec who need it, and take all reasonable steps to protect it from unauthorised or unlawful disclosure.

Purposes for which Epcotec collects, holds, uses and/or discloses personal information

The purposes for which Epcotec may collect, hold, use and/or disclose personal information include:

• recruitment functions;
• client service management and delivery of engagements;
• training and events;
• surveys and general research;
• marketing and business development;
• commercial administration of our business (including receipt and making of payments); and
• business relationship management.

Epcotec may collect and use personal information for any of the above purposes, and may reasonably use information collected for a particular purpose for another related purpose. We may also collect, hold, use and/or disclose personal information if you consent, or if required or authorised under law.

Direct marketing

Epcotec may use or disclose personal information (other than sensitive information) about you for the purpose of direct marketing, for example advising you of new goods and/or services being offered by Epcotec. We use or disclose sensitive information for direct marketing only if you have consented.

You can opt out of receiving direct marketing communications from Epcotec at any time by contacting the People & Compliance lead, or by unsubscribing through the link provided in the communication.

Client portal

Epcotec operates a client portal at portal.epcotec.com, through which clients access project artefacts, staging environments, dashboards and account information. We collect and hold the personal information necessary to provision and secure portal accounts, including name, email address, role and authentication data.

Access to the portal is protected by multi-factor authentication and least-privilege access controls in line with our ISO 27001-aligned and Essential Eight security posture. We do not use personal information collected through the portal for any purpose other than delivering and securing the client relationship.

Telephony and voice services

Epcotec provides IP telephony and voice services in the United States and Canada. Where we deliver, configure, support or operate voice services on a client's behalf, call data, and in some configurations call recordings, may be processed.

Where calls are recorded, we do so in accordance with applicable laws, with the consent or notification required in the relevant jurisdiction, and for the purposes of quality assurance, compliance, or as agreed in the client's statement of work. Recordings and call data are treated as client information and are protected in the same manner as other client data.

Recruitment

Epcotec collects personal information from job applicants and candidates to assess suitability for roles and to manage the recruitment process. This may include your name, contact details, employment history, qualifications, certifications, references and, with your consent, sensitive information relevant to the role.

Privacy collection statement for job applicants

When you apply for a role at Epcotec, we collect the personal information you provide (name, contact details, résumé, employment history, qualifications and references) to assess your application and, if successful, manage your engagement. We may collect this information directly from you or, with your knowledge, from referees and publicly available professional sources. If you do not provide the requested information, we may be unable to assess your application. Your information is used only for recruitment and related purposes, is accessible only to those involved in hiring, and is handled in accordance with this Policy. Unsuccessful candidates' information is retained only as long as reasonably necessary and then securely destroyed or de-identified, unless you consent to us keeping it on file for future opportunities. You may access or correct your information at any time by contacting the People & Compliance lead.

Website cookies and analytics

Epcotec's website and client portal use cookies and similar technologies to remember preferences, support authentication, and understand how the sites are used through privacy-respecting analytics.

We use analytics to improve our services. Where required by law, we obtain your consent before placing non-essential cookies, and you can manage or withdraw consent through your browser settings or the site's cookie preferences. We do not use cookies to build profiles of individuals for sale to third parties.

Disclosure of personal information

Epcotec may disclose your personal information for any of the purposes for which it was collected, or where it is under a legal duty to do so.

Disclosure will usually be made internally, to related entities within the Epcotec group, or to third parties such as contracted service suppliers (for example, cloud hosting providers, payment processors and recruitment platforms). Before disclosing personal information about you to a third party, we take steps reasonable in the circumstances to ensure the third party protects the information.

Cross-border data flows and data residency

Because Epcotec operates in Australia and Canada, personal information may flow between our Australian and Canadian operations and to the service providers that support them.

We are transparent about where personal information is held. Personal information collected in Australia is ordinarily hosted within Australia, and personal information collected in Canada is ordinarily hosted within Canada, unless the nature of the engagement requires otherwise. Clients can discuss data residency options (including hosting in a specific region) as part of their engagement.

Where personal information crosses a border, we take reasonable steps to ensure the receiving party is subject to comparable privacy protections, and we notify you where required by law.

Access to personal information

If Epcotec holds personal information about you, you may request access by putting the request in writing and sending it to the People & Compliance lead. We will respond within a reasonable period, and a charge may apply for providing access.

There are circumstances in which Epcotec may refuse access to personal information in accordance with the APPs or PIPEDA. In those situations we will give you written notice setting out the reasons for the refusal and the mechanisms available to you to make a complaint.

Correction of personal information

If Epcotec holds personal information about you that is inaccurate, out-of-date, incomplete, irrelevant or misleading, we take reasonable steps to correct it.

If you make a written request to the People & Compliance lead to correct your information, Epcotec will take reasonable steps to do so and will respond within a reasonable period.

There are circumstances in which Epcotec may refuse to correct personal information. In those situations we will give you written notice setting out the reasons for the refusal and the mechanisms available to you to make a complaint.

If Epcotec corrects personal information it has previously supplied to a third party, and you request that we notify the third party of the correction, we will take reasonable steps to give that notification unless it is impracticable or unlawful to do so.

Deletion of personal information

At any time you may make a written request to the People & Compliance lead to delete personal information or data where it is no longer necessary or required, where consent has been withdrawn, or where the data was not lawfully collected. Epcotec will take reasonable steps to comply with the request and delete the personal information or data as soon as possible, and will notify you on completion.

Integrity and security of personal information

Epcotec takes steps reasonable in the circumstances to ensure that the personal information it collects is accurate, up-to-date and complete, and that the information it uses or discloses is accurate, up-to-date and complete having regard to the purpose of the use or disclosure.

We protect personal information from misuse, interference, loss, and unauthorised access, modification or disclosure. These protections align with our ISO 27001-aligned and Essential Eight controls, including multi-factor authentication, least-privilege access, encryption of data in transit and at rest, and dependency and vulnerability scanning.

Anonymity and pseudonymity

Individuals have the option of not identifying themselves, or of using a pseudonym, when dealing with Epcotec in relation to a particular matter. This does not apply:

• where Epcotec is required or authorised by law, or by a court or tribunal order, to deal with individuals who have identified themselves; or
• where it is impracticable for Epcotec to deal with individuals who have not identified themselves or who have used a pseudonym.

Complaints

Individuals have the right to complain about Epcotec's handling of personal information if it is alleged that Epcotec has breached an APP or PIPEDA. All complaints must be made to the People & Compliance lead. The complaint will be reviewed, and notice of the determination will be provided to you and to the Founder.

If you are not satisfied with our response, you may refer your complaint to the Office of the Australian Information Commissioner (OAIC) in Australia, or the Office of the Privacy Commissioner of Canada in Canada.

Contacting us

You can contact the People & Compliance lead:

• through the contact details published on epcotec.com; or
• through the client portal at portal.epcotec.com (for portal-related requests).

Breach of this Policy

Any representative of Epcotec found to have breached this Policy may be subject to disciplinary action, including termination of engagement, or may be referred to law enforcement in the event of a breach of the Privacy Act 1988 (Cth) or PIPEDA.

---

Approved: Eugene Pivnev, Founder & Managing Director, Epcotec

Version 1.2, 2 October 2026