A. What Personal Information do we collect and hold?

The kinds of personal information we collect and hold will depend on the services we provide and the nature of our relationship with you. This may include:

1. identifying and contact information;
2. information relevant to the subject matter of your claim/litigation (e.g., trading data, your advisors, living and housing arrangements);
3. details from your identification documents such as certificates and licences, including where required to comply with anti-money laundering and counter-terrorism financing laws;
4. information required for the purpose of the relationship, such as work history for employment applications or distribution arrangements for compensation;
5. data collected through our website including your IP address, browser type and pages visited; and
6. any other personal information you provide or that we collect in connection with our

Some personal information we collect may be ‘sensitive information’ as defined in the Privacy Act. This includes information relating to a person’s racial or ethnic origin, political opinions, sexual preferences, membership of political, professional or trade association, religious or philosophical beliefs, criminal records, as well as health, genetic or biometric information. We will not collect sensitive information without your consent unless permitted by law or there is an exemption under the APPs.

B. Why do we collect your Personal Information?

We may collect, hold, use and disclose personal information for the following purposes:

1. providing legal and related services, including but not limited to the investigation of potential claims; the preparation, commencement and conduct of proceedings; engaging in confidential alternative dispute resolution processes; securing litigation funding and/or insurance in connection with your claim; and effecting the distribution of any settlement among clients and group members;
2. reviewing, processing and responding to inquiries and requests for our services from prospective clients;
3. recruiting and careers;
4. marketing, which would primarily consist of notifying you of future claims that you may be eligible to participate in;
5. the general conduct and management of our business, including considering any concerns or complaints you may have and helping us to enhance our business;
6. meeting our legal and professional obligations, such as to courts, regulatory authorities and other third parties legally entitled to access the information.

C. Who may we disclose your Personal Information to?

For the purposes mentioned above, it may be reasonably necessary, or we may be compelled to disclose your personal information to third parties, including (but not limited to):

1. parties and others involved in the litigation or legal matter (including, insurers, litigation funders, other solicitors and their service providers);
2. regulatory bodies, courts, tribunals, commissions, government departments and other authorities, who may in turn make that information available to others (for example, information may be placed on the public record, be submitted for taxation or other compliance purposes);
3. third parties assisting us to provide legal or related services to you;
4. those assisting with sanctions, anti-money laundering and counter-terrorism financing and other compliance checks, where required (we may need to request further personal information to complete those checks);
5. our advisors, consultants and service providers assisting with our business (e.g., insurers, banks, auditors, archival providers);
6. service providers assisting with recruitment services, marketing, data storage and processing, technology providers (including AI service providers) and business development;
7. to establish or protect our legal rights, or defend ourselves against a claim;
8. others with your authority.Phi Finney McDonald personnel, including from an entity related to Phi Finney McDonald Pty Ltd, may access your personal information. Our personnel are bound by contractual and professional obligations of confidentiality.

There may be situations where your personal information is disclosed to, or accessed by, recipients located outside of Australia. This may occur, for example, where your claim is funded or insured by an overseas-based litigation funder or insurer, we consult overseas-based experts, consultants or

lawyers, or we engage overseas third-party service providers (such as providers of information technology and support, mailing or digital marketing, financial or administrative services) in connection with our business.

We currently consider that recipients are most likely to be located in the United Kingdom, Europe, Canada, New Zealand, Ireland or the United States. Before disclosing your personal information to an overseas recipient, we take reasonable steps in the circumstances to ensure the recipient does not breach the APPs in relation to the information, or we satisfy ourselves that the recipient is

subject to a law or a binding scheme that has the effect of protecting the information in a way that, overall, is substantially similar to the protections under the APPs, and that there are mechanisms available to you to enforce that protection.

D. How is your Personal Information collected and held?

Generally, Phi Finney McDonald collects your personal information directly from you through:

1. face-to-face meetings, by telephone, via hand-completed forms, by email or via online forms or portal pages completed via our website or other electronic platforms;
2. in certain circumstances, digital recording using CCTV may be Phi Finney McDonald may also
   1. engage third parties to analyse our website traffic, which may involve the use of cookies, however any information obtained via this kind of analysis is anonymous;
   2. receive personal information from a party in a proceeding who is authorised by court order to do so;
   3. receive personal information about a person from a third-party, for example, if a client provides personal information which includes the personal information of a family member, or if your authorised representative tells us information about Where that occurs, we are relying on the person providing the information to tell the other person they are doing that, and to direct them to this policy.

Phi Finney McDonald holds personal information received:

1. in paper and/or electronic form, and we endeavour to keep it secure and confidential;
2. in some instances, the personal information we hold will be stored with third party data storage providers who are subject to confidentiality obligations.

Because the privacy of your information is important to us, we also take such steps as are reasonable in the circumstances to protect your personal information held by us from loss or

misuse and from unauthorised access, modification or disclosure. This includes reasonable steps to maintain the security of physical files and restricted access to electronic records.

However, we cannot guarantee the security of information about you, and do not accept automatic liability for any loss or damage that may result from our collection, holding, use or disclosure of your personal information.

You do not have to provide your personal information to us. However, if you do not, we may not be able to provide the requested legal or other service to you.

E. How long is your Personal Information kept?

We are subject to legal, contractual and professional obligations to hold your personal information.

If you are a client, the information about your case must be kept for seven years after your case

closes. For compliance and regulatory reasons, we are required to keep some documents for longer than this, including for establishing, prosecuting or defending legal proceedings.

Once our obligations to keep your information have ceased, we will either destroy or de-identify your personal information. Electronic information which cannot be destroyed or de-identified without compromising other information, will be securely stored with restricted access. In such circumstances we won’t attempt to use it, and we will seek to destroy the information in the future when it can be done without compromising other information.

F. Data breach notification

In the event of an eligible data breach involving your personal information, we will notify you and the Office of the Australian Information Commissioner (OAIC) in accordance with the Privacy Act 1988 (Cth).

G. Artificial Intelligence and Personal Information

We will use artificial intelligence (AI) technologies to enhance our efficiency and service delivery. AI may be used to analyse data, automate processes and assist with transcription, discovery and document review. AI applications used by the firm are reviewed in the context of data protection laws and regulations, and we maintain policies and training to support responsible use of AI and compliance with relevant data laws and regulations and ethical rules. It is the firm’s policy not to permit the use of personal information collected pursuant to this privacy policy to train datasets or models that will be used outside the firm’s technical infrastructure or controlled tenanted platform.

Through the firm’s use of AI, your personal information may be transferred to and held by third party processors. Third party processors may be located outside of Australia (including the United States, the United Kingdom, any country located within the European Economic Area, and/or any country that has received an adequacy decision from the European Commission).

Third party processors engaged by the firm’s AI providers are bound by contractual obligations to handle personal information in accordance with applicable data protection laws, including to delete or de-identify the information once it is no longer required. The transfer and processing of personal information to third party processors is based on appropriate safeguards.

H. Marketing

We may use your personal information to contact you to notify you of future claims that you may be eligible to participate in. Such communications will contain a simple ‘unsubscribe’ procedure for individuals who do not want to receive such materials in the future.

I. Cookies and Third Party Websites

We use cookies from our website services. Please see the Cookie Policy.

Our website may contain links to third party sites which are controlled by other parties. You should consult the privacy policies and terms of use of those third party websites. We do not accept responsibility for their collection, use or disclosure of your personal information.

J. Accessing or Correcting your Personal Information

Under Australian privacy laws, you have rights to access and seek correction of your personal information which we hold, except where the law provides a valid reason not to provide the information to you. If we refuse your request to access the information, we will provide reasons for the refusal. Where access or correction of personal information might breach anti-money laundering and counter-terrorism financing laws, for example the tipping off provisions, we may be unable to provide reasons for the refusal.

Please address any requests for access and correction of your personal information to our Privacy Officer by email at dataprotection@phifinneymcdonald.com. We will do our best to respond to you within a reasonable time.

For class action participants, we want the information we hold about you to be accurate and current. If your contact or other information for the class action changes, please notify us of the updated information by writing to the relevant class action contact email address.

K. Incidents and Complaints Handling

If you have any concerns about the manner in which we have dealt with your personal information, or if you believe that we may have breached our obligations under Australian privacy law, please contact our Privacy Officer at dataprotection@phifinneymcdonald.com.

We will do our best to respond to you within a reasonable period of time, and no more than one month. If after that time we have not resolved your complaint, you may refer your complaint to the Office of the Australian Information Commissioner on 1300 363 992, by email to

enquiries@oaic.gov.au or online at www.oaic.gov.au.

L. Where you can find out more about Australian privacy law

If you would like more information about Australian privacy law, please visit the dedicated webpage maintained by the Office of the Australian Information Commissioner

at https://www.oaic.gov.au/privacy-law/.
T: +61 (0)3 9134 7100
E: enquiries@phifinneymcdonald.com

M. Updates to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. Any updates will be published on our website. We encourage you to review this Privacy Policy periodically.