PRIVACY POLICY

Rev-Raise Group Pty Ltd trading as Rev-Raise | ABN 45 691 400 594 | Version 3.1 | 13 September 2026

This policy explains how Rev-Raise Group Pty Ltd trading as Rev-Raise (we, us, our) handles personal information. Words with capital letters, such as Engagement, Service Agreement and Systems, have the meaning given in clause 1 of our Master Client Terms at rev-raise.com/terms.

---

1. THE STANDARD WE APPLY

1.1 We apply the Australian Privacy Principles in the Privacy Act 1988 (Cth) as our standard for all personal information we handle.

1.2 For our clients, the binding commitments about personal information are in clause 11 of the Master Client Terms and in Schedule J, Data Processing, at rev-raise.com/terms-data. This policy is linked from those terms for notice and operational information. It is not incorporated into them and does not change them (Master clause 11.9).

1.3 This policy covers the matters the Australian Privacy Principles require a privacy policy to cover: the kinds of personal information we collect and hold, how we collect and hold it, why, how you can access and correct it, how to complain, whether we disclose it overseas and to which countries, and how we use automated processing.

2. WHAT WE COLLECT

2.1 About you, when you deal with us directly. Depending on how you deal with us, we collect:

(a) your name, email address, phone number and job title;

(b) your business name and information about your business;

(c) what you tell us in forms, enquiries, bookings, applications, scorecards and calculators;

(d) billing and payment records. Card payments are made through our payment processor, and we do not store card details (Master clause 5.3);

(e) our communications with you, including emails, messages, notes of calls and meetings, and records of what you asked us to do;

(f) information about your visit to our website, as described in clause 13 and our Cookie and Tracking Policy;

(g) your marketing preferences, and records of your consent and of any request to unsubscribe;

(h) recordings of training sessions, review sessions and calls, only as clause 6 allows, and the Attendee Recording Consent you sign;

(i) photographs of you at a public event, only where you opted in at registration and only for the uses you opted in to (Schedule C clause 12.1);

(j) training, attendance, assessment, accreditation and completion records for people who attend our training, use a module library we host, or are nominated as Facilitators, including the register of accredited Facilitators described in Schedule I clause 3.1; and

(k) records of your Engagement, including your Service Agreement, the Engagement Register, approvals and invoices.

2.2 About people whose information is in Systems we operate for a client. Whatever that client's Systems collect. Clause 3.2 explains how we treat it.

2.3 Sensitive information. We do not intentionally collect sensitive information, as defined in section 6 of the Privacy Act, such as health information, for our own purposes, and we ask you not to send it to us. A client must tell us before putting sensitive information into Systems we operate, and agree the additional controls in writing (Schedule J clause 3.2).

2.4 Dealing with us without giving your name. You can read our website without telling us who you are. We need your name and contact details to answer an enquiry, take a booking or supply a service.

3. OUR TWO ROLES

We handle personal information in two different roles.

3.1 Our own dealings

When you visit our website, enquire, book, buy, attend training or become a client, we decide what we collect and why. This policy governs that information.

3.2 Information in Systems we operate for a client

3.2.1 Where we build or operate Systems for a client, those Systems hold personal information about the client's own customers, and may hold employee information, New-Hire records, recordings and reporting data. Schedule J governs that information, whether or not it is named in the client's Service Agreement (Master Preamble).

3.2.2 The client decides what is collected and why, and we act on the client's instructions, only to deliver the services in its Service Agreement (Schedule J clause 1.1).

3.2.3 We do not use that information for our own purposes, market to the client's customers, or sell, rent or share it except with the service providers who help us deliver the services (Schedule J clause 2.2). Our commitments on model training are in clause 11.3 of the Master Client Terms, and Schedule J clause 2.3 applies them to that information.

3.2.4 When the Systems end, the information is exported and deleted under Schedule B clause 12 where Schedule B applies, and otherwise under Schedule A clause 16 or the client's Service Agreement (Schedule J clause 8.1). Clause 10 sets out the periods.

3.2.5 If you are a customer of one of our clients, contact that business to access, correct or delete your information. It controls the information. If you contact us, we refer you to the business and tell it on the same Business Day (Schedule J clause 3.3).

4. HOW WE COLLECT AND HOLD IT

4.1 We collect personal information:

(a) directly from you, when you contact us, complete a form, book a call, buy, attend a session, apply to work with us or sign a document;

(b) automatically when you visit our website, as described in clause 13 and our Cookie and Tracking Policy;

(c) by recording a session or call, only as clause 6 allows; and

(d) from a third party, such as your employer, where it nominates you for training, as a Facilitator or as an Authorised Representative, or where you have authorised the connection or referral.

4.2 We hold personal information electronically, in systems run for us by the service providers described in clause 8, including the website and sales platform we use. Where a document is signed on paper, we keep the signed document or a copy of it.

5. AUTOMATED PROCESSING AND DECISIONS

5.1 What we use automated processing for. We use automated tools and automated processing to:

(a) record and organise enquiries, form responses and bookings, and send messages about them;

(b) draft, organise and summarise documents and content, including notes of calls and meetings; and

(c) for clients, deliver the services in their Service Agreement, including automated processing of sales and customer communications in Systems we build or operate (Master clauses 3.2 and 11.2).

5.2 The kinds of personal information used. Name, contact details, business name and business information, the answers you give in forms, bookings, scorecards and applications, the content of your communications with us, and information about your visit to our website.

5.3 Decisions. We do not currently use a computer program to make a decision, or to do a thing that is substantially and directly related to making a decision, that could reasonably be expected to significantly affect your rights or interests. Where automated processing organises or summarises information about you, a person makes any decision about you. That includes applications to work with us: automated processing does not score, rank or decline an application or enquiry, and a person reviews each one.

5.4 Systems we operate for clients. If a System we build or operate for a client is to make, or materially contribute to, a decision that significantly affects an individual, clause 11.5 of the Master Client Terms and Schedule J clause 10 apply: we tell the client beforehand what the decision is and what information it uses, so that the client can meet its own transparency obligations, and it does not go live without the client's approval.

5.5 Asking for a person. If you want a person to look at an outcome produced by automated processing, email [email protected] and a person will review it.

5.6 Timing. Australian Privacy Principles 1.7 to 1.9, which require a privacy policy to describe automated decisions, apply from 10 December 2026. This clause is written to meet them.

6. RECORDINGS

6.1 Consent first. We record a training or review session only where each person present has signed an Attendee Recording Consent before the session. The consent covers being recorded and each use of the recording, and each use is a separate choice. Marketing, publication and any other external use are separate optional choices. Anyone may refuse, and refusing has no effect on their participation (Schedule C clause 7.1).

6.2 No recording while a person who has not consented is present. We do not record any part of a session that a person who has not consented attends. We take written notes instead (Schedule C clause 7.2).

6.3 Every recording is announced. Every recorded session or call opens with an announcement that it is being recorded (Schedule C clause 7.3 and Schedule H clause 8.2(c)).

6.4 Employers. Where a client's employees attend, the client circulates the Attendee Recording Consent before the session, and gives any workplace notice the law requires (Schedule C clause 7.5 and Schedule H clause 8.2).

6.5 A client's customers. We record a conversation with a client's customer, or use a recording of one the client gives us, only where the client confirms in writing that the customer was told before the conversation that it may be recorded and provided to Rev-Raise as the client's training provider. A customer who declines is not recorded, and we work from written notes or live observation instead (Schedule C clause 7.6 and Schedule H clauses 8.2(b) and 8.3).

6.6 Use. A recording is used only for the uses each person consented to, or, for a customer recording, only to coach that conversation and, where Schedule F applies, to score it. We do not publish any recording, or any part of one, outside the client's business unless every identifiable person in it has consented to that publication and the client has agreed in writing (Schedule C clauses 7.4 and 7.6).

6.7 Public events. Where we film a public event, we film only the presenter and the slides. The audience is not filmed or recorded (Schedule C clause 12.1).

6.8 Storage and retention. Recordings are held with our service providers, which may process data outside Australia (clause 8). Recording law differs between states and territories, so we apply the consent standard in this clause everywhere. Clause 10 sets out how long recordings are kept.

6.9 Our own calls and meetings. Where we record or transcribe a call or meeting with you, such as a Diagnostic Call or a client meeting, we tell you at the start, and we do not record or transcribe it if you ask us not to. We use the recording or transcript only to prepare notes and to deliver our services to you, and we delete it within 90 days after the call or meeting.

7. WHY WE COLLECT IT

We collect, hold, use and disclose personal information to:

(a) deliver and manage our services;

(b) communicate with you about your enquiry, booking, account or Engagement;

(c) process payments and manage billing;

(d) send you marketing, only with your consent (clause 12);

(e) improve our website, our materials and how we deliver;

(f) comply with our legal obligations; and

(g) protect the security of our business and the Systems we operate.

8. WHO WE SHARE IT WITH

8.1 Service providers. We use third-party service providers in these categories:

8.2 Named providers. A current list of named providers, and the countries in which each processes data, is available on request. A client receives it within 10 Business Days of asking (Schedule J clauses 4.2 and 6.1).

8.3 Providers. We take reasonable steps, including reviewing a provider's terms before we use it, to ensure each provider protects personal information with reasonable security and uses it only as its terms permit (Schedule J clause 4.4; Master clause 11.3).

8.4 Overseas disclosure. Some providers process personal information outside Australia. The country in which they are most likely to do so is the United States. Some providers run networks in other countries too, and the named list states the countries for each provider. Before personal information is disclosed overseas, we take reasonable steps, including contractual commitments where available, to ensure the recipient handles it consistently with the Australian Privacy Principles, to the standard of APP 8. We treat ourselves as accountable for how an overseas recipient handles that information, in the way section 16C of the Privacy Act provides, unless an exception would apply.

8.5 Other disclosures. We also disclose personal information:

(a) to the client that engaged us, where you are one of its people. For example, call review findings go to the client (Schedule H clause 8.4), accreditation results go to the Facilitator and the client (Schedule I clause 7.3), and New-Hire completion reports go to the client's nominated manager (Schedule C clause 16.1(d));

(b) where the law requires or authorises it; and

(c) in a business transfer under clause 13.4.

8.6 We do not sell personal information.

9. SECURITY

9.1 We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure, to the standard of APP 11. This includes multi-factor authentication on the accounts that access it.

9.2 Data breaches. We assess any suspected data breach. Where a breach is likely to result in serious harm, we notify the people affected and the Office of the Australian Information Commissioner in the way the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act provides.

9.3 Client Systems. Clause 11.7 of the Master Client Terms and Schedule J clause 7 set out when and how we notify a client of an incident affecting personal information in Systems we operate for it.

10. HOW LONG WE KEEP IT

10.1 Our own dealings.

• Enquiries and prospects who did not become clients: 24 months after last contact.
• Free course and free community accounts: while active, then 12 months after last login.
• Client records and engagement documents, including training, attendance, assessment and accreditation records we hold in our own right: 7 years after the Engagement ends.
• Records a law requires us to keep, such as tax and financial records: only for the period the law requires, and only for that purpose, and then deleted.
• Recordings and transcripts of our own calls and meetings with you: deleted within 90 days after the call or meeting (clause 6.9).

10.2 Information we hold for clients. These periods are set by the Schedules, and the Schedule governs:

Data in Systems we operate, where Schedule B applies. Export on request before the Systems end and for 30 days afterwards. Access continues for 30 days after the Systems end, or until the export is provided where it was requested in the last 10 Business Days of that period. Where access was locked when the Systems ended, for example for non-payment, live access is not restored, but the export is still provided. Deleted 90 days after access ends, unless the client asks us in writing to delete it sooner or to hold it longer at a holding fee we tell it before it starts. (Where the rule is: Schedule B clauses 12.4 to 12.6; Schedule J clause 8.1.)

Data in Systems we operate under a subscription, where Schedule B does not apply and the Service Agreement has no off-boarding clause of its own. Export on request before the subscription ends and for 30 days afterwards. Access continues for the same 30 days, or until the export is provided where it was requested in the last 10 Business Days of that period. Where access was locked when the Systems ended, for example for non-payment, live access is not restored, but the export is still provided. Deleted 90 days after access ends, unless the client asks us in writing to delete it sooner or to hold it longer at a holding fee we tell it before it starts. (Where the rule is: Schedule A clauses 16.1, 16.3 and 16.4; Schedule J clause 8.1.)

Recordings of training sessions. Kept only for the uses each person consented to in their Attendee Recording Consent, and deleted when those uses end or, if no longer period was consented to, 24 months after the session, whichever is earlier. (Where the rule is: Schedule J clause 8.2.)

Recordings of a client's customer, given to us for coaching. Deleted within 90 days after the coaching or review for which it was provided, unless the client asks us in writing to keep it longer. (Where the rule is: Schedule C clause 7.6; Schedule J clause 8.2.)

Recordings given to us for call and consultation review. Kept for no longer than 90 days after the review, unless the client asks us in writing to keep it longer, and then deleted. (Where the rule is: Schedule H clause 8.5; Schedule J clause 8.2.)

Employee information, New-Hire records (including completion reports and assessment results) and reporting data. When the service that uses them ends, a copy is given to the client on request within 30 days. Deleted 90 days after that service ends, unless the client asks us to delete them sooner. (Where the rule is: Schedule J clause 8.3; Schedule C clause 20.4.)

Records a law requires us to keep. Only that record, only for the period the law requires, and only for that purpose. (Where the rule is: Schedule A clause 16.5; Schedule B clause 12.7; Schedule J clause 8.4.)

Copies in backups. May remain in backups after deletion from live systems. Backups are not used for any purpose other than disaster recovery, and the information is deleted when those backups are overwritten. (Where the rule is: Schedule A clause 16.4; Schedule B clause 12.6; Schedule J clause 8.5.)

10.3 Some data sits with the third-party platforms a client's Systems run on. We close or delete the accounts we manage on those platforms and ask the provider to delete the data. A provider's own retention rules apply to data it keeps under its own terms (Schedule A clause 16.6 and Schedule B clause 12.8).

10.4 When we no longer need personal information and no rule above requires us to keep it, we delete it or de-identify it.

11. YOUR RIGHTS

11.1 You may ask us to:

(a) give you access to the personal information we hold about you;

(b) correct it if it is wrong, out of date or incomplete;

(c) stop sending you marketing, at any time (clause 12);

(d) delete it, unless we need to keep it under clause 10;

(e) have a person review an outcome produced by automated processing (clause 5.5); or

(f) deal with a complaint (clause 14).

11.2 Email [email protected]. We may need to confirm who you are before we act. We respond within 30 days. If we refuse a request, we tell you why in writing and how to complain.

11.3 There is no charge for making a request. Where giving access involves substantial work, we may charge a reasonable cost, and we tell you before we do.

11.4 If your information is held in Systems we operate for a client, clause 3.2.5 applies.

12. MARKETING

12.1 We send marketing only with your consent, as the Spam Act 2003 (Cth) requires. That consent is express, or inferred where the Spam Act allows it. A one-off enquiry or purchase does not by itself give ongoing marketing consent.

12.2 Every marketing message identifies us and has an unsubscribe link. You can also unsubscribe by emailing [email protected]. We honour an unsubscribe request within 5 business days, calculated under clause 6 of Schedule 2 to the Spam Act 2003 (Cth) as business days at the place to which the message was sent.

12.3 Consent to marketing is separate from buying from us. Declining marketing does not affect any service you buy.

13. COOKIES, CHILDREN, THIRD-PARTY LINKS AND BUSINESS TRANSFER

13.1 Cookies. Our website uses a visitor identifier cookie and browser storage set by the website and sales platform we use, embedded forms and a booking calendar that may set their own cookies, an analytics service that its provider describes as not using cookies, and web fonts. There are currently no advertising or social media pixels on the site. Our Cookie and Tracking Policy at rev-raise.com/cookies has the detail and explains your choices.

13.2 Children. Our website, courses, events and services are for people aged 18 or over (Master clause 2.6). We do not knowingly collect personal information from anyone under 18. If you believe we have, contact us and we will delete it.

13.3 Third-party links. Our website links to other sites and uses third-party platforms for some courses and video. This policy does not apply to them. Their own policies do.

13.4 Business transfer. If we sell our business or its assets, or merge, personal information we hold may transfer as part of that transaction. We take reasonable steps to ensure the buyer handles it consistently with this policy. For clients, clause 24.1 of the Master Client Terms governs assignment.

14. COMPLAINTS

14.1 Contact us first at [email protected], or by post to 14 Wales Street, Margate QLD 4019. We acknowledge your complaint within 5 business days and give you our answer in writing within 30 days.

14.2 If you are not satisfied with our answer, you may contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992 for information about your options.

15. CHANGES

15.1 The current version of this policy is published at rev-raise.com/privacy, with its date at the top.

15.2 If we change this policy, personal information we already hold for a client remains protected to at least the standard described in the version in force when the client's Engagement began, unless the later version gives greater protection (Master clause 11.10).

16. CONTACT

Privacy enquiries: [email protected] | +61 468 055 551

Rev-Raise Group Pty Ltd trading as Rev-Raise, ABN 45 691 400 594
14 Wales Street, Margate QLD 4019, Australia

---

© 2026 Rev-Raise Group Pty Ltd trading as Rev-Raise (ABN 45 691 400 594). All rights reserved. THE DELIBERATE SALE™ and REV-RAISE™ are trade marks used by Rev-Raise under an exclusive licence.