Australian Agricultural Company Limited ACN 010 892 270, of Level 1, Tower A, Gasworks Plaza 76 Skyring Terrace, Newstead Queensland 4006, and its subsidiaries including those trading as Westholme, Darling Downs and 1824 (AACo), recognise the importance of protecting the rights of individuals in relation to their personal and private information. Other than as stated below, this Privacy Policy relates to Personal Data obtained by AACo as a data controller, which includes Personal Data relating to our customers, business contacts, website visitors and others). This Policy excludes personal data about our employees and other staff and personal data obtained when a person is applying for employment (which is managed separately in our Employee and Applicant Personal Data Privacy Policy).

AACo, we, ours, or us means Australian Agricultural Company Limited ACN 010 892 270 and its subsidiaries. Data controller means an organisation (in this case, AACo) that determines the ways in which your Personal Data is processed and why. Data processor means an organisation that processes Personal Data on behalf of a data controller. Personal Data means any information that personally identifies you (or others) or can be used to personally identify you (or others) and is described in section 3. Privacy Laws means United Kingdom General Data Protection Regulation (the UK GDPR); the UK Data Protection Act, the Privacy and Electronic Communications Regulations (PECR); the Australian Privacy Act 1998 (Cth) (the Privacy Act) and the Australian Privacy Principles contained therein; and the Spam Act 2003 (Cth). Privacy Officer means the representative under the UK GDPR who is described in section 16. Process or processing means any operation performed on Personal Data, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction, and any other handling of Personal Data. Sensitive information means Personal Data the reveals racial or ethnic origin, political opinions or associations, religious or philosophical beliefs, trade union membership or associations; criminal record; genetic data; biometric data (where used for identification purposes); data concerning health; data concerning a person’s sex life; and data concerning a person’s sexual orientation.

We collect, hold and process various categories of data, including Personal Data about our customers, business contacts and people who visit our website. AACo will only collect Personal Data in a fair and lawful manner. If you are a customer or potential customer, or otherwise deal with us (including through our website), we collect, hold and process your Personal Data to provide you with our products and services and otherwise facilitate your dealings with us. For example, we use your information to process payments, provide after-sale services, respond to enquiries, resolve complaints, and promotional activities. The kinds of Personal Data we collect or otherwise process will depend upon the circumstances in which the Data is collected. Set out below are the main categories of Personal Data we collect, hold and process when you engage with us.

Account registration information If you register an account with us, we will ask you to provide us with certain information, including your name, contact details, address, country and postcode, date of birth, and industry role. We may also ask for this information when you attend our events or interact with our sales team.

Using our websites or social media sites We may collect website usage information though cookies, web beacons and other technologies, such as the IP address you are using, the name of your internet service provider, your browser version, the web site that referred you to us and the next website you go to, the pages you request and the date and time of those requests. We may also collect information that you provide to us via our website. For example, when completing an online contact form we will ask for your name, email address, country location, industry role and enquiry type, in addition to your comments. If you apply for employment with AACo using our website, your Personal Data will be managed in accordance with our Employee and Applicant Personal Data Privacy Policy.

Market and product development research information If you participate in our market research or product development research (including focus groups, panels and surveys), we may collect information from you including: your name and contact details, date of birth, industry role, demographic information, and your opinions about our products or services, or potential products services.

Information from thirdparty sources We may receive additional information about you that is publicly or commercially available and combine that with the information we have collected or received about you in in other ways. We do not typically collect or otherwise process sensitive information relating to individuals, but may do so in limited circumstances where required or permitted under law. We will provide further notice to you and/or seek your consent when we collect or process sensitive information. If you wish to do so, you may choose to remain anonymous or use a pseudonym when dealing with AACo, unless it is not practicable for us to deal with you on that basis.

Personal Data may be collected by us in certain circumstances, including when you:

• engage with us to purchase our products;

• visit any of our websites;

• subscribe to our marketing communications on various AACo products or communicate with us via our website or our other social media sites;

• interact or follow our social media pages/profiles like Twitter, Facebook and Instagram (including through the use of Meta Pixel);

• otherwise contact us in respect of us providing you with a product or other information (including, for example a request for a copy of our Privacy Policy);

• participate in any of our research projects;

• when we partner with you, or your organisation;

• authorise someone else to act on your behalf and they provide us with your Personal Data;

• submit feedback; or

• submit any query to the Privacy Officer.

We may also collect Personal Data about you in the event of a merger, alliance or joint venture with, or acquisition of, another organisation; or from third-party sources made publicly or commercially available. Data you provide when you subscribe to our marketing communications will be captured within AACo’s CRM database.

We use the Personal Data we collect for the purposes for which it was provided to us, other related purposes, as permitted by law and as required by law. The key purposes for which we use your Personal Data include the following:

• providing or promoting our products and services to you;

• contacting you to obtain your feedback, to find out your level of satisfaction with our products and services and for other market research activities;

• determining the number of visitors to our websites and conducting reviews of our websites;

• personalising use experience on our websites;

• customer segmenting and profiling;

• conducting contests and promotions;

• managing loyalty programs;

• managing event and webinar registration;

• partner marketing opportunities;

• keeping you informed about any changes to our websites as well as goods and/or services;

• conducting product and market research (including focus groups, panels and surveys) so that we can better understand the needs of our customers and tailor our future products and services accordingly;

• responding to any complaints, enquiries and feedback;

• unsubscribing your details from our database;

• any other purposes identified at the time of collecting your Personal Data; and

• to prevent fraud, comply with any legal obligation or as otherwise required by law.

If our information practices change at any time in the future, only Personal Data collected from the time of the policy change going forward will adhere to our updated practices.

AACo does not provide your Personal Data to other entities or organisations for the purposes of direct marketing. We may issue direct marketing communications if you have consented to receiving it or where Privacy Laws otherwise permit us to do so.

At any time you may opt-out of receiving our marketing communications by using any “unsubscribe” facility provided in the marketing communications you receive or by contacting the Privacy Officer with details of the communication and your wish to “opt-out”. We will then take steps to remove your Personal Data from the direct marketing database from which your Personal Data was sourced.

We use Personal Data to automate decisions through profiling in the following ways: Personalised communication: When Personal Data is collected through our website, we will use this information to profile a person based on their role, location and business type to determine the communications that person will receive. Personalised marketing: We may use Personal Data to market messages based on a person's behaviour and preferences, which may include: sending personalised emails, showing personalised product recommendations, delivering personalised advertising, and targeting and communicating with individuals on third party platforms. Testing and optimisation: We may use profiling to run effective A/B tests to ensure that we are assessing variations on the right groups of people. Customer journey mapping: We may use profiling to serve communications based on a person's attributes.

AACo relies on the following legal bases for our data processing (including our marketing) activities. Consent. We may ask for your consent for Personal Data collection and processing – for instance where we can give you a clear choice about what information you need to provide. You may withdraw your consent at any time, without affecting the Personal Data that we previously processed based on your consent. As outlined in section 6 above, we will ask for your consent before we send you marketing communications unless we are otherwise permitted to do so by law. Legal compliance. If any law requires us to, we may need to collect, process and hold your Personal Data. For example, under certain tax laws we are required to retain financial data for seven years. Public interest or vital interests. In limited situations we may use your Personal Data where it is necessary for the performance of a task carried out in the public interest or to protect the vital interests of either you or another person. It is likely to be in the public interest or required to protect someone's vital interests to collect data to prevent crime or dishonesty or safeguard the wellbeing of other people. Contract compliance. We may collect and process your Personal Data where a contract (including a binding MOU), or any steps necessary before entering into a contract, requires us to do so. Legitimate interests. In specific situations, we process your Personal Data to pursue our legitimate interests in ways which might reasonably be expected and which do not materially impact your rights, freedom or interests. AACo's legitimate interests include carrying out tasks such as providing our products and services, managing our distribution, customer and supplier arrangements, intra-group transfers, managing and improving our products and services, assessing interest in our products and services, sharing insights with our retail partners, managing our website and its visitors, administering and protecting our organisation (including IT and physical security), and sending updates and marketing information to you or keeping you updated on our projects.

We will not share or sell your Personal Data with any third party for their own marketing purposes. We may share your personal data with: our employees, contractors and related companies – who help us run our business; our third party suppliers, service providers, distributors, and customers (who on sell our products and services) – who help us and provide our products and services. In many cases, these suppliers are 'data processors' who will only act under our instructions and are subject to equivalent contractual data protection obligations as we describe in this Privacy Policy. We do not allow these organisations to use your Personal Data for their own purposes or disclose it to other third parties without our consent and we will take all reasonable care to ensure that they keep your Personal Data secure. In other cases, these suppliers are 'data controllers' and are required to comply with Privacy Laws in their own capacity; payment systems operators (eg, merchants receiving card payments); regulatory authorities – in order to comply with legal requests where disclosure is required or permitted by law (for example to government bodies, statutory bodies, or law enforcement agencies for tax purposes, where it is in the public interest or for the prevention and detection of crime); other parties in response to legal process or when necessary to conduct or protect our legal rights; anyone to whom our assets or businesses (or any part of them) are transferred; and other third-parties where you provide consent.

AACo may disclose or transfer your Personal Data to third party suppliers outside of the country where you are based (including countries which may not have been determined by the UK Information Commissioner's Office (UK ICO), Office of the Australian Information Commissioner or equivalent authorities to have a similar data protection regime as your home country). Jurisdictions where we process your Personal Data include: countries where we have related companies: Australia and the USA; countries where our employees and contractors may be located: Australia, the USA, the United Kingdom, countries of the European Union, Singapore, Sri Lanka, the Philippines and Korea; and countries in which our service providers may be located: Australia, the USA, India, the Netherlands, Sri Lanka, Singapore, countries of the European Union, New Zealand, and Canada. When we disclose Personal Data to third parties in overseas locations, we do so by taking reasonable steps to ensure adequate safeguards are put in place to protect your Personal Data. This may include (where applicable) entering into the UK ICO's International Data Transfer Agreement with overseas third party recipients or anything else which is required or permitted by applicable Privacy Laws.

AACo is committed to maintaining the confidentiality of all Personal Data that it collects and will take all reasonable steps, and implement appropriate technical controls, to ensure that the Personal Data we collect from you is held securely and protected from misuse and unauthorised access, modification or disclosure. However, AACo cannot and does not guarantee that unauthorised access to your Personal Data will not occur. Accordingly, where consistent with applicable legislation, any Personal Data you provide to AACo will be at your own risk.

We only keep your Personal Data for as long as is reasonable and necessary for the purposes described above in section 5 or to comply with our legal obligations, resolve disputes and enforce our legal agreements and policies. The period that we retain Personal Data is determined by the type of Personal Data, the category of user to whom the Personal Data relates, and the purposes for which we collected the Personal Data. Other factors impacting the retention period include: legal and regulatory requirements, purposes of safety, security and fraud prevention, or by issues relating to our website and the services we offer you. For example, if you contact us to delete your account, we will delete the information that we collected from you in order to administer your account.

You have various rights in relation to your Personal Data, including rights to access, update, delete, restrict processing, or object to or withdraw the use of, your data. You can contact our Privacy Officer to exercise any of your rights in relation to your Personal Data at any time (see section 16 for contract details). In particular, here are the things you can ask us to do in relation to Personal Data we hold about you at any time. Please note that these rights may operate differently depending on the country in which you reside – please contact our Privacy Officer if you would like to find out more. Access. You can request a copy of your Personal Data, including how we first obtained your details. We will provide this as soon as possible, and within 30 days unless there are specific reasons why this would not be possible. We will always let you know if this is likely to be the case. Correct. You can ask us to correct or update your Personal Data when it is incorrect, out of date or incomplete. Delete. You can ask us to delete or permanently de-identify your Personal Data from our systems. We will do so upon your request, to the extent that we are permitted to do so at law. Withdraw consent for marketing. You can withdraw your consent for us to use your Personal Data for direct marketing (either through specific channels or all channels). Restrict processing. You can request that we no longer engage in profiling or other forms of automated decision-making about you. Such requests may lead to you not hearing from us in future. Complain. You can express your concerns or complaints to us about your privacy or the way we are handling your information. We take your concerns seriously and will seek to resolve any issue or concern as soon as possible. Object. You can object to any form of processing which is based on our legitimate interests (including profiling based on these provisions) or to our direct marketing activities. We will consider your objection and stop processing your Personal Data where justified. To protect the confidentiality of your Personal Data, we will ask you to verify your identity before proceeding with any request you make under this Privacy Policy. If you have authorised a third party to submit a request or complaint on your behalf, we will ask them to prove they have your permission to act. If you are not happy with the way we handle your query or handle your Personal Data (including our response to your request to access your rights outlined above), you have a right to lodge a complaint with the relevant privacy or information commissioner in your jurisdiction (the details are set out at section 17 below).

AACo does not knowingly collect any information from persons under the age of 18 who do not have the consent of their parents or guardians. Our databases may nevertheless contain Personal Data of children under 18 because it is not always possible for us to determine precisely the age of an individual.

AACo may update or vary this Privacy Policy from time to time and changes will apply immediately. You should review our Privacy Policy regularly to ensure you are familiar with any changes. Your continued use of our website, platforms or our services after any changes to this Privacy Policy will be taken as your acceptance of those changes.

You can contact AACo’s Privacy Officer (and representative under the UK GDPR) for any query relating to privacy or this Privacy Policy using the contract details below. Email privacy@aaco.com.au Phone +617 3368 4400 Address Attn: Privacy Officer Australian Agricultural Company Limited, Level 1, Tower A, Gasworks Plaza 76 Skyring Terrace Newstead QLD 4006 AUSTRALIA

You can find out more about the various privacy laws and other rules, regulations and standards we have mentioned in this Privacy Policy, or lodge a complaint where you are not happy with the way we've handled your query or your information (as explained in section 13), by visiting the website of the relevant privacy or information commissioner in your jurisdiction. These details are set out below.

Australia Office of the Australian Information Commissioner https://www.oaic.gov.au/

European Union European Data Protection Board https://edpb.europa.eu/about-edpb/about-edpb/members_en

UK Information Commissioner's Office https://ico.org.uk/

USA Office of Privacy and Civil Liberties https://www.justice.gov/opcl

This Privacy Policy was last updated on 21st May 2025