1.Privacy generally

This Privacy Collection Statement applies to the collection of personal information by or on behalf of ShaBaas Pty Ltd (ACN 653 591 550) (ShaBaas, we us, our).

ShaBaas understands the importance of protecting the privacy of an individual’s personal information. This privacy policy sets out how ShaBaas aims to protect the privacy of your personal information, your rights in relation to your personal information managed by ShaBaas and how ShaBaas collects, holds, uses, discloses, and otherwise manages, your personal information.

In collecting, holding, using, disclosing and otherwise managing your personal information, ShaBaas will comply with the Privacy Act 1988 (Cth) (Privacy Act) and the Australian Privacy Principles in the Privacy Act.

ShaBaas will regularly review its policies and procedures regarding personal information and may therefore update and amend this privacy policy from time to time. Any updated privacy policy will be made available on our website at www.shabaas.com.au or can otherwise be obtained by contacting us and requesting a copy.

2.Kinds of personal information collected

Personal information includes information or an opinion about an identified, or reasonably identifiable, individual.

During the provision of our payment and other products or services or as a result of our other interactions or dealings with you, ShaBaas may collect your personal information.

The kinds of personal information that ShaBaas collects will vary depending on our particular interactions or dealings with you. However, generally speaking, the kinds of personal information ShaBaas collects may include:

• (a) contact information such as your name and email address;
• (b) information we may require to verify your identity such as your physical current address, date of birth, mobile phone number, government identification information and other personal information that we may require for identity verification purposes;
• (b) information such as your expected transaction activity as well as ‘know-your-customer’ (KYC) information that we require for account opening and maintenance purposes;
• (c) information such as your expected transaction activity as well as ‘know-your-customer’ (KYC) information that we require for account opening and maintenance purposes;
• (d) payment activity information from you when you transact using our payment services, such as transaction amount, date and time, and information related to the merchant or other recipient or sender for each transaction;
• (e)other transaction information relating to your use of our products or services or information relating to your correspondence or dealings with us;
• (f)information you disclose to our customer support team; and
• (g)any information required under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) and the Anti-Money Laundering and Counter-Terrorism Financing Rules.

ShaBaas may also hold other kinds of personal information as permitted or required by law or other kinds of personal information that we notify you of at or about the time of collection. Privacy Policy (clean).DOCX Page 2 Generally, we do not collect sensitive information about individuals. Information about your health, racial or ethnic origin, political persuasions, criminal record and religious or philosophical beliefs are all examples of sensitive information. If we do need to collect sensitive information about you, we will only do so with your consent or where we are required to do so by law (for example, information about whether you are a politically exposed person or subject to other sanctions).

3.How we collect personal information

Generally, ShaBaas collects your personal information directly from you. For example, ShaBaas may collect your personal information:

• when you use or apply to use our payment or other products or services;
• when you register for an account with us, request information or services or otherwise provide us with your details;
• where you download or use our online, mobile or other applications or software;
• where you use our website or other services or otherwise interact with us;
• when you complete a survey or enter a promotion or competition; or
• if you post information to any of our social media sites.

There may be occasions when ShaBaas collects your personal information from someone other than you, for example:

• from your bank or other relevant financial institutions in order to provide our services to you;
• from third parties you authorise to disclose your information to us;
• from a publicly maintained record or other publicly available sources of information including social media and similar websites;
• from our vendors, suppliers or contractors that help us provide our products or services to you; and
• from third parties for identity verification purposes or when performing any checks required under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) or other similar laws.

Generally, ShaBaas will only collect your personal information from sources other than you if it is unreasonable or impracticable to collect that personal information from you.

4.Purposes for which personal information is used

Some examples of the purposes for which ShaBaas collects, holds, uses and discloses your personal information include to:

• enable us to supply you with information you request from us;
• operate our digital payment platform;
• supply our services to you, including our digital payment services;
• personalise your experience with our services;
• conduct promotions, competitions, giveaways and events;
• contact you to obtain your feedback regarding our services or to conduct other market research;
• undertake direct marketing (as detailed in paragraph 5 below);
• analyse information we collect so that we can administer, support, improve and develop our business and the services we offer; and
• comply with the obligations of ShaBaas under any applicable laws.

In addition to the purposes listed above, ShaBaas may use your personal information for other purposes which we notify you of when we collect the information and for purposes otherwise permitted or required by law.

Where personal information is used or disclosed, ShaBaas takes steps reasonable in the circumstances to ensure it is relevant to the purpose for which it is to be used or disclosed. You are under no obligation to provide your personal information to ShaBaas. However, without certain information from you, ShaBaas may not be able to provide services or information to you or may be limited in how we can interact with you.

5.Direct marketing

In addition to the purposes outlined in paragraph 4 above, ShaBaas may use your personal information in order to inform you of promotions, competitions, giveaways, events, products or services that may be of interest to you. This may include using your personal information for the purpose of promoting third party products and services. If you do not wish to receive such communications, you can opt-out by contacting ShaBaas via the contact details set out in paragraph 11 of this privacy policy or through the opt-out mechanism contained in a marketing communication to you.

6.Disclosure of personal information

ShaBaas discloses your personal information for the purpose for which ShaBaas collects it. As a result, generally, ShaBaas will only disclose your personal information for a purpose set out in paragraphs 4 and 5 of this privacy policy. This may include disclosing your personal information to:

• related companies of ShaBaas in order to provide our services to you;
• our service providers, contractors and other third parties that provide products or services to us (including our technology service providers, payment processors, verification services and administration service providers);
• other third parties that are integral to the provision of our services (including financial institutions and other payment processors);
• where you use our services to make payments to merchants or other third parties, the merchants and other third parties you make those payments to;
• third party service providers for identity verification or Anti-Money Laundering compliance related purposes;
• people or entities considering acquiring an interest in ShaBaas business or assets;
• other parties who invest in or acquire an interest in ShaBaas;
• ShaBaas professional advisors (including legal and accounting firms, auditors, consultants, insurers and other professional advisers); and Privacy Policy (clean).DOCX Page 4 ◼ Government authorities where required by law.

ShaBaas may also disclose your personal information for other purposes if we notify you of the disclosure at or about the time of collecting the information, we have otherwise received your consent or the disclosure is required or authorised by law.

If you post information or other content to public sections of our website or to our social media sites, you acknowledge that the information or content may be viewed by the public and/or users of the relevant website or social media site.

7.Overseas disclosures

ShaBaas works with selected technology and other vendors who may process or have access to your personal information. Where possible ShaBaas will require that these vendors store any data and personal information they collect from ShaBaas in Australia. However, some of these vendors may access or store your personal information outside of Australia for limited purposes (such as standard data analytics purposes).

8.Links to other websites

When you access our website or other online services, we may provide as a convenience to you links to other websites, including sites operated by our partners, associates, or independent third parties. These links are provided as a convenience to you. Each website has its own privacy practices, as described in that site’s privacy policy. Those practices may be different than the practices described in this privacy policy, and we encourage you to read each website’s privacy policy carefully before you use or submit information to that site. Additionally, to the extent that you follow a link to a website operated by an independent third party, please be aware that we exercise no authority or control over that third party, and cannot and are not responsible for any information that you may submit to that site.

9.Security of personal information

ShaBaas takes steps reasonable in the circumstances to ensure that the personal information it holds is protected from misuse, interference and loss and from unauthorised access, modification or disclosure.

Your personal information will be kept on databases held on servers kept in a physically and technologically secured environment, accessed only by authorised personnel or contractors. Where personal information is held in hard copy, it will be held in controlled, access restricted premises which only authorised personnel will be permitted to access.

We have in place procedures for training our employees about their obligations under this privacy policy, disciplining them for failure to follow this privacy policy. We also have in place internal procedures to confirm general company compliance with this privacy policy.

ShaBaas will destroy or de-identify personal information in circumstances where it is no longer required, unless ShaBaas is otherwise required or authorised by law to retain the information.

Where you have an account with us, you are responsible for maintaining the confidentiality of your user name and password. You will be responsible for all uses of your account, whether or not authorised by you. You agree to immediately notify ShaBaas of any unauthorised use of your user name or password.

10.Access and correction

ShaBaas takes steps reasonable in the circumstances to ensure personal information it holds is accurate, up-to-date, complete, relevant and not misleading.

Under the Privacy Act, you have a right to seek access to and correction of your personal information that is collected and held by ShaBaas. If at any time you would like to access or correct the personal information that ShaBaas holds about you, or you would like more information on ShaBaas approach to privacy, please contact the ShaBaas Privacy Officer using the details Privacy Policy (clean).DOCX Page 5 set out in paragraph 11 below. ShaBaas will grant access to the extent required or authorised by the Privacy Act or other law and take steps reasonable in the circumstances to correct personal information where necessary and appropriate.

To obtain access to your personal information:

• you will have to provide proof of identity to ensure that personal information is provided only to the correct individuals and that the privacy of others is protected;
• ShaBaas requests that you be reasonably specific about the information you require; and
• ShaBaas may charge you a reasonable administration fee, which reflects and will not exceed the cost to ShaBaas for providing access in accordance with your request.

ShaBaas will endeavour to respond to your request to access or correct your personal information within 30 days from your request. If ShaBaas refuses your request to access or correct your personal information, ShaBaas will provide you with written reasons for the refusal and details of complaint mechanisms.

11.Contacting ShaBaas

For further information or enquiries regarding your personal information, or if you would like to opt- out of receiving any promotional or marketing communications or make a privacy complaint, please contact ShaBaas Privacy Officer using any of the following contact details:

Email: support@shabaas.com

Phone: +61 2 8094 8092

12.Privacy complaints

Please direct all privacy complaints to ShaBaas Privacy Officer. At all times, privacy complaints:

• will be treated seriously;
• will be dealt with promptly;
• will be dealt with in a confidential manner; and
• will not affect your existing obligations or affect the commercial arrangements between you and ShaBaas.

ShaBaas will acknowledge your complaint within 1 day of receipt and endeavour to resolve it within 30 days, unless ShaBaas informs you otherwise and seeks your agreement in writing.

ShaBaas Privacy Officer will commence an investigation into your complaint. You will be informed of the outcome of your complaint following completion of the investigation. In the event that you are dissatisfied with the outcome of your complaint, or an extension to the time in which ShaBaas will resolve it, you may refer the complaint to the Office of the Australian Information Commissioner.

‍