Privacy Policy

In this Privacy Policy, 'us' 'we' or 'our' means DNA Combinator Pty Ltd (ACN 639 775 607). We are committed to respecting your privacy. Our Privacy Policy sets out how we collect, use, store and disclose your Personal Information.

By providing Personal Information to us, you consent to our collection, use and disclosure of your Personal Information in accordance with this Privacy Policy and any other arrangements that apply between us. We may change our Privacy Policy from time to time by publishing changes to it on the Platform. We encourage you to check the Platform periodically to ensure that you are aware of our current Privacy Policy.

Personal Information includes information or an opinion about an individual that is reasonably identifiable. For example, this may include your name, age, gender, postcode and contact details. It may also include financial information, including your credit card information.

1 Definitions

1.1 In this Privacy Policy, the following capitalised terms have the following meanings:

Non-personal Information means information which does not relate to a person and/or cannot be used to identify a person.

Personal Information means any information which can be used to identify an individual, and is described in detail in clause 2.

Privacy Act means the Privacy Act 1998 (Cth).

Spam Act means the Spam Act 2003 (Cth).

Any other capitalised terms which are defined in the Terms of Use have the same meaning as they do in the Terms of Use.

2 What Personal Information do we collect?

2.1 We may collect Personal Information about you when you use the Platform, register on the Platform or interact with us in any way.

2.2 Information you provide to us: We collect all information which Users voluntarily provide to us through using the Platform or interacting with us. This includes information provided:

(a) during registration;

(b) during correspondence, enquiries, emails to our helpdesk, over phone calls, or as part of customer surveys; or

The Personal Information we may collect includes without limitation:

(a) basic information such as your first and last name;

(d) contact information including email address and phone number;

(e) demographic information such as postal code, age, and gender;

(f) geographic location;

(g) information relating to your qualifications, certifications, or trainings;

(h) other personal information obtained by your use of the Platform; and

(i) any other information that enables users to be personally identified.

2.3 Information we automatically collect: We also automatically collect certain technical data that is sent to us from the computer, mobile device and/or browser through which you access the Platform (Automatic Data). Automatic Data, includes without limitation, a unique identifier associated with your access device and/or browser (including, for example, your Internet Protocol (IP) address) characteristics about your access device and/or browser, statistics on your activities on the Platform, details of the membership programs you have subscribed for or that you have enquired about, including any additional information related thereto and response to your enquiries, or information about how you came to the Platform. We collect Automatic Data based on your consent which was granted to us

when you registered as a User and accepted this Privacy Policy.

2.4 Information we obtain from others: We may also collect or receive Personal Information from third party sources, suppliers, social media, or other third-party integrations.

2.5 Non-personal Information: When you interact with the Platform, we may collect Non-Personal Information. The limitations and requirements in this Privacy Policy on our collection, use, disclosure, transfer, and storage/retention of Personal Information do not apply to Non-personal Information. When you register for the Platform or otherwise submit Personal Information to us, we may associate other Non-personal Information (including Non-personal Information we collect from third parties) with your Personal Information. At such instance, we will treat any such combined data as your Personal Information until such time as it can no longer be associated with you or used to identify you.

3 Why do we collect, use, and disclose Personal Information?

3.1 We may collect, hold, use and disclose your Personal Information for the following purposes:

(a) to enable you to access and use our Platform and avail associated services;

(b) to operate, protect, improve, and optimise our Platform, business, and our Users’ experience, such as to perform analytics, conduct research and for advertising and marketing;

(c) to send you service, support and administrative messages, reminders, technical notices, updates, security alerts, and information requested by you;

(d) to send you marketing and promotional messages and other information that may be of interest to you, including information sent on behalf of our business partners that we think you may find interesting;

(e) to administer rewards, surveys, contests, or other promotional activities or events sponsored or managed by us or our business partners; and

(f) to comply with our legal obligations, resolve any disputes that we may have with any of our Users, and enforce our agreements with third parties.

3.2 We may also disclose your Personal Information to a trusted third party who also holds other information about you. This third party may combine that information in order to enable it and us to develop anonymised consumer insights so that we can better understand your preferences and interests, personalise your experience and enhance the services that you receive.

3.3 The information we collect is not distributed, sold, or leased to third parties for commercial purposes, except to provide services you have requested or for other purposes when we have your permission or when we are obliged to do so.

4 Do we use your Personal Information for direct marketing?

4.1 We may send you direct marketing communications and information about the services offered on our Platform. This may take the form of emails, SMS, mail or other forms of communication, in accordance with the Spam Act and the Privacy Act. You may opt-out of receiving marketing materials from us by contacting us, or by using the opt-out facilities provided (e.g. an unsubscribe link).

5 To whom do we disclose your Personal Information?

5.1 We may disclose Personal Information for the purposes described in this Privacy Policy to:

(a) our employees and related bodies corporate;

(b) other Users;

(c) third-party suppliers and service providers (including providers for the operation of our Platform and/or our business or in connection with providing our services to you);

(d) professional advisers, dealers, and agents;

(e) Payment Service Providers (e.g. merchants receiving card payments);

(f) our existing or potential agents, business partners or partners;

(g) our sponsors or promoters of any competition that we conduct via our services;

(h) anyone to whom our assets or businesses (or any part of them) are transferred;

(i) specific third-parties authorised by you to receive information held by us; and/or

(j) other persons, including government agencies, regulatory bodies, and law enforcement agencies, or as required, authorised, or permitted by law.

5.2 We may disclose your Personal Information to recipients that are located outside of Australia, including to our IT support, developers, and other partners located in Ukraine.

6 Using our websites and cookies

6.1 We may collect Personal Information about you when you use and access our Platform. While we do not use browsing information to identify you personally, we may record certain information about your use of our Platform, such as which pages you visit, the time and date of your visit and the internet protocol address assigned to your computer.

6.2 We may also use 'cookies' or other similar tracking technologies on our Platform that help us track your Platform usage and remember your preferences. Cookies are small files that store information on your computer, TV, mobile phone, and other devices. They enable the entity that put the cookie on your device to recognise you across different websites, services, devices and/or browsing sessions. You can

disable cookies through your internet browser but our Platform may not work as intended for you if you do so.

6.3 We may also use cookies to enable us to collect data that may include Personal Information. For example, where a cookie is linked to your account, it will be considered personal information under the Privacy Act. We will handle any Personal Information collected by cookies in the same way that we handle all other Personal Information as described in this Privacy Policy.

7 Security

7.1 We may hold your Personal Information in either electronic or hard copy form. We take reasonable steps to protect your Personal Information from misuse, interference, and loss, as well as unauthorised access, modification or disclosure and we use a number of physical, administrative, personnel and technical measures to protect your Personal Information. However, we cannot guarantee the security of your Personal Information.

8 Retention

8.1 We may retain your Personal Information as long as you are registered to the Platform as a User. You may close your account by contacting us. However, we may retain Personal Information for an additional period as is permitted or required under applicable laws. Even if we delete your Personal Information it may persist on backup or archival media for an additional period of time for legal, tax or

regulatory reasons or for legitimate and lawful business purposes.

9 Exclusions

9.1 Links: Our Platform may contain links to websites operated by third parties. Those links are provided for convenience and may not remain current or be maintained. Unless expressly stated otherwise, we are not responsible for the privacy practices of, or any content on, those linked websites, and have no control over or rights in those linked websites. The privacy policies that apply to those other websites may differ substantially from our Privacy Policy, so we encourage individuals to read them before using those websites.

9.2 Children: We do not knowingly collect Personal Information from children under the age of thirteen (13). If you are under the age of thirteen (13), please do not submit any Personal Information through the Platform. We encourage parents and legal guardians to monitor their children's Internet usage and to help enforce our Privacy Policy by instructing their children never to provide Personal Information through the Platform without their permission. If you have reason to believe that a child under the age of 13 has provided Personal Information to us through the Platform, please contact us and we will endeavour to delete that information from our databases.

9.3 Personal Information Provided to Others: This Privacy Policy does not apply to any Personal Information that you provide to another User or visitor through the Platform or through any other means, or information posted by you to any public areas of the Platform.

10 Accessing or correcting your Personal Information

10.1 You can access the Personal Information we hold about you by contacting us. Sometimes, we may not be able to provide you with access to all of your Personal Information and, where this is the case, we will tell you why. We may also need to verify your identity when you request your Personal Information.

10.2 If you think that any Personal Information, we hold about you is inaccurate, please contact us and we will take reasonable steps to ensure that it is corrected.

10.3 We will consider and respond to all requests in accordance with all applicable laws.

11 Making a complaint

11.1 If you think we have breached the Privacy Act or any other relevant privacy law, or you wish to make a complaint about the way we have handled your Personal Information, you can contact us. Please include your name, email address and/or telephone number and clearly describe your complaint. We will acknowledge your complaint and respond to your complaint within a reasonable period of time. If you think that we have failed to resolve the complaint satisfactorily, we will provide you with information about the further steps you can take.

12 The EU General Data Protection Regulation (GDPR)

12.1 To the extent that the EU General Data Protection Regulation (GDPR) applies to us and your Personal Information, this clause applies.

Legal grounds for processing your Personal Information

12.2 Our legal grounds for us processing your Personal Information for the purposes set out in clause 3 above will typically be because:

(a) you provided your consent;

(b) it is necessary for our contractual relationship;

(d) the processing is in our legitimate interest as a marketplace and platform which allows you to provide, or receive services (for example, to protect the security and integrity of our systems and to provide you with customer service, etc.).

Transfers of Personal Information

12.3 As we are a global company, we may need to transfer your Personal Information outside of the country from which it was originally provided. This may be intra-group or to third parties that we work with who may be located in jurisdictions outside the European Economic Area (EEA), Switzerland and the UK which have no data protection laws or laws that are less strict compared with those in Europe.

12.4 Whenever we transfer Personal Information outside of the EEA, Switzerland, or the UK, we take legally required steps to make sure that appropriate safeguards are in place to protect your Personal Information. Feel free to contact us for more information about the safeguards we have put in place to protect your Personal Information and privacy rights in these circumstances.

Personal Information retention

12.5 We retain your Personal Information for as long as necessary to provide you access to our Platform and services, or for other important purposes such as complying with legal obligations, resolving disputes, and enforcing our agreements.

12.6 If you have an account with us, we will typically retain your Personal Information for a period of 90 days after you have requested that your account is closed or if it's been inactive for 7 years.

Your rights

12.7 Data protection law provides you with rights in respect of Personal Information that we hold about you, including the right to request a copy of the Personal Information, request that we rectify, restrict or delete your Personal Information, object to profiling and unsubscribe from marketing communications.

12.8 To exercise any of your rights, please contact us. Please note that requests to exercise data protection rights will be assessed by us on a case-by-case basis. There may be circumstances where we are not legally required to comply with your request because of the laws in your jurisdiction or because of exemptions provided for in data protection legislation.

12.9 If you have a complaint about how we handle your Personal Information, please contact us. If you are not happy with how we have attempted to resolve your complaint, you may contact the relevant data protection authority.

Data controller and a data processor

12.10 EU data protection law makes a distinction between organisations that process Personal Information for their own purposes (known as "data controllers") and organisations that process Personal Information on behalf of other organisations (known as "data processors"). If you have a question or complaint about how your Personal Information is handled, these should always be directed to the relevant data controller since they are the ones with primary responsibility for your Personal

Information.

12.11 We act as a data controller unless stated otherwise.

13 Contact Us

13.1 For further information about our Privacy Policy or practices, or to access or correct your Personal Information, or make a complaint, please contact us using the details set out below:

13.2 Contact us at support@borisdoes.com

Effective: 01.12.2020