Autosports Group Limited and each of its subsidiaries (Autosports Group, we, our or us) are committed to protecting your privacy and personal information. This Privacy Policy (Policy) explains how we collect, use, disclose, safeguard and otherwise handle personal information in accordance with the Australian Privacy Principles (APPs), the New Zealand Privacy Principles (NZPPs), the Privacy Act 1988 (Cth) (Australia) and the Privacy Act 2020 (New Zealand), the Credit Reporting Code and any other applicable privacy laws.

You are not required to provide personal information to us, but in some circumstances we might not be able to provide you with our products and services without your personal information. Depending on how you interact with Autosports Group (eg online, offline) and for what products and services, we may collect the following types of personal information from or about you, as set out below: • contact and identification information: such as name, address, phone number, email address, business and company numbers, drivers licence and demographic information (such as date of birth, occupation, gender) • employment information: employment history, proof of work eligibility, licence information • finance and insurance information: purchase history, tax file number, current or previous insurance information (for motor insurance), documents to support a finance application, including salary and personal finances (for loan applications) • vehicle and servicing information: vehicle registration, vehicle purchase details, service appointment bookings specific technical data downloaded from your vehicle for diagnostics, fault memory, specification and warranty information for the purpose of servicing your vehicle • device information and IP addresses: when you visit our websites, we may receive data about the computer system or device you are using and/or analytical data, such as your Internet Protocol (IP) address, operating system type, web browser type and version and, if you access our websites using a mobile device such as a smartphone, where permitted the information collected will also include the unique device identifier, advertising identifier, geo-location and other similar mobile device data • information volunteered: any other information you choose to provide us or is relevant or necessary to enable us to provide you with our services, and/or to support your purchase of any of our products or services

We collect personal information from you in a variety of ways, including when you interact with us in person, when you interact with us electronically, when you access our website, when we (and our third party service providers) provide services to you.

We collect, hold, use and disclose your personal information for the following primary reasons: • to provide our products and services to you • to process your transactions • to communicate with you about our products and services • marketing and promotional activities (with your consent (where required) or legitimate interest) • to comply with legal and regulatory obligations • for internal business operations purposes   We also collect, hold, use and disclose personal information for other purposes explained at the time of collection, to which you have consented, or which are required, or authorised by or under law.

We may disclose your personal information to: • our related bodies corporate within Autosports Group • other organisations that provide products or services to us, for example:  our vehicle manufacturers and their related bodies corporate dealer management system providers  third party software providers  shipping, courier and/or freight service providers  marketing agencies  lenders  insurers  insurance and finance brokers  debt recovery agencies  legal, taxation and financial advisors  shareholder registry  • regulatory authorities • state government entities responsible for motor vehicle registrations and driving infringements • comply with lawful requests from regulatory authorities and law enforcement agencies • a company that has acquired the stock or assets of a member of Autosports Group or one of our Dealerships. If such a transfer occurs, the acquiring company’s use of your personal information will still be subject to this Policy.

Autosports Group is headquartered in Sydney, Australia, and with key facilities and personnel in Australia and New Zealand. We hold your personal information in a number of ways including: • electronic files using third party software programs stored on a server, hard drive or in the cloud • hard copy files stored securely at one of our sites or at a third party document archiving facility • in cloud or other types of networked or electronic storage Due to the number and complexity of the IT systems we use to operate our business and because majority of the brands we sell are based overseas, your personal information may be disclosed to third party service providers and suppliers located overseas, including vehicle manufacturers, external advisors and service providers. When we transfer your personal information to other countries, we take reasonable steps to ensure that applicable laws are being followed and that adequate data transfer mechanisms are put in place. Personal information is held in accordance with our data retention policy and relevant legislative requirements. Once personal information is no longer required to be held we take all reasonable care to securely destroy it.

We are committed to ensuring that the information you provide to us is kept secure. We have a range of technical, administrative, and other security safeguards to protect your personal information from interference, misuse, loss, unauthorised access, modification, or disclosure. This includes control of access to our buildings and our electronic databases are password access only with virus protection software installed. The steps we take to secure the personal information we hold include website protection measures (such as firewalls and anti-virus software), security restrictions on access to our computer systems (such as login and password protection), controlled access to our corporate premises, policies on document storage and security, personnel security (including restricting access to personal information on our systems to staff who need that access to carry out their duties, staff training and workplace policies. We process payments using EFTPOS and online technologies. All transactions processed by us meet industry security standards to ensure payment details are protected.

We take all reasonable precautions to ensure that the personal information we collect, use and disclose is accurate, complete and up to date. If you wish to access or make any changes to the personal information we hold about you, please contact us at the details under ‘Contact us’ in this Policy, below. We will require you to verify your identity before processing any access or correction requests, to ensure that the personal information we hold is properly protected.

You may opt-out of receiving marketing communications from us at any time, by: • using the unsubscribe function in our electronic messages (such as email, SMS and MMS) • contacting us (see ‘Contact us’ in this Policy, below) • if you receive a marketing call, advising us that you no longer wish to receive these calls

Cookies We use cookies on our website to: • provide you with a better website experience • to better understand your behaviours and habits • display relevant advertisements or content on our network and third party networks and websites We use remarketing tools such as Google Ad Words to personalise your marketing and content experience. When you visit our website or related landing pages to read, browse, submit or download information, our system will record/log information such as your IP address, date and time of your visit to our site, the pages viewed, and any information downloaded. We automatically collect non-personal information about you such as the site from which you linked to our website. We also collect your personal information through the use of cookies. You can configure your browser to refuse cookies or delete existing cookies from your hard drive. Rejecting cookies will limit your website experience. Web beacons The use of a web beacon allows the website to record the simple actions of the user (such as opening the page that contains the beacon) through a tracking pixel. We use web beacons (and cookies) to analyse site usage, to report and audit advertising and personalise your content. We share data collected from web beacons (and cookies) with third parties to provide you with relevant advertising when browsing third party websites. Advertising and tracking We advertise on third party websites. When you view our advertisements on third party websites, the advertising company will use cookies, and in some cases, web beacons, to collect information such as the server your computer is logged onto, your browser type, the date and time of your visit and the performance of their marketing efforts. When you access our website after viewing one of our advertisements on a third party website, the advertising company will collect information on how you utilise our website (for example, which pages you viewed) and whether you commenced or completed any online forms.

When you apply to work at or for Autosports Group, you are asked to provide personal information such as contact details, proof of work eligibility and referees’ contact details. Personal information about you may also be collected from others as a result of interview feedback, reference checks, background checks and psychometric assessments. Personal information collected throughout the job application process will not be shared with any third parties without your consent, outside of the use of service providers acting on Autosports Group’s behalf. When you provide references as part of your job application, Autosports Group may contact those individuals and disclose to them that you have applied to work at Autosports Group. We may share your personal information with the referees you designate or other third parties, and we can collect from them additional personal information about you for the purpose of completing the background check process. Similarly, if you are a referee we may collect and use your personal information.

Credit information is a sub-set of personal information, and it is information that is used to assess your Page 4 of 4 eligibility to be provided with finance. It includes any finance that you have outstanding, your repayment history in respect of those, and any defaults. Usually, credit information is exchanged between credit and finance providers and credit reporting bodies (CRBs). Credit providers (such as lenders and utility) provide information about individuals’ activities in relation to consumer credit to central databases managed by CRBs. CRBs are then able to include that information on the individual’s credit report. A credit provider can obtain a copy of an individual’s credit report from a CRB to assist them in deciding whether to provide an individual with consumer credit, or to manage credit that has been provided to an individual.

The law requires us to advise you of ‘notifiable matters’ in relation to how we use your credit information. You can request to have these notifiable matters (and this Policy) provided to you in an alternative form, such as a hard copy. We may exchange your credit information with CRBs. We will use the credit information that we exchange with the CRBs to assess your creditworthiness, assess your application for finance and manage your finance. If you fail to meet your payment obligations in relation to any finance that we have provided or arranged, or you have committed a serious credit infringement, we may disclose this information to a CRB. You have the right to request access to the credit information that we hold about you and make a request for us to correct that credit information if needed. Sometimes, your credit information will be used by CRBs for ‘pre-screening’ credit offers on the request of other credit providers. You can contact the CRB at any time to request that your credit information is not used in this way. You can contact the CRB to advise them that you believe that you have been a victim of fraud. For 21 days after the CRB receives your notification, the CRB must not use or disclose that credit information. You can contact any of the following CRBs for more information: Dun & Bradstreet (Australia) Pty Ltd (www.dnb.com.au); Experian (www.experian.com.au); and Equifax (www.equifax.com.au).

If you wish to raise any questions or concerns about this Policy or how Autosports Group handles your personal information, please contact us by email at privacy@autosportsgroup.com.au, by phone on 1300 125 179 or by mail:   Privacy Officer Autosports Group 555 Parramatta Road Leichhardt NSW 2040 Australia   If you are dissatisfied with our response, you can contact:   Australia Office of the Australian Information Commissioner Website: www.oaic.gov.au Phone: 1300 363 992   New Zealand Office of the Privacy Commissioner Website: www.privacy.org.nz Phone: 0800 803 909

Please be aware that we periodically update this Policy for a variety of reasons, including changes in laws, regulations and our business practices. Please check back from time to time to review our Policy.