1.1Master Group (Aust.) Pty Ltd (ACN 131 609 008) ("Mastergroup", "we", "us", "our") understands that privacy and how we collect, use, disclose, store and protect your personal information is important to you and your business (“you”, “your”). We are committed to ensuring the privacy of your information and to complying with:

1. (a)
   the Privacy Act 1988 (Cth) ("Privacy Act"), including the Australian Privacy Principles ("APPs");
2. (b)
   the Privacy Amendment (Enhancing Privacy Protection) Act 2012 (Cth);
3. (c)
   the Privacy and Other Legislation Amendment (Data Breaches) Act 2017 (Cth), including the Notifiable Data Breaches Scheme (Part IIIC of the Privacy Act);
4. (d)
   the Privacy and Other Legislation Amendment Act 2026 (Cth), including the provisions relating to ‘automated decision-making’; and
5. (e)
   the Spam Act 2003 (Cth) and the Do Not Call Register Act 2006 (Cth).

1.2In this Privacy Policy:

1. (a)
   "Personal Information" has the meaning given to it in section 6 of the Privacy Act — that is, information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information or opinion is true or not, and whether the information or opinion is recorded in a material form or not.
2. (b)
   "Sensitive information" is a subset of personal information and includes information about an individual's racial or ethnic origin, political opinions, membership of a political association, religious beliefs, philosophical beliefs, membership of a professional or trade association, membership of a trade union, sexual orientation or practices, criminal record, health information, genetic information, biometric information or biometric templates.
3. (c)
   “Agrimaster®” means the Agrimaster® suite of financial software solutions, applications, training, and consultancy services of Mastergroup.

2.1The types of personal information that we collect will depend on the nature of your dealings with us. We may collect personal information from you when you:

1. (a)
   visit our website at www.agrimaster.com.au;
2. (b)
   subscribe to our publications, newsletters, alert services or mailing lists;
3. (c)
   purchase a subscription to our Agrimaster®;
4. (d)
   apply for employment with us;
5. (e)
   interact with us as a supplier, contractor, or business contact; or
6. (f)
   communicate with us by telephone, email, post, social media, through our website form, or in person.

2.2The Personal Information and Sensitive Information we may collect includes:

1. (a)
   your name, title, date of birth, gender and contact details (including residential and postal address, email address and telephone numbers and social media handles);
2. (b)
   your financial details (including bank account balances, account activities, payment history, BSBs, account numbers, credit card numbers, your assets (including real property, shares and investments), superannuation and insurance arrangements, occupation and income) where necessary for the provision of our services;
3. (c)
   your tax file number;
4. (d)
   your ABN;
5. (e)
   financial or payroll information of persons whose remuneration are paid through Mastergroup’s Wagemaster® payment system;
6. (f)
   information about you, including documents, correspondence and instructions;
7. (g)
   your employment history, qualifications and professional memberships;
8. (h)
   your IP address, browser type, device information and website usage data collected via cookies and analytics tools (see Section 9 below); and
9. (i)
   any other information you voluntarily provide to us.

2.3Anonymity and Pseudonymity

You acknowledge that due to the nature of Agrimaster®, it would be impractical for us to provide you with our services (including Agrimaster® if you remain anonymous or are using a pseudonym. If you choose to do so, we may be unable to provide you with our services).

2.4Sensitive Information

We will not collect sensitive information about you unless:

1. (a)
   it is reasonably necessary for the provision of our services to you;
2. (b)
   you have consented to the collection; or
3. (c)
   we are required or authorised by law to collect it.

Examples of sensitive information we may collect include health information, and information about racial or ethnic origin.

2.5How We Collect Personal Information

We collect personal information:

1. (a)
   directly from you — when you provide instructions, complete forms (including any “Contact Us” forms on our website, or surveys), communicate with us, or subscribe to our Services;
2. (b)
   from third parties — including recruitment agencies, referees, government agencies, credit reporting bodies; transaction platforms, your personal or business advisors, associates, and employees, and credit reporting bodies;
3. (c)
   from the public domain (e.g., from your business’ website);
4. (d)
   automatically — when you visit our website, through the use of cookies, web beacons and analytics tools (see Section 9 below).

2.6Unsolicited Personal Information

If we receive Personal Information about you that we did not ask for, we will check whether that information is reasonably necessary for our functions or activities. If it is, we will handle this information the same way we do with any other information we seek from you. If not, we will ensure we do the right thing and destroy or de-identify it.

2.7Notification of Collection of Personal Information

When we collect Personal Information from you, we will take reasonable steps to notify you of the need for such collection of your Personal Information, and of this Privacy Policy which deals with the ways in which your Personal Information may be used or disclosed to third parties.

2.8Government Related Identifiers

Due to the nature of the services we provide, we may sometimes require certain government identifiers from you, which may include (without limitation) your ABN and your tax file number. We will not use such government identifier as our own means of identifying you, and it is only used:

1. (a)
   to the extent necessary for us to:
   1. (i)
      verify your identity for the purposes of providing you with Agrimaster®;
   2. (ii)
      fulfill our obligations to a government agency;
   3. (iii)
      fulfill our obligations under an Australian law or a court/tribunal order, including in relation to an eligible data breach;
   4. (iv)
      fulfill our obligations in connection with any enforcement activities conducted by government enforcement agencies; and
2. (b)
   where a Permitted General Situation (other than that referred to in Item 4 or 5 under section 16A(1) of the Privacy Act applies).

3.1We collect and use personal information for the following purpose (the “Primary Purpose”)s:

1. (a)
   providing you with Agrimaster® along with any training and consultancy services;
2. (b)
   managing our relationship with you
3. (c)
   communicating with you about our services, publications and other information that may be of interest to you;
4. (d)
   improving our services, training staff, website and business operations, including planning, research and statistical analysis;
5. (e)
   complying with our risk management obligations;
6. (f)
   investigating or dealing with any suspected or actual unlawful activity;
7. (g)
   complying with court orders, subpoenas and other legal or regulatory processes;
8. (h)
   recovering amounts owed to us;
9. (i)
   credit reporting and credit worthiness checks;
10. (j)
    assessing applications for employment with us; and
11. (k)
    any other purpose for which you have given your consent, or which is permitted or required by law.

3.2We will not use your personal information for a purpose other than the Primary Purpose, unless:

1. (a)
   you would reasonably expect us to use the information for a secondary purpose and that secondary purpose is related to the Primary Purpose (or, in the case of sensitive information, directly related);
2. (b)
   you have consented to the secondary use; or
3. (c)
   the use is required or authorised by or under an Australian law or court/tribunal order.

4.1We may disclose your personal information to the following categories of recipients where reasonably necessary for the purposes described in Section 3:

4.2External Service Providers

We may disclose personal information to external service providers who assist us in operating our business and providing services to you, including:

1. (a)
   cloud storage, payment gateway, and IT infrastructure providers (including TeamViewer, 8x8, Stripe, Microsoft Teams, GoTo Meeting, Zendesk);
2. (b)
   document management and archiving services;
3. (c)
   accounting and financial services providers (e.g., Stripe);
4. (d)
   marketing and communications platforms;
5. (e)
   valuers, insurers, reinsurers, claim assessors and investigators;
6. (f)
   brokers or referrers;
7. (g)
   banks and other financial institutions;
8. (h)
   debt purchasers and debt collectors;
9. (i)
   our related entities;
10. (j)
    fraud reporting agencies;
11. (k)
    our external advisors, including accountants, auditors and lawyers;
12. (l)
    guarantors and prospective guarantors;
13. (m)
    joint venture partners and organisations involved in corporate reorganisation or transfer of business assets;
14. (n)
    product planning, research and development organisations;
15. (o)
    mailing houses and telemarketing agencies; and
16. (p)
    other organisations to whom we may disclose information in our normal business practices, including our agents and contractors.

Where we engage external service providers, we take reasonable steps to ensure they comply with the APPs and are authorised only to use personal information for the limited purposes specified in our agreement with them.

When you communicate with us through third party platforms, including our social media channels, these social media platforms may collect and hold your Personal Information overseas in accordance with their own respective privacy policies. You acknowledge that you do not hold us liable for any loss or damage in connection with any security breaches, viruses or other malicious software, or any loss of, or unauthorised access to, your data (including Personal Information) that occurs in connection with your use of our social media channels.

4.3Regulatory and Government Bodies

We may disclose personal information to regulatory and government bodies where required or authorised by law, including:

1. (a)
   the Office of the Australian Information Commissioner (OAIC); and
2. (b)
   courts and tribunals.

4.4Professional Indemnity and Cyber Insurers

We may disclose personal information to our professional indemnity insurer and our cyber liability insurer where required for the purposes of obtaining or maintaining insurance coverage, or in connection with a claim or potential claim.

4.5Disclosures Required or Permitted by Law

We will disclose personal information where required or permitted by law, including in response to court orders, subpoenas, statutory demands, or regulatory investigations.

4.6Overseas Disclosure

We store all data (including Personal Information) on secure cloud or offside services including, but not limited to, Microsoft Azure, which may be situated outside of Australia.

We do not otherwise transfer personal information overseas unless:

1. (a)
   you have provided your informed consent;
2. (b)
   we have taken reasonable steps to ensure the overseas recipient complies with the APPs (or a substantially similar privacy regime); or
3. (c)
   the disclosure is required by Australian law or a court/tribunal order.

We take the security of your personal information seriously. We have implemented comprehensive technical and organisational measures to protect your personal information from misuse, interference, loss, unauthorised access, modification or disclosure.

5.1Our security measures include, but are not limited to:

1. (a)
   Technical Controls (‘Essential Eight’ Framework)

   We have implemented the Australian Cyber Security Centre's (ACSC) Essential Eight cybersecurity framework at Maturity Level 2, which includes but is not limited to:

   1. (i)
      Multi-Factor Authentication (MFA): MFA is enforced on all of our systems (including TeamViewer, 8x8, Stripe, Microsoft Teams, GoTo Meeting, Zendesk).
   2. (ii)
      Application Whitelisting: Only approved applications may execute on firm systems, preventing unauthorised software from running;
   3. (iii)
      Patch Management: Critical security updates for operating systems and enterprise applications are deployed within 48 hours of vendor release;
   4. (iv)
      Restriction of Administrative Privileges: Daily workflows are never performed using accounts with administrative privileges. Administrative access is restricted to the IT Director with secondary MFA validation;
   5. (v)
      Microsoft Office Macro Restrictions: All macros in files received from external internet sources are blocked by default;
   6. (vi)
      Application Hardening: Web browsers and email clients are configured to block known malicious content;
   7. (vii)
      Daily Backups: All data is backed up daily to a secure cloud; and
   8. (viii)
      User Application Hardening: Flash, Java and other high-risk applications are disabled or restricted.

5.2Encryption and Data Sovereignty

All electronic customer data is stored within encrypted cloud infrastructure. Data is encrypted both in transit (using TLS 1.2 or higher) and at rest (using AES-256 encryption).

5.3Physical Security

Our office premises are secured with restricted access.

5.4Personnel Controls

All of our employees are required, as a condition of employment, to treat personal information held by us as confidential. Staff are bound by contractual privacy obligations and must complete annual cybersecurity awareness training.

5.5Endpoint Detection and Response (EDR)

EDR software is deployed on all endpoints across our network, monitored by our managed security services provider.

5.6Email Security

We utilise advanced email filtering software to scan all inbound and outbound email messages, filtering spam and malicious content. We conduct regular simulated phishing exercises to test staff awareness.

5.7Cyber Insurance

We maintain comprehensive cyber liability insurance to provide financial protection in the event of a data breach or cyber incident.

5.8SSL/TLS

Our website and applications are secured using industry-standard SSL/TLS technology to encrypt data between your browser and the websites and/or applications.

5.9Acknowledgement

While we will use reasonable steps to review and update our physical and data security measures, you acknowledge and agree that no data transmission over electronic, mobile data and communication services can be guaranteed to be totally secure. Accordingly, you acknowledge that you do not hold us liable for any loss or damage in connection with any security breaches, viruses or other malicious software, or any loss of, or unauthorised access to, your data (including Personal Information).

6.1In accordance with Part IIIC of the Privacy Act, we are subject to the Notifiable Data Breaches (NDB) Scheme.

6.2If we become aware of a data breach that is likely to result in serious harm to any individual whose personal information is involved, we will:

1. (a)
   take immediate steps to contain the breach and, where possible, remediate any damage;
2. (b)
   conduct a reasonable and expeditious assessment of the breach within 30 days (or sooner where practicable);
3. (c)
   if the breach is assessed as an "eligible data breach" within the meaning of the Privacy Act, notify the Office of the Australian Information Commissioner (OAIC) as soon as practicable after the breach being confirmed;
4. (d)
   notify all individuals whose personal information is involved in the eligible data breach, as soon as practicable, including:
   1. (i)
      a description of the breach;
   2. (ii)
      the kinds of information involved;
   3. (iii)
      recommendations about the steps individuals should take in response; and
   4. (iv)
      our contact details for further information; and
5. (e)
   maintain a record of all data breaches (whether notifiable or not) in our internal Data Breach Register.

Our IT Compliance Officer is responsible for managing our data breach response in accordance with our Incident Response Plan.

7.1We use technology, including artificial intelligence (AI) tools, to assist in the delivery of our services, including in the provision of training and consultancy services and our communications with you.

7.2In accordance with the Privacy and Other Legislation Amendment Act 2026 (Cth), we provide the following information about our use of automated decision-making.

7.3How We Use AI

We may use AI-assisted tools for:

1. (a)
   data analysis;
2. (b)
   forecasting;
3. (c)
   initial drafting of generic correspondence and document templates; and
4. (d)
   administrative tasks such as document review and data extraction.

7.4Human Oversight

No document, or decision that significantly affects your rights or interests is generated solely by an automated system. All AI-assisted outputs are subject to independent review and verification before being provided to you or relied upon in any way.

7.5Data Protection in AI Usage

We maintain a Zero Customer-Data Leakage policy. Raw customer information, sensitive corporate structures, trade secrets, or confidential data are never uploaded into public AI platforms or non-enterprise tools where data may be ingested for model training. We only use enterprise-grade AI applications that feature guaranteed data sovereignty and zero-retention API configurations.

7.6Hallucination Verification

AI models may generate inaccurate information (known as "hallucinations"). No AI-generated draft may be delivered to a customer without every factual assertion being independently verified.

7.7Your Rights Regarding Automated Decisions

You have the right to:

1. (a)
   be informed if a decision that significantly affects you has been substantially based on automated processing;
2. (b)
   request meaningful information about the logic involved in any automated decision-making process that affects you; and
3. (c)
   request human review of any decision that has been made using automated processing.

To exercise these rights, please contact our Customer Support and Success Team using the details in Section 15 below.

8.1We will take reasonable steps to ensure that the Personal Information that we collect from you is correct, accurate and complete. If any of your information needs updating, please provide it to us as soon as possible.

8.2Under the Privacy Act, you have the right to:

1. (a)
   access the personal information we hold about you;
2. (b)
   request that we correct your personal information where it is inaccurate, incomplete, out of date, irrelevant or misleading;
3. (c)
   opt out of receiving direct marketing communications from us at any time;
4. (d)
   request erasure of your personal information from our marketing databases and non-essential systems (subject to our statutory retention obligations — see Section 12 below);
5. (e)
   request information about whether any automated decision-making has been used in relation to your matter (see Section 7 above); and
6. (f)
   lodge a complaint about our handling of your personal information (see Section 10 below).

8.3In order to maintain confidentiality, we may ask for you to meet with us in person or otherwise verify your identity before we provide you with access to your Personal Information.

8.4How to Request Access or Correction

1. (a)
   If you wish to access or correct the personal information we hold about you, please set out your request in writing and forward it to our Customer Support and Success Team using the contact details in Section 15 below.
2. (b)
   We will respond to your request within 30 days of receipt. If we are unable to provide access or make the requested correction, we will provide you with written reasons for our decision.
3. (c)
   We will not charge you for making a request or for correcting your personal information. However, we may charge a reasonable fee for providing access to archived or historical records where retrieval involves significant time or resources. We will advise you of any applicable fee before proceeding.

8.5Exceptions to Access

We may refuse to provide access to personal information in limited circumstances permitted by the Privacy Act, including where:

1. (a)
   providing access would pose a serious threat to the life, health or safety of any individual;
2. (b)
   providing access would have an unreasonable impact on the privacy of other individuals;
3. (c)
   the request is frivolous or vexatious;
4. (d)
   the information relates to existing or anticipated legal proceedings and would not be accessible through the discovery process;
5. (e)
   providing access would be unlawful or would prejudice enforcement activities; or
6. (f)
   it is required or authorised by or under an Australian law or court/tribunal order.

9.1Information Collected via Our Website

When you visit our website (www.agrimaster.com.au) we may automatically collect, including but not limited to, the following information:

1. (a)
   your IP address and approximate geographic location;
2. (b)
   your browser type, version and operating system;
3. (c)
   the pages you visit on our website and the duration of your visit;
4. (d)
   the website from which you were referred to our site;
5. (e)
   your device type and screen resolution; and
6. (f)
   the date and time of your visit.

9.2Cookies

1. (a)
   A "cookie" is a small data file stored on your computer or mobile device by our web server. We use cookies, including but not limited to, the following:
   1. (i)
      maintain user sessions (e.g., if you subscribe to access publications);
   2. (ii)
      analyse website traffic and usage patterns;
   3. (iii)
      improve website functionality and user experience; and
   4. (iv)
      deliver targeted advertising (including remarketing) based on your previous visits to our website.

9.3Types of Cookies We Use

9.4Third-Party Analytics

We use Google Analytics, Datadog RUM (and similar tools) to collect anonymised data about website usage. Google Analytics uses cookies to generate statistical information. Google's privacy policy is available at https://policies.google.com/privacy. Datadog’s Privacy Policy is available at https://www.datadoghq.com/privacy/.

9.5Managing Cookies

You may manage or disable cookies through your browser settings. Most browsers allow you to:

1. (a)
   view what cookies are stored and delete them individually;
2. (b)
   block third-party cookies;
3. (c)
   block cookies from particular sites; and
4. (d)
   block all cookies.

Please note that if you disable all cookies, some features of our website may not function correctly.

9.6Do Not Track

Our website currently does not respond to "Do Not Track" browser signals. However, you may opt out of targeted advertising by adjusting your cookie preferences.

9.7Third-Party Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices of those websites and recommend that you review their privacy policies independently.

10.1If you believe that we have breached the APPs or otherwise mishandled your personal information, you may lodge a complaint with us.

10.2How to Complain

Please set out your complaint in writing, including:

1. (a)
   your name and contact details;
2. (b)
   a description of the conduct you are complaining about;
3. (c)
   the outcome you are seeking; and
4. (d)
   any supporting documentation.

Forward your complaint to our Customer Support and Success Team using the contact details in Section 15 below.

10.3Our Complaints Process

1. (a)
   We will acknowledge receipt of your complaint within 5 business days.
2. (b)
   We will investigate your complaint and endeavour to respond to you within 30 days of receipt.
3. (c)
   If we require additional time to investigate, we will notify you of the delay and the reasons for it.
4. (d)
   We will advise you of the outcome of our investigation in writing, including any steps we have taken or propose to take to resolve the complaint.

10.4Escalation to the OAIC

If you are not satisfied with our response, or if we have not responded within 30 days, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):

1. (a)
   Online: www.oaic.gov.au/privacy/privacy-complaints
2. (b)
   Phone: 1300 363 992
3. (c)
   Post: GPO Box 5218, Sydney NSW 2001

11.1We collect personal information about individuals who apply for employment with us. The information we collect includes:

1. (a)
   personal contact details, name, title and gender;
2. (b)
   educational and employment history, qualifications and professional memberships;
3. (c)
   Nationally Coordinated Criminal History Check (NCCHC) or a National Police Certificate (NPC), also known as ‘police clearance checks’;
4. (d)
   eligibility to work in Australia (including visa status and citizenship documentation);
5. (e)
   referees' contact details;
6. (f)
   information obtained from referees and professional networking sites (e.g., LinkedIn);
7. (g)
   performance information from interviews and assessments; and
8. (h)
   whether the applicant identifies as Aboriginal or Torres Strait Islander (collected solely for the purpose of monitoring our equal employment opportunity policy).

We may collect this information directly from you or indirectly from recruitment agencies, referees, or publicly available professional profiles.

We use this information to assess your eligibility and suitability for employment. We may retain your information to assess your suitability for future roles, unless you request otherwise.

11.2We do not disclose job applicant personal information to any third party, except:

1. (a)
   to referees (for the purpose of obtaining a reference);
2. (b)
   to background check providers (with your consent); or
3. (c)
   as required by law.

12.1We retain personal information only for as long as is necessary to fulfil the purposes for which it was collected, or as required by law.

12.2Retention Periods

12.3Destruction

Once the applicable retention period has expired:

1. (a)
   digital data is permanently purged using secure cryptographic sanitisation protocols; and
2. (b)
   any physical documents are destroyed via appropriate shredding.

12.4Your Right to Request Erasure

You may request the destruction of your personal information from our marketing databases and non-essential systems at any time. However, we cannot delete data that:

1. (a)
   is required to be retained under any law;
2. (b)
   is subject to a legal hold, court order or regulatory investigation; or
3. (c)
   is held in safe custody unless you provide a signed release.

13.1We may use your personal information to send you communications about legal developments, seminars, publications, and services that may be of interest to you. We will only do so where:

1. (a)
   you have consented to receiving such communications;
2. (b)
   you would reasonably expect to receive such communications given your existing relationship with us; or
3. (c)
   we provide a simple mechanism for you to opt out of each communication.

13.2Opting Out

You may opt out of receiving direct marketing communications at any time by:

1. (a)
   clicking the "unsubscribe" link in any electronic communication;
2. (b)
   contacting our Customer Support and Success Team using the details in Section 15 below; or
3. (c)
   selecting the relevant online link to, or replying to any communication with the word, "UNSUBSCRIBE".

We will process your opt-out request within 5 business days. Opting out of marketing communications will not affect communications that are necessary in connection with your subscription to Agrimaster®.

13.3We comply with the Spam Act 2003(Cth) in relation to all commercial electronic messages and the Do Not Call Register Act 2006(Cth) in relation to telemarketing.

14.1We do not knowingly collect personal information from individuals under the age of 18 without the consent of a parent or legal guardian, except where:

1. (a)
   the collection is necessary for the provision of our Services (e.g., in connection with estate planning Services); and
2. (b)
   the collection is authorised or required by law.

14.2Where we collect personal information about a child, we will take reasonable steps to ensure that a parent or legal guardian is informed and has provided consent (where required).

15.1If you have any questions, comments or requests regarding this Privacy Policy or our handling of your personal information, please contact our Customer Support and Success Team using the following details:

Email: support@agrimaster.com.au

Telephone: (08) 6380 8800

Post: PO Box 7138, Shenton Park, WA 6008

16.1We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements or other factors.

16.2When we make material changes to this Privacy Policy, we will:

1. (a)
   update the "Last Updated" date at the top of this policy;
2. (b)
   publish the updated policy on our website at www.agrimaster.com.au; and
3. (c)
   where practicable, notify you directly (e.g., by email) if the changes are likely to significantly affect how we handle your personal information.

16.3We encourage you to review this Privacy Policy periodically. The current version will always be available on our website.

17.1The EU General Data Protection Regulation (GDPR) has harmonised the data privacy laws of each individual EU country, giving more rights to individuals located in the EU and more obligations to organisations holding their Personal Information. In this section, “Personal Information” means any information relating to an identified or identifiable natural person (the meaning given to the term “personal data” in the GDPR).

17.2Personal information must be processed in a lawful, fair and transparent manner. As such, if you are located in the EU, the GDPR requires us to provide you with more information about how we collect, use, share and store your Personal Information as well as advising you of your rights as a “data subject”.

17.3If you are located in the EU and have an enquiry relating to your rights under the GDPR, please contact our Customer Support and Success Team at support@agrimaster.com.au

17.4What Personal Information Do We Collect?

Please refer to the above Section 2 headed “What Personal Information Do We Collect and Hold” for details of the Personal Information we collect.

17.5Special Categories of Personal Information

The GDPR provides additional protection for Personal Information about your racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, biometric data (for example your fingerprints), or data concerning your health, sex life or sexual orientation. We will only process this type of Personal Information with your consent or where otherwise lawfully permitted.

17.6How Long We Keep Your Personal Information

We will keep your Personal Information while you are a customer of Mastergroup. We aim to keep your Personal Information for only as long as we need it. However, we may keep your Personal Information for longer to fulfil legal or regulatory obligations, for internal research and analytics, or to respond to a question or complaint.

17.7How We Use Your Personal Information

We can only collect and use your Personal Information if we have a valid lawful reason to do so. For Mastergroup, these reasons are:

1. (a)
   if we need to process your Personal Information in order to fulfil a contract you have with us, or because you have asked us to take specific steps before entering into a contract (contract performance)
2. (b)
   if we need to process your Personal Information for us to comply with the law (legal obligation);
3. (c)
   if you have given clear consent for us to process your Personal Information for a specific purpose (consent); and
4. (d)
   if we need to process your Personal Information for our legitimate interests or the legitimate interests of a third party unless there is a good reason to protect your Personal Information which overrides these legitimate interests (legitimate interests).

17.8Grounds

In the table below, we have set out the relevant grounds that apply to each purpose of data processing that is mentioned in this Privacy Policy:

17.9Your Rights as a Data Subject

You have the following rights with respect to the Personal Information we hold about you.

1. (a)
   The right to be informed how Personal Information is processed: You have the right to be informed how your Personal Information is being collected and used. If we require your consent to process your Personal Information you can withdraw consent at any time. If you withdraw consent, we may not be able to provide certain services to you. The right to withdraw only applies when the lawful basis of processing is consent.
2. (b)
   The right of access to Personal Information: You can access your Personal Information that we hold by emailing our Customer Support and Success Team at support@agrimaster.com.au
3. (c)
   The right to rectification: You have the right to question any Personal Information we have about you that is inaccurate or incomplete. If you do, we will take reasonable steps to check the accuracy and correct it.
4. (d)
   The right to erasure: You have the right to ask us to delete your Personal Information if there is no need for us to keep it. You must make the request in writing. There may be legal or other reasons why we need to keep your Personal Information and if so, we will tell you what these are. However, if you ask us to delete your Personal Information, it will not be possible to restore your financial data at a subsequent date if you wish to purchase a new subscription to our products.
5. (e)
   The right to restrict processing: You have the right to ask us to restrict our use of your Personal Information in some circumstances. In this situation we would not use or share your Personal Information while it is restricted. This is not an absolute right and only applies in certain circumstances.
6. (f)
   The right to data portability: In some circumstances you have the right to request we provide you with a copy of the Personal Information you have provided to us in a format that can be easily reused.
7. (g)
   The right to object: In some circumstances you have the right to object to us processing your Personal Information.
8. (h)
   Rights in relation to automated decision making and profiling: We sometimes use systems to make automated decisions (including profiling) based on Personal Information we have collected from you or obtained from other sources such as credit reporting bodies. These automated decisions can affect the services we offer you. You can ask that we not make decisions based on automated score alone or object to an automated decision and ask that a person review.
9. (i)
   The right to lodge a complaint with a supervisory authority: You have the right to complain to the regulator if you are not happy with the outcome of a complaint. Please refer to the European Commission Website for details of the relevant data protection authorities. The individual regulator’s websites will tell you how to report a concern.
10. (j)
    Please note that while any changes you make to your Personal Information will be reflected in active user databases instantly or within a reasonable period of time, we may retain all information you submit for backups, archiving, prevention of fraud and abuse, analytics, satisfaction of legal obligations, or where we otherwise reasonably believe that we have a legitimate reason to do so.
11. (k)
    You may decline to share certain Personal Information with us, in which case we may not be able to provide to you some of the features and functionality of our services.

This Privacy Policy is governed by the laws of the Commonwealth of Australia and the State of Western Australia. Any disputes arising in connection with this Privacy Policy are subject to the exclusive jurisdiction of the courts of Western Australia and the Federal Court of Australia.

© 2026 Master Group (Aust.) Pty Ltd. All rights reserved. Privacy Policy: 22 October 2026