Privacy Policy

Last updated: September 2025

Technology One Limited (“TechnologyOne”, “we” or “us”) is committed to protecting the privacy of the personal information we collect.

Our Privacy Policy describes how we collect and use your personal information when we are acting as a data controller (i.e. where we decide how and why your personal information is used). This Policy does not apply to personal information we hold as an employer or data processor when acting on behalf of, and in accordance with the instructions of our customers through our customers’ use of TechnologyOne services.

We may make changes to our Privacy Policy from time to time to take account of changes to our standard practices and procedures or where necessary to comply with new laws and regulations. If we make changes, we will update the ‘Last updated’ date at the front of our Policy. The latest version will always be available on our website.

We encourage you to check our website from time to time to ensure that you are aware of our current Privacy Policy.

Types of personal information we collect

The types of personal information we collect will depend on the circumstances in which the information is collected. However, the types of personal information we collect and hold about you may include:

• Identifying information, such as your name
• Contact information, such as your address, email address and telephone/mobile number
• Biometric information, such as your photo
• Financial information, such as your bank account or other payment details
• Usernames and passwords that you create when registering for an account with us
• Your organisation and position, where your organisation has business dealing with us
• Information about your occupation and employer organisation
• Information about how you use the products or services we provide to you
• Records of our communications with you, such as telephone, email, SMS, online and in-person communications
• If you visit our offices in Australia, England, Malaysia, or New Zealand, images of you which may be captured on CCTV
• Other information that you provide us during the course of business
• Other information that is capable of identifying you

If you choose not to supply us with this information, we may not be able to allow you to access or use our products or services (or all of the features and functionality offered by our products or services) or to respond to queries or requests that you submit to us.

You are always welcome to provide us with comments, queries and feedback in relation to our products and services. We may record and monitor telephone calls and other communications between you and us for training, quality control and compliance purposes.

When you communicate with us, we may collect additional information including the languages you speak, how best to manage communications with you, and information about your dealings with us.

If you participate in a survey or competition, or respond to a feedback request, we will collect the information that you provide in doing so, and associated information such as when and how you submitted the response.

We collect information about people who invest in us. We collect information about people who are our contractors, suppliers and business partners, or who are employed by our contractors, suppliers and business partners.

When you do business with us, we may collect information about you from others, such as from others who do business with you.

Our website may contain links to third party websites. We are not responsible for the privacy practices or the content of those third party websites. The privacy practices applicable to those third party websites may differ substantially from ours, so we advise you to read the privacy policy of those websites before using them.

Log data, device and location information

When using our products and services (including our website), we will collect information about you and about your use of our products and services, such as which services you use and how you use them. We will collect information such as:

• User name and password
• Device information, such as the model and ID of the device you use, operating system, telephone number and mobile phone network
• Server log information, such as details of how you used the products or service (including our website), IP address, hardware settings, browser type, browser language, the date and time of your use and referral URL, device location data
• Your browser or your account using cookies (see below for further information about our use of cookies)

Our products and services (including our website) may also detect and use your IP address or domain name for internal traffic monitoring and capacity management purposes or to otherwise administer the products and services. The patterns of usage of visitor services may be tracked for the purposes of providing improved service and content based on aggregate or statistical review of user traffic patterns.

Sensitive Information

When using our products or services, or visiting our sites or offices, we may collect your biometric information in order to provide you with services such as facial recognition or registration services.

How we collect personal information

We may collect personal information about you in the following ways:

• When you order products or services from us
• When you use our online services (e.g. Customer Communities), and other products and services (including our website)
• When you visit our sites or offices
• When you submit a query or request to us
• When you respond to a survey that we run or fill in forms on our website
• By tracking your use of our products and services (including our website)
• When you use our apps as part of our products and services
• From third parties who are entitled to disclose that information to us
• From publicly available sources
• From online sources (including social media platforms and providers like LinkedIn)
• Suppliers of information products and services (e.g. companies that consolidate data from multiple public sources)
• Other lawful means

From time to time, we may use third-party online services to collect personal information such as your name and email address or telephone number to administer online competitions, customer feedback and surveys.

If you provide us with personal information about someone else, you must only do so if that person has provided their permission for you to do so.

Cookies

We may also collect personal information about you and your use of our website, products and services using cookies. Amongst other things, we use cookies to monitor and observe your use of our website, products and services, compile aggregate data about that use, and provide you with a more effective service (which may include customising parts of our website based on your preferences and past activities on that website). For more information about our use of cookies please see our Cookie Notice.

How we use personal information and our legal basis for using your personal information

We use personal information that we collect about you to:

• Verify your identity when you are dealing with us
• Maintain our relationship with you
• Determine your eligibility for any of our products or services
• Answer your queries and requests
• Enable us to provide you or your organisation with our products and services
• Use in accordance with any request or instructions from you
• Make special offers related to our products or services that we think may be of interest to you
• Keep you informed about our activities and notify you of changes to our products or services
• Monitor use of our products and services (including our website)
• Provide better products, services and information to our customers and to the community
• Assess, operate, maintain, upgrade and improve our products and services (including our website)
• Maintain and update our records
• Carry out market analysis and research
• Carry out planning and forecasting activities and other internal business processes
• Manage and resolve any legal or commercial complaints or issues (including debt recovery)
• Meet our obligations and perform our functions under applicable laws and agreements
• Comply with our legal and regulatory obligations
• Use as otherwise required or authorised by law or government agency

We may also use your personal information for any other purpose as authorised by you. Our legal basis for th above activities includes:

• consent
• necessary for performance of a contract
• necessary for our legitimate interests or the legitimate interests of a third party
• necessary for compliance with our legal obligations

When we have legitimate interests

As set out above, in some cases we use your personal information where it is necessary for our legitimate interests or the legitimate interests of a third party. This includes where the use of your personal information is necessary to:

• Administer our operations and business in an efficient and effective way including undertaking management planning and improving and developing our products and services
• For our authorised third-party service providers or others to perform services on our behalf, such as payment processing and data analysis
• Understand and respond to queries, complaints and feedback
• Send direct marketing to business contacts
• Transfer personal information in relation to an actual or proposed sale, transfer or re-organisation of all or part of our business and the acquisition of the business
• Analyse and optimise our website's content by updating it in accordance with your preferences
• Ensure network and information security
• Enforce our legal rights and manage any dispute and legal claims and take legal or other professional advice

Direct marketing and research

If you have given us your consent or if we are otherwise legally entitled to do so, we may use and disclose your personal information for marketing purposes (but we will not sell your personal information to any third party) including contacting you about our products and services (including our website), the products and services of other people, or related special offers from our business partners, that we think may be of interest to you. This information may be sent to you by email, SMS or by other means.

We may use your personal information to carry out consumer and market research, compile demographics and perform other research and analysis so that we can develop and implement initiatives to improve our services, improve the design, construction and operation of our products and identify people likely to be interested in our products and services.

You can opt-out of receiving marketing communications from us at any time by following the ‘unsubscribe’ link in any communication from us or contacting us using the contact details below. Unsubscribing from marketing communications will not stop service-related communications from us, such as administrative alerts in relation to your account.

De-identification

We may de-identify (anonymise) information about you so that the information can no longer be used to identify you. We may use and disclose de-identified information in the course of our business (including in any promotional or marketing material).

Aggregation

We may aggregate information on the use of our products and services (including our website) in such a way that the information can no longer be related to identifiable individuals. We may use and disclose aggregated information in the course of our business (including in any promotional or marketing material).

Who we disclose personal information to

We may disclose your personal information to:

• Your representatives, advisers and others you have authorised to interact with us on your behalf
• Controlled entities within our corporate group
• Our team members and third parties including business partners, consultants, contractors, suppliers, service providers, professional advisers and agents who need the information to assist us with conducting our business activities
• Payment system operators and financial institutions
• Prospective purchasers of all or part of our business or shares in our company or a related entity
• Government agencies or authorities, regulators, law enforcement agencies and other parties where authorised or required by law who ask us to disclose that information and to which we are legally required to disclose your personal information
• Parties identified at the time of collecting your personal information or as otherwise authorised by you

Cross-border transfers

We may transfer your personal information to recipients that are located outside the country in which you are located (including contractors and external service providers). We may also disclose your personal information to our team members overseas. Where we disclose your personal information to overseas recipients, we will take reasonable steps to ensure that data security and appropriate privacy practices are maintained in accordance with applicable data protection laws.

We have Group entities in Australia, Germany, Malaysia, New Zealand, United Kingdom and Singapore and may disclose personal information to those entities.

For individuals in the UK or the EEA, we will comply with applicable data protection laws in relation to the cross-border transfer of personal information, including, ensuring that personal information is transferred to another country on the basis of an adequacy decision by the European Commission or the UK government (as applicable); or implementing appropriate safeguards to protect the privacy of the personal information and your ability to exercise your rights, including (but not limited to) implementing an appropriate data transfer solution such as entering into "standard contractual clauses" approved by the European Commission or the UK government (as applicable) with the relevant data importer. For information on our service provider locations please see our Sub-Processor Notice.

How we maintain and secure your personal information

Security is a priority for us when it comes to your personal data. We take reasonable steps to ensure that any of your personal information which we hold is accurate, complete and up-to-date. These steps include promptly updating personal information when we are advised that personal information has changed, checking our contact lists for accuracy, and providing individuals with a simple means to update their personal information.

We store the personal information that we collect in electronic databases, some of which may be held on our behalf by third party data storage providers (which may be located offshore). On rare occasions, we also keep hard copy records of this personal information in physical storage facilities. We use a range of physical and technical security processes and procedures to protect the confidentiality and security of the information that we hold, and we update these from time to time. These measures include:

• Implementing physical and technical access and security controls to our physical and electronic databases, such as security procedures for access to our business premises
• Technological security procedures including password protection, network firewalls, encryption, intrusion detection and site monitoring where practicable to do so

We also take steps to monitor access to and modification of your information by our team members and contractors, and ensure that our team members and contractors are aware of and properly trained in their obligations for managing your privacy.

However, the internet is not a secure environment and no matter what physical and technical security processes and procedures are used we cannot guarantee the security of your personal information. You also play an important role in keeping your information secure by maintaining the confidentiality of any usernames and passwords you use with our products and services (including our website).

How long we store your personal information for

Personal information is only retained for as long as it is needed for the purpose for which it was collected or as required by law. After the expiry of this period, we will take reasonable steps to make sure it is de-identified or destroyed.

The criteria used to determine appropriate retention periods for personal information include:

• The length of time we have an ongoing business relationship with you
• The amount, nature and sensitivity of the personal information
• Whether we have a legal obligation to retain personal information
• Whether retaining the personal information is necessary to resolve legal disputes (including the establishment, exercise or defence of legal claims)

Your rights

Depending on where you are located, you may have a right to:

• Request a copy of your personal information. In relation to personal data you have supplied to us, and which is held by us for the purpose of entering into a contract between us or on the basis of your consent, you may be entitled to ask us for a copy of this information in a structured, commonly used and machine readable format so that you can reuse it or share it with other organisations
• Object to our processing of your data and ask us to restrict the use of your personal information and to delete it
• Correct or rectify any personal information that is out-of-date, incorrect, incomplete or misleading

Such requests should be submitted to us in writing using the contact details below. We may ask you to verify your identity before responding to your request.

We will respond to your request in a timely manner and action your request in accordance with applicable data protection laws.

You have a right to withdraw your consent where you have previously given us consent to use your personal information (e.g. to receive marketing communications). You can do this by contacting the Chief Privacy Officer using the contact details below or, where the consent relates to marketing, by unsubscribing using the link in any of our communications.

Complaints

If you have a concern about your privacy or how we have collected or handled your personal information, please contact our Chief Privacy Officer using the contact details below.

If you wish to make a complaint, you should forward a written complaint to our Chief Privacy Officer using the contact details below. In the complaint, please include your contact details (such as email address, name, address and telephone number) so we can contact you for further information and clearly describe the complaint.

We will respond to your query or complaint within a reasonable time and in accordance with applicable data protection laws. If you are not satisfied with our response, you may contact us to discuss your concerns or may raise a complaint with your local data protection authority through their official channels.

In the United Kingdom it is the Information Commissioner's Office, in Australia it is the Office of the Australian Information Commissioner, in New Zealand it is the Privacy Commissioner and in Malaysia it is the Personal Data Protection Commissioner.

Contact us

If you require further information about this Privacy Policy or TechnologyOne’s management of your personal information please contact us using the following contact details:

• TechnologyOne Chief Privacy Officer
• PO Box 96 Fortitude Valley, Queensland, 4006 Australia
• Phone: +61 7 3167 7300
• Email: privacy@technology1.com
• UK email: privacy@dataguard.co.uk