PRIVACY POLICY | CARAVEA

COMMITMENT TO PRIVACY

CARAVEA are bound by the Australian Privacy Principles contained in the Privacy Act 1988 (Cth), and any other privacy legislation that may apply in the jurisdiction in which you use our Website (Applicable Laws).

The object of the Australian Privacy Principles is to protect the confidentiality of personal information and the privacy of individuals by regulating the way in which personal information is managed through our Website. This Policy applies to all of the products, services, Website offered by CARAVEA (collectively, Services) accessed by you.

WHAT IS "PERSONAL INFORMATION"?

The Privacy Act currently defines "Personal Information" as meaning information or an opinion about an identified individual or an individual who is reasonably identifiable:

• whether the information or opinion is true or not; and
• whether the information or opinion is recorded in a material form or not.

If information does not disclose your identity or enable your identity to be ascertained, it will in most cases not be classified as "Personal Information" and will not be subject to this Policy.

CARAVEA is committed to protecting the Personal Information it collects and regularly monitors its systems and procedures to ensure compliance with the Australian Privacy Principles and this Policy. This Policy outlines the way in which CARAVEA deals with Personal Information it collects.

We are not responsible for the privacy practices of any third-party websites that may be linked to our Services.

WHAT INFORMATION DO WE COLLECT and why?

Personal Information collected by Caravea will depend on the circumstances of collection and on the Services that we are providing to you and may include (but is not limited to):

• Identification details, which may include name, address, birth date and gender;
• For certain services, images of, or information from, verification documents such as your driver's license;
• Contact information which may include email address and phone number;
• Bank account and credit account details;
• User IDs and passwords;
• Services provided to you, including saved items and searches;
• Business information, such as ABN and licence number;
• Information submitted in placing an advertisement, for example vehicle details, pricing, photos and videos;
• Information submitted in applying for or requesting a quote for an advertised product, which may include employment details, current living situation, current and previous addresses and residency status;
• Your IP address, information about the devices on which you visit the Caravea website, and your activities on those devices or sites (including browser and operating system, time, date, referral information, location, carrier and site interactions);
• Third party account details (for example, where you sign in through a social network, we will collect limited personal information from that social network site, including your username, site ID and email address);
• Your public social profile information (e.g. name, profile picture);
• Records and content of communications with Caravea or any other person including records and content using communications services facilitated by Caravea (e.g. chat functions, enquiry forms, phone services and online forums);
• If you participate in any surveys we, or a third party service provider acting on our behalf, may conduct from time to time, personal information relating to your survey responses;
• If you are applying for employment with us, personal information that is relevant to such employment including academic and employment history; and
• Information obtained as a result of your use of our mobile websites or applications such as geo-locations and unique device identifiers.

HOW WE COLLECT YOUR PERSONAL INFORMATION

We may collect Personal Information from you whenever you input such information through our Services or an interface that connects to the same.

Personal Information will generally be collected directly from you through the use of our standard forms, over the internet via accessing the Services, via email, or through a telephone or in-person conversation with you. There may, however, be some instances where Personal Information about you will be collected indirectly because it is unreasonable or impractical to collect Personal Information directly from you. We will usually notify you about these instances in advance, or where that is not possible, as soon as reasonably practicable after the information has been collected, however it will be dealt with by us in accordance with this Policy as if it was collected directly.

If the Personal Information you provide to us is incomplete or inaccurate, we may be unable to provide you, or someone else you know, with the products or services you, or they, are seeking.

WEBSITE, COOKIES, PIXELS, Beacons

The Services may from time to time have links to other websites not owned or controlled by us. These links are meant for your convenience only. Links to third party websites do not constitute sponsorship or endorsement or approval of these websites. Please be aware that CARAVEA is not responsible for the privacy practices of other such websites. We encourage our users to be aware, when they leave our Services, to read the privacy statements of the relevant platform that collects Personal Information, and you use the same at your own risk.

Our Services may use web beacons from time to time. Web beacons or clear gifs are small pieces of code placed on a web page to monitor the behaviour and collect data about the visitors viewing a web page. For example, web beacons can be used to count the users who visit a web page or to deliver a cookie to the browser of a visitor viewing that page.

We also collect Personal Information via cookies from your device which enable us to identify when you use the Services and also to help customise your experience. As a general rule, however, it is not possible to identify you personally from our use of cookies, but they may link back to a database record about you.

A cookie is a small amount of information that is downloaded to your computer or device when you use our Services. We use a number of different cookies, including functional, performance, advertising, and social media or content cookies. Cookies make your browsing experience better by allowing the website to remember your actions and preferences (such as login and region selection). This means you do not have to re-enter this information each time you return to the site or browse from one page to another. Cookies also provide information on how people use the website, for instance whether it is their first time visiting or if they are a frequent visitor.

You can control and manage cookies in various ways. Please keep in mind that removing or blocking cookies can negatively impact your user experience and parts of our Services may no longer be fully accessible.

Most browsers automatically accept cookies, but you can choose whether or not to accept cookies through your browser controls, often found in your browser's "Tools" or "Preferences" menu. For more information on how to modify your browser settings or how to block, manage or filter cookies can be found in your browser's help file or through such sites as www.allaboutcookies.org.

Additionally, please note that blocking cookies may not completely prevent how we share information with third parties such as our advertising partners.

We also use tracking pixels to help us understand how users interact with our Website and online content. Tracking pixels are small snippets of code that load when a user visits a webpage or opens an email which allows us to monitor actions such as page visits, ad views, link clicks, and conversions. This helps us measure the effectiveness of our advertising campaigns and tailor content and ads to be more relevant to our users.

The data collected through our pixel is used solely by us and is shared with third-party advertising networks. We use this information to analyse engagement, optimise our Website's performance, and ensure our content remains relevant and effective.

You can manage or disable pixel tracking through your browser settings or by adjusting your privacy preferences.

We also use Google Analytics to help us understand how our customers use the Website. Google Analytics anonymously tracks how users interact with the websites, including where they came from, what they did on the websites and whether they completed any transactions on the websites. You can read more about how Google uses your Personal Information here: https://policies.google.com/privacy?hl=en. You can also opt-out of Google Analytics here: https://tools.google.com/dlpage/gaoptout.

For more information about how targeted advertising works, you can visit the Network Advertising Initiative's educational page at: http://www.networkadvertising.org/understanding-online-advertising/how-does-it-work.

You can opt out of targeted advertising through:

• Facebook - https://www.facebook.com/settings/?tab=ads.
• Google- https://www.google.com/settings/ads/anonymous.

Additionally, you can opt out of some of these services by visiting the Digital Advertising Alliance's opt-out portal at: http://optout.aboutads.info/.

USE AND DISCLOSURE

CARAVEA will use your Personal Information for the primary purpose for which it is collected, which generally includes the following purposes:

• Provide you with updated product or safety information with respect to the Services;
• Send you products that CARAVEA believes may be of interest to you (although if you are a subscriber we will not do so without your consent);
• Respond to your requests for information, product, services including managing your online accounts and providing warranty service where this applies to products;
• Resolve or track the status of all problems with consumers and/or products or services;
• Manage, plan and arrange meetings between you and other CARAVEA users;
• Generate customer lists for the purposes of market research;
• Verify your age or identity as needed for us to provide our products and Services safely and lawfully;
• Improve our products and Services;
• De-identify your information by removing all personal identifiers (your name, e-mail address etc.) so that the information is no longer Personal Information and can be used for other purposes;
• Protect someone's health safety or welfare;
• Comply with a law or regulation, court order or other legal requirement; and
• Undertake other activities for which you have consented we can use or disclose your personal information.

We will only use or disclose your Personal Information for a purpose that was not the primary purpose for which we collected it, if we are required, authorised or permitted by law or a court / tribunal order to do so.

We may disclose Personal Information:

• To our related companies and affiliates;
• To third party service providers engaged by us so that they may perform services for us or on our behalf, which may include services related to you;
• Where we are authorised or required by law to do so or are permitted to disclose the information under the Australian Privacy Principles or Applicable Laws; and
• If you have expressly consented to the disclosure.

You represent and warrant that you have permission to share any information you elect to provide CARAVEA, you consent to such information being shared with third parties, and that such information is accurate, current, non-misleading, and consistent and relevant for the purpose for which you are providing information.

DISCLAIMER

CARAVEA makes no representation and assumes no responsibility for the accuracy of information contained on or available through our Services, and such information is subject to change without notice.

You are encouraged to confirm any information obtained from our Services with other sources.

CROSS BORDER DATA TRANSFER

We may disclose your Personal Information – including information that may identify your exact geographic location- to a CARAVEA company or affiliate, or to our database overseas. In disclosing Personal Information offshore, CARAVEA ensures that the use and disclosure of the Personal Information transferred is dealt with in accordance with this Policy and the requirements of the relevant law within the relevant jurisdictions.

By providing CARAVEA with your Personal Information, you consent to the transfer, storing, and processing of your Personal Information in other countries. You acknowledge that where we rely on your consent for these activities that your Personal Information may not be given the same protection as is available under the Australian Privacy Laws.

TRANSFER OF DATA TO THIRD PARTIES

CARAVEA processes and stores its data, including Personal Information, on secure Azure Microsoft cloud servers. CARAVEA may transfer data to the third-party service providers. By submitting Personal Information or otherwise using the Services, you agree to this transfer, storing or processing of your Personal Information. You acknowledge and agree that your Personal Information may be accessible to law enforcement and governmental agencies under lawful access regimes or court order.

We will not sell or rent your Personal Information to anyone other than as permitted in this Privacy Policy.

SERVICE PROVIDERS AND BUSINESS PARTNERS

We currently engage third party companies and individuals employed by us to facilitate our Services, including the provision of maintenance services, database management, web analytics and general improvement of the Services, and businesses who engage our Services (to the extent provided for above). We take commercially reasonable steps to ensure our service providers adhere to the security standards we apply to your Personal Information.

Minors

The Services are intended for persons aged 18 years and over. We will not knowingly collect, use or disclose Personal Information from anyone under the age of 18. If you are under 18, you are not permitted to access, or use our Services.

If we become aware that we have inadvertently collected Personal Information from a person under 18 without appropriate consent, we will take reasonable steps to delete such information as soon as practicable.

If you believe that we may have collected personal information from someone under the age of 18, please contact us immediately at privacy@caravea.au.

DATA SECURITY

You use our Services at your own risk. We implement commercially reasonable technical, administrative, and organisational measures to protect Personal Information from loss, misuse, and unauthorised access, disclosure, alteration, or destruction in accordance with the Applicable Laws. However, no Internet or e-mail transmission is ever fully secure or error free. In particular, e-mail sent to or from us may not be secure. Therefore, you should take special care in deciding what information you send to us via the Services or e-mail. Please keep this in mind when disclosing any Personal Information to Caravea via the Internet. In addition, we are not responsible for circumvention of any privacy settings or security measures contained on the Service, or third-party websites.

ACCESS, CORRECTION AND ACCURACY

Australian Privacy Principle 12 permits you to obtain access to the Personal Information we hold about you in certain circumstances, and Australian Privacy Principle 13 allows you to correct inaccurate Personal Information subject to certain exceptions.

You may access the Personal Information we hold about you, upon making a written request. We will respond to your request within a reasonable period. We may charge you a reasonable fee for processing your request (but not for making the request for access).

We may decline a request for access to Personal Information in circumstances prescribed by the Privacy Act, and if we do, we will give you a written notice that sets out the reasons for the refusal (unless it would be unreasonable to provide those reasons), to the extent we comply with the relevant Australian Privacy Principles.

If, upon receiving access to your Personal Information or at any other time, you believe the Personal Information we hold about you is inaccurate, incomplete or out of date, please notify us immediately. We will take reasonable steps to correct the information so that it is accurate, complete and up to date.

If we refuse to correct your Personal Information, we will give you a written notice that sets out our reasons for our refusal (unless it would be unreasonable to provide those reasons), including details of the mechanisms available to you to make a complaint.

If you would like to obtain such access, please contact us as set out in clause (22) below.

OPT-OUT CHOICES

To "opt-out" of (1) any consents previously given to us, (2) receiving communications from us, or (3) having Personal Information disclosed to third parties, send an e-mail to privacy@caravea.au. Notwithstanding this right to request to cease receiving communications from us and to have us not share Personal Information with third parties, we retain the right to collect, maintain and process information provided by and collected about you on and through the Services, and disclose such information to comply with its reasonable business and legal obligations.

BUSINESS TRANSFER

If our business (or substantially all of our assets) are acquired by a third party, or if we go out of business, enter bankruptcy, or go through some other change of control, Personal Information may be made available or otherwise transferred to the new controlling entity, where permitted under applicable law.

CHANGES TO THIS PRIVACY POLICY

We may amend this Privacy Policy from time to time. If we decide to change our Privacy Policy, we will post those changes on this page and update the Privacy Policy modification date at the top of this page. Use of Personal Information we collect is subject to the Privacy Policy in effect at the time such information is collected, used or disclosed. If we make material changes or changes in the way we use Personal Information, we will notify you by posting an announcement on our Website or sending you an email prior to the change becoming effective. You are bound by any changes to the Privacy Policy when you use our Services after such changes have been first made available online.

COMPLAINT PROCEDURE

If you have a complaint concerning the manner in which we maintain the privacy of your Personal Information, please contact us as set out in clause (22) below. All complaints will be considered by our privacy officer and we may seek further information from you to clarify your concerns. If we agree that your complaint is well founded, we will, in consultation with you, take appropriate steps to rectify the problem.

If we are unable to satisfactorily resolve your concerns about our handling of your Personal Information, you can contact the Office of the Australian Information Commissioner:

Foreign residents may also reach the relevant information commissioner in your jurisdiction.

FOREIGN PRIVACY ACTS

You may have additional rights under other applicable foreign privacy laws, including but not limited to the following:

• If you are a New Zealand resident, you have additional rights under the Privacy Act 2020.
• If you are a Singaporean resident, you have additional rights under the Personal Data Protection Act 2012 (PDPA).
• If you are a resident of the United Kingdom or the European Union, you have rights under the UK General Data Protection Regulation (UK GDPR) and the EU General Data Protection Regulation (EU GDPR), respectively.
• If you are a resident of certain U.S. states, such as California, you may have rights under state privacy laws, including the California Consumer Privacy Act (CCPA) or the California Privacy Rights Act (CPRA).
• If you are a resident of South Africa, you have rights under the Protection of Personal Information Act (POPIA).
• If you are a resident of Canada, you have rights under the Privacy Act and the Personal Information Protection and Electronic Documents Act (PIPEDA).
• If you are a resident of Japan, you have additional rights under the Protection of Personal Information (APPI).
• If you are resident of Hong Kong, you have additional rights under the Personal Data (Privacy) Ordinance (PDPO).
• If you are resident of India, you have additional rights under the Digital Personal Data Protection Act 2023 (DPDP Act).
• If you are resident of China, you have additional rights under the Personal Information Protection Law (PIPL), Data Security Law (DSL) and Cybersecurity Law (CSL).

GDPR

If you are an individual in a country in the European Economic Area (EEA), we may be required to comply with the EU General Data Protection Regulation 2016/679 (GDPR) which applies to us when processing the Personal Information of individuals (data subjects) who are in countries in the EEA in relation to offering you our products or services or if we monitor any of your behaviour when in those countries. Caravea is a data controller for our website and services provided through our website.

In some circumstances, the GDPR provides additional protection to individuals located in Europe. Where this is the case, there may be additional rights and remedies available to you under the GDPR if your Personal Information is handled in a manner inconsistent with that law.

You have certain rights in relation to Personal Information we hold about you, such as the right to be informed, access, rectify, erase, and object or restrict your data. We will require evidence of your identity before we are able to act on your request.

Should there be a conflict between these clauses 19 and 20 and the rest of the Policy, these two clauses will prevail if you are an individual residing within GDPR jurisdiction.

GDPR LAWFUL Processing OF personal data

Under the GDPR, we are allowed to process your Personal Information based on the following legal bases for the purposes explained in the previous clause ‎19 "What information we collect and why":

Legitimate Interests: We are permitted to process your personal data if it is based on our 'legitimate interests' i.e., we have good, sensible, practical reasons for processing your personal data which is in our interests. To do so, we have considered the impact on your interests and rights, and have placed appropriate safeguards to ensure that the intrusion on your privacy is reduced as much as possible. You can object to processing that we carry out on the grounds of legitimate interests. See the clause ‎20 "General Data Protection Regulation" and ‎21 "Contact Us".

Contract: It is necessary for our performance of the Services you have agreed to receive from us. If you do not provide your Personal Information to us, we will not be able to provide the relevant Services to you.

Legal obligation: We are subject to legal obligations to process your personal data for the purposes of complying with applicable regulatory rules and to make mandatory disclosures to government bodies and law enforcement agencies.

Consent: Sometimes we want to use your personal data in a way that is entirely optional for you, such as when you sign up to our newsletter. On these occasions, we will ask for your consent to use your information. You can withdraw this consent at any time by following the instructions in the marketing communication (e.g., clicking "unsubscribe" in the marketing email) or reaching out to us using the information in clause ‎21 "Contact Us".

HOW TO CONTACT US ABOUT PRIVACY

If you have any queries, or if you seek access to your Personal Information, or if you have a complaint about our privacy practices, you can contact our privacy officer below: