Avocado Consulting Pty Ltd (ABN 14 108 342 561) ("Avocado Consulting", "we", "us") is bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This policy explains how we collect, hold, use, disclose and protect personal information, and how you can access or correct it or make a complaint.

It applies to personal information we collect through our website, events, marketing, client engagements, recruitment and dealings with suppliers and partners. We review this policy at least once a year.

The personal information we collect depends on how you deal with us. It may include:

• contact and professional details: name, job title, employer, business email, phone number and location
• your interests and preferences, including topics, events and content you engage with
• information you provide in forms, event registrations, surveys, enquiries and correspondence
• for job applicants: your resume, work history, qualifications, referee details, right-to-work information and any assessment results
• for clients and suppliers: details needed to manage contracts, projects, billing and access to systems
• technical and usage data: IP address, device and browser type, pages visited, time on site, referring sites and interactions recorded through cookies and similar technologies

We do not usually collect sensitive information (such as health or criminal record information). If we need it, for example for a background check required by a client engagement, we will only collect it with your consent or where the law allows.

Where practical, you can deal with us anonymously or using a pseudonym, such as when browsing the website or making a general enquiry. We may not be able to provide some services or progress a job application if you do.

We collect personal information mostly from you directly, for example when you complete a form, register for an event or webinar, download a resource, apply for a role or contact us.

We may also collect it from third parties, including technology partners who co-host events or campaigns with us, event organisers, recruitment agencies, referees, professional networking platforms such as LinkedIn, and publicly available sources. If we receive information we did not ask for and could not have collected ourselves, we will destroy or de-identify it where lawful and reasonable.

We use personal information to:

• respond to enquiries and provide our services
• manage client, partner and supplier relationships
• run events, webinars and campaigns, including joint campaigns with technology partners
• send marketing about our services, insights and events
• assess job applications and manage recruitment
• operate, secure and improve our website and systems, including understanding how visitors use them
• meet our legal, regulatory and contractual obligations

We do not sell, rent or lease personal information.

We send marketing emails in line with the Spam Act 2003 (Cth). Every marketing email includes a working unsubscribe option, and you can also opt out by contacting us. We will act on an opt-out within five business days.

We run joint marketing activities with technology partners, including [Dynatrace, CyberArk, Splunk and others]. With your consent, usually given when you register for a joint event or campaign, we may share your name, business email, job title, company and phone number with the relevant partner so they can follow up with you. Partners are bound by contract to handle your information appropriately. You can withdraw consent at any time by contacting us.

We may also disclose personal information to:

• service providers who support our business, such as CRM and marketing automation, website hosting, analytics, cloud storage, event management and recruitment platforms
• professional advisers, such as lawyers, accountants and auditors
• clients, where needed to deliver an engagement (for example, consultant profiles)
• government agencies or others where required or authorised by law
• a buyer, seller or adviser as part of a business sale, acquisition or restructure

Our website uses cookies and similar technologies, from us and from third parties, to make the site work, understand how it is used and support advertising. These include [HubSpot, Microsoft Clarity, Microsoft Advertising, Google Analytics and the LinkedIn Insight Tag].

Microsoft Clarity records behavioural metrics, heatmaps and session replays to help us improve the website. It masks sensitive text, such as information typed into forms. Advertising tools may use cookies to show you our ads on other websites and measure their results.

You can manage non-essential cookies through our cookie banner or your browser settings. Blocking some cookies may affect how the website works.

Some of our service providers and technology partners store or access personal information outside Australia. These recipients are likely to be located in [the United States, the European Union, the United Kingdom and Israel]. We take reasonable steps to ensure overseas recipients handle personal information in line with the APPs.

We do not use computer programs to make, or to substantially and directly help make, decisions that could reasonably be expected to significantly affect your rights or interests.

We may use automated tools, including artificial intelligence, for routine tasks such as sorting enquiries or personalising website content. These do not make significant decisions about you.

We take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, change or disclosure. Our controls include access management, encryption, multi-factor authentication, staff training and supplier due diligence.

We keep personal information only as long as we need it for the purposes in this policy or as required by law. When we no longer need it, we take reasonable steps to destroy or de-identify it.

We follow the Notifiable Data Breaches scheme under the Privacy Act. If a data breach is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC).

You can ask to access the personal information we hold about you, or to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading. Contact our Privacy Officer using the details below. We will respond within 30 days. We do not charge for requests, unless access involves significant cost, in which case we will tell you first. If we refuse a request, we will explain why in writing.

If you have a concern about how we have handled your personal information, please contact our Privacy Officer. We will acknowledge your complaint within five business days and aim to resolve it within 30 days.

If you are not satisfied with our response, you can complain to the OAIC at oaic.gov.au or on 1300 363 992.

We may update this policy from time to time. The current version will always be on our website, with the date it was last updated.

Privacy Officer Avocado Consulting Pty Ltd GPO Box 3583, Sydney NSW 2001 Email: [privacy@avocado.com.au] Phone: 02 8905 0198