Novaro Group ("we", "us" or "our") is committed to protecting your privacy and handling your personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

This Privacy Policy explains how we collect, use, store, disclose and protect your personal information, including information used to verify your identity.

The most current version of this Privacy Policy is always available at novarogroup.com.au.

We may collect personal information including:

• Full name
• Date and place of birth
• Residential or business address
• Email address and telephone number
• Government-issued identification details (such as your driver's licence, passport, Medicare card or other identification documents)
• Biometric information, including a facial image or short video used for identity verification
• Information relating to the services we provide and any associated transactions
• Any other information you voluntarily provide to us

We only collect personal information that is reasonably necessary to provide our services and operate our business.

We collect, use and disclose your personal information to:

• Verify your identity
• Provide and manage our services
• Communicate with you regarding our services
• Meet our legal and regulatory obligations, including Anti-Money Laundering and Counter-Terrorism Financing (AML/CTF) requirements
• Detect and prevent fraud
• Protect our systems and business operations
• Improve our services and customer experience

To verify your identity, we may use electronic identity verification services, including the Australian Government's Document Verification Service (DVS).

With your consent, your name, date of birth and identity document details may be securely submitted to the relevant Commonwealth or State authority that issued your identification document. These authorities may include:

• Department of Home Affairs
• Passport Office
• State and Territory Driver Licence Authorities
• Births, Deaths and Marriages Registries
• Other authorised government record holders

These authorities compare the information you provide against their records and return only a verification result indicating whether your details match.

We do not receive copies of your government records.

Where identity verification is required, your information may be securely provided to an approved Identity Verification Provider for the purpose of conducting DVS checks on our behalf.

Further information about the Document Verification Service is available at idmatch.gov.au.

As part of identity verification, we may collect biometric information such as a facial image or short video.

Biometric information may be used to:

• Confirm you are a real person who is physically present
• Compare your facial image against your identification document
• Help prevent fraud and identity theft

Biometric information is considered sensitive information under the Privacy Act.

We only collect and use biometric information with your consent and solely for identity verification and related compliance purposes.

By providing your personal information and completing our identity verification process, you consent to:

• The collection, use and disclosure of your personal information for identity verification and compliance purposes
• The collection and use of biometric information for identity verification
• Your information being checked against Commonwealth and State records through the Document Verification Service
• Your information being shared with our authorised identity verification providers where required

Providing your consent is voluntary.

If you choose not to provide consent, or do not provide the information required, we may be unable to verify your identity electronically. In these circumstances, we may need to verify your identity using alternative methods or may be unable to provide our services.

You may withdraw your consent at any time by contacting us using the details provided in Section 13.

We may disclose your personal information to:

• Approved identity verification providers and authorised sub-providers
• Commonwealth and State authorities through the Document Verification Service
• Our employees and authorised representatives where reasonably necessary
• Professional advisers including lawyers, accountants and auditors
• Trusted technology providers and service providers that support our business
• Regulators, law enforcement agencies or other parties where required or authorised by law

We do not sell your personal information.

Some of our service providers may store or process personal information outside Australia.

Where this occurs, we take reasonable steps to ensure your personal information continues to receive protection consistent with the Australian Privacy Principles, including through appropriate contractual safeguards.

We take reasonable steps to protect your personal information from misuse, interference, loss and unauthorised access, modification or disclosure.

These measures include:

• Secure systems
• Restricted access controls
• Encryption where appropriate
• Ongoing security monitoring

We retain personal information only for as long as necessary to fulfil the purposes outlined in this Policy or as otherwise required by law.

When information is no longer required, it is securely destroyed or permanently de-identified.

You may request access to the personal information we hold about you and request corrections if you believe it is inaccurate, incomplete or out of date.

Requests can be made using the contact details provided in Section 13.

We will respond within a reasonable period.

From time to time, we may use your contact details to send you information about our services that may be of interest to you.

You may opt out of receiving marketing communications at any time by:

• Selecting the unsubscribe option in our communications; or
• Contacting us directly using the details in Section 13.

If you believe we have mishandled your personal information, please contact us using the details below.

We will acknowledge your complaint, investigate the matter and respond within a reasonable timeframe.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC).

Website: www.oaic.gov.au

Telephone: 1300 363 992

We encourage you to contact us first so we have the opportunity to resolve your concerns promptly and fairly.

If you have any questions about this Privacy Policy or wish to exercise your privacy rights, please contact us.

Novaro Group

Privacy Contact: Stefano Battaglia – Director

Email: stefano@novarogroup.com.au

Website: novarogroup.com.au

We may update this Privacy Policy from time to time to reflect changes in our business practices, legal obligations or regulatory requirements.

The latest version will always be published on our website.

Where significant changes are made, we will notify you where appropriate.