Privacy Policy – Envest Group and Subsidiary Companies

Effective Date: 19 May 2025

1. Overview

Your privacy matters to us. This Privacy Policy explains how Envest Group Pty Ltd (ABN 73 645 319 820) and all of its subsidiary and associated companies (collectively referred to as "Envest", "we", "our", or "us") collect, use, store, and disclose your personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

We are committed to protecting your privacy and ensuring that your personal information is handled in a secure, respectful, and lawful way. This policy applies to all our products, services, websites, mobile applications, and customer interactions.

2. Definitions

• “Personal Information” means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information is true or not, and whether recorded in a material form or not.
• “Sensitive Information” is a sub-category of personal information and includes information about an individual’s:
  • racial or ethnic origin
  • political opinions or memberships
  • religious or philosophical beliefs
  • trade or professional association memberships
  • union membership
  • sexual orientation or practices
  • criminal record
  • health, genetic or biometric information
• “Related Companies” has the same meaning as in section 50 of the Corporations Act 2001 (Cth) and includes our group companies and corporate partners.
• “You” or “Your” refers to any person whose personal information is collected, held, used, or disclosed by us, including users of our websites or services.

3. Our Commitment

We are bound by the Privacy Act 1988 (Cth) and the APPs which set minimum standards for how we collect, store, use, disclose, and protect your personal information. A copy of the APPs is available from the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

4. What We Collect and Why

We may collect personal information including:

• Names, contact details, and addresses
• Email addresses and phone numbers
• Date of birth and gender
• Employment or business details
• Policy, claim, or transaction information

We collect this information for purposes including:

• Providing and managing our products or services
• Managing client and customer relationships, underwriting, and claims
• Internal business operations such as training, auditing, and analytics
• Legal and regulatory compliance
• Direct marketing and promotions
• Product and service improvement through research and analysis

Collection Notice: At or before the time we collect your personal information, or as soon as practicable afterwards, we will provide a collection notice outlining the purpose of collection, who we may disclose the information to, any legal requirements, and links to this policy.

5. How We Collect Personal Information

We collect your personal information:

• Directly from you (e.g. through forms, emails, calls, applications, in-person)
• Automatically via our websites using cookies and tracking tools
• Through social media or other public sources
• From third parties, such as brokers, advisers, employers, or partners
• Via electronic communications and referral networks

If we collect personal information from a third party, we will take reasonable steps to ensure you are made aware of the collection, including the purpose and your rights.

6. What Happens If You Don’t Provide Information

If you do not provide requested information, we may be unable to:

• Provide you with our products or services
• Respond to your enquiry or application
• Process a claim or request
• Comply with legal obligations

7. Use and Disclosure of Your Information

We use and disclose your personal information only for:

• The primary purpose for which it was collected
• Related secondary purposes you would reasonably expect
• Other uses with your consent or where required or authorised by law

We may disclose your personal information to:

• Other companies within the Envest Group
• Insurance underwriters, claims assessors, and loss adjusters
• Government agencies, regulators, and law enforcement
• Financial institutions and brokers
• Marketing and analytics service providers
• Professional advisers (accountants, auditors, lawyers)
• Medical or health service providers (where relevant)
• IT service providers, data hosts, and cloud providers
• Dispute resolution bodies
• Any other person or organisation you authorise

We do not sell your personal information.

8. Sensitive Information

We only collect and handle sensitive information if:

• You have given explicit consent
• It is necessary for a primary function (e.g., insurance claims)
• Required or authorised by law
• Permitted under the Privacy Act

9. Overseas Disclosure

Some of our service providers and data partners are located overseas. Your personal information may be disclosed to third parties located in:

• United Kingdom (UK)
• Malaysia
• South Africa
• Singapore

We take reasonable steps to ensure overseas recipients handle your information in accordance with Australian privacy standards. For an up-to-date list of overseas recipients, please contact us using the details in Section 16.

10. Direct Marketing

We may use your personal information to send you:

• Product and service updates
• Newsletters, offers, or promotions
• Information from related companies or partners

You may opt out of marketing communications at any time by following the unsubscribe instructions or contacting us directly.

We may also use third-party services for campaign management and data analytics. These providers are subject to strict contractual confidentiality obligations.

11. Website Tracking and Cookies

We use cookies and similar technologies to:

• Monitor website performance and traffic
• Customise and improve user experience
• Enable remarketing and targeted advertising

You can disable cookies via your browser settings, but doing so may limit certain website functionality.

12. Accessing and Correcting Your Information

You may request:

• Access to the personal information we hold about you
• Correction of inaccurate, incomplete, or outdated information

To do so, contact us in writing (see Section 16). We may need to verify your identity. We do not charge a fee for access requests but may charge for physical copies.

13. Data Security and Retention

We take reasonable steps to protect your personal information from:

• Misuse, interference, or loss
• Unauthorised access, modification, or disclosure

When your personal information is no longer required, we will securely destroy or de-identify it. Some information may be retained for legal or regulatory reasons (e.g., for 7 years or more).

14. Making a Privacy Complaint

If you believe we have breached your privacy rights, please contact us using the details below.

We will:

• Acknowledge your complaint within a reasonable time
• Investigate and respond in a timely manner
• Inform you of any further options if you are not satisfied with our response

You may also contact the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

15. Important Notice – Subsidiary Privacy Policies

Some Envest subsidiaries or associated businesses may operate under their own privacy policies for Business Specific Activities.

This Group Privacy Policy supplements (but does not replace) the privacy policies of our subsidiaries. If you are a customer of a specific business (e.g., Club 4x4 Insurance), please consult their individual privacy policy and terms of service, which govern their specific collection and use of your information.

16. Contact Us

For all privacy enquiries, requests or complaints, please contact:
Suite 1, Level 7, 545 Queen Street
Brisbane, QLD 4000
Email: communications@envest.com.au
Website: https://www.envest.com.au/privacy-policy/

17. Policy Updates

This policy is current as of 19 May 2025. We may update this Privacy Policy from time to time to reflect changes in legal obligations or business practices. The latest version is always available on our website.