www.creativecubes.co/privacy CREATIVECUBES.CO PRIVACY STATEMENT There are some things we take very seriously, and privacy is one of them. This Privacy Statement explains how we handle personal information in the course of operating our business. DEFINITIONS To help keep this Privacy Statement simple, we’ve defined a few terms at the start: a. When we say “us”, “we” or “our”, we mean the Operators. b. When we refer to our “Business”, we mean the business of operating Co Working Spaces. c. When we say “Co Working Space”, we mean a co-working space branded ‘CreativeCubes.Co’. d. When we say “Member”, we mean a person who has obtained a membership in order to have access to a Co Working Space. e. When we say “Operators”, we mean jointly and severally each of the entities which operate and control a Co Working Space, which at the time of writing this Privacy Statement was CreativeCubes.Co Property–Cremorne Pty. Ltd. ACN 616 147 945. f. When we say “Payment Services Provider”, we mean the third party business engaged by us to provide payment processing services, which at the time of writing this Privacy Statement was the service known as Stripe. g. When we say “Personal Information”, we mean information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information or opinion is true or not, and whether recorded in a material form or not. h. When we say “Privacy Act”, we mean the Privacy Act 1988 (Cth) as updated or amended from time to time. i. When we say “Supplier”, we mean any legal entity which supplies us with Personal Information (which could be a person making an enquiry, a Member, a Third Party or somebody else). j. When we say “User”, we mean any person who accesses and uses a Co Working Space whether as a Member or otherwise. k. When we say “Third Party”, we mean a third party who supplies goods and/or services to us, or who we otherwise deal with during the course of operating the Business. l. When we say “Third Party Software” we mean any software owned or operated by a third party or licensed to us by a third party. m. When we say “Website”, we mean our website at http://creativecubes.co/. 1. The Privacy Act and us At the time of writing this Privacy Statement, we were not legally bound by the Privacy Act. However, as a matter of best practice, we do (and will) make all reasonable endeavours to comply with the Privacy Act. 2. How we receive Personal Information We come into contact with Personal Information from Suppliers in the following kinds of ways: a. When we receive and process an application to become a Member; b. When our Users interact with us (for example by sending us correspondence or making payments); c. When we receive an enquiry via our Website or other means; and d. When a Third Party provides us with the Personal Information of any individual. 3. The kinds of Personal Information we receive The kinds of Personal Information we will directly request, and receive, include: a. From Members – i. Business name ii. ABN and/ or ACN iii. Contact individual name iv. Contact phone number v. Profile picture vi. Business logo vii. Email address viii. Physical address ix. Certain kinds of payment information (as discussed in paragraph 3 below) x. Information the Member chooses to disclose as part of their profile on our network, including: a. General introductory/ biographical information b. Interests c. Skills d. Achievements e. Social media handles b. From other Users – i. Business name ii. ABN and/or ACN iii. Contact individual name iv. Contact phone number v. Email address c. From individuals who make an enquiry through our Website – i. Name ii. Contact details (which may be an email address or phone number or both) iii. Information provided by the individual regarding the nature of the enquiry and how we can help them d. From Third Parties – i. Information which is reasonably necessary to enable us to conduct the relevant business relationship (such as the Personal Information of the contact person nominated by the relevant Third Party). 4. Payment information We will usually take payment from Users via our Payment Services Provider, in which case we will not directly receive or process the User’s credit card information. Our Payment Services Provider handles all Personal Information it receives according to its own privacy policy (which, at the time of writing this Privacy Statement, was available at the following link: https://stripe.com/au/privacy). We are not responsible for how our Payment Services Provider handles Personal Information it receives, such as credit card details and other payment information. From time to time, where we make the option available to a particular User, we may also receive payment directly via electronic funds transfer from that User’s bank account to our bank account. In such circumstances, we will be able to view certain information regarding the payment in our bank statements (such as the date of payment, transfer description and relevant account name). In addition to information set out above, we may also collect non-personal statistical information through our Website as detailed in our Website Terms and Conditions available at creativecubes.co/terms. 5. Storage, access to and disclosure of Personal Information We store electronic data relating to the Business on our servers which are currently based at Level 3, 534 Church St Cremorne VIC Australia. We also use cloud-based services such as Dropbox and Google Drive to store and allow us to remotely access data. Access to our stored data is restricted to our employees, contractors, officers and technical support providers (our “Personnel”). In addition to the foregoing, Personal Information may be used or disclosed by us as required by law, including but not limited to the “permitted general situations” which are outlined in the Privacy Act. 6. Use of Third Party Software In the course of operating our Business from an internal perspective, we need to use Third Party Software. The Personal Information that we receive or deal with under this Privacy Policy may be transmitted, stored or shared via such Third Party Software (such as Calendy, Meshworkapp, Freshdesk, Integriti Security, XERO and so on). Although we don’t profess to be tech experts, we are happy to provide a reasonable amount of information to Suppliers about the data flow of their Personal Information, upon request. Although we do take care to carefully select the businesses we work with, we cannot be responsible for the privacy practices of the operators or licensors of such Third Party Software (the “Third Party Software Providers”). The handling of Suppliers’ Personal Information by Third Party Software Providers is subject to the privacy policy of the relevant Third Party Software Provider. 7. Sharing information with other third parties In addition to Third Party Software Providers, there are other kinds of third parties with whom we may have a genuine operational or business requirement to share the Personal Information of Suppliers, and Suppliers agree to such sharing, use and disclosure. These kinds of third parties include (for example) investors and prospective investors in our Business who wish to inspect our books and accounts for due diligence purposes. 8. Anonymity and pseudonymity We are happy to accept enquiries pseudonymously, although this will limit our ability to effectively respond to the enquiry. Otherwise, we do not give Users or Third Parties the option of being anonymous or pseudonymous because it will restrict our ability to manage the relationship and effectively carry out our Business with respect to that User or Third Party. 9. Our promises In operating our Business, we agree that we will: a. Not directly or indirectly use, disclose, alter or otherwise handle any Personal Information which we receive from any Supplier except as expressly noted in this Privacy Statement or as otherwise reasonably required to give effect to the terms of and carry out our obligations under the relevant agreement with the Supplier (the “Intended Purpose”); b. Except as expressly noted in this Prviacy Statement, not disclose any Personal Information which we receive from the Supplier to any third party other than our Personnel, without obtaining the prior written consent of the Supplier, a condition of which may be that the person who we plan to disclose the Personal Information to also agrees to be bound by the provisions of this paragraph; and c. Take all reasonable steps (including maintaining appropriate operational and technological processes and procedures) to ensure that the Personal Information is protected against misuse, interference, loss, and unauthorised access, modification and/or disclosure. We will promptly notify the relevant Supplier if we become aware of: a. Any accidental or unauthorised access to any Personal Information supplied, or any disclosure outside of disclosure permitted for the Intended Purpose; b. Any loss of any Personal Information supplied; and c. Any breach of security which involves any Personal Information supplied. At the end of our relationship with a User or Third Party, if that party requests, we will take reasonable steps to destroy or permanently de-identify Personal Information provided by that party. However, we may retain and use de-identified information or statistical data collected. 10. Accessing and correcting Personal Information It is the Supplier’s responsibility to ensure that the Personal Information supplied is accurate and up to date. If the Supplier believes that any Personal Information held by us is inaccurate, incomplete, out of date or misleading, the Supplier may notify us and we will correct the information. Suppliers are entitled to request a copy of any Personal Information we hold about them. The Supplier doesn’t need a reason for asking, but we have the right to charge the Supplier for reasonable expenses we incur in preparing and sending the information. We will endeavour to respond to all requests within a reasonable time. We can refuse access to Personal Information where the access would be unlawful or have an unreasonable impact on the privacy of others, the information is commercially sensitive, or the request is frivolous or vexatious. 11. Direct marketing We reserve the right to directly market with respect to our Business to Suppliers using the email addresses provided, but will always give Suppliers the option of opting out of receiving direct marketing materials. If selected by you, you will also receive direct marketing from our affiliates, and you will similarly have the option of opting out of receiving marketing materials from our affiliates. 12. Transfer in certain circumstances If there is a sale, merger, consolidation, change in control, transfer of substantial assets, reorganisation or liquidation of us, then we may transfer, sell or assign Personal Information to one or more relevant third parties. We may also transfer, sell or assign Personal Information belonging to a Supplier with the prior written consent of a Supplier. This clause may be overridden if we agree in writing with a particular Supplier to handle their Personal Information differently. 13. Questions and complaints Any questions about this Privacy Statement, requests for access or correction, and complaints, may be directed to hello@creativecubes.co. For further information on online privacy rights, please contact the Office of the Australian Information Commission at www.oaic.gov.au.