Privacy Policies.

1.1 ACOFEL PTY LTD is the entity responsible for the personal information collected and held through the Platform. ACOFEL is an APP entity for the purposes of the Privacy Act.

1.2 Our Privacy Officer can be contacted at: Email: [email protected]. Postal Address: ACOFEL PTY LTD, [Address], Australia.

1.3 If you have any questions, concerns, or complaints about how we handle your personal information, we encourage you to contact our Privacy Officer in the first instance.

2.1 We collect personal information that is reasonably necessary to provide the Platform and its services. The personal information we collect varies depending on whether you are a Learner or an Instructor.

2.2 From Learners, we collect:

• full legal name;
• email address;
• mobile phone number;
• residential address and pickup address for Lessons;
• learner driver permit or licence number and issuing state or territory;
• date of birth (for age verification and regulatory compliance purposes);
• payment information processed through Stripe (note: ACOFEL does not store card details directly);
• booking history, lesson records, and communications through the Platform;
• reviews and ratings submitted on the Platform;
• device information and usage data collected through cookies and similar technologies, as described in our Cookie Policy; and
• any other information voluntarily provided through support requests or correspondence with ACOFEL.

2.3 From Instructors, we collect:

• full legal name and trading name (if applicable);
• email address and mobile phone number;
• business address and operating working areas;
• driving instructor licence or accreditation number, issuing authority, and expiry date;
• Certificate IV in Motor Vehicle Driving Instruction qualification details;
• National Police Criminal History Check documentation;
• Working With Children Check number, type, and expiry date (or equivalent Blue Card or WWVP registration);
• public liability insurance policy details;
• vehicle registration, make, model, year, and safety information;
• bank account details for payout processing;
• Commission and payout records;
• profile photograph and biography submitted for display on the Platform;
• reviews and ratings received from Learners; and
• device information and usage data collected through cookies and similar technologies.

2.4 We also collect information generated through your use of the Platform, including log data (IP address, browser type, pages visited, time and date of access), location data (where you have enabled location services on your device), and Platform interaction data (clicks, searches, and booking flows).

3.1 We collect personal information through the following means:

• directly from you when you register an account, complete your profile, make or accept a Booking, submit a review, or contact our support team;
• from your device and browser through cookies, pixels, and similar tracking technologies, as described in our Cookie Policy;
• from Stripe, in connection with payment processing and payout management;
• from third-party identity verification or credential checking services, where applicable; and
• from government or regulatory sources in connection with Instructor verification, to the extent permitted by law.

3.2 We will only collect personal information by lawful and fair means, and only to the extent necessary for the purposes described in this Privacy Policy.

3.3 Where we collect personal information about you from a third party, we will take reasonable steps to notify you of this collection as soon as practicable.

4.1 We collect, hold, use, and disclose your personal information for the following primary purposes:

• to establish and manage your account on the Platform;
• to verify the eligibility and credentials of Instructors before listing on the Platform;
• to facilitate the search, discovery, and booking of Instructors by Learners;
• to process payments and manage payouts through Stripe;
• to administer the Wallet credit system;
• to send booking confirmations, reminders, cancellation notices, and refund notifications;
• to respond to your support requests, complaints, and inquiries;
• to display Instructor profiles, reviews, and availability to Learners;
• to detect, prevent, and investigate fraud, security incidents, and breaches of our Terms;
• to comply with our legal obligations under applicable law, including the Privacy Act, Australian Consumer Law, road transport legislation, and Working With Children Check requirements; and
• to improve and develop the Platform, including by analysing usage patterns and feedback.

4.2 We may also use your personal information for the following secondary purposes, with your consent where required:

• to send you marketing communications about ACOFEL's services, promotions, and features, where you have opted in to receive such communications; and
• to conduct surveys, research, and analysis to understand how the Platform is used and how it can be improved.

4.3 If we wish to use your personal information for a purpose other than those described above, we will seek your consent or rely on another permitted ground under the Privacy Act.

5.1 We do not sell, rent, or trade your personal information to third parties. We may disclose your personal information to the following categories of recipients, as necessary for the operation of the Platform:

(a) Instructors: When a Learner makes a Booking, ACOFEL will share the Learner's name, phone number, and pickup address with the relevant Instructor for the purpose of delivering the booked Lesson.

(b) Learners: When a Booking is confirmed, ACOFEL will share the Instructor's name, contact details, and vehicle information with the relevant Learner for the purpose of the Lesson.

(c) Stripe: Payment and payout data is shared with Stripe for the purpose of processing transactions. Stripe's privacy policy is available at www.stripe.com/au/privacy.

(d) Cloud hosting and infrastructure providers: We use third-party cloud services to host the Platform and store data securely.

(e) Analytics and marketing service providers: We may use tools such as Google Analytics to understand Platform usage. These tools may process usage data in accordance with their own privacy policies.

(f) Legal and regulatory authorities: We may disclose personal information to law enforcement, government agencies, courts, or other regulatory bodies where required by law, court order, or to protect ACOFEL's legal rights.

(g) Professional advisors: We may share personal information with our legal, financial, and accounting advisors in connection with the operation of our business, subject to obligations of confidentiality.

(h) Business successors: In the event of a merger, acquisition, or sale of substantially all of ACOFEL's assets, your personal information may be transferred to the acquiring entity, subject to equivalent privacy protections.

5.2 We require all third parties who receive personal information from us to handle that information in accordance with applicable privacy laws and to implement appropriate security measures.

6.1 ACOFEL operates primarily in Australia but uses third-party service providers whose servers and operations may be located outside Australia. In particular:

• Stripe processes payment data on servers located in the United States. By making or receiving a payment through the Platform, you acknowledge that your payment data may be transferred to, and processed in, the United States. In such circumstances, your data may be subject to the laws of the United States, including the USA PATRIOT Act, which may permit access to your data by US government authorities without prior notice.
• Other cloud service providers and analytics tools used by ACOFEL may process data in locations including but not limited to the United States, Ireland, or Singapore.

6.2 Before disclosing personal information to overseas recipients, ACOFEL takes reasonable steps to ensure that the recipient is subject to privacy protections that are at least substantially similar to the APPs, or will otherwise handle the information in a manner consistent with the APPs.

6.3 By using the Platform, you consent to the cross-border disclosure of your personal information as described in this clause, and you acknowledge that ACOFEL may not always be able to ensure that overseas recipients will comply with the APPs.

7.1 Pursuant to the Privacy and Other Legislation Amendment Act 2024, which amended the Privacy Act with effect from 11 December 2024, we are required to disclose when we use substantially automated processes to make decisions that significantly affect individuals.

7.2 We use automated processes in the following contexts in connection with the Platform:

• Search result ranking: The Platform uses automated algorithms to rank and display Instructor profiles in response to Learner location searches. Ranking factors may include geographic proximity, availability, profile completeness, and aggregate review rating. No individual is employed solely to review each search result.
• Account flagging: The Platform's security systems may automatically flag user accounts or transactions that display characteristics associated with fraud, unusual activity, or policy violations. Flagged accounts may be subject to manual review or temporary suspension.
• Refund processing: Certain refund categories (such as Instructor cancellations confirmed through the Platform) may be processed automatically without manual review.

7.3 If an automated decision has significantly affected you and you would like to request human review of that decision, you may contact our Privacy Officer at [email protected]. We will review your request and respond within a reasonable timeframe.

7.4 Detailed disclosures regarding the use of automated decision-making processes in our privacy policies will be updated to comply with the additional transparency obligations taking effect on 10 December 2026 under the Privacy and Other Legislation Amendment Act 2024.

8.1 The Platform is accessible to individuals who are 16 years of age or older. We recognise that a significant proportion of Learners may be minors (persons under 18 years of age), and we are committed to handling the personal information of minors with heightened care.

8.2 Where a Learner is under 18 years of age, they must obtain the express consent of a parent or legal guardian before registering on the Platform and before their personal information is collected. By registering, a Learner under 18 represents that such consent has been obtained.

8.3 We do not knowingly collect personal information from children under 16 years of age. If we become aware that personal information has been collected from a child under 16 without parental consent, we will take steps to delete that information as soon as practicable.

8.4 In anticipation of the Children's Online Privacy Code to be registered by the Office of the Australian Information Commissioner by 10 December 2026, ACOFEL is taking proactive steps to strengthen privacy protections for minors who use the Platform. This includes implementing enhanced data minimisation practices for Learner accounts identified as minors, and restricting the use of minor Learners' data for non-essential purposes.

8.5 Parents or guardians who believe their child under 16 has registered on the Platform without their consent should contact us immediately at [email protected].

9.1 ACOFEL implements technical and organisational measures to protect personal information from misuse, interference, loss, unauthorised access, modification, or disclosure. These measures include:

• encryption of data in transit using industry-standard TLS/SSL protocols;
• encryption of sensitive data at rest, including payment and identity data;
• access controls that restrict access to personal information to authorised personnel on a need-to-know basis;
• regular security assessments and vulnerability testing;
• staff training on privacy and data security obligations; and
• contractual requirements imposed on third-party service providers to maintain equivalent security standards.

9.2 We take "reasonable steps" to protect personal information as required by APP 11 and, consistent with the Privacy and Other Legislation Amendment Act 2024, we interpret those reasonable steps to include the implementation of "technical and organisational measures" appropriate to the nature and sensitivity of the information held.

9.3 Despite our security measures, no system is completely secure. ACOFEL cannot guarantee the absolute security of your personal information. In the event of an eligible data breach as defined in Part IIIC of the Privacy Act, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) in accordance with the Notifiable Data Breaches scheme.

10.1 We retain personal information for as long as it is necessary to fulfil the purposes for which it was collected, or as required by applicable law. Our standard retention periods are as follows:

• Account data (name, email, contact details): retained for the duration of the account and for a period of seven (7) years following account closure, to comply with legal and regulatory obligations.
• Booking and transaction records: retained for seven (7) years following the date of the transaction, in accordance with Australian taxation and financial record-keeping requirements.
• Instructor credential documentation: retained for five (5) years following the termination of the Instructor's registration, to support potential licensing compliance inquiries.
• Communication records (support tickets, dispute correspondence): retained for three (3) years following the resolution of the matter.
• Review and rating data: retained for the duration of the Platform's operation, subject to removal upon a verified request in accordance with clause 13.
• Marketing consent records: retained for the duration of the consent and for three (3) years following withdrawal of consent, to evidence compliance with the Spam Act 2003.

10.2 When personal information is no longer required, we will take reasonable steps to destroy or de-identify it in a secure manner.

11.1 The Platform uses cookies, pixel tags, web beacons, and similar tracking technologies to enhance user experience, analyse Platform usage, and serve relevant content. A full description of the types of cookies used, the purposes for which they are used, and how you can manage your cookie preferences is set out in our Cookie Policy, available on the Platform.

11.2 Certain cookies used on the Platform are operated by third parties, including Google Analytics, Stripe, and any other analytics or advertising partners engaged by ACOFEL from time to time. These third parties process data in accordance with their own privacy policies.

11.3 By using the Platform, you consent to the use of cookies as described in our Cookie Policy. You may withdraw your consent or manage your cookie preferences at any time through your browser settings or the cookie preference centre on the Platform, however certain strictly necessary cookies cannot be disabled without affecting the functionality of the Platform.

12.1 We may send you marketing communications about ACOFEL's services, promotions, and features by email or SMS, provided you have given your express consent to receive such communications at the time of registration or subsequently through your account settings.

12.2 All marketing communications will clearly identify ACOFEL as the sender and will include a simple, functional mechanism for you to unsubscribe from future marketing communications. Unsubscribe requests will be actioned within five (5) business days of receipt.

12.3 Even if you opt out of marketing communications, we will continue to send you transactional and operational messages relating to your account and Bookings, including booking confirmations, payment receipts, cancellation notices, and security alerts. These messages are necessary for the performance of our obligations to you and do not require separate marketing consent.

12.4 We operate in compliance with the Spam Act 2003 (Cth) and the ACMA's Statement of Expectations on Consumer Consent for Electronic Marketing (July 2024). We maintain records of the date, time, and method of each User's consent to receive marketing communications.

13.1 Under the Australian Privacy Principles, you have the following rights in relation to your personal information held by ACOFEL:

(a) Right of Access: You have the right to request access to the personal information we hold about you. We will respond to access requests within 30 days. We may charge a reasonable administrative fee for providing access where permitted by law.

(b) Right to Correction: If the personal information we hold about you is inaccurate, out of date, incomplete, irrelevant, or misleading, you have the right to request that we correct it. We will respond to correction requests within 30 days.

(c) Right to Complain: If you believe we have breached the Privacy Act or the APPs in our handling of your personal information, you have the right to make a complaint to our Privacy Officer. If you are dissatisfied with our response, you may escalate your complaint to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

(d) Right to Opt Out of Marketing: You may withdraw your consent to receive marketing communications at any time by clicking "unsubscribe" in any marketing email or SMS, or by updating your communication preferences in your account settings.

(e) Right to Request Deletion: You may request the deletion of your personal information where it is no longer required for the purposes for which it was collected and where no legal obligation requires its retention. We will assess deletion requests on a case-by-case basis and will notify you if we are unable to fulfil a request.

13.2 To exercise any of the rights described in this clause, please contact our Privacy Officer at [email protected]. We may require you to verify your identity before processing your request.

14.1 If you are located in the European Union (EU) or the United Kingdom (UK), the General Data Protection Regulation (GDPR) or the UK GDPR (as applicable) may apply to our processing of your personal information, in addition to the Australian Privacy Act.

14.2 Under GDPR and UK GDPR, we rely on the following lawful bases for processing your personal information:

• Contract performance: processing necessary to fulfil the contract between you and ACOFEL (including account management, booking processing, and payment administration).
• Legitimate interests: processing necessary for ACOFEL's legitimate business interests, such as fraud prevention, platform security, and Platform improvement, where those interests are not overridden by your rights and freedoms.
• Consent: processing for marketing communications, non-essential cookies, and any other purpose for which we have sought and obtained your consent.
• Legal obligation: processing necessary to comply with a legal obligation under Australian or EU law.

14.3 EU and UK users have the following additional rights under GDPR and UK GDPR:

• Right to erasure ("right to be forgotten"): to request deletion of your personal information in certain circumstances;
• Right to data portability: to receive a copy of your personal information in a structured, commonly used, machine-readable format;
• Right to restriction of processing: to request that we restrict processing of your personal information in certain circumstances;
• Right to object: to object to processing based on legitimate interests;
• Rights in relation to automated decision-making: not to be subject to a decision based solely on automated processing that produces a legal or similarly significant effect on you, without human review.

14.4 To exercise any GDPR or UK GDPR right, please contact us at [email protected]. You also have the right to lodge a complaint with your local supervisory authority (for EU users) or the Information Commissioner's Office (for UK users).

15.1 If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), may apply to our processing of your personal information.

15.2 Under the CCPA/CPRA, California residents have the right to:

• know what personal information we collect, use, disclose, and sell or share;
• delete personal information we hold about them, subject to certain exceptions;
• correct inaccurate personal information;
• opt out of the sale or sharing of personal information for cross-context behavioural advertising; and
• not be discriminated against for exercising privacy rights.

15.3 ACOFEL does not sell personal information as defined under the CCPA. If you are a California resident and wish to exercise your CCPA rights, please contact us at [email protected].

16.1 We collect certain categories of sensitive information in the course of Instructor onboarding and verification, including:

• criminal history information (from National Police Criminal History Check documentation); and
• health and medical information (where voluntarily disclosed by a Learner or Instructor in connection with their fitness to drive or instruct).

16.2 We collect and hold this information only with the consent of the relevant individual (in the case of Instructor credential documentation), or where collection is required or authorised by law.

16.3 We do not use sensitive information for any purpose other than those for which it was collected, and we apply heightened security and access controls to sensitive information.

17.1 The Platform may contain links to external websites, services, and applications operated by third parties, including transport authority websites, mapping services, and payment portals. ACOFEL is not responsible for the privacy practices of any third-party website or service.

17.2 Once you leave the Platform or are redirected to a third-party website, this Privacy Policy no longer applies. We encourage you to read the privacy policies of any third-party sites you visit.

17.3 Stripe's privacy practices are governed by Stripe's privacy policy (www.stripe.com/au/privacy). By using the Platform's payment function, you acknowledge and accept that your payment data will be processed by Stripe in accordance with Stripe's policy.

18.1 ACOFEL maintains an internal data breach response plan. In the event of a suspected data breach, we will:

• contain the breach and assess its likely impact as a matter of urgency;
• where the breach constitutes an "eligible data breach" under Part IIIC of the Privacy Act (i.e., where there is a likely risk of serious harm to any affected individual), notify the OAIC and the affected individuals as soon as practicable and in any event within 30 days of becoming aware of the breach; and
• take reasonable steps to remediate the breach and prevent its recurrence.

18.2 Notifications to individuals affected by an eligible data breach will include a description of the breach, the types of information involved, and recommended steps the individual can take to protect themselves.

19.1 Instructors who accept Bookings through the Platform will receive certain personal information about Learners, including names, phone numbers, and pickup addresses. Instructors agree to:

• use Learner personal information solely for the purpose of delivering the booked Lesson;
• not retain Learner personal information beyond the period necessary for the purpose for which it was provided;
• not use Learner personal information for any marketing, solicitation, or off-platform contact; and
• implement reasonable security measures to protect any Learner personal information accessed through the Platform.

19.2 Instructors who handle personal information of individuals in the course of their driving instruction business may themselves be subject to the Privacy Act and the APPs, depending on the size and nature of their operations. ACOFEL is not responsible for an Instructor's compliance with their own privacy obligations.

20.1 ACOFEL may de-identify personal information and use the resulting de-identified and aggregate data for research, analytics, product development, and marketing purposes. De-identified data does not identify any individual and is not personal information for the purposes of the Privacy Act.

20.2 We may share de-identified and aggregate data with third parties, including research partners, investors, and industry analysts, without restriction.

21.1 We respect your preferences regarding marketing communications. You may update your communication preferences at any time through your account settings or by contacting us at [email protected].

21.2 Even where you have opted out of marketing communications, we may continue to contact you with transactional, safety, and operational information in connection with your Bookings and account.

21.3 We will not share your personal information with third-party marketers for their own marketing purposes without your express consent.

22.1 We may update this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or Platform features. Where an update is material, we will notify you by email or in-platform notification prior to the change taking effect.

22.2 We will update the "Last Updated" date at the top of this Privacy Policy each time it is revised. We encourage you to review this Privacy Policy periodically.

22.3 Your continued use of the Platform following notification of an update constitutes your acceptance of the revised Privacy Policy. If you do not accept a change, you must cease using the Platform and close your account.

23.1 If you believe that ACOFEL has breached the Privacy Act, the APPs, or this Privacy Policy in connection with the handling of your personal information, you may make a complaint by contacting our Privacy Officer at [email protected].

23.2 We will acknowledge your complaint within five (5) business days and will investigate and respond substantively within 30 days. If we require additional time to investigate a complex complaint, we will notify you.

23.3 If you are not satisfied with our response to your complaint, you may refer the matter to the Office of the Australian Information Commissioner (OAIC):

• Website: www.oaic.gov.au
• Phone: 1300 363 992
• Mail: GPO Box 5218, Sydney NSW 2001

23.4 EU and UK residents may also escalate to their relevant national data protection supervisory authority.

24.1 This Privacy Policy is governed by and construed in accordance with the laws of New South Wales, Australia.

24.2 Our privacy practices are designed to comply with the following primary legislative instruments:

• Privacy Act 1988 (Cth), as amended by the Privacy and Other Legislation Amendment Act 2024;
• Australian Privacy Principles (Schedule 1, Privacy Act 1988);
• Notifiable Data Breaches scheme (Part IIIC, Privacy Act 1988);
• Spam Act 2003 (Cth);
• Telecommunications Act 1997 (Cth) (where applicable);
• General Data Protection Regulation (EU) 2016/679 (GDPR) — for EU user data;
• UK General Data Protection Regulation — for UK user data; and
• California Consumer Privacy Act 2018 (as amended by the CPRA 2020) — for California user data.

24.3 ACOFEL will update its privacy practices as further tranches of Australian privacy law reform are enacted, including any future requirements arising from the Children's Online Privacy Code and any additional amendments to the Privacy Act.

25.1 All requests for access to, correction of, or deletion of personal information, as well as any complaints, privacy inquiries, or requests to exercise any right described in this Privacy Policy, should be directed to:

Privacy Officer, ACOFEL PTY LTD

Email: [email protected]

Postal Address: U 163 18-20 EDINBURGH ST OAKLEIGH VIC 3166, Australia

Business Hours: Monday to Friday, 9:00 AM to 5:00 PM AEST (excluding public holidays)

25.2 We may require you to verify your identity before processing any access, correction, or deletion request, to protect the security of personal information held on the Platform.

25.3 We will not charge a fee for making an access or correction request, but may charge a reasonable administrative fee for the provision of access to large volumes of records, where permitted by the Privacy Act.