Untitled Group (ACN 50 429 003 692) “us”, “we” or “our”) and/or our subsidiaries or affiliates use, collect,store and disclose information supplied to us in connection with our products or services, whether that bethrough attending our events, interacting with our website located at https://www.untitledgroup.com.au/and associated online platforms (the “Sites”), or by contacting us in person, by phone, or over email (wewill refer to the foregoing collectively as the “Services”).

This Privacy Policy details how we comply with the Privacy Act 1988 (Cth) (“Privacy Act”) and theAustralian Privacy Principles (“APPs”) set out in Schedule 1 of the Privacy Act, and to the extent that itapplies, the EU General Data Protection Regulation 2016/679 (GDPR).

We may update this Privacy Policy from time to time at our sole discretion. Any variations becomeeffective on posting the updated privacy policy to https://www.untitledgroup.com.au/ and we shall have noobligation to provide you with individual notice of such changes. Your continued use of our products andservices following the publication of any amended Privacy Policy shall signify your acceptance of thatamended Privacy Policy, except where we are otherwise required by law to seek your direct consent.

PLEASE READ THIS PRIVACY POLICY CAREFULLY. IF YOU DO NOT AGREE WITH ANY PART OFTHIS PRIVACY POLICY, PLEASE DO NOT BROWSE, ACCESS OR USE OUR SITES; MAKE APURCHASE; ATTEND OR PURCHASE A TICKET TO OUR FESTIVALS OR EVENTS; OR OTHERWISEENGAGE WITH OUR PRODUCTS AND SERVICES.

Types of information we collect

“Personal Information” means information that can be used to personally identify you, such as yourname, age or date of birth, telephone number, address, email address, photographs or videos where youare personally identifiable, and in some circumstances financial information such as your credit card,direct debit or Paypal account information. If the information we collect personally identifies you or you arereasonably identifiable from it, the information will be considered Personal Information.

“Sensitive Information” is a special type of Personal Information that relates to health information,political beliefs, ethnicity, membership of a professional or trade association, gender, sexual preferences,philosophical beliefs, or criminal record. We will not collect Sensitive Information except with your expressconsent, and then only if collection of such information is necessary for a particular activity or function.

‘Usage Information’ means anonymous aggregate data that is automatically collected through your useof the Sites. This includes information that identifies your device, your operating system, your IP addressand dates and times that you access and use the Sites.

We recognise that Usage Information, whilst for the most part anonymous, can be cumulatively used todirectly or indirectly identify you. Usage Information that can be used to identify you in any way, togetherwith your Personal Information, shall collectively be referred to in this Privacy Policy as “Personal Data”.

Why we collect your Personal Data

The primary purposes for which we collect information about you is to enable us to:

• perform our business activities and functions;
• provide the Services to you; and
• ensure the health and safety of our workers and attendees (including you).
  

Other legitimate purposes that you agree we can collect, hold, use and disclose your Personal Data for include but are not limited to the following:

• to provide you with access to the Sites;
• to approve transactions you wish to make; to send you invoices and receipts;
• to respond to requests submitted by you; to enhance our products and services;
• to verify your identity;
• for our administrative, planning, product/service development, quality control, safety, and research purposes, or those of our contractors or external service providers;
• to provide you with information about any festivals or events for which you have registered as an attendee whether by purchasing a ticket, registering for access, being registered as the holder of a ticket or minor pass, by having a ticket transferred to you or by any other means by which you may be registered as an attendee;
• to contact you with information which we think you may find interesting, only where you have opted in to receiving such communication and until you withdraw such consents;
• to run competitions, promotions, and giveaways;
• to comply with legal and regulatory requirements;
• to update and provide information to any third parties (including but not limited to Emergency Services Staff and insurers) as required by their policies and applicable regulations in connection with our events for health, safety and risk management purposes;
• to prevent, detect and investigate potential illegal activities, security breaches and fraud; and/or as otherwise required or permitted under any applicable law.

For the avoidance of doubt, we will only use your Personal Data for purposes that you would reasonsbly expect us to use your Personal Data for in connection with operating and providing the Services to you, or where we are required by law to collect your Personal Data. We will not sell, rent, or license your email address or any of your Personal Data unless we have otherwise obtained your express consent to do so.

We recognise your right under the Spam Act 2003 (Cth) and the GDPR to opt out from direct marketing, and as such these consents can be modified at any time by emailing us at hello@untitledgroup.com.au, or by clicking ‘unsubscribe’ on any direct marketing communications.

Please note certain non-marketing related correspondence from us, including messages relating to payment and confirmation, will be automatically sent to you by virtue of your use of the Services and you may not have the option to unsubscribe from receiving this correspondence.

How we collect your Personal Data

We collect your Personal Data directly from you, unless it is unreasonable or impractical to do so. We do this in a number of ways, including:

• when you contact us by email, telephone or in writing;
• when you fill out a form on our Sites when completing an application or order;
•  when you enter a competition or giveaway;
• when you subscribe to our mailing lists or other direct marketing communications;
• when you purchase a ticket, register for event access, transfer ticket registration, are registered as the recipient of a transferred ticket or are registered as the holder of a minor pass or registered as the child of a parent or legal guardian attending an event in respect of our festivals or events via one of our third-party ticket merchants or ticket resale merchants;
• recording or photographing you at our festivals or events.
  It is your choice to provide information to us. Wherever it is lawful and practicable, you have the option not to identify yourself when interacting with us. Please be aware that it is necessary for us to collect your Personal Data to enable us to provide the Services to you. As such, if you do not wish to provide your Personal Data, we may not be able to provide the Services to you.
  

Circumstances where we collect Personal Data about you from sources other than you directly include where:

• you have consented for a third party to share information with us;
• where we are authorised by law to collect the information from a third party;
• where it is unreasonable or impracticable to collect the information from you personally (for example, if you are an emergency contact for an attendee).

If we collect your Personal Data from third parties in circumstances where you may not be aware that we have collected such Personal Data, we will take reasonable steps to notify you of the collection and circumstances surrounding the collection.

We may also collect Personal Data from third parties including our contractors and business partners, medical and emergency services providers (“Emergency Services Staff”), advertisers, mailing lists, recruitment agencies and government entities.

You expressly consent that we may collect your Sensitive Information from you, Emergency Services Staff or any necessary party in the event of:

• a permitted health situation (as defined by section 16B of the Privacy Act) (“Permitted Health Situation");
• an emergency, including but not limited to health emergency, injury, death or safety incident (e.g. if you injure yourself or lose consciousness) (“Emergency Incident"); or
• voluntary notification to us via email, telephone, in writing, or in person (e.g. if you notify us stating of accessibility requirements)

COOKIES‍

We may collect Usage Data through cookies, pixel tags and other tracking technologies (collectively Cookies). Cookies are small packets of data that are downloaded onto your device when you access a website. Cookies hold specific information that help a website ‘remember’ your actions and preferences over time. These are the types of Cookies that we may use to operate the Sites:

• Strictly Necessary Cookies – these Cookies are essential to ensure that the Sites work correctly, and record information that allows you to move around the Sites and navigate their features;
• Performance Cookies – these Cookies collect information about how you use the Sites, such as how often you access the Sites and if you encounter any errors;
• Functionality Cookies – these Cookies allow the Sites to remember the choices you make to provide a more personalised experience;
• Targeting/Advertising Cookies – these Cookies deliver targeted advertising to you based on your interests and use of the Sites.
  Cookies can stay on your device temporarily (“Session Cookies”) or until you manually delete them (“Persistent Cookies”). Data collected by Cookies does not identify you, but it does identify your device. Where such data can be cumulatively used to personally identify you, we will seek your consent to collect and process such information. You can disable Cookies at any time in your browser. If you disable Cookies, we cannot guarantee that the Sites will be available to you in a fully functional form.

Who we disclose your Personal Data to
You agree and consent that we may disclose your Personal Data to:

• our directors, officers, employees, contractors, consultants and agents
• external service providers for the operation of our business, and our professional advisers such
  as accountants and solicitors, insurers and their representatives, marketing agencies, financial
  service providers, payment gateways, e-commerce platforms and technical support;
• our Related Bodies Corporate (as that term is defined in the Corporation Act 2001 (Cth));

• our existing or potential agents, business partners or joint venture entities or partners, including our third-party ticket merchants and ticket resale merchants and the artists whos performances we represent and showcase;
  our sponsors or promoters (as advertised on our Sites from time to time);
• Emergency Services Staff;
• specific third parties authorised by you to receive information held by us;
  the police, any relevant authority or enforcement body, or your Internet Service Provider or network administrator, if we have reason to suspect you have committed a breach of our terms and conditions or have been engaged in unlawful activity, and we reasonably believe disclosure is necessary;
• as required or permitted by any law (including the Privacy Act).

In the event of the Permitted Heath Situation and/or Emergency Incident, you agree and consent that we may disclose your Sensitive Information:

• to Emergency Services Personnel;
• to external service providers for the operation of our business, and our professional advisers such
• as accountants and solicitors and insurers and their representatives; and
  any necessary parties in connection with the Permitted Health Situation and/or Emergency Incident.

We will take reasonable steps to ensure that these third parties are aware of our Privacy Policy and are bound by Australian privacy laws.

You can withdraw your consent for us to share your Personal Data with third parties at any time by emailing hello@untitledgroup.com.au, but please note that withdrawal of such consents may affect your ability to access and use the Services.

What are your rights to your Personal Data

You have a general right to access any Personal Data about you that is held by us, unless a valid exception applies. You can request access to your own Personal Data by emailing us at hello@untitledgroup.com.au.

We cannot modify or alter your Personal Data. You acknowledge that it is your responsibility to maintain the truth, accuracy, and completeness of your information and your failure to do so may inhibit our ability to provide the Services. You agree that you remain solely responsible for maintaining the truth, accuracy, and completeness of your information at all times, and we shall have no liability to you or any third party arising from your failure to do the same. If you believe that the Personal Data we hold about you is incorrect, incomplete or inaccurate, you may request that we amend it by emailing us at hello@untitledgroup.com.au.

In accordance with the GDPR, we acknowledge the right of EU subjects to:

• have their data erased that is no longer being used for a legitimate purpose;
  
• request a copy of all Personal Data held about you by us in a readable format, along with
  supplementary information to verify that such Personal Data is being processed lawfully; and
  
• request restricted processing of your Personal Data whilst any complaints or concerns are being resolved.
  To erase, request or restrict processing of your Personal Data, please email hello@untitledgroup.com.au with the subject ATT: PRIVACY OFFICER.
  

Data Retention‍

We will retain your Personal Data and Sensitive Information for the period necessary to fulfill the purposesoutlined in this Privacy Policy unless a longer retention period is required or permitted by law. How longwe retain your Personal Data and Sensitive Information depends on the type of data and the legitimatepurpose for which we process and/or retain the data.

External Links

Our Sites may contain links or plugins to other third-party websites or applications, including to ourthird-party ticket merchants or ticket resale merchants. Please note that this Privacy Policy does not coverthe privacy practices of any third-party site. We do not have access to, or control over, the technologiesthat third-party sites may use to collect information about you. We disclaim all liability in connection withthe services of any third-party sites integrated or otherwise linked to our Services. If you have anyconcerns about the privacy practices of a third-party site, we encourage you to reach out to them directly.

Security

We protect your Personal Data through technical security measures i.e. firewalls, encryption that limit therisk of loss, disclosure, unauthorised access and modification. No security measures are, however, 100%secure so we cannot guarantee the security of your information or data at any time. To the extentpermitted by law, we accept no liability for any breach of security, or direct hacking of our securitymeasures, or any unintentional disclosure, loss or misuse of any information or data or for the actions ofany third parties that may obtain any information or data.

Overseas Disclosure

We may, in the course of providing any products or services to you, disclose Personal Data to overseascountries that are deemed by the EU Commission as having an ‘adequate’ level of Personal Dataprotection. Where we transfer data to a third party in a country where no adequacy decision has beenmade, we will take reasonable steps to ensure that the person or entity handling your data in thosecountries are bound under contract to meet the requirements of the Privacy Act, APPs and GDPR (asapplicable).

Contact

Thank you for taking the time to read our Privacy Policy. If you have any questions regarding our PrivacyPolicy, you can reach our privacy officer at.

Untitled Group
Att: Privacy Officer
1 Eastbourne StreetWindsor, VIC 3181hello@untitledgroup.com.au

If you believe your privacy has been breached by us, or have any questions or concerns about ourPrivacy Policy, please contact us using the details above. We will treat your requests or complaints

If you are not satisfied with our handling of your Personal Data, or have any other concern over ourprivacy policy, then you may lodge a formal complaint with the Office of the Australian InformationCommissioner (for more information, please see www.oaic.gov.au) or with the European Data ProtectionSupervisor (for more information, please see https://edps.europa.eu).

Notwithstanding the above, we acknowledge our obligation to report any data breach that is likely to riskthe rights and freedoms of natural persons to the Australian Information Commissioner and, where ourdata breach involves the information of EU subjects, report to the European Data Protection Supervisor.We will also inform you, where possible, if your data has been breached in the circumstance where itposes a risk of serious harm to your rights and freedoms.

We also train our personnel who may have access to your Personal Data about this Privacy Policy andour obligations under the Privacy Act, APPs and GDPR. For more information on our internal policies,email us at hello@untitledgroup.com.au