The Mirvac Group complies with the Australian Privacy Principles contained in the Privacy Act 1988 and the Privacy Amendment (Enhancing Privacy Protection) Act 2012 to protect the personal information Mirvac Group holds about individuals.

Mirvac’s policy is to only collect personal information which is reasonably necessary for its dealings with the relevant individual. Mirvac only uses personal information for the purpose specified or which is reasonably apparent at the time the information was collected, or for a related purpose for which the individual would reasonably expect it to be used. Mirvac takes reasonable steps to protect personal information that it holds from unauthorised access, modification, misuse, interference and loss. Mirvac may sometimes disclose personal information overseas to allow external parties to perform their services for Mirvac but Mirvac will only do so in accordance with the Australian Privacy Principles.

The Mirvac Group Privacy Policy contains information about how you may request access to and correction of personal information Mirvac holds about you, or to make a complaint about an alleged breach of the Australian Privacy Principles.

Mirvac’s Privacy Policy
Updated October 2018

1 INTRODUCTION
The Mirvac Group, comprising Mirvac Limited (ABN 92 003 280 699) and Mirvac Property Trust (ARSN 086 780 645) which are stapled and trade together on the Australian Securities Exchange and their respective controlled entities (collectively known as Mirvac), recognises the importance of privacy and is committed to protecting individuals’ personal information.

Mirvac is subject to the Australian Privacy Principles contained in the Privacy Act 1988 (Cth).

This Policy describes how Mirvac complies with its privacy obligations in protecting the personal information Mirvac holds about individuals.

2 OVERVIEW OF MIRVAC’S FUNCTIONS AND ACTIVITIES
Mirvac is an Australian real estate group, with an integrated development and asset management capability. Its operations are principally located in Australia’s four key cities of Sydney, Melbourne, Brisbane and Perth. Its key activities include:

• asset management: Mirvac owns and manages assets across the office, retail and industrial sectors;
• development: Mirvac also develops commercial and residential assets.

For more information regarding Mirvac, please visit our website: www.mirvac.com.

3 COLLECTION OF PERSONAL INFORMATION
Personal information is defined as information or an opinion that can identify or can reasonably identify an individual. This may include an individual’s name, address, email address and telephone numbers. The type of personal information that Mirvac collects will depend upon what dealings the relevant individual may have with Mirvac.

Mirvac may collect and hold personal information about individuals who:
• purchase, or express an interest to purchase, a Mirvac home or apartment (for example, when entering into a sale and purchase agreement, or when responding to requests for information about a Mirvac home or apartment)
• register or subscribe for electronic newsletters (either in person at one of our shopping centres or online) customer loyalty programs, competitions or promotions run by Mirvac;
• hire mobility equipment in a Mirvac managed shopping centre;
• enter a Mirvac managed shopping centre, building or car park (for example, our camera surveillance systems (commonly referred to as CCTV) may collect footage or still images of individuals and vehicles as well as licence plate details for security purposes or at some Mirvac managed buildings, visitors are required to register before entry for building safety purposes);
• park in a Mirvac managed car park that has a ticketless parking system (Mirvac may collect licence plate details and in certain circumstances, name, email address and telephone number to measure parking duration and to provide data to improve the management of the car park);
• use mobile applications developed by Mirvac or logon to wireless facilities provided in a Mirvac managed building or shopping centre;
lease, or express an interest to lease, premises, or spaces (including retail pop up spaces), including any related guarantors (for example, when negotiating, entering into or applying to enter into a lease with Mirvac).
• seek employment with Mirvac or are Mirvac employees (for example, when conducting background checks for the purposes of employment);
• supply goods and services (for example, when establishing records and systems to enable payment for goods). are security holders in Mirvac Group securities or who invest in Mirvac investment vehicles (for example, when establishing accounts and carrying out due diligence). In the case of Mirvac Group Securities, Mirvac may collect personal information of its security holders from its external registry service provider, Link Market Services Limited;
• use Mirvac’s websites, social media and other online services;
• may otherwise come into contact with Mirvac; or
• are provided loans or other financial accommodation by Mirvac.

Mirvac only collects personal information which is reasonably necessary for its dealings with the relevant individual. The types of personal information may include, but are not limited to: information that identifies the individual (for example, name, gender, address, contact details, date of birth, photographic or video images);

• information needed verify an individual’s identity such as driver licence number;
• information about the individual’s financial position and credit-worthiness;
• an individual’s employment history, and other information an individual provides as part of the recruitment process;
• information including an individual’s image collected via our CCTV systems;
• information about the individual that is required or authorised by law;
• the individual’s tax file number;
• the individual’s opinion/preferences about Mirvac’s products, services or staff.

The Privacy Act imposes restrictions on collecting sensitive personal information such as information about religious views, ethnicity, political opinions and personal health.

Mirvac generally does not collect sensitive personal information about an individual. However, in certain circumstances, Mirvac may collect some sensitive information if it is necessary to allow Mirvac to deal with the individual and provided the individual has given consent for Mirvac to do so.

Whenever it is reasonable and practical to do so, Mirvac collects personal information directly from the individual. However, in some circumstances, personal information may be provided to Mirvac by other parties such as the individual’s agent, employees or Mirvac’s authorised agents, service providers and subcontractors. Mirvac will take reasonable steps to inform the individual that it has the individual’s personal information, unless it is obvious from the circumstances.

4 NOTIFICATION OF COLLECTION OF PERSONAL INFORMATION
When Mirvac collects personal information, Mirvac will generally provide notification of the collection to the individual to inform the individual about the purpose for the collection, the types of entities that the information is disclosed to, the overseas recipients the information is disclosed to (where applicable), and that the Mirvac Group Privacy Policy contains information about how the individual may access the personal information held by Mirvac and how the individual may make a complaint.

5 USE AND DISCLOSURE OF PERSONAL INFORMATION
Mirvac operates a number of businesses which handle personal information. Mirvac’s policy is only to use personal information for the purpose which was either specified or reasonably apparent at the time when the information was collected. Mirvac may also use or disclose the information collected for any other related purpose for which the individual would reasonably expect it to be used.

If Mirvac wishes to use or disclose the personal information in other circumstances, it needs to obtain the individual’s consent to do so.

In general, Mirvac uses personal information for the following purposes:

• providing products or services that have been requested;
• communicating with the individual;
• assessing the suitability of prospective tenants;
• helping Mirvac manage and enhance its products and services, including analysing customer feedback and future customer needs;
• providing ongoing information and marketing about products and services to individuals that Mirvac believes may be interested and where the individual has signed up;
• managing security and safety requirements in Mirvac managed buildings and sites;
• complying with regulatory and legal obligations;
• recruiting employees and contractors; or
• fulfilling its obligations to employees.

6 MARKETING
Mirvac may send marketing materials to its customers or potential customers where Mirvac has collected the personal information from the individual and the individual would reasonably expect Mirvac to use the information for that purpose.

The individual’s prior consent will be obtained before personal information is used for marketing purposes in situations where the personal information has been collected from the individual and the individual would not reasonably expect Mirvac to use the information for that purpose, the personal information has not been collected directly from the individual or where sensitive information is involved.

If the customer no longer wishes Mirvac to use his or her personal information in order for Mirvac to provide marketing materials, the customer is to advise Mirvac via the relevant method provided for in the electronic marketing message sent to the customer (e.g. via an ‘unsubscribe’ link) or to write to the Mirvac Privacy Officer (refer to contact details below). Mirvac will act and amend its records promptly.

7 DISCLOSING PERSONAL INFORMATION TO OTHER PARTIES
Mirvac may disclose personal information to other entities within the Mirvac Group.

External parties may be given access to personal information held by Mirvac in certain circumstances. These include, but are not limited to:

Mirvac’s contractors, consultants, advisers and service providers who assist Mirvac in the operation of its business or to provide a customer service (for example, a company which helps maintain Mirvac’s computer systems or sends out Mirvac’s mail);
• joint venture partners for the purposes of seeking relevant regulatory approvals;
• third party lenders and insurers;
• the Australian Securities Exchange, the Australian Securities and Investments Commission and to other regulatory authorities or government agencies as agreed to or required by law;
• anyone authorised by a provider of personal information;
• relevant parties in situations when Mirvac is required by law to provide the information.

Mirvac limits the information disclosed to external parties to what is required for them to perform their services for Mirvac or the relevant individual, or what is required by law.

Mirvac generally requires these parties to agree to Mirvac Group Privacy Policy and to strict conditions governing how this information may be used and stored.

From time to time, Mirvac may disclose personal information to external parties located outside Australia to allow the external parties to perform their services for Mirvac.

These currently include organisations located in the countries listed in the Appendix. Mirvac will only disclose personal information overseas when it is necessary for the services provided by these external parties and when it is in accordance with the Australian Privacy Principles. This includes taking reasonable steps to ensure that the external party has appropriate data handling arrangements in place.

Mirvac does not sell personal information to entities outside the Mirvac Group.

8 APPLYING FOR EMPLOYMENT WITH MIRVAC
Mirvac collects personal information from individuals who submit applications or register interest for employment with Mirvac. If the application is unsuccessful, Mirvac may retain the information in case a more appropriate opportunity becomes available. The unsuccessful applicant will be advised that they can contact Mirvac to request Mirvac not to retain the applicant’s information.

9 SECURITY OF PERSONAL INFORMATION
Mirvac will take reasonable steps to protect personal information that it holds from unauthorised access, modification, misuse, interference and loss. Mirvac maintains physical security measures over its physical premises, and a range of computer and network security measures (such as systems access, firewalls, data encryption) over its electronic systems. Mirvac employees are required to maintain the confidentiality of any personal information held.

If other parties provide support services, Mirvac generally requires them to agree to appropriately protect the privacy of the information provided to them.

10 ACCESS TO PERSONAL INFORMATION
Any individual can request access to the personal information Mirvac may hold about them. To obtain access to the information, the individual needs to write to the Mirvac Privacy Officer (refer to contact details below). Mirvac will require evidence to verify the identity of the individual.

This service is free of charge unless the personal information requested requires preparation time. In this situation, Mirvac will provide an estimate of how much this service will cost and request agreement before proceeding.

In normal circumstances, Mirvac will provide the individual with access to the individual’s personal information. However, in some circumstances, there may be legal, regulatory or administrative reasons to deny the requested access. If access is denied, Mirvac will provide the individual with the reasons for doing so.

11 CHANGING PERSONAL INFORMATION
If an individual wishes to change personal information that the individual believes may be inaccurate, out-of-date, incomplete, irrelevant or misleading, the individual may write to the Mirvac Privacy Officer requesting the information to be changed.

If Mirvac disagrees with the individual that the personal information should be changed, Mirvac will provide the individual with the reasons for doing so. The individual has the right to request that a notation be included with their personal information to indicate their disagreement with their personal information held by Mirvac.

12 COLLECTION OF OTHER INFORMATION
Mirvac may also collect the following information from you:

A cookie is a small data file that may be placed on the computer of a web user (usually in the browser software folder) during a visit to a Mirvac website. Cookies are necessary to allow the Mirvac website and the user’s computer to interact effectively and enhance security. Cookies can record information about the user’s visit to assist Mirvac in better understanding the needs of the user. For example, user traffic data may be collected and used to infer the website user’s demographic using various web analytic technologies. Mirvac sometimes also use performance tracking technology (such as conversion tags) to help Mirvac to track user behaviour on its websites. General such user traffic and performance tracking data is non-personally identifiable and is collected on an aggregate level to report statistics to assist Mirvac to improve the quality and relevancy of its services. However, if the user has completed the online registration form on Mirvac’s websites, such cookie data may be linked to the personal information Mirvac holds about the user. In these circumstances, this cookie data will be treated the same manner as the personal information which it has been linked.

Mirvac may also use cookies from third party ad servers for the purpose of targeting our online advertisements on other sites. The cookies provided by the third party ad servers will collect information such as the device the user used to access the Mirvac website (such as the type of device, the browser type or the operating system), the user’s browsing behaviour (such as what the user searched for, the pages the user viewed, the date and time of the visit and how long the user stayed) and the performance of our marketing campaigns (such as which ads or online content the user viewed or accessed). The information collected through this technology is not personally identifiable but such information will be shared with the third party ad servers for the purposes of showing the user more relevant advertising on Mirvac’s websites or partner sites.

If users of a Mirvac Group website do not wish to receive any cookies, they should set their browser to refuse cookies but this means that they may not be able to use certain parts of the Mirvac website. If the user does not want third party ad servers to use cookies for targeted advertising purposes, the user can use an opt out mechanism provided by various advertising industry bodies such as Network Advertising Initiative opt-out (http://www.networkadvertising.org/choices/DAA).

Where electronic devices such as mobile phones and tablets are enabled to allow connectivity to and are detected by Wi-Fi networks (or similar) in Mirvac managed buildings or shopping centres, Mirvac may automatically collect data relating to the device identification code and its location. Mirvac may use the anonymised data to create aggregate information to, among other things, analyse shopping behaviour to improve its shopping centres, but the aggregate information will not identify the customers. If a customer does not wish to have their device identification code detected, they should disable the Wi-Fi network (or similar) connectivity of their device.

When customers register to use Wi-Fi services provided by Mirvac, Mirvac collects their personal information in relation to their use of the Wi-Fi services, and for any other purposes they have consented to.

Mirvac’s websites use, among other technologies, Google’s suite of analytics programs to track website traffic. Where users have chosen to enable Google to associate their web and app browsing history with their Google account, and to use information from their Google account to personalise ads, Google will use data from its signed-in users together with Mirvac’s Google Analytics data to build audience lists for cross-device remarketing. For users of Mirvac’s websites, Google Analytics will collect Google-authenticated identifiers associated with the user’s Google Accounts (and therefore, personal information). Google Analytics will also temporarily join these identifiers to Mirvac’s Google Analytics data. If a customer does not wish to have their Google-authenticated identifies joined with Mirvac’s Google Analytics data, they should opt out of the ‘personalised ads’ option via their Google account.

13 CHANGES IN THE FUTURE
Mirvac reserves the right to change this Policy at any time. Mirvac will notify any changes to this Policy by posting an updated version of the Policy on the Mirvac website at http://www.mirvac.com.

14 COMPLAINTS
An individual can make a complaint about the way in which Mirvac has handled an individual’s personal information by writing to the Mirvac Privacy Officer. Mirvac will endeavour to act promptly in response to a complaint.

You may also contact the Office of the Australian Information Commissioner as follows:

Phone: 1300 363 992
Web: www.oaic.gov.au
Address: GPO Box 5218 Sydney, NSW 2001

15 CONTACTING MIRVAC
The Mirvac Privacy Officer can be contacted as follows:

Phone: (02) 9080 8000
Email: privacy@mirvac.com
Address: ‘Mirvac Privacy Officer’
Mirvac Group Compliance
Level 28, 200 George Street
Sydney, NSW 2000

16 ADDITIONAL INFORMATION ON PRIVACY
For further information about privacy issues and the protection of privacy, visit the Office of the Australian Information Commissioner’s website at http://www.oaic.gov.au.

17 APPROVED AND ADOPTED
This policy was approved and adopted by the Mirvac Group on 12 June 2018.

APPENDIX – DISCLOSURE TO OTHER COUNTRIES
Updated 1 May 2018

Personal information may be disclosed to third parties performing services for Mirvac located in the following jurisdictions:

United States;
Japan;
the Philippines; and
United Kingdom.