1.0 Overview

flypay is a digital wallet provided by Coles Group Limited ABN 11 004 089 936 of 800 Toorak Road, Hawthorn East, Victoria 3123 (Coles) in collaboration with Loyalty Pacific Pty Ltd ABN 82 057 931 334 of Level 14, Brookfield Place Tower 2, 123 St Georges Terrace, Perth, Western Australia, 6000 (Flybuys) (together, Us, Our or We).

You/Your means you individually and any person acting as your agent, under your authority, or with Your permission.

At flypay we respect the privacy Personal Information in our care. This commitment is set out here in our Privacy Policy, which describes how we deal with Personal Information. Personal Information means information which identifies you as an individual or from which you can be reasonably identified.

This Privacy Policy relates to Personal Information we collect and handle about flypay users and visitors to our website, apps, social media and other digital services.

The flypay service is a payment service provided by us in collaboration with Flybuys, Coles Group (Coles) and Wesfarmers Limited (Wesfarmers). flypay is not responsible for the privacy practices or policies of Flybuys, Coles, and Wesfarmers, and we recommend that you visit their websites for more information about their privacy practices and policies.

If you do not agree to the terms of this Privacy Policy you may terminate your use of the flypay service at any time.

We reserve the right to change the Privacy Policy at any time, so please check back regularly to keep informed of updates to this Policy.

2.0 Types of Personal Information collected

The types of Personal Information we collect include:

• Name;

• Contact details (e.g. phone number, email address and delivery address);

• Payment and transaction details;

• Flybuys membership number;

• Authorisations;

• Records of your communications and interactions with us and the Flybuys service; and

• Details and history of preferences, interests and behaviour relating to transactions,

• products, services, and activity with our digital services.

We may not be able to provide our services without your Personal Information. For example, we may not be able to finalise payment, arrange for Flybuys to issue points to you, manage your account, or contact you.

Where you provide us with Personal Information about someone else, you must have their consent to provide their Personal Information to us based on this Privacy Policy.

3.0 How Personal Information is collected and held

We may collect your Personal Information, and that of additional members, from your interactions and transactions with us, Flybuys, Coles, and Wesfarmers group companies. This includes:

• Placing an order online;

• Using your Flybuys card or number or associated identifiers such as payment cards;

• Registering for services; and

• Using related digital services.

We may monitor and record your communications with us (including email and telephone) for security, dispute resolution, and training purposes. We may also collect Personal Information from third parties including:

• Public sources;

• Information service providers (e.g. for data integrity purposes);

• Providers who administer products and services such as for Flybuys affiliated payment cards and insurance

• Anyone authorised to act on your behalf; and

• Flybuys, Coles and Wesfarmers group companies.

We hold Personal Information electronically and in hard copy form, both at our own facilities and with the assistance of our service providers. We implement a range of measures to protect the security of that Personal Information. Examples of these measures include:

• Access to Personal Information is controlled through identity and access management systems;

• Team Members are bound by internal information security policies and are required to keep Personal Information secure at all times;

• We take steps to protect Personal Information in accordance with the Office of the Australian Information Commissioner’s Guide to securing personal information; and

• We also take measures in respect of destroying or de-identifying Personal Information that is no longer needed for any lawful purpose.

4.0 Purposes for handling Personal Information

We handle your Personal Information in connection with providing, administering, improving and personalising the flypay service, and those products and services provided by Flybuys, Coles, and Wesfarmers group companies. This can include:

• To register and service your flypay account, including keeping your information up-to-date, and verifying your identity;

• To communicate with you about our products, services and promotions (including direct marketing);

• To help us improve our products and services, including conducting product and marketresearch;

• To improve our operational processes to enhance your customer experience;

• To respond to your feedback, queries or concerns;

• Working with our service providers;

• Investigative, fraud and loss prevention activities;

• Interacting with Regulators and relevant government entities;

• Any of our related companies and brands including the Coles and Wesfarmers group companies; and

• As otherwise required or permitted by law.

Using Personal Information, we endeavour to improve our understanding of your interests, suitability, and behaviour in relation to products, services, and offers.

We may also handle your Personal Information to protect our lawful interests and facilitate purchases and potential purchases of our businesses.

We may provide marketing communications and targeted advertising to you on an ongoing basis by telephone, electronic messages (e.g. email), through our digital services, and by other means. These communications may relate to the products and services we, Flybuys, Coles, and Wesfarmers group companies provide, and other products which may be of interest to you. You can call us on 1300 FLY PAY (1300 359 729) or login to your flypay account at www.flypay.com.auThis link opens in a new tab or window at any time to opt out of electronic and telephone direct marketing communications. We need to be able to contact you by phone to manage your account. If you do not want us to contact you by phone, you may terminate your flypay account.

Where you provide us with Personal Information about someone else, you must have their consent to provide their Personal Information to us based on this Privacy Policy.

5.0 Sharing of Personal Information

To make it easy for you to deal with Flybuys, Coles, and Wesfarmers group companies, we may exchange and combine Personal Information with them for the purposes described in our respective privacy policies. You can find their privacy policies of their respective company websites.

When you place an order at a Coles or Wesfarmers brand site, and elect to pay through flypay, the following Personal Information relating to that order will be shared by flypay to that specific Coles or Wesfarmers brand company for the purpose of processing your order:

• Name;

• Email Address;

• Delivery Address; and

• Phone Number.

flypay may exchange your Personal Information with service providers engaged to assist with services including working with a number of suppliers that carry out specific functions on our behalf, and include companies that assist us with:

• Technology services including application, development and technical support, processing, storing, hosting,and analysing data;

• Processing payments;

• Product development and market research;

• Business advisory services, such as our lawyers, accountants or other professional service providers to extent reasonably required; and

• Administrative services, including archival and contact management services.

The third parties to whom we disclose Personal Information may be located in Australia and other countries including Germany, India, Poland, the United States of America and United Kingdom.

6.0 Digital Services

We provide information and services through a range of digital and online services ('Digital Services'), including:

• Websites (e.g. www.flypay.com.auThis link opens in a new tab or window);

• Apps; and

• Email.

These services may be operated by us as flypay to provide a consistent experience, personalise your use of each of those services and provide targeted marketing.

We and our suppliers (such as Facebook, Google, Oracle and Adobe) use various technologies, such as cookies, beacons, tags and pixels, to personalise and improve your customer experience as you use our Digital Services. Cookies and similar technologies may also help us to detect fraudulent activity or to prevent security breaches and so we may collect information about your device from within the cookie.

These technologies may be used to do the following:

• Improve the way our websites and mobile apps work – these technologies allow us to improve the way our websites and mobile apps work so that we can personalise your experience and allow you to use many of their useful features. For example, we use cookies so we can remember your preferences and the contents of your shopping basket when you return to our websites and mobile apps.

• Improve the performance of our websites and mobile apps – these technologies can help us to understand how our websites and mobile apps are being used, for example, by telling us if you get error messages as you browse.

• Deliver relevant online advertising, including via social media - these technologies to help us deliver online advertising that we believe is most relevant to you on our websites, other organisations’ websites, and on social media. These technologies may collect information about your online behaviour, such as your IP address, the website you arrived from and information about your purchase history or the content of your shopping basket. This means that you may see our adverts on our websites and on other organisations’ websites. You may also see adverts for other organisations on our websites. To help us deliver online advertising that is relevant to you, we may also combine data we collect through cookies and similar technologies on your devices with other data that we have collected, for example your use of loyalty cards and in-store purchases.

• Measuring the effectiveness of our marketing communications, including online advertising - marketing communications and online advertising may be in the form of email, SMS, push notification through our app, web notifications through our website, display banners on external websites, and social media platforms. Cookies and similar technologies can tell us, for example, if you have seen a specific advert, and how long it has been since you have seen it. This information allows us to measure the effectiveness of our online advertising campaigns and control the number of times you are shown an advert. We also use cookies and similar technologies to measure the effectiveness of our marketing communications, for example by telling us if you have opened a marketing email that we have sent.

You can configure your browser or device to reject and delete cookies, block JavaScript, disable GPS location services and anonymise your usage patterns. If you choose to do so, this may limit the functionality of some parts of Coles Digital Services for you. For example, you may not be able to add items to your shopping basket, proceed to checkout, or use our products and services that require you to sign in.

You can opt out of receiving promotional email and SMS communications at any time by either:

• Clicking unsubscribe within the Coles email;

• Calling our flypay Coles contact centre on 1300 FLY PAY (1300 359 729); or,

• Texting “STOP” to opt out of SMS.

There are, however, some service and transactional messages that we must be able to send you. These include, for example, messages relating to your account, forgotten passwords, transactional receipts, updates to our T&Cs and Privacy Policy, and product recall notices.

7.0 Procedures for access and correction of your Personal Information

If you wish to access or correct any Personal Information we hold about you, please contact us as set out below.

When making an access request, please provide as much detail as you can about the particular information you seek in order to help us retrieve it. Under the Privacy Act and other relevant laws, we are required to provide a written response outlining our reasons if we refuse your request.

Where we decide not to make a requested correction and you disagree, you may ask us to add a note of your requested correction to the information that explains your correction request.

8.0 Questions and complaints

If you have any complaints or concerns about this Policy, or our handling of your Personal Information, you can contact us as set out below.

Once a complaint or concern has been lodged, we will let you know who will be handling your matter and when you can expect a full response within 30 days. If you are not satisfied with our response, please let us know and we will investigate further and respond to you.

Complaints should be directed to us in the first instance. If you are still not satisfied, you can contact the Office of the Australian Information Commissioner, whose contact details are set out below.

Contact Details

Queries regarding how Coles handles your personal information can be directed to the Coles Customer Care:

The flypay Privacy Policy can be found on www.flypay.com.auThis link opens in a new tab or window or by calling our flypay Service Centre on 1300 FLY PAY (1300 359 729) Monday to Friday between 9.00am and 5.00pm AEST (excluding public holidays).

For information about privacy generally, you may contact the Office of the Australian Information Commissioner on the contact details noted below: