COMMAND AUTO GROUP
Last updated: 1 July 2011

Privacy Is Important To Us
The Command Auto Group Pty Limited (Command Auto Group) respects the privacy of personal information. All our staff are required to read this policy and understand their responsibilities when dealing with personal information.

In this policy:

• sensitive information refers to information about a person's racial or ethnic origin, political opinions or associations, religious beliefs or affiliations, philosophical beliefs, trade and professional memberships, sexual preferences or practices, criminal record or health information;
• personal information refers to any information or an opinion whether true or not, from which an individual's identity is apparent, or can reasonably be ascertained

Our Privacy Principles

Command Auto Group is bound by the National Privacy Principles (NPPs) in the Privacy Act 1988 (the Act). We have adopted internal policies and procedures to ensure that your personal information is dealt with in accordance with the NPPs. You can see the full text of the NPPs online at www.privacy.gov.au.

Collection
We may need to collect personal information about you and others including names, addresses, phone numbers and other contact details, age, sex, hobbies and other personal information about you or others.

We need to collect personal information so we are able to:

• identify our customers and potential customers, and their authorised representatives;
• inform individuals of marketing initiatives we think may be of interest to them;
• provide goods, services or other benefits to be offered to customers;
• conduct our business in a professional and efficient manner; and
• develop and implement initiatives to improve products and services we offer.

If we are not provided with all the personal information we request, we may be unable to do business with you or others.

Where possible we will collect personal information directly from the individual concerned. However, an individual's representatives may hold personal information (eg, financial or bank account details or a credit reference) that we may need to access for particular dealings or other purposes. Where we are at liberty to do so, we will use our best endeavours to seek an individual's consent before obtaining their personal information from third parties.

Personal information may be collected by us when:

• we are contacted about our products and services, in person or over the telephone;
• we negotiate and enter into business transactions;
• we provide products and services; or
• we respond to an inquiry, where we consider personal details are required or appropriate to fulfil the query.

Personal information will usually be recorded or up-dated in our records, each time we have contact with or from the individual concerned.

Any additional purpose for the collection (not included in this policy) will be identified when we collect personal information, or as soon as practicable afterwards.

Sensitive Information

We generally do not need to collect "sensitive information" (as defined in the Act) about individuals. However, where we are at liberty to do so, and it is practicable to do so, we will seek the consent of the individual concerned before collecting their sensitive information and inform them of the purpose at the same time.

Use

We may use personal information:

• to identify individuals and protect them from unauthorised access to their personal information, accounts or services in our control;
• to improve our services to you or others;
• to inform you or others of our marketing initiatives and product offerings;
• to derive or aggregate anonymous information from which individuals cannot be identified;
• to prevent or lessen a threat to a person's life or health;
• where disclosure is reasonably necessary for the establishment, exercise or defence of a legal or equitable claim;
• for the purpose for which it was collected, or for a related purpose (or a directly related purpose in the case of sensitive information) that the individual concerned would reasonably expect from us,
• to provide data in connection with the sale, licence or other dealing or proposed dealing of or with our business or any part; and
• for other purposes permitted, required or authorised by or under law.

Disclosure

Except where indicated above, we will not disclose personal information to a third party unless:

• the disclosure is made as part of giving effect to a primary purpose for which the information was collected;
• the individual concerned has consented to the disclosure;
• the third party is our agent or contractor, in which case we will require them to disclose and to use the personal information only for the purpose for which it was disclosed by us to them;
• there are reasonable grounds to believe that disclosure is necessary to prevent or lessen a threat to your life or health or that of another person;
• the disclosure is to a related body corporate;
• the disclosure is reasonably necessary for the establishment, exercise or defence of a legal or equitable claim; or
• the disclosure is permitted, required or authorised by or under law.

Our web site

To ensure we are meeting the needs and wants of our website users, and to develop our online services, we may collect aggregated information by using cookies.

Cookies are unique numbered identification numbers like tags that are placed on your browser. They do not in themselves identify a user personally, but are linked back to a database record about the browser (and - only where a user is a registered user : the user).

We may use cookies to track use of our web site by individual users, to compile statistics on visits to the site in an aggregated form, and to log anonymous information such as:

• the address of your server;
• your top level domain (such as .com. or .au);
• the date and time of your visit;
• the pages you accessed and downloaded;
• the search engine you used; and
• what type of browser was used

When you visit our site

When you visit our site a cookie may be placed on your machine. Where you have visited us before, the cookie may be read each time you re-visit our site. We do not use this technology to access your personal information and you cannot be personally identified from a cookie, unless you are a registered user authorised to deal with us through any online B2B or B2C portal we may make available from time to time.

If you choose not to have your browser accept cookies from our site, you will still be able to view the text on the screens.

If you are a registered user authorised to deal with us through any online B2B or B2C portal we may make available from time to time, your use of the portal and our site will be linked back to your personal information stored on our database and you will in this way be personally identified.

Marketing

We may use personal information to advise the individual concerned of new services and marketing initiatives that we think may be of interest to them. This may include special product offerings, sale brochures, catalogues and general information about the Command Auto Group.

Those who prefer not to receive information about our products or services can contact our Privacy Officer to be removed from the relevant circulation list. Contact details for our Privacy Officer appear at the end of this policy.

We never disclose personal information to a third party for the purpose of allowing them to direct market their products or service on an individual, unless they have expressly consented to that disclosure.

We may require written confirmation of a request to be removed from our circulation list, for example where legislation requires us to provide particular communications to the individual concerned.

Correction of Records
We ask that you tell us of any changes to the personal information we hold about you. We can be notified at any time to update personal information or to be told that the personal information we hold about you is inaccurate or incomplete.

We will then take reasonable steps to investigate the request and, if considered appropriate, correct the information in the manner requested. If we consider that the personal information we retain does not require amendment, we will annotate the request on our files.

Security
The protection of personal information is a priority for the Command Auto Group.

We are committed to maintaining:

• safeguards to protect personal information against unauthorised use, disclosure, access, alteration, destruction and accidental loss. All personal information we hold is dealt with in accordance with the NPPs;
• industry standards for the security and protection of information. Personal information is stored securely and access is restricted to authorised personnel only. Our computer systems require access passwords, and these are kept secure by our personnel; and
• internal policies on management of personal information, and staff training to ensure compliance with these policies. All our staff are required to read this policy and understand their responsibilities in relation to personal information.

Access to Personal Information
We will generally allow an individual access to any personal information that we hold about them on request - subject to any Restrictions on Access. We will try to give the individual concerned access in a form and manner that suits their needs.

To request access please contact our Privacy Officer. Contact details for our Privacy Officer appear at the end of this policy.

Restrictions on Access
We are entitled to restrict access to personal information in accordance with the NPPs.

You may not be allowed access to personal information we hold where access would reveal evaluative information generated by us in connection with a commercially sensitive decision-making process. Instead, we may give you an explanation for the decision, rather than direct access to the information.

If we have given you such an explanation and you believe that direct access to the evaluative information is necessary to provide a reasonable explanation of the reasons for the decision, we will, at your request, review the decision. Personnel other than the original decision-maker will conduct the review.

Wherever direct access by you is impractical or inappropriate, we should consider together whether the use of a mutually agreed intermediary would allow sufficient access to meet both our needs and concerns.

Other instances where it may not be appropriate to provide you with access to the personal information we hold, include where:

• providing access would pose a serious and imminent threat to the life or health of any individual;
• providing access would have an unreasonable impact upon the privacy of others;
• the request for access is frivolous or vexatious;
• the information relates to an anticipated or existing legal dispute and disclosure would compromise our position or the position of others.

Charges for Access
An individual will incur no charges for lodging a request to access personal information. However, we may levy a reasonable charge for providing the access. We will provide an estimate of any charge on request, or if it appears to us that the work will be onerous or otherwise warrants a charge.

Overseas Transfer
Generally, we do not transfer personal information overseas.

However, where it is necessary, we will transfer personal information outside Australia where:

• we reasonably believe that the recipient of the information is subject to legal obligations that uphold principles for the protection and fair handling of personal information that are substantially similar to the principles contained in this policy;
• we are given consent by the individual concerned to do so, expressly or by implication;
• we are contractually required to do so; or
• the transfer is for the benefit of the individual concerned and it is not practicable for us to obtain their consent and if they were able to grant consent, they would be likely to give it (in this instance we will advise the individual concerned to whom their information has been disclosed as soon as practicable).

Changes to our Policy
We may update or change this policy. When we do so, we will publish the current policy on our web site at www.tcag.com.au.

If you have any suggestions or concerns that are not addressed in this privacy policy, please contact our Privacy Officer. The contact details of the Privacy Officer are listed at the end of this policy.

Complaint Resolution
We are committed to constantly improving our procedures so that personal information is treated appropriately.

If you feel that we have failed to deal with your personal information in accordance with the NPPs or this policy, please speak to us so that we have an opportunity to resolve the issue to your satisfaction.

The person to contact is our Privacy Officer, whose contact details appear at the end of this policy.

Our Privacy Officer will manage the following process for us to:

• listen to your concerns and grievances regarding our handling of personal information;
• discuss with you the ways in which we can remedy the situation; and
• put in place an action plan to resolve your complaint and improve our information handling procedures if appropriate.

If this process does not result in an outcome that is satisfactory to you, you may contact the Privacy Commissioner's Office. We will work together with the Privacy Commissioner's Office to resolve the issues between us.

The contact details for the Privacy Commissioner's Office are as follows:

Street address: Level 8, Piccadilly Tower, 133 Castlereagh Street Sydney NSW 2000.
Telephone 1300 363 992 (for the cost of a local call anywhere in Australia)
TTY 1800 620 241
Post GPO Box 5218, Sydney NSW 1042
Facsimile +61 2 9284 9666
E-mail privacy@privacy.gov.au

Further information about privacy and your rights can be obtained at the Federal Privacy Commissioner's website at www.privacy.gov.au.

Contact Information
If you wish to access any personal information that we hold about you, or have a query about this policy, please contact our Privacy Officer as follows:

The Privacy Officer
Command Auto Group Pty Ltd
Unit G/2 Hudson Avenue, Castle Hill NSW 2154

Command Auto Group Pty Ltd
P.O. Box 7145
Baulkam Hills Business Centre NSW 2153
E-mail: privacy@tcag.com.au
Phone: +61 2 8853 2900