1  Background

1.1  Overview

a) Thornton Group (Australia) Pty Ltd adhere to the Australian Privacy Principles (APPs)
and are bound by the Privacy Act 1988 (Cth) (Privacy Act), as amended by the Privacy
and Other Legislation Amendment Act 2024 (Cth) (POLA Act). It is important to us
that personal information collected by us is protected.

(b) If you want more information about this Privacy Policy, or if you want to inquire
about any of personal information held by us, or if you believe personal information
held by us is inaccurate, incomplete or out-of-date, please contact us.

(c) Our business is providing financial services to retail and wholesale clients. When
providing such services, we may have access to personal information relating to our
clients.

(d) The purpose of this Privacy Policy is to outline how we collect, use, disclose and
retain personal and sensitive information. It also sets out how you can make a
complaint and how you can access the personal information we hold about you.

2  What is personal information?

2.1  What is personal information?

Personal information means information or an opinion about an identified individual, or an
individual who is reasonably identifiable: (a) whether the information or opinion is true or
not; and (b) whether the information or opinion is recorded in a material form or not.

2.2  What personal information could we collect?

In order for us to provide financial services to you, we may collect the following
information about you:

(a) full name, date of birth, contact details and residential address

(b) financial position: assets, liabilities, income, expenses and cash flow

(c) superannuation and insurance details

(d) investment objectives, risk tolerance and time horizon

(e) health and medical information (for insurance advice), estate planning details and
family circumstances

(f) tax file number, tax residency and relevant tax information

(g) employment, business activities and source of wealth

(h) identity document details – type, number, issuing authority and expiry

(i) politically exposed person (PEP) status and sanctions screening results

3  Collection of personal information

3.1  Collection of personal information

We collect your personal information to fulfil our obligations as a licensed financial services
provider under the Corporations Act 2001, the Privacy Act and the Anti-Money Laundering
and Counter-Terrorism Financing Act 2006. This includes our obligations to:

(a) verify your identity before providing financial services (AML/CTF customer due
diligence)

(b) provide you with financial advice tailored to your personal circumstances, goals and
financial situation

(c) manage your ongoing financial services including portfolio reviews, insurance and
superannuation

(d) prepare and deliver Statements of Advice (SOAs) and ongoing advice documents

(e) meet record-keeping obligations under the Corporations Act, AML/CTF Act and ASIC
regulatory requirements

(f) make reports required by AUSTRAC under the AML/CTF Act

(g) manage complaints and disputes in accordance with our internal dispute resolution
obligations

(h) We may collect and hold personal information from you for the purposes of enabling
us to provide our services to you. For example – when we provide financial services
to you (eg. when we recommend a financial product to you or to arrange for you to
invest in a financial product). When doing so, we may collect personal information
about you as part of forming our recommendation or providing our arranging
services.

(i) If you give us personal information about you, we will only use and disclose that
information for the relevant purposes set out below. You can also access the
information we hold about you.

(j) Any personal information held by us may be held in a number of ways including via
hard copy, soft copy or offsite on electronic servers.

(k) Where we obtain sensitive information (e.g. racial or ethnic origin, political opinions,
religious beliefs or affiliations or criminal record), we will only do so with your
consent and where the collection of such information is reasonably necessary for us
to perform our function.

3.2  How do we collect your information

We collect your personal information:

(a) directly from you through our client agreement, fact find, risk profile questionnaire
and ongoing correspondence

(b) from third-party sources including financial institutions, superannuation funds,
insurers, ATO, public registers (ASIC) and identity verification services, where
reasonably necessary

3.3  Dealing with unsolicited personal information

If we receive unsolicited personal information, we will within a reasonable period after
receiving the information, determine whether or not we could have collected the
information under Australian Privacy Principle 3. If the information could not have been
obtained under APP 3, we will take steps to destroy or de-identify the information as soon
as practicable, if it is lawful and reasonable to do so.

3.4  Notification of the collection of personal information

At or before the time we collect personal information from you, or if that is not practicable,
as soon as practicable after, we will take reasonable steps to ensure you are aware of:

(a) who we are and our details;

(b) how we collect the personal information and whom from;

(c) whether the collection of the personal information is required or authorised by or
under an Australian law or a court/tribunal order;

(d) the purposes for which we collect the personal information;

(e) the main consequences (if any) if we do not collect all or some of the personal
information;

(f) any other person or body to whom we would disclose the personal information that
we have collected;

(g) information about how you may access the personal information held by us about
you and how you may seek correction of such information;

(h) how you may complain about a breach of the Australian Privacy Principles and how
the entity will deal with such a complaint;

(i) whether we are likely to disclose the personal information to overseas recipients (if
so where).

3.5  Anonymity and pseudonymity

Whilst you may wish to deal with us anonymously, this is likely to limit the services we
provide to you as our principal business is the provision of financial services which is
personal to you. Given the legal requirements around anti-money laundering and counter
terrorism financing, we are required to identify our clients when we deal with them. We
cannot therefore provide financial services to you on an anonymous basis.

3.6  If you don’t provide us with the information we request

It is your choice as to whether you wish to provide us with the information we request.
However, we may not be able to provide you with the services you require if you don’t
provide us with the relevant information to help us deliver the services.

4  Use or disclosure of personal information

4.1  Use or disclosure of personal information

Personal information collected by us is used to provide financial services to you and will
not be disclosed unless required in the performance of those services or otherwise
permitted under the Privacy Act. We may disclose your personal information to the
following categories of third parties:

(a) Product issuers and platforms – where you invest in a financial product through us,
including fund managers, superannuation trustees, insurance companies, managed
investment scheme operators, and investment platforms, with your consent;

(b) Paraplanning service providers – who assist in preparing your financial advice
documents (including Statements of Advice) on our behalf, whether located in
Australia or overseas;

(c) Compliance and audit service providers – who conduct file reviews and compliance
monitoring of our advice processes on our behalf, including external compliance
consultants engaged by our licensee;

(d) Software and technology providers – including IT, document management, CRM
platform providers and practice management system providers who host and
manage our client records and systems;

(e) Professional advisers – including your legal, accounting, lending and audit advisers,
where you have asked us to liaise with them or where it is necessary to provide you
with coordinated financial services;

(f) Our AML/CTF reporting group – as required under our AML/CTF Program;

(g) Regulators – including ASIC, AUSTRAC and the ATO where required by law, court
order or in connection with our regulatory obligations; and

(h) Artificial intelligence tools – where we use AI-assisted software to help prepare
financial advice documents or record client meetings (see Section 4.3 below).

(i) If we specify that personal information is collected for a specific purpose, we will not
use or disclose the information for another purpose unless you consent to the use or
disclosure of the information or an exception in the APPs applies

4.2  Overseas disclosure

(a) Some of our service providers are located overseas or store data on servers outside
Australia. This may include cloud storage and document management platforms, and
AI tool providers. Overseas recipients may include providers in the United States of
America

(b) We take reasonable steps to ensure overseas recipients handle your personal
information consistently with the Australian Privacy Principles (APPs), including by:

(a) entering into contractual arrangements requiring APP-consistent handling;

(b)assessing the privacy protections in the recipient country; and

(c) relying on the Government’s whitelist of approved countries (once published under the POLA Act
2024) where available.

4.3 Direct marketing

We may use and disclose your personal information to keep you informed about the range
of services that we think may be relevant or of interest to you. You can opt out of receiving
information from us at any time by contacting us.

4.4  Use of artificial intelligence

(a) We may use artificial intelligence (AI) tools to assist in the preparation of financial
advice documents (including Statements of Advice), to record and transcribe client
meetings, and to assist in the preparation or review of compliance documentation.
AI tools currently used by us include: Microsoft Copilot, Fireflies and Paradino.
These tools may be hosted by providers located overseas. Where AI tools are used,
your personal information including your financial position, goals, personal
circumstances and discussion transcripts may be processed by the AI system.

(b) We take reasonable steps to ensure:

(i) where meeting transcription tools are used, you will be notified before the
meeting commences and given the opportunity to decline recording;
(ii) human review is applied to all AI-assisted advice outputs before they are
provided to you;
(iii) your personal information is not used to train AI models without your consent;
and
(iv) AI tools used by us are subject to appropriate data handling and
confidentiality obligations.

5  Security and access

5.1  Information accuracy

We take reasonable steps to ensure that all personal data collected is accurate, up to date
and complete. You can ask us to correct any inaccurate information we hold or have
provided to others by contacting us using the details in this policy. If the information that is
corrected is information we have provided to others, you can ask us to notify them of the
correction.

5.2  Security of personal information

We take care to protect the security of your personal information. We may hold personal
information in a combination of secure computer storage facilities, paper-based files and
other formats. We take reasonable steps to protect personal information from misuse,
loss, unauthorised access, modification or improper disclosure. In accordance with APP 11
as amended by the POLA Act 2024, our security measures include both technical measures
(encryption of data at rest and in transit, multi-factor authentication, role-based access
controls, regular security testing, and vendor security assessments for all third-party
providers) and organisational measures (staff privacy and security training, documented
incident response procedures, periodic security reviews, and contractual data security
obligations on all third-party service providers including paraplanning and AI tool
providers). We regularly review these measures to ensure they remain reasonable in the
circumstances. Please note, we are required by law to retain your personal information for
a specific amount of time. We will generally destroy or de-identify personal information if
it is no longer required.

5.3  Access to and collection of personal information

(a) You can contact us to access or correct any personal information we hold about you.

However, in certain situations, we are permitted to refuse access to personal
information. These situations include where:

(i) giving access would have an unreasonable impact on the privacy of other
individuals
(ii) giving access would be unlawful, or where denying access is required or
authorised by an Australian law or a court order
(iii) giving access is likely to interfere with law enforcement activities.

For other situations, please consider Australian Privacy Principle 12.

(b) If we receive a request to access personal information, we aim to respond to that
request in a reasonable timeframe. In general, we will not impose an access charge
unless the request of access and correct personal information is excessively onerous.

(c) If we refuse access to personal information, we will provide you with reasons as to
why access was refused and provide you with information on how to lodge a
complaint about the refusal.

5.4  Retention of personal information

(a) We retain personal information only for as long as it is required for the purposes for
which it was collected, or as required by law. We will take reasonable steps to
destroy or de-identify personal information in accordance with APP 11.2 when the
personal information we hold is no longer required.

(b) If we are required to hold the personal information, the applicable minimum
retention periods for financial advice businesses is seven years.

5.5  Data breach

(a) A data breach occurs when personal information held by us is lost or subjected to
unauthorised access, modification, disclosure, or other misuse or interference.
Examples of a data breach are when a device containing personal information of
clients is lost or stolen, or when a database containing personal information is
hacked or if we mistakenly provide personal information to the wrong person.

(b) Under the Privacy Amendment (Notifiable Data Breaches) Act 2017, we have an
obligation to assess within 30 days whether a data breach amounts to an ‘eligible
data breach’ if we become aware that there are reasonable grounds to suspect that
data breach may have occurred.

(c) If we form the view that the data breach would likely result in serious harm to any of
the individuals to whom the information relates despite any remedial action taken
by us, then the data breach will constitute an ‘eligible data breach’. If an eligible data
breach occurs, we have an obligation to notify you and the Office of the Australian
Information Commissioner and of the details of the eligible data breach.

6  Complaint

6.1 Complaint

If you would like to make a complaint about this policy or the personal information held by
us, please contact us on the contact details below. We will acknowledge your complaint
within 5 business days and endeavour to resolve it within 30 days. If you are not satisfied
with our response, you may escalate your complaint to the Office of the Australian
Information Commissioner (OAIC) (see Section 7.2 below)

7 Contact us

7.1 Contact

(a) You may wish to contact us for the following:

(i) find out what personal information we hold about you;
(ii) update or correct the personal information we hold about you;
(iii) opt out of receiving direct marketing material
(iv) make a privacy related complaint.

Should you wish to do so, please contact us at:

Att Mrs T Kelly
182 Fullarton Road
DULWICH SA 5065
Email: tkelly@thorntongroup.com.au

7.2 External Dispute Resolution

(a) If we are not able to satisfactorily resolve your complaint relating to your personal
information you can contact The Privacy Commissioner.

The Privacy Commissioner
GPO Box 5218
Sydney NSW 2001
1300 363 992
privacy@privacy.gov.au