1. Introduction

1.1 ONCORE GROUP HOLDINGS PTY LTD (OGH Ltd) – ACN 137343349 is an Australian privatecompany whose registered address is: 118 Elizabeth Street, Melbourne, VIC 3000, Australia. This company is the parent organisation and shareholder to a number of UK incorporated companies (listed below) who act solely as subsidiaries, and therefore this policy covers all companies within this group structure.

1.2 The UK incorporated companies (the subsidiaries) and registered offices are:

1.2.1 Oncore (UK) Ltd (OUK), Reg Co: 06921136. Reg Co Address: 1 Long Lane, London , SE1 4PG

1.2.2 IT Global (UK) Ltd (ITG), Reg Co: 03574787 Reg Co Address: 1 Long lane, London. SE1 4PG

1.2.3 Oncore Contract Management (UK) Ltd (OCM), Reg Co: 03214958. Reg Co Address: 1 Long Lane, London. SE1 4PG

1.2.4 Oncore Business Solutions (UK) Ltd (OBS) also trading as MyOe (UK) Ltd, Reg Co: 05691880. Reg Co Address: 1 Long Lane, London. SE1 4PG

1.3 This Data Protection Consent and Privacy Policy contains important information as to how we collect, process, store and use personal data, records and information and about some of our key responsibilities under the Data Protection Act 1998 (the Act) and its successor legislation the General Data Protection Regulations 2018 (GDPR) and in respect of other laws; including how we may use that data to comply with our responsibilities in respect of anti-fraud, anti-bribery and anti-money laundering. For the purposes of the Act and the GDPR, OGH and its subsidiaries are all data controllers.

1.4 We take our responsibilities under the Act, very seriously and your data and its security is very important to us. Please read this Data Protection Consent and Privacy Policy carefully and if you have any questions or queries please contact us at 0203 5985352 or at ukadmin@oncoreservices.com

Information we collect from and about you:

1.5 In the course of our business with you, OGH and its subsidiaries will collect and process personal information about you that you may give us by phone; by email; via our website in person; or otherwise.

1.6 The personal data, records and information you give us may include amongst other things, your name, address, Visa and passport details, email address, phone number and financial information (for example bank account details and sort codes) as well from time to time information about others which you provide such as your employees and customers/clients. We do not hold sensitive personal information about you or any third parties.

1.7 This Data Protection Consent and Privacy Policy applies to all personal data, records and information OGH and its subsidiaries collect and hold including:

1.7.1 from visitors to our websites;

1.7.2 People who are employed by us and who use our services including clients and customers.

1.8 The personal data, records and information you give us may include amongst other things, your name, address, Visa and passport details, email address, phone number and financial information (for example bank account details and sort codes) as well from time to time information about others which you provide such as your employees and customers/clients. We do not hold sensitive personal information about you or any third parties.

1.9 This Data Protection Consent and Privacy Policy applies to all personal data, records and information OGH and its subsidiaries collect and hold including:

1.9.1 from visitors to our websites;

1.9.2 people who are employed by us and who use our services including clients and customers.

Uses of information we collect from and about you

1.10 We gather personal data, records and information about you so that OGH and its subsidiaries can provide our services and those of selected third parties to you which you request and we use this information and the personal data, records and information, you give to us in the following ways;

1.10.1 To carry out our role as employer and any statutory obligations therein

1.10.2 to carry out our obligations arising from any contracts entered into between you and us;

1.10.3 to provide you with the information and services that you request from us being but not limited to; UK employment, UK finances, UK Business and Financial advice, work and contractual advice, general immigration advice, general accounting advice.

1.10.4 to permit selected third parties (e.g. suppliers and sub-contractors) who help us in providing our services to you;

1.10.5 to selected business partners to provide you with information about other services which may be of interest to you;

1.10.6 in order to fulfil our legal and regulatory obligations e.g. as employer, Anti-Fraud, Anti Bribery and Anti-Money Laundering; and,to notify you about changes to our services

Disclosure of the information we collect from and about you

1.1 You agree that we have the right to share your personal data, records and information with:

1.1.1 OGH (and those who process data, records and information on their behalf);

1.1.2 any group companies; being any company or corporate entity (including limited liability partnerships) owned by or controlled by OGH (whether through shares, contract or otherwise) including parent, holding and subsidiary companies, or which are otherwise connected or associated with OGH or which has a commonality of ownership or control with OGH (including joint venture companies and special purpose vehicles);

1.1.3 selected third parties including our professional advisors (including accountants, lawyers, consultants and bankers), suppliers and sub-contractors;

1.1.4 to our business partners;

1.1.5 financial services companies(including financial institutions and credit reference agencies);

1.1.6 to governmental organisations required by statute such as HMRC, UKVI, Judicial or legal bodies (including regulators).

1.2 We will disclose your personal data, records and information to third parties only in the following circumstances:

1.2.1 Information to OGH and its subsidiaries in the process of facilitating and carrying out an ongoing relationship as employer. In the process of doing so this may include professional advisors and selected third parties which need to know such information to facilitate the employment; to assist us in the performance of any contract we enter into with you and to assist us in providing our services, for example, where we offer accounting services or to administer a third-party arrangement or contract to facilitate your employment. i.e Agency or end client.

1.2.2 to provide you with information about our other services

1.2.3 to those of selected business partners to provide you with information in respect of their services which may be of interest to you;

1.2.4 in order to enforce or apply our standard terms and conditions of business and other agreements;

1.2.5 For the purpose of assessing your credit score or credit worthiness, but only where this is required for us to perform the services in our agreement with you; and for contractual obligation.

1.2.6 if we are under a duty to disclose or share your personal data, records and information in order to comply with any legal obligation, or to protect the rights, property, or safety of OGH and its subsidiaries, and our customers and clients. This includes exchanging information with other companies and organisations for the purposes of fraud protection, anti-money laundering, anti- bribery and credit risk reduction.

Where we store your personal data

1.3 The data we collect from you may be transferred to, used in, processed and stored in Australia; a location outside the European Economic Area (EEA).

1.4 It may also be used and processed by staff based in Australia operating outside the EEA who work for and with OGH and its subsidiaries and those who process data, records and information on their behalf. This includes staff engaged in, among other things the fulfilment of our contract with you, the processing of your payment details and the provision of support services.

OGH and its subsidiaries will take all steps reasonably necessary to ensure that your data information and records are treated securely and in accordance with the Act and GDPR (including ensuring that such transfer, processing and storage is performed in accordance with the Australian privacy Act 1998 and those Australian owned companies within EU establishments). All information you provide to us is stored on our secure servers, any payment transactions will be encrypted.

1.5 Cookies

Our website and those of the subsidiaries use cookies as part of delivering our services. Cookies are small files of letters and numbers that are downloaded on to your computer when you visit a website. Cookies are used by us to do a number of things, e.g. remembering your preferences, recording what you are looking at on our website, and counting the number of people looking at our website. To find out more see our Cookies Policy on cookies and how we use them.

Your rights and access to your data, information and records

1.6 You have the right to ask us not to process or to restrict the processing of your personal data, records and information. You can exercise your rights at any time by contacting us at 0203 5985352 or at ukadmin@oncoreservices.com or by post to Data Protection Officer, IT Global (UK) Ltd, 1 Long Lane, London, SE1 4PG

1.7 The Act and GDPR, also gives you the rights in certain circumstances to access, rectify, amend, erase and transfer/port information held about you. You may exercise such rights and submit an information access request by contacting us at 0203 5985352 or at ukadmin@oncoreservices.com or by post to Data Protection Officer, IT Global (UK) Ltd, 1 Long Lane, London, SE1 4PG

1.8 However, you must be aware that in exercising these rights you may prevent us from performing our obligations in any contract we have with you or the ability to perform the services we provide.

Consent of third parties

1.9 To the extent that personal data, records and information is provided by you about third parties, including for example your customers and employees, YOU MUST obtain the necessary consent for the disclosure of this information on the same or equivalent terms as set out in this Data Protection Consent and Privacy Policy and that you have the right permissions and authorisations.

1.10 Before you release any such personal data, records and information to us; YOU MUST ensure that you have the right permissions, consents and authorisations.