Privacy Policy

DryFlow Magnetics Pty Ltd (ACN 679 608 032) and its subsidiaries (DryFlow)

1. Introduction

This Policy applies to DryFlow Magnetics Pty Ltd (ACN 679 608 032) (“DryFlow”) and to any related bodies corporate (as defined in the Corporations Act 2001 (Cth)) that form part of the DryFlow group, and covers all personal information collected by the DryFlow group in connection with its business operations, including information about employees, contractors, clients, suppliers and other individuals. Where we refer to “DryFlow”, “we”, “us” or “our” in this Policy, we mean the DryFlow entity responsible for collecting or holding the personal information concerned.

DryFlow is committed to protecting the privacy of individuals and handling personal information responsibly, openly and in accordance with the law. DryFlow does not sell personal information to third parties.

This Privacy Policy explains how DryFlow collects, holds, uses, discloses and manages personal information in accordance with the Australian Privacy Principles (“APPs”) contained in Schedule 1 of the Privacy Act 1988 (Cth) (“Privacy Act”).

2. What is Personal Information?

Personal information means any information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information or opinion is true or not, and whether recorded in a material form or not.

Sensitive information is a subset of personal information that includes health information, racial or ethnic origin, political opinions, religious beliefs, sexual orientation or practices, trade union membership, biometric information and criminal records. Sensitive information attracts a higher level of protection under the APPs.

3. What Personal Information We Collect

DryFlow may collect and hold the following types of personal information:

• Contact details, name, email address, telephone number, postal address.
• Employment details, job title, employer, department, work contact information.
• Financial information, bank account details, invoicing and payment information (for billing and payroll purposes).
• Technical data, IP addresses, device identifiers, browser type and login data (where individuals interact with DryFlow’s digital systems).
• Project-related information, roles, responsibilities and information disclosed during project execution.
• Health information, where an employee or contractor discloses a medical condition relevant to workplace safety or first aid, with their consent.

We only collect personal information that is reasonably necessary for one or more of our functions or activities (APP 3).

4. Cookies and Website Analytics

Where an individual interacts with DryFlow’s website, we use only essential cookies that are strictly necessary for the website to function correctly (for example, to maintain security and enable core site features). We do not currently use analytics, advertising or other non-essential tracking cookies.

Most browsers allow individuals to manage or disable cookies through their settings, although disabling essential cookies may affect the functionality of our website.

We will update this Policy before introducing any additional tracking technologies, such as analytics, third-party advertising or remarketing cookies, and will seek consent where required by law.

5. How We Collect Personal Information

DryFlow collects personal information by lawful and fair means (APP 3.5), primarily directly from the individual concerned. Methods of collection include:

• Employment and contractor engagement forms and agreements.
• Email, telephone and written communications.
• Website contact forms and digital interactions.
• Face-to-face meetings, workshops and project activities.
• Third parties such as recruitment agencies, referees or government bodies, where authorised by law or with the individual’s consent.

Where DryFlow receives unsolicited personal information (information we did not ask for), we will determine whether we could have lawfully collected it. If not, we will destroy or de-identify it as soon as practicable (APP 4).

6. Anonymity and Pseudonymity

Where lawful and practicable, DryFlow will give individuals the option of not identifying themselves or using a pseudonym when dealing with us (APP 2). However, in most cases DryFlow requires individuals to identify themselves to provide services, enter into contracts, or comply with legal obligations.

7. Notification of Collection

At or before the time DryFlow collects personal information (or as soon as practicable afterwards), we will take reasonable steps to notify the individual of (APP 5):

• DryFlow’s identity and contact details.
• The purposes for which the information is collected.
• Any third parties to whom we usually disclose information of that kind.
• Whether we are likely to disclose information to overseas recipients, and if so which countries.
• How the individual may access or correct their personal information.
• How to make a privacy complaint and how we will handle it.

This notification is typically provided through this Privacy Policy, employment or engagement agreements, or a collection notice at the point of collection.

8. Why We Collect and Use Personal Information

DryFlow collects, holds, uses and discloses personal information for the following primary purposes (APP 6):

• Recruiting, employing and managing employees and contractors.
• Delivering services to clients and managing business relationships with suppliers and partners.
• Complying with legal and regulatory obligations.
• Managing accounts, billing, payments and financial reporting.
• Workplace health and safety.
• Improving our products, services, internal operations and user experience.

We will not use or disclose personal information for a purpose other than the primary purpose of collection unless:

• The individual has consented to the secondary use or disclosure.
• The individual would reasonably expect the use or disclosure and it is related (or directly related for sensitive information) to the primary purpose.
• The use or disclosure is required or authorised by law.
• A permitted general situation applies under the Privacy Act.

9. Direct Marketing

DryFlow will not use or disclose personal information for the purpose of direct marketing without first obtaining the individual’s consent, or where permitted by law (APP 7). Where we do send direct marketing communications, individuals may opt out at any time by contacting us using the details in section 18 of this Policy.

10. Automated Decision-Making

DryFlow does not currently use a computer program to make, or to substantially and directly assist in making, decisions using an individual’s personal information that could reasonably be expected to significantly affect that individual’s rights or interests.

If this changes – for example, if DryFlow begins using automated tools to help make decisions about recruitment, credit or access to services that meet this threshold – we will update this Policy to describe the kinds of personal information used and whether the relevant process is fully automated or assists a human decision-maker, consistent with the transparency requirements that commence under the Privacy Act on 10 December 2026.

11. Disclosure of Personal Information to Third Parties

DryFlow may disclose personal information to the following categories of recipients: DryFlow does not sell, rent or trade personal information to any third party.

• Our related bodies corporate, for internal group administration, reporting and business management purposes.
• Service providers, payroll processors, IT service providers, accountants and legal advisers engaged by DryFlow to perform functions on our behalf, including cloud-based software providers that may store or process data outside Australia (see section 12).
• Government bodies and regulators, where required or authorised by law.
• Business transactions, in connection with a merger, acquisition or asset sale, where personal information may be transferred as part of business assets

We take reasonable steps to ensure that third-party recipients handle personal information in accordance with the APPs and do not use it for unauthorised purposes.

12. Cross-Border Disclosure of Personal Information

DryFlow uses cloud-based service providers to help operate its business, including payroll and HR platforms (such as Xero and Xero Me) and other IT and software-as-a-service providers.

Some of these providers store or process personal information using infrastructure located outside Australia, including in the United States, New Zealand and other jurisdictions in which our service providers operate data centres and support services. Before disclosing personal information to an overseas recipient, we take reasonable steps to ensure the recipient does not breach the APPs in relation to that information (APP 8), including through contractual protections in our service agreements.

Where practicable, we will notify individuals of the countries in which overseas recipients are likely to be located. DryFlow does not otherwise disclose personal information to overseas recipients as at the date of this Policy. If this changes – for example, if DryFlow or its related bodies corporate expand their operations overseas – we will update this Policy accordingly.

13. Government-Related Identifiers

DryFlow will not adopt, use or disclose a government-related identifier (such as a Tax File Number or Medicare number) as its own identifier of an individual, except where required or authorised by law or reasonably necessary to fulfil obligations to a government agency (APP 9).

14. Quality of Personal Information

DryFlow takes reasonable steps to ensure that the personal information we collect is accurate, up-to-date and complete, and that the personal information we use or disclose is accurate, up-to-date, complete and relevant having regard to the purpose of its use or disclosure (APP 10).

We encourage individuals to notify us of any changes to their personal information so that our records remain current.

15. Security of Personal Information

DryFlow takes reasonable technical and organisational steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure (APP 11), including:

• Secure storage systems and access controls.
• Encryption of sensitive data in transit and at rest.
• Regular security assessments and staff training on data protection.
• Restricted access to personal information on a need-to-know basis.
• Procedures to identify, assess and respond to data breaches, including notifying affected individuals and the Office of the Australian Information Commissioner (“OAIC”) where required under the Notifiable Data Breaches (“NDB”) scheme in Part IIIC of the Privacy Act.

When personal information is no longer needed for any purpose for which it may be used or disclosed, and we are not required by law to retain it, we will take reasonable steps to destroy or de-identify it (APP 11.2).

16. Access to Personal Information

Individuals have the right to request access to personal information that DryFlow holds about them (APP 12). To make an access request, please contact our Privacy Officer using the details in section 18.

We will respond to access requests within a reasonable period and provide access in the manner requested where it is reasonable and practicable to do so. We may recover reasonable costs of providing access.

Access may be refused in limited circumstances permitted by APP 12.3, including where:

• Providing access would pose a serious threat to the life, health or safety of any person.
• Providing access would unreasonably impact the privacy of other individuals.
• The request is frivolous or vexatious.
• Denying access is required or authorised by law.

If we refuse access, we will provide written reasons and inform the individual of available complaint mechanisms.

17. Correction of Personal Information

If an individual believes that personal information DryFlow holds about them is inaccurate, out-of-date, incomplete, irrelevant or misleading, they may request correction (APP 13). We will take reasonable steps to correct the information.

If we correct information that was previously disclosed to another APP entity, and the individual requests us to notify that entity of the correction, we will take reasonable steps to do so unless it is impracticable or unlawful.

18. Privacy Complaints

If an individual has a concern or complaint about the way DryFlow has handled their personal information, they should contact our Privacy Officer in the first instance:

Privacy Officer

DryFlow Magnetics Pty Ltd

Email: reachout@dryflowmag.com

Website: www.dryflowmag.com

DryFlow will acknowledge the complaint promptly and generally respond within 30 days. If an individual is not satisfied with our response, they may lodge a complaint with the OAIC:

Office of the Australian Information Commissioner

Website: www.oaic.gov.au

Phone: 1300 363 992

19. Availability of This Policy

This Privacy Policy is available on DryFlow’s website at www.dryflowmag.com. If a person requests a copy in a particular form, DryFlow will take reasonable steps to provide it in that form (APP 1.5-1.6).

20. Links to Other Websites

Our website may contain links to websites operated by third parties. DryFlow is not responsible for the privacy practices or content of those third-party websites. We encourage individuals to review the privacy policy of any third-party website before providing personal information to it.