Privacy Policy

Allara Global Pty Limited (Australian Company Number 652 022 010) (“we”, “us”, “our”) is committed to providing quality services to you and to ensuring the protection of the privacy of our Clients. This Privacy Policy sets out how we collect, store, use and disclose your personal information (including sensitive information). This Privacy Policy was last updated on 2nd October 2026.

Purpose and reach of our Privacy Policy

The Privacy Policy has been created and implemented to ensure we have the measures in place to protect our Client’s information that has been collected for the purpose of providing our service offerings. This Privacy Policy applies to all of our Content and product offerings, across our LMS and our mobile app (the “Content”).

This Privacy Policy follows the standards set in the Australian Privacy Act 1988 (Cth) and the principles set by the European Union’s General Data Protection Regulation (GDPR) and the United Kingdom’s Data Protection Act 2018, and, for residents of the United States, US state privacy laws such as the California Consumer Privacy Act of 2018, as amended (CCPA), where they apply to us.

For the purposes of data protection laws applicable in the EU/EEA and the UK (including the GDPR and the UK Data Protection Act 2018), Allara Global is the “data controller” of your personal data collected in connection with our services, except where we process personal data on behalf of a Client (see “When we act on behalf of your employer or organisation” below). This means we determine the purposes for and the manner in which your personal data is processed.

When we act on behalf of your employer or organisation

Many people use our Content because their employer or another organisation (a “Client”, including any Participating Site operating under a Client’s agreement) has subscribed to our services. When we process your personal information to provide, administer and report on your training for a Client, we do so on the Client’s behalf and on its documented instructions under our Data Processing Addendum. In that role we are a “processor” under the GDPR, UK GDPR and similar laws, and a “service provider” or “processor” under the CCPA and other US state privacy laws. The Client decides how your information is used, and the Client’s own privacy policy applies to it.

This information typically includes your name, work email address, employer, job title or role, user ID, training enrolments, completion records, assessment results, certificates and platform usage data. We do not sell or share it, and we do not use it for our own marketing. To access, correct or delete it, please contact your employer or organisation. If you contact us instead, we will pass your request to the relevant Client and help it respond.

What is personal information?

"Personal information" is information or an opinion, whether true or not, and whether recorded in a material form or not, about an identified individual or an individual who is reasonably identifiable or data about an individual who can be identified from that data, or from that data and other information to which we have or are likely to have access.

Sensitive information

Personal information may include sensitive information. "Sensitive information" is personal information which is about your racial or ethnic origin, political opinions, membership of a political association, religious beliefs or affiliations, philosophical beliefs, membership of a professional or trade association, membership of a trade union, sexual orientation or practices, criminal record, health information, genetic information and biometric information or templates.

What personal information do we collect about you?

The personal information we collect and hold about you may include:

• identity information, such as first and last names, job title, organisation or employer names;
• contact information including mailing or street address, telephone numbers and email addresses;
• information relating to prior education;
• information relating to disabilities;
• cultural information;
• payment and transaction information including billing address details about payments to and from you and other details of products or services you have purchased from us, bank account and credit card details;
• profile information, including your username and password, your interests, preferences and any feedback you provide;
• information about your business organisation such as a company name, industry, company size, company contact information;
• information about your use of our services, including:
• formal learning tracking information (including your course completion status, final results/score, certificates); and
• questions/answers tracking (including your assessment results);
• customer service information, including your customer service enquiries and comments;
• records of our interactions and correspondence with you whether by submitting of a web form, telephone, email, text message, social media or otherwise;
• information about your use and interaction with our website, portals and online services advertisements or communications including, the links you click on, the files and attachments you view or download, traffic data and location data. Please refer to our Cookies sections for more information about how we use cookies and other technologies to collect data about you; and

How we collect your personal information

We collect your personal information in various ways including:

• directly from you when you:
• become our customer;
• visit, access or use our websites or services;
• create an account on our websites or platforms or via other means;
• subscribe to our service or publications;
• your employer subscribes to our services on your behalf;
• enter a competition, promotion or survey;
• request marketing to be sent to you or respond to it;
• give us feedback;
• submit payments to us; or
• correspond with us by telephone, email or post,
• from publicly available sources (such as from your organisation’s website, from media and publications and from other publicly available sources);
• automatically when you interact with our website, communications or online advertisements using cookies and tracking technology (please see the “Cookies” section below for more details); and
• information we may obtain from our affiliated websites or related companies;
• indirectly from third parties including:
• utilising customer databases to cross match information for the purpose of identifying mutual opportunities

Purpose for collecting, holding and using your personal information

We collect and use your personal information to:

• provide our products and services to you;
• create a user account for you;
• contact you and make suggestions and recommendations about our and third-party products, services, events and offers that may be of interest to you;
• communicate directly with you, such as sending you email marketing messages or direct mail and recording your communication preferences. We may also send you service-related emails or messages (e.g., account verification, change or updates to features of our products and services, technical and security notices);
• process, manage and deliver our services;
• research, monitor and evaluate our services so we can continue to improve the quality and outcomes of our services as well as develop new services;
• manage our relationship with you, including dealing with any complaints;
• comply with our statutory and regulatory reporting obligations;
• complete internal and/or external audits within our group;
• comply with our legal obligations and other compliance requirements;
• administer and protect our organisation and websites (including troubleshooting, data analysis, testing, system maintenance, support, reporting, hosting of data, and network, security and fraud protection activities);
• reasonable third-party use for the issuance of supplier related content, completion/credentialing;
• improve our website, products or services, marketing, client relationships and experiences including through analysis and business intelligence techniques; and
• any other purpose notified to you at the time your personal information is collected or that you have consented to.

Automated decision-making

Some of our online courses use automated marking. When you complete an online assessment, our LMS compares your answers with the answers set for that course and calculates your score. If you reach the pass mark, it records the course as complete and issues your certificate of completion. These decisions are made solely by our LMS, without a person reviewing each result. Assessments that include written, practical or observed tasks are marked by a trainer or assessor.

To make these decisions, our LMS uses your name, user ID, course enrolment, answers, score, number of attempts, and the date and time you completed the assessment.

If you access our LMS through your employer, your employer may use your completion records and certificates when making its own decisions, for example whether you can work in a role that requires the training. Those decisions are made by your employer, not by us.

You can ask for any automatically marked result to be reviewed by a person. Email with “Assessment review” in the subject line within 30 days of your result, and tell us anything you would like us to consider. A member of our learning team with the authority to change the result will review it and let you know the outcome within 10 business days. You can also ask us how automated marking was used to make a decision about you.

We do not otherwise use computer programs to make, or substantially assist in making, decisions that significantly affect you.

What happens if you don’t provide us with your personal information?

If you choose not to provide the personal information as requested, we may not be able to supply you with our products or services.

Legal basis for using your personal information

If you are an individual or entity who is either based in a region governed by the General Data Protection Regulation (GDPR) (European Union) or the United Kingdom’s Data Protection Act 2018 the United Kingdom), we will only collect, use and share your personal information where we are satisfied that we have an appropriate legal basis to do this. We will make sure that we only use your personal information for the purposes set out above and where we are satisfied:

• we need to use your personal information to perform a contract or take steps to enter into a contract with you;
• we need to use your personal information for our legitimate interest as a commercial organisation. For example, we may collect your personal details so that we can respond to enquiries submitted via our website. In all such cases, we will look after your information at all times in a way that is proportionate and respects your privacy rights and you have a right to object to processing as explained in the “Accuracy, access and correction of your personal information” section of this Privacy Policy below;
• we need to use your personal information to comply with a relevant legal or regulatory obligation that we have; or
• we have your consent to using your personal information for a particular activity.

We may from time to time process sensitive personal information about you, such as information about prior education, disabilities and cultural information. We will only process your sensitive personal information if:

• we have a lawful basis for doing so, i.e. to perform a contract or take steps to enter into a contract with you;
• you have given explicit consent;
• the processing is necessary for the purposes of exercising our or your obligations;
• the processing relates to personal data which is manifestly made public by you; or
• the processing is necessary for reasons of substantial public interest.

To provide additional clarity, below is a summary of the legal bases we rely upon for different processing activities:

Disclosure of personal information

We may share your personal information with the persons set out below:

• our related companies which means our subsidiaries, our ultimate holding company and its subsidiaries, including in addition to Allara Global Pty Limited (ABN 66 652 022 010) and Tactical Training Group Pty Limited (ABN 57 094 224 076) (a wholly owned subsidiary of Allara Investments Pty Limited (ABN 76 110 564 264) (trading as Allara Learning));
• third parties who help improve and manage our business and provide our services, including our third-party service providers, such as payment system operators, IT suppliers including customer and sales platform solutions, online learning management systems, identity and fraud protection services, marketing (including direct marketing) and market research services, advertising and social media platforms, mailing services, analytic services, or web hosting services
• professional advisers, including lawyers, accountants, audit assessors, other advisers and financial institutions who provide consultancy, banking, legal or accounting services;
• our insurers;
• any other entities notified to you at the time of collection;
• buyers of our assets or shares when we are a seller; and
• courts, law enforcement, regulators and other government agencies so we may respond to their reasonable requests for information or comply with all applicable laws, regulations, rules and our legal obligations.

We are not liable for any loss, claim or damage that arises from another person’s use of personal information where we were authorised to provide that information. While we may not have direct control over the privacy policies or security measures employed by our third-party service providers, we require that all service providers and related companies handle personal data in a manner consistent with this Privacy Policy and applicable data protection laws. We put in place appropriate data processing agreements and safeguards, such as Standard Contractual Clauses, to ensure that these third parties protect your personal information and only process it for authorised purposes.

Transfer of personal information overseas

We may disclose your personal information to third-party service providers and/or our related companies based around the world who may use, hold or access your information from a place outside your place of residence including but not limited to:

• Australia
• the European Union
• New Zealand
• Malaysia
• Philippines
• Vietnam
• United States of America
• Singapore
• Thailand
• United Arab Emirates

Transfer of your personal information will only be made for one or more of the purposes specified in this Privacy Policy.

If you are in the United States, your personal information will be transferred to, stored and processed in Australia and the other countries listed above, whose data protection laws may differ from those where you live.

When we take reasonable steps, we will ensure that transfers of personal information are in accordance with applicable law and carefully managed to protect your privacy rights and transfers are limited to either countries which are recognised as providing an adequate level of legal protection or where we can be satisfied that alternative arrangements are in place to protect your privacy rights.

To this end:

• we ensure transfers within Allara Global and associated company Allara Learning, are covered in this same Privacy Policy measures to ensure personal information receives an adequate and consistent level of protection wherever it is transferred within our group of companies.
• we use standard contractual clauses approved by the European Commission or other approved mechanisms;
• where we transfer your personal information either outside our group or to third parties who help provide our services, we ensure these third parties have robust Privacy Policies and data protection processes in place to protect your information; or
• where we receive requests for information from law enforcement or regulators, we carefully validate these requests before any personal information is disclosed.

You have a right to contact us for more information about the safeguards we have put in place to ensure the adequate protection of your personal information when this is transferred as mentioned above.

Your obligations when you provide personal information of others

You must not provide us with personal information (including any sensitive information) of any other individual (including any of your employees or customers) unless you have the express or implied consent of that individual to do so. If you do provide us with such information about another individual, before doing so you:

• must tell that individual that you will be providing their information to us; and
• warrant that you have that individual’s consent to provide their information to us.

Your obligations when we provide you with personal information

If we give you, or provide you access to, the personal information of any individual, you must only use it:

• for the purposes we have agreed to; and
• in compliance with applicable Privacy Laws and this Privacy Policy.

You must also ensure that your agents, advisers, employees and contractors meet the above requirements.

Accuracy, access and correction of your personal information

We take reasonable steps to ensure that your personal information is accurate, complete and up-to-date whenever we collect, use or disclose it. However, we also rely on you to advise us of any changes to your personal information. All personal information identified as being incorrect is updated in our database and, where applicable and appropriate, on our third-party databases, such as payment system operators, IT suppliers including customer and sales platform solutions and online learning management systems.

Please contact us using our contact details at the end of this policy as soon as possible if there are any changes to your personal information or if you believe the personal information we hold about you is not accurate, complete or up-to-date. These requests will be actioned within 28 days of receiving the request in writing. We are not liable for any information that is provided to us that is incorrect.

You may access the Personal Information we hold about you and update and/or correct it, subject to certain exceptions. If you wish to access your Personal Information, please contact us in writing using the contact details at the end of this policy. If you make an access request, we will provide you with access to the personal information we hold about you unless otherwise required or permitted by law. We will notify you of the basis for any denial of access to your personal information. Allara Global may charge a fee where permitted by law, for instance if your request is manifestly unfounded or excessive. We may also charge the reasonable cost of third parties who assist us in complying with the access request.

Additional rights under the GDPR and UK Data Protection Act 2018

If you are an individual based in or a resident of the European Union or the United Kingdom, there are additional rights available to you. Please see below your detailed rights including rights of access, erasures, rectification and portability of your personal data.

If you wish to access any of the above-mentioned rights, we may ask you for additional information to confirm your identity and for security purposes, in particular before disclosing personal information to you.

Your US State Privacy Rights (including California)

This section applies to residents of California and other US states with comprehensive consumer privacy laws, to the extent those laws apply to us. It supplements the rest of this Privacy Policy and does not cover information we process on behalf of a Client (see “When we act on behalf of your employer or organisation”). Terms such as “personal information”, “sensitive personal information”, “sell”, “share” and “business purpose” have the meanings given in the California Consumer Privacy Act of 2018, as amended (CCPA).

Personal information we collect, disclose and keep. In the past 12 months we have collected the categories below, from the sources described in “How we collect your personal information”, for the purposes described in “Purpose for collecting, holding and using your personal information”.

Sensitive personal information. We use and disclose sensitive personal information only to provide our services, keep accounts secure, process payments and meet legal obligations, as permitted by section 7027(m) of the CCPA regulations. We do not use it to infer characteristics about you, so the right to limit its use does not apply.

Your rights. Depending on where you live, you have the rights below. Exercising them is free.

How to make a request. Use our privacy request form or email helpdesk@allaraglobal.com with “US Privacy Request” in the subject line. We will confirm receipt within 10 business days and respond within 45 calendar days. If we need longer (up to a further 45 days), we will tell you why. We act on opt-out requests within 15 business days.

Verifying your identity. Before responding to a request to know, delete or correct, we will verify your identity by matching information you give us against information we hold, and may ask account holders to log in. We may ask for more information for requests involving sensitive or specific information, and will use it only to verify your request. You do not need to verify your identity to opt out.

Authorised agents. An authorised agent can make a request for you. We may ask the agent for your signed permission and ask you to verify your identity directly with us, unless the agent holds a power of attorney under California Probate Code sections 4121 to 4130.

Appeals. If you live outside California and we decline your request, you can appeal by replying to our decision or emailing with “Privacy Appeal” in the subject line. We will respond in writing within 45 days, or any other period your state’s law requires, and explain our decision. If you are not satisfied, you can contact your state Attorney General.

De-identified information. Where we de-identify personal information, we keep and use it only in de-identified form and do not attempt to re-identify it.

California “Shine the Light”. We do not disclose personal information to third parties for their own direct marketing purposes.

Nevada. We do not sell covered information as defined under Nevada law. Nevada residents can ask us not to sell it in future by emailing .

Children

All Content is aimed at individuals who are at least 16 years of age. Individuals who are the age of 16 years or older can consent to the processing of personal data, but anyone younger needs the consent of their parent or guardian. If you are the age of 13 years or older but younger than the age of 16 years, you may only provide your personal data on our LMS or our mobile app after you have been given consent by (one of) your parent(s) or legal guardian(s). If you are younger than the age of 13 years, we do not permit you to provide your personal data on our LMS or our mobile app. We do not knowingly collect and do not envisage collecting personal data from individuals below the age of 16. We make no representation that the Content is available or appropriate for use by individuals below the age of 16. The Content is not intended to be viewed or used by children without the involvement and approval of (one of) their parent(s) or legal guardian(s).

Our services are not directed to children under 13. If we learn that we have collected personal information from a child under 13, we will delete it. We do not sell or share the personal information of consumers we know to be under 16.

Security of personal information

We have appointed a Data Protection Officer (the “DPO”) to oversee this Privacy Policy and its compliance with the Australian Privacy Act, the GDPR and the United Kingdom’s Data Protection Act 2018 and California Consumer Privacy Act of 2018, as amended (CCPA), and other applicable US state privacy laws. The DPO may be assisted by internal and external professionals and advisors. The DPO can be contacted regarding any privacy-related inquiries or concerns by using the email address provided under ‘How to contact us’.

We take steps to protect personal information that we hold from misuse, interference and loss, and from unauthorised access, alteration and disclosure. For example, we maintain physical security over our paper and electronic data stores and premises, such as locks and security systems. We also maintain computer and network security.

We use SSL encryption and even though we use reputable third-party providers whose platforms regularly undergo independent verification of security, privacy, and compliance controls, achieving certifications against global standards, we are not responsible for the privacy or security of third parties and these may be subject to separate security and privacy policies.

Given the nature of online transactions, and despite our best efforts to ensure your personal information is secure, the security of online transactions cannot be guaranteed and as such, each individual who provides information to us via electronic means, does so at their own risk and we are unable to accept responsibility for the loss or misuse of personal information where this is outside of our control.

Links to third-party sites

Our website may contain links to other third-party websites. Clicking on those links may allow third parties to collect or share data about you in accordance with their own privacy policies. We do not endorse or otherwise accept responsibility for the content on those websites or privacy practices of those third parties or any products or services offered by them. We recommend that you check the privacy policies of these third-parties to find out how these third parties may collect and deal with your personal information.

Cookies

Like many website operators, we may use standard technology called cookies on our website. Cookies are small data files that are downloaded onto your device when you visit a particular website. Cookies help provide additional functionality to the site or to help us analyse site usage more accurately. For instance, our server may set a cookie that keeps you from having to enter a password more than once during a visit to one of our sites. You can disable cookies by turning them off in your browser; however, our website may not function properly if you do so.

Please refer to: for more information on how we use Cookies.

You can adjust the settings in your web browser to determine whether sites can set cookies on your device. If you’ve visited this site before, there may be previously set cookies on your device. To find out more about cookies, including how to see what cookies have been set and how to manage and delete them, visit or .

For visitors accessing our website, we present a cookie consent banner or pop-up that allows you to choose which cookies you wish to accept. Non-essential cookies (such as analytics or advertising cookies) will only be placed on your device if you provide your explicit consent. You can withdraw or change your cookie preferences at any time by clicking on the cookie settings link in the footer of our website or via your browser settings.

If you access our website from the United States, please note that third parties such as our analytics and advertising partners may collect information about your online activities over time and across different websites. You can opt out of the sale or sharing of your personal information using the “Your Privacy Choices” link in our website footer. Our website does not respond to “Do Not Track” signals, because there is no agreed industry standard for them.

Direct marketing and how to opt out

We may use your personal information to send you direct marketing communications about our products, services and special offers, those of our related entities and other third parties. If you are in the European Union or the United Kingdom and subscribe to receive any of our email newsletters or marketing communications, then you will be subscribed to receive our direct marketing communications once you consent to it. If you are not within the European Union or the United Kingdom and you buy from us, we may send you direct marketing communications. If you sign up for any of our free products or services, we will also add you to our marketing communications (see “Notice of financial incentive” below). You can opt out at any time.

If you no longer wish to receive such information, you can opt out by following the unsubscribe/opt out link at the bottom of our marketing emails or contacting us using our contact details at the end of this policy. If an individual believes they are receiving information from us when they have not elected to opt-in to our marketing communications, they should contact us immediately using the details provided at the end of this Privacy Policy.

Notice of financial incentive. Some of our courses and content are free when you sign up with your name, email address, employer and job title, and signing up also adds you to our marketing communications. Under the CCPA, this may be a financial incentive. The personal information involved is identifiers (name and email address) and professional information (employer and job title). We estimate the value of this information to us at US$40 per person, which is reasonably related to the value of the free content we provide. We based this estimate on published 2026 industry benchmarks for the cost of acquiring a new marketing contact through paid social advertising. You opt in by completing the sign-up form. You can withdraw at any time by clicking “unsubscribe” in any of our emails or by emailing helpdesk@allaraglobal.com, and you will keep access to any free content you have already received.

Retention of personal information

We retain your personal information only for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

We will only retain your personal information until the earlier of the following events:

• the information is no longer necessary for the purpose it was collected and we are no longer required to hold the information by law;
• consent has been withdrawn by the individual;
• you have requested us to delete the information;
• the information is in relation to a child younger than the age of 13;
• the information is found to be outdated;;
• it is too costly to maintain further retention of your personal data;
• we discontinue our business or services;
• the information collected breached the Australian Privacy Act, the GDPR or the United Kingdom’s Data Protection Act 2018;
• our decision to cease using our existing data providers; or
• we are legally required to remove or delete the information.

We may refuse to remove personal information we hold in relation to an individual where the information was collected:

• to exercise right of freedom of expression and to information;
• to comply with legal obligations in relation to the public interest or exercise of official authority;
• archiving purposes or public health purposes in the public interest, statistical purposes or scientific research; or
• for the defence of legal claims.

We will provide reasons if we do not intend to comply with any of your requests regarding your personal data.

We apply different retention periods for different categories of personal information, depending on the purpose of the processing and any legal or regulatory obligations. For example:

• Customer Account Data: Generally kept for up to 5 years after your last interaction with our services, unless a longer retention period is required by law.
• Financial/Transaction Records: Kept for at least 7 years to comply with tax and accounting regulations.
• Marketing Data: Retained until you opt out of marketing communications or withdraw consent, or 5 years after our last interaction.

Where it is not possible to provide a fixed retention period, we outline the criteria we use to determine retention (e.g., legal obligations, ongoing business needs, and your preferences).

Policy updates

We may amend our Privacy Policy from time to time. We review and update this Privacy Policy at least once every 12 months. Any amended Privacy Policy will be posted on our website or, where appropriate, we will communicate the changes to you by email or other means. You are unable to opt out of these communications.

Data breach

Where we become aware or suspect that there has been unauthorised access to, or unauthorised disclosure of, Personal Information or Personal Information has been lost in circumstances where unauthorised access to, or unauthorised disclosure of, the Personal Information may occur (a “Data Breach”) then we will:

• immediately establish the severity of the Data Breach and the associated risks;
• when the Data Breach is likely to result in a high risk to the rights and freedoms of natural persons, disclose without undue delay to the relevant data subject(s) to whom the Data Breach relates all information relevant to that actual or suspected Data Breach;
• co-operate with the other party in investigating whether a Data Breach has occurred and the circumstances surrounding that Data Breach; and
• disclose to required third parties (including any government agency or privacy regulator) the existence or circumstances surrounding any Data Breaches where it is required to do so by applicable law. Where notification of a Data Breach is required under the GDPR or the United Kingdom’s Data Protection Act 2018, we will notify the relevant supervisory authorities not later than 72 hours after having become aware of it. Where the notification to the supervisory authority is not made within 72 hours, it shall be accompanied by reasons for the delay.
• where a Data Breach affects individuals in the United States, notify those individuals and any relevant regulators within the timeframes required by applicable US state laws;
• disclose to required third parties the facts relating to the Data Breach, actions being taken in relation to the Data Breach and undertake to put preventative measures in place to avoid a similar Data Breach in the future.

Additional work

We may take additional actions to ensure the privacy of personal information is secure and to ensure we comply with the Australian Privacy Act, the GDPR, the United Kingdom’s Data Protection Act 2018, the California Consumer Privacy Act of 2018, as amended (CCPA), and other applicable US state privacy laws. Nothing in this Privacy Policy should be taken to be non-compliant with or deem us to not have complied with the Australian Privacy Act, the GDPR, the United Kingdom’s Data Protection Act 2018 and the California Consumer Privacy Act of 2018, as amended (CCPA), and other applicable US state privacy laws.

Privacy Policy complaints and enquiries

If you wish to make a complaint about a breach of this Privacy Policy or any breach of applicable privacy laws, you can contact us using the contact details at the end of this policy. You will need to provide us with sufficient details regarding your complaint.

We will contact you if we require any additional information from you and will notify you in writing of the outcome of the investigation. We will try to resolve any complaint within 30 days. If this is not possible, you will be contacted within that time to let you know how long it should take us to resolve your complaint.

If you are not satisfied with our response, you can contact us to discuss your concerns and you can complain to the relevant local data protection supervisory authority for your place of habitual residence, place of work or place of alleged infringement. In Australia, this is the Office of the Australian Information Commissioner (). Regulators in other countries are listed under “Local data protection supervisory authorities” below.

How to contact us

If you wish to gain access to your personal information, want us to correct or update it, have a complaint about a breach of your privacy or any other query relating to our Privacy Policy, please contact our Data Privacy Officer by email using the following email . These requests will be responded to within 28 days of receipt by us of your email (or, for US residents, within the timeframes set out in “Your US State Privacy Rights (including California)”). We may extend the aforementioned period of 28 days by up to two months when necessary, taking into account the complexity of your request and the number of your requests, in which case you will be provided notice of such extension together with the reasons for such delay:

Allara Global

Sydney Suite 19.04, Level 19 227 Elizabeth Street Sydney, NSW, 2000 Australia

London

Atrium Office 3.03

Stables Market

407 Chalk Farm Rd

London NW1 8AH

United Kingdom

US residents can also make a request using our privacy request form or by emailing helpdesk@allaraglobal.com.

EU and UK Representative

VeraSafe has been appointed as Allara Global 's representative in the European Union and the United Kingdom for data protection matters, pursuant to Article 27 of the General Data Protection Regulation of the European Union and the United Kingdom. If you are in the European Economic Area or the United Kingdom, VeraSafe can be contacted in addition to our Data Privacy Officer, only on matters related to the processing of personal data. To make such an inquiry, please contact VeraSafe using this contact form: https://verasafe.com/public-resources/contact-data-protection-representative or via telephone at: +420 228 881 031.

Alternatively, VeraSafe can be contacted at:

VeraSafe Czech Republic s.r.o

Klimentská 46, Prague 1, 11002, Czech Republic

VeraSafe United Kingdom Ltd.

37 Albert Embankment, London SE1 7TL, United Kingdom

Local data protection supervisory authorities

You may be able to find out further information about privacy laws in your jurisdiction from your local data protection supervisory authority, including:

• in Australia, the Office of the Australian Information Commissioner at or
• in New Zealand, the New Zealand Privacy Commissioner at or
• in Singapore, the Personal Data Protection Commission at or
• in the European Union, the data protection authority in your member state, listed at or
• in the UK, the Information Commissioner's Office at www.ico.org.uk or
• in California (United States), the California Privacy Protection Agency at

2nd October 2026