Privacy Policy

This policy applies to all operations of Shante Pty Ltd trading as National Salary Packaging, including related Australian entities involved in providing: • Salary packaging administration • Novated leasing services • Employee benefits administration • Finance sourcing and vehicle leasing services • Associated payroll and employee benefit services. It governs all personal and sensitive information we collect, use, store, and disclose when delivering these services.

Personal information means information or an opinion about an identified individual, or an individual who is reasonably identifiable. Examples include name, address, phone number, email address, date of birth, occupation, employment information, and financial details. Sensitive information includes information relating to racial or ethnic origin, political opinions, religious beliefs or affiliations, trade union membership, health information, biometric information, and criminal history. Sensitive information is only collected where necessary and permitted by law.

We may collect the following types of information: • Identity information: full name, residential or mailing address, phone number, email address, date of birth. • Employment information: employer name, payroll details, salary information, employment status. • Financial information: bank account details, financial commitments, transaction records. • Government identification: driver licence details, passport details, Medicare card details where required. • Vehicle information (where novated leasing is requested): vehicle make and model, registration, and insurance details. • Credit information (for novated lease applications): credit history, credit scores, repayment history, and credit reporting information.

To administer salary packaging arrangements, we collect and use financial information to process payments on your behalf. You may authorise NSP to collect and store your bank account details, process electronic funds transfers, prepare payment files for authorised payments, and distribute payments from employer holding accounts to service providers or nominated bank accounts. We do not have login access to your bank accounts. Depending on your salary packaging elections, we may process payments for novated lease repayments, everyday living expenses, personal loan payments, credit card payments, education expenses, and general expense reimbursements. All payments are processed only in accordance with your authorised salary packaging arrangements.

To deliver salary packaging benefits we work with payment card providers. EML Payment Solutions is our primary card provider for everyday living benefits and meal and entertainment benefits. We may transfer funds to your EML digital card account as part of your salary packaging arrangement. EML Payment Solutions Limited (ABN 30 131 436 532) operates under Australian privacy and banking regulations. Beyond Bank (Historical): Some employees may still hold accounts through Beyond Bank previously administered by NSP. Where applicable, we may continue administering those accounts in accordance with your salary packaging arrangements.

To comply with ATO requirements and Fringe Benefits Tax obligations, we may collect bank statements or transaction screenshots, receipts and invoices, expense claims, lease invoices, and payslips provided through employers. This information is used solely for verifying salary packaging claims, complying with taxation and FBT legislation, and maintaining records for audit and compliance. We do not access your bank account directly - documentation is provided voluntarily by you.

Salary sacrifice funds may be held in designated employer holding accounts administered by NSP on behalf of your employer. These accounts are used to receive salary sacrifice deductions, hold funds until benefit payments are due, and distribute payments to employees or service providers.

We may collect personal information through: • Application forms and online portals • Our website (nationalsalarypackaging.com) • Emails or telephone communications • Face-to-face meetings • Employer payroll systems • Credit reporting bodies • Government agencies including the ATO • Publicly available sources

We use personal information to administer salary packaging benefits, process novated lease applications, verify identity and eligibility, process payments and reimbursements, assess creditworthiness, communicate with employees and employers, manage business operations, and comply with legal and regulatory obligations. We may disclose information to employers and payroll providers, banks and financial institutions, credit reporting bodies, leasing companies and vehicle suppliers, insurers, payment card providers including EML Payment Solutions, government agencies including the ATO, and legal advisers, auditors, and regulators where required by law.

We take reasonable steps to protect personal information from misuse, loss, or unauthorised access through: • Encryption of electronic communications • Secure systems and access controls • Staff privacy training • Cybersecurity monitoring • Secure storage of documents

If a data breach occurs that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) in accordance with the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act 1988 (Cth).

Some service providers we engage may store or process data outside Australia. Current overseas locations include the United States of America, Philippines, Singapore, and United Kingdom. Where this occurs, we take reasonable steps to ensure overseas providers protect personal information in accordance with Australian privacy laws. Under APP 8, once information is disclosed to an overseas recipient, NSP may not always be in a position to ensure that recipient complies with the Australian Privacy Principles, and you may not be able to seek redress under the Privacy Act in relation to that recipient's handling of your information. If you have concerns about overseas disclosure, please contact our Privacy Officer before submitting personal information through our website or forms.

NSP uses the following trusted technology providers to operate our website, collect form submissions, and manage client relationships. All providers are engaged under contractual privacy and data protection obligations. Base44: Our website and online form platform is built and hosted on Base44 (base44.com). Personal information submitted through NSP's online forms - including application forms, enquiry forms, and benefit selection forms - is processed through Base44's platform. Base44 servers are currently located in the United States of America. Personal information submitted through NSP's website may be stored on Base44's servers in the United States in accordance with Base44's data retention policies. Deleted records are retained for up to 30 days before permanent deletion. HubSpot: NSP uses HubSpot as its customer relationship management platform. Personal information submitted through NSP's website and forms - including contact details, enquiry information, employment details, and benefit selections - may be transferred from Base44 to HubSpot and stored within HubSpot's CRM system. HubSpot servers may be located outside Australia, including in the United States of America. EML Payment Solutions: As noted in Section 5, EML Payment Solutions processes salary packaging card transactions on behalf of NSP. EML operates under Australian financial services and privacy legislation.

We may send communications about services that may interest you. You can opt out at any time by using the unsubscribe link in emails or contacting our Privacy Officer. We do not sell personal information to third parties.

Our website uses cookies and tracking technologies to operate website functions, analyse website usage, improve user experience, and measure marketing effectiveness. Types of technologies we use include: • Functional cookies - essential for the website to operate correctly. • Analytics cookies - used to understand how visitors interact with our website, including page visits and time on site. • Marketing and tracking pixels - our website may use third-party tracking technologies including the Meta (Facebook) pixel and HubSpot tracking to measure the effectiveness of our marketing and to understand visitor behaviour. You may manage cookie preferences through your browser settings. Please note that disabling certain cookies may affect website functionality.

You have the right to request access to personal information we hold about you. Requests may be made by contacting our Privacy Officer. We will generally respond within 30 days. You may also request corrections where information is inaccurate or incomplete.

If you believe your privacy has been breached, you may lodge a complaint with NSP. We will acknowledge complaints within 5 business days, investigate the matter, and respond within 30 days. If you are not satisfied with our response, you may contact: Office of the Australian Information Commissioner (OAIC) Phone: 1300 363 992 Website: www.oaic.gov.au For credit reporting complaints, you may also contact the Australian Financial Complaints Authority (AFCA).

We review this Privacy Policy at least annually and whenever there is a material change to our operations, technology platforms, or applicable legislation. The most current version will always be published at nationalsalarypackaging.com.au/privacy. This policy was last updated in May 2026 and is due for review in May 2027.