1 September 2026

Privacy Policy

Taurus Scaffolding Systems Pty Ltd

ABN 90 698 671 448 ACN 698 671 448 Version 3.1 Issue Date 1 September 2026

1. INTERPRETATION

1.1 In this Policy, unless the context requires otherwise:

(a) "Company" means Taurus Scaffolding Systems Pty Ltd (ABN 90 698 671 448, ACN 698 671 448), trading as Taurus Scaffolding.

(b) "Group" means The Premier Scaffolds Group of Companies.

(d) "Personal Information" means information or an opinion about an identified individual, or an individual who is reasonably identifiable, and includes personal data within the meaning of the UK GDPR and the EU GDPR.

(e) "Policy" means this Privacy Policy as updated from time to time.

(f) "Privacy Contact" means Kaleb Roberts, Head of International, kroberts@taurusscaffolding.com.

(g) "SMS Program" means the transactional SMS program described in clause 9 and in the Terms.

(h) "Terms" means the Company's Terms and Conditions published at https://www.taurusscaffolding.com/terms.

(i) "United States Markets" means Texas, New York and Florida.

(j) "Website" means https://www.taurusscaffolding.com/ and the pages published at https://www.taurusscaffolding.com/privacy-policy and https://www.taurusscaffolding.com/terms.

(k) "you" means the individual whose Personal Information the Company collects.

1.2 A reference to a person includes a natural person, partnership, body corporate, unincorporated association and governmental authority. A reference to the singular includes the plural and vice versa. A reference to a gender includes every gender. Including, or similar words, does not limit what else may be included.

1.3 A reference to legislation includes that legislation as amended or replaced, and includes instruments made under it. A reference to a clause or a Schedule is to a clause or Schedule of this Policy. Headings are for convenience only and do not affect interpretation.

1.4 This is Version 3.1, issued 1 September 2026.

2. THE COMPANY

2.1 The Company is an Australian Private Company established in Australia. ABN status: Active from 02 June 2026. GST: Registered from 02 June 2026. Those details were extracted from the Australian Business Register on 1 September 2026 (ABN last updated 04 June 2026). As at the Issue Date the Company has not formed a United States subsidiary.

2.2 The Company supplies wholesale scaffolding and access systems and is part of the Group. Registered office: 28 Yarraman Place, Virginia QLD 4014, Australia. Postal address: PO Box 315, Virginia QLD 4014, Australia. Telephone: 1300 455 444. General email: info@taurusscaffolding.com.

2.3 The Company's United States beachhead is Texas. New York and Florida are further United States Markets in which the Company deals or intends to deal. The Company also deals in the United Kingdom, the United Arab Emirates and the Kingdom of Saudi Arabia.

2.4 The Website published at the Issue Date is https://www.taurusscaffolding.com/. Wix site properties retrieved 1 September 2026 record country Australia, timezone Australia/Brisbane, currency AUD, and contact email info@taurusscaffolding.com. The Company's letterhead also prints taurusscaffolding.com.au. That domain is registered. This Policy is published at the Website URLs in clause 1.1.

2.5 The Company is the controller (APP entity) of Personal Information described in this Policy. The Company has not appointed a Data Protection Officer. The Company has not appointed a representative under Article 27 of the EU GDPR or under the UK GDPR. Those appointments, if required, will be made and this Policy updated. Until then, contact the Privacy Contact.

3. SCOPE

3.1 This Policy applies to Personal Information collected through the Website, enquiry forms, telephone, SMS, email, meetings, and from people who deal with the Company as wholesale distributors, contractors, specifiers, suppliers, professional advisers or other business contacts.

3.2 This Policy does not govern Personal Information of the Company's employees or contractors, which is handled under the Group's internal privacy and confidentiality arrangements. This Policy is not a product specification and does not make any product-performance claim.

4. TERRITORIAL APPLICATION AND APPLICABLE LAW

4.1 This Policy applies wherever you deal with the Company. The Company is established in Australia and is setting up United States operations centred on Texas, with New York and Florida as further United States Markets.

4.2 As at the Issue Date the Company's live wholesale markets include the United States, the United Kingdom, the United Arab Emirates and the Kingdom of Saudi Arabia. An enquiry from any other country is still covered by this Policy.

4.3 The Company applies one operational standard, being the strictest combination of the following. Naming a law is not an admission that every provision of that law currently binds the Company. Where a local statute does not apply, the Company will still honour the rights in clause 16 on request unless a legal exception applies:

(a) Australia: Privacy Act 1988 (Cth) and the Australian Privacy Principles, including the APP 1.4 content described in the OAIC APP Guidelines Chapter 1 (version 1.2, October 2025). The Company does not claim the small-business exemption. From 10 December 2026, APP 1.7 to 1.9 will require extra notice if a computer program uses Personal Information to make a significant decision about an individual (see clause 14);

(b) United States: Telephone Consumer Protection Act; CTIA and The Campaign Registry A2P 10DLC rules; California Consumer Privacy Act as amended by the CPRA (notice at collection); Texas Data Privacy and Security Act, Texas being the Company's United States beachhead; and the mandatory privacy and security laws of New York and Florida to the extent they cannot be excluded;

(c) United Kingdom: UK GDPR and the Data Protection Act 2018. The Information Commissioner's Office is the UK complaint body;

(d) European Union and EEA: GDPR (EU) 2016/679, using Articles 13 and 14 as the structural template. Telephony data may be processed in Germany and Slovakia by the Company's processor even where you are not in the EU;

(e) United Arab Emirates: Federal Decree-Law No. 45 of 2021. Kingdom of Saudi Arabia: Personal Data Protection Law. As at the Issue Date the Company has not appointed a local data protection officer in either country and has not completed a foreign-controller registration in either country;

(f) other countries, including Japan, Singapore, New Zealand, Canada and Council of Europe Convention 108+ countries: the access, correction, deletion and complaint routes in this Policy are available on request.

4.4 This Policy is governed by the laws of Queensland, Australia, being the law of the place where the Company is established.

4.5 If you deal with the Company in connection with its operations in a United States Market, the mandatory privacy and security laws of Texas, New York or Florida (whichever applies to that dealing) are not excluded.

4.6 The courts of Queensland, and the state and federal courts sitting in Texas, New York and Florida, have non-exclusive jurisdiction. Texas is the intended United States seat. New York and Florida are additional United States forums because the Company deals or intends to deal there. Nothing in this clause 4 deprives you of a mandatory local court or authority where a statute gives you that right.

5. PERSONAL INFORMATION COLLECTED

5.1 The Company collects only Personal Information reasonably necessary for its functions. That may include:

(a) identity and contact details: name, job title, company, work email, phone or mobile number, country, state, postal address, and project or site details you provide;

(b) enquiry and relationship records: messages, call notes, recordings and transcripts where CloudTalk Conversation Intelligence is enabled, meeting times, and order or shipment follow-up;

(d) technical data from the Website: IP address, browser type, device type, referring URL, and similar logs, where the Website or its host collects them.

5.2 The Company does not seek sensitive information as part of a wholesale enquiry. If you volunteer it, the Company will hold only what is necessary to handle that message. The Company does not collect government identifiers such as tax file numbers or Social Security numbers through the Website form.

6. COLLECTION

6.1 The Company collects Personal Information:

(a) directly from you, including by Website form, email, telephone, SMS, video meeting, in person, or a document you send;

(b) from a person at your company who is authorised to provide a colleague's work contact details;

(d) from publicly available business sources you publish, only where reasonably necessary to respond to an enquiry or to keep a business record accurate.

6.2 Where practicable, Personal Information is collected from you. If the Company receives your details from a colleague, it will take reasonable steps to notify you, including by this Policy when it first writes or calls.

7. STORAGE AND SECURITY

7.1 The Company holds Personal Information in Microsoft 365 (email and files), Odoo Online (CRM), CloudTalk (telephony and SMS), and the Wix-hosted Website. Access is limited to persons who need it.

7.2 The Company takes reasonable steps to protect Personal Information from misuse, interference, loss, and unauthorised access, modification or disclosure. The Company does not publish the detail of those controls in a way that would weaken them. Personal Information is disposed of securely when it is no longer needed.

8. PURPOSES AND LAWFUL BASES

8.1 The Company uses Personal Information for the purposes in clause 8.2. For the UK GDPR and the EU GDPR a lawful basis is also named. Australian APP 6 uses a related-purpose test. The Company applies both.

8.2 The purposes are:

(a) responding to product, distribution and specification enquiries (UK/EU: legitimate interests or steps toward a contract; APP 6: the enquiry you sent);

(b) scheduling meetings and following up orders or shipments you asked about (UK/EU: contract steps, legitimate interests, or consent where SMS is used; APP 6: performing the relationship you started);

(c) operating the Website, CRM, email and telephony, including CloudTalk (UK/EU: legitimate interests; APP 6: internal operations reasonably related to the enquiry);

(d) sending transactional SMS after you opt in (UK/EU and TCPA: consent; APP 6: the SMS Program you agreed to);

(e) meeting tax, safety, sanctions-screening and record-keeping duties (UK/EU: legal obligation; APP 6: required or authorised by law);

(f) defending legal claims or handling a complaint (UK/EU: legitimate interests or legal obligation; APP 6: related to the original collection or required by law).

8.3 The Company does not sell Personal Information. The Company does not use Personal Information for direct marketing without consent, except where Australian law permits it, and never uses SMS opt-in data for third-party or affiliate marketing. You may object to processing based on legitimate interests. You may withdraw SMS consent at any time under clause 9.

9. SMS AND MOBILE NUMBERS

9.1 If you tick the SMS box on the contact form, or you agree on a call to receive SMS, the Company may send transactional text messages about replies to product and distribution enquiries, meeting scheduling, and order or shipment follow-up. Message frequency varies. Message and data rates may apply. Reply STOP to opt out. Reply HELP for help.

9.2 SMS opt-in data and mobile numbers will not be shared with third parties or affiliates for marketing purposes. Mobile information will not be shared with third parties or affiliates for marketing or promotional purposes. All other categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

9.3 The Company may share your number with CloudTalk s. r. o. and with mobile carriers solely so the message can be delivered. That is delivery, not marketing. Consent to SMS is not a condition of purchase. You may submit an enquiry without ticking the SMS box. Phone number is optional on the Website form.

9.4 SMS may be sent from +1 (346) 684-0599 or +1 (253) 544-3217, or another number registered to the Company on the same program. The Terms are at https://www.taurusscaffolding.com/terms.

10. COOKIES AND WEBSITE TECHNOLOGIES

10.1 The Website is hosted on Wix.com Ltd. Wix site context retrieved 1 September 2026 records Wix Forms and Wix Promote SEO as installed apps. The Website and its host may set cookies or similar technologies needed for a page to load, to keep a session, or to measure basic traffic, including cookies associated with Wix Promote SEO.

10.2 As at the Issue Date the Company has not published a separate cookie list or a cookie-choice banner. If non-essential cookies require a choice mechanism under applicable law, the Company will add one before relying on those cookies for a purpose that needs it. You may also control cookies in your browser. Essential cookies may still be required for the Website to function.

11. DISCLOSURE

11.1 The Company may disclose Personal Information to other entities in the Group where needed to run the business, including manufacturing or administration support. SMS opt-in data is not shared with those entities or with any other person for their marketing.

11.2 The Company uses service providers under contract. The processors verified as handling Website, CRM, email or telephony data as at the Issue Date are listed in Schedule 1. The Company does not name every internal tool. A tool that does not process your enquiry or SMS data is outside Schedule 1.

11.3 The Company may also disclose Personal Information to professional advisers under confidentiality, and to regulators, courts or others where the law requires or authorises it.

12. OVERSEAS DISCLOSURE

12.1 The Company is likely to disclose Personal Information to overseas recipients (APP 1.4(f)).

12.2 The countries in which those recipients are likely to be located, where it is practicable to specify them (APP 1.4(g)), are Australia, the United States, Slovakia, Germany, Singapore, Belgium, France, the Netherlands, Canada and Israel. Additional countries may appear if a processor's sub-processor list changes.

12.3 CloudTalk publishes Standard Contractual Clauses and a transfer impact assessment for non-EEA transfers. Where the Company discloses Personal Information to an overseas recipient, it takes reasonable steps so the information is handled in a way that is consistent with the Australian Privacy Principles, or it obtains your consent, or another APP 8 exception applies.

13. RETENTION

13.1 Enquiry and relationship records are kept for as long as the business relationship lasts and for a reasonable period after, including tax and legal retention.

13.2 If you reply STOP, the Company keeps only what it needs to honour the opt-out and to demonstrate compliance. Call recordings and transcripts follow CloudTalk's retention settings for the Company's account. The Company does not keep Personal Information longer than it needs it.

14. AUTOMATED DECISION-MAKING

14.1 The Company does not use a computer program to make a significant decision about you with legal or similarly significant effects.

14.2 CloudTalk Conversation Intelligence may produce transcripts, summaries and tags of calls. Those outputs are operational aids. A human decides whether and how the Company follows up. If that position changes, this Policy will be updated before any such process runs.

15. ANONYMITY AND CHILDREN

15.1 You may deal with the Company anonymously or under a pseudonym where that is practicable (APP 2). For a wholesale product enquiry it is usually not practicable, because the Company needs a work identity to respond, quote or supply.

15.2 The Website and the SMS Program are not directed at children. The Company does not knowingly collect Personal Information from anyone under 16. If you believe it has, write to the Privacy Contact and the information will be deleted.

16. YOUR RIGHTS

16.1 You may ask the Company to do any of the following. The Company will meet the request where the law that applies to you requires it, and as a global operational standard otherwise, unless an exception applies (including another person's privacy, legal privilege, or a legal retention duty):

(a) access the Personal Information the Company holds about you;

(b) correct it if it is wrong, incomplete or out of date;

(d) restrict or object to processing, including processing based on legitimate interests;

(e) receive a portable copy of information you provided, where GDPR Article 20 applies;

(f) withdraw consent, including SMS consent, without affecting processing that already occurred;

(g) complain to the Company and to a supervisory authority under clause 17;

(h) if you are a resident of California, Texas, New York or Florida: the access, correction, deletion and opt-out rights that statute gives you. The Company does not sell Personal Information and does not share it for cross-context behavioural advertising. The Company does not use or disclose sensitive personal information for purposes that require a right to limit under the CPRA.

16.2 The Company will not charge for a first access request unless the law allows a reasonable fee for a clearly excessive or repeated request. The Company may need to verify that you are the person the record is about.

17. EXERCISING RIGHTS AND COMPLAINTS

17.1 Write to the Privacy Contact at kroberts@taurusscaffolding.com, or post to PO Box 315, Virginia QLD 4014, Australia, or telephone 1300 455 444. You do not have to use a particular form.

17.2 The Company will acknowledge a complaint within five business days and aims to respond to access, correction and complaint requests within 30 days, or sooner where the UK GDPR or the EU GDPR requires it.

17.3 If you are not satisfied, you may complain to the Office of the Australian Information Commissioner (www.oaic.gov.au). If you are in the United Kingdom, you may complain to the Information Commissioner's Office (ico.org.uk). If you are in the EEA, you may complain to your local data protection authority. If you are in California, you may contact the California Privacy Protection Agency or the California Attorney General. If you are in Texas, New York or Florida, you may contact the attorney general of that state. If you are elsewhere, you may complain to the privacy or data protection authority where you live. Using those routes does not affect your other legal rights.

18. UNITED STATES NOTICE AT COLLECTION

18.1 This clause 18 is the notice at collection for California, Texas, New York and Florida. In the last 12 months the Company has collected, or will collect, the categories in clause 5 from the sources in clause 6, for the purposes in clause 8. The Company discloses those categories to the processors in Schedule 1 for those purposes.

18.2 The Company does not sell Personal Information. The Company does not share Personal Information for cross-context behavioural advertising. The Company does not offer a financial incentive for Personal Information. Retention is as in clause 13. SMS is as in clause 9. The Company sends SMS to a US mobile only with the consent described in the Terms. The Company does not disclose Personal Information to third parties for their direct marketing (California Civil Code 1798.83).

18.3 Texas is the Company's United States beachhead. New York and Florida are further United States Markets. Mandatory privacy and security laws of those states that cannot be excluded remain available. The Company does not, by this Policy, claim a complete exemption from those statutes.

19. UNITED KINGDOM AND EUROPEAN ECONOMIC AREA

19.1 The Company is not established in the United Kingdom or the EU. The Company may still process Personal Information of people in those places when they enquire, or when processors (including CloudTalk) store recordings in Germany.

19.2 Transfers from the EEA or the United Kingdom to Australia or the United States rely on the processor's Standard Contractual Clauses or another lawful transfer tool where the processor is the exporter, and on APP 8 when the Company is the Australian exporter.

19.3 Because no Article 27 representative is appointed, EEA and UK individuals should contact the Privacy Contact directly. That does not reduce the rights in clause 16. If a representative is appointed, this Policy will name them.

20. UNITED ARAB EMIRATES, KINGDOM OF SAUDI ARABIA AND OTHER COUNTRIES

20.1 If you are in the United Arab Emirates or the Kingdom of Saudi Arabia, you may request access, correction, deletion and information about processing under clause 17. As at the Issue Date the Company has not appointed a local data protection officer in either country. If a filing or representative is required and completed, this Policy will be updated.

20.2 If you are in Japan, Singapore, New Zealand, Canada or another country, use the same request route. Mandatory local consumer or privacy rights that cannot be excluded remain available.

21. DATA BREACHES

21.1 If the Company has reasonable grounds to believe an eligible data breach has occurred under the Privacy Act 1988 (Cth), it will notify the OAIC and affected individuals as that scheme requires. Where GDPR, UK GDPR or applicable United States state law also requires notification, the Company will meet those clocks as well.

21.2 If you think your information has been compromised, write to the Privacy Contact immediately.

22. RELATED BODIES CORPORATE

22.1 The Company is the controller for the Website and the SMS Program. Other companies in the Group may receive business contact details where needed to manufacture, administer or support a supply. They are not authorised to use SMS opt-in data for their own marketing.

22.2 Premier Scaffolds IP Pty Ltd (ABN 45 169 353 164) is the registrant of taurusscaffolding.com.au. Naming that entity is a legal fact about the domain.

23. CHANGES

23.1 The Company may update this Policy. The current version is the version published at https://www.taurusscaffolding.com/privacy-policy. Version 3.1, issued 1 September 2026. Material changes to SMS practices will be reflected before the Company relies on a new consent.

24. CONTACT

24.1 Taurus Scaffolding Systems Pty Ltd, 28 Yarraman Place, Virginia QLD 4014, Australia. Postal: PO Box 315, Virginia QLD 4014, Australia. Telephone: 1300 455 444. Email: info@taurusscaffolding.com. Privacy Contact: kroberts@taurusscaffolding.com. SMS numbers: +1 (346) 684-0599; +1 (253) 544-3217. This Policy: https://www.taurusscaffolding.com/privacy-policy.

SCHEDULE 1 PROCESSORS

S1.1 CloudTalk s. r. o. (Bratislava, Slovakia): telephony, SMS, call recordings and Conversation Intelligence. Countries likely: Slovakia; Germany (recordings and AI data, CloudTalk Privacy Centre retrieved 1 September 2026); Amazon Web Services Frankfurt, Northern Virginia, Singapore and Sydney.

S1.2 Odoo S.A. (Chaussee de Namur 40, 1367 Grand-Rosiere, Belgium): CRM on Odoo Online (taurus-scaffolding.odoo.com). Belgium is the platform operator. The Company is an Australian customer. Odoo's published Oceania region uses Australia for production and Europe (France and the Netherlands) plus Canada for backups (Odoo Privacy Policy retrieved 1 September 2026).

S1.3 Microsoft (Microsoft 365 / Exchange): email and files for info@taurusscaffolding.com and kroberts@taurusscaffolding.com. The Company is established in Australia and is setting up in Texas. Microsoft may process email and files in Australia, the United States and other Microsoft regions.

S1.4 Wix.com Ltd: public Website host, Wix Forms and Wix Promote SEO. Wix site context retrieved 1 September 2026 records country Australia, timezone Australia/Brisbane and currency AUD. Wix processing is typically in Israel and the United States.