WE MAKE A DIFFERENCE

PRIVACY POLICY

We Make A Difference Pty Ltd

ABN 48 626 022 624

ACN 626 022 624

Effective Date: 26/08/2026

1. About This Privacy Policy

We Make A Difference Pty Ltd (WeMAD, we, us or our) respects your privacy and is committed to protecting personal information.

This Privacy Policy explains how WeMAD collects, holds, uses and discloses personal information in connection with its websites, applications, digital wallets, member portals and related services (Platform).

WeMAD handles personal information in accordance with the Privacy Act 1988 (Cth), including the Australian Privacy Principles (APPs), where applicable.

This Privacy Policy should be read together with the WeMAD Member Terms of Use.

2. Program Partners

Access to WeMAD may be provided directly or through an employer, association, club, membership organisation, benefits provider or other organisation (Program Partner).

Where a Program Partner provides or facilitates access to WeMAD, the Program Partner may separately collect and hold personal information about you.

The Program Partner's handling of information within its own systems is governed by its own privacy obligations and privacy policy.

WeMAD is responsible for personal information it holds or controls.

3. Personal Information We May Collect

The information WeMAD collects depends upon how you access and use the Platform.

It may include:

• name;
• email address;
• mobile telephone number;
• address;
• date of birth;
• account identifiers;
• membership or eligibility information;
• employer, association, club or Program Partner information;
• account and profile information;
• transaction history;
• Gift Card purchases;
• Gift Card denominations and Merchants;
• wallet activity;
• Gift Card issuance and delivery information;
• customer service communications;
• complaints and enquiries;
• fraud reports;
• security incident information;
• authentication information;
• device and browser information;
• IP address;
• login and access information;
• session information;
• timestamps;
• referral information;
• Platform usage information; and
• other information reasonably necessary to provide, secure and administer the Platform.

4. Information Provided by Program Partners

Where you access WeMAD through a Program Partner, WeMAD may receive information from that Program Partner for purposes including:

• establishing your eligibility;
• creating or linking your Account;
• authenticating access;
• administering your membership or benefit;
• providing Platform services;
• supporting single sign-on or other integrations;
• investigating suspected fraud;
• investigating unauthorised access;
• responding to security incidents; and
• resolving complaints or disputes.

The information received will depend upon the relevant Program Partner and integration.

WeMAD will only use information received from a Program Partner for purposes permitted by law and reasonably connected with the operation, administration or security of the Platform or another purpose for which you have provided consent.

5. Information We Collect Automatically

When you access or use the Platform, WeMAD may automatically collect technical and usage information including:

• IP address;
• browser type;
• device type;
• operating system;
• login times;
• session information;
• referring website or application;
• pages or Platform functions accessed;
• transaction activity;
• security events;
• authentication events; and
• other technical information associated with your use of the Platform.

This information may be used to operate and improve the Platform and to detect, prevent and investigate fraud, unauthorised access, cyber security incidents and misuse.

6. Cookies and Similar Technologies

WeMAD may use cookies and similar technologies to:

• maintain user sessions;
• authenticate users;
• remember preferences;
• improve Platform functionality;
• understand Platform usage;
• measure performance;
• support security controls; and
• detect suspicious or fraudulent activity.

You may be able to control cookies through your browser settings.

Disabling some cookies may affect Platform functionality or prevent access to certain services.

7. Payment Information

Payments may be processed by third-party payment service providers.

Where payment card information is entered directly into a payment provider's secure payment environment, WeMAD may not receive or store the complete payment card number.

WeMAD may nevertheless receive information associated with a transaction, including:

• payment status;
• transaction identifier;
• payment method information;
• transaction amount;
• fraud or risk information;
• payment verification results; and
• information required for reconciliation, refunds, disputes or chargebacks.

Payment providers handle information in accordance with their own privacy policies and applicable law.

8. Gift Card and Transaction Information

When you purchase or access a Gift Card through WeMAD, we may collect and retain information relating to:

• the Merchant;
• Gift Card type;
• denomination;
• purchase time;
• transaction identifier;
• fulfilment status;
• delivery;
• wallet storage;
• Gift Card access or reveal events;
• available redemption information;
• refunds;
• reversals;
• disputes; and
• fraud investigations.

WeMAD may retain transaction and security records where reasonably necessary for accounting, reconciliation, security, fraud prevention, dispute resolution and legal compliance.

9. How We Use Personal Information

WeMAD may use personal information to:

• provide and administer the Platform;
• create and maintain Accounts;
• verify eligibility;
• authenticate users;
• process transactions;
• procure and fulfil Gift Cards;
• operate digital wallets;
• communicate with users;
• provide customer support;
• process complaints;
• manage refunds and transaction disputes;
• detect and prevent fraud;
• investigate suspected unauthorised access;
• investigate security incidents;
• prevent misuse of the Platform;
• maintain Platform security;
• administer Program Partner arrangements;
• perform reconciliation and reporting;
• improve Platform functionality;
• conduct analytics;
• comply with legal and regulatory requirements; and
• protect the rights, property and security of WeMAD, users, Program Partners, Merchants and other parties.

We may also use personal information for another purpose where you have consented or where permitted or required by law.

10. Fraud Prevention and Security

WeMAD may use personal information and technical information for fraud prevention and security purposes.

This may include information concerning:

• authentication;
• account access;
• device and session activity;
• IP addresses;
• transaction behaviour;
• payment verification;
• Gift Card issuance;
• wallet activity;
• Gift Card access or reveal events;
• suspected unauthorised transactions; and
• other indicators reasonably relevant to fraud or security.

WeMAD may use internal controls and third-party fraud prevention or security service providers to assess transactions and Account activity.

Where activity presents a suspected security or fraud risk, WeMAD may undertake additional verification or temporarily restrict an Account, transaction, wallet or Gift Card while the matter is investigated.

11. Fraud and Security Investigations

Where WeMAD receives a report of fraud, unauthorised Account access, unauthorised Gift Card use or another security incident, WeMAD may collect, use and disclose information reasonably necessary to investigate the incident.

This may include exchanging relevant information with:

• the affected user;
• the relevant Program Partner;
• payment service providers;
• Gift Card suppliers;
• Merchants or issuers;
• fraud prevention providers;
• cyber security providers;
• financial institutions;
• insurers;
• professional advisers;
• law enforcement agencies; and
• regulators,

where reasonably necessary and permitted by law.

Information exchanged will be limited to information reasonably necessary for the relevant investigation, prevention, recovery, legal or security purpose.

12. Program Partner Security Incidents

Where WeMAD reasonably suspects that fraud or unauthorised access may have originated from or involved a Program Partner's systems, WeMAD may request relevant information from the Program Partner and provide relevant information to that Program Partner for investigation.

Information may include, where lawfully available:

• authentication events;
• Account identifiers;
• timestamps;
• access records;
• transaction information;
• security events;
• device or session information; and
• other information reasonably necessary to identify the source, scope and impact of the incident.

WeMAD does not assume responsibility for a Program Partner's handling of personal information within systems that are outside WeMAD's control.

13. Disclosure of Personal Information

WeMAD may disclose personal information where reasonably necessary to:

• Program Partners;
• Gift Card suppliers and distributors;
• Merchants and Gift Card issuers;
• payment service providers;
• fraud prevention providers;
• cyber security providers;
• identity and authentication providers;
• hosting and technology providers;
• communications providers;
• professional advisers;
• insurers;
• auditors;
• regulators;
• law enforcement agencies; and
• other service providers supporting the Platform.

WeMAD does not sell personal information to advertisers.

WeMAD may also disclose personal information where required or authorised by law.

14. Program Partner Reporting

WeMAD may provide Program Partners with information reasonably required to administer their program.

Where practical, reporting may use aggregated or de-identified information.

Identifiable information may be provided where reasonably necessary and lawfully permitted for purposes including:

• eligibility administration;
• Account support;
• fraud investigation;
• security incident management;
• complaint resolution; or
• another authorised program purpose.

WeMAD will not provide Program Partners with unrestricted access to a user's personal information merely because they provide access to the Platform.

15. Aggregated and De-identified Information

WeMAD may create aggregated or de-identified information from Platform usage and transaction information.

Where information has been appropriately de-identified so that an individual is no longer reasonably identifiable, it is not personal information for the purposes of this Privacy Policy.

WeMAD may use aggregated or de-identified information for:

• analytics;
• reporting;
• service development;
• Platform improvement;
• business planning; and
• Program Partner reporting.

16. Direct Marketing

Where permitted by law, WeMAD may use your contact information to communicate with you about products, services, benefits, offers or promotions that may be relevant to you.

You may opt out of marketing communications at any time using the unsubscribe mechanism contained in the communication or by contacting WeMAD.

Opting out of marketing does not prevent WeMAD from sending necessary service communications concerning:

• your Account;
• transactions;
• security;
• Gift Card fulfilment;
• changes affecting the Platform; or
• other administrative matters.

17. Overseas Disclosure

Some of WeMAD's technology, security, payment, fraud prevention, hosting, communications, Gift Card or other service providers may operate or store information outside Australia.

Where WeMAD discloses personal information to an overseas recipient, WeMAD will handle that disclosure in accordance with applicable Australian privacy law.

The countries in which overseas recipients are likely to be located may change as WeMAD's service-provider arrangements change.

Where required by the Australian Privacy Principles, WeMAD will take reasonable steps in relation to overseas disclosures.

WeMAD will maintain information about likely overseas disclosure locations and update this Privacy Policy where appropriate.

18. Data Security

WeMAD takes reasonable steps to protect personal information against:

• misuse;
• interference;
• loss;
• unauthorised access;
• unauthorised modification; and
• unauthorised disclosure.

Security measures may include, as appropriate:

• authentication controls;
• access controls;
• multi-factor or one-time-password authentication;
• encryption;
• logging and monitoring;
• fraud detection;
• security testing;
• restricted administrative access;
• system monitoring;
• incident-response procedures; and
• other technical and organisational safeguards.

No internet-connected system can be guaranteed to be completely secure.

You are also responsible for taking reasonable steps to protect your Account and credentials.

19. Your Security Responsibilities

You should:

• keep passwords confidential;
• protect authentication codes;
• protect your email account and mobile device;
• not disclose one-time passwords to unauthorised persons;
• protect Gift Card numbers, PINs and barcodes;
• log out of shared devices;
• use appropriate device security; and
• notify WeMAD promptly if you suspect unauthorised access.

WeMAD may never need to ask you to disclose your complete password.

20. Data Breaches

WeMAD maintains processes for responding to suspected or actual data breaches.

Where WeMAD becomes aware of a suspected breach affecting personal information it holds, WeMAD may:

• investigate the incident;
• take steps to contain it;
• assess the potential impact;
• undertake remediation;
• cooperate with relevant Program Partners or service providers; and
• notify affected individuals and the Office of the Australian Information Commissioner where required by law.

21. Retention of Personal Information

WeMAD retains personal information for as long as reasonably necessary for the purposes for which it was collected or as required by law.

Relevant considerations may include:

• maintaining your Account;
• providing Platform services;
• transaction and accounting requirements;
• Gift Card fulfilment;
• fraud prevention;
• security investigations;
• disputes and chargebacks;
• contractual obligations;
• insurance requirements; and
• statutory record-keeping obligations.

Where personal information is no longer required, WeMAD will take reasonable steps to destroy or de-identify it where required by law.

22. Access to Your Personal Information

You may request access to personal information WeMAD holds about you.

WeMAD may require reasonable verification of your identity before providing access.

Access may be refused or limited where permitted by the Privacy Act or other applicable law.

Where access is refused, WeMAD will provide the reasons where required by law.

Requests may be sent to:

privacy@wemakeadifference.com.au

23. Correction of Personal Information

WeMAD takes reasonable steps to ensure personal information it holds is accurate, up to date, complete, relevant and not misleading.

If you believe information held by WeMAD is incorrect, you may request correction by contacting:

privacy@wemakeadifference.com.au

WeMAD may take reasonable steps to verify the requested correction.

24. Privacy Complaints

If you believe WeMAD has not handled your personal information appropriately, please contact:

privacy@wemakeadifference.com.au

WeMAD will investigate privacy complaints and endeavour to respond within a reasonable period.

If you are not satisfied with WeMAD's response, you may be entitled to lodge a complaint with the Office of the Australian Information Commissioner (OAIC).

Information about the OAIC and its complaints process is available at www.oaic.gov.au .

25. Third-Party Websites and Merchants

The Platform may contain links to Merchant or other third-party websites and services.

WeMAD is not responsible for the privacy practices of third parties where those parties independently collect or control personal information.

You should review the applicable third party's privacy policy before providing personal information directly to it.

26. Children

The Platform is not intended for use by persons under 18 unless expressly permitted under the applicable WeMAD program and appropriate arrangements have been established.

If WeMAD becomes aware that personal information has been collected contrary to applicable requirements, it will take appropriate steps in accordance with law.

27. Automated Fraud and Security Decisions

WeMAD may use technology to assist in identifying potentially fraudulent, unauthorised or high-risk transactions and Account activity.

This technology may contribute to decisions such as:

• requesting additional authentication;
• delaying a transaction;
• declining a transaction;
• temporarily restricting Account access; or
• referring activity for further review.

Where required by applicable privacy law, WeMAD will provide information about substantially automated decisions that could significantly affect an individual's rights or interests and the types of personal information used in those decisions.

28. Changes to This Privacy Policy

WeMAD may update this Privacy Policy from time to time to reflect:

• changes to the Platform;
• changes to WeMAD's practices;
• new technologies or service providers;
• security requirements; or
• changes in applicable law.

The current version and effective date will be published through the Platform.

Where a change is material, WeMAD may provide additional notice where appropriate.

29. Contact WeMAD

Questions, access requests, correction requests and privacy complaints may be directed to:

We Make A Difference Pty Ltd

ABN 48 626 022 624

ACN 626 022 624

Privacy email: privacy@wemakeadifference.com.au

Postal address: Level 5, 63 Pirie Street Adelaide SA 5000 Australia

Effective Date: 24/08/2026
© We Make A Difference Pty Ltd. All rights reserved.