Metcash Group – General Privacy Policy

Last update: July 2026

1. Introduction

This Privacy Policy explains how Metcash Trading Limited (ABN 61 000 031 569) and its related bodies corporate (collectively, Metcash, we, our or us) collect, hold, use, disclose, and protect your personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) (where you are based in Australia) or the Privacy Act 2020 (NZ) and the Information Privacy Principles (IPPs) (where you are based in New Zealand). To learn more about the food, liquor and hardware businesses in our group, please see the Our Businesses pages on the Metcash website.

This Privacy Policy outlines how we handle the personal information of individuals, particularly when we interact with them as consumers, loyalty program members, business customers (including Metcash retailers), suppliers, business/program partners and applicants for a job or engagement with Metcash.

However, for details about how we handle:

• personal information of employees and contractors of Metcash, please refer to the Metcash Group – Team Members Privacy Policy (which can be obtained by contacting our Group Privacy Officer – please see contact details under section 7 below); and
• credit-related information (e.g. personal information that may have a bearing on credit provided to you or that you have applied for), please also refer to the Metcash Group – Credit Reporting Data Management Policy.

This Privacy Policy outlines our organisational information handling practices. It contains different information sections for different types of individuals with whom we interact. Accordingly, for information about how we handle the personal information relating to:

• individuals, primarily Metcash customers – please see section 3;
• Metcash suppliers and business/program partners – please see section 4; and
• applicants for a job or engagement with Metcash – please see section 5.

Other sections apply generally to all personal information we collect, hold, use or disclose.

This Privacy Policy should be read in conjunction with any privacy notices that are referenced or shown to you when personal information is collected about you for specific purposes (e.g. when you sign up to a loyalty program).

Please note that the handling of personal information by third parties as contemplated in this Privacy Policy will generally be subject to the privacy policies of those third parties.

Metcash may update this Privacy Policy from time to time. The most current version will be made available on our website or can be obtained by contacting our Group Privacy Officer (please see contact details under section 7 below).

2. Definitions

There are terms used in this Privacy Policy that have a specific meaning as follows:

Consumers	Individuals that shop or consume goods or services provided by Metcash, including loyalty program members
Business customers	Entities, other than consumers, that acquire goods or services provided by Metcash (e.g. businesses that acquire goods from Metcash or have a trading account with Metcash or are a Metcash retailer)
Metcash customers	Both consumers and business customers (including Metcash retailers)
Metcash retailer	A business customer operating under a Metcash brand/banner
Personal information	Information or an opinion about an identified, or reasonably identifiable, individual
Sensitive information	A type of personal information that includes information or an opinion about an individual’s: racial or ethnic origin; political opinions or associations; religious or philosophical beliefs; trade union membership or associations; sexual orientation or practices; criminal record; or health or genetic information, or certain aspects of their biometric information.
Team Members	Officers and directors of Metcash, workers engaged by Metcash including employees and independent contractors, labour hire staff, other individuals who are otherwise performing work for the benefit of Metcash who are issued Metcash provided devices and/or email and other individuals that a relevant privacy notice indicates the Metcash Group – Team Members Privacy Policy will apply to.

3. Information for individuals, primarily Metcash customers

This section outlines how we collect, use and disclose the personal information of individuals that we interact with, primarily as a Metcash customer.

For details about how we handle credit-related information, please refer to the Metcash Group – Credit Reporting Data Management Policy.

a. What personal information we collect and how we collect it

(i) Collection from you

We collect your personal information from you in various circumstances such as those outlined below:

Circumstances of collection	Examples of what we collect
When you register for and participate in a loyalty program, set up an account, sign-up for marketing communications and enter promotions or competitions	Your name, contact details, date of birth, age, gender, location-related details (e.g. state or postcode), address, details of transactions or interactions, details of your local/primary/preferred store (or similar), account details (including any loyalty points and rewards earned, received or redeemed), household and demographic details, preferences, job title and records of your promotion or competition entries. In certain circumstances, we may collect information relating to your business (e.g. ABN/ACN or NZBN) (which may be personal information in certain circumstances). When you register for a loyalty program or account, sign-up for marketing communications or enter promotions or competitions, we may link your profile to information we hold about you, such as information relating to your accounts with Metcash and information collected based on your IP address or other technical identifier. For more information about our use of cookies and other similar technologies, please see section 3(b)(ii) (“Digital technologies”) below. Information we collect about you in the future may also be linked to your profile.
When you interact with us online (e.g. when making online purchases or using our websites or apps)	Your name, contact details, payment information, details of transactions or interactions (e.g. when you shopped and the store that fulfilled your order, how you paid and what you purchased), order details, loyalty program membership information or other account information, preferences, user activity, and information regarding your access to and use of websites and apps (including IP address, browser, device and operating system identifier and other technical identifiers, information input, referring domain, links and content accessed, device type, operating system, browser type, location and browsing habits) which may be collected via certain digital technologies as described below in section 3(b)(ii) (“Digital technologies”).
When you interact with us in-store	Payment information, details of transactions or interactions (e.g. when and where you shopped, how you paid and what you purchased), loyalty program membership information or other account information (including loyalty card/member identifier number), and video and/or audio recordings (including via CCTV and other devices). In the event of an incident or injury in a store, we collect your name, contact details and health and medical information. If you procure certain services (e.g. trailer hire), we also collect identity information.
When you interact with us on the phone or via email (e.g. when you contact our customer service teams)	Your name, contact details, details of transactions or interactions and loyalty program membership information or other account information. Where calls are recorded, we also collect audio recordings and may generate transcripts.
When you apply for business customer accounts, trading accounts or credit facilities	Your name, job description, contact details, financial information, bank account details, identity information (such as driver’s licence), date of birth and details relating to your business (which may be personal information in certain circumstances) (e.g. ABN or NZBN). We also collect credit-related information if you wish to establish a trading account or credit facility. Please refer to the Metcash Group – Credit Reporting Data Management Policy for more details.
When you attend a Metcash corporate office, distribution centre or other premises	Your name, contact details, details of the company/business you work for, reasons for your visit/attendance, your photograph and video and/or audio recordings (including via CCTV and other devices).
When you participate in our events or other activities	Your name, contact details, dietary preferences, other details required to complete your registration, feedback following an event, video and/or audio recordings and photographs. Where reasonably necessary, we also collect health information (e.g. details of allergies).
When you submit a query, make a complaint or provide feedback	Your name, contact details, loyalty program membership or other account information, details of your query, complaint or feedback and any responses we provide.

If you do not provide requested personal information:

• you may not be able to access the relevant goods, service, site, event, program, offer, promotion, competition or support;
• we may not be able to personalise your experience or deliver marketing communications that are relevant to you;
• you may not be able to earn, receive or redeem points or rewards as part of a loyalty program;
• you may not be able to obtain a trading account, credit facility or participate in the Metcash network of business customers;
• we may not be able to adequately address your query or concerns; or
• we may not be able to facilitate your attendance at or participation in our events or programs or take reasonable steps to cater for your specific circumstances.

You can, however, use a pseudonym for any interaction with us that does not require your name.

Where you provide us with personal information of other individuals, you must ensure that they are aware of the terms of this Privacy Policy and any applicable privacy notice(s).

(ii) Collection from parties other than you

We collect your personal information from third parties in certain circumstances, including when:

• we manage our shop online programs, in which case we will collect your personal information from Metcash retailers and business/program partners (including delivery partners) to fulfil orders (e.g. receiving confirmations of delivery or collection of an order);
• we carry out a credit check, in which case we will collect your personal information from parties such as credit reporting bodies (please refer to the Metcash Group – Credit Reporting Data Management Policy for more details about how we handle credit-related information);
• we conduct identity verification and relevant checks (e.g. Know-Your-Customer checks and ABN/NZBN look-ups – noting that business-related information may be personal information in certain circumstances). For example, we will collect personal information from publicly available sources (e.g. the Australian Business Register, the New Zealand Companies Office and other government websites/registers) and parties such as service providers and government agencies;
• we carry out reference checks, in which case we will collect your personal information from referees;
• you make a claim against us, in which case we will collect your personal information from legal representatives;
• you participate in Metcash activities or programs (including loyalty programs). For example, we may collect your personal information from our service providers, Metcash retailers and their service providers, business/program partners (including loyalty points earn or redemption partners or rewards providers), operators of associated third party loyalty programs and other relevant program participants. Where the relevant Metcash activity or program involves referring a customer to a business/program partner, personal information collected from that business/program partner may include details relating to the referral (such as goods or services purchased, complaints and queries you submit to the business/program partner and other aspects of your ongoing relationship with the business/program partner);
• we manage promotions and competitions for Metcash retailers, in which case we may collect your personal information (such as name and role) from these Metcash retailers for this purpose, including to ensure only eligible Program members enter certain promotions and competitions;
• you participate in an event, program, promotion or competition that is managed for us by or involves services provided by a third party;
• you respond to surveys or requests for feedback (e.g. product reviews or customer satisfaction surveys), in which case we will collect your personal information (including responses) from third parties that manage and/or analyse the surveys, requests for feedback and/or responses; and
• we use or conduct data analytics. For example, we may collect your personal information from related companies and members of the Metcash group, third parties (such as Metcash retailers and their service providers, suppliers, business/program partners, digital platforms, data brokers and other service providers) or other sources of publicly available information. We may match or combine that information with information we hold about you for the purposes described below in section 3(b) (“Generating insights and business improvements”).

We also collect personal information about you when we (or our service providers) generate insights and inferences about you using data analytics or technologies such as AI.

We may also collect personal information about you from the other parties described below in section 3(c) (“Who we disclose your personal information to”).

b. Why we collect, hold, use and disclose your personal information

(i) Key purposes

We collect, hold, use and disclose your personal information to manage our business, including for the following purposes:

Purposes	Examples of why we collect, hold, use and disclose personal information
Providing products, services and other benefits	processing and delivering orders; managing payments and transactions (including issuing receipts); operating, developing and promoting Metcash programs (including loyalty programs) and events; managing, designing, and implementing promotions, competitions and offers (including those of Metcash and selected third parties); ensuring you are eligible to register for Metcash programs, accounts, offers, promotions and competitions and to obtain relevant goods and/or services; sending (or enabling the sending of) surveys or requests for feedback regarding purchases, shopping experiences, products and/or services; and ensuring you are able to (and are eligible to) access relevant parts of our platforms (e.g. websites and apps).
Managing relationships with Metcash customers	managing Metcash customer accounts (including trading accounts and loyalty membership accounts) and associated contracts; assessing and processing applications for accounts (including conducting credit checks); assessing the ongoing operation of Metcash retailers; responding to queries, complaints and feedback; and managing claims.
Communicating and promoting products, services and other benefits	sending communications about Metcash programs (including loyalty programs) and communications related to other services or accounts; informing Metcash business customers of upcoming campaigns; announcing or notifying prize or competition winners; personalising your experience while you are on our platforms (such as websites and apps); and sending or displaying Metcash and third party offers and promotions (including marketing communications and advertising on our platforms and third party websites and apps such as social media platforms). For further information about this, and how you can unsubscribe from such offers and promotions, please click here. For more details about how we use certain digital technologies for marketing purposes and personalisation, please see section 3(b)(ii) below (“Digital Technologies”).
Generating insights and business improvements	using or conducting data analytics (including about buying preferences and trends); and/or matching or combining personal information we hold with other information we hold about you or information held by related companies and Metcash group members or from third parties (such as Metcash retailers, suppliers, digital platforms, data brokers and other service providers) or publicly accessible sources, to generate insights that help: better understand Metcash customer needs, preferences and experiences; identify customers with similar characteristics to another group of customers; improve the relevance of offers and promotions (including those of third parties) for Metcash customers; and develop and enhance marketing, products, services, platforms and systems of both Metcash and third parties. For more details about how we use certain digital technologies for data analytics purposes, please see section 3(b)(ii) below (“Digital Technologies”).
Protecting people, assets (including data) and our business	managing and preventing theft, fraud, misconduct, and criminal activity; protecting information that we hold; managing the safety and security of our premises, people and assets (including data); preventing access to relevant parts of our platforms (e.g. Program websites and apps) and services, where necessary (e.g. due to security reasons or age-based restrictions) or requested (e.g. in the case of self-exclusion); and training Team Members and Metcash retailers.
Complying with laws and regulations and other applicable requirements, and obtaining advice	conducting identity verification and relevant checks (e.g. Know-Your-Customer checks); lodging securities on the Personal Property Securities Register (PPSR); complying with court orders or subpoenas; complying with liquor laws, including age-based restrictions and laws regarding dry zones (i.e. areas where consumption, sales and deliveries of alcohol are prohibited); and obtaining professional advice (e.g. legal, accounting, auditing or consulting advice).
Managing administrative matters	managing retention and storage of data (including with third party service providers); supporting corporate transactions (e.g. mergers and acquisitions) which, for example, may include disclosures to proposed or actual purchasers of our business or assets; and calculating commissions payable (where referral or similar arrangements are involved).

We may also de-identify and/or aggregate personal information, and use and disclose the de-identified and/or aggregated data for any purpose.

In addition, we collect, hold, use and disclose your personal information for other purposes permitted by law or as outlined in relevant privacy notices or as disclosed to you from time to time.

(ii) Digital technologies

We use digital technologies, such as cookies, device identifiers, pixels, location services, software development kits (SDKs), APIs, tags, web server logs and web beacons, in connection with our websites, apps, social media pages, other digital portals and digital marketing initiatives (e.g. in relation to online behavioural advertising and other targeted advertising, surveys, analytics and campaign tracking). Where such technologies collect personal information, this Privacy Policy applies to our handling of that information.

These digital technologies help us track user traffic and activity (e.g. pages visited, content viewed, and times and dates of visits). This allows us to better serve you, for example, by improving your browsing experience, tailoring offers and promotions to you, and remembering your preferences for future visits to our platforms. We also use this information for security purposes as well as platform maintenance and evaluating and improving the performance of our platforms and communications. See section 3(a)(i) above (“Collection from you”) for more detail about the kinds of information we collect using these digital technologies.

The digital technologies described above may be provided by third parties and may include Google Analytics, Google AdSense, Google Ads, Google Data Cloud, Google Looker Studio, Google Tag Manager, Meta Pixel, Segment, Microsoft Clarity, Microsoft Ads, Bing Ads, Facebook Ads, Double Click, Trade Desk, Auth0, Content Square and Apps Flyer. These third parties may collect or receive information from our websites, apps and elsewhere on the internet and third parties, including Google and Meta, may use that information to provide measurement services, target and deliver ads and conduct other similar campaign management activities (as further contemplated above). You can find out more about these technologies, how your data is collected and handled by the relevant third parties and how you can opt-out of certain practices in their applicable privacy policies and other consumer-facing documentation.

For example, information about how Google uses information from sites or apps that use its services is located at www.google.com/policies/privacy/partners/, or any other URL that Google may provide from time to time.

You may need to opt-out separately from each technology.

The websites optout.aboutads.info, thenai.org and www.youradchoices.com also offer facilities for you to opt-out of online behavioural advertising from a number of advertising industry participants and explain how online behavioural advertising works. You can contact privacy@metcash.com to opt out of any Metcash businesses you specify using or disclosing your personal information for online behavioural advertising. Your browser may allow you to turn off or disable cookies and certain other digital technologies. Your phone or app settings may also allow you to review and adjust certain permissions relating to tracking technologies (e.g. controls that limit access to your location or restrict tracking of your activities across apps and websites).

Please note, however, that if you turn off or disable these digital technologies or do not provide certain permissions, you may not be able to experience the full functionality of our platforms and associated services.

c. Who we disclose your personal information to

We disclose your personal information to third parties including:

• related companies and members of the Metcash group (including Team Members);
• agents;
• credit reporting bodies and credit providers;
• legal representatives or advisors (e.g. where you make a claim against us);
• service providers (e.g. providers of technology, business support, data, analytics and marketing services);
• delivery or logistics providers and other suppliers (e.g. to support the delivery or receipt of goods);
• digital platforms with whom we engage or advertise or use to create advertising segments or audiences or generate other insights;
• Metcash retailers, suppliers, business/program partners (including loyalty points earn or redemption partners or rewards providers, including to advertise and promote their goods and services);
• third party goods or services providers where we facilitate your purchase of their goods or services or act as an introducer or referral partner;
• payment processing providers, financial institutions and payment schemes (e.g. in connection with facilitation of payments, fraud or scam prevention and management and administration of payment functionality and any payment disputes);
• professional advisors (e.g. legal, accounting, auditing or consulting advisors);
• regulatory authorities, enforcement bodies, emergency responders and government agencies;
• where we are announcing prize or competition winners, members of the public;
• state and territory lottery departments;
• insurers or insurance brokers (where there is a relevant claim);
• parties to relevant corporate transactions (including investors and purchasers of all or parts of our business or assets, whether prospective or otherwise); and
• other third parties where relevant for purposes described above in section 3(b) (“Why we collect, hold, use and disclose your personal information”) or in the Metcash Group – Credit Reporting Data Management Policy;

We also disclose your personal information when permitted or required by law (e.g. in response to a subpoena).

Some of the third parties that your personal information is disclosed to are located overseas, including the following countries: United States, Canada, United Kingdom, Ireland, Romania, Turkey, China, Singapore, Thailand, Vietnam, the Philippines, India, Pakistan, New Zealand (where you are based in Australia) and Australia (where you are based in New Zealand).

4. Information for Metcash suppliers and business/program partners

This section is applicable to our handling of personal information of individuals we interact with as a supplier of goods and/or services or a business/program partner (e.g. a party who provides benefits associated with Metcash programs), or a representative of any such business.

a. What personal information we collect and how we collect it

(i) Collection from you

We collect your personal information from you in various circumstances such as those outlined below:

Circumstances of collection	Examples of what we collect
When assessing the suitability of, or onboarding, your business as a supplier	Your name, job description, contact details, financial information, identity information (such as driver’s licence), date of birth and details relating to your business (which may be personal information in certain circumstances).
When engaging with your business as a business/program partner	Your name, job description, contact details and details relating to your business (which may be personal information in certain circumstances).
When you attend a Metcash corporate office, distribution centre or other premises	Your name, contact details, details of the company/business you work for, reasons for your visit/attendance, your photograph and video and/or audio recordings (including via CCTV and other devices).
When you participate in our events or other activities	Your name, job description, contact details, details relating to your business (which may be personal information in certain circumstances), dietary preferences, other details required to complete your registration, feedback following an event, video and/or audio recordings and photographs. Where reasonably necessary, we also collect health information (e.g. details of allergies).
When you otherwise engage or interact with us	Your contact details and details of communications and interactions with us. Where this interaction is online or via an application or portal, this may capture your user or login details, preferences, user activity, information regarding your access to and use of websites and apps (including IP address, browser, device and operating system identifier and other technical identifiers, information input, referring domain, links and content accessed, device type, operating system, browser type, location and browsing habits) which may be collected via certain digital technologies as described above in section 3(b)(ii) (“Digital technologies”).

If you do not provide requested personal information, we may not be able to:

• engage your business as a supplier or business/program partner (or consider your business’ application to become a supplier or business/program partner);
• provide you with access to our sites or premises; or
• facilitate your attendance at or participation in our events or programs or take reasonable steps to cater for your specific circumstances.

Where you provide us with personal information of other individuals, you must ensure that they are aware of the terms of this Privacy Policy and any applicable privacy notice(s).

(ii) Collection from parties other than you

We collect your personal information from third parties in certain circumstances, including when we conduct identity verification and relevant checks, carry out reference, financial, credit or background or probity checks (or similar) or are otherwise assessing your suitability as a supplier or business/program partner. We may also collect your personal information from:

• your colleagues (e.g. where user accounts on our portals, contact lists or similar are established by administrative personnel at your organisation or where details of officers or management are provided to us for relationship management or probity purposes or similar); and
• from publicly accessible sources of information and Team Members.

We also collect personal information about you when we (or our service providers) generate insights and inferences about you using data analytics or technologies such as AI.

We may also collect personal information about you from the other parties described below in section 4(c) (“Who we disclose your personal information to”).

b. Why we collect, hold, use and disclose your personal information

We collect, hold, use and disclose your personal information to manage our business and network of suppliers and business/program partners, including for the following purposes:

Purposes	Examples of why we collect, hold, use and disclose personal information
Managing supplier and business/program partner selection, onboarding and relationships	conducting procurement processes (including conducting relevant due diligence and managing contracts); conducting compliance checks; processing and making payments; maintaining supplier and business/program partner relationships; and managing claims.
Generating insights and business improvements	using or conducting data analytics to generate insights that help us better understand and improve our business (including procurement activities and practices).
Protecting people, assets (including data) and our business	managing and preventing theft, fraud, misconduct, and criminal activity; protecting information that we hold; managing the safety and security of our premises, people and assets (including data); preventing access to relevant parts of our platforms (e.g. Program websites and apps) and services, where necessary (e.g. due to security reasons); and training Team Members.
Complying with laws and regulations and other applicable requirements, and obtaining advice	conducting identity verification and relevant checks (e.g. Know-Your-Customer checks); complying with court orders or subpoenas; and obtaining professional advice (e.g. legal, accounting, auditing or consulting advice).
Managing administrative functions	managing retention and storage of data (including with third party service providers); and supporting corporate transactions (e.g. mergers and acquisitions) which, for example, may include disclosures to proposed or actual purchasers of our business or assets.

We may also de-identify and/or aggregate personal information, and use and disclose the de-identified and/or aggregated data for any purpose.

In addition, we collect, hold, use and disclose your personal information for other purposes permitted by law or as outlined in relevant privacy notices or as disclosed to you from time to time.

c. Who we disclose your personal information to

We disclose your personal information to third parties including:

• related companies and members of the Metcash group (including Team Members);
• agents;
• credit reporting bodies and credit providers;
• legal representatives or advisors (e.g. where you make a claim against us); and
• service providers (e.g. providers of technology, business support, data, analytics and marketing services);
• delivery or logistics providers and other suppliers (e.g. to support delivery or receipt of goods);
• business customers (including Metcash retailers), suppliers and other business/program partners;
• third party goods or services providers where we facilitate your purchase of their goods or services or act as an introducer or referral partner;
• payment processing providers, financial institutions and payment schemes (e.g. in connection with facilitation of payments, fraud or scam prevention and management and administration of payment functionality and any payment disputes);
• professional advisors (e.g. legal, accounting, auditing or consulting advisors);
• regulatory authorities, enforcement bodies, emergency responders and government agencies;
• insurers or insurance brokers (where there is a relevant claim);
• parties to relevant corporate transactions (including investors and purchasers of all or parts of our business or assets, whether prospective or otherwise); and
• other third parties where relevant for the purposes described above in section 4(b) (“Why we collect, hold, use and disclose your personal information”).

We also disclose your personal information when permitted or required by law (e.g. in response to a subpoena).

Some of the third parties that your personal information is disclosed to are located overseas, including the following countries: United States, United Kingdom, China, Thailand, the Philippines, Pakistan, India, Germany, New Zealand (where you are based in Australia) and Australia (where you are based in New Zealand).

5. Information for applicants for a job or engagement with Metcash

This section is applicable to our handling of personal information of individuals we interact with as applicants for a job or engagement with the Metcash Group.

Please note that where you are successful in obtaining employment or an engagement with Metcash, your personal information will be handled in accordance with the Metcash Group – Team Members Privacy Policy (a copy of which can be obtained by contacting our Group Privacy Officer – please see contact details under section 7 below).

a. What personal information we collect and how we collect it

(i) Collection from you

We collect your personal information from you in various circumstances such as those outlined below:

Circumstances of collection	Examples of what we collect
When you apply for a job or engagement with Metcash	Your name, contact details, address, resume details, employment history, education details, date of birth, identity information, background information, rights to work-related information (e.g. visa status and conditions, citizenship details, residency or immigration status, and work eligibility details), salary expectations, existing notice periods, conflict of interest declarations, emergency contact details and details of your interactions with us. We also collect sensitive information, such as health information (e.g. results of pre-employment medical checks, and details relating to medical conditions, disabilities or injuries), information relating to criminal or civil offences, and information relating to whether you identify as Aboriginal or Torres Strait Islander. We also collect information relating to background checks (which may include police and criminal history checks and right to work checks). We do not require the provision of information about trade union membership but may collect this where it is provided to us or as permitted by law.
When you attend an interview	Your name and interactions with us during the interview. Where an interview takes place at a Metcash site, we also collect your contact details, reasons for your visit/attendance, photograph and video and/or audio recordings (including via CCTV and other devices). Where an interview takes place online or via phone, we may also record the interview and generate a transcript.

If you do not provide requested personal information, we may not be able to:

• consider or process your application for a role or engagement with Metcash;
• provide you with access to our sites or premises; or
• provide you with a relevant response or support.

Where you provide us with personal information of other individuals, you must ensure that they are aware of the terms of this Privacy Policy and any applicable privacy notice(s).

(ii) Collection from parties other than you

We collect your personal information from third parties in certain circumstances, including when:

• we are managing and assessing your suitability for a role with us. For example, we collect personal information about you (e.g. information about your background, criminal records, health and identity, results of psychometric testing, and details available through publicly accessible sources of information) from service providers (e.g. recruitment agencies, identity verification, background and criminal history check and psychometric testing service providers and pre-employment medical checks service providers), educational and training institutions, government sources, referees or other sources of reference checks, Team Members, and publicly accessible sources of information (e.g. LinkedIn and social media accounts);
• we conduct pre-employment medical checks. For example, subject to your authorisation, we collect health information (including medical reports and results) about you from pre-employment medical checks service providers, medical practitioners and other health service providers; and
• we need to verify your rights to work in Australia or New Zealand (as applicable). For example, where you hold a visa, we may verify your right to work in Australia by conducting a Visa Entitlement Verification Online (VEVO) check, or your right to work in New Zealand by conducting an Immigration New Zealand VisaView check, which involves collection of personal information about you from government agencies.

We may also collect personal information about you from the other parties described below in section 5(c) (“Who we disclose your personal information to”).

b. Why we collect, hold, use and disclose your personal information

We collect, hold, use and disclose your personal information to manage our business and recruitment, including for the following purposes:

Purposes	Examples of why we collect, hold, use and disclose personal information
Managing recruitment and applications for jobs and engagements with Metcash	processing and assessing applications (including psychometric or behavioural assessments and associated results); checking and confirming your identity, fitness to work, work history, education details, references, rights to work (e.g. visa status, citizenship details and work eligibility details) and background details and criminal history checks; responding to queries, complaints and feedback; maintaining details of potential candidates who may be suitable for current or future job openings with Metcash; and managing claims.
Protecting people, assets (including data) and our business	managing and preventing theft, fraud, misconduct, and criminal activity; protecting information that we hold; managing the safety and security of our premises, people and assets (including data); preventing access to relevant parts of our platforms (e.g. Program websites and apps) and services, where necessary (e.g. due to security reasons); and training Team Members.
Complying with laws and regulations and other applicable requirements, and obtaining advice	complying with court orders or subpoenas; and obtaining professional advice (e.g. legal, accounting, auditing or consulting advice).
Managing administrative matters	managing retention and storage of data (including with third party service providers); and supporting corporate transactions (e.g. mergers and acquisitions), which, for example, may include disclosures to proposed or actual purchasers of our business or assets.

We may also de-identify and/or aggregate personal information, and use and disclose the de-identified and/or aggregated data for any purpose.

In addition, we collect, hold, use and disclose your personal information for other purposes permitted by law or as outlined in relevant privacy notices or as disclosed to you from time to time.

c. Who we disclose your personal information to

We disclose your personal information to third parties including:

• related companies and members of the Metcash group (including Team Members);
• agents;
• legal representatives or advisors (e.g. where you make a claim against us);
• where relevant, your employer;
• service providers (e.g. recruitment agencies) and parties assisting with conducting relevant checks (e.g. identity verification, reference, fitness to work, background and criminal or police checks);
• approved providers in relation to fitness for work assessments or injury management;
• health service providers (including medical practitioners) for medical and fitness for work checks;
• professional advisors (e.g. legal, accounting, auditing or consulting advisors);
• regulatory authorities, enforcement bodies, emergency responders and government agencies;
• parties to relevant corporate transactions (including investors and purchasers of all or parts of our business or assets, whether prospective or otherwise); and
• other third parties where relevant for purposes described above in section 5(b) (“Why we collect, hold, use and disclose your personal information”).

We also disclose your personal information when permitted or required by law (e.g. in response to a subpoena).

Some of the third parties that your personal information is disclosed to are located overseas, including the following countries: United States, United Kingdom, China, Thailand, Germany, New Zealand (where you are based in Australia) and Australia (where you are based in New Zealand).

d. Automated decisions

Metcash and its service providers may use computer programs to filter job applications to Metcash based on minimum criteria applicable to available jobs. For example, the program may filter out job applications where the applicant does not have a requisite licence (e.g. forklift licence) to perform the role. Applications that are filtered by the program will not progress to the next phase of review and assessment.

The program will process personal information provided in job applications or otherwise provided by the job applicant (e.g. through interactions with Metcash or its service providers (such as recruitment agencies). Whilst the program will automatically filter out applications that do not meet minimum criteria, the criteria are set by Metcash.

6. How we seek to secure your personal information

We take reasonable steps to ensure that security protections are in place in relation to personal information held by Metcash.

Security measures include encryption, access controls, secure disposal and/or de-identification.

7. How you can request access and corrections to your personal information or lodge queries and complaints

You have the right to request access to, or correction of, any personal information we hold about you.

To seek access to or correction of your personal information, submit a privacy query or complain about a privacy issue, please contact:

Group Privacy Officer, Metcash Trading Limited
Email: privacy@metcash.com

Alternatively, to seek access to or correction of your personal information, you may (where applicable):

• contact the email address specified in the relevant privacy notice; or
• access your account/membership profile via the relevant Metcash app or website.

We seek to acknowledge, and investigate within a reasonable time, any complaint about the way we handle personal information.

If we have not resolved your privacy complaint or responded to your satisfaction, you can also make a complaint about a privacy issue to the Office of the Australian Information Commissioner at enquiries@oaic.gov.au or www.oaic.gov.au, or, if your complaint relates to our handling of your personal information under New Zealand law, to the Office of the Privacy Commissioner (New Zealand) by calling 0800 803 909 or through www.privacy.org.nz.

For any complaints relating to Metcash that do not relate to this Privacy Policy, please find relevant contact details here.