We're Australia's leading retail drinks and hospitality business. This Policy sets out how we handle personal information.

About Endeavour Group

Endeavour Group Limited (ABN 77 159 767 843) (Endeavour Group) owns and operates drinks retailers and licensed venues across Australia. Our brands include Dan Murphy’s, BWS, Langtons, ALH Group and Paragon Wine Estates.

This Policy

When we collect personal information, we’re required to comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

This Policy applies to all the personal information that we collect as part of our Australian businesses and operations. This includes the information that we collect from:

• people who shop with us or use our services, both in-person and online

• people who sign up for our membership programs or participate in our surveys and competitions

• people we work with, including employees, job applicants, contractors and sub-contractors, partners and third-party service provider representatives, and business contacts.

We update this Policy from time to time. You can always find the most up-to-date version on our website at https://www.endeavourgroup.com.au/privacy-policy.

When you use our apps or websites or visit our venues, we collect the information about you that we need to run our business.

We may collect your personal information where you agree and when we reasonably need it to carry out our functions and activities, manage our business, or comply with the law.

We generally only collect personal information when you engage with us. We may do this when you sign up for one of our membership schemes and use your account, browse or buy things online, visit our shops or venues, respond to our surveys, enter our competitions, call us, or interact with us directly or indirectly online.

For example:

• When you sign up for one of our membership programs, we collect your first and last name, contact details (including email address and mobile number), gender and date of birth.

• When you use your membership account, we collect information about purchases for which you earn points, and how you use your points.

• When you shop with us, in person or online, or visit our venues, we may collect information about:

• your membership card number

• your orders or purchases

• how you paid for your orders or purchases

• payment card details

• your contact details or the contact details of your nominated person, for services such as pick up, home delivery or special orders

• your behaviour on our websites and apps, including items you view, promotions you activated, and items you have added to your cart

• information on your valid government ID (such as your driver’s licence) if you want to purchase or use certain products (such as alcohol, tobacco or gaming) or use certain services we provide

• the mobile devices or smart devices (such as smart watches) that you install our apps on, including the current location of your device, type and version of your browser, and your device ID and other device metrics, where your device permissions allow

• security camera footage and other data which may identify you

• your contact details, if our security or team members are investigating a security or safety incident, if you are injured, or witness an incident in any of our shops or venues.

• When you buy one of our gift cards or gift products online, we may collect:

• your contact details or the contact details of the recipient

• the gift card ‘Card Number’ and the corresponding ‘PIN’

• the balance on the gift card.

• When you participate in our competitions or promotions, we may collect:

• information you provide to us so you can be part of the competition or promotion

• images or video that you have provided to us or posted online as part of the competition or promotion.

• When you apply to work with us, we will collect your name, personal contact details, work history and qualifications, and reference information.

• When you are a professional contact, we may collect information about you if you are a representative of a partner, contractor, subcontractor, or third-party provider.

What if you don't want to give us your personal information?

We give people the option of not identifying themselves, where it is lawful and practical.

However, in some cases, if you don't give us your personal information, we may not be able to respond to your request or give you the service you want. For example:

• We’re required by law to check proof of age in some cases, such as when you wish to buy alcohol or tobacco products.

• You’ll need to identify yourself to sign up for our membership programs.

• You’ll need to identify yourself to make an order for pick up or delivery.

Cookies and web analytics

When you visit our apps and websites, we may use methods such as ‘cookies’ and pixel tracking to collect anonymised information and statistics such as your IP address, general location, and which pages you visit, and to help show you relevant content on our sites and other sites. We may share this information with our advertising partners. You can read more in our Cookies Statement.

We collect, use and disclose your personal information to carry out our functions and activities, manage our business and comply with the law.

Purposes of collection

For example, we collect, use and disclose personal information for the following purposes:

• Personalisation: To identify your preferences, recommend features, products, and services that may interest you, and personalise your experience with us.

• Promoting products and services: To send you offers and other messages you may be interested in, either offered by us or offered by our third-party marketing partners.

• Membership programs: To run our membership programs and to create, manage, and secure your membership account.

• Safety, security and fraud detection: To keep our customers, visitors and staff safe, in-store and online, manage security incidents, prevent fraud, and enable investigations.

• Improve our services and customer experience: To analyse performance, and improve our systems and services.

• Fulfilling gift orders: When you purchase a gift for someone, to let the recipient know who the purchaser is and to send them any gifting content you have created.

• Manage our staff: Including advertising staff or volunteer roles, engaging staff, and managing those relationships.

• Manage our relationships with partners and third-party providers.

• Processing payments.

• Legal and licensing requirements: To comply with legal requirements and obligations, including those which may relate to our licenses, such as reporting to regulators and enforcement bodies.

• Responsible service: To meet our responsible service of alcohol and gambling commitments.

• Manage questions, requests and complaints: These may be from you or third parties including government agencies and enforcement bodies. You can also learn more about how to access or correct your personal information in Sections 5 and 6

• Business administration purposes: For example if we’re involved in a takeover or merger, or propose to sell any part of our business, we may need to share your personal information as part of the restructure, takeover or merger.

We may also use or disclose your personal information for other purposes that are allowed by law.

Direct marketing

Where you have created an account with us, we may use your personal information to send you marketing messages. This may include contacting you in various ways, including by mail, email, SMS or phone.

You can opt out of receiving marketing messages at any time:

• For emails and SMS messages, you can use the unsubscribe option included in the message. In limited circumstances, our cybersecurity controls may block you from accessing our sites in order to unsubscribe. If this happens, please send an email to [email protected] with the brand and channel(s) (i.e. email or SMS) that you wish to unsubscribe from and we will ensure that your request is actioned as soon as possible.

• For phone calls, you can tell the caller that you no longer wish to receive calls or other marketing messages.

Retention

We aim to keep your personal information for as long as we need it to do our work and comply with the law. When we no longer need it, we work to destroy or de-identify it.

Third parties

We partner with other organisations or hire other companies to help us do our work (‘third parties’). These third parties may collect your personal information on our behalf and provide it to us. We may also share your personal information with these third parties. These third parties may include:

• information technology and data storage providers, research and statistical analysis providers, and selected marketing partners

• partners or related organisations

We may also collect personal information from partners and combine different sets of data to add to the personal information we hold. An example of this is a history of a member’s transactions from use of the same payment card for purchases at one or more of our businesses.

When we work with third parties, we require them to handle your personal information safely and in a way that meets Australian privacy laws.

We sometimes disclose or store personal information outside of Australia. When we do this, we take steps to keep it safe.

In some cases, we may disclose personal information outside Australia – for example, to a third-party technology service provider or partner. When we do this, we require them to handle your personal information safely, and in a way that meets Australian privacy laws.

What are your rights?

You have the right to access the personal information that we hold about you, and ask us to update or correct it if it is not accurate.

There are some exceptions to these rights. For example, we can’t give you access to personal information about other people, or if it contains commercially sensitive information.

We’ll agree to your request if it’s reasonable and lawful for us to do so. If we don’t agree, or we only partially agree, we’ll:

• write to you to explain our decision (except if it’s unreasonable to do so), and

• give you information on your options, including how to make a complaint.

Is there a fee?

If it will take a long time for us to satisfy your request, we may charge a fee, depending on the complexity and size of your request, to cover the time we spend finding and putting together the personal information you want. If there is a fee, we will let you know how much it will likely be, so you can choose if you want to go ahead.

How long will it take?

We’ll respond to your request within 30 days. We will let you know if we think it will take us more than 30 days to meet your request.

Before we manage your request, we will need to confirm your identity to protect your information.

How can you contact us?

See ‘Contact Us’, below.

If you’re concerned about how we have handled your personal information, please let us know and we’ll try to fix it.

If you’re not satisfied with how we have handled your complaint, you can contact the Office of the Australian Information Commissioner.

How can you make a privacy complaint?

If you’re concerned about your privacy or how we’ve handled your personal information, you can let us know and we’ll try to fix it (see ‘Contact us’, below).

How do we manage privacy complaints?

We will:

• keep a record of your complaint,

• write to you within 30 days to acknowledge your complaint,

• investigate your complaint (including, for example, gathering the relevant facts, locating and reviewing relevant documents and speaking to relevant individuals), and

• write to you with our final response, including our view on whether we have not complied with this policy or relevant privacy laws, and what we will do to fix the issue.

In most cases, we’ll give you a final response within 30 calendar days of receiving your complaint. If we can’t respond in that time, we’ll get in touch to tell you why and work out a new timeframe with you.

What else can you do?

If you’re not satisfied with how we have managed your complaint, you can contact the Office of the Australian Information Commissioner:

Phone: 1300 363 992

Email: [email protected]

Website: www.oaic.gov.au

Complaints form: https://www.oaic.gov.au/privacy/privacy-complaints

Please contact us if you have any questions or concerns about how we handle your personal information.