1. PURPOSE

The purpose of this Privacy Policy is to outline:

• the kind of information RDC Media may collect about you, how it is collected and how it is held by RDC Media;
• the purposes for which RDC Media collects, holds, uses and discloses personal information;
• how RDC Media may disclose that information;
• how an individual can access the information held about him or her and seek correction of such information (if required);
• when RDC Media may use an individual's information to contact them; and
• the protection of an individual's personal information.

RDC Media abides by the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth) (Privacy Act). Further information in relation to RDC Media's Privacy Policy can be obtained by contacting RDC Media's Privacy Officer (please refer below for contact details).

This Privacy Policy will be reviewed regularly and may be updated from time to time and published on the relevant Website (as defined in section 9 below).

2. SCOPE

This Privacy Policy applies to all personal information collected by Racing.com Media Pty Ltd (ABN 55 643 473 376) when trading as:

• Racing.com;
• Best Bets;
• Winning Post; and
• Racing Photos.

(together, RDC Media).

RDC Media is a wholly owned subsidiary of Racing Victoria Limited ACN 096 917 930 (Racing Victoria). RDC Media will only collect personal information or sensitive information that is reasonably necessary for, or directly related to, one of its functions or activities. This Privacy Policy applies to all personal information collected by RDC Media, whether RDC Media has asked for the information or not.

3. RDC MEDIA'S FUNCTIONS AND ACTIVITIES

RDC Media's functions and activities include:

• marketing, promotion and distribution of Victorian thoroughbred horse racing, as well as selected national and international thoroughbred horse racing;
• holding, managing and exploiting the Victorian thoroughbred horse racing media broadcasting rights and intellectual property rights;
• creating and maintaining information and records in relation to customers and/or subscribers and their interests in race horses;
• provision of the Racing.com, Best Bets, Winning Post, Racing Photos websites and social platforms and the Racing.com mobile apps (iOS and Android);
• production and provision of thoroughbred racing industry services, including:
  • tipping and betting publications, forums, communications and websites;
  • professional racing photography and memorabilia;
  • subscription and bespoke breeding and pedigree reports;
  • provision of news and information related to the thoroughbred racing industry including race form;
  • targeted promotion of industry related events, promotions and competitions;
  • provision of aggregated data, industry related communications and news service; and
  • advertising services.

4. COLLECTION OF INFORMATION

Personal Information

Personal information is information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether true or not, and whether recorded in a material form or not. Personal information includes information such as:

• an individual's name or address;
• bank account details and credit card information; or
• information about an individual's opinions, likes and dislikes.

RDC Media will not collect personal information unless collection of such information is reasonably necessary to enable RDC Media to carry out one or more of its functions and/or activities.

We are generally exempt from the Privacy Act when we handle employee records, and this Privacy Policy does not apply to that information. However, where State or Territory health privacy legislation applies, we are still required to protect the privacy of employee health information. This Privacy Policy will apply in those circumstances.

Solicited Information

RDC Media holds and uses personal information about its suppliers, customers, Website users and subscribers. Typically, this information includes a person's name, email address, phone number, address, date of birth, gender and any other required information.

This information is needed to maintain RDC Media's records in a format that identifies the person. These records are held by RDC Media for the purposes of enabling RDC Media to:

• provide goods and/or services to its customers, including subscriptions, news, communications (including publications and newsletters) and process the purchase of products / memorabilia;
• conduct competitions or promotions;
• measure and improve the services and features of the Website in order to provide the individual with the best service experience possible on the Website;
• promoting the thoroughbred racing industry;
• engage suppliers; and
• otherwise perform its functions and activities as outlined above.

RDC Media collects personal information only by lawful and fair means. Information is collected from the individual unless it is unreasonable or impracticable to do so. This is generally directly from an individual in the course of their visit to the Website and includes but is not limited to, situations where an individual inputs personal information to:

• register to become a subscriber to any of RDC Media's businesses including to Racing+, Best Bets, Racing Photos, form guides, newsletters and/or communications;
• submit a purchase order for RDC Media's products/goods;
• submit general enquiries or feedback;
• submit job applications;
• submit of entries into competitions for which RDC Media is the promoter; and
• post comments on the Website; or
• becomes an advertiser.

RDC Media may otherwise collect information directly from you, from third parties and/or publicly available sources, including but not limited to the following:

• your image, where we are photographing your participation or attendance at a race meeting;
• from race results, licensed participant profiles, articles or other resources on other websites;
• when someone provides your personal information to us on your behalf, such as when submitting a letter to the editor in Winning Post or making a complaint;
• from third parties including Racing Australia and Racing Victoria;
• through social networking sites such as LinkedIn or Facebook or from your professional reference where you are applying for employment at RDC Media;
• if authorised or required by law;
• with your consent; or
• as otherwise required to enable RDC Media to fulfill it functions and activities as outlined in Section 3.

Unsolicited Information

If RDC Media receives personal information about an individual in circumstances where it did not solicit the information, RDC Media will (within a reasonable period after receiving the information) determine whether or not it would have been entitled to collect such information having regard to its functions and activities. If RDC Media determines that it is not entitled to such information, RDC Media will destroy the information or ensure that the information is de-identified.

Sensitive Information

Sensitive information is a subset of personal information that is generally afforded a higher level of privacy protection. Examples include information about an individual's:

• racial or ethnic origin;
• health or medical information;
• membership of a political association, professional or trade association or trade union;
• criminal record; or
• genetic information.

RDC Media will not collect sensitive information unless the individual has consented to the collection of that information or the collection is required or authorised by law.

What if you don't provide us with your personal information?

The nature of the business carried on by RDC Media means that, generally, it is not possible for us to provide services to you anonymously. However, in some circumstances, we allow individuals the option of not identifying themselves, or of using a pseudonym, when dealing with us, for example, where you write to a RDC Media publication or where you post on the Website.

5. HOW INFORMATION IS HELD BY RDC MEDIA

RDC Media has commercially reasonable processes in place to ensure the security of an individual's personal information including encryption of all data when it is transferred to Best Bets' service providers and limitations on access to personal information within RDC Media. There are limitations on access to information within RDC Media.

Only certain RDC Media employees, being those required to have access to personal information so that RDC Media is able to carry out its functions and activities will have access to information held by RDC Media, in order to protect the information from:

1. misuse, interference and loss; and
2. unauthorised access, modification or disclosure.

Authorised RDC Media employees will require a password to access RDC Media's database, where the information is held.

If RDC Media no longer requires any information for any purpose for which the information may be used or disclosed in accordance with this Privacy Policy, RDC Media will take such steps as are reasonable in the circumstances to securely destroy the information or to ensure that the information is de-identified.

6. USE AND DISCLOSURE OF PERSONAL INFORMATION

For what purpose may RDC Media use and/or disclose my personal information?

RDC Media may use or disclose personal information for the purpose for which it was collected and for other purposes permitted by the Privacy Act, including where:

• the individual has consented; or
• the individual would reasonably expect RDC Media to use or disclose the information for that other purpose, in circumstances where it is:
  • (sensitive information) directly related to the purpose for which it was collected; or
  • (personal information) related to the purpose for which it was collected;
• use or disclosure is authorised by law or a court/tribunal order; or
• RDC Media reasonably believes that use or disclosure of the information is reasonably necessary for one or more enforcement related activities conducted by, or on behalf of, an enforcement body.

Except in limited circumstances, including those described below (refer to section "Cross-border Processing and Disclosure of Personal Information"), it is not likely that RDC Media will disclose information to overseas recipients.

RDC Media may disclose your personal information to third parties for the following purposes:

• to provide the service or product you wish to purchase or use;
• for research purposes relating to the thoroughbred racing industry;
• to customise and promote services and events related to the thoroughbred racing industry which may be of interest to you;
• to give effect to functions of our Website you elect to use, such as posting comments which are published on the Website and accessible to the public (such comments may contain your name and be displayed in search results on external world wide web search engines);
• if authorised or required by law;
• with your consent;
• as otherwise required to enable RDC Media to fulfill it functions and activities as outlined in Section 3; or

When personal information is disclosed to third parties, appropriate care is taken to ensure the information is protected from misuse.

Who may RDC Media share my personal information with?

Personal information collected by RDC Media shall be disclosed to Racing Victoria. Please refer to Racing Victoria's Privacy Policy available at https://www.racingvictoria.com.au/privacy-policy for details regarding how Racing Victoria manages your personal information.

Personal information collected by RDC Media may also be disclosed to third parties. For example, personal information may be disclosed to:

• RDC Media's related bodies corporate, including Racing Victoria, Racing.com Pty Ltd and Thoroughbred Racing Productions (Vic) Pty Ltd;
• third party service providers in order to assist with RDC Media's functions and operations or to fulfill a service you have elected to use (e.g. production house, delivery provider); and
• government agencies, as required or authorised by law.

Cross-border Processing and Disclosure of Personal Information

RDC Media may process and/or disclose your personal information overseas, including in the United States, the European Union (including the United Kingdom), Singapore and Hong Kong in the following situations:

• to third-party providers of business support services, such as IT services, who are based in countries including the United States and Singapore;
• if authorised or required by law;
• with your consent; and
• as otherwise required to enable RDC Media to fulfill it functions and activities as outlined in Section 3.

In each case, we will comply with the requirements of the Privacy Act that apply to cross border disclosures of personal information.

Journalism

Where applicable, the collection and handling of personal information collected by RDC Media in its role as a media organisation in the course of journalism, photography or provision of the news service (Journalism Activities), is not covered under this Privacy Policy. Personal information collected in the course of Journalism Activities will be handled in accordance with the Australian Press Council's Privacy Standards which are available here: http://www.presscouncil.org.au/privacy-principles/.

Direct marketing

RDC Media may disclose personal information (not sensitive information) to third parties for the purposes of direct marketing services related to the thoroughbred racing industry. An individual will be able to opt-out of direct marketing at any time if he or she chooses, by following the relevant opt-out or unsubscribe instructions in the relevant communication, the preference centre which can be accessed via the Website or by notifying Customer Support at feedback@racing.com

RDC Media will not use or disclose personal information about an individual for the purpose of direct marketing, unless RDC Media collected the information:

• directly from the individual:
  • where the individual would reasonably expect RDC Media to use or disclose the personal information for that purpose; and
  • the individual has not opted out of receiving direct marketing, or
• from a third party:
  • where the individual has consented to disclosure for that purpose, or it is impracticable to obtain that consent;
  • the communication includes an opt out statement which makes clear to the individual the simple way to opt out of receiving direct marketing; and
  • the individual has not opted out of receiving direct marketing.

7. ACCESS TO PERSONAL INFORMATION AND CORRECTION

A person can access his or her own personal information by contacting RDC Media's Privacy Officer. RDC Media's Privacy Officer will respond within a reasonable period after the request is made.

In some circumstances, a fee may apply.

RDC Media will endeavour to take reasonable steps to ensure that the information it holds is accurate, up to date and complete. If the information held by RDC Media is inaccurate, incomplete or not up to date, the individual may request that RDC Media correct the information.

There are some circumstances in which RDC Media is entitled to deny a person access to information, in part or full. These include, amongst others, circumstances where:

• RDC Media believes that giving access would pose a serious threat to the life, health or safety of any individual, or to public health or public safety;
• giving access would have an unreasonable impact on the privacy of other individuals;
• the request for access is frivolous or vexatious;
• the information relates to existing or anticipated legal proceedings between RDC Media and the individual, and would not be accessible by the process of discovery in those proceedings;
• giving access would reveal evaluative information generated within RDC Media in connection with a commercially sensitive decision-making process;
• giving access would be likely to prejudice one or more enforcement related activities conducted by, or on behalf of an enforcement body;
• giving access would be unlawful (for example, if providing the information would amount to a breach of legal professional privilege or a breach of confidence); or
• denying access is required or authorised by or under an Australian law or a court/tribunal order.

If any request for access to information is to be denied in part or full or not provided in the manner requested by an individual, RDC Media will give the individual a written notice, setting out, amongst others, the reasons for the refusal except to the extent that, having regard to the grounds for the refusal, it would be unreasonable to do so.

8. DATA AND SECURITY

We hold personal information in a number of ways, including in hard copy documents, electronic databases, email contact lists, and in paper files held in drawers and cabinets. Paper files may also be archived in boxes and stored offsite in secure facilities. We take reasonable steps to:

• make sure that the personal information that we collect, use and disclose is accurate, up to date and complete and (in the case of use and disclosure) relevant;
• protect the personal information that we hold from misuse, interference and loss and from unauthorised access, modification or disclosure; and
• destroy or permanently de-identify personal information that is no longer needed for any purpose that is permitted by the APPs.

You can help us keep your information up to date, by letting us know about any changes to your details, such as your address, email address or phone number.

The steps we take to secure the personal information we hold include website protection measures (such as firewalls and anti-virus software), security restrictions on access to our computer systems (such as login and password protection), controlled access to our corporate premises, policies on document storage and security, personnel security, staff training and workplace policies.

9. RDC MEDIA WEBSITES

RDC Media operates various websites to which this Privacy Policy applies as follows:

https://www.racing.com
https://www.bestbets.com
https://www.winningpost.com.au
https://photos.racing.com
https://licensedphotos.racing.com

(Website).

The Website may also contain links to other websites, including the following, which have their own privacy policies. Individuals that visit these websites should refer to their separate privacy policies.

Collection and Purpose (including Cookies)

RDC Media may collect personal information from an individual in the course of an individual's visit to a Website and where that individual inputs personal information, which includes but is not limited to situations, where a person:

• signs up to receive a newsletter; or
• enters a competition or participates in a promotion.

In addition, RDC Media also places, uses and reads cookies and advertising identifiers for mobile devices from an individual who visits the Website computer. This includes through its use of a third party service, Google Analytics, which may also provide RDC Media with information about you, such as your IP address, location, gender, age bracket, language and interests based on your interaction with Google platforms. If you would like more information regarding how Google uses data, please visit www.google.com/policies/privacy/partners/ (as amended by Google from time to time).

The use of cookies, advertising identifiers for mobile devices and Google Analytics enables RDC Media to:

• tell when a person uses a Website; and
• helps customise that person's Website experience.

The purposes for which RDC Media collects personal information from users of its Website include:

• providing the individual with the best service experience possible on a Website (such as improving functionality);
• assist RDC Media in analysing and developing its marketing campaigns;
• conducting competitions and promotions; and
• providing services related to the thoroughbred racing industry such as circulation of newsletters and industry related news.

If a person does not wish to receive cookies, you may set your browser to either prompt or refuse cookies.

Microsoft Clarity

We partner with Microsoft Clarity to capture website usage data, which monitors how you use and interact with our website. Website usage data is captured using first and third-party cookies and other tracking technologies, including heat maps, session recordings and machine learning, to determine the popularity of products/services and online activity.

The data we collect includes search terms used by you, the pages you visit on our website and the amount of time spent on those pages (or on certain parts of a page), the date and time when you access pages on our website, downloads, your general browsing activity and bounce rates (being whether you enter our site and leave or view multiple pages).

The main purpose for collecting this data is to improve and market our products/services. Additionally, we use this information for site optimisation, fraud/security detection purposes, and advertising. For more information about how Microsoft collects and uses your data, visit the Microsoft Privacy Statement.

Microsoft Clarity is hosted in Australia, and customer data is stored in Australia.

Disclosure

Customarily, RDC Media only discloses personal information collected via the Website to its service providers who assist in the operation of the Websites. RDC Media will only disclose personal information to an unrelated third party with the individual's consent, in accordance with this Privacy Policy or otherwise in accordance with the Privacy Act.

10. ADDITIONAL RIGHTS - EUROPEAN UNION AND UNITED KINGDOM RESIDENTS

If you are located in the European Union or the United Kingdom you may have additional rights to those described above. Some of these rights will only apply in limited circumstances.

The right to erasure- you have the right to request that RDC Media erase your personal data, under certain conditions. This right only applies in limited circumstances and will not usually apply where it remains necessary for us to process your information for the purposes for which it was collected, or if we are otherwise required by law to retain your information or your information is relevant to a legal dispute.

The right to restrict processing - you have the right to request that RDC Media restrict the processing of your personal data, under certain conditions. For example, these rights will not usually apply when we need to process your information to carry out our day-to-day business functions or where we have a legitimate interest in processing your information. For example, it is necessary for RDC Media to comply with its legal obligations.

The right to object to processing - you have the right to object to RDC Media's processing of your personal data, under certain conditions.

The right to data portability - you have the right to request that RDC Media transfer the data that we have collected to another organisation, or directly to you, under certain conditions.

Where we rely on your consent as the legal basis for processing your personal information you may withdraw your consent at any time. For example, where you have subscribed to an e-News service to which you have previously opted-in, you can do so by using the unsubscribe tool.

11. HOW TO CONTACT US ABOUT PRIVACY

Your privacy is very important to us. Please contact RDC Media's Privacy Officer via one of the following if you have any questions: Mail: Racing Victoria Privacy Officer, Racing Victoria, 400 Epsom Road, Flemington, Victoria, 3031
Telephone: 1300 139 401
Email: privacyofficer@racingvictoria.net.au

If you are concerned about a possible interference with your privacy, please contact RDC Media's Privacy Officer and RDC Media will investigate the matter. Complaints to RDC Media must be made in writing. If you do not receive a response within 30 days or your concern is not resolved to your satisfaction, you can refer the matter to the Office of the Australian Information Commissioner (OAIC).

Before you can lodge a complaint with the OAIC, you will generally need to complain directly to RDC Media. Details on how to lodge a complaint with OAIC are set out on the OAIC's website here.

The OAIC can also be contacted on 1300 363 992.