Redflex Website Privacy Policy

Who is Redflex?

Redflex Holdings Limited (ABN 96 069 306 216 ("Redflex") is an Australian public company listed on the Australian Securities Exchange whose registered office address is at 31 Market Street, South Melbourne, Victoria, Australia 3205. Redflex has subsidiaries in the United States of America (U.S.), Australia, United Kingdom (U.K.) and various other regions and countries (collectively, the "Redflex Group"). When we say "Redflex", "we" or "us" in this document, we mean Redflex Holdings Limited. The following are some of the companies in the Redflex Group and the countries it which each operates:

Company Country

Introduction

Redflex has prepared this User Privacy Notice ("Notice") to be provided to users of the Redflex website (www.redflex.com) and associated domains (collectively, the "Website"). We process your personal data in connection with your use of our Website. We think that it is very important that you understand how we use your personal data, and we take our obligations in this regard very seriously. The purpose of this Notice is therefore to give you information about how Redflex collects, processes, stores and otherwise uses information about you, and your rights in relation to that information.

Redflex is committed to protecting and respecting your privacy. Redflex Holdings Limited is the data controller of personal data we process about you. We process personal data only in compliance with applicable data protection laws, including the Data Protection Regulation (EU) (2016/679) (the "GDPR"), the Data Protection Act 2017 and any successor legislation to any of the above (together, the "Data Protection Laws"). Redflex is also bound by the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles set out in that act. We are also bound by other legislations (Australian Federal and its States and Territories) which may likewise require us to meet privacy obligations. Redflex will ensure it complies with the law in respect of privacy.

This Notice (together with our Website Terms of Use and any other documents referred to in it) sets out the manner in which we collect, maintain, manage and use personal data.

Please read the following carefully to understand our views and practices regarding your personal data.

What categories of personal data does Redflex collect about me?

"Personal data" means any information relating to you. We collect personal data about you when you contact us, fill in forms on our Website and use our Website. Redflex will collect, process and use the following categories and types of personal data about you:
We may collect and process the following information about you:

• Your name;
• Your telephone number(s);
• Your email address(es);
• Your postal address;
• Any other personal data which are contained in your responses to questions we may ask;
• Your internet protocol (IP) address;
• Your login information;
• Your computer software details such as browser and browser plug-in type and version, operating system and platform;
• Details regarding your internet visit, including uniform resource locator (URL) clickstream to and from our Website (including date and time), products you viewed or searched for, page response time, download errors, duration of visit to certain pages, page interaction information (such as scrolling, clicks and mouse-overs) and methods used to browse away from page; and
• Any telephone number used to call our customer service desk.

We may also collect personal data from other sources. We may receive personal data if you use any other websites we operate or are linked to or other services we provide. Any data we collect may be shared internally and combined with data collected on this Website. We also work with third parties (including, for example, customers, business partners, analytics providers and search information providers) and may receive personal data from them. Our customers include certain government agencies.

Why does Redflex need to collect, process and use my personal data and what is the legal basis for doing so?

We collect and use personal data for a variety of reasons linked to your use of the Website. To help clarify these we have set out below a list of reasons why we collect and use this data (the "Processing Purposes"). However, we can only collect and use this data if we have a valid legal basis for doing so, and we are required to explain the various legal bases that we rely on to you.

To give you the full picture, we have set out each of the reasons why we collect and personal data, i.e., the Processing Purposes, and mapped these against the relevant types of personal data and the different legal bases that allow us to do so. We appreciate that this is quite a lot of information to take in, so please bear with us.

Who might Redflex share my personal data with?

We are part of the global Redflex Group, and several entities in this group are involved in the Processing Purposes. To ensure that the Processing Purposes can be completed, your information may be shared with any of the entities within the Redflex Group. Where we do share data in this way, however, it is our policy to limit the categories of individual who have access to that personal data.

Redflex may transfer personal data to third parties, including to entities within and outside the Redflex Group located in any jurisdictions where Redflex Group entities are located, for the Processing Purposes as follows:

• Within the Redflex Group. Redflex is part of a wider group headquartered in South Melbourne, Australia with offices located around the globe. For this reason, Redflex may transfer personal data, or otherwise allow access to such data by other entities within the Redflex Group, which may use, transfer, and process the data for the Processing Purposes listed above.
• Communication with third parties. As necessary in connection with business operations, personal data may be transferred to existing or potential business partners, suppliers, customers, end-customers or government officials and other third parties.
• Regulators, authorities, and other third parties. As necessary for the Processing Purposes described above, personal data may be transferred to regulators, courts, and other authorities (e.g., tax and law enforcement authorities), independent external advisors (e.g., auditors), insurance providers, pensions and benefits providers, internal compliance and investigation teams (including external advisers appointed to conduct internal investigations).
• Data processors. As necessary for the Processing Purposes described above, personal data may be shared with one or more third parties, whether affiliated or unaffiliated, to process personal data under appropriate instructions ("Data Processors"). The Data Processors include customer relationship management service providers and analytics and search engine providers that assist us in the improvement and optimisation of our Website, as well as other third parties who assist us with our Processing Purposes. The Data Processors will be subject to contractual obligations to implement appropriate technical and organisational security measures to safeguard the personal data and to process the personal data only as instructed.

For a full list of the Redflex Group entities and third parties that we may share your data with, please contact us as set out below.

Where we store your personal data

As you may expect, some of the recipients we may share personal data with may be located in countries outside of Europe. In some cases, this may include countries located outside the European Union and/or European Economic Area ("EEA").

Some countries where recipients may be located already provide an adequate level of protection for this data and transfers to other countries such as the U.S. may be protected under arrangements such as the EU-U.S. Privacy Shield. Nonetheless, for transfers to Redflex Group entities outside of the EEA, Redflex will be bound by the EU Standard Contractual Clauses pursuant to Article 46(2)(c) GDPR, which the European Commission has assessed as providing an adequate level of protection for personal data, to ensure that your data is protected adequately.

If recipients are located in other countries without adequate protections for personal data, Redflex will take all necessary measures to ensure that transfers out of the EEA are adequately protected as required by applicable data protection law. This will include using appropriate safeguards such as the EU Standard Data Protection Clauses. You can ask for a copy of the such appropriate safeguards by contacting us as set out below (Who can I contact?).

Our Website may, from time to time, contain links to and from the websites of our partner networks, advertisers and affiliates. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for these policies. Please check these policies before you submit any personal data to these websites.

Our Website may, from time to time, contain links to and from the websites of our partner networks, advertisers and affiliates. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for these policies. Please check these policies before you submit any personal data to these websites.

How long do we keep your personal data?

It is our policy not to keep personal data for longer than is necessary. We may, for example, keep your personal data for a reasonable time after you have accessed our Website to ensure that Redflex has the records it needs in the event of a dispute or regulatory investigation and to ensure that any ongoing obligations can be complied with, such as complying with requests from regulators. Where personal data is kept, that period will be determined based on the applicable local law. You may request further details on how long Redflex will retain different categories of personal data.

Automated decision-making, including profiling

We do not carry out automated decision-making or profiling in relation to your personal data.

Cookies and Trackers

Our Website uses cookies (including Google Analytics cookies). Cookies help us to provide you with a better user experience when you browse our Website and also allows us to improve our Website.

Cookies are small data files placed on the User’s hard drive by a website so that the User’s browser can be uniquely identified. Redflex may use cookies for the purposes of making our Website easier to use. At the moment, cookies are the only way to identify a unique anonymous visitor to a site and to understand how they navigate the website. An anonymous user to our Website remains anonymous in all cases. Redflex does not attempt to identify visitors if they do not voluntarily submit their information to our Website for the purposes of performing a transaction or accessing a feature. With most Internet browsers the User can erase cookies from the User’s computer’s hard drive, block all cookies from being placed on the User’s computer or receive a warning when a website attempts to place a cookie on the User’s computer. Whether or not to accept a cookie on the User’s computer is up to the User. However, some Website features and services may not function properly if the User’s cookies are disabled.

Trackers are programs that recognize a unique piece of information contained within a cookie placed on the User’s hard drive by another website. Redflex does not use trackers.

What rights do I have in respect of my personal data?

You have a number of rights in relation to your personal data. These can differ by country, but can be summarised in broad terms as follows:

(i) Right of access

You have the right to confirm with us whether your personal data is processed, and if it is, to request access to that personal data including the categories of personal data processed, the purpose of the processing and the recipients or categories of recipients. We do have to take into account the interests of others though, so this is not an absolute right, and if you want to request more than one copy we may charge a fee.

(ii) Right to rectification

You may have the right to rectify inaccurate or incomplete personal data concerning you.

(iii) Right to erasure (right to be forgotten)

You may have the right to ask us to erase personal data concerning you.

(iv) Right to restriction of processing

In limited circumstances, you may have the right to request that we restrict processing of your personal data, however where we process personal data for the Processing Purposes we think that we have a legitimate interest in processing which may override a request that you make.

(v) Right to data portability

You may have the right to receive personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and you may have the right to transmit that data to another entity.

(vi) Right to object and rights relating to automated decision-making

Under certain circumstances you may have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal data, including profiling, by us and we can be required to no longer process your personal data. This may include requesting human intervention in relation to an automated decision so that you can express your view and to contest the decision.

To exercise any of these rights, please contact us as stated below (Who can I contact?).

You also have the right to lodge a complaint with the competent data protection supervisory authority, which in the U.K. is the Information Commissioner's Office (the "ICO").

Who can I contact?

If you have concerns or questions regarding this Privacy Notice or if you would like to exercise your rights as a data subject, you can get ahold of the right person here:

Verra Mobility Privacy Office

1150 North Alma School Road

Mesa, Arizona 85201 USA

Telephone: +1 (503) 596-4566

Email: privacy@verramobility.com

Changes to this Notice

As our business changes from time to time, we sometimes need to make changes to the way we collect and use your personal data. Therefore, this Privacy Notice may be updated from time to time. If we make changes to this Privacy Notice, we will post an alert on the home page of our Website.

Changes to this Notice

We are not responsible for any external websites.