Privacy Policy

This policy explains how Galileo Ventures Pty Ltd ACN 617 596 899 and its subsidiaries and affiliates ("Galileo", "we", "us", "our") collect, hold, use and disclose personal information, and how we meet our obligations under the Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles ("APPs").

It applies to everyone we deal with outside our own organisation: visitors to this website, founders who pitch us, investors and prospective investors in our funds, people who come to our events, and the people who work for our service providers and suppliers.

"Personal information" means information or an opinion about an identified individual, or an individual who is reasonably identifiable — your name and contact details, for example. It does not cover information that has been de-identified or aggregated so that you can no longer be identified from it.

What we collect

Most people who deal with us only ever give us a name, contact details, and whatever they choose to tell us about their company.

We collect and hold information that is reasonably necessary for our functions and activities. Depending on how you deal with us, that can include:

• name, address, email address, phone number and other contact details
• your role, employer and professional background
• the contents of any pitch, business plan or other material you send us — see our Terms of Use
• a record of our correspondence and meetings with you
• technical information about your visit to this website, described under Cookies and analytics below

If you invest, or apply to invest, in one of our funds we have to collect more. This is the only situation in which we collect the categories below, and we collect them because the *Anti-Money Laundering and Counter-Terrorism Financing Act 2006* (Cth), the *Corporations Act 2001* (Cth) and related law require it:

• date of birth
• nationality and country of birth
• identity documents and the other data required for AML/CTF customer identification
• financial information, including evidence supporting your status as a wholesale or sophisticated investor
• government identifiers, such as a tax file number, but only where we are required or authorised by law to collect them. We do not adopt a government identifier as our own identifier for you.

Sensitive information

Sensitive information is a category the APPs protect more strictly. It includes information about your racial or ethnic origin, health, political opinions, religion, professional or trade union memberships, philosophical beliefs, sexual orientation or practices, criminal record, and biometric information.

We collect sensitive information only with your consent and only where it is reasonably necessary for our functions. In practice that is almost always limited to dietary requirements and accessibility needs you give us for an event.

We use and disclose sensitive information only for the purpose you gave it to us for, for a directly related purpose you would reasonably expect, or where the law requires it.

How we collect it

Where it is reasonable and practicable to do so, we collect personal information directly from you — through the forms on this website, our application form, email, letters, meetings, phone and video calls, and event registrations.

We may also collect personal information from third parties or from publicly available sources, such as a company register, a professional networking site, a referral from someone in our network, or a reference check. We only do that where it is unreasonable or impracticable to collect the information from you directly.

Where practicable we will give you the option of not identifying yourself, or of using a pseudonym, in your dealings with us. That is not possible where the law requires us to identify you — investor onboarding, for instance.

Cookies and analytics

This website uses cookies and Google Analytics to understand how the site is used: which pages people visit, how they arrived, and which links they follow. Google Analytics collects technical data including your IP address, browser type and version, device, time zone setting and approximate location.

We use this to improve the website. We do not use cookies for advertising retargeting and we do not run advertising pixels on this website.

You can block or delete cookies in your browser settings, and you can opt out of Google Analytics entirely with Google's opt-out browser add-on. Blocking cookies will not stop you using this website. How Google handles data collected from sites that use its services is described here.

How we use it

We use personal information for the purpose we collected it for, for a related purpose you would reasonably expect, or where you have consented or the law requires it. That includes:

• assessing and responding to a pitch or an application
• managing our investments and our relationships with founders, investors and the wider ecosystem
• running our events and programs
• assessing an application to invest in one of our funds, and administering that investment
• meeting our legal and regulatory obligations
• our internal administration and record-keeping
• sending you information about Galileo, our funds and our events

Direct marketing, and how to stop it

If you subscribe to one of our newsletters or give us your details at an event, we may send you updates about Galileo. Every marketing email we send carries an unsubscribe link, as the *Spam Act 2003* (Cth) requires, and we act on unsubscribes promptly.

You can also opt out at any time by emailing team@galileo.ventures. If you ask us to stop using your personal information for direct marketing, we will.

Who we share it with

We do not sell personal information and we do not trade it.

We disclose personal information where you have consented, where you would reasonably expect us to, where we are authorised or required by law, or where a permitted general situation under the Privacy Act applies. In practice that means:

• our own team, our contractors and our related entities
• other investors and co-investors in a financing, where you are a founder raising with us
• our service providers — cloud hosting, email, CRM, document storage, analytics, fund administration and identity verification
• our professional advisers, including legal, accounting, audit and tax firms
• regulators and government agencies where required, including ASIC, AUSTRAC and the ATO

We take reasonable steps to ensure that anyone who handles personal information for us does so consistently with the Privacy Act and the APPs.

We may also share de-identified and aggregated information — portfolio-level statistics, for example — for research or promotional purposes.

Sending information overseas

Some of our service providers store or process personal information outside Australia. The countries in which they are most likely to hold it are the United States, the United Kingdom and countries in the European Union.

Before we disclose personal information to an overseas recipient we take steps that are reasonable in the circumstances to ensure the recipient does not breach the APPs in relation to it, normally through our contract with that provider.

Separately, if you invest with us, information we report to the ATO or ASIC may be exchanged with overseas regulators as a result of Australia's participation in the Common Reporting Standard and the *Foreign Account Tax Compliance Act*. That exchange is between regulators and is not something we control.

How we store and protect it

We hold personal information in cloud services, in our internal systems, and occasionally in hard copy.

We use industry-standard measures — access controls, encryption in transit, and vetting of the providers we use — to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure.

No system is perfectly secure. If you believe your dealings with us are no longer secure, tell us immediately using the contact details below.

Data breaches

We maintain a data breach response plan. If we suffer a data breach that is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act requires.

How long we keep it

We keep personal information only for as long as we need it for the purpose we collected it, or for as long as the law requires — whichever is longer.

Some of those periods are set by law. Records collected for AML/CTF customer identification must be kept for seven years after our relationship with you ends, and company and financial records under the Corporations Act must be kept for seven years.

When we no longer need personal information and are not required to keep it, we destroy it or de-identify it.

Our own people

The Privacy Act contains an exemption for employee records. This policy covers people outside our organisation; the handling of our own employees' records is governed by our internal policies.

Getting access, and correcting it

You can ask us for a copy of the personal information we hold about you, and you can ask us to correct it. Email team@galileo.ventures. We do not charge for a request or for making a correction.

We will ask you for identification — a driver's licence or passport, say — so we can confirm you are the person the information relates to.

We will respond within a reasonable time, usually within 30 days. There are limited circumstances in which we may refuse access or a correction, such as where granting access would unreasonably affect another person's privacy. If we refuse, we will tell you why and how you can seek a review of that decision. If we decline to correct something, you may ask us to attach a statement to the record noting that you consider it inaccurate, and we will do so.

Complaints

If you think we have breached the Australian Privacy Principles, please tell us first. Email team@galileo.ventures with enough detail for us to look into it, or write to the address below.

We will acknowledge your complaint and respond in writing within a reasonable time, usually no longer than 30 days. We may come back to you for more information so we can give you a complete answer.

If you are not satisfied with our response, you can take the complaint to the Office of the Australian Information Commissioner:

• oaic.gov.au
• 1300 363 992
• GPO Box 5288, Sydney NSW 2001

Contact us

Privacy Officer

Galileo Ventures Pty Ltd ACN 617 596 899

Level 4, 1 Castlereagh Street, Sydney NSW 2000

team@galileo.ventures

Changes to this policy

We may update this policy from time to time. The version published on this page is always the current one, and the "last updated" date at the top tells you when we last changed it. If we make a change that materially affects how we handle your personal information, we will take reasonable steps to tell you.