Privacy Policy

TaxCalendar Pty Ltd (ACN 700 298 764) ("TaxCalendar", "we", "us", "our") is committed to protecting the privacy of everyone who uses our Platform and interacts with our business. This Privacy Policy explains what personal information we collect, why we collect it, how we use and protect it, and the choices you have in relation to your information. It applies to all personal information collected by TaxCalendar through our Platform at www.taxcalendarhq.com, our website, and any related communications. This Privacy Policy is governed by the Privacy Act 1988 (Cth) ("Privacy Act") and the Australian Privacy Principles ("APPs") contained in that Act. By creating an account or using the Platform, you agree to the collection, use, and disclosure of your personal information as described in this Privacy Policy. If you do not agree, please do not use the Platform. A note on roles. TaxCalendar acts as the primary data controller for information about account holders, Firm Administrators, and Authorised Users. Where accounting firms upload or import information about their own clients ("Client Data"), TaxCalendar acts as a data processor on behalf of the accounting firm as the responsible party. This distinction is explained further in section 5 below.

We collect different types of information depending on how you interact with TaxCalendar. • Account and Registration Information When you create an account, we collect: • your name and contact details, including email address and phone number; • the name and details of your accounting firm; • your nominated role within the firm (for example, Firm Administrator or staff member); • your login credentials; and • any profile information you choose to provide. • Billing and Subscription Information When you subscribe to a paid plan, we collect: • billing contact name and email address; • billing address; • subscription plan details; and • payment transaction records. We do not store full credit card or bank account details. Payment card data is handled directly by our third-party payment processor, which operates under its own security and privacy standards. • Client Data Uploaded by Subscribers Accounting firms using TaxCalendar may upload, import, or enter information about their own clients through the Platform, including: • client names and contact details; • client entity types, ABNs, ACNs, and tax file information; • compliance obligation details and lodgement history; • workflow notes, deadline records, and reminder configurations; and • any other information entered or imported by the firm or its staff. This is referred to as "Client Data" throughout this Privacy Policy. See section 5 for how we handle Client Data. • Usage and Workflow Data As you use the Platform, we collect information about how you and your team interact with it, including: • pages visited and features used; • workflow and task activity; • reminder schedules created; • search queries made within the Platform; • actions taken in relation to client records; and • session duration and frequency of use. • Technical and Device Information We automatically collect certain technical information when you access the Platform, including: • IP address; • browser type and version; • operating system; • device type; • referring URL; • time and date of access; and • error logs and diagnostic data. • Communications with Us If you contact our support team or communicate with us by email or other channels, we collect: • the content of your messages; • your contact details; and • records of any resolutions or actions taken in response. • Cookies and Tracking Technologies We use cookies and similar technologies to operate the Platform. See section 11 for more detail.

We collect personal information in the following ways. • Information You Provide Directly We collect information you give us when you: • register for an account; • complete your profile or firm settings; • subscribe to a plan or update your billing details; • contact our support team; • respond to surveys or feedback requests; or • communicate with us by email or through the Platform. • Information Imported or Entered by Subscribers Accounting firms may import Client Data into the Platform by CSV upload or manual entry. Where Client Data contains personal information about third parties (such as the firm's own clients), that information is collected from the firm as the subscribing organisation, not directly from the individuals concerned. • Information Collected Automatically We automatically collect certain technical and usage information when you interact with the Platform. This includes server log data, analytics data, and information collected through cookies and similar technologies. • Information from Third-Party Integrations Where you connect the Platform to a third-party service (such as Microsoft Outlook), we may receive information from that service necessary to enable and maintain the integration. We only collect the information required to provide the connected functionality. • Information from Our Service Providers We may receive limited information from our service providers (such as payment confirmation data from our payment processor) to enable us to manage your account and subscription.

We collect and use personal information for the following purposes. • Providing the Platform We use your information to: • create and manage your account; • provide access to Platform features; • process and manage your subscription; • send automated reminders and workflow notifications on your behalf; • support integrations you have enabled; and • maintain and improve Platform performance. • Authentication and Security We use your information to: • verify your identity when you log in; • detect and prevent fraud and unauthorised access; • monitor for suspicious activity; and • protect the security and integrity of the Platform and its users. • Billing and Account Management We use your information to: • process subscription payments; • send invoices, payment receipts, and renewal notices; • manage plan changes and cancellations; and • resolve billing disputes. • Customer Support We use your information to: • respond to support requests; • diagnose and resolve technical issues; • maintain records of support interactions; and • improve the quality of our support services. • Product Improvement and Analytics We use aggregated and, where applicable, de-identified information to: • understand how the Platform is used; • identify areas for improvement; • develop new features and functionality; and • conduct internal analytics and research. Where we use personal information for analytics purposes, we take reasonable steps to de-identify that information before use. • AI-Assisted Functionality Where you use AI Features within the Platform, we process relevant data to generate AI outputs. See section 6 for further detail on how AI Features interact with your information. • Communications and Marketing We use your contact details to: • send you important account and service notifications (these cannot be opted out of while your account is active); • send you product updates, feature announcements, and tips for using the Platform; and • send you marketing communications where you have consented or where we are otherwise permitted to do so under applicable law. You may opt out of marketing communications at any time. See section 12 for more detail. • Legal and Compliance Obligations We may use or disclose your information where required or permitted by law, including to: • comply with a court order, subpoena, or regulatory requirement; • respond to a lawful request by a government or law enforcement authority; • enforce our Terms of Service; or • protect the rights, property, or safety of TaxCalendar, our users, or the public.

We collect and use personal information on one or more of the following bases: • Contract: to perform our obligations under our Terms of Service and to provide you with the Platform you have subscribed to; • Legal obligation: where we are required to collect or retain information under applicable law; • Legitimate interests: to operate, secure, and improve our Platform, and to communicate with you about our services, where those interests are not overridden by your privacy rights; and • Consent: where you have expressly agreed to a specific use, such as receiving marketing communications or participating in a Beta testing programme.

• Subscriber responsibility When an accounting firm uploads, imports, or enters information about its own clients into the Platform, the firm is responsible for that Client Data. TaxCalendar processes Client Data on the firm's behalf and in accordance with the firm's instructions. Accounting firms using TaxCalendar are responsible for: • ensuring they have a lawful basis for uploading Client Data to the Platform; • obtaining any consents required from their own clients under applicable law; • complying with their own obligations under the Privacy Act and other applicable privacy legislation; and • ensuring the accuracy of Client Data entered into the Platform. • TaxCalendar's obligations as processor As a processor of Client Data on behalf of accounting firms, TaxCalendar will: • process Client Data only for the purposes of providing the Platform and associated services; • implement and maintain appropriate technical and organisational security measures to protect Client Data; • not disclose Client Data to third parties except as described in this Privacy Policy or as required by law; and • delete or return Client Data in accordance with our data retention practices described in section 10. • No direct relationship with end clients TaxCalendar does not have a direct relationship with the individual clients of accounting firms whose information may be entered into the Platform. If an individual has questions about how their information is handled by their accounting firm, they should contact that firm directly.

• How AI Features use your information Where you use AI-assisted features within the Platform, we may process: • prompts and queries you or your Authorised Users submit; • workflow and task context used to generate outputs; and • usage patterns associated with AI Feature interactions. AI Features may be powered by one or more third-party artificial intelligence providers or models. The specific providers used may change over time as TaxCalendar updates its technology. Outputs may vary depending on the provider in use at any given time. • Independent review required AI-generated outputs are tools to assist your workflows only. They are not professional advice and may be incomplete, inaccurate, or unsuitable for a particular purpose. You must independently review and verify all AI-generated content before relying on it or communicating it to clients. • Use of information to improve AI Features TaxCalendar may use anonymised or aggregated data derived from interactions with AI Features to improve the accuracy, relevance, and performance of those features. This will only be done in a form that does not identify individual users or their clients. TaxCalendar will not intentionally use identifiable Client Data or identifiable personal information to train publicly available AI models without your prior consent.

• Service providers We share information with third-party service providers who assist us in operating the Platform and delivering our services. These providers may include: • cloud hosting and infrastructure providers; • payment processors; • email delivery providers; • analytics and monitoring providers; • authentication and identity verification providers; • artificial intelligence and machine learning providers; • integration partners (including Microsoft Outlook and other calendar and productivity platforms); and • customer support and helpdesk tools. We only share information with service providers to the extent necessary for them to perform their services. We take reasonable contractual steps to ensure that service providers handle information in a manner consistent with this Privacy Policy and applicable law. • Business transfers If TaxCalendar is involved in a merger, acquisition, sale of assets, or restructure, your personal information may be transferred as part of that transaction. We will notify you of any such transfer and any material change to how your information is handled. • Legal requirements We may disclose personal information where required to do so by law, court order, regulatory requirement, or other lawful process, or where we reasonably believe disclosure is necessary to protect the rights, property, or safety of TaxCalendar, our users, or others. • Aggregated or de-identified information We may share aggregated or de-identified information that does not identify any individual or firm with third parties for research, analytics, or industry reporting purposes. • No sale of personal information TaxCalendar does not sell, rent, or trade personal information to third parties for their own marketing or commercial purposes.

Some of our service providers store or process information outside Australia. Where this occurs, we take reasonable steps to ensure that those providers are subject to appropriate safeguards, including: • contractual obligations requiring them to handle information consistently with the APPs; • certification under recognised international security or privacy frameworks; or • other safeguards appropriate to the circumstances. By using the Platform, you acknowledge that your information may be transferred to, stored, and processed in countries outside Australia. Where required under APP 8, we will take reasonable steps to ensure overseas recipients handle your information in accordance with the APPs or to an equivalent standard.

TaxCalendar implements commercially reasonable technical and organisational measures to protect personal information against unauthorised access, loss, misuse, disclosure, alteration, and destruction. Our security measures include: • encryption of data in transit using industry-standard protocols; • encryption of data at rest within our cloud infrastructure; • role-based access controls limiting access to personal information to personnel who require it; • multi-factor authentication options for account access; • continuous monitoring and logging of Platform activity; • regular security assessments of our infrastructure; and • secure, geographically distributed cloud infrastructure. Despite these measures, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee the absolute security of your information. If you become aware of any actual or suspected security incident affecting your account, please notify us immediately at support@taxcalendarhq.com.

We retain personal information for as long as reasonably necessary to fulfil the purposes described in this Privacy Policy and to comply with our legal obligations. Specifically: • Account information is retained for the duration of your subscription and for a reasonable period following termination to handle any outstanding matters. • Subscriber Data (including Client Data uploaded to the Platform) is retained for 30 days following account termination or cancellation. After this period, Subscriber Data will be permanently deleted from our systems unless we are required by law to retain it for longer. You may request an export of your Subscriber Data before deletion by contacting support@taxcalendarhq.com within 30 days of termination. • Billing and transaction records are retained as required to comply with applicable financial, tax, and accounting obligations, typically for 7 years. • Support communications are retained for a reasonable period to assist with ongoing support and quality improvement. • Technical and analytics data is retained in aggregated or de-identified form for product improvement purposes. When information is no longer required, we take reasonable steps to destroy or permanently de-identify it.

• What are cookies Cookies are small text files stored on your device when you access a website or web application. We use cookies and similar technologies (such as local storage and session tokens) to operate and improve the Platform. • Types of cookies we use • Essential cookies: Required for the Platform to function. These include session management, authentication, and security cookies. These cannot be disabled without affecting Platform functionality. • Authentication cookies: Used to keep you securely logged in during your session and to recognise your device on subsequent visits. • Analytics cookies: Used to understand how users interact with the Platform, which features are most used, and where we can improve. Information collected through analytics cookies is aggregated and de-identified where possible. • Functionality cookies: Used to remember your preferences and settings within the Platform, such as display options and notification preferences. • Managing cookies You can manage cookie settings through your browser. Disabling certain cookies may affect Platform functionality. For more information about how we use cookies, see our Cookie Policy at www.taxcalendarhq.com/cookies.

• Account and service notifications We will send you transactional and service-related communications as part of operating your account. These include subscription confirmations, renewal notices, invoices, security alerts, and important product updates. You cannot opt out of these communications while your account is active, as they are necessary to provide the service. • Marketing emails From time to time, we may send you information about new features, tips for using TaxCalendar, and other news about our products and services. You may opt out of marketing communications at any time by: • clicking the "unsubscribe" link in any marketing email; or • contacting us at support@taxcalendarhq.com with the subject line "Unsubscribe". We will process your request promptly. Note that opting out of marketing communications will not affect your receipt of account and service notifications.

• Access You have the right to request access to the personal information TaxCalendar holds about you. To make an access request, contact us at support@taxcalendarhq.com. We will respond within a reasonable time and, in any event, within 30 days. We may ask you to verify your identity before processing your request. In some circumstances, we may be unable to provide access to certain information, for example where doing so would reveal the personal information of another individual or would be contrary to applicable law. Where we decline to provide access, we will explain our reasons. • Correction If you believe that personal information we hold about you is inaccurate, incomplete, or out of date, you may ask us to correct it. You can update many of your account details directly within the Platform. For corrections we need to make on your behalf, contact us at support@taxcalendarhq.com. • Deletion You may request deletion of your personal information where it is no longer required for the purposes for which it was collected, or where we are otherwise not required to retain it by law. Deletion requests will be assessed on a case-by-case basis. In many cases, information will be deleted as part of our standard data retention practices following account termination. • Complaints If you believe TaxCalendar has handled your personal information in a way that does not comply with the Privacy Act or the APPs, you may lodge a complaint with us at support@taxcalendarhq.com. We will acknowledge your complaint and investigate it within a reasonable time. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner ("OAIC") at www.oaic.gov.au or by calling 1300 363 992.

TaxCalendar is subject to the Notifiable Data Breaches ("NDB") scheme under Part IIIC of the Privacy Act. If we have reasonable grounds to believe that an eligible data breach has occurred — that is, a breach that is likely to result in serious harm to any individual whose information was involved — we will: • take immediate steps to contain the breach and assess its nature and scope; • notify affected individuals as soon as practicable; and • notify the OAIC in accordance with the requirements of the NDB scheme. We maintain an internal privacy incident response process to assist us in detecting, assessing, and responding to potential data breaches promptly.

The Platform is designed for use by accounting professionals and is not intended for individuals under the age of 18. We do not knowingly collect personal information from anyone under 18 years of age. If you believe we have inadvertently collected personal information from a minor, please contact us at support@taxcalendarhq.com and we will take steps to delete that information promptly.

The Platform may contain links to, or integrations with, third-party websites and services. This Privacy Policy does not apply to those third parties. We encourage you to review the privacy policies of any third-party services you use in connection with the Platform.

We may update this Privacy Policy from time to time to reflect changes to our practices, technology, legal requirements, or for other operational reasons. When we make material changes, we will notify you by: • sending an email to the address associated with your account; and/or • displaying a notice within the Platform. The updated Privacy Policy will take effect on the date published at www.taxcalendarhq.com/privacy. We encourage you to review this page periodically. Continued use of the Platform following publication of an updated Privacy Policy constitutes your acceptance of the updated terms.

If you have any questions, concerns, or requests relating to this Privacy Policy or our privacy practices, please contact us: Privacy enquiries TaxCalendar Pty Ltd ACN 700 298 764 Email: support@taxcalendarhq.com Website: www.taxcalendarhq.com We aim to respond to all privacy enquiries within 30 days. This Privacy Policy was last updated on 15 July 2026.