Privacy Policy

Steel Source Australia ("Steel Source Australia", "we", "us" or "our") is an Australian company registered and headquartered in New South Wales. We are a leading supplier of premium steel products, fencing systems, roofing materials, structural steel, and associated services to residential, commercial, industrial and agricultural customers throughout Australia — including New South Wales, Victoria, Queensland, South Australia, Western Australia, Tasmania, the Australian Capital Territory, and the Northern Territory.

We are committed to protecting the privacy of all individuals who interact with our business, including customers, prospective customers, suppliers, contractors, employees, job applicants, and visitors to our website. We recognise that your personal information is important to you, and we take our obligations under Australian privacy law seriously.

This Privacy Policy has been prepared in accordance with the Privacy Act 1988 (Cth) (the "Privacy Act") and the thirteen Australian Privacy Principles ("APPs") contained in Schedule 1 of that Act. The APPs govern the way in which organisations like Steel Source Australia must handle personal information, and this policy reflects our commitment to complying with those principles in all of our operations across Australia.

This Privacy Policy applies to all personal information collected by Steel Source Australia through our website at revolutionsteel.com.au, through telephone and email communications, through in-person interactions at our premises in New South Wales, and through any other means by which you interact with our business. By using our website, submitting an enquiry, placing an order, or otherwise providing us with your personal information, you acknowledge that you have read and understood this Privacy Policy and consent to the collection, use and disclosure of your personal information as described herein.

If you do not agree with any part of this Privacy Policy, you should not provide us with your personal information and should not use our website or services. If you have any questions about this policy or our privacy practices, we encourage you to contact us using the details provided at the end of this document.

"Personal information" is defined under the Privacy Act as information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information or opinion is true or not, and whether the information or opinion is recorded in a material form or not. Steel Source Australia collects personal information that is reasonably necessary for one or more of our functions or activities as a steel supplier and service provider operating nationally from New South Wales.

The types of personal information we may collect include, but are not limited to, the following categories:

Identity and Contact Information

• Your full name, including first name, middle name and surname
• Your residential or business postal address, including street address, suburb, state and postcode — across all Australian states and territories
• Your email address, including personal and business email addresses
• Your telephone number, including mobile, landline and business numbers
• Your job title, role or position within your organisation
• The name of your employer or business
• Your Australian Business Number (ABN) or Australian Company Number (ACN) where relevant to a trade account or business transaction

Enquiry and Transaction Information

• Details of the products or services you have enquired about or purchased, including product categories, specifications, quantities and dimensions
• Your project details, including project type, location, timeline and budget range
• Correspondence and communications between you and Steel Source Australia, including emails, phone call notes and written correspondence
• Records of quotations provided to you and orders placed by you
• Delivery address and delivery instructions, which may differ from your billing or contact address
• Payment information, including payment method preferences (note: we do not store full credit card numbers)
• Records of any complaints, feedback or disputes you have raised with us

Website and Technical Information

• Your Internet Protocol (IP) address, which may indicate your approximate geographic location within Australia or overseas
• The type and version of web browser you are using
• The operating system and device type you are using to access our website
• The pages of our website you visit, the order in which you visit them, and the time you spend on each page
• The URL of the website that referred you to our website, if applicable
• Search terms you enter into our website search function
• Cookie identifiers and similar tracking data (see Section 7 for more detail)
• Your approximate geographic location as determined by your IP address or device settings

Sensitive Information

We do not intentionally collect sensitive information (as defined in the Privacy Act, including health information, racial or ethnic origin, political opinions, religious beliefs, sexual orientation, criminal records, or biometric data) unless it is directly relevant to a specific purpose and you have provided your express consent. If you believe you have inadvertently provided us with sensitive information, please contact us immediately so we can take appropriate steps.

Information About Third Parties

If you provide us with personal information about another person — for example, a colleague, employee, or site contact — you represent and warrant that you have obtained that person's consent to provide their information to us and that they are aware of this Privacy Policy. We will handle that information in accordance with this policy.

Steel Source Australia collects personal information in a number of ways, depending on how you interact with our business. As a company that operates nationally from our New South Wales base, we interact with customers and stakeholders across Australia through a variety of channels, and we collect personal information through each of these channels in the ways described below.

Direct Collection — From You

The primary way we collect personal information is directly from you. This occurs when you:

• Submit an enquiry through our website contact form or product enquiry form
• Add products to your enquiry cart and submit a checkout enquiry through our website
• Call our sales team on 0467 158 771
• Send us an email at support@steelsource.com.au or any other Steel Source Australia email address
• Visit our premises in New South Wales and speak with our team in person
• Attend a trade show, industry event or exhibition where Steel Source Australia is present
• Apply for a trade account or credit account with us
• Submit a job application or employment enquiry
• Respond to a survey, promotion or marketing communication from us
• Register for or attend a product demonstration, training session or industry event hosted by Steel Source Australia

Indirect Collection — From Third Parties

In some circumstances, we may collect personal information about you from third parties. This may occur when:

• A colleague, employer, contractor or business associate provides your contact details to us as a project contact or site contact
• A referral partner or industry contact refers you to Steel Source Australia
• We conduct credit checks or verify business information through authorised credit reporting agencies or business information services
• We receive information from publicly available sources such as business directories, the Australian Securities and Investments Commission (ASIC) register, or professional association directories
• We receive information from our logistics and delivery partners regarding delivery contacts at project sites

Where we collect personal information about you from a third party, we will take reasonable steps to notify you of that collection as soon as practicable, unless it is impractical or unreasonable to do so in the circumstances.

Automatic Collection — Website and Technology

When you visit our website, certain information is collected automatically through the use of cookies, web server logs and similar technologies. This information is primarily technical in nature and is used to improve the performance and functionality of our website. Please refer to Section 7 of this policy for detailed information about our use of cookies and tracking technologies.

Unsolicited Information

Occasionally, we may receive personal information that we did not solicit — for example, if someone sends us an unsolicited email containing personal information about a third party. In such cases, we will assess whether we could have collected that information through our normal collection processes. If we determine that we could not have collected it, or that it is not reasonably necessary for our functions, we will destroy or de-identify the information as soon as practicable, provided it is lawful and reasonable to do so.

Steel Source Australia collects, holds and uses personal information only for purposes that are directly related to our functions and activities as a steel supplier and service provider, or for purposes that you would reasonably expect given the context in which the information was collected. We do not collect personal information unless it is reasonably necessary for one or more of the purposes described in this section.

Primary Purposes

The primary purposes for which we collect and use personal information include:

• To respond to your product enquiries, requests for quotation, and requests for information about our steel products and services
• To prepare, issue and manage quotations for the supply of steel products, fencing systems, roofing materials, structural steel, and associated services
• To process, confirm and fulfil orders for steel products and services, including coordinating delivery to project sites across New South Wales and all other Australian states and territories
• To arrange and manage the delivery of products to your nominated delivery address, whether that is in metropolitan Sydney, regional New South Wales, or any other location across Australia
• To communicate with you about your enquiry, quotation, order, delivery, or any other aspect of your dealings with Steel Source Australia
• To manage your trade account or credit account, including conducting credit assessments and managing payment terms
• To process payments and manage accounts receivable
• To provide after-sales support, including responding to questions about products you have purchased, assisting with warranty claims, and resolving any issues with your order
• To manage and resolve complaints, disputes or claims arising from the supply of our products or services

Secondary Purposes

We may also use your personal information for the following secondary purposes, which are related to our primary business functions:

• To improve our website, products, services and business processes based on feedback and usage data
• To conduct market research and analyse trends in the Australian steel industry
• To send you product updates, new product announcements, promotional offers, industry news and other marketing communications — but only where you have consented to receive such communications or where we are otherwise permitted to do so under applicable law
• To personalise your experience on our website and tailor the content and products we display to you based on your browsing history and preferences
• To maintain and update our customer database and business records
• To train and develop our staff in customer service and product knowledge
• To conduct internal audits, risk assessments and quality assurance processes
• To protect the security and integrity of our business, website and systems
• To detect, investigate and prevent fraud, theft, misconduct or other unlawful activity
• To comply with our legal, regulatory and contractual obligations under Australian law
• To enforce our Terms and Conditions and other agreements
• To respond to requests from government agencies, law enforcement bodies, courts or tribunals as required or permitted by law

Direct Marketing

We may use your personal information to send you direct marketing communications about our products, services, promotions and industry news. We will only do this where you have consented to receive such communications, or where we are permitted to do so under the Spam Act 2003 (Cth) or other applicable legislation. Every marketing communication we send will include a clear and easy mechanism for you to opt out of receiving further communications. If you opt out, we will process your request within a reasonable time and will not send you further marketing communications, although we may still contact you for non-marketing purposes related to your account or orders.

Steel Source Australia does not sell, rent, trade or otherwise transfer your personal information to third parties for their own commercial purposes. We treat your personal information with the utmost confidentiality and will only disclose it in the circumstances described in this section.

Disclosure to Service Providers and Business Partners

In the course of operating our business and delivering products and services to customers across Australia, we may disclose your personal information to the following categories of third parties who assist us in our operations:

• Freight, logistics and delivery companies who transport our steel products to project sites and delivery addresses across New South Wales and all other Australian states and territories, including metropolitan and regional areas
• Information technology service providers who host, maintain and support our website, customer database, email systems, and other business technology infrastructure
• Cloud computing and data storage providers who store our business data and customer records on our behalf
• Email marketing platforms and customer relationship management (CRM) software providers who help us manage our communications with customers
• Payment processing companies and financial institutions who process credit card payments, EFT transactions, and other payment methods on our behalf
• Finance and buy-now-pay-later providers, including Afterpay and Handy Finance, who provide financing options to our customers
• Credit reporting agencies and business information services who assist us in assessing credit applications for trade accounts
• Professional advisers including lawyers, accountants, auditors and insurers who provide professional services to Steel Source Australia
• Manufacturers, distributors and suppliers of steel products and related materials who may need to be involved in fulfilling your order or resolving a product issue
• Industry bodies, standards organisations and certification authorities in connection with product compliance and quality assurance

Where we disclose your personal information to third-party service providers, we take reasonable contractual and practical steps to ensure that those providers handle your information in a manner consistent with the APPs and this Privacy Policy. We require our service providers to use your personal information only for the purpose for which it was disclosed to them and not to disclose it to any other party without our consent.

Disclosure Required by Law

We may be required to disclose your personal information to government agencies, regulatory bodies, law enforcement agencies, courts, tribunals or other authorities where we are required or authorised to do so by law. This may include, for example, disclosure to the Australian Taxation Office, the Fair Work Commission, WorkSafe authorities in relevant states and territories, or law enforcement agencies investigating fraud or other criminal activity. We will only make such disclosures to the extent required or permitted by law and will take reasonable steps to notify you of any such disclosure where we are permitted to do so.

Disclosure in Business Transactions

In the event that Steel Source Australia is involved in a merger, acquisition, sale of assets, restructuring, or other business transaction, your personal information may be disclosed to the other party or parties involved in that transaction as part of the due diligence process or as part of the transfer of business assets. In such circumstances, we will take reasonable steps to ensure that the recipient of your personal information is bound by obligations of confidentiality and privacy protection consistent with this policy.

Steel Source Australia is an Australian company and our primary operations are based in New South Wales. We prefer to use Australian-based service providers wherever practicable. However, some of the third-party technology platforms and service providers we use to operate our business may store, process or access personal information outside of Australia. This may include cloud computing platforms, email service providers, customer relationship management systems, and analytics platforms that operate data centres in countries such as the United States of America, the United Kingdom, Ireland, Singapore, or other countries.

Under APP 8 of the Privacy Act, before disclosing personal information to an overseas recipient, we are required to take reasonable steps to ensure that the overseas recipient does not breach the APPs in relation to that information. We take this obligation seriously and take the following steps to protect your information when it is disclosed overseas:

• We select overseas service providers that are subject to privacy laws or binding contractual obligations that provide a standard of protection for personal information that is, overall, at least equivalent to the protection provided by the APPs
• We review the privacy policies and data processing agreements of overseas service providers before engaging them
• We include data processing clauses in our contracts with overseas service providers that require them to handle personal information in accordance with the APPs
• We monitor our overseas service providers on an ongoing basis to ensure continued compliance with our privacy requirements

By providing us with your personal information and using our website and services, you acknowledge that your personal information may be transferred to and stored in countries outside Australia. If you have concerns about overseas disclosure of your personal information, please contact us to discuss your options.

Steel Source Australia takes the security of your personal information extremely seriously. We implement a comprehensive range of technical, organisational and physical security measures to protect your personal information from misuse, interference, loss, unauthorised access, modification and disclosure. These measures are reviewed and updated regularly to ensure they remain appropriate and effective.

Technical Security Measures

• All data transmitted between your browser and our website is encrypted using Transport Layer Security (TLS) technology, as indicated by the "https://" prefix in our website address
• Our website and customer database are hosted on secure server infrastructure with industry-standard firewall protection
• Access to our customer database and business systems is protected by strong password policies and, where available, multi-factor authentication
• We use role-based access controls to ensure that only authorised personnel can access personal information, and only to the extent necessary for their role
• Our systems are regularly updated with security patches and software updates to protect against known vulnerabilities
• We conduct regular security assessments and vulnerability testing of our website and business systems

Organisational Security Measures

• All Steel Source Australia employees and contractors who handle personal information are required to comply with this Privacy Policy and our internal privacy and data security procedures
• We provide privacy and data security training to our staff to ensure they understand their obligations and handle personal information appropriately
• We have internal procedures for responding to data breaches and privacy incidents, including our obligations under the Notifiable Data Breaches (NDB) scheme
• We conduct regular reviews of our privacy practices and this Privacy Policy to ensure they remain current and compliant with applicable law

Physical Security Measures

• Physical access to our premises in New South Wales, where paper records and computer systems containing personal information are held, is restricted to authorised personnel
• Paper records containing personal information are stored securely and disposed of by secure shredding when no longer required
• Computer equipment containing personal information is secured against theft and unauthorised access

Notifiable Data Breaches

Under the Notifiable Data Breaches (NDB) scheme established by Part IIIC of the Privacy Act, Steel Source Australia is required to notify the Office of the Australian Information Commissioner (OAIC) and affected individuals if we experience an eligible data breach — that is, a data breach that is likely to result in serious harm to any of the individuals whose personal information is involved. If we experience a data breach, we will conduct a prompt assessment to determine whether it is an eligible data breach, and if so, we will notify the OAIC and affected individuals as required by law. We will also take immediate steps to contain the breach and prevent further harm.

Despite our best efforts, no method of data transmission over the internet or method of electronic storage is completely secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee its absolute security. If you have reason to believe that your personal information has been compromised, please contact us immediately.

Our website uses cookies and similar tracking technologies to improve your browsing experience, analyse how our website is used, and provide us with information that helps us improve our products and services. This section explains what cookies are, what types of cookies we use, and how you can manage your cookie preferences.

What Are Cookies?

Cookies are small text files that are placed on your computer, smartphone, tablet or other device when you visit a website. They are widely used to make websites work more efficiently and to provide information to website owners. Cookies can be "session cookies" (which are deleted when you close your browser) or "persistent cookies" (which remain on your device for a set period of time or until you delete them). Cookies can also be "first-party cookies" (set by the website you are visiting) or "third-party cookies" (set by a third party such as an analytics or advertising provider).

Types of Cookies We Use

• Essential Cookies: These cookies are strictly necessary for our website to function correctly. They enable core functionality such as page navigation, access to secure areas of the website, and the operation of our enquiry cart. Without these cookies, our website cannot function properly. These cookies do not collect any personal information and cannot be disabled.
• Analytics Cookies: We use analytics cookies, including Google Analytics, to collect information about how visitors use our website. This information includes the pages visited, the time spent on each page, the source of traffic, and the geographic location of visitors (at a city or regional level). This information is used in aggregate form to help us understand how our website is being used and to identify areas for improvement. Analytics cookies do not identify individual users.
• Preference Cookies: These cookies allow our website to remember choices you have made, such as your preferred language or region, to provide a more personalised experience. They may also be used to remember information you have entered into forms so that you do not need to re-enter it.
• Marketing and Tracking Cookies: We may use marketing cookies to track visitors across websites and to display relevant advertisements. These cookies are set by third-party advertising networks and are used to build a profile of your interests and show you relevant advertisements on other websites. We do not use these cookies to collect sensitive personal information.

Managing Your Cookie Preferences

You can control and manage cookies in a number of ways. Most web browsers allow you to refuse cookies, delete existing cookies, or be notified when a new cookie is set. The method for doing this varies between browsers — please refer to your browser's help documentation for instructions. Please note that if you disable or delete cookies, some parts of our website may not function correctly and your user experience may be affected.

You can also opt out of Google Analytics tracking by installing the Google Analytics Opt-out Browser Add-on, available at tools.google.com/dlpage/gaoptout.

Steel Source Australia retains personal information for as long as it is necessary to fulfil the purposes for which it was collected, or as required or permitted by Australian law. The retention period for personal information varies depending on the type of information and the purpose for which it was collected. The following general retention periods apply to the main categories of personal information we hold:

• Customer enquiry records (including enquiry forms, email correspondence and quotation records): retained for a minimum of seven (7) years from the date of the enquiry or the last interaction with the customer, in accordance with general business record-keeping requirements and potential limitation periods for legal claims under Australian law
• Order and transaction records (including purchase orders, invoices, delivery records and payment records): retained for a minimum of seven (7) years from the date of the transaction, in accordance with the requirements of the Australian Taxation Office and the Corporations Act 2001 (Cth)
• Customer account records (including trade account applications, credit assessments and account history): retained for a minimum of seven (7) years from the date the account is closed or the last transaction is recorded
• Employee and contractor records: retained in accordance with applicable employment law requirements, generally for a minimum of seven (7) years from the end of the employment or engagement
• Website analytics data: retained in aggregate, anonymised form for up to three (3) years for the purpose of analysing website usage trends
• Marketing consent records: retained for as long as you remain on our marketing list, plus a reasonable period thereafter to demonstrate compliance with our marketing obligations

When personal information is no longer required for any of the purposes described in this policy and is not required to be retained by law, we will take reasonable steps to destroy or permanently de-identify that information. Destruction of paper records is carried out by secure shredding. Destruction of electronic records is carried out by secure deletion or overwriting of data storage media.

Under the Privacy Act and the APPs, you have important rights in relation to the personal information that Steel Source Australia holds about you. We are committed to upholding these rights and making it as easy as possible for you to exercise them.

Right of Access

You have the right to request access to the personal information that Steel Source Australia holds about you. This includes the right to know what personal information we hold, how we collected it, how we have used it, and to whom we have disclosed it. To make an access request, please contact us using the details provided at the end of this policy. We will respond to your request within 30 days of receipt. In some cases, we may need to verify your identity before we can provide access to your personal information, to ensure that we do not disclose your information to an unauthorised person.

We will provide access to your personal information free of charge in most cases. However, if your request is complex or requires significant time and resources to fulfil, we may charge a reasonable fee to cover our costs. We will notify you of any applicable fee before processing your request.

There are limited circumstances in which we may refuse to provide access to personal information, including where providing access would pose a serious threat to the life, health or safety of any individual, where providing access would have an unreasonable impact on the privacy of other individuals, where the request is frivolous or vexatious, or where we are required or authorised by law to refuse access. If we refuse your access request, we will provide you with written reasons for the refusal and information about how you can complain about the decision.

Right of Correction

You have the right to request that we correct personal information about you that is inaccurate, out of date, incomplete, irrelevant or misleading. If you believe that any personal information we hold about you is incorrect, please contact us and we will take reasonable steps to correct it. We will respond to your correction request within 30 days of receipt. If we correct your personal information, we will also take reasonable steps to notify any third parties to whom we have previously disclosed the incorrect information, if it is practicable and appropriate to do so.

If we refuse to correct your personal information, we will provide you with written reasons for the refusal and information about how you can complain about the decision. You may also request that we associate a statement with the relevant information noting that you believe it is inaccurate, out of date, incomplete, irrelevant or misleading.

How to Make a Request

To make an access or correction request, please contact us in writing using the contact details provided at the end of this policy. Please include your full name, contact details, and a clear description of the information you wish to access or correct. We may ask you to provide proof of identity before processing your request.

Steel Source Australia takes privacy complaints seriously and is committed to resolving any concerns you may have about our handling of your personal information promptly and fairly. If you believe that we have breached the APPs, this Privacy Policy, or any other applicable privacy obligation, we encourage you to contact us in the first instance so that we have the opportunity to address your concern.

Making a Privacy Complaint

To make a privacy complaint, please contact us in writing using the details provided at the end of this policy. Please include your full name, contact details, a clear description of your complaint, and any relevant supporting information. We will acknowledge receipt of your complaint within five (5) business days and will provide you with a substantive response within thirty (30) days of receipt. If your complaint is complex and requires more time to investigate, we will notify you of the expected timeframe for resolution.

Escalation to the OAIC

If you are not satisfied with our response to your complaint, or if we have failed to respond within the timeframe set out above, you have the right to lodge a complaint with the Office of the Australian Information Commissioner (OAIC). The OAIC is the independent national regulator for privacy and freedom of information in Australia. You can contact the OAIC as follows:

• Website: www.oaic.gov.au
• Phone: 1300 363 992
• Post: GPO Box 5218, Sydney NSW 2001
• Email: enquiries@oaic.gov.au

The OAIC can investigate your complaint and, if it finds that we have breached the Privacy Act, can make a determination requiring us to take remedial action, including paying compensation in appropriate cases.

Our website may contain links to third-party websites, including the websites of product manufacturers, industry associations, government agencies, and other organisations that may be of interest to our customers. These links are provided for your convenience and do not constitute an endorsement by Steel Source Australia of those websites or their content. Steel Source Australia has no control over the content, privacy practices or security of third-party websites, and we are not responsible for the privacy practices of those websites.

We strongly encourage you to review the privacy policies of any third-party websites you visit before providing them with your personal information. The privacy practices of third-party websites are governed by their own privacy policies, not by this Privacy Policy. Steel Source Australia accepts no responsibility or liability for the privacy practices of third-party websites.

Our website and services are directed at businesses and adults engaged in the construction, engineering, agricultural and related industries across Australia. We do not knowingly collect personal information from children under the age of 18. If you are under 18 years of age, please do not provide us with any personal information without the consent and supervision of a parent or guardian. If we become aware that we have inadvertently collected personal information from a child under 18 without appropriate consent, we will take steps to delete that information as soon as practicable.

Steel Source Australia reserves the right to update, amend or replace this Privacy Policy at any time to reflect changes in our business practices, changes in applicable law, or improvements in our privacy practices. When we make changes to this policy, we will update the "Last updated" date at the top of this page and post the revised policy on our website. We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your personal information.

If we make material changes to this Privacy Policy that significantly affect how we handle your personal information, we will take reasonable steps to notify you of those changes, which may include posting a prominent notice on our website or sending you an email notification if we have your email address on file. Your continued use of our website or services after the updated Privacy Policy has been posted constitutes your acceptance of the changes.

If you have any questions about changes to this Privacy Policy, please contact us using the details provided below.