PRIMAX AI PTY LTD (ABN 71 680 726 158) operates the PRiMAX website (primaxai.io) and the PRiMAX behavioral intelligence platform. This policy explains how we collect, use, disclose, and protect your information under the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This policy applies to visitors of primaxai.io, users who interact with websites and digital properties powered by PRiMAX technology on behalf of our business clients ("Customers"), and individuals who create PRiMAX accounts.

PRiMAX provides behavioral intelligence services to business Customers across different engagement models. Our privacy obligations vary depending on our role in each engagement. When we act as a Data Controller (Property Intelligence services): For our property intelligence Customers, PRiMAX collects and processes personal information directly, including information you provide through inquiry forms, registration pages, and other digital touchpoints on Customer websites. In these engagements, PRiMAX determines the purposes and means of processing and is directly responsible for meeting all applicable privacy obligations described in this policy. You may exercise your privacy rights by contacting us directly using the details in Section 14. When we act as a Service Provider / Data Processor (Behavioral Insights services): For certain Customers, including those in financial services and other regulated industries, PRiMAX provides behavioral analytics, journey tracking, and lead scoring services without accessing or storing directly identifying personal information such as names, email addresses, or phone numbers. In these engagements, our Customer determines how and why personal information is collected and used. PRiMAX processes only technical and behavioral data, such as device attributes, browsing patterns, and engagement signals, strictly under the Customer's instructions and in accordance with a Data Processing Agreement. If you wish to exercise your privacy rights in connection with these services, please contact the relevant Customer directly, as they control any linkage between behavioral data and your identity. When we act as a Controller for our own business purposes: Regardless of the engagement model, PRiMAX collects certain information about visitors to primaxai.io for our own business purposes, including website analytics, security, and service improvement. For this processing, PRiMAX is the data controller.

When you visit a website powered by PRiMAX technology, we collect first-party behavioral and technical data automatically, without requiring an account. This includes browsing behavior such as pages viewed, time on page, scroll depth, click patterns, navigation paths, return visit frequency, and content engagement depth. It also includes interaction data such as unit or floorplan interactions, inquiry form engagement, content downloads, and feature usage (for property intelligence services). We collect device and browser attributes including browser type and version, operating system, screen resolution, installed fonts, language settings, time zone, and other technical characteristics used to generate a device fingerprint (see Section 4). We also collect network information including your IP address (used to derive approximate geographic location and then truncated or discarded), referring URL, and search terms that led you to the site. We use cookies and tracking pixels configured to minimize personal information collection in compliance with APP 1, APP 3, and APP 5. If you create an account or submit an inquiry through a PRiMAX-powered website, we may also collect your name, email address, phone number, contact preferences, and project or product registrations. This information is collected only in our Property Intelligence services, where PRiMAX operates as a data controller. In our Behavioral Insights services, PRiMAX does not collect, receive, or store your name, email, phone number, or other directly identifying information. Any forms you complete on a Behavioral Insights Customer's website are processed by that Customer directly. In some engagements, Customers may provide PRiMAX with aggregated or anonymized datasets such as campaign performance data or market benchmarks to enhance analytics outputs. We do not receive identified personal information from Customers in our Behavioral Insights engagements.

PRiMAX uses several technologies to understand how users interact with our Customers' digital properties. We believe in being upfront about what these technologies are and how they work. We collect technical attributes from your device and browser, including browser type and version, operating system, screen resolution, installed fonts, language settings, time zone, and other technical characteristics. We combine these attributes to create a device identifier ("device fingerprint"). This identifier helps recognize your device across browsing sessions without relying solely on cookies. Unlike cookies, device fingerprints are derived from your device's technical configuration and may persist even if you clear your browser data. We use first-party cookies to support session management, remember preferences, and collect behavioral data. We do not use third-party advertising cookies. A full breakdown of cookie categories is provided through the consent mechanism on each Customer's website. We also use small, transparent tracking pixels embedded on web pages to record page views, session activity, and engagement events. These pixels may transmit your IP address, browser type, and the time of your visit. Where enabled by a Customer, PRiMAX may track user behavior across multiple digital properties operated by or on behalf of the same Customer. This cross-site tracking enables a complete view of the user journey and improves lead scoring accuracy. We do not track users across unrelated third-party websites. How tracking differs by service model: In our Property Intelligence services, tracking data may be linked to identifying information you provide (such as your name and email) to create enriched lead profiles delivered to our Customer's CRM. In our Behavioral Insights services, tracking data is processed using device-level identifiers without linkage to your identity. PRiMAX does not receive or store your name, email, or other directly identifying information in these engagements. The Customer maintains any identity linkage separately under their own privacy controls.

We use behavioral data to power PRiMAX analytics, including demand and engagement insights (anonymized, aggregated analytics into demand patterns, content resonance, pricing signals, and campaign performance licensed to Customers, permitted under APP 6 and aligned with OAIC data analytics guidance), lead scoring and behavioral profiling (automated analysis of behavioral signals to generate lead scores as described in Section 6), and product improvement (aggregated behavioral data used to improve PRiMAX models, refine scoring algorithms, and develop new analytics capabilities, using only de-identified data). Personal data collected through our Property Intelligence services is shared only with the relevant Customer (property developer) and their authorized sales teams for follow-up about projects you've expressed interest in. We do not use your personal data for advertising or third-party marketing, and we do not sell it to anyone. Information collected from visitors to our own website (primaxai.io) is used for website analytics, security monitoring, responding to inquiries, and service improvement.

Lead scoring is a core part of what PRiMAX does, and we want to be transparent about how it works. Scores are derived from behavioral signals including pages visited, time spent on specific content, return visit frequency, content engagement depth, navigation patterns, referral sources, and device characteristics. In our Property Intelligence services, scores may also incorporate information you have provided directly, such as your stated budget, property preferences, or contact details. Lead scores help our Customers prioritize outreach and allocate resources more effectively. In our Property Intelligence services, high-scoring leads may be contacted directly by a Customer's sales agents. In our Behavioral Insights services, scores are provided to the Customer through an analytics dashboard and do not directly trigger automated communications from PRiMAX. Lead scores are decision-support tools designed to assist, not replace, human judgment. Our Customers' teams review and act on lead scores as part of their normal sales and marketing processes. PRiMAX does not make automated decisions that produce legal effects or similarly significant effects on individuals without meaningful human oversight. You have the right to be informed that profiling is taking place (which this policy provides), to object to profiling where it is used for direct marketing purposes, and to request human review of any decision significantly affected by automated profiling. To exercise these rights, contact PRiMAX directly for Property Intelligence services, or contact the relevant Customer for Behavioral Insights services (see Section 12).

We do not sell your personal data. Full stop. Personal data collected through our Property Intelligence services is disclosed only to the relevant Customer and their authorized representatives for the purpose of responding to your expressed interest in their projects or products. Anonymized and aggregated behavioral data may be shared with Customers for benchmarking, reporting, and market insights. These aggregate outputs contain no information that could reasonably identify an individual. In our Behavioral Insights services, PRiMAX provides Customers with behavioral analytics and lead scores derived from technical and device-level data. Because PRiMAX does not hold directly identifying information in these engagements, the Customer is responsible for any linkage to individual identities and for all downstream use of insights. We may also disclose information where required or authorized by law, in response to enforceable government requests, or to protect the rights, safety, or property of PRiMAX, our Customers, or the public.

PRiMAX stores and processes all information using cloud infrastructure located in Australia. If this changes in the future, we will update this section and take reasonable steps to ensure any overseas recipient handles information in accordance with the Australian Privacy Principles, including through contractual obligations and Data Processing Agreements that require equivalent protections.

From your first visit, we clearly inform you that behavioral tracking is active on websites powered by PRiMAX technology. Our Customers are responsible for implementing appropriate consent mechanisms on their own websites, and we provide them with the tools and guidance to do so. For our Property Intelligence services, a cookie and tracking consent mechanism is presented before non-essential tracking technologies are activated. For our Behavioral Insights services, the Customer determines and manages the consent mechanism appropriate to their industry and regulatory requirements. PRiMAX provides technical support including the ability to suppress tracking for users who do not consent. We honor Do Not Track (DNT) and Global Privacy Control (GPC) signals where technically feasible, noting that opting out of all tracking may limit the functionality of certain website features.

All data is encrypted in transit (TLS/SSL) and at rest using industry-standard encryption. Access is strictly restricted to authorized personnel through role-based access controls and multi-factor authentication. We conduct regular security assessments, maintain SOC 2 Type II alignment, and require our team to complete data handling training. In the event of a data breach that is likely to result in serious harm to affected individuals, PRiMAX will notify the Office of the Australian Information Commissioner (OAIC) and affected individuals in accordance with the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act 1988. Where PRiMAX acts as a processor, we will promptly notify the relevant Customer so they can fulfill their own breach notification obligations.

We retain personal information only for as long as necessary to fulfill the purposes described in this policy, or as required by law. Behavioral and device data collected through our Property Intelligence services is retained for the duration of the Customer's active campaign plus 12 months, then de-identified or deleted. Behavioral and device data collected through our Behavioral Insights services is retained for the duration of the Customer engagement plus 6 months, then aggregated and de-identified. Personal data from account holders and form submissions is retained for the duration of your account or the relevant Customer engagement, then deleted upon request or at engagement end unless a legal obligation requires otherwise. Lead scores and profiling outputs are retained for the duration of the Customer engagement plus 6 months. Technical logs including IP addresses and server access logs are retained for 90 days for security and troubleshooting purposes, then deleted. Where we de-identify personal information, we apply techniques including aggregation, suppression, and generalization to ensure individuals cannot be reasonably re-identified. We regularly reassess re-identification risk in accordance with the OAIC's De-Identification Decision-Making Framework. De-identified information is not subject to the Australian Privacy Principles and may be used for product improvement, research, and analytics. In our Behavioral Insights engagements, data is processed using device-level identifiers without linkage to directly identifying information. While this constitutes pseudonymization (and the data remains subject to privacy obligations), it significantly reduces privacy risk by ensuring PRiMAX cannot independently identify individuals. The Customer holds any linkage keys separately under their own privacy controls.

Under the Privacy Act 1988, you have the right to request access to the personal information we hold about you (APP 12), request correction of personal information that is inaccurate, out of date, incomplete, or misleading (APP 13), withdraw consent to behavioral tracking at any time through the consent mechanism on the relevant website or by enabling Do Not Track or Global Privacy Control signals in your browser, request that your behavioral data not be used for lead scoring purposes, and request deletion of your personal data and account. Deletion of personal data does not affect previously generated anonymized or aggregated insights. For Property Intelligence services where PRiMAX is the data controller, contact us directly at the details in Section 14. For Behavioral Insights services where PRiMAX acts as a processor, contact the relevant Customer. PRiMAX will assist our Customers in responding to your requests in accordance with our Data Processing Agreement.

PRiMAX does not knowingly collect personal information from children under 16 years of age. If we become aware that we have inadvertently collected such information, we will take steps to delete it promptly. If you believe a child's information has been collected through a PRiMAX-powered service, please contact us immediately.

This policy is effective from September 2025. We may revise it periodically. Major changes will be communicated via our website or, where we hold your contact details, by email. We encourage you to review this policy regularly. For privacy queries, rights requests, or complaints, contact the Privacy Officer at PRIMAX AI PTY LTD via email at privacy@primaxai.io. If you believe we have breached the Australian Privacy Principles, you may lodge a complaint with us using the details above. We will acknowledge your complaint within 7 days and provide a substantive response within 30 days. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.