Privacy Policy

1. THE RESILIENCE PROJECT PTY. LTD. commitment to privacy.

(a) THE RESILIENCE PROJECT PTY. LTD. (ABN: 70609613381), its subsidiaries and affiliates in Australia (collectively referred to as “we” and “us”) are committed to managing personal information in accordance with the Australian Privacy Principles under the Privacy Act 1988 (Cth) (as amended by the Privacy and Other Legislation Amendment Bill 2024) and in accordance with other applicable privacy laws. (b) This document sets out our policies for managing your personal information and is referred to as our Privacy Policy. (c) In this Privacy Policy, “we” and “us” refers to THE RESILIENCE PROJECT PTY. LTD. and “you” refers to any individual about whom we collect personal information.

2. About THE RESILIENCE PROJECT PTY. LTD.

(a) THE RESILIENCE PROJECT PTY. LTD. is a for-purpose organisation, focused on teaching positive mental health strategies to help people feel happier and more resilient. (b) THE RESILIENCE PROJECT PTY. LTD. offers a complete range of services, including programs, content, resources, workshops, presentations and events, delivered in a range of settings, including schools, early years services, workplaces and with the general public.

3. What information does THE RESILIENCE PROJECT PTY. LTD. collect about you?

3.1 Clients and prospective clients

i) When you enquire about our services or when you become a client of THE RESILIENCE PROJECT PTY. LTD., a record is made which includes your personal information.

ii) The type of personal information that we collect will vary depending on the circumstances of collection and the kind of service that you request from us, but will typically include:

(1) your name, e-mail, phone number, and other contact details;

(2) information about your role, employer or an organisation who you represent; and

(3) any additional personal information you provide to us, or authorise us to collect, as part of your interaction with THE RESILIENCE PROJECT PTY. LTD..

3.2 Prospective employees or applicants

i) We collect personal information when recruiting personnel, such as your name, contact details, qualifications and work history. Generally, we will collect this information directly from you.

ii) We may also collect personal information from third parties in ways which you would expect (for example, from recruitment agencies or referees you have nominated). Before offering you a position, we may collect additional details such as your tax file number and superannuation information and other information necessary to conduct background checks to determine your suitability for certain positions (for example, positions which involve working with children).

3.3 Other individuals

i) THE RESILIENCE PROJECT PTY. LTD. may collect personal information about other individuals who are not clients of THE RESILIENCE PROJECT PTY. LTD.. This includes customers and members of the public who participate in events we are involved with, individual service providers and contractors to THE RESILIENCE PROJECT PTY. LTD., and other individuals who interact with THE RESILIENCE PROJECT PTY. LTD. on a commercial basis. The kinds of personal information we collect will depend on the capacity in which you are dealing with THE RESILIENCE PROJECT PTY. LTD..

ii) If you are participating in an event we are managing or delivering, we may take images or audio-visual recordings which identify you.

iii) In limited circumstances, THE RESILIENCE PROJECT PTY. LTD. may collect information which is considered sensitive information. For example, if you are injured at an event promoted or delivered by THE RESILIENCE PROJECT PTY. LTD. we may collect health information about you in an emergency or otherwise with your consent.

iv) We may collect personal information about children (for example, when children participate in events we are involved with). Where children do not have sufficient maturity and understanding to make decisions about their personal information, we will require their parents or guardians to make decisions on their behalf. THE RESILIENCE PROJECT PTY. LTD. Will comply with any applicable Children’s Online Privacy Code issued by the OAIC under the Privacy Act.

v) You can always decline to give THE RESILIENCE PROJECT PTY. LTD. any personal information we request, but that may mean we cannot provide you with some or all of the services you have requested. If you have any concerns about personal information we have requested, please let us know.

3.4 Visitors to our website The way in which we handle the personal information of visitors to our websites is discussed in clause 5.

4. How and why does THE RESILIENCE PROJECT PTY. LTD. collect and use your personal information?

(a) THE RESILIENCE PROJECT PTY. LTD. collects personal information reasonably necessary to carry out our business, to assess and manage our clients’ needs, and provide services including programs, content, resources, workshops, presentations and events, delivered in a range of settings, including schools, early years services, workplaces and with the general public. We may also collect information to fulfil administrative functions associated with these services, for example billing, entering into contracts with you or third parties and managing client relationships. (b) The purposes for which THE RESILIENCE PROJECT PTY. LTD. usually collects and uses personal information depends on the nature of your interaction with us, but may include:

(i) responding to requests for information and other general inquiries;

(ii) managing, planning, advertising and administering programs, events, competitions and performances;

(iii) researching, developing and expanding our facilities and services;

(iv) informing you of our activities, events, facilities and services;

(v) recruitment processes (including for volunteers, internships and work experience);

(vi) responding to enquires and complaints; and

(vii) subscribing to email marketing & communication, purchasing products & services.

(c) THE RESILIENCE PROJECT PTY. LTD. generally collects personal information directly from you. We may collect and update your personal information over the phone, by email, over the internet or social media, or in person. We may also collect personal information about you from other sources, for example:

(i) our affiliated and related companies; and

(ii) third party suppliers and contractors who assist us to operate our business.

(d) THE RESILIENCE PROJECT PTY. LTD. also collects and uses personal information for market research purposes and to innovate our delivery of products and services.

5. How does THE RESILIENCE PROJECT PTY. LTD. interact with you via the internet?

(a) You may visit our website (https://theresilienceproject.com.au/ or associated subdomains) without identifying yourself. If you identify yourself (for example, by providing your contact details in an enquiry), any personal information you provide to THE RESILIENCE PROJECT PTY. LTD. will be managed in accordance with this Privacy Policy. (b) THE RESILIENCE PROJECT PTY. LTD.’s website uses cookies. A “cookie” is a small file stored on your computer’s browser, which assists in managing customised settings of the website and delivering content. We collect certain information such as your device type, browser type, IP address, pages you have accessed on our websites and on third-party websites. You are not identifiable from such information. (c) You can use the settings in your browser to control how your browser deals with cookies. However, in doing so, you may be unable to access certain pages or content on our website. (d) THE RESILIENCE PROJECT PTY. LTD.’s website may contain links to third-party websites. THE RESILIENCE PROJECT PTY. LTD. is not responsible for the content or privacy practices of websites that are linked to our website. (e) We partner with Microsoft Clarity and Microsoft Advertising to capture how you use and interact with our website through behavioural metrics, heatmaps, and session replay to improve and market our products and services. Website usage data is captured using first and third-party cookies and other tracking technologies to determine the popularity of products and services and online activity. We also use this information for site optimisation, fraud and security purposes, and advertising. For more information about how Microsoft collects and uses your data, visit the Microsoft Privacy Statement.

6. Can you deal with THE RESILIENCE PROJECT PTY. LTD. anonymously?

THE RESILIENCE PROJECT PTY. LTD. will provide individuals with the opportunity to remain anonymous or use a pseudonym in their dealings with us where it is lawful and practicable (for example, when making a general enquiry). Generally, it is not practicable for THE RESILIENCE PROJECT PTY. LTD. to deal with individuals anonymously or pseudonymously on an ongoing basis. If we do not collect personal information about you, you may be unable to utilise our services or participate in our events, programs or activities we manage or deliver.

7. How does THE RESILIENCE PROJECT PTY. LTD. hold information?

(a) THE RESILIENCE PROJECT PTY. LTD. stores information in paper-based files or other electronic record keeping methods in secure databases (including trusted third party storage providers based in Australia or overseas). Personal information may be collected in paper-based documents and converted to electronic form for use or storage (with the original paper-based documents either archived or securely destroyed). We take reasonable steps to protect your personal information from misuse, interference and loss and from unauthorised access, modification or disclosure. (b) THE RESILIENCE PROJECT PTY. LTD. maintains physical security over paper and electronic data stores, such as through locks and security systems at our premises. We also maintain computer and network security, for example, we use firewalls (security measures for the internet) and other security systems such as user identifiers and passwords to control access to our computer systems. Our websites use encryption (HTTPS/TLS) to support the secure transmission of information via the internet. We take reasonable steps to ensure the security of data transmitted through our websites, however users should still exercise care when transmitting personal information online. (d) We take steps to destroy or de-identify information that we no longer require.

8. Overseas disclosures and sub-processors

(a) To deliver our services, THE RESILIENCE PROJECT PTY. LTD. engages third-party service providers (“sub-processors”), some of which are located overseas or may access, transmit or store personal information in locations outside Australia. (b) The personal information you provide to our digital services — including your account details, your school’s records, your subscriptions, and your activity within our platforms — is stored and processed in Australia. (c) Limited technical metadata is processed by our sub-processors in the United States, including:

(i) IP addresses, browser information and security signals processed by our content delivery network and edge security provider;

(ii) video viewing telemetry (such as IP address, device information and playback events) processed by our video hosting provider; and

(iii) website usage data collected on our public marketing website through behavioural analytics tools (see clause 5(e)).

(d) Before engaging a sub-processor, we take reasonable steps to ensure that the sub-processor handles personal information in a manner consistent with the Australian Privacy Principles. These steps typically include:

(i) selecting reputable providers whose published terms include appropriate data protection commitments;

(ii) reviewing the sub-processor’s security and privacy practices, including relevant certifications such as ISO 27001 and SOC 2;

(iii) configuring services to keep data within Australia where reasonably practicable; and

(iv) ensuring data is encrypted in transit and at rest.

(e) The sub-processors used to deliver our Schools Hub service, including their purpose, the categories of data they process, the locations involved, and the transfer mechanism relied upon, are listed in Appendix A — Schools Hub Sub-Processor Register at the end of this Privacy Policy. (f) You may subscribe to advance notifications of changes to our Schools Hub sub-processors by emailing [email protected] with the subject line “Schools Hub sub-processor notifications”.

9. Data breach notification

(a) In the event of an eligible data breach, THE RESILIENCE PROJECT PTY. LTD. Will comply with the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act 1988. Where a data breach is likely to result in serious harm to any individual whose personal information is involved, we will notify the affected individuals and the Office of the Australian Information Commissioner as soon as practicable. THE RESILIENCE PROJECT PTY. LTD. maintains a data breach response plan to ensure timely identification, containment, and notification of data breaches.

10. Does THE RESILIENCE PROJECT PTY. LTD. use or disclose your personal information for direct marketing?

(a) THE RESILIENCE PROJECT PTY. LTD. may use or disclose your personal information for the purpose of informing you about our services, upcoming promotions and events, or other opportunities that may interest you. If you do not want to receive direct marketing communications, you can opt-out at any time by contacting us using the contact details refer to clause 14. (b) If you opt-out of receiving marketing material from us, THE RESILIENCE PROJECT PTY. LTD. may still contact you in relation to its ongoing relationship with you.

11. How does THE RESILIENCE PROJECT PTY. LTD. use and disclose personal information?

a) For clients The purposes for which we may use and disclose your personal information will depend on the services we are providing you. For example, if you have engaged us to deliver a service, we may disclose information about you to service providers where this is relevant to our services. b) For customers and participants If you are a customer or participant in an event, we may disclose your personal information to our clients and venues where this is reasonably necessary for, and relevant to, the delivery of the event. We may use images or audio-visual recordings which identify you for promotional purposes where you would reasonably expect this to occur. c) Disclosure to contractors and other service providers

i) THE RESILIENCE PROJECT PTY. LTD. may disclose information to third parties we engage in order to provide our services, including contractors and service providers used for data processing, data analysis, customer satisfaction surveys, information technology services and support, website maintenance/development, printing, archiving, and mail-outs. The sub-processors used to deliver our Schools Hub service are listed in Appendix A.

ii) Personal information may also be shared between related and affiliated companies of THE RESILIENCE PROJECT PTY. LTD., located in Australia or overseas.

iii) Third parties to whom we have disclosed your personal information may contact you directly to let you know they have collected your personal information and to give you information about their privacy policies.

d) Use and disclosure for administration and management THE RESILIENCE PROJECT PTY. LTD. will also use and disclose personal information for a range of administrative, management and operational purposes. This includes:

(i) administering billing and payments and debt recovery;

(ii) planning, managing, monitoring and evaluating our services;

(iii) quality improvement activities;

(iv) statistical analysis and reporting;

(v) training staff, contractors and other workers;

(vi) risk management and management of legal liabilities and claims (for example, liaising with insurers and legal representatives);

(vii) responding to enquiries and complaints regarding our services;

(viii) obtaining advice from consultants and other professional advisers; and

(ix) responding to subpoenas and other legal orders and obligations.

e) Other uses and disclosures We may use and disclose your personal information for other purposes explained at the time of collection or otherwise as set out in this Privacy Policy.

12. Use of artificial intelligence and automated decision-making

a) THE RESILIENCE PROJECT PTY. LTD. may use artificial intelligence tools and automated systems in the course of its operations. Where such tools process personal information, we will do so in accordance with this Privacy Policy and the Australian Privacy Principles. Where automated decision-making is used in a way that significantly affects an individual we will provide transparency about the nature of the automated process, the types of personal information involved, and how individuals may seek review of such decisions. We will update this section as further regulatory guidance is issued under the Privacy Act.

13. How can you access or seek correction of your personal information?

(a ) You are entitled to access your personal information held by THE RESILIENCE PROJECT PTY. LTD. on request. To request access to your personal information please contact our privacy officer using the contact details set out below. (b) You will not be charged for making a request to access your personal information but you may be charged for the reasonable time and expense incurred in compiling information in response to your request. (c) We will take reasonable steps to ensure that the personal information we collect, use or disclose is accurate, complete and up-to-date. You can help us to do this by letting us know if you notice errors or discrepancies in information we hold about you and letting us know if your personal details change. (d) However, if you consider any personal information we hold about you is inaccurate, out-ofdate, incomplete, irrelevant or misleading you are entitled to request correction of the information. After receiving a request from you, we will take reasonable steps to correct your information. (e) We may decline your request to access or correct your personal information in certain circumstances in accordance with the Australian Privacy Principles. If we do refuse your request, we will provide you with a reason for our decision and, in the case of a request for correction, we will include a statement with your personal information about the requested correction.

14. What should you do if you have a complaint about the handing of your personal information?

(a) You may contact THE RESILIENCE PROJECT PTY. LTD. at any time if you have any questions or concerns about this Privacy Policy or about the way in which your personal information has been handled. (b) You may make a complaint about privacy to the privacy officer at the contact details set out below. (c) The privacy officer will first consider your complaint to determine whether there are simple or immediate steps which can be taken to resolve the complaint. We will generally respond to your complaint within a week. (d) If your complaint requires more detailed consideration or investigation, we will acknowledge receipt of your complaint within a week and endeavour to complete our investigation into your complaint promptly. We may ask you to provide further information about your complaint and the outcome you are seeking. We will then typically gather relevant facts, locate and review relevant documents and speak with individuals involved. (e) In most cases, we will investigate and respond to a complaint within 30 days of receipt of the complaint. If the matter is more complex or our investigation may take longer, we will let you know. (f) If you are not satisfied with our response to your complaint, or you consider that THE RESILIENCE PROJECT PTY. LTD. may have breached the Australian Privacy Principles or the Privacy Act, a complaint may be made to the Office of the Australian Information Commissioner. The Office of the Australian Information Commissioner can be contacted by telephone on 1300 363 992 or by using the contact details on the website (www.oaic.gov.au). From 10 June 2025, the Privacy Act also provides individuals with a statutory right to bring legal proceeding for serious invasions of privacy. This may include intrusion upon seclusion or misuse of personal information where a person had a reasonable expectation of privacy.

15. How changes are made to this Privacy Policy?

THE RESILIENCE PROJECT PTY. LTD. may amend this Privacy Policy from time to time, with or without notice to you. We recommend that you visit our website (https://theresilienceproject.com.au/) regularly to keep up to date with any changes.

16. How can you contact THE RESILIENCE PROJECT PTY. LTD.?

The contact details for THE RESILIENCE PROJECT PTY. LTD. are: (a) THE RESILIENCE PROJECT PTY. LTD. privacy officer: Privacy Officer (b) Level 1/71 Langridge Street, Collingwood, Victoria 3066 (c) [email protected] This Privacy Policy was last updated on 18 May 2026

Appendix A — Schools Hub Sub-Processor Register

This appendix lists the third-party service providers (“sub-processors”) engaged by THE RESILIENCE PROJECT PTY. LTD. to deliver the Schools Hub. It is published in support of our obligations under the Australian Privacy Principles, the Privacy Act 1988 (Cth), and the Safer Technologies 4 Schools (ST4S) framework.

A1. Roles

For the purposes of this appendix, in relation to the Schools Hub:

(a) the school (or other contracting organisation) is the data controller;

(b) THE RESILIENCE PROJECT PTY. LTD. is the data processor; and

A2. Overseas disclosures

(a) The personal information you provide to the Schools Hub — including your account details, your school’s records, your subscriptions, and your activity within the platform — is stored and processed in Australia. (b) Limited technical metadata is processed by our sub-processors in the United States, including:

(i) IP addresses, browser information and security signals processed by Cloudflare for content delivery and edge security; and

(ii) video viewing telemetry (such as IP address, device information and playback events) processed by Vimeo for video streaming.

(c) Where personal information is disclosed overseas, we take reasonable steps to ensure the sub-processor handles that information in a manner consistent with the Australian Privacy Principles. This includes selecting reputable providers that publish data protection terms and maintain recognised security certifications (such as ISO 27001 and SOC 2), technical safeguards (encryption in transit and at rest), and organisational measures (access controls and confidentiality obligations).

A3. Sub-processor register

Sub-processor	Purpose	Data categories	Location(s)	Transfer mechanism	Security attestations
Amazon Web Services, Inc. (AWS)	Cloud infrastructure hosting, including compute, storage, database, authentication and serverless services that run the Schools Hub.	Account details (name, email, role); school details; subscription and course data; application usage data; authentication metadata.	Australia (AWS Asia Pacific (Sydney) — `ap-southeast-2`).	Data stored in Australia. Service provided under standard AWS Customer Agreement.	ISO 27001, ISO 27017, ISO 27018, SOC 1/2/3, IRAP (PROTECTED).
Cloudflare, Inc.	DNS resolution, content delivery network (CDN), web application firewall (WAF) and edge security for the Schools Hub.	Request metadata, IP addresses, user-agent strings, security signals. No application data is stored at the edge.	Global edge network, including points of presence in Australia. Headquartered in the United States.	Service provided under standard Cloudflare Subscription Agreement and Self-Serve Subscription Agreement, which incorporate standard data protection terms.	ISO 27001, ISO 27018, SOC 2 Type II, PCI DSS.
SMTP2GO Limited	Transactional email delivery (account confirmations, password resets, subscription notifications, in-product communications).	Recipient name and email address; email content and metadata; delivery and bounce logs.	Australia (SMTP2GO Australian region). Headquartered in New Zealand.	Data stored and processed in Australia. Service provided under standard SMTP2GO Terms of Service.	SOC 2 Type II.
Vimeo, Inc.	Hosting and streaming of video content delivered through the Schools Hub.	Video viewer IP address, device and browser information, playback events. No account credentials or school records are shared with Vimeo.	United States (headquarters); global content delivery network.	Service provided under standard Vimeo Terms of Service.	SOC 2 Type II.

A4. Internal services

The following services support the Schools Hub but are not separate sub-processors, because the data they process is held within infrastructure already listed above:

(a) Craft CMS — content management system, self-hosted on our AWS infrastructure in Sydney;

(b) Amazon CloudWatch — logging and monitoring, included within our AWS environment;

(c) TRP staff access — TRP staff access Schools Hub data from Australia in the course of providing the service. Staff access is managed under our internal security policies.

A5. Services not used

For the avoidance of doubt:

(a) the Schools Hub does not process payment card data — payments related to Schools Hub subscriptions are handled by separate finance systems and never pass through the Hub;

(b) Microsoft Clarity and other behavioural analytics tools are used on our public marketing website (theresilienceproject.com.au) but are not deployed on the Schools Hub.

A6. Notification of changes

(a) This appendix is our authoritative public list of Schools Hub sub-processors. (b) Where we propose to engage a new sub-processor, or change the location at which personal information is processed, we will publish the change in this appendix and notify subscribers at least 30 days in advance of the change taking effect, except where a change is required urgently for security or legal reasons. (c) To subscribe to sub-processor change notifications, please email [email protected] with the subject line “Schools Hub sub-processor notifications”. (d) Customers who object to a proposed change may raise their concern with our privacy officer using the contact details set out in clause 16 of this Privacy Policy.

A7. Change log

Date	Change	Effective	Notice sent
18 May 2026	Appendix published.	18 May 2026	Initial publication.

A8. Review and ownership

(a) This appendix is owned by the Tech Manager, THE RESILIENCE PROJECT PTY. LTD. (b) It is reviewed at least quarterly, and whenever a sub-processor is added, removed, or materially changed. This appendix was last reviewed on 18 May 2026.