SOLARHUB PRIVACY POLICY

Version 2.0 — last updated 23/09/2026

A Introduction

This privacy policy (Policy) is issued by Smart Renewables Pty Ltd, ABN 32 168 981 780 trading as SolarHub (we, us or our), for individuals whose personal information we collect and hold (you or your), including our customers and the employees, installers and contractors who work with us, and sets out the way we manage your personal information, including:

• the kinds of personal information that we collect and hold;
• how we collect and hold personal information;
• the purposes for which we hold, use and disclose personal information;
• how long we keep personal information;
• how you can access personal information we hold about you and seek correction of such information;
• how you can complain if we breach the applicable privacy principles (or any related code of practice that binds us) and how we will handle such a complaint; and
• the circumstances under which we may disclose your personal information to overseas recipients, and the countries they are in.

Section K of this Policy explains how the SolarHub Installer app handles personal information.

This Policy is made available without charge at www.solarhub.net.au/privacy but you may request a copy in another form by writing to the address set out below.

B Applicable Law

In relation to the personal information of Australian residents, this Policy is issued subject to the Privacy Act 1988 (Cth) as amended, applicable related regulations as amended, applicable related codes of practice as amended and successors to any of those (Australian Law).

C Collection of Personal Information

1 What kinds of personal information do we collect?

The basic personal information we collect about you is your name, your address and your contact information (e.g. email, phone, mobile number, address etc.).

If you make payment to us, we may also collect one or more of credit card information, debit card information, EFT information, bank account and similar financial information.

If you work with us as an employee, installer or contractor, we also collect the information we need to engage you and to record your work, such as your licences and accreditations, the jobs you are assigned to and the records you create on those jobs.

To the extent it would be impracticable to obtain it directly from you, we also collect other personal information about you from time to time from third party sources where it is relevant to the conduct of our business functions and activities (such as credit scoring information and consumer preference information).

Sometimes, you may voluntarily disclose other information to us in the course of your dealings with us or with our representatives. If this information comprises or contains one or both of unsolicited personal information or sensitive personal information, such information will be further dealt with as set out below.

In addition to personal information (i.e. information that identifies you individually), we may also collect information that relates to you but which has been anonymised or otherwise de-identified; this information is statistical in nature.

Our apps and other software tools may collect device-specific information (e.g. information relating to a specific phone or tablet), log information and location information; such information may also constitute personal information if it identifies you. Section K explains exactly what the SolarHub Installer app collects.

2 Who do we collect the personal information from?

Generally, we collect your personal information from you directly when you provide your name and contact details (e.g. when you request a quote, we conduct a site inspection for the purposes of providing a quote, you order products or systems from us, when we install products or systems at your address, when you request information from us, when you notify us of change of address, etc.). When we install products or systems at your address, our installers may also record your name and signature to confirm sign-off on the work. We also collect your personal information from third parties; these may include our shareholders, our business affiliates and our service providers.

3 How do we collect the personal information?

Generally, we collect your personal information directly either from you (when you provide your contact details to us in requests for quotes, placements of orders, emails, faxes, phone calls, social media postings and other online postings) or from third parties as described above. We also collect information about you indirectly through browser tracking cookies, mobile app reporting and webpage pixel tags when you use our website and apps.

Please note that most of the information we collect indirectly is not personal information (since it cannot identify you individually) but some may be (especially when held or used in combination with other information).

In addition to storing your quote, proposal and order details in physical files, we use a number of electronic systems to record and store your personal and other information, including call recording systems, customer notes systems, customer database systems, job management systems and web database systems (including online fora and/or online ordering).

4 Why do we collect the personal information? The purposes of collection

Within the general purpose of allowing us to carry out our business activities and functions, we collect your personal information to enable us to organise and carry out:

• Providing quotes, site inspections, placing orders, installing products or systems;
• Recording installation work, including evidence required for small-scale technology certificate (STC) claims and other compliance obligations;
• Shipping and supply of our products (to us or to you as the case may be).
• Receipt (or making) of payment and associated payment processing
• Issuing invoices and account statements
• Issuing responses to your queries
• Recovering defaulted payment or monies owed (NB in the event that there is defaulted payment or monies owed by you to us, we may share relevant personal information with credit agencies and/or our debt collection agents)
• Competitions and special promotions
• Issue of refunds, credit notes, discount vouchers, reward vouchers and similar benefits
• Drop shipping of products (for bulky or specialist items)
• Product personalisation (if available)
• Credit scoring
• Use of internal and external business analytics tools (e.g. Google Ads)

Please note: To the extent (if any) that we engage in direct marketing, both that activity and the corresponding purpose(s) of collection of your personal information are described in the section of this Policy headed ‘Direct Marketing’.

If you do not provide us with some or all of the personal information we require (or the information you supply is materially incorrect or false) then it may not be possible for us to deal with you or continue to deal with you for the above purposes. In some cases (e.g. in relation to an account giving website access), supply of incomplete or incorrect information may lead to reduced functionality and/or restricted access to facilities that we provide (or may provide in the future).

D Direct Marketing

We are an organisation that engages in direct marketing and so you may reasonably expect us to use your personal information for that purpose.

After we collect your personal information from you, we may continue to use that personal information for the purpose of direct marketing to you for so long as we have not received an ‘opt out’ request from you.

If we collect your personal information from a third party, we may continue to use or disclose that personal information for the purpose of direct marketing to you, subject to your consent to do so unless it is impracticable to obtain such consent, for so long as we have not received an ‘opt out’ request from you.

You may also request that we (a) not use or disclose your personal information for the purpose of facilitating direct marketing by third parties and (b) identify the source of the personal information we hold about you.

If you wish to request:

• to ‘opt out’ from receiving direct marketing communications from us;
• that we do not provide your personal information to third party for the purpose of facilitating direct marketing; or
• that we tell you where we sourced your personal information,

then contact us as follows:

SolarHub Head Office: 1300 213 422 or customer-service@solarhub.net.au

If we receive a request from you under (a) and (b) above, we will action your request within a reasonable period. If we receive a request from you under (c), we will notify you of the source within a reasonable period unless it is impracticable or unreasonable to so.

We do not use information collected through the SolarHub Installer app for direct marketing.

E Use or Disclosure

1 Limited use or disclosure

Unless we obtain your further consent, we will:

• only use or disclose your personal information for the purposes permitted or required by applicable law and otherwise in accordance with this Privacy Policy, and
• not allow third parties to hold, use or disclose personal information we collect from you except for purposes permitted or required by applicable law and otherwise in accordance with this Privacy Policy.

2 Restriction on sale, rental or transfer

We will not sell, rent or otherwise transfer your personal information to a third party except where:

• such sale, rental or other transfer is part of larger transaction affecting us (e.g. sale of the business, sale of shares, company group reorganisation, etc.);
• the information sold, rented or transferred has been anonymised or otherwise de-identified (such that it is no longer personal information); or
• the sale, rental or other transfer is covered by one of the limited and specific exceptions set out below.

3 Our representatives

We utilise a number of individuals to carry out business functions and activities on our behalf including not only employees but also contractors, sub-contractors, agents and commercial representatives expressly affiliated to us (all collectively being representatives).

Our technical service providers are obliged to respect your privacy.

You consent to our disclosure of your personal information to our representatives other than our employees, and to the use and disclosure of your personal information by such representatives when it becomes necessary to enable them to carry out business functions and activities on our behalf.

To the extent that our technical service providers hold, use or disclose your personal information in connection with providing their services to us, you consent to such use and disclosure and our disclosure to them of your personal information.

4 Other service providers

In addition to our technical service suppliers, we use a number of other service providers in support of our business functions and activities, including couriers and suppliers.

Our other service providers are obliged to respect your privacy.

To the extent that our other service providers hold, use or disclose your personal information in connection with providing their services to us, you consent to such use and disclosure and our disclosure to them of your personal information.

5 Business affiliates

In addition to our representatives and service providers, we have commercial arrangements with a number of industry partners (e.g. ActewAGL) and other reputable business affiliates.

Our business affiliates are obliged to respect your privacy.

We will not disclose your personal information to our business affiliates except where:

• the information in question has been anonymised or otherwise de-identified (such that it is no longer personal information); or
• you have specifically consented to the disclosure of your information to the business affiliate for the purposes of accessing a particular product or service offered by the business affiliate.

Only to the extent of the limited exceptions set out above, you consent to the disclosure by us of your personal information to our business affiliates and to their holding, using or disclosing your personal information.

6 Overseas use or disclosure

We store most of the personal information we hold in Australia, including in Microsoft Azure data centres (Australia East) and in the Australian services we use for job management, sign-in messages and STC paperwork.

Some of our service providers are located overseas, or may process information overseas. These are:

• United States — Apple and Google (app distribution and passkey sign-in on your device), Google (website advertising and analytics tools), and Anthropic (AI tools that help our staff and installers, where we use them — see section K);
• Germany (European Union) — Functional Software, Inc. trading as Sentry (app crash reports, which do not identify you by name or account).

We take reasonable steps to ensure these providers handle your personal information consistently with the Australian Privacy Principles, including through their contractual terms.

To the extent that applicable law requires your consent to our transfer of your personal information to our service providers and business affiliates overseas, you consent to such transfer and to subsequent use and disclosure of your personal information by our overseas service providers and overseas business affiliates when necessary for them to provide their services and honour their commercial arrangements with us respectively.

7 Required or authorised collection, use or disclosure

If collection, use or disclosure of your personal information is required or authorised by law or by order of a court or tribunal, we will inform you of that requirement or permission with details (unless the law or order requires otherwise).

8 Quality and Security of Personal Information

We will take all reasonable measures to make sure that any personal information about you that we collect, hold, use or disclose is accurate, up-to-date and complete. If you are (or become) aware of any personal information that we hold about you that is not is accurate, up-to-date and complete, please contact us to let us know as soon as possible by contacting:

SolarHub Head Office: 1300 213 422 or customer-service@solarhub.net.au

We will take all reasonable measures (including application of industry standards and industry best practice where possible) to protect your personal information from misuse, interference and loss, unauthorised access, unauthorised modification and unauthorised disclosure. To the extent we disclose your personal information to our representatives, our service providers and our business affiliates, they are subject to obligations in relation to privacy.

9 Access to your Personal Information

If you request access to your personal information, we will respond within a reasonable period and provide you with the information in the manner you request if it is reasonable and practicable to do so.

Please note that we are not obliged to give you access as requested in some circumstances, including where the request is frivolous or vexatious, the request would have an unreasonable impact on the privacy of others or the request is denied in compliance with applicable law (or under a court or tribunal order).

We will not charge you for making a request for access to your personal information.

If the estimated cost to us to provide you with the information exceeds $10, we reserve the right to charge you on a cost recovery basis for providing access to your personal information.

If we refuse to provide access to your personal information, we will issue a written notice that sets out the reasons for our refusal, the mechanisms to complain about our refusal and any other matters prescribed by applicable law. In relevant circumstances, we will consider providing an alternative means of access to your personal information to the refused means of access.

If you wish to seek access to your personal information, please contact us at:

SolarHub Head Office: 1300 213 422 or customer-service@solarhub.net.au

10 Correction of Personal Information

We will take reasonable steps to correct your personal information to ensure that, having regard to the purpose(s) for which it is held, such information is accurate, up-to-date, complete, relevant and not misleading if we are satisfied that the information does not meet those thresholds.

We may also correct your personal information upon request from you. If you wish request a correction of your personal information, please contact:

SolarHub Head Office: 1300 213 422 or customer-service@solarhub.net.au

If you make such a request, we will respond within a reasonable period.

If we correct your personal information and you request us to notify third parties to whom we have disclosed such information, we will take reasonable steps (if any) to give that notification unless it is impracticable or unlawful to do so.

We may refuse your request to correct your personal information if it is not reasonable in the circumstances (e.g. the correction you request us to make is inaccurate).

If we refuse your request to correct your personal information, we will issue a written notice that sets out the reasons for our refusal, the mechanisms to complain about our refusal and any other matters prescribed by applicable law.

If, we refuse your request to correct your personal information and you request us to associate with your personal information a statement that the information is inaccurate, incomplete, irrelevant or misleading, we will take reasonable steps to associate the statement apparent to users of the information. If you make such a request, we will respond within a reasonable period.

We will not charge you for making a request for correction to your personal information, for correcting your personal information or associating a statement with your personal information that it is inaccurate, irrelevant or misleading.

11 How long we keep personal information, and removing, deleting or destroying it

We keep personal information only for as long as we need it for the purposes described in this Policy, or for as long as the law requires us to keep it. In particular:

• customer, job and installation records — including photos, signatures, form answers, location stamps, notes and hours recorded on a job — are kept for 7 years after the job, including evidence we must hold for small-scale technology certificate (STC) claims and for tax purposes;
• SolarHub Installer app account details are kept while you are engaged by us, then deleted or de-identified within 90 days after your engagement ends;
• app crash reports are kept for 90 days.

We normally seek to remove, delete or destroy personal information from our records as soon it is no longer required. However, there may be circumstances where such removal, deletion or destruction is either delayed or not possible, including, in the case of our electronic record systems, in relation to backup, archival and general record-keeping processes. If, for technical or other reasons, it is not possible to remove, delete or destroy personal information, we will put such information beyond use (e.g. in the case of our electronic record system, by marking an account inactive, by locking a record or by similar technical means) and we will not access it again unless either we are subsequently requested to do so by you or we are required or permitted to access it by applicable law.

You can ask us to delete your personal information by contacting us using the details in section G. For SolarHub Installer app accounts, see Deleting your app account in section K.

F Miscellaneous

1. Your dealings with us

Because it makes it impracticable for us to carry out many of our core business functions and activities (e.g. order receipt, processing and despatch and installation of products and systems), you cannot normally deal with us anonymously or under another name (pseudonymously). However, if and where dealing with us anonymously or pseudonymously is practicable in respect of particular matters (e.g. providing online product reviews or posting to our other online forums), we will make that option available.

2 Unsolicited personal information

If in the course of communications with us or our representatives, you provide unsolicited personal information, we will review that information. If, upon review, that unsolicited information is relevant to our business functions or activities, we may hold, use or disclose that personal information consistently with your reason for disclosing it (for example, resolving a customer complaint).

3 Sensitive personal information

Please note that we do not seek to collect from you health information or other sensitive information as defined by Australian Law. We do not collect biometric information: where you sign in to one of our apps with a fingerprint or face check, that check happens on your own device and we never receive it. However, if unsolicited personal information provided by you also includes health information or other sensitive information as defined by Australian Law, you consent to us holding, using or disclosing such health information or other sensitive personal information consistently with your reason for disclosing it (for example, resolving a customer complaint).

4 Partial identification in commercial communications

Sometimes in the course of our commercial communications (e.g. communication of written testimonials, product conversations, product-related tweets or similar), we may partially identify an individual by reference to part of that individual’s name and an area (e.g. suburb, region or state). To the extent that such information might identify you as an individual, you nevertheless consent to us holding, using or disclosing your personal information in that way.

5 Software and AI tools

We use software tools, including artificial intelligence (AI) tools, to help our staff and installers work efficiently — for example, to check paperwork for errors or to suggest answers on job forms. Suggestions made by these tools are reviewed and confirmed by a person.

G Making a Complaint

If you wish to make a complaint with regard to a possible breach of this Policy or the Australian Privacy Principles, please contact:

SolarHub Head Office: 1300 213 422 or customer-service@solarhub.net.au

For complaints regarding handling of your other requests or enquiries in relation to this policy, please contact:

SolarHub Head Office: 1300 213 422 or customer-service@solarhub.net.au

H What happens to my complaint?

When we receive your complaint we will contact you when reasonably practicable to let you know that we have received it.

We will use reasonable endeavours to investigate your complaint and aim to resolve it. We may contact you for further information.

We will write to you and let you know the outcome. We will use reasonable endeavours to resolve your complaint within 30 days however some complaints are more complex and take longer. We will keep you informed if this is the case.

If for some reason we cannot resolve your complaint (for example, the issue is outside our responsibilities), we will write to you and let you know

If we are unable to resolve your complaint, you may contact the Office of the Australian Information Commissioner (OAIC).

OAIC website: https://www.oaic.gov.au

OAIC telephone: 1300 363 992

OAIC postal addresses: GPO Box 2999, Canberra, ACT 2601 or GPO Box 5218, Sydney NSW 2001

I Reminder – Helping Us to Help You

While we will do what we can to make sure that your personal information is accurate, up-to-date and complete, we do need your help. If your personal information changes (e.g. because of a change of name, address or credit card provider), please contact us to let us know what those changes are.

J Policy Changes

Please note that this Policy may change from time to time to take into account new laws and technology, changes to our operations and practices, and the changing business environment.

We will make available the current version of our Policy, with a date and version notice, via our website(s) and, upon request, in other forms.

If we make a material change to how we handle your personal information, we will update the version and date at the top of this Policy and, where practicable, let you know before the change takes effect (for example, by email or in our apps).

The version of this Policy that applies is the one in effect when your personal information is handled. If you do not accept a change, you may contact us to discuss it; in some cases we may no longer be able to accept or process orders from you or otherwise deal with you.

K SolarHub Installer app

This section explains what the SolarHub Installer app collects, why, and what we do with it. The rest of this Policy also applies; where this section is more specific, this section applies.

1 Who this section covers

• Employees, installers and contractors who use the app for SolarHub.
• Customers whose name or signature is recorded by an installer on site.

The app is only for people SolarHub has engaged. Accounts are created by SolarHub; there is no public sign-up.

2 What the app collects and why

What	Why
Your mobile number and email address	To send you sign-in codes
Your name	To identify you on your account and on the work you record
Your precise location, when you start and when you submit a job form	To confirm the work was done on site. We do not track your location at any other time or in the background
Photos and short videos you take or choose	To record the installation. We remove location data embedded in photos before upload
Signatures — yours and the customer’s — and the names typed with them	To record sign-off on the work
Job notes and form answers, including Wi-Fi signal strength readings	To record what was done and checked. We record signal strength and band only, never the Wi-Fi network name
Hours you confirm on a job	To record time on site
App version, build and phone operating system	To keep the app working with our systems
Crash reports	To find and fix faults. Crash reports include technical details about the fault and your device, and a random identifier for the app installation. They are not linked to your name or account

The app also shows you customer details — names, addresses and job information — from our job system so you can do the work. The app does not collect these from you.

3 Passkeys and biometrics

If you sign in with a passkey, your fingerprint or face check happens on your phone. We never receive your fingerprint or face data — only a public key that lets us confirm it is your device.

4 What the app does not collect

The app does not show advertising, does not track you across other apps or websites, and we do not sell your data. The app does not read your contacts, messages or microphone, does not record Wi-Fi network names, and does not track your location in the background.

5 Where your information goes

We store app data in Microsoft Azure data centres in Australia (Australia East). We use the service providers below to run the app. They process information on our behalf.

Provider	What for	Where
Microsoft Azure	Hosting, database and photo storage	Australia
simPRO	Our job management system	Australia
Kudosity	Sending sign-in codes by SMS	Australia
Microsoft 365	Sending sign-in codes by email	Australia
Formbay	Small-scale technology certificate (STC) paperwork, including installation evidence	Australia
Apple and Google	App distribution; passkey sign-in on your device	United States (overseas)
Sentry (Functional Software, Inc.)	Crash reports, which are not linked to your name or account	Germany, European Union (overseas)
Anthropic	Only if we switch on AI form suggestions: suggesting answers from the job’s existing record (job description, customer name, site address and earlier office answers). Nothing you type or photograph in the app is sent	United States (overseas)

6 How long we keep it

• Your account details: while you are engaged by SolarHub, then deleted or de-identified within 90 days.
• Job and compliance records — photos, signatures, form answers, location stamps, notes and hours: 7 years after the job, including evidence for STC claims.
• Crash reports: 90 days.

7 Deleting your app account

Email customer-service@solarhub.net.au with “Delete my Installer account” from the email address or phone number on your account. We will confirm who you are, then delete your account and personal information within 30 days. We keep job and compliance records that we are required by law to hold (for example, STC evidence and tax records) for the period above, and then delete them.

8 Access, correction and complaints

See sections E9 (access), E10 (correction) and G (complaints) above.

SolarHub Head Office: 1300 213 422 or customer-service@solarhub.net.au