PRIVACY POLICY © GB Orange Pty Ltd (ACN 644 006 628)

GB Orange Pty Ltd (ACN 644 006 628) (“we”, “us” or “our”) trades a Gracie Barra brand franchisee Brazilian Jiu jitsu martial arts gym and training business under the business name Gracie Barra Orange.

Other franchisees (“GB Schools”) variously operate and trade Brazilian jiu jitsu training businesses and gyms under the business name Gracie Barra in Oceania and for the purpose of this Privacy Policy may also include GB Schools in Asia, Africa, Europe, North America and South America.

For the purposes of this policy, “Franchisor Parties” means GB Oceania Association Pty Ltd (ACN 123 456 789), Australian Institute of Brazilian Jiu Jitsu Pty Ltd (ACN 111 776 491), GB Oceania Ambassador Program Ltd (ACN 622 630 157), GB Shop Oceania Pty Ltd (trading as GB Wear Australia) (ACN 136 582 780), GB Compnet Pty Ltd (ACN 602 349 262), Kinetic Data Pty Ltd (ACN 098 942 717), Kinetic Data Inc (USA), Gracie Barra Digital Global Inc (USA), Gracie Barra Franchise Systems Inc (USA), Gracie Barra Global Licensing Inc (USA), Gracie Barra Events Inc (USA), Gracie Barra Jiu Jitsu Global (USA), Gracie Barra Wear Inc (USA), Gracie Barra Wear Brasil (Brazil), Gracie Barra Brasil (Brazil) and Gracie Barra America Inc (USA). Each is a “Franchisor Party”.

We take the protection and proper handling of your personal information seriously. This policy sets out information about our privacy practices and your rights.

Where you deal with us on behalf of a young person under your care (under 18 years old) (“minor”), this policy also applies to the minor subject to the further qualifications set out later in this policy and references to “you” also include the minor.

What is Personal Information?

The Privacy Act 1988 defines “personal information” as information or an opinion about an identified person, or a person who is reasonably identifiable, whether the information or opinion is true or not, regardless of how it is recorded.

Types of Personal Information We Collect

In order to effectively:

• engage with you;

• market our services and/or those of the Gracie Barra brand;

• ensure proper billing and administrative tasks relating to our services, those of a GB School or Franchisor Party;

• comply with applicable laws; and

• maintain proper security and standards at the business premises,

we need to collect personal information about you (whether directly from you, through other GB Schools or otherwise). This information can include, but is not limited to your (a) name, (b) address, (c) contact details, (d) whether you are an adult or less than 18 years old, (e) if you are a parent or guardian to a jiu jitsu student, the name of that student and that you are that student’s parent or guardian, (f) medical information including (but not limited to) details and history of any medical conditions, injuries, allergies or medications, (g) clothing sizes, dimensions and purchase history, (h) training and competition information (including any information prior to joining Gracie Barra), (i) information on family, friends, dependants, guardians and spouses, (j) membership status, program / curriculum enrolment information, (k) details of social media accounts and social media posts (including videos and photos), (l) banking and/or credit card details, (m) which contractual documents with us you have signed or agreed to (This is the ‘primary purpose’ for the collection of personal information), (n) photos, video’s and/or communications/messages between students, staff or the public and (o) visitor history, cookies and trackers which may be utilised on our, a GB School or Franchisor Party website/s.

We may use your personal information for secondary purposes closely aligned to the primary purposes in circumstances where you would reasonably expect such use or disclosure. You may unsubscribe from our mailing or marketing lists at any time by providing notice in writing, or using other means of unsubscribing we notify you of.

We collect personal information about you from a variety of sources, notably (a) our website or the website of a GB School or Franchisor Party, (b) the GB Schools, (c) enrolment or application forms from GB Schools or a Franchisor Party (including those relating to acknowledgment of risks and releases), (d) forms or posts submitted to any GB School and/or other Franchisor Parties (including through website or social media channels), (e) billing service providers (including but not limited to Paysmart, EziDebit, Pay Way, Integrapay), (f) POS (point of sale) service providers (including but not limited to Paypal, SquareUp), (g) GB School (Franchisee) information database (may include but not limited to Clubworx & Kinops), (h) marketing campaigns (including referrals), (i) emails, (j) SMS (such as to our business mobile number), (k) social media, (l) online messaging platforms, (m) instructors and/or staff (including those engaged by GB Schools), (n) students and/or their friends and family members, members of the public and (o) our Franchisor Parties. Further details relating to some sources of collection are set out later in this policy.

Generally, we will obtain this personal data directly from you, although we may receive personal information, such as in the form of friend or family referrals from third parties. Where we have obtained personal information about you from a third party, we will attempt to take reasonable steps to ensure you are made aware of the information provided to us.

Disclosure of Personal Information

We may disclose your personal information to third parties in the following circumstances:

• For any sales, billing, accounting, membership recording and incident management purposes;

• In the ordinary course of our business of working with and supporting other GB Schools (such as sharing your personal information with our other Franchisees / GB Schools, GB USA and their affiliates) or any of our Franchisor Parties;

• The preparation, coordination and / or management of the attendance of events (such as competitions, social events, training or extra-curricular training);

• To comply with our legal and regulatory obligations (including, for example, to accountants for the preparation of financial statements and auditors and to meet contractual obligations to our Franchisor (in particular GB Oceania Association Pty Ltd);

• To contract out some of our administrative functions to external services providers (such as for bookkeeping, IT support, marketing and advertising functions);

• As reasonably required for any medical emergencies;

• With your consent;

• As required or authorised by law, or in our legal defence.

Sensitive Information

Sensitive information can include information or an opinion about someone’s racial or ethnic origin, political opinions or associations, sexual orientation or practices, criminal record and health.

We will generally only collect sensitive information relating to your health to assist with your safety and care in the event of a health incident or crisis, or to document the occurrence of such matters at any of our and/or Franchisor Party’s or GB School business premises or events organised or coordinated through a GB School / Franchise or Franchisor Party. This information will only be collected from you or your parent/guardian and will (or will likely) include information about your allergies, any medical condition that could make you more vulnerable in the participation of a full contact combat sport (or any martial art including, but not limited to Brazilian Jiu Jitsu, Jiu Jitsu, Judu, Kickboxing, Wrestling and Yoga) and the details of any injuries suffered at any Franchisee, Franchisor Parties business premises or event that a Franchisee or Franchisor Parties may organise &/or participate in.

Sensitive information will only be used by us:

• For the primary purpose for which it was obtained;

• For an important secondary purpose directly related to the primary purpose, including in our dealings with emergency services (such as to paramedics in the case of a serious medical event;

• With your consent; or

• As required or authorised by law, or in our legal defence.

Personal Information from Minors

Other than the information pertaining to memberships that were supplied by a parent or guardian, subject to this policy we do not intentionally collect personal information from individuals under 18 years of age without the permission of their parent or guardian. Where we are required to collect or receive personal information about minors in the ordinary course of business (such as details on membership or enrolment documents), we require that this information be provided by a parent or guardian on behalf of the minor and/or otherwise provided with the permission of a parent or guardian. Where you are a parent or legal guardian, please do not allow your children to submit personal information without your permission.

Data Security

We will endeavour to take all reasonable steps to protect personal information that we hold from unauthorised access, modification, misuse, interference and loss. When electronic information is no longer required it is permanently destroyed.

Data security procedures we have in place include:

• The use of password protected computer logins;

• The use of a reputable encrypted electronic communications platforms; and

• In the case of the Franchisor Parties for the purposes disclosed above, a secure hosted database.

Access to your Personal Information

You may access the personal information we hold about you to update and/or correct it, subject to certain exceptions. If you wish to access your personal information, please contact us in writing. We will not charge any fee for your inspection, but may charge an administrative fee for providing you copies of your personal information.

Our retention of original documents and information is subject to the retention section below. Especially where you have provided us with personal information that affects any rights we have against or with respect to you, we are entitled to retain the original personal information provided until such rights are discharged (and such further period specified in the retention section below).

We may refuse access or to make any requested changes if there is a reason under the Privacy Act 1988 or other relevant law to refuse such access.

If we do not agree to change your record/personal information in accordance with your request, you may write a detailed statement of the proposed requested changes and we will enclose this with your record. Further, should you wish to then obtain access to your record, your request should be in writing outlining in detail the information you are seeking.

We may deny access to some information if providing such access could have an unreasonable impact upon the privacy of other individuals.

Before access to personal information is granted to any individual, their identity needs to be established. To protect your personal information from unauthorised disclosure, we may require suitable photo identification from you before allowing you access to the requested information.

We will take reasonable steps to make sure that your personal information is accurate, complete and up-to-date at the time of collection and when used or disclosed. If you find that the information we have collected is not up to date or is inaccurate, please advise us as soon as practicable so we can update our records and ensure we can continue to provide quality services to you.

Video Monitor and Recording

For the security of our staff and business premises, our business premises may be equipped with video monitoring and recording technology. Our monitoring may include CCTV cameras that record the time and date at which images are taken. These CCTV cameras may capture your image on those recordings.

The video and images recorded may be provided to law enforcement bodies (for example; NSW/ QLD / WA / TAS / NT / ACT / VIC / SA Australian Federal Police), insurance companies, and other government bodies if required. We may use recorded video and images for the purposes of legal proceedings.

Social Media

GB Orange, other GB Schools and the Franchisor Parties use various social media platforms to advertise events, Gracie Barra events, Gracie Barra merchandise and other activities. These platforms may include, but not limited to (a) Facebook, (b) Instagram, (c) LinkedIn, (d) Twitter, (e) Instagram, (f) YouTube, (g) Snapchat, (h) Pinterest, (i) Reddit, (j) TikTok and (k) website/s. While attending our, a GB Schools and/or a Franchisor Party’s premises, you may be photographed or videoed in group pictures, or as an individual, and those images may be shared on social media. Examples of this can include when you or your child receive a belt promotion, when a GB School is running a special event, or as part of a group photo. Please advise us directly if you do not wish to take part in these images (if the circumstances relate to us) or in other cases the relevant Franchisor Party (usually the GB School you are associated with). If a photograph or image has been taken or stored by us, please also ask us if you wish that an image of yourself or child be removed or obscured.

Retention period

We will only retain personal data for as long as we have a legitimate purpose to do so. How long it will need to retain personal data for these purposes will depend on the specific personal data and circumstances. The period of time will generally be at least 7 years after last collection of personal information about you, but this could be extended by the requirements of law (including our tax obligations), our insurance providers or legal dispute to which the information is relevant.

Once we have no legal or commercial reasons to retain personal data, it will be securely deleted or destroyed.

Policy Updates

This policy may change from time to time and is available on our website www.graciebarraorange.com.au/privacy-policy

If:

• you have questions or comments about this privacy policy;

• we have reason to deny you access to your personal information;

• you have a complaint about our information handling practices;

please contact us at:

GB Orange Pty Ltd. 34 Telopea Way, Orange NSW 2800 / info@gborange.com

We will respond to complaints within a reasonable period of time.

The website for the Office of the Australian Information Commissioner (OAIC) is www.oaic.gov.au. Its telephone number for enquiries is 1300 363 992 and other contact information can be found at https://www.oaic.gov.au/about-us/contact-us/

Gallery