Australia Privacy Supplement

---

1. Application, status and basis of handling

Section 1.1 — Application and non-contractual status

This Australia Privacy Supplement (the "Supplement") applies to Personal Information about individuals located in Australia that Zeus collects or holds in connection with the Services, and to Zeus's acts and practices as an APP entity under the Privacy Act 1988 (Cth). This Supplement must be read together with the Zeus Privacy Policy at https://fieldzeus.com/legal/privacy; terms capitalized here have the meanings given in the Privacy Policy and the Defined Terms of the Zeus legal suite. This Supplement and the Privacy Policy are notices, not contracts: they do not form part of any Agreement between Zeus and any Customer, and nothing in them grants contractual rights against Zeus. Creating an account, accessing or using the Services, or providing Personal Information to Zeus constitutes acknowledgment of the Privacy Policy and this Supplement, including as revised from time to time; if you do not agree with the practices they describe, your remedy is to not use, or to stop using, the Services. Where this Supplement and the Privacy Policy differ, this Supplement prevails for individuals in Australia only to the extent mandatory Australian law requires; in every other respect the global core of the Privacy Policy continues to apply without dilution.

Section 1.2 — Basis of handling in Australia; voluntariness

For individuals in Australia, and unless this Supplement or the Privacy Policy states otherwise for a specific practice, Zeus does not rely on consent as the basis on which it handles Personal Information; Zeus collects, holds, uses and discloses Personal Information as reasonably necessary for the business purposes and functions described in the Privacy Policy and as permitted by the Australian Privacy Principles. Accessing or using the Services, or otherwise providing Personal Information to Zeus, constitutes your acknowledgment that your Personal Information will be handled as described in the Privacy Policy and this Supplement. Providing Personal Information to Zeus is voluntary; however, if you choose not to provide it, Zeus may be unable to provide you (or the Customer whose Workspace you use) with some or all of the Services, and some features may be prevented or severely constrained.

Section 1.3 — Roles: APP entity for Account Data; processor-style handling of End-Customer Data and Worker Data

Zeus is the APP entity accountable under the Privacy Act only for Account Data — registration, billing, device and session Telemetry, diagnostics and Zeus website data — and for Personal Information Zeus collects for its own purposes as described in the Privacy Policy. For End-Customer Data and Worker Data — Personal Information about Clients, workers, subcontractors and other individuals that a Customer or its Authorized Users enter into, or cause to be collected through, the Services — Zeus acts solely as a service provider processing that information on the Customer's behalf and on the Customer's instructions, unless otherwise required by law. The Customer, not Zeus, decides why and how that information is collected and is responsible for compliance with the privacy laws that apply to it, including giving any notices required at or before collection. If your Personal Information sits in a Customer's Workspace, direct your questions and requests to that Customer (for example, the contracting business you dealt with); Zeus refers such dealings to the relevant Customer as described in §5.

Section 1.4 — Mandatory-law savings

Nothing in the Privacy Policy or this Supplement excludes, restricts or modifies any right you have, or any obligation Zeus has, under the Privacy Act 1988 (Cth) or any other Australian law that cannot lawfully be excluded, restricted or modified. Where the Privacy Policy describes a practice, allocation or limitation that mandatory Australian law does not permit as to you, that practice applies to you only to the maximum extent the law permits, and otherwise the statutory position applies — without affecting the operation of the global clause for any other person or place.

---

2. Who we are; accountability and contacts (APP 1)

Section 2.1 — Identity and privacy contact

The entity accountable for the handling of Personal Information described in this Supplement is Omni Data Tech Inc., of 3601 Highway 7 East, Suite 1006, Markham, Ontario, L3R 0M3, Canada. Privacy questions, access, correction and complaint communications for Australia should be directed to [email protected] (postal route: 3601 Highway 7 East, Suite 1006, Markham, Ontario, L3R 0M3, Canada). The current version of this Supplement and the Privacy Policy are published at https://fieldzeus.com/legal.

---

3. Collection notice (APP 5)

Section 3.1 — What Zeus collects in Australia and how

The kinds of Personal Information Zeus collects and holds, how it is collected, and the purposes of collection, holding, use and disclosure are described in §3–§5 of the Privacy Policy. For Australian users these practices are, in summary and as verified product fact: account registration and billing details; first-party device and session Telemetry (raw events retained 30 days, aggregate rollups 365 days); diagnostic and error data; job, client, quoting, invoicing and payment-record content entered by Customers; photos and their metadata; snapshot-only Location Data limited to the six disclosed purposes (photo-tag fallback, clock-in/out snapshots, optional GPS at signing, address geocoding, map-tile requests, and the location recorded against a receipt or expense where that capture switch is on — no background or continuous tracking); electronic-signature evidence records; workforce records entered by Customers about their own personnel (time entries and their approval state, crew membership, recorded absences and the reason given for them, and skill, certification, licence or insurance records); and receipts processed by Zeus's own self-hosted OCR (no third-party OCR vendor). Zeus does not sell Personal Information, use third-party advertising networks or ad cookies, perform data enrichment, or pull credit reports.

Section 3.2 — Indirect collection through Customers

Much of the Personal Information in the Services about Clients and workers is collected indirectly: a Customer (for example, a contracting business you engaged) enters it, uploads it, or causes it to be collected through job records, photos, documents, signatures and payment records. The Customer is responsible for having told you, and for having any authority it needs, before putting your Personal Information into the Services, and for giving you the notices its own privacy obligations require. If you did not deal with Zeus directly, the Customer is your first point of contact for questions about why your information was collected.

---

4. Overseas disclosure and cross-border processing (APP 8)

Section 4.1 — Likely overseas recipients and countries

Zeus is likely to disclose Personal Information to overseas recipients — its hosting, infrastructure, email-delivery, geocoding and other service providers — located in the United States, Canada, and Europe, and in any other location where Zeus or its service providers maintain facilities as reasonably necessary for the proper performance and delivery of the Services. As a statement of current practice (and not a warranty — see §4.4): Zeus's primary object storage is pinned to an Eastern North America region; database and application infrastructure are operated from North America; transactional and document-delivery email is dispatched via a United States provider; street addresses for Australian jobs may be geocoded by a service provider operating on European infrastructure; and traffic to and from the Services traverses a global content-delivery edge, which processes traffic at the data centre closest to you.

Section 4.2 — Your acknowledgment of overseas processing

By using the Services or submitting Personal Information — and this applies expressly to users located in Australia — you consent to, and acknowledge, the transfer, storage and processing of your information in the United States, Canada and any other country in which Zeus or its service providers maintain facilities. The laws of those countries may not be as protective of Personal Information as the laws of Australia, and information held there may be subject to lawful access by the governments, courts, law-enforcement and regulatory agencies of those countries. If you do not want your Personal Information transferred, stored or processed as this section describes, you should not use the Services; continued use constitutes your ongoing acknowledgment of these transfers.

Section 4.3 — APP 8 compliance route

Zeus's APP 8 compliance route for the overseas disclosures described in this section is APP 8.1 contractual assurance (owner + counsel decision pending: APP 8.1 reasonable-steps/contractual-assurance route versus the APP 8.2(b) informed-consent route with its express statement that s 16C accountability will not apply).

Section 4.4 — No data-residency warranty; relocation

Zeus states its storage locations as current practice only and MAKES NO WARRANTY THAT ANY SPECIFIC HOSTING OR STORAGE LOCATION WILL MEET YOUR DATA-RESIDENCY REQUIREMENTS OR PREFERENCES. Without limiting the foregoing, content-delivery edge processing, backups and disaster-recovery copies, diagnostics, and support access may each occur outside any stated primary region, and traffic is processed at the edge data centre closest to the requesting device. Zeus may relocate data between facilities, regions or providers at any time, subject to §4.3's mandatory-law route once settled and to the savings clause in §1.4.

---

5. Access, correction and your other rights (APPs 12–13)

Section 5.1 — Rights framework and routing

You have the rights that applicable law provides — including, under the Privacy Act, rights to request access to, and correction of, Personal Information Zeus holds about you — and those rights are not absolute: they are subject to the exceptions, conditions and timeframes the law itself sets. If your Personal Information was entered into the Services by or for a Customer (End-Customer Data or Worker Data), please direct your request to that Customer, as this may expedite its completion; Zeus refers such requests to the relevant Customer and provides reasonable assistance to that Customer, as appropriate and as required by applicable law.

Section 5.2 — Identity verification

Before actioning any request, Zeus may require you to prove you are who you say you are: Zeus may request up to three pieces of personal information to compare against its records, may ask for copies of relevant identity documents, and may take additional steps where fraud is suspected; failure to verify may result in denial of the request. Requests made through an agent or representative require the agent's written permission from you and your direct identity verification with Zeus, failing which the request may be denied; and where records also contain Personal Information about other people, Zeus may redact or withhold that information.

Section 5.3 — Response, refusal grounds and charges

Zeus responds to access and correction requests within a reasonable period; Zeus may decline to process requests that are manifestly unfounded or excessive, unreasonably repetitive, frivolous or vexatious, require disproportionate technical effort, jeopardise the privacy of others, are extremely impractical, or for which access is not otherwise required by law — in each case only where and to the extent the Privacy Act permits refusal. There is no charge for making a request or for correction; where the Privacy Act permits a charge for giving access, any such charge will not be excessive; and where Zeus refuses a request, Zeus will give you written reasons and the available complaint mechanisms except to the extent it would be unreasonable to do so.

Section 5.4 — Deletion, retention carve-outs and communications you cannot opt out of

Where you ask Zeus to delete Personal Information it holds in its own right, deletion is two-phase: deactivation followed by a later purge run as soon as reasonably practicable, with no fixed purge timeline promised; the account purge window is as soon as reasonably practicable, and the retention schedule published in the Data Retention and Deletion Policy applies. Zeus may decline to delete, in whole or in part, Personal Information that Zeus (or its service providers) is required or permitted to retain — including append-only audit and financial records that survive purge by design, backups pending scheduled rotation, records needed to complete transactions, maintain security and integrity, comply with legal obligations, or for internal uses lawfully compatible with the context in which you provided the information. If any processing does rest on your consent, withdrawing it does not affect processing that is required or permitted by law, and may result in your inability to continue using some or all of the Services. You may not opt out of administrative and transactional communications — such as security notices, service messages, and messages confirming or actioning your own requests.

---

6. Complaints and the OAIC

Section 6.1 — How to complain; escalation to the regulator

If you believe Zeus has breached the Australian Privacy Principles in relation to your Personal Information, you may complain to Zeus at [email protected] (postal route: 3601 Highway 7 East, Suite 1006, Markham, Ontario, L3R 0M3, Canada). Zeus will acknowledge and consider your complaint and respond to you. If you are not satisfied with Zeus's response, you may complain to the Office of the Australian Information Commissioner (OAIC), online at oaic.gov.au.

---

7. Data breaches (Notifiable Data Breaches scheme)

Section 7.1 — Statutory breach regime; notification posture

Where the Privacy Act's Notifiable Data Breaches scheme (Part IIIC) applies to Zeus in respect of Personal Information it holds, Zeus will assess suspected eligible data breaches and notify the OAIC and affected individuals as and when that scheme requires; nothing in any Zeus document limits those statutory duties. For the purposes of Zeus's own notices, a "Security Incident" means confirmed unauthorized access to or disclosure of Personal Information and does not include unsuccessful attempts or activities that do not compromise it (such as failed log-ins, pings, port scans or denial-of-service attacks). Zeus notifies affected Customers without undue delay using the contact details on the Customer's account, and only to the extent applicable law requires; the Customer is solely responsible for keeping those contact details valid and accurate. No notification of, or response to, a Security Incident is an acknowledgment by Zeus of any fault or liability; and incidents not specific to you or your organization may be communicated through Zeus's general status channels.

---

8. Australia-specific practices

Section 8.1 — Direct marketing (APP 7; Spam Act)

Zeus's own administrative and transactional messages (for example, password resets, verification messages, security notices and document-delivery emails sent at a Customer's direction) are a condition of using the Services and are not subject to opt-out. Where Zeus sends its own direct-marketing communications to individuals in Australia, it does so as permitted by APP 7 and the Spam Act 2003 (Cth), with a functional means to opt out; opting out of marketing does not affect the administrative and transactional messages described above. Messages that Customers send to their own Clients through or alongside the Services are sent by the Customer as originator; the Customer is responsible for its own APP 7 and Spam Act compliance, as further described in the Privacy Policy and the SMS, Email and Messaging Terms.

Section 8.2 — Automated decision-making (APPs 1.7–1.9)

Zeus does not currently use computer programs to make, or to do things substantially and directly connected with making, decisions that could reasonably be expected to significantly affect your rights or interests: Zeus operates no server-side artificial-intelligence decision systems, and its receipt-OCR feature is assistive only — its output is a draft that a human reviews and confirms before any business use. If and when Zeus deploys any such automated decision-making, Zeus will update this Supplement and the Privacy Policy to describe the kinds of decisions, the programs involved and the kinds of Personal Information used, as the amendments to the Privacy Act commencing 10 December 2026 (APPs 1.7–1.9) require.

Section 8.3 — Changes to this Supplement

Zeus may revise this Supplement from time to time; the current version, with its effective date and version number, is always available at https://fieldzeus.com/legal. Continued use of the Services after a revision takes effect constitutes acknowledgment of the revised Supplement, as described in §1.1 and in the Privacy Policy's changes section, and subject to the savings clause in §1.4.

Section 8.4 — Workforce data visibility; the employer's monitoring responsibilities

The global workforce-visibility positions of the Privacy Policy (its §3.9 and §10.2) apply unchanged in Australia; for transparency to Australian workers they are restated here:

Worker Data — time entries and their approval state, clock-in/clock-out location snapshots, photos, assignments and crew membership, recorded absences and the reason given for them, skill and certification records, and activity data about a Customer's personnel — is processed for the business that owns the Workspace: worker time-tracking data, including its optional location component, is made available to the Account Owner and the Workspace's administrators, and location data collected from workers is used exclusively to provide the Services to that business. If you use the Services under a Customer's Workspace as a Member, Helper or other Invited User, your Personal Information and activity within the Workspace may be monitored, processed and analyzed by the Account Owner and its administrators, and content you submit within the Workspace may be accessed, copied and processed by them; you should have no expectation that in-tenant data is private from the business that invited you. The Services maintain an always-on, append-only activity and audit log that users cannot turn off. The Customer (as employer or principal) — not Zeus — is solely responsible for compliance with the employment, workplace-monitoring, surveillance, privacy and consent laws that apply to its use of these features (including any State or Territory workplace-surveillance legislation that applies to it), and must obtain all requisite approvals and authorizations from its personnel for the creation, display, analysis and distribution of the data they generate before enabling them. Worker requests about Worker Data are routed to the employer under §5.1, and deletion of workforce records is a matter for the employer as the accountable organization for that data.