Cobalt Blue Holdings Limited and its related bodies corporate (Cobalt Blue, we, our, or us) are committed to protecting the privacy of personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

This Privacy Policy outlines how we collect, use, disclose, store, and manage personal information.

This Privacy Policy applies to personal information collected by Cobalt Blue in connection with:

• Our website

• Investor and shareholder communications

• Business and stakeholder engagement

• Recruitment activities

• Regulatory and compliance obligations

We collect personal information that is reasonably necessary for our business activities. This may include:

• Name

• Contact details including email, telephone, and address

• Company or organisation details

• Shareholder and investor information

• Recruitment and employment-related information

• Any information voluntarily provided to us

We may also collect limited technical information when you use our website, including IP address, browser type, device information, and website usage data.

We do not collect sensitive information unless required by law or with your consent.

Personal information may be collected:

• Directly from you

• Through correspondence, meetings, or events

• Via our website or subscription services

• From our share registry provider

• From publicly available sources

• From third-party service providers where authorised

Our website may use cookies and analytics tools to monitor and improve functionality.

We collect and use personal information for purposes including:

• Responding to enquiries

• Managing shareholder and investor communications

• Meeting legal and regulatory obligations

• Assessing employment applications

• Conducting business operations and stakeholder engagement

• Improving website performance and user experience

Personal information will only be used for the primary purpose for which it was collected or for a related purpose permitted under applicable law.

We may disclose personal information to:

• Professional advisers including legal, accounting, and financial advisers

• Service providers and contractors supporting our operations

• Share registry and investor communication providers

• Regulatory authorities where required by law

• IT and hosting providers

Some service providers may store or process information overseas. Where this occurs, we take reasonable steps to ensure appropriate data protection safeguards are implemented.

We do not sell personal information.

Cobalt Blue takes reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification, or disclosure.

Security measures include:

• Controlled access to systems and records

• Secure IT infrastructure

• Confidentiality obligations for personnel and service providers

Despite these measures, no method of electronic transmission or storage is completely secure.

Individuals may request access to, or correction of, personal information held by Cobalt Blue.

Requests should be submitted in writing using the contact details below. We may require verification of identity prior to processing a request.

Personal information provided in connection with employment applications will be used solely for recruitment and related purposes.

If you believe Cobalt Blue has breached the Australian Privacy Principles, you may lodge a complaint by contacting us.

We will investigate complaints and respond within a reasonable timeframe. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner at www.oaic.gov.au.

This Privacy Policy may be updated from time to time. The current version will be available on our website.