Privacy Statement

Issued 22 September 2026 | Version 1.0

1. Who we are and what this policy covers

This policy explains how Independent Investment Research (Aust.) Pty Ltd (ACN 152 172 079) (IIR, we, us or our) handles personal information in connection with our website, Australian research services and related business dealings. It applies to website visitors, research-access applicants, subscribers, clients, issuer and fund-manager contacts, and other individuals who deal with us.

IIR is Corporate Authorised Representative No. 1242826 of Contego Investment Partners Pty Ltd (ACN 152 241 908), holder of Australian Financial Services Licence No. 410381. Contego may receive relevant information for licence oversight and complaints handling. These Australian licence details do not authorise services in another jurisdiction.

We respect your privacy and handle personal information in accordance with applicable privacy law, including the Privacy Act 1988 (Cth) and the Australian Privacy Principles where they apply. A separate IIR entity providing a service should be identified in the applicable engagement or collection notice. This policy does not treat every IIR-branded entity as the same legal entity.

2. Contact our Privacy Officer

Privacy Officer
Independent Investment Research (Aust.) Pty Ltd
Email: client.services@independentresearch.com.au

Use this contact for privacy enquiries, access or correction requests, complaints or a free copy of this policy. Put “Privacy” in the subject line where practicable. Do not include passwords, full payment-card details or unnecessary identity documents in an initial enquiry.

3. Information we collect and hold

Depending on your dealings with us, information may include your name, business email, telephone number, employer, role, professional or licence details; account identifiers, access permissions and communication preferences; relevant client-classification evidence; engagement, invoicing and payment records; and enquiry or complaint correspondence.

We may also hold professional information relevant to research, such as company officers’ roles and experience, and technical information such as IP addresses, browser and device details, access times, pages viewed and account activity. Information about a business contact can be personal information even when the client is a company or a wholesale client.

4. How we collect personal information

We generally collect information directly when you contact us, request research access, subscribe to communications, provide documents, enter an engagement or use an account. We may also receive relevant information from your employer or authorised representative, commissioning clients, public company disclosures, professional registers and other lawful public sources.

Website and service systems may collect technical information automatically. At or before collection, or as soon as practicable afterwards, we provide a collection notice where required. A general privacy policy does not replace information that should accompany a particular form or collection process.

5. Why we collect, use and disclose information

We use relevant information to assess eligibility for professional research access; create and administer accounts; deliver research and requested communications; manage commissioned research and business relationships; process invoices; respond to enquiries and complaints; protect systems against misuse; maintain appropriate records; and meet legal, regulatory and professional obligations.

Professional information from lawful sources may be used in company or fund research where relevant to the analysis. We use identifiable website activity only for legitimate service, security, administration or permitted analytical purposes. Publication of research is not permission to publish a reader’s private contact or account information.

We use or disclose information for the purpose for which it was collected, a related purpose permitted by law, with appropriate consent, or where otherwise authorised or required by law. Providing information does not amount to unrestricted consent to unrelated marketing, disclosure or future uses.

6. Your choices and sensitive information

You may make a general enquiry without identifying yourself or using your real name where lawful and practicable. We may need to identify you to assess professional access, administer an engagement or verify an access request. Without necessary information we may be unable to provide the requested service.

We seek only information reasonably needed for the relevant purpose. We do not ordinarily seek sensitive information for research access. Where it is necessary, we will explain why and obtain consent unless the law permits otherwise. Please redact irrelevant financial or identity details from documents. Unsolicited information will be assessed and, where it cannot lawfully be retained, securely destroyed or de-identified when lawful and reasonable.

7. Service providers and other disclosures

Relevant information may be provided to authorised personnel; Contego; suppliers supporting hosting, email, cloud storage, account administration, communications, technology, security or professional services; and regulators, courts or dispute-resolution bodies where lawful. We limit disclosures to what is reasonably needed and require suitable privacy and confidentiality protections from providers acting for us. We do not sell your personal information.

8. Overseas handling

IIR’s activities involve Australia and the United States. Relevant personal information may be accessed by authorised personnel or service providers in the United States to support research, client relationships and administration. Cloud, hosting, support or communications providers may also handle information outside Australia; their locations depend on the service and provider arrangements.

Before a cross-border disclosure, we assess applicable privacy requirements and take reasonable steps to ensure the recipient handles information consistently with the Australian Privacy Principles where required, unless a lawful exception applies. Merely using our website does not waive applicable cross-border protections.

You may contact the Privacy Officer for information about overseas handling relevant to your dealings with us. Our published policy and any relevant collection notice will identify additional likely recipient countries where reasonably practicable. A provider’s Australian data-hosting location does not, by itself, establish that overseas access cannot occur.

9. Cookies, analytics and third-party content

Our website may use cookies and similar technologies to support sign-in, security, user preferences and measurement of website use. These tools may collect or associate technical identifiers with a browser, device or account. IP addresses, cookie identifiers and usage records are not automatically anonymous and are treated as personal information where they identify, or reasonably identify, an individual.

You can manage cookies through your browser and through any privacy controls offered on the website. Restricting essential cookies may affect account sign-in or other requested functions. Where a particular technology requires consent under applicable law, it must not be activated for that purpose until valid consent is obtained.

Third-party links, embedded content or external research-distribution platforms may collect information when you interact with them and are subject to their own privacy practices. We do not assume that choosing to view public content gives consent to unrelated advertising. Any genuinely de-identified statistics must be assessed for the risk of identifying people when combined with other information.

10. Research communications and direct marketing

We may send research updates, invitations or information about our services where you have requested them or where otherwise permitted by applicable law. Marketing communications will identify IIR and provide a simple way to unsubscribe. You may also change preferences by contacting the Privacy Officer.

We action electronic-marketing unsubscribe requests within five working days and other opt-out requests within the period required by law. Unsubscribing from marketing does not, by itself, terminate approved research-platform access. We may still send necessary account, contractual, security, complaints or legal notices that are not marketing messages.

11. Security, retention and data breaches

We take reasonable technical and organisational steps to protect personal information against misuse, interference, loss and unauthorised access, modification or disclosure. Access should be limited to people with a legitimate business need. No internet transmission or storage system can be guaranteed completely secure.

We retain information only while needed for the purposes described in this policy or a permitted related purpose, or where required by law or a court or tribunal order. Retention may be needed for research and engagement records, client-classification evidence, tax obligations, complaints or legal claims. We take reasonable steps to securely destroy or de-identify information when it is no longer required, including copies held by service providers and in backups.

We assess and respond to suspected data breaches. Where the Notifiable Data Breaches scheme or another applicable law requires notification, we notify the relevant regulator and affected individuals as required and provide appropriate information about protective action.

12. Access and correction

You may request access to personal information we hold about you and ask us to correct information that is inaccurate, incomplete, out of date, irrelevant or misleading. We may need reasonable evidence of your identity or authority. We aim to respond within 30 calendar days and within any shorter applicable legal period.

There is no charge to make a request or to correct information. Any lawful charge for providing access will be reasonable and explained in advance. Where access or correction is refused on a lawful ground, we provide reasons and complaint options as required. You may ask for a statement of a disputed correction to be associated with the record. A deletion request is assessed against lawful retention requirements; deletion is not an unconditional right in every circumstance.

13. Privacy complaints

Contact the Privacy Officer with details of your concern and the outcome you seek. We will acknowledge your complaint, investigate it fairly and aim to provide a written response within 30 calendar days. We will explain a delay and keep you informed. There is no fee to make a privacy complaint.

If you are dissatisfied with our response or have not received one within 30 days, you may complain to the Office of the Australian Information Commissioner (OAIC), subject to its jurisdiction and complaint requirements. Privacy complaints to the OAIC must be made in writing. Visit oaic.gov.au or telephone 1300 363 992 for information.

For a privacy complaint connected with financial services, an approved external dispute-resolution scheme such as AFCA may be the appropriate first external avenue. Contego is an AFCA member. See our Financial Services Guide or afca.org.au for the process; the relevant body determines eligibility and jurisdiction.

14. Policy updates

We review this policy when our practices or applicable requirements change. The current approved policy is published on our website with its update date and is available free on request. A policy update does not retrospectively obtain consent for a new use of information. We provide further notice or seek consent where required.