Cann Group Limited Privacy Policy

Contents

1. Overview
2. What is personal information and who may we collect it form?
3. Why we collect personal information and how we do it
4. How we share your personal information
5. Storage and security of your personal information
6. Quality, access and correction of your personal information
7. How to make a complaint
8. Contact Cann
9. Miscellaneous

1. Overview

At Cann Group Limited (ABN 25 603 949 739) (“Cann” “we” “us”) your privacy is important to us. We are committed to protecting your privacy when managing your personal information. We have policies and procedures in place to ensure that all personal information is handled carefully and securely in accordance with the Australian Privacy Principles (APPs) contained in the Privacy Act 1988 (Cth) (“Privacy Act”).

We are an Australian pharmaceutical company operating in the import and export, cultivation, production and manufacture business of cannabinoid-based products for markets where cannabis is legalised for medicinal uses. We also operate in cannabis research and development and do so independently as well as in collaboration with industry partners and scientists. For the purposes of this Privacy Policy, these are referred to as “activities”, “products and or “services”.

The purpose of this Privacy Policy is to explain how Cann collect, use and share information that is provided to us or that we may otherwise obtain through our Website(s) which relates to a person. More specifically, this Privacy Policy provides an outline of Cann’s information collection and handling processes regarding:

• what kind of personal information we may gather about you;
• the purposes for which the information is used, and how it is managed;
• the choices you have regarding our use of such information;
• whether we disclose your personal information to anyone and why;
• how you may inquire, access and/or seek correction of your personal information using our access and correction handling procedure; and
• how you may alert us about an alleged breach of the APPs and our complaint handling procedure.

By using our Website(s) and or submitting your personal information to us, you agree to the collection, use and disclosure of personal information by us as set out in this Privacy Policy.

2. What is personal information and who may we collect it from?

Personal information is information that could identify you. The personal information we hold may include, for example, your name, contact details, postal address and e-mail address or other information you have provided to us. The type of personal information collected will be directly related to the specified purpose it has been collected for. How much of your personal information that you choose to disclose to us is completely up to you. However, failure to provide certain information may result in Cann being unable to provide you with the relevant information you have requested or may otherwise require.

If you are a healthcare professional such as a doctor, clinician or specialist and you have submitted an enquiry via our Website(s), Cann may collect your Personal Information such as:

• Your name, email, mailing address and other contact information;
• Your professional details including but not limited to:
  • your qualification(s);
  • your profession;
  • your place of practice; and
• Any other information that you voluntary provide.

Cann may also collect personal information from members of the public if you:

• are part of an existing or prospective commercial or research partner of Cann and you provide such information;
• sign up to use a particular service such as our newsletter(s) and e-newsletters, mail outs or other subscriptions (if and when available);
• participate in surveys we, or a third party service provider acting on our behalf, may conduct from time to time we may collect personal information relating to your survey responses;
• make an inquiry, provide feedback or make a complaint to us, we may collect your name and contact details; or
• are applying for employment with us, we may collect any information that is relevant to such employment including:
  • your name and contact details (i.e. residential address, phone number(s) and/or email address); and
  • any other information relevant to the recruitment process (including any information contained in the application form and your resume).

You acknowledge that the personal information we collect from you is your own information or information which you have been authorised to provide us.

If you are under the age of eighteen (18) years old, you should only submit personal information about yourself with the consent of a parent or guardian.

3. Why we collect personal information and how we do it

The types of information that we collect from you will depend on the circumstances of collection and on the service that we are providing to you. Cann will use the personal information you have chosen to provide us for the purpose for which you provided it or a related secondary purpose which you would reasonably expect. Cann will not use it for any other purpose without your consent, unless we are permitted to do so under the Privacy Act.

Healthcare professionals

If you are a healthcare professional, Cann may use your personal information for the purpose of providing you with information about medicinal cannabis, the products available and resource materials such as scholarly articles (where legally permitted). We collect personal information from healthcare professionals for the following purposes:

• in order to understand clinical opinions, prescribing habits and patient demographics (where legally permitted);
• establishing and maintaining advisory boards;
• conducting research;
• coordinating medical conferences;
• to assist in developing Cann’s business processes and systems;
• to continuously improve Cann’s products, services and activities; and
• ensuring compliance with regulatory requirements.

Members of the Public

For members of the public, we will use your personal information for the following purposes:

• providing you information that you have requested from Cann including for example:
• to provide you with company information generally;
• administering services where you have registered your interest with Cann via our Website(s) or email;
• to respond to any inquiries, feedback or complaints made by you;
• assisting us to improve our Website(s);
• processing and assessing employment applications for current and future positions;
• managing any legal or commercial matters; and
• otherwise managing our internal business operations and processes.

Method of collection

We will only collect personal information through lawful and fair means and not in an unreasonably intrusive way. Cann collects your personal information when you deal with us directly, via our Website(s), via forms or correspondence (i.e. by mail or email), over the phone or in person. For example, we may collect information where you have used our Website(s) to:

• submit an enquiry with respect collaboration opportunities in research and development;
• contact Cann with respect to legal or commercial matters;
• sign up to our email alerts service to receive the latest company announcements; or
• submit an enquiry to obtain more information with respect to clinicians;

Cann may also collect personal information through our third-party service providers such as market research organisations, conference organisations and database providers, or from publicly available sources in accordance with relevant laws, so that we may provide a better or more relevant service to you. We may also collect personal information about you from applicants who have nominated you to act as their referee or trade reference.

Anonymous information

We may also collect information about visitors to our Website(s). For example, we may collect:

• statistical information about the number of visitors to the Website(s) and the date, time and duration of visits;
• the name of the domain/URL from which you access our Website(s); and
• the internet protocol address.

However, we do not collect information about the identity of the visitors unless they voluntarily provide that information.

Anonymous information is information that does not identify you. It includes:

• analytics information – this is information that we log regarding access and use of the Website(s)

Cann gathers anonymous information to:

• monitor the use of our Website(s);
• help us make improvements to the Website(s); and

offer relevant information and services to as many users as possible.

Sensitive information

Cann does not generally collect sensitive information as defined under the Privacy Act, however, subject to obtaining your prior consent, Cann may collect sensitive information from you in the course of considering an application for employment such as your criminal history, medical or health conditions.

Unsolicited information

Where unsolicited information is received by Cann we will determine, within a reasonable period of time, whether or not we would be permitted to collect the information under the APPs. If it would not be permitted for Cann to collect the information, we will destroy the information or ensure it is de-identified as soon as practicable. Otherwise, Cann may retain the information in accordance with the terms of this Privacy Policy.

Cookies

A cookie is a small file which we may store on your computer. We may use cookies to record and hold information to track your internet browser’s behaviour and to enable certain website functions, such as remembering your settings or preferences. Cookies will collect only the necessary information for this purpose.

We use cookies and similar technologies to help us understand how people use the Website(s) so that we can keep improving your user experience.

We utilise our own cookies as well as cookies from third parties when you visit our website or use our apps.

You can block cookies on your computer, however this may degrade your user experience on the Website(s). To find out how to see what cookies have been set and how to reject and delete cookies, please visit http://www.aboutcookies.org

Google Cookies

Cann may utilise cookies provided by Google, Inc (“Google”) to help analyse how users use our Website(s). The information generated by these cookies is transmitted to and stored by Google on servers in the United States.

Cann may, from time to time, use the following services provide by Google which utilise cookies. These include Google Analytics, Google Remarketing, Google Display Network Impression Reporting and Google Analytics Demographics and Interest Reporting.

To opt-out of analysis by Google Analytics on our Website(s) and other websites, please visit http://tools.google.com/dlpage/gaoptout

To opt-out of personalised ad delivery on the Google content network, please visit Google’s Ads Preferences Manager at http://www.google.com/ads/preferences

Email Lists

We may collect your email and, if you provide it, other contact details when you subscribe to our email list, for example, where you registered your interest in investing in Cann by email or by completing and submitting a form on our Website(s). We only use this information for the purpose that we informed you of at the time that you supplied this information.

4. How we share your personal information

There will be certain circumstances where it will be necessary for Cann to disclose your personal information to third parties.

Cann may disclose your personal information to:

• contractors and third party service providers on a confidential basis that we use in the ordinary course of our business to assist with the delivery of the product or service. This may include organisations such as marketing agencies, data processing companies, printing and mailing houses, delivery companies, finance agencies or debt collection agencies;
• government authorities or other third parties as required by law; or
• third parties for any other purpose for which you have provided your consent.

Cann Group Companies and Related Companies

Cann may share the personal information it collects from you with any of the Cann Group related companies. Where Cann shares your information with a Related Company, the Related Company may use your personal information in the same way as Cann can under this Privacy Policy.

Transfer of information outside Australia

Unless permitted under the APPs, Cann will not disclose your personal information to third parties outside of Australia. It may be necessary for Cann to transfer your personal information outside of Australia where required by an international partner or international regulatory body. In such circumstances, we will ensure that we take reasonable steps to protect your personal information from misuse, unauothrised access or disclosure. These measures include data transfer agreements which contain standard data protection clauses.

Other than as stated above, we do not disclose personal information that you may give us to any organisation or person outside of Cann unless you have authorised us to do so.

No sale of personal information

Under no circumstances will Cann sell or receive payment for licensing or disclosing your personal information.

5. Storage and security of your personal information

The security of your information is important to us. Cann operates secure data networks that are designed to protect your privacy and security. When we have collected information about you it cannot be seen or modified by anyone else. Cann has implemented generally acceptable standards of technology and operational security to ensure personal information (in both physical and electronic form) is protected against loss, misuse, interference and unauthorised access.

Only authorised Cann personnel and contractors are provided access to personal information and have agreed to ensure the confidentiality of this information. Reasonable steps are taken to destroy or permanently de-identify any personal information that is no longer required.

Should any actual or suspected personal data breach occur, we will inform you in writing and any applicable regulator where legally required to do so.

6. Quality, access and correction of your personal information

Access

You may at any time, request access to personal information that Cann holds about you by making a request to the address or email address below.

We will endeavour to process any requests for access to personal information within a reasonable period of time. We will ask you to verify your identity before we will disclose the personal information you request or modify that information. Where possible, we will provide you with access to that information either by providing you with copies of the information requested, allowing you to inspect the information requested, or providing you with a summary of the information held. If we need to deny your request for access we will let you know why and inform you how you may lodge a complaint regarding this decision. Generally, this will only be in cases where providing access would be unlawful or is subject to a potential legal claim or proceeding.

Correction

We will try to ensure that all information we collect, use or disclose about you is accurate, complete, up-to-date and relevant to the service being provided.

Otherwise, if you discover or suspect that there is an error or information is missing, please forward your request for correction to us in writing at the address or email address below. We will consider your request and as soon as practicable manage the correction of your personal information and will update you in writing. If your correction request is refused, we will provide you within a reasonable period of time the reasons for such refusal and inform you of the complaint process (see below).

7. How to make a complaint

If you have any complaints relating to the management of your personal information or if you believe there has been a breach of the APPs by Cann, please forward your complaint in writing to us at the address or email address below.

We will consider the complaint and advise you of their decision in writing within a reasonable time from receipt of the complaint.

If we decide that there has been a breach of the APPs, we will endeavour to ensure that the breach is rectified within 30 days from the date of the decision and will update you in writing.

If you are still not satisfied after lodging a complaint with us and given us a reasonable time to respond, then we suggest that you contact the Office of the Australian Information Commissioner by:

Phone: 1300 363 992 (local call cost, but calls from mobile and pay phones may incur higher charges).
If calling from overseas (including Norfolk Island): +61 2 9284 9749
TTY: 1800 620 241 (this number is dedicated to the hearing impaired only, no voice calls.)
TIS: Translating and Interpreting Service: 131 450
(If you don’t speak English or English is your second language and you need assistance and ask for the Office of the Australian Information Commissioner)

Post: GPO Box 2999 Canberra ACT 2601
Fax: +61 2 9284 9666
Email: enquiries@oaic.gov.au

8. Contact Cann

Please contact us on the contact details below if you would like to:

• inquire about or request access and/or update your personal information;
• report an alleged breach of your privacy rights or make a complaint; or
• talk to someone about our Privacy Policy.

Post: c/- Legal & Regulatory Affairs, Cann Group Limited, 4 Research Avenue, Bundoora, Victoria 3083
Telephone: (03) 9095 7088
E-mail: contact@canngrouplimited.com

9. Miscellaneous

“Personal information” has the same meaning as in the Privacy Act.

“Related Company” has the same meaning as “Related Body Corporate” as defined under the Corporations Act 2001 (Cth).

“Website(s)” refers to all websites and includes (if and when deployed) associated social media websites and applications which are owned, operated or under the control of Cann.

Further Information on Privacy

For more information about your privacy rights in Australia, visit the Office of the Australian Commissioner’s website, www.oaic.gov.au

Policy Changes

We may edit this Privacy Policy from time to time by publishing the changed Privacy Policy on our Website(s). This Privacy Policy was last updated on 10 December 2019.