Privacy Policy

Effective date: 20 July 2026 Last updated: 20 July 2026 Version: 1.0

1. About this policy

Direct Auto LLC ("Direct Auto", "we", "us", "our") is a motor vehicle dealership operated by and under the corporate control of its parent company, Stateline Holdings Pty Ltd. In this policy, references to "we", "us" and "our" include Direct Auto LLC and Stateline Holdings Pty Ltd and their related bodies corporate.

We are committed to protecting your privacy and to handling your personal information in accordance with the Privacy Act 1988 (Cth) (the "Privacy Act"), including the Australian Privacy Principles (the "APPs"), and all other applicable privacy and data protection laws in Australia (including the Spam Act 2003 (Cth) and the Do Not Call Register Act 2006 (Cth)).

This Privacy Policy explains:

• what personal information (including vehicle information) we collect and hold;
• how and why we collect, use, hold and disclose it;
• how we publish and syndicate vehicle listings on our website and on third-party platforms;
• how you can access and correct your information, opt out of marketing, and make a complaint; and
• how we protect your information and disclose it to third parties, including overseas recipients.

This policy applies to our website(s), our physical dealership premises, our sales, finance, insurance, service and marketing activities, and all other dealings we have with you. By using our website or providing your information to us, you acknowledge that you have read and understood this policy.

This policy does not form part of any contract of employment or any sale, finance, service or other contract you enter into with us. We may vary or supplement this policy with additional privacy notices (called "collection notices") given to you at the time we collect your information.

2. What is personal information?

"Personal information" means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information is true or not and whether it is recorded in a material form or not (as defined in the Privacy Act).

"Sensitive information" is a subset of personal information and includes information about your health, racial or ethnic origin, political opinions, religious beliefs, sexual orientation, criminal record, and biometric information. We generally do not collect sensitive information unless it is reasonably necessary for our functions and activities and you have consented, or the collection is otherwise permitted by law.

3. The information we collect

The kinds of personal information we collect depend on the nature of your dealings with us. We collect two broad categories: (a) personal information about you, and (b) vehicle information, which in some cases is linked to you and therefore is also personal information.

3.1 Personal information about you

This may include:

• Identity and contact details – your name, residential and postal address, email address, telephone and mobile numbers, date of birth, and preferred contact method.
• Identity verification information – driver licence number and details, passport details, and other government-issued identifiers where required to verify your identity, permit a test drive, or comply with law.
• Financial and credit information – income, employment details, bank account and payment card details, and, where you apply for finance or a related product, credit information and credit eligibility information handled in accordance with Part IIIA of the Privacy Act and the Privacy (Credit Reporting) Code.
• Transaction information – details of vehicles you have purchased, sold, traded in, consigned, financed, insured, leased or serviced with us, including quotes, deposits, contracts, invoices and payment history.
• Interaction information – records of your enquiries, test drive bookings, appointments, service history, correspondence (including emails, SMS, web-form submissions, live-chat transcripts and social media messages), and notes made by our staff.
• Marketing preferences – your consents, preferences and opt-outs for marketing communications.
• Website and technical information – see section 9 (Cookies, analytics and online tracking).

3.2 Vehicle information

Where you sell, trade in, consign or otherwise provide a vehicle to us, or where we service, appraise or list a vehicle, we collect information about that vehicle, which may include:

• vehicle identification number (VIN), engine and chassis numbers;
• registration (number plate) details and registration expiry;
• make, model, variant, year, build and compliance dates, colour, body type, transmission and specifications;
• odometer reading, condition, service and repair history, roadworthy/inspection details, and any accident, damage or write-off history;
• finance, encumbrance (PPSR) and ownership details; and
• photographs, video and other imagery of the vehicle.

Where vehicle information is linked to an identifiable individual (for example, the registered owner, a trade-in customer, or a consignment seller), that information is treated as personal information and handled in accordance with this policy. Before we publish a vehicle listing, we take steps described in section 6 to ensure that personal identifiers (such as number plates and VINs, where appropriate) are managed and that we have any consent required to publish.

3.3 Information about other people

If you provide us with personal information about another person (for example, a co-buyer, guarantor, nominated driver, next of kin or the registered owner of a vehicle), you represent that you are authorised to provide that information and that you have made, or will make, that person aware of this policy and how we handle their information.

4. How we collect your information

We collect personal information in a number of ways, including:

• Directly from you – when you contact us, visit our premises, complete a web form, request a quote or valuation, book a test drive or service, apply for finance or insurance, sign a contract, or otherwise deal with us.
• From our website – through online enquiry forms, live chat, account registration, and automated technologies such as cookies (see section 9).
• From third parties – including credit reporting bodies, finance and insurance providers, our related companies, vehicle history and valuation providers (for example, PPSR, odometer and write-off register checks), the relevant state or territory road transport authority, referrers and introducers, and publicly available sources, where it is reasonable and lawful for us to do so.
• Through your vehicle – when we inspect, appraise or service a vehicle, including data stored in or generated by the vehicle where accessible.

Where it is reasonable and practicable, we collect personal information directly from you. If we collect information about you from a third party, we will take reasonable steps to ensure you are made aware of the matters in APP 5, unless an exception applies.

If you do not provide the information we request, we may be unable to provide you with the product or service you have requested, process your finance or insurance application, complete a sale or trade-in, list your vehicle, or otherwise deal with you effectively.

5. Why we collect, hold, use and disclose your information

We collect, hold, use and disclose personal information for purposes connected with our functions and activities as a motor vehicle dealer, including to:

• respond to your enquiries and provide quotes, valuations and information;
• sell, purchase, trade in, consign, finance, insure, lease, deliver and service vehicles;
• advertise, list, market and sell vehicles on our website and on third-party platforms (see section 6);
• verify your identity, permit test drives, and manage the security of our premises, staff, customers and stock;
• assess and process finance and insurance applications, including through credit reporting bodies and finance and insurance providers;
• administer contracts, deposits, payments, refunds, warranties and recalls;
• maintain service and ownership records and contact you about servicing, safety recalls and product updates;
• conduct market research, analytics and business improvement;
• send you marketing and promotional communications (see section 8), where permitted;
• manage complaints, disputes and legal claims, and protect our lawful interests;
• comply with our legal obligations, including under the Privacy Act, tax, consumer protection, motor dealer licensing, anti-money-laundering and road transport laws; and
• for any other purpose disclosed to you at the time of collection or otherwise permitted by law.

We will only use or disclose your personal information for the primary purpose for which it was collected, for a directly related secondary purpose you would reasonably expect, where you have consented, or where the use or disclosure is otherwise required or authorised by law.

6. Listing and advertising vehicles (on our site and third-party platforms)

A core part of our business is advertising vehicles for sale. This section explains how vehicle information (and any linked personal information) is published.

6.1 Where we publish listings

We publish vehicle listings on:

• our own website and any websites we operate;
• third-party automotive marketplaces and classified platforms (for example, and without limitation, carsales, Autotrader, Gumtree, Facebook Marketplace, Google and comparable services);
• social media pages and advertising networks; and
• syndication, feed and stock-management providers that distribute our listings to multiple platforms on our behalf.

Some of these platforms are operated by third parties and may be located overseas (see section 11). Once a listing is published on a third-party platform, that platform's own terms and privacy policy govern how it handles the information, and content may be indexed by search engines, cached, copied or re-shared by others in ways that are outside our control.

6.2 What we publish

A published listing typically includes the vehicle's make, model, year, specifications, price, odometer, condition, features, photographs and video. We take reasonable steps to avoid publishing personal identifiers that are not necessary for the sale. In particular, we will generally obscure or omit number plates and full VINs in public listings unless disclosure is required, customary or you have consented.

6.3 Consent for trade-in, consignment and customer vehicles

If you sell, trade in or consign a vehicle to us, you acknowledge and agree that we may photograph, describe, advertise and list that vehicle (including its specifications, condition, history and imagery) on our website and on third-party platforms in order to sell it. Where a listing would include personal information about you, we will rely on your consent given at the time of the transaction, in a collection notice, or under the contract between us. You may ask us to remove or de-identify a listing that relates to you, and we will take reasonable steps to do so, although we cannot control copies or caches held by third parties or search engines.

6.4 De-identified and aggregated information

We may use de-identified and aggregated information (for example, sales trends and stock analytics) for business, research and marketing purposes. Once information is de-identified so that you are no longer reasonably identifiable, it is not personal information and this policy does not restrict its use.

7. Disclosure of your information

We may disclose your personal information to:

• our related bodies corporate, including our parent company Stateline Holdings Pty Ltd, and our staff who need it to perform their duties;
• finance providers, lenders, insurers, brokers and their agents in connection with finance and insurance products;
• credit reporting bodies and other providers, in accordance with Part IIIA of the Privacy Act and the Privacy (Credit Reporting) Code;
• vehicle manufacturers, importers and distributors (for example, for warranty, recall and registration purposes);
• the automotive marketplaces, advertising platforms, syndication and feed providers described in section 6;
• our service providers and contractors, including IT, hosting, cloud storage, customer-relationship-management (CRM), analytics, payment processing, marketing, mailing, debt-recovery and professional advisory providers;
• government agencies, regulators, road transport authorities, courts and law enforcement, where required or authorised by law;
• prospective purchasers of our business or assets, and their advisers, in connection with a sale, merger or reorganisation; and
• any other party to whom you consent, or as required or authorised by law.

We require our service providers and contractors to protect personal information consistently with the Privacy Act and to use it only for the purposes for which we engage them.

8. Direct marketing

We may use your personal information to send you marketing and promotional communications about vehicles, offers, events, servicing and related products and services, by mail, email, SMS, telephone and other electronic channels, where we are permitted to do so.

We handle marketing in accordance with the Privacy Act, the Spam Act 2003 (Cth) and the Do Not Call Register Act 2006 (Cth). This means:

• we will only send commercial electronic messages where we have your consent (express or inferred) and each message will identify us and include a functional unsubscribe facility; and
• we will honour the Do Not Call Register and your telephone marketing preferences.

You can opt out of marketing at any time by using the unsubscribe link in an electronic message, replying "STOP" to an SMS, or contacting our Privacy Officer (section 14). We will action your request within a reasonable time. Even after you opt out of marketing, we may still contact you about transactional, servicing, safety-recall and legal matters.

9. Cookies, analytics and online tracking

When you use our website, we and our service providers may collect technical information automatically, including your IP address, device and browser type, operating system, referring pages, the pages you view, the dates and times of visits, and your interactions with our site and listings.

We use cookies, pixels, tags and similar technologies to operate the website, remember your preferences, analyse traffic, measure and improve performance, and deliver and measure advertising (including remarketing that shows you our vehicles on other sites). We may use third-party analytics and advertising services (such as Google Analytics and social media advertising tools), which may set their own cookies and collect information subject to their own privacy policies.

You can manage or disable cookies through your browser settings, and you can opt out of certain interest-based advertising through the tools provided by the relevant advertising networks. Disabling cookies may affect the functionality of our website.

10. Automated decision-making

Some decisions (for example, preliminary finance eligibility assessments) may involve automated processing of your information. Where automated systems are used to make, or substantially assist in making, decisions that could reasonably be expected to significantly affect your rights or interests, we will disclose this and handle it in accordance with the Privacy Act, including the automated decision-making transparency requirements introduced by the Privacy and Other Legislation Amendment Act 2024. You may contact us to request a human review of, or further information about, such a decision.

11. Overseas disclosure

Some of our service providers, cloud hosting, marketing platforms and automotive marketplaces are located, or store data, outside Australia. Depending on the providers we use from time to time, your personal information may be disclosed to or accessible from countries including [INSERT COUNTRIES, e.g. the United States, and countries in the European Union and Asia-Pacific region].

Before disclosing personal information overseas, we take steps that are reasonable in the circumstances to ensure the overseas recipient handles it consistently with the APPs, or we rely on an exception under APP 8 (including where you consent to the disclosure after we advise you that APP 8.1 will not apply). Where a listing is published on an overseas platform at your request or with your consent, you acknowledge that the information will be accessible internationally.

12. Security, storage and retention

We hold personal information in both physical and electronic form and take reasonable steps to protect it from misuse, interference and loss, and from unauthorised access, modification or disclosure. These steps include access controls, staff training and confidentiality obligations, secure premises, network and system security measures, and agreements with our service providers.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security of information transmitted to or from our website.

We retain personal information for as long as necessary to fulfil the purposes for which it was collected, to provide our products and services, and to meet our legal, tax, accounting, warranty, licensing and record-keeping obligations. When we no longer need personal information and are not required by law to retain it, we take reasonable steps to destroy it or ensure it is de-identified.

Data breaches

We have procedures in place to respond to data breaches. If we experience an "eligible data breach" that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act.

13. Accessing and correcting your information

You may request access to the personal information we hold about you, and ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading, by contacting our Privacy Officer (section 14).

We will respond to your request within a reasonable time. There is generally no charge for making a request, although we may charge a reasonable cost for giving access in some circumstances (we will tell you before any cost is incurred). We may need to verify your identity before actioning a request. In limited circumstances we may decline access or correction as permitted by the Privacy Act; if we do, we will give you written reasons and information about how to complain, unless it would be unreasonable to do so.

14. How to contact us and make a complaint

If you have any questions about this policy, wish to access or correct your information, opt out of marketing, or make a privacy complaint, please contact our Privacy Officer:

Privacy Officer Direct Auto LLC (operated by Stateline Holdings Pty Ltd) Postal address: [INSERT ADDRESS] Email: [INSERT EMAIL] Phone: [INSERT PHONE]

If you make a complaint, we will acknowledge it and aim to respond within a reasonable time (generally within 30 days). We may ask you for further information and will let you know the outcome and the reasons for our decision.

If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC):

• Website: www.oaic.gov.au
• Phone: 1300 363 992
• Post: GPO Box 5288, Sydney NSW 2001

15. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements or other factors. The current version will always be available on our website and will be identified by the "Last updated" date above. We encourage you to review this policy periodically. Any material changes will take effect when the updated policy is published, unless a later date is stated.