Privacy Policy

At Tabcorp, we take protecting your personal information very seriously. We understand that your privacy is important, and we value, trust and respect your personal information.

Who does this policy cover?

This policy covers the “Tabcorp Group” (also referred to as Tabcorp, we, or us), which means Tabcorp Holdings Limited (ABN 66 063 780 709) and its wholly-owned Australian businesses operating TAB, SKY and MAX. It excludes our international businesses which have their own privacy policies. For information on how we process personal information relating to our international operating businesses, please see:

PGI Privacy Policy

https://www.pginternational.co.uk/legal/policy

Sky Racing World Privacy Policy

https://www.skyracingworld.com/privacy-policy

Each entity in the Tabcorp Group, as defined above, is bound by the Privacy Act 1988 (Cth) (as amended from time to time) (Privacy Act) and must comply with the Australian Privacy Principles. In this policy, personal information has the same meaning as in the Privacy Act.

How we update this policy

We will review and update this policy from time to time where necessary to keep it up to date, including to reflect changes in applicable laws or our business. Where we make a material change to this policy, we will notify you through our website, www.tabcorp.com.au. The most up-to-date version of this policy can always be found on www.tabcorp.com.au.

Important definitions

In this policy:

• a TAB account refers to a customer account that you may create including via the TAB website or app that allows you to use our TAB products and services;
• AML/CTF Act means the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) as amended from time to time;
• gaming venue customers that receive services from MAX are referred to as MAX venues; and
• our TAB agencies and licensed venues that offer TAB products and services are referred to as TAB venues.

The kind of personal information we collect depends on how and why you are engaging with us, it could include:

• contact and other personal information – such as name, date of birth, address, email address, mobile phone number and home telephone number;
• identity and age verification information – such as images of you, date of birth, drivers’ licence, Medicare card, passport, birth certificate, gender, visa information and/or utility bills;
• banking or payment details – such as payment card details, bank account, PayPal account and other payment account information (such as Apple Pay, Google Pay, BPay or PayID accounts) and other payment details;
• your purchasing behaviour and transaction history with us;
• information you provide in relation to our products and services – such as in calls to us, messages or emails you send us, interactions you have with our staff or with the staff of TAB venues or MAX venues;
• information you provide in relation to working for us or a TAB venue – information about your prospective employment or engagement, such as when you apply to join our workforce, when you apply to be a TAB operator in a TAB venue, or when you join one of our training programs (including CVs and other employment information, which may include financial details, right to work information and background checks);
• your online interactions with our websites, apps, social media channels, communications, and advertising and third-party websites and apps that display our advertising;
• video and voice data – including call or voice recordings and data when you interact with us by telephone or through voice assistant technology, and video surveillance, including CCTV and other cameras at certain Tabcorp premises, TAB venues and/or MAX venues; and
• location, device and system data – information about your device, such as your IP address, device ID, operating system and operating system version, the physical location of your device, information about where you have opened a TAB account with us, and where and how your TAB account has been used or accessed. The specific data collected depends on the platform you are using and your mobile device or TAB account settings, and whether you are logged into a TAB account.

Sometimes the information that we collect, use and disclose is ‘sensitive information’ under the Privacy Act (such as information about your race, ethnicity, criminal record, biometrics or health). For example, we may collect health information from you in relation to our safer gambling obligations, or an incident at one of our TAB venues. Or if you apply to work with us or in our TAB venues, we may collect information about your criminal record, whether you are of Aboriginal or Torres Strait Island descent, or any disability you may have.

In many cases, we will collect your personal information from you directly. We do this when you interact with us:

• via our websites, apps and social media channels (including through cookies);
• over the telephone;
• when using our self-service betting terminals and devices; and/or
• by mail, email or in person.

In some cases, we may generate new personal information through reports and analysis. We may also collect your personal information from third parties and other sources, including:

• credit reporting bodies and customer data validation service providers (including identity and/or age verification service providers), who help confirm your identity and/or age and help us to assess risks under the AML/CTF Act and our “know your customer” obligations;
• our share registry provider;
• institutional investors (e.g. banks) that offer customers investment products incorporating Tabcorp shares;
• TAB venues;
• MAX venues;
• suppliers of training, research, marketing consultancy or other services to us;
• the types of third parties with which we share personal information, as described below;
• third-parties supplying recruitment services to us, or a referee nominated by you, in the context of employment applications;
• public sources (e.g. social media and search websites) and publicly available registries and databases;
• our industry regulators;
• Commonwealth, state or territory government authorities or agencies; and
• in connection with a corporate transaction including any proposed or actual sale of all or part of Tabcorp’s business, or a merger, consolidation or other capital reorgansiation or purchase of an interest in another business, including any related separation and transitional arrangements.

We collect your personal information for the purposes set out in this policy. If we are unable to collect your personal information, we may not be able to provide our products and services to you. For example:

• if we cannot verify your age or identity, you will not be able to access or use our TAB products or services; or
• from time to time, if we cannot re-verify your identity, or you decline or are unable to provide information we’re otherwise required to collect for TAB customers under the AML/CTF Act or for our safer gambling programs, we may place restrictions on use of your TAB account including restrictions on dealing with any funds in your TAB account until you provide that information.

We may also be unable to:

• engage or employ you, or issue or administer any Tabcorp shares you have applied for (e.g. pay you dividends or send you important shareholder communications); or
• provide certain products and services to our TAB venues or MAX venues.

We hold and use the personal information we have about you for one or more of the following purposes:

• to manage our relationship with you – including to identify and communicate with you, or to provide you with products, services or information that you have requested;
• to meet our legal obligations or exercise our legal rights – including to verify your age, location and identity, to respond to enquiries, complaints or investigations, to report to government agencies, to comply with the conditions of our licences, to meet our safer gambling obligations, and to meet our obligations to our sporting industry and racing industry partners;
• to analyse, investigate, pursue and prevent suspected or actual serious misconduct or unlawful, fraudulent or criminal activities, and to protect the integrity of our products and services (including to help our sporting and racing industry partners maintain the integrity of a sport or racing code);
• to allow our wagering products and services to be used in a way that prevents and minimises gambling harm and to administer our safer gambling and self-exclusion programs;
• to protect the safety and security of our people, sites and assets;
• to provide, manage, administer and improve the quality of our products and services and our TAB venues, including to undertake analytics activities that inform our product development initiatives, marketing campaigns and end user experience when using our products and services;
• to personalise your online and in-person experience and market our products and services to you – including to give you a personalised experience in our products and services, to send you information and show you advertisements about our products and services we think you could be interested in (including products and services of third parties), and to serve you with more relevant advertising about our products and services, including on our website, apps or third party social media sites and apps;
• to make employment and recruitment decisions, and manage our employees and contractors and TAB venue staff – including to assess your suitability for a role, confirm your eligibility to work and meet payroll related obligations;
• to operate and manage our business – including to undertake management of TAB accounts, our customers and our products and services, product and systems development, migration and testing, risk management, staff training, maintenance of our records (including combining or consolidating information across accounts and customers), market and customer satisfaction research, customer feedback or collecting debts;
• to facilitate corporate transactions including any proposed or actual sale of all or part of Tabcorp’s business, or a merger, consolidation or other capital reorgansiation or purchase of an interest in another business, including any related separation and transitional arrangements; and
• for other reasons where the law, the conditions of our licences and relevant rules may require or allow us to do so.

For some of the purposes identified above, we may use automated technology, including artificial intelligence tools. For example, we may use artificial intelligence tools to, among other things, assist our Customer Service Centre to provide responses to you when you contact us, and to assist our Safer Gambling team to identify potential problem gambling tendencies.

Depending on how you engage with us, we may disclose your personal information, for the purposes for which we collect, hold, store and/or use your personal information set out in this policy, as follows:

• among the Tabcorp Group;
• where you have consented to that disclosure, for example, to a secondary contact you nominate;
• to our third party service providers that we engage to provide you with our products and services and manage our business, including:
• third parties that help us manage our AML/CTF risks including our “know your customer” obligations (e.g. “World-Check” screening services) and identity verification obligations (e.g. identity verification organisations, such as credit reporting bodies and the document issuer or official record holder (via an identity verification service) where you have expressly consented to that disclosure);

1. third parties as part of our safer gambling programs;
2. third parties that provide us with software and technology solutions and services to manage our business and support our platforms;
3. third parties that provide identification and fraud detection services;
4. third parties to enable us to meet our payment and payroll obligations;
5. our third party print partners when we send you direct mail; and
6. third parties that provide us with marketing consulting, research and/or targeted advertising services. We use digital platforms such as Facebook, TikTok, Snapchat, Google, LinkedIn, Instagram and Adobe as well as marketing agencies to deliver these services;

• to parties involved in corporate transactions including any proposed or actual sale of all or part of Tabcorp’s business, or a merger, consolidation or other capital reorgansiation or purchase of an interest in another business, including any related separation and transitional arrangements, including advisers and parties providing transitional or separation related services which may include activities relating to data maintenance and migration;
• to our industry regulators;
• to government authorities and law enforcement agencies, both in Australia and overseas;
• to credit reporting bodies (for more information on credit reporting, see below);
• to our professional advisers, consultants, contractors and subcontractors;
• to banks, financial institutions and payment processing providers;
• to our TAB venues;
• to MAX venues in relation to providing those venues with our MAX services; and
• to our racing industry and sporting industry partners or their associated or nominated integrity representatives.

Disclosure of your personal information overseas

Sometimes the third parties we disclose your information to are overseas, including in New Zealand, Hong Kong, South Africa, the United States of America, the United Kingdom, Japan, India, Philippines, Vietnam and countries located in the European Union.

For our TAB products and services, we are required to verify and (from time to time) re-verify your age and identity before we can provide you, or continue to provide you, with our TAB-related products and services. We use third parties including credit reporting bodies to assist us with this. Credit reporting bodies use the name, residential address and date of birth details contained in credit information files to verify your age and identity.

In particular, we may:

• disclose your name, residential address and date of birth to credit reporting bodies; and
• ask credit reporting bodies to assess whether the information we provide to them matches the information they hold about you in their credit information files.

If we can’t verify your age and identity using that information, we will let you know.

If you do not wish to have your identity verified by a credit reporting body, contact the TAB Customer Service Centre on 131 802 and we can discuss other options with you.

We need to verify your identity for the purposes of the AML/CTF Act. The obligations we have under the AML/CTF Act may require us to:

• request additional personal information from you (e.g. your occupation and/or the identity of your employer or, after you become a TAB customer, confirmation of your TAB account transactions);
• collect information about your transactions on any TAB accounts, including any communication or information you send to us, and to report activity externally;
• collect other information about you that we reasonably require to help assess your risk to our business; and/or
• disclose any of that information to our regulators, industry bodies, and other gambling operators.

From time to time, we may use your personal information to send you marketing communications about products and services we think you would be interested in. These include our products and services and, those of:

• our racing and sporting industry partners;
• our TAB venues; or
• our club and hotel industry partners (including MAX venues).

We may tell you about these things directly by various methods including by mail, email, SMS, push notifications (if they are enabled on your device), MMS and phone calls.

Opting-out

You can opt-out of receiving marketing communications anytime. How you opt-out will depend on the channel you received or saw the communication in. Each marketing communication will contain the specific instructions for you to opt-out. You can also review your preferences, and opt-out via the TAB app.

Additionally, you may call the TAB Customer Service Centre on 131 802 (see also https://www.tabcorp.com.au/contact) or contact your TAB Account Manager (if applicable) and they will record your marketing preference.

We will also stop sending marketing communications to you in other circumstances, such as where we are required to opt you out of marketing by law.

Personalising your visit to our website and apps

If you use our website or apps we may show you personalised offers and content. We can do this using your customer or TAB account numbers and by using cookies, pixels and other similar technologies. Cookies allow a website or application to identify and interact with your computer. Cookies are small files that store information on your computer, TV, mobile phone or other device. They enable us to recognise you across different websites, services, devices and browsing sessions. This can take the form of automatically assigning you to the correct jurisdiction based on your location, altering website navigation based on your most visited pages or displaying game or event information based on your previous browsing or transaction history. Other similar pieces of code, such as pixels and similar technology, can also be used to identify website activity.

From time to time we may also use cookies and similar technologies from third party websites (e.g. those that display our advertising) to personalise your online experience with us.

You can disable cookies through your internet browser settings and delete cookies from within your browser’s cache (though this may affect website performance).

Tabcorp is committed to delivering its products and services in a way that prevents and minimises harm by supporting a well- regulated and safer gambling industry, characterised by integrity at all levels. We take safer gambling very seriously, and when you interact with us and our TAB venues, we collect, store, use and disclose your personal information to inform and maintain our safer gambling programs and initiatives like our education campaigns, self-exclusion programs, pre-commitment limits, research and supporting counselling services.

We may also monitor transactions on your TAB accounts, emails, messages and communications you send us, information you provide to us during telephone calls and information you provide to our TAB venues’ staff along with their observations of your behaviour, to support you and enable you to make informed choices in line with our safer gambling programs. We also collect, generate, use, store and disclose your personal information for proactive safer gambling detection and analysis, and to inform or direct TAB venues to enable them to support you with safer gambling issues and to send you communications regarding your gambling behaviour, available safer gambling tools and gambling help and other support services. You will not be able to opt-out of service messages, including where we are authorised or required to communicate for the purposes of our safer gambling programs or by law.

You can read more about our safer gambling programs by visiting https://responsiblegambling.tab.com.au/.

Keeping your personal information secure is important to us. Our security measures are designed to help us protect your personal information from unauthorised access and disclosure or loss.

If we collect personal information about you for the purpose of you working for us as an employee, contractor or labour hire resource, or as a TAB operator in our TAB venues, we will collect, use and disclose your personal information in accordance with this policy.

The processing and results of background checks may require us to disclose information about you to our regulators and to other third parties.

We will, where possible, collect this information from you directly. However, we may also obtain records containing your information from other parties (such as your third party employer). Where you’re a TAB operator in a TAB venue, we may use your personal information to assess your employer’s compliance with their arrangements with us and relevant policies and laws (including workplace laws).

You can ask us for a copy of the personal information we hold about you, by writing to us.

Email: privacy@tabcorp.com.au

Mail: Level 13, 180 Ann Street, Brisbane QLD 4000

We may verify your identity before processing your request.

Is there a fee? There is no fee to ask for your information, but we may charge you an access fee to cover the time we spend finding and putting together the information you have a right to ask for. We will tell you any charges before we incur them.

How long will it take? In most cases, the information we agree to provide to you will be made available to you in 30 days of your request.

Can we decline access? In some cases, yes. In other cases, we may only give you access to certain information. For example, we might not let you see information that is commercially sensitive or where it has an unreasonable impact on the privacy of others or if we are investigating possible illegal activity and giving you access might affect those investigations. If we do this, we’ll let you know why. If you disagree with us, you can let us know using the complaints procedure which we outline below.

How can I update or correct my personal information?

It’s important that we have your correct details, especially your contact information. You can check and update some of the information we hold about you by logging in to your TAB account on our TAB website or app, or by calling the TAB Customer Service Centre on 131 802 (see also https://www.tabcorp.com.au/contact). You can otherwise ask us to update or correct the personal information we hold about you, by writing to us at:

Email: privacy@tabcorp.com.au

Mail: Level 13, 180 Ann Street, Brisbane QLD 4000

We won’t charge a fee for this.

If you have a concern about how we have handled your personal information or your privacy, let us know so we can take steps to address your concern.

If we don’t address your concern when you first raise it, you can make a complaint and we’ll do our best to resolve it for you. To make a privacy complaint, please contact our Privacy Officer in writing.

Email: privacy@tabcorp.com.au

Mail: Level 13, 180 Ann Street, Brisbane QLD 4000

It’s helpful to us if your written complaint includes a brief description of what happened and when, and what outcome you’d like.

We treat all privacy complaints seriously. After you have lodged your complaint in writing, we will:

• investigate the circumstances of your complaint;
• assess your complaint with the aim of resolving it in a timely and efficient manner; and
• take steps to respond to you in a reasonable time, usually 30 days.

We ask that you cooperate with us during the complaints process and provide us with information we may need to investigate and assess your complaint.

What else can you do?

If you’re not satisfied with how we manage your complaint or if our decision does not resolve your complaint, you may contact the Office of the Australian Information Commissioner (OAIC).

Email: enquiries@oaic.gov.au

Mail: GPO Box 5288, Sydney NSW 2001

Phone: 1300 363 992

If you have any questions or wish to provide feedback about how we treat your privacy or handle your personal information, please contact us by writing to:

The Privacy Officer

Email: privacy@tabcorp.com.au

Mail: Level 13, 180 Ann Street, Brisbane QLD 4000

You can view a PDF Tabcorp Group Privacy Policy here (last updated on 6 July 2026).