Appendix A SPC Privacy Policy 1. Purpose This Information Privacy Policy (Policy) shall apply where Southland Pipeline Corporation Limited (SPC): (a) accesses, uses or receives from a Customer, Supplier or Third Party (Information Provider) information or information about an identified individual (Personal Information), and (b) collects or holds Personal Information as part of carrying on business. The Policy shall apply to the Personal Information, until that Personal Information: (a) has been destroyed or de-identified, or (b) is no longer held by, or accessible to, SPC. 2. Use of Information Any Personal Information will be used: (a) in a manner which does not breach the Privacy Act 2020 (Privacy Law) (b) in accordance with any policy under which it was collected, and/ or any consents given, and (c) for the purposes for which the Personal Information was provided (including in relation to the fulfilment of requests or provisions of services) and for purposes related to that purpose. If SPC allows any third-party service provider to collect, access or use the Personal Information, it shall ensure that third party: (a) complies and does not breach Privacy Law, and (b) is subject to restrictions no less onerous than those set out in this Policy. 3. Maintain the Information SPC shall: (a) comply with any reasonable request from the Information Provider in relation to any Personal Information held by SPC, including any request to correct any Personal Information, and (b) promptly notify the Information Provider of any breach of this policy of which it becomes aware, including any misuse, interference or loss, unauthorised access, modification and disclosure of the Personal Information governed by this policy. 4. Return of the Information If SPC no longer requires the Personal Information for any of the purposes outlined in this Policy, it shall promptly destroy or de-identify the Personal Information or, at the Information Provider's reasonable request, return the Personal Information to the Information Provider.