Milford Asset Management Limited and, where applicable, its related entities (together, the Milford Group) are bound by and adhere to the New Zealand Privacy Act 2020 for personal information to which that Act relates, and Milford Asset Management Limited and Milford Australia Pty Ltd are bound by and adhere to the Australian Privacy Act 1988 for personal information to which that Act relates (each, the Privacy Act). Each Privacy Act provides a set of Privacy Principles which govern how we collect, use, hold and disclose your personal information.

This Privacy Policy explains:

• • • the kinds of personal information that we collect and hold
    • how we collect and hold personal information
    • the purpose for collecting, holding, using and disclosing personal information
    • how you can seek access to, and correction of, that information
    • how you can make a complaint relating to our handling of that information.

We can change this Privacy Policy from time to time. The latest version of this Privacy Policy will always be available on our website, application, and client portal (each, a platform). We will aim to provide reasonable advance notice of any material changes, although this may not always be possible depending on the circumstances. We encourage you to check for any changes. By continuing to use the platform, or otherwise receive products or services from us, you are considered to have accepted any updated Privacy Policy. The updated Privacy Policy will apply from the date stated at the end of this Privacy Policy.

1. What information do we collect?
What personal information we collect and hold may depend on the reason that we collect your personal information (including what products or services you wish to receive). This information can include:

• • • contact details such as personal address, telephone number, email address
    • identification details such as full name, title, date of birth, gender, passport number, driver’s licence number, residency status, tax number, employer details, signature
    • financial and related information such as bank account number, occupation, assets, income, credit history, employment, PAYE and KiwiSaver contribution details
    • transaction history with us and our associates or relevant third parties
    • marketing and communications information, such as marketing and communication preferences, tracking data relating to whether you have read marketing communications from us, and unique user identifiers assigned to you for tracking purposes.
    • profile details such as your username for our online services you have access to, investments made by you, services requested, marketing communications responded to, information about health and genetic and biometric data
    • analytics and technical data such as your IP address and platform usage information, operating system, mobile app versions, and browser and device type
    • other information we may be legally required to collect or to otherwise meet legislative requirements, including under local or overseas legislation such as tax reporting legislation and legislation to combat money laundering or terrorism, and to enforce sanctions.

Where we collect personal information in connection with applications made on behalf of minors, we apply the same protections described in this Privacy Policy and take appropriate care in the use of any tracking and analytics technologies in that context.

2. Why do we collect personal information?
The personal information you provide to us (whether on our platform or captured on closed circuit television (CCTV) or in an application form for a Milford Fund or elsewhere) may be collected, held and used by us for the following purposes:

• • • process and respond to your web enquiry
    • communicate and provide information to you by any method including electronically, such as by email, text message, through our online portal or by post
    • administration, marketing, operation, security and management of the Funds
    • provision of our financial products, financial advice and other services to you, including our processing of payments to and from you
    • compliance with laws, rules and regulations whether in New Zealand, Australia or elsewhere, including to combat money laundering and terrorism financing and to enforce sanctions laws, financial markets laws and taxation laws, in each case whether in New Zealand, Australia or elsewhere
    • verification of your identity (including via electronic identity verification and biometric verification) and bank account details
    • to understand our platform user and client preferences and interests
    • for internal research, development, and optimisation of our platforms and the services we provide
    • optimising the effectiveness of our marketing activities, and creating and targeting advertising campaigns across digital and other channels, including letting you know about features, products and services we offer
    • personalising your experience on our platforms and in the communication and content you receive from us
    • managing our relationship with you, and evaluating and improving our client service
    • detect, deter, prevent or investigate unruly behaviour or fraud and/or other criminal activity
    • exercise and enforce our rights under our platform terms of use
    • assist with the safety and security of our staff, contractors, visitors and property.

3. Who do we disclose your personal information to?
Your personal information may be disclosed to, and held and used by, the following persons:

• • • Any of the Milford Group’s employees, contractors, advisers, and agents.
    • Any third party, whether in New Zealand, Australia or elsewhere, that provides services to the Milford Group or assists us to provide our financial products, financial advice and other services, including third parties who verify information you provide to us, such as your bank account or your identity (where you have opted into an electronic identity verification method). The Milford Group takes reasonable steps to ensure the third party does not breach the Privacy Principles.
    • Other bodies such as government departments or agencies, regulators (including the FMA and ASIC), and legal and professional advisers (whether or not we are legally obliged to disclose) whether in New Zealand, Australia, or elsewhere.
    • Any other person or entity where it is relevant to do so for the purposes set out in this Privacy Policy.

We may also disclose personal information where we believe this is appropriate for legal compliance, avoiding prejudice to the maintenance of law (including the prevention, detection, investigation, prosecution and punishment of offences) and law enforcement (including to government agencies with statutory law enforcement responsibilities), or to assist with court proceedings, enforce or apply our terms of use, or protect ourselves, our platform users or clients, and others.

We can also disclose personal information to third parties as instructed by you and in other ways permitted by the Privacy Act and the Privacy Principles.

If you have provided your consent, your personal information may also be used by any Milford Group member to keep you informed about other financial opportunities, products and services of any Milford Group member, including by email, by text message, through the platform or by any other electronic means. Any electronic communication offering other financial opportunities, products or services will include an unsubscribe facility. Please note that opting out of marketing communications will not affect our ability to send you transactional or service-related communications (such as account statements or responses to your enquiries), or our use of your information for analytics, measurement, and personalisation purposes in accordance with this Privacy Policy. Please see the “Cookies and similar technologies” section below for information on controlling tracking technologies.

4. How do we collect personal information?
We collect most personal information directly from you (or from someone who is representing or assisting you). Sometimes we may (and you authorise us to) collect personal information about you indirectly, such as from:

• • • referral partners and introducers, financial advisers and professional trustees, lawyers and accountants acting on your behalf
    • public sources such as the New Zealand Companies Register, land/property registers, and births/deaths/marriages registers
    • third party marketing and communications platforms and analytics services
    • third party digital platforms and platform providers
    • government agencies
    • other third parties who assist with aspects of the establishment and administration of your account(s) with us, such as third parties who provide identity and bank account verification services.

We may also collect information about you through your use of our platform (including subscribing for news and insights) and from publicly available sources of information.

We will only collect information which is sensitive in nature (for example, your health information or biometric information) directly from you or relevant third parties with your consent, if the information is reasonably necessary for, or directly related to, (and where relevant, the processing of such information is proportionate to) one or more of our activities. In some circumstances permitted under the Privacy Act, for example, where authorised by a court, we will not seek your consent to collect sensitive information. Any sensitive information that is collected will only be used for the purpose for which it is provided.

When you are dealing with Milford by telephone or live web or video chat service, or attending a Milford hosted seminar or conference, your conversation or other interactions with us may be recorded for training or verification purposes. When you approach or enter a Milford office, you may be recorded on a CCTV operated or managed by Milford primarily for health and safety purposes. CCTV cameras may be located in Milford offices, however they are not located in restrooms or other areas designated for personal privacy.

5. Your Information and Technologies we use

• • • Cookies and similar technologies
      We, and our third-party service providers, may use cookies, web beacons, pixels and other tracking and storage technologies when you interact with us through our platform, emails or other communications. Cookies are small blocks of text stored on your device. They allow us and our third-party service providers to recognise your device, and collect and receive information about you from our platform and elsewhere on the internet. Web beacons (also called pixels or tags) are small pieces of code embedded in web pages or emails that communicate information about your interaction with those pages or emails (such as whether you opened an email or clicked a link). Cookies, web beacons and other storage technologies may be used for security to help us identify your browser, to provide you with personalised features, content and experiences, to provide measurement services and target ads, and for tracking traffic and your interactions on our platform and communications.
      We may share information collected through cookies (or similar technologies) with third parties (who may also use that information for ad targeting and the other purposes described above).
    • Opting out of cookies
      You can prevent new cookies from being installed and delete existing cookies. The procedure depends on which browser you are using. For information on how to remove cookies, check your internet browser. You may be unable to make full use of our platform or its integration with Facebook or other third-party platforms unless you accept cookies.
      For further information on how to opt out of cookies or similar technologies, see http://www.aboutads.info/choices, and http://www.networkadvertising.org.
    • Analytics Tools
      We may use various app, web and / or email analytics tools (e.g. Google Analytics) to collect information through the platform (such as the number of visitors per day or the average amount of time spent on the platform). Emails we send to you may also include a code (such as a unique identifier) that measures or determine what you do when you receive it and whether you respond. The information we collect through the use of such analytics tools may be anonymous or may be associated with other personal information we hold about you, and may be used for the purposes described in this Privacy Policy.
      By accessing or using our platform, you consent to the processing of data about you by our third-party analytics providers for the purposes set out above (such as Google Analytics in the manner described in Google’s Privacy Policy). You can opt out of analytics tracking by disabling or refusing cookies in your browser settings or by using the opt-out tools provided by the relevant analytics service (e.g., Google Analytics).
    • Generative AI Tools
      We may use generative artificial intelligence (AI) tools to help us provide our products and services. When we do, we apply technical and organisational safeguards designed to protect your information. Our use of those tools does not change our privacy obligations to you. We do not use your personal information to train generative AI models.

6. How do we hold personal information?
The personal information we hold will be stored securely by us or our service providers, whether electronically or otherwise. We may hold your personal information on the cloud or other types of electronic system. We use a range of security measures to protect the personal information we hold.

7. What do we do if there has been a breach of your personal information?
If there has been an eligible breach or a notifiable privacy breach of your personal information, we will respond to actual or potential data breaches quickly through our notification processes. Eligible breaches or notifiable privacy breaches include (i) unauthorised access or disclosure of personal information, and (ii) information that is lost in circumstances where unauthorised access or disclosure of personal information has occurred, in each case where the breach has or is likely to result in serious harm to one or more individuals and Milford has not been able to prevent the likely risk of serious harm with remedial actions.

If we believe there has been an eligible breach or a notifiable privacy breach, then affected individuals and the regulator will be notified to ensure that your personal information is protected.

8. How can you access and correct your personal information?
You may request access to, or correction of, any personal information that we hold about you at any time (subject to certain exceptions allowed by law).

You may request access to, or correction of, your personal information by contacting Milford on the Contact Details below. Any update to your personal information may be used to update other information held about you by any member of the Milford Group.

There are circumstances where we are entitled to refuse your request. For example, we will not give you access to the personal information where giving access would likely pose a serious threat to the life, health, or safety of you or any individual, or to public health or public safety.

We will respond to your request for access or correction within 20 working days. If your request is refused for any reason, we will give you a written notice with the reasons why your request has been refused and your options in respect of our decision.

If you are concerned about how your personal information is being handled or if you would like to make a complaint, or you have any questions or concerns about our Privacy Policy or practices, please contact us on the Contact Details below.

9. What happens if personal information is not provided?
If you do not provide the personal information we request, we may not be able to respond to your enquiry or provide you with the full range of products and services we offer.

10. What do you need to do if you have a complaint?
If you wish to make a complaint about a breach of this Privacy Policy, the Privacy Act or the Privacy Principles, you can contact us using the contact details below. You will need to provide us with sufficient details regarding your complaint together with any supporting evidence.

We will refer your complaint to our Privacy Officer who will investigate the issue and determine the steps (if any) that we will undertake to resolve your complaint. We will contact you if we require any additional information from you and will notify you in writing of the outcome of the investigation. We will aim to respond to and notify you of the outcome of our investigation regarding the privacy complaint within 20 working days of receiving the complaint.

If you are not satisfied with our determination, you can contact us to discuss your concerns or make a complaint to the New Zealand Office of the Privacy Commissioner via www.privacy.org.nz or to the Australian Privacy Commissioner via www.oaic.gov.au.

You can also lodge a dispute:

For New Zealand through the:

• Financial Services Council Limited (FSCL) our external dispute resolution provider for New Zealand via www.fscl.org,nz

For Australia through the:

• Australian Financial Complaints Authority (AFCA), our external dispute resolution provider in Australia, via www.afca.org.au.

Both FSCL and AFCA provide consumers and small businesses with fair, free and independent dispute resolution for financial complaints. Please note that FSCL may recommend that a privacy complaint is referred to the Office of the Privacy Commissioner for resolution.

Our Contact Details
• If calling from New Zealand: 0800 662 345
• If calling from Australia: +1800 161 310
• By emailing us at [email protected]

Date updated: 17 August 2026