Data Breach Response Policy

1.1 Purpose

This Data Breach Response Policy explains how Tool-O prepares for, manages and responds to actual or suspected data breaches affecting Personal Information or other protected information handled by the Platform.

The purpose of this Policy is to minimise harm, protect affected individuals, preserve trust and support compliance with applicable privacy and data protection laws.

1.2 Objectives

This Policy seeks to:

• establish a structured data breach response process;

• protect Personal Information;

• minimise harm arising from data breaches;

• support timely investigation and containment;

• facilitate appropriate notifications;

• strengthen information security;

• comply with applicable legal obligations.

1.3 Scope

This Policy applies to actual or suspected data breaches involving:

• Personal Information;

• User Accounts;

• Platform databases;

• payment-related information;

• authentication information;

• internal records;

• third-party hosted information;

• any other information processed by or on behalf of Tool-O.

1.4 Guiding Principles

Tool-O administers data breach response in accordance with the following principles:

• prompt action;

• transparency;

• accountability;

• confidentiality;

• proportionality;

• continuous improvement.

1.5 Relationship with Other Policies

This Policy should be read together with the:

• Privacy Policy;

• Security Policy;

• Incident Response Policy;

• Data Retention Policy;

• Business Continuity Policy;

• User Account Policy;

• all other Platform policies.

1.6 Updates

Tool-O may amend this Data Breach Response Policy from time to time.

The latest version published on the Platform replaces all previous versions.

2.1 Identification

Tool-O may identify actual or suspected data breaches through:

• User reports;

• internal monitoring;

• automated security systems;

• third-party service providers;

• security assessments;

• audit activities;

• regulatory notifications;

• other reliable sources.

2.2 Types of Data Breaches

A data breach may include circumstances involving:

• unauthorised access to information;

• unauthorised disclosure of information;

• accidental disclosure;

• loss of information;

• theft of information;

• alteration of information;

• destruction of information;

• unavailability of information;

• other events affecting the confidentiality, integrity or availability

of protected information.

2.3 Initial Assessment

Upon becoming aware of an actual or suspected data breach, Tool-O may promptly assess:

• the nature of the incident;

• the information involved;

• the likely cause;

• affected systems;

• potential impact on Users;

• applicable legal obligations.

2.4 Containment

Where reasonably appropriate, Tool-O may take steps to contain a data breach, including:

• restricting system access;

• isolating affected systems;

• resetting credentials;

• applying security controls;

• suspending affected functionality;

• preserving relevant evidence;

• implementing temporary protective measures.

2.5 Investigation

Tool-O may investigate a data breach by reviewing:

• system logs;

• authentication records;

• security alerts;

• access records;

• User reports;

• technical diagnostics;

• third-party information;

• other relevant evidence.

2.6 Risk Assessment

Tool-O may assess risks arising from a data breach by considering factors including:

• the type of information involved;

• the sensitivity of the information;

• the number of affected individuals;

• the likelihood of misuse;

• the severity of potential harm;

• whether the information has been recovered or secured.

2.7 Notifications

Where required or considered appropriate under applicable law, Tool-O may notify:

• affected Users;

• relevant regulators;

• law enforcement agencies;

• third-party service providers;

• other persons or organisations reasonably necessary to respond to the

breach.

Notifications may include information regarding:

• the nature of the breach;

• affected information where appropriate;

• recommended protective actions;

• available support;

• contact details for further enquiries.

2.8 Recovery

Following containment of a data breach, Tool-O may take reasonable steps to:

• restore affected systems;

• verify system integrity;

• strengthen security controls;

• recover information where possible;

• monitor for further unauthorised activity;

• reduce the likelihood of recurrence.

2.9 User Responsibilities

Users are encouraged to promptly notify Tool-O if they reasonably suspect:

• unauthorised Account access;

• compromised credentials;

• phishing attempts;

• suspicious communications;

• unauthorised disclosure of Personal Information;

• any other suspected data security issue.

Users should also take reasonable steps to protect their own credentials and devices.

2.10 Continuous Improvement

Tool-O seeks to continually improve its data breach response capabilities through security reviews, operational improvements, incident analysis, staff awareness and ongoing enhancement of information security practices.

3.1 Roles and Responsibilities

Tool-O may allocate responsibilities for responding to data breaches to appropriate personnel, service providers or authorised representatives based upon:

• the nature of the breach;

• operational requirements;

• technical expertise;

• legal obligations;

• regulatory requirements.

3.2 Preservation of Evidence

Where reasonably appropriate, Tool-O may preserve evidence relating to a data breach, including:

• system logs;

• access records;

• authentication records;

• communications;

• technical diagnostics;

• forensic information;

• other relevant records.

Evidence may be retained in accordance with applicable laws, the Privacy Policy and the Data Retention Policy.

3.3 Third-Party Coordination

Where a data breach involves third-party service providers, Tool-O may cooperate with those providers to:

• investigate the breach;

• contain the incident;

• restore affected services;

• strengthen security controls;

• comply with contractual or legal obligations.

3.4 Legal and Regulatory Compliance

Where required by applicable law, Tool-O may:

• notify privacy regulators;

• notify affected individuals;

• cooperate with law enforcement agencies;

• preserve relevant evidence;

• comply with statutory reporting obligations;

• comply with lawful directions or court orders.

3.5 Temporary Protective Measures

During or following a data breach, Tool-O may implement temporary protective measures including:

• password resets;

• Account restrictions;

• mandatory re-authentication;

• additional identity verification;

• temporary suspension of affected services;

• enhanced monitoring;

• other reasonable security measures.

3.6 User Assistance

Where reasonably appropriate following a data breach, Tool-O may provide affected Users with information regarding:

• recommended protective actions;

• credential updates;

• Account security measures;

• methods of contacting Tool-O;

• other relevant guidance.

Users remain responsible for taking reasonable steps to protect their own Accounts and devices.

3.7 Root Cause Analysis

Following a significant data breach, Tool-O may conduct an analysis to identify:

• contributing factors;

• technical vulnerabilities;

• operational weaknesses;

• process deficiencies;

• security improvement opportunities;

• preventative measures.

3.8 Documentation

Tool-O may maintain records relating to data breaches including:

• incident reports;

• investigation findings;

• notification records;

• corrective actions;

• recovery activities;

• lessons learned.

3.9 Security Improvements

Following a data breach, Tool-O may implement improvements including:

• enhanced access controls;

• infrastructure upgrades;

• revised operational procedures;

• software updates;

• enhanced monitoring;

• additional staff awareness or training where appropriate.

3.10 Responsible Data Breach Management

Tool-O seeks to respond to data breaches promptly, responsibly and proportionately while protecting affected individuals, maintaining compliance with applicable laws and strengthening the long-term security of the Platform.

4.1 Governance

Tool-O is responsible for administering this Data Breach Response Policy and may maintain internal procedures, response plans and security frameworks to support the effective management of actual or suspected data breaches.

4.2 Compliance

Tool-O seeks to manage data breaches in accordance with applicable privacy, data protection and cyber security laws and regulatory requirements.

Nothing in this Policy excludes, restricts or modifies any rights or obligations that cannot lawfully be excluded.

4.3 Policy Review

Tool-O may periodically review this Policy to reflect:

• legislative changes;

• regulatory guidance;

• technological developments;

• cyber security risks;

• operational experience;

• lessons learned from previous incidents;

• evolving industry practices.

4.4 Testing and Preparedness

Tool-O may periodically review and test its data breach response capabilities through activities including:

• incident response exercises;

• security assessments;

• penetration testing where appropriate;

• vulnerability assessments;

• procedural reviews;

• disaster recovery testing.

These activities are intended to improve preparedness and organisational resilience.

4.5 Continuous Improvement

Following reviews, testing or actual data breaches, Tool-O may implement improvements including:

• enhanced security controls;

• revised response procedures;

• improved monitoring;

• infrastructure upgrades;

• stronger authentication measures;

• additional staff awareness or training where appropriate.

4.6 Relationship with Other Policies

This Data Breach Response Policy should be read together with the:

• Privacy Policy;

• Security Policy;

• Incident Response Policy;

• Data Retention Policy;

• Business Continuity Policy;

• User Account Policy;

• Trust & Safety Policy;

• all other Platform policies.

Where there is any inconsistency, the Terms of Use prevail to the extent permitted by applicable law.

4.7 Contact

Questions regarding this Data Breach Response Policy may be directed to Tool-O using the contact details published on the Platform.

4.8 Policy Updates

Tool-O may amend this Data Breach Response Policy from time to time.

The latest version published on the Platform replaces all previous versions.

4.9 Commitment

Tool-O is committed to protecting Personal Information through responsible governance, prompt incident response and continuous improvement of its information security practices.

4.10 Final Statement

Protecting Personal Information is fundamental to maintaining User trust in the Tool-O marketplace.

By maintaining structured response procedures, complying with applicable privacy laws and continually strengthening its security practices, Tool-O seeks to minimise the impact of data breaches and support the confidentiality, integrity and availability of information entrusted to the Platform.

END OF DATA BREACH RESPONSE POLICY