1.1 Collection of Biometric Data

TOOLii collects personal information, including **biometric information** in the form of **facial images and data points**, through the TOOLii Robot.

1.2 Necessity and Purpose

The collection of this information is necessary to enable TOOLii to:

• identify and verify individuals engaging with the TOOLii Robot;
• provide secure, personalised interactions; and
• improve and maintain the functionality of the TOOLii Robot.

1.3 Voluntary Information

TOOLii may also collect other personal information provided voluntarily during interactions, including but not limited to **names, voice data, and interaction history**.

2.1 Notification Requirements

TOOLii takes reasonable steps to notify individuals, at or before the time of collection, of:

• the fact and circumstances of the collection;
• the purposes for which the information is being collected;
• the types of entities to which information may be disclosed;
• the rights of individuals to access and correct their information;
• the means by which complaints may be lodged in relation to a breach of the APPs.

3.1 Primary Use

TOOLii will use and disclose personal information only for the **primary purpose of collection**, being identification and authentication of individuals interacting with the TOOLii Robot.

3.2 Secondary Purposes

Personal information may also be used for secondary purposes where:

• the individual has provided consent; or
• the use or disclosure is otherwise permitted under the *Privacy Act 1988* (Cth).

3.3 Biometric Data Trading

TOOLii does not sell, rent, or trade biometric information.

3.4 Disclosure to Third Parties

Disclosure of personal information may occur to **third-party service providers**, including cloud storage or data processors, subject to compliance with APP 8 (Cross-border Disclosure of Personal Information).

4.1 Overseas Recipients

TOOLii may disclose personal information to **recipients outside Australia**.

4.2 Compliance Measures

TOOLii will take reasonable steps to ensure that any overseas recipient will handle personal information in accordance with the APPs or **substantially similar privacy protections**.

5.1 Data Security

TOOLii takes **reasonable steps** to ensure that all personal information is **stored securely** and is protected against unauthorised access, modification, misuse, interference, loss, or disclosure.

5.2 Access Restriction

Access to biometric data is **restricted to authorised personnel only**.

5.3 Retention Period

Personal information is retained only for as long as necessary to fulfil the purpose for which it was collected, unless a longer retention period is required or authorised by law.

5.4 Secure Disposal

When personal information is no longer required, TOOLii will take reasonable steps to **permanently de-identify or destroy it in a secure manner**.

6.1 Informed Consent

By **engaging with the TOOLii Robot**, individuals provide their **informed consent** to the collection, recording, storage, and use of their biometric and other personal information in accordance with this Privacy Policy.

6.2 Refusal of Consent

If an individual does not consent, they **must refrain from interacting** with the TOOLii Robot.

7.1 Right to Access and Correction

Individuals have the right to request access to the personal information TOOLii holds about them and to request the **correction** of that information if it is inaccurate, out of date, incomplete, irrelevant, or misleading.

7.2 Request Method

Requests for access or correction must be made in writing to the TOOLii Privacy Officer (see Section 10).

8.1 Option to Remain Anonymous (APP 2)

In accordance with **APP 2**, individuals have the option of **not identifying themselves**, or of **using a pseudonym**, when interacting with TOOLii, unless it is impracticable for TOOLii to provide services without identification.

8.2 Biometric Limitation

Due to the nature of biometric identification, **full anonymity may not be possible** during certain interactions.