Privacy Policy

THE a2 MILK COMPANY LIMITED

1 About this Privacy Policy

1.1 The a2 Milk Company Limited (‘a2MC’) and its subsidiaries and related entities (the ‘a2MC Group’) recognise the importance of protecting your privacy.

1.2 In this Privacy Policy, ‘we’, ‘us’ and ‘our’ refer to a2MC and, where applicable, other members of the a2MC Group.

1.3 We specialise in producing, marketing, and selling premium dairy products including liquid milk, infant formula, and powdered products, made with a2 Milk™. We operate in Australia, New Zealand and other countries and may provide our services through related entities, service providers, and distribution partners.

1.4 We collect and process your personal information in accordance with our legal obligations, including under the Privacy Act 1988 (Cth), and the Privacy Act 2020 (NZ) (together, the ‘Privacy Acts’) and the privacy principles under these laws.

1.5 This Privacy Policy describes how your personal information is collected and processed by the following members of the a2MC Group:

The a2 Milk Company Limited (ABN 97 769 415 292);
The a2 Milk Company (Australia) Pty Ltd (ABN 52 125 331 213); and
a2 Infant Nutrition Australia Pty Limited (ABN 27 161 773 913),

and details how we aim to protect the privacy of your personal information, and sets out your rights in relation to your personal information.

1.6 This Privacy Policy applies to the handling of personal information of individuals located in Australia and New Zealand in connection with the following websites:

1.7 This Privacy Policy does not apply to personal information collected about our employees or contractors which is governed by separate internal policies and notices.

1.8 We may update this Privacy Policy from time to time. You may obtain a copy of our current policy from our website or by contacting us directly using our contact details in section 8 below. This Privacy Policy does not limit the application to us of any exceptions available under the Privacy Acts.

1.9 For more information about how we use your information for direct marketing purposes and ways to opt out, please see section 2b below (“Why we collect and how we use your information”).

2 Collection, use and sharing

2a. What information do we collect?

2.1 We may collect the following categories of personal information from time to time, depending on your interactions with members of the a2MC Group, and the products and services we provide to you:

Types of personal information	What personal information may be collected
Personal and contact details	This may include your name, address, phone number, email address, age, date of birth, gender, and authorised signatories.
Financial information	This may include bank account details where necessary to process payments or administer corporate actions related to a2MC securities.
Employment information from job applicants	We may collect education and employment history and other details about your application and interview if you apply for a job with us.
Government identifiers and identity documents	This may include your Tax File Number (‘TFN’) and other identity documents for verification purposes. Note we only use this information as permitted by law – government identifiers are not adopted as internal identifiers.
Digital information	When you use our online services, we may collect device and technical information such as IP address, browser type, operating system, and log-on or usage details. We may also process materials you provide and associated metadata. For further information, see the Cookies section below.
Publicly available information	We use social media platforms and other interactive online forums through which we communicate, promote, and/or provide our goods and services. We may process personal information you disclose through such forums. However, such information may also be read, collected and used by other users whose actions we cannot control and for which we take no responsibility.
Sensitive information (including Careline data)	We may collect and process personal information that may be considered ‘sensitive information’ necessary to administer and resolve enquiries and complaints, including as part of our Careline services. This may include: health information relating to infants or consumers (e.g. age, feeding history, allergies or intolerances); relevant family context (e.g. number and ages of children and pregnancy status or plans); communications with healthcare professionals; limited cultural or religious information in relation to product use (e.g. dietary preferences); and adverse event details including photos or other attachments. Where sensitive information is collected via Careline, express consent will be sought at the time of collection.
Call recordings (including Careline calls)	We may record our calls for quality assurance, training, complaint handling and regulatory purposes. Where calls are recorded, we will take reasonable steps to inform you at or before the time of recording.

2.2 We usually collect your personal information directly from you. In some cases, we may obtain information about you from other people and organisations.

2.3 We may collect your personal information when:

you give it to us directly;
you purchase and use our products and services;
you purchase or acquire security holdings;
third parties, including your financial advisor, broker or authorised representative communicate with us on your behalf (in which case we will take reasonable steps to notify you of the collection);
you visit our website;
you participate in membership or promotional programs or competitions relating to our products and services, including through e-commerce platforms and apps; and
you knowingly give us information by contacting us via our website, social media accounts (including but not limited to Facebook, Instagram, TikTok, WeChat, AliPay, Little Red Book), email or telephone, including through Careline enquiry channels.

2.4 Where you interact with us through third-party social media, websites or other platforms, we may collect and use your personal information in accordance with this Privacy Policy. However, those platforms may also handle your personal information in accordance with their own terms of use and privacy policies.

2.5 We aim to collect only the personal information that is reasonably necessary for our functions or activities.

2.6 If at any time you provide another person’s personal information to us, then you must ensure that that person has read and understood this Privacy Policy and separately consents to his or her personal information being collected, used and disclosed by us as described in this Privacy Policy.

2.7 At or before the time we collect your personal information (or as soon as practicable afterwards), we will take reasonable steps to notify you of the matters required by APP 5, including who we are, how to contact us, the purposes of collection, and the consequences if personal information is not collected. This notification may be provided through this Privacy Policy, a collection statement at the point of collection, or other reasonable means.

Cookies and similar technologies

2.8 We may use cookies and similar technologies to monitor your usage of our online resources, including our website. A cookie is a small amount of information which is transferred to the hard drive of your computer which can identify your web browser but not you. These technologies provide us with information about your computer’s IP address, the date and time of your visit, and the resources or information you have accessed or interacted with. This information assists us in tailoring our services and making your visits easier, more productive and more efficient.

2.9 Cookies and similar technologies do not directly collect any personal information about you or extract any information from your computer. However, in some circumstances cookies may enable us to identify you. Any personal information obtained through the use of cookies or similar technologies will only be processed in accordance with this Privacy Policy. Some technologies may also be provided by third parties, who may collect and handle information in accordance with their own privacy policies. You may disable your web browser from accepting cookies. However, if you do, you may still access our website, but not all services may be available.

2b. Why we collect and how we use information

2.10 We collect your personal information where it is reasonably necessary for our functions and activities, and we use your personal information for the purposes for which it was collected. The table below sets out how we use your personal information and the underlying purpose:

Purpose	How we use your personal information
Serving you as a customer	We use your information to deliver our products and services and to improve your customer experience, including to: respond to your queries; provide and improve our products and services; conduct any promotions you participate in; keep a record of our dealings with you; develop a data profile to enable us to tailor our services to you and enhance the content and functionality of our website; and inform you of products and services that may be of interest to you (including by direct marketing, subject to your right to opt out). In the event you do not wish to receive our communications, you may opt-out by contacting us via our contact details in section 8.1 or through the opt-out mechanism contained in the communication.
Resolving your enquiries (including Careline enquiries)	Where you contact us including via our Careline (e.g. via webform, email or hotline), we use your information to: create and manage a case in our system; verify your identity in connection with enquiries or complaints; triage and resolve your enquiry or complaint; conduct product quality and safety investigations; and communicate outcomes and follow-up actions to you. Your personal information, including phone call recordings, may be stored in third party IT systems.
Improving our business	We use your information to improve the products and services we provide, such as for quality assurance and training purposes, to conduct data analytics, and to better understand how customers use our products, services and platforms.
Managing our operations	We use your information to manage our operations, including to: conduct any promotions you participate in; use the information for our internal business and marketing purposes and those of our related bodies corporate; protect the security and integrity of our business and systems; provide the services under Careers at a2MC, (including contacting you in relation to a job vacancy and/or application); administer investments in a2MC (including any employee incentive plans), maintain the register of securities, facilitate payments and other associated corporate actions and communications; and prepare and distribute statements regarding your security holdings and information relating to your investments in a2MC (including any employee incentive plans).
To comply with our legal obligations	We may also collect, use and share your information for other reasons where the law allows or requires us to. This may include identity verification, and for our record-keeping, reporting, audit and tax obligations and to prevent fraud.
Workplace management and compliance	We use personal information in our workplace management and compliance systems to: identify individuals involved in an activity (e.g. staff, contractors, customers or other stakeholders); allocate and track tasks; record inspections / audits / incidents; communicate about issues; and maintain an auditable record of actions taken (including who completed an action, and when). This helps us manage operational and regulatory compliance, quality and safety processes, and respond to enquiries or complaints (including via Careline).
De-identifying information	Sometimes we de-identify your personal information and aggregate this anonymised data (which does not identify you) to provide to our related bodies corporate and potential stakeholders to provide insights.
Sale or acquisition	We may share your personal information with any party in connection with an actual or potential, sale, merger, reorganisation or other restructuring.
Artificial intelligence	In limited cases, we may use information to: help train and improve tools used to summarise enquiries; improve service quality; and develop products and services that better meet customer needs. Where possible, we use de-identified or aggregated information for these purposes and do not make solely automated decisions that have a legal or similarly significant effect on you. Further, our use of artificial intelligence is subject to human oversight and other safeguards against bias.

2.11 We also use your information for permitted secondary purposes that you would reasonably expect, including to better understand you, your needs and to inform you about products and services you may be interested in, where permitted under the Privacy Acts.

2.12 Our ability to provide you with products, services, information and administer any investment you make in a2MC may be adversely affected if you choose not to provide us with your personal information (e.g. we may not be able to respond to your request, provide you with specific products or services or administer your investment). Where possible (and to the extent permitted by law), you may have the option of not identifying yourself or of using a pseudonym.

2.13 You consent to your personal information being processed for the purposes described in section 2.10 above.

2.14 We will process your personal information:

if you have provided consent;
for the purpose for which it was collected, or purposes reasonably related to that purpose, and even then, only if you would reasonably expect us to use it for those purposes; or
in law enforcement, public health, public safety or regulatory circumstances, where authorised or required by law.

Direct marketing

2.15 In accordance with the Privacy Acts and, as applicable, the Spam Act 2003 (Cth) and Unsolicited Electronic Messages Act 2007 (NZ), we may also use your personal information to deliver direct marketing to you about our products and services, or other products and services we consider might be relevant to you.

2.16 In the event you do not wish to receive such communications, you may opt-out by contacting us via our contact details in section 8 or through the opt-out mechanism contained in the communication.

2c. Who do we share your information with?

2.17 We may disclose your personal information to third parties as described below:

Type of party	Description
Members of the a2MC Group	To help us deliver services to you and for the purposes described above in this Privacy Policy. Members of the a2MC Group will treat your personal information in accordance with the Privacy Acts and their respective privacy policies.
Service providers and professional advisers	We use third party service providers to: support our Careline service; facilitate and administer investments in a2MC; facilitate and administer membership and promotional programs; support our marketing functions including advertising and promotion of our product; conduct research and development activities for the a2MC Group; support our IT infrastructure including hosting / cloud services, website and platform operations; and provide other services such as mailing, printing, market research, corporate, legal, recruitment and audit services. We take reasonable steps to ensure that these parties have contractual obligations to process and store your personal information in a manner consistent with this Privacy Policy.
Quality, packaging and dairy partners	For product quality investigations and traceability, we may share complaint notes that are relevant to an investigation with milk, product, packaging and related suppliers or distributors based in Australia or New Zealand. We aim to limit the personal information included in such notes and avoid sharing contact details unless necessary for the investigation or legally required.
Regulators and law enforcement	To comply with legal and regulatory obligations, including consumer protection, food safety and traceability requirements, and where we are legally compelled to disclose personal information.
With your consent	Where you ask us or authorise us to share information, or where consent can reasonably be inferred from the circumstances (including to your financial advisors or representative where relevant authorisations are provided).

Sending information overseas

2.18 Some of the recipients we disclose your personal information to may be located in countries other than Australia and New Zealand, including China, the United States, and any other country in which the a2MC Group does business.

2.19 Before disclosing any personal information to an overseas recipient, we take reasonable steps to ensure that the recipient complies with the Privacy Acts or is bound by a substantially similar privacy scheme. However, please note we cannot guarantee that all overseas recipients will comply with Australian law.

3 Security, confidentiality and storage practices

3.1 We take all reasonable steps to ensure that all personal information we process is accurate, complete and up-to-date.

3.2 We take all reasonable steps to ensure the security of our systems, including by maintaining organisational and technical measures, and to protect your personal information from misuse, interference and loss and from unauthorised access, modification and disclosure.

3.3 Access to personal information collected via Careline is provided on a need-to-know basis, with role-based access controls in place. We periodically review access permissions to ensure they remain appropriate.

3.4 Your personal information is stored in a secure environment and is accessed only by authorised personnel for permitted purposes, although, because of the nature of the internet, we cannot guarantee that such information is totally protected from hackers or misuse. Further information is available in our Security Policy at paragraph 8 of our Website Terms of Use.

3.5 We take data breaches seriously and maintain procedures to assess and respond to suspected breaches of personal information. Where an eligible data breach occurs, we will comply with our notification obligations under the Privacy Acts and our internal notification guidelines and incident plans.

4 Data retention

4.1 We generally seek to retain your personal information only for as long as it is reasonably necessary to fulfil the purposes for which it was collected or as permitted by law.

4.2 Retention periods may vary depending on the nature and purpose for which it was collected and the applicable legal or operational requirements.

4.3 Timeframes apply across our various collection channels, including our Careline services, website, customer programmes, and other contact methods. Contact details and case records may be archived or deleted in accordance with these timeframes, subject to any legal or regulatory requirements.

4.4 We endeavour to destroy or de-identify your personal information in a secure manner if we no longer need it for the purposes for which it was collected, unless we are otherwise required or authorised by law to retain the information. Where possible, we use anonymised or de-identified references in our internal records to minimise the retention of identifiable personal information.

5 How you can access and correct your information

5.1 You can contact us and ask to view your information. Upon your request, we will inform you of what personal information we store about you, and you may request the deletion or correction of that information.

5.2 If you:

wish to access, correct, remove or modify your personal information;
consider that there may have been a breach of your privacy;
would like to opt-out of receiving promotional communications from us; or
are unhappy with any aspect of the way we process your personal information,

please contact our Privacy Officer using the details set out in section 8.

5.3 When contacting the Privacy Officer, you will be required to provide proof of your identity to ensure that personal information is provided only to the correct individuals and that the privacy of others is protected. We may charge you a reasonable administration fee reflecting the costs to us for providing access in accordance with your request.

6 Making a complaint

6.1 Where you have raised a concern or complaint regarding your privacy, or a request to access or correct your personal information, we will endeavour to respond within 30 days of receiving your request (or as otherwise required under applicable law). If we refuse to provide access to, or allow correction of your personal information, we will notify you in writing setting out a written explanation of the reasons for the refusal (unless unreasonable to do so) and inform you of the mechanisms to complain about the refusal.

6.2 In the event you are dissatisfied with the outcome of your request, or if you still have any concerns about your privacy, you may contact the:

Office of the Australian Information Commissioner; or
Te Mana Mātāpono Matatapu (New Zealand Privacy Commissioner).

7 What this Privacy Policy does not apply to

Please be aware that this Privacy Policy applies to dealings with us including dealings via our websites or in respect of our website services but does not apply to any other third party websites which you access using a link from our websites. In this case the privacy policy of the owner of the linked website (if any) will apply. We cannot and do not make any warranty or representation as to the practices of any linked websites in the handling of your personal information. Further information is available in our Website Terms of Use.

8 Further information

8.1 If you have any questions or comments about this Privacy Policy or would like to request a copy of this Privacy Policy in a different format, please contact us using the details below.

Australia
Contact: Privacy Officer
Email: privacy@a2milk.com
Telephone: 1800 22 46 32
Address: PO Box 1564, North Sydney NSW 2059 Australia

New Zealand
Contact: Privacy Officer (NZ)
Email: privacy@a2milk.com
Telephone: 0800 22 46 32
Address: Level 17, 51 Shortland Street Auckland 1010, New Zealand

8.2 This policy was last updated on July 27th 2026

Privacy policy