Whistleblower Policy

1. The purpose of this whistleblower policy is to:
   • identify wrongdoing or systemic misconduct which may be harmful to Siteminder and/or its subsidiaries (Siteminder) or our employees, officers or contractors
   • encourage those who are legally entitled to make a disclosure of wrongdoing to speak up;
   • help detect, address and prevent inappropriate conduct within Siteminder; and
   • outline the protections available and provide suitable channels for whistleblowers to report inappropriate conduct and wrongdoing, in accordance with Part 9.4AAA of the Corporations Act 2001 (Cth) (Corporations Law) or Part IVD of the Taxation Administration Act 1953 (Cth) (Tax Act).
2. A person who makes a disclosure under this whistleblower policy is referred to as a whistleblower.
3. This whistleblower policy does not form any part of any employee’s contract of employment, and Siteminder may amend it at any time.

1. The following individuals are eligible whistleblowers. That means they can make a report of a Disclosable Matter (as defined in paragraph 4) and will be protected for doing so in accordance with this policy.
   • An eligible whistleblower is an individual who is, or has been, any of the following in relation to Siteminder:
     • an officer, director or senior manager;
     • a permanent, temporary, casual, part-time or full-time employee;
     • a trainee or apprentice;
     • suppliers of services or goods to Siteminder, such as contractors and business partners; or
     • a spouse, relative or dependant of an individual referred to above.
   • An eligible whistleblower will qualify for protections available under the Corporations Law and the Tax Act if they make a disclosure that qualifies for protection under those statutes. See Schedule 1 for when a disclosure qualifies for protection under the Corporations Law and Tax Act.
2. Issues, queries and concerns about the application of this whistleblower policy, and the type of protections and immunities available to whistleblowers, and other persons (including persons who are the subject of a disclosure), can be raised with:
   • Your line manager or supervisor.
   • The Whistleblower Officer.
   • An independent lawyer should you seek legal advice on the operation of the statutory whistleblower regimes under the Corporations Law or Tax Act.
   • Siteminder’s Employee Assistance Providers, on the following numbers:

     Australia	Assure Programs	1800 808 374
     Ireland	LAYA Healthcare	1800 911 909
     Americas	Trinet EAP	888-893-5893
     UK	Health Shield	0800 028 1963.

1. The Board of Directors has responsibility for:
   • This whistleblower policy, including approving the whistleblower policy and any amendments.
   • Where relevant, determining how a matter reported under this whistleblower policy will be managed, including seeking legal advice on Siteminder’s statutory or other legal obligations arising from a disclosure made under this whistleblower policy.
2. The Whistleblower Officer has primary and day-to-day responsibility for:
   • Implementing this whistleblower policy.
   • Assessing disclosures made under this whistleblower policy.
   • Subject to any permissions from the whistleblower, ensuring a whistleblower’s identity is kept confidential.
   • Notifying the Board of Directors where a disclosure is sufficiently serious.
   • Seeking legal advice on Siteminder’s statutory or other legal obligations arising from a disclosure made under this whistleblower policy.
   • Assessing the risk of any detrimental conduct to a whistleblower, or other person, due to a disclosure made under this whistleblower policy, and ensuring the implementation of appropriate safeguards.
   • Determining whether a disclosure will be investigated, and the scope and conduct of that investigation.
   • Notifying the Chief People Officer in circumstances where, if the disclosure was proven, there could be disciplinary consequences for an employee of Siteminder.
3. Designated disclosure officers (see paragraph 6.1), officers and senior managers of Siteminder, and employees and officers with functions or duties that relate to the tax affairs of Siteminder are responsible for:
   • Receiving disclosures under this whistleblower policy.
   • Subject to any permissions from the whistleblower, ensuring a whistleblower’s identity is kept confidential.
   • Ensuring a whistleblower has access to this whistleblower policy.
4. Siteminder’s General Counsel is, where requested by the Board of Directors or Whistleblower Officer, responsible for the provision of legal advice to Siteminder in respect of a disclosure under this whistleblower policy, or the application of this whistleblower policy.
5. An Investigator, appointed by the Board of Directors, Whistleblower Officer, General Counsel or Siteminder’s legal representative, will have responsibility for:
   • Subject to any permissions from the whistleblower, ensuring a whistleblower’s identity is kept confidential.
   • Conducting a:
     • confidential and privileged factual investigation of the disclosure for the purpose of providing Siteminder with legal advice; or
     • conducting a confidential factual investigation of the disclosure, including gathering evidence, interviewing witnesses, communicating with the whistleblower where they have consented to providing their identity to the Investigator, seeking assistance from internal and external consultants, and providing an investigation report with the Investigator’s findings to the Board of Directors or the Whistleblower Officer.
6. The Chief People Officer has overall responsibility for any disciplinary process that is triggered by a disclosure under this whistleblower policy that, if established, leads to an allegation of misconduct or serious misconduct against an employee of Siteminder, of where a report involves a personal work-related grievance as defined in paragraph 5.3.
7. Potential whistleblowers are encouraged to report under this whistleblower policy if they reasonably suspect a Disclosable Matter exists or has occurred.
8. All employees of Siteminder, and persons providing services as an independent contractor or labour hire worker to Siteminder, are required to:
   • Subject to a claim of privilege or self-incrimination, cooperate with an Investigator, including by providing relevant documents and information, or answering questions during the conduct of any investigation under this whistleblower policy.
   • Strictly maintain the confidentiality of a whistleblower’s identity, whether they obtain that information directly or indirectly.
   • Refrain from committing, or threating to commit, any act of detrimental conduct to a whistleblower, or any other person, because they believe or suspect that a whistleblower, or another person, has made, may have made, proposes to make or could make a disclosure that qualifies for protection under the Corporations Law or Tax Act.

1. Eligible whistleblowers should make a disclosure under this whistleblower policy if they reasonably suspect that conduct, or a state of affairs exists, in relation to Siteminder that is any of the following:
   • Misconduct, or an improper state of affairs or circumstances, in relation to Siteminder or in relation to its tax affairs. This includes:
     • dishonest, fraudulent or corrupt practices;
     • harassment, discrimination, victimization or bullying;
     • criminal conduct, including theft, unlawful drug use, violence or intimidation, criminal damage to property;
     • breaches of state or federal law, or other rules or regulations which apply to Siteminder (e.g. the ASX Listing Rules);
     • unethical conduct, or breaches of Siteminder’s policies or procedures (including the Siteminder Code of Conduct);
     • unsafe work practices or work practices that violate environmental regulations;
     • conduct that is likely to cause financial (or other) loss or reputational damage;
     • serious improper conduct or abuse of authority;
     • information that indicates a serious risk to public safety, or the stability or confidence in the financial system; or
     • conduct aimed to conceal records relating to the above.
   • In contravention of any law administered by the Australian Securities and Investments Commission (ASIC) or Australian Prudential Regulation Authority (APRA) (see Schedule 2 for a list of these laws).
   • Conduct that represents a danger to the public or the financial system (even if this conduct does not involve a breach of a particular law).
   • Conduct that is an offence against any law of the Commonwealth, where the offence is punishable by imprisonment for a period of 12 months or more. (collectively referred to as Disclosable Matters.)
2. You must have reasonable grounds to suspect that the information you are disclosing concerns misconduct or an improper state of affairs or circumstances. Reasonable grounds means that a reasonable person in your position would also suspect the information indicates misconduct or a breach of the law.
3. Wrongdoing can be a Disclosable Matter regardless of whether it contravenes a particular law. A disclosure can still qualify for protection even if that disclosure turns out to be incorrect. But a disclosure which is not made on reasonable grounds, or does not otherwise fall into the category of Disclosable Matter under clause 4.1 will not result in the whistleblower being given the protections offered by this Policy.

1. Subject to a handful of exceptions (see paragraph 5.3), a Disclosable Matter does not include a personal work-related grievance. That is a grievance in relation to a whistleblower’s employment, or former employment, with Siteminder that only has implications for the whistleblower personally.
2. Examples of a personal work-related grievances include complaints an employee, or former employee, may hold concerning:
   • The terms and conditions of their employment.
   • An interpersonal conflict with another employee.
   • Any disciplinary or performance management process.
   • The termination of their employment.
3. A personal work-related grievance will only be a Disclosable Matter if it:
   • Has significant implications for Siteminder, and wider ramifications than for the whistleblower personally.
   • Relates to detrimental conduct suffered by the whistleblower because of making a previous disclosure, or seeking legal advice about whistleblower protections.
4. Further information about Siteminder’s workplace policies can be obtained from the HR Team or on BambooHR. If unsure whether a grievance is a Disclosable Matter under this whistleblower policy, or a personal work-related grievance that is more appropriately managed through a relevant workplace policy of Siteminder, seek guidance from the Whistleblower Officer or the General Counsel.

1. Disclosures under this whistleblower policy should be made to one of the following Designated Disclosure Officers:

   Whistleblower Officer	whistleblower@siteminder.com
   General Counsel – Mark Simpson	mark.simpson@siteminder.com
   Chief People Officer – Dionne Niven	dionne.niven@siteminder.com
   Head of Sales – Jonathan Bedford	jonathan.bedford@siteminder.com
   Chairman of the Board – Mike Ford	mike.ford@siteminder.com

2. Wherever possible, to assist Siteminder handle a disclosure appropriately, the following information about a Disclosable Matter should be provided to the Designated Disclosure Officer in a clear and factual way:
   • The whistleblower’s full name, address and preferred contact details, noting there is no requirement for a whistleblower to provide these details as disclosures may be made anonymously.
   • The division or department which the Disclosable Matter relates to.
   • The nature of the alleged wrongdoing including, where relevant, details of the person believed to have committed the wrongdoing, or is aware of, or involved in, the wrongdoing.
   • When and where the wrongdoing occurred.
   • Anyone else who may verify the claim, or possible witnesses.
   • If the whistleblower is concerned about any possible victimisation or acts of reprisal for disclosing the matter, or has been subject to detrimental conduct for a previous report of a Disclosable Matter, and any assistance or support sought from Siteminder.
   • Any support information (for instance, emails, documents, text messages, file notes and photos).
3. Whistleblowers can also report Disclosable Matters by:
   • Writing a report, preferably addressing the matters raised in paragraph 6.2, and mailing it to:
     • Whistleblower Officer,
     • Siteminder Limited,
     • Bond Store 3
     • 30 Windmill Street,
     • Millers Point NSW 2000
     • Australia

     where it will be received by the Whistleblower Officer.

   • Where the matter does not involve the tax affairs of Siteminder, raising it with:
     • any officer or senior manager of Siteminder;
     • Siteminder’s appointed auditor, ASIC or APRA (see Schedule 3 for contact details).
     • in limited circumstances involving an emergency or public interest disclosure, to the media or a Member of Parliament.
   • Where the matter involves the tax affairs of Siteminder, raising it with:
     • a director or senior manager of Siteminder;
     • employees or officers of Siteminder who have functions or duties that relate to the tax affairs of Siteminder; or
     • Siteminder’s appointed auditor or the Commissioner of Taxation (see Schedule 4 for contact details).
4. Disclosures of Disclosable Matters can be made anonymously, and a whistleblower may choose to remain anonymous, including during any investigation into the disclosure. If the disclosure is not made anonymously, or an anonymous whistleblower consents to limited disclosure of their identity (for instance to the Whistleblower Officer or Investigator), Siteminder will take reasonable steps to ensure that the whistleblower’s identity remains confidential.

1. Under Australian law, an Eligible Whistleblower who makes a Protected Disclosure is legally entitled to the following protections:
   • Confidentiality & identity protection: You are entitled to have your disclosure kept confidential in order to protect your identity. It is illegal for a person to identify a discloser, or disclose information that is likely to lead to identification of the discloser, outside of certain exceptions (discussed further below).
   • Protection from detriment: It is illegal for someone to cause or threaten detriment to you because they believe or suspect that you have made, may have made, or could make a whistleblower disclosure.
   • Compensation & remedies: You can seek compensation through a court if you suffer retaliatory conduct, loss, damage or injury for making your disclosure. There are also other remedies you can seek, including:
     • reinstatement of your original position or a comparable position;
     • the court issuing an injunction to prevent or stop detrimental conduct; or
     • an order that the person who caused you detriment or threatened you with detriment apologising to you.
   • Civil, criminal and administrative liability protection: You may be protected from certain legal actions related to making a Protected Disclosure, including criminal prosecution, civil litigation (e.g. breach of your employment contract, duty of confidentiality or other contractual obligation), or administrative legal action (including disciplinary action) for making the disclosure.
   • Also, the information you provide may not be admissible as evidence against you in a legal proceeding (unless you have provided false information).
2. Siteminder is committed to protecting the confidentiality of a discloser’s identity and protecting disclosers from detrimental acts or omissions. Siteminder will take the following measures and has the following mechanisms in place to protect a discloser:
   • If you are an Eligible Whistleblower and make a Protected Disclosure under this Policy, it will be treated as confidential. This means that Siteminder will take all reasonable steps to protect your identity. Recipients of the report or any other person with knowledge of the report must not disclose your identity (e.g. name, title, team member ID or email address) unless:
     • it is required by law;
     • you provide consent;
     • disclosure is made to ASIC, APRA or the AFP;
     • disclosure is made to a lawyer for the purposes of getting legal advice about legal obligations of protection and confidentiality
   • Information which may lead to your identification (e.g. your unique role and responsibilities) may only be disclosed where it is reasonably necessary for Siteminder to further the investigation. In these cases, Siteminder will take reasonable steps to reduce the risk that your identity is disclosed.
   • Unauthorised disclosure of your identity or information which may lead to your identification other than in accordance with the abovementioned investigation exception will be regarded as serious misconduct, may constitute grounds for termination and may be an offence under Australian law.
   • Siteminder will not tolerate any reprisals, discrimination, harassment, intimidation or victimisation against an Eligible Whistleblower for making a Protected Disclosure under this Policy, or against that person’s colleagues, employer (if a contractor or supplier), relatives or any other person where the reason for the detrimental conduct relates to a suspicion that a person has reported a Disclosable Matter. Such treatment will be regarded as serious misconduct, may constitute grounds for termination and may be an offence under Australian law (attracting both criminal and civil penalties).
   • Siteminder has processes in place for assessing the risk of detriment against a discloser and other persons (e.g. other staff who might be suspected to have made a disclosure) which will commence as soon as possible after receiving a disclosure.
   • Siteminder may also take other actions to protect a discloser from detriment, for example allowing the discloser to perform their duties from another location.
   • Employees, potential Eligible Recipients and potential investigators will receive regular training in relation to their rights and obligations under this Policy.
   • Siteminder also offers counselling support services to all its staff (including employees who are whistleblowers or employees named in a disclosure) via the Employee Assistance Program (EAP). To access the EAP please call your local provider on the following numbers:

     Australia	Assure Programs	1800 808 374
     Ireland	LAYA Healthcare	1800 911 909
     Americas	Trinet EAP	888-893-5893
     UK	Health Shield	0800 028 1963.

3. A whistleblower can choose to remain anonymous while making a disclosure, over the course of the investigation and after the investigation is finalised. A whistleblower can refuse to answer questions that they feel could reveal their identity at any time, including during follow-up conversations. However, please be aware that anonymity can limit thorough investigation and proper resolution of the matter. As with named reporting, to allow Siteminder to investigate the issue, it is important that anonymous reports include sufficient information in relation to the Disclosable Matter. We suggest that a whistleblower who wishes to remain anonymous should maintain ongoing two-way communication with Siteminder, so that Siteminder can ask follow-up questions or provide feedback.
4. Remedies and penalties may be imposed against any person who contravenes the protections where a qualifying disclosure under the Corporations Law or Tax Act has been made.

1. Where a whistleblower does not give their permission to share their identity, or share their identity with particular persons involved in managing or investigating the disclosure, a person receiving a disclosure under this whistleblower policy will disclose the information contained in the disclosure only if:
   • The information does not disclose the whistleblower’s identity.
   • They have taken all reasonable steps to reduce the risk that the whistleblower will be identified from the information.
   • It is reasonably necessary for investigating the issues raised in the disclosure.
2. Information relating to the disclosure will be stored confidentially and securely in Siteminder’s whistleblower database maintained by the Whistleblower Officer. All persons receiving, handling and investigating a disclosure under this whistleblower policy will receive appropriate training in their obligations in respect of the confidentiality of a whistleblower’s identity, and how to ensure the security of information and communications in respect of a disclosure.
3. Whistleblowers should be aware that people may be able to guess their identity where they:
   • Have mentioned to other people they are considering making a disclosure.
   • Have complained or raised concerns with other people about the subject matter of the disclosure.
   • Are one of a very small number of people with access to the information the subject of the disclosure.
   • Are disclosing information that has been told to them privately and in confidence.
4. After receiving a disclosure under this whistleblower policy, a recipient of a disclosure will notify the Whistleblower Officer of the disclosure, having regard to their obligations in paragraph 8.1. The Whistleblower Officer will, as soon as practicable, assess:
   • The disclosure and determine whether it:
     • falls within the scope of this whistleblower policy, or whether it is more appropriately managed under another workplace policy of Siteminder;
     • triggers a requirement for Siteminder to seek legal advice in respect of its legal obligations, including the conduct of a factual investigation into the disclosure to assist in the provision of that advice; or
     • should be investigated, and by whom.
   • The risk of detriment to the whistleblower, or another person, arising from the disclosure, and where appropriate develop and implement strategies to eliminate, or where that is not reasonably practicable, minimise the risk of detriment to the whistleblower, or another person, arising from the disclosure.
5. In certain situations, it will be appropriate for the recipient of a disclosure to report a disclosure directly to the Board of Directors, and for the assessment detailed in paragraph 8.4 to be performed by the Board of Directors.
6. Where it is determined that a disclosure should be investigated:
   • The investigation will be through, objective, fair, preserve the confidentiality of the whistleblower’s identity, and be conducted independent of:
     • the whistleblower;
     • any person the subject of the disclosure; and
     • any parts of Siteminder’s business concerned.
   • The Investigator will document the nature and scope of the investigation and findings in a report that will be provided to the Whistleblower Officer and/or the Board of Directors, who will provide feedback, where appropriate, to the whistleblower regarding the progress and outcome of, and actions arising from, the investigation.
7. If the disclosure was made anonymously, the determination of whether to investigate the disclosure, or the conduct of any investigation, will be based on the information provided by the whistleblower.

1. An employee who breaches this whistleblower policy will face a disciplinary process in accordance with Siteminder Disciplinary Policy, which could result in the termination of their employment. Breach includes:
   • breaching an obligation to keep a whistleblower’s identity confidential;
   • refusing to participate or cooperate with an investigation into a disclosure; or
   • engaging in detrimental conduct against a whistleblower or another person because a disclosure has been made under this whistleblower policy.
2. Siteminder may terminate its relationship with other individuals and entities providing goods or services to Siteminder if they breach this whistleblower policy.

This Policy is available on the Siteminder website Corporate Governance page, and on BambooHR. It will be reviewed regularly by the Board of Directors.

1. Eligible whistleblowers, and others, may be able to obtain certain statutory protections where a disclosure qualifying for protection is made under Part 9.4AAA of the Corporations Law or Part IVD of the Tax Act.
2. This Schedule provides an overview of the key conditions that must be met for a disclosure of information to qualify for protection under the Corporations Law and the Tax Act.

1. To qualify for protection under the Corporations Law, a disclosure can be either a:
   • Qualifying disclosure.
   • Protected disclosure.
2. To be a qualifying disclosure under the Corporations Law, the following conditions must be met.

   Condition	Consideration
   The information disclosed relates to a regulated entity.	The information disclosed must relate to a regulated entity, a term that includes a company such as Siteminder.
   The individual making the disclosure is an eligible whistleblower in relation to the regulated entity.	The person making the disclosure must be an eligible whistleblower, a term broadly defined by the Corporations Law to include an individual who is, or has been, any of the following in relation to the regulated entity: An officer or employee. An individual supplying services or goods, or an employee of a person supplying services or goods. An associate (such as a director or related entity). A relative, dependent or spouse of an individual referred to above.
   The disclosure must be made to a person who is eligible to receive a disclosure.	The disclosure must be made to a person or body prescribed under Part 9.4AAA of the Corporations Law as eligible to receive a protected disclosure, which includes: Officers and senior managers of the regulated entity. Persons authorised by the regulated entity to receive qualifying disclosures, which could include an independent external hotline service, as well as senior leaders. Auditors and actuaries of the regulated entity. The Australian Securities and Investment Commission (ASIC). The Australian Prudential Regulation Authority (APRA).
   The disclosure is about matters the eligible whistleblower has reasonable grounds to suspect may concern prescribed conduct in respect of the regulated entity, or a related body corporate of the regulated entity.	A qualifying disclosure must be about a Disclosable Matter. A disclosure relates to a Disclosable Matter if an eligible whistleblower has reasonable grounds to suspect that the information they are disclosing concerns or indicates: Misconduct or an improper state of affairs or circumstances in relation to the regulated entity or a related body corporate of the regulated entity.. The regulated entity, or an officer of the regulated entity, or a related body corporate of the regulated entity, has engaged in disclosable conduct, being conduct that: breaches legislation administered by ASIC or APRA, including the Corporations Law; constitutes an offence against any other Commonwealth Law that is punishable by imprisonment for a period of 12 months or more; or represents a danger to the public or financial system.
   A disclosure will not be a qualifying disclosure if it relates to a personal workrelated grievance of the whistleblower, unless an exception applies.	A personal work-related grievance is broadly a disclosure of information concerning a matter in relation to the whistleblower’s employment, or former employment, and having (or tending to have) implications for the whistleblower personally, such as in respect of: Their engagement, transfer or promotion. Terms and conditions of employment. Interpersonal conflict with an employee. Discipline or suspension. Termination of employment. However, a personal work-related grievance will be a qualifying disclosure it: Has significant implications for Siteminder, and wider ramifications than for just the whistleblower (such as a personal grievance that identifies wider systematic failures by the regulated entity). Relates to detrimental treatment suffered by, or threatened to, the whistleblower because of making an earlier qualifying or protected disclosure.

3. To be a protected disclosure under the Corporations Law, either of the following conditions must be met:

   In extreme cases, where an eligible whistleblower makes a disclosure to the media or a Member of Parliament in relation to a regulated entity.

   For a disclosure to the media or a Member of Parliament to qualify for protection under Part 9.4AAA, the eligible whistleblower must: Already have made a qualifying disclosure. Already have met certain prescribed written notification requirements in respect of that qualifying disclosure to the person or body that received the disclosure, and either: the disclosure is in respect of a substantial and imminent danger to someone’s health and safety, or the natural environment; or disclosing the information is in the public interest.

   A disclosure of information is made to a legal practitioner for the purpose of obtaining legal advice or representation in relation to the operation of Part 9.4AAA of the Corporations Law.

   This condition for a disclosure to be a protected disclosure does not carry any of the requirements for the disclosure to also be a qualifying disclosure, including no requirement that: The person be an eligible whistleblower. The disclosure be about a Disclosable Matter.

To qualify for protection under the Tax Act, the following conditions must be met:

• Joshua Tanchel,
• Deloitte,
• Level 9, Grosvenor Place
• 225 George Street
• Sydney NSW 2000
• jtanchel@deloitte.com.au
• +612 9322 7258

1. ASIC Office of the Whistleblower
   • Address: GPO Box 9827, Brisbane Qld 4001.
   • Website: https://asic.gov.au.
   • Telephone: 1300 300 630.

1. APRA contact
   • Address: GPO Box 9836, SYDNEY NSW 2001.
   • Website: https://apra.gov.au.
   • Telephone: 1300 558 849.

• Joshua Tanchel,
• Deloitte,
• Level 9, Grosvenor Place
• 225 George Street
• Sydney NSW 2000
• jtanchel@deloitte.com.au
• +612 9322 7258

1. Commissioner of Taxation
   • Address: PO Box 900, Civic Square ACT 2608.
   • Website: https://ato.gov.au.
   • Telephone: 13 28 69.