Privacy Policy

Last Updated September 2026

GBST Holdings Ltd ACN 010 488 874 and its related bodies corporate, including GBST group entities in Australia, the United Kingdom, Vietnam and other jurisdictions, are committed to protecting personal information.

This Privacy Policy explains how GBST collects, uses, discloses, stores and protects personal information when you interact with us, including through our website, products and services, customer and supplier relationships, business development activities and other dealings with GBST.

This Privacy Policy applies globally. Depending on where you are located, the GBST entity you interact with, and the nature of your relationship with us, additional rights and information may apply under local privacy and data protection laws, including the Australian Privacy Act 1988 (Cth), the Australian Privacy Principles, the UK GDPR, the UK Data Protection Act 2018 and the Vietnamese Law on Personal Data Protection 2025.

In this Privacy Policy, “personal information” means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether directly or indirectly. Where applicable privacy or data protection laws use the term “personal data”, references to personal information in this Privacy Policy include personal data.

Where we rely on your consent to collect or use personal information, we will ask for that consent separately where required.

1. Information about Us

GBST Holdings Limited ACN 010 488 874 is the parent company of the GBST group. GBST group entities operate in jurisdictions including Australia, the United Kingdom and Vietnam. Legal entities within the GBST group include:

  • GBST Wealth Management Ltd Company No. 06663089,
  • GBST Hosting Limited Company No. 066612;
  • GBST UK Holdings Limited Company No. 06662908; and
  • GBST Vietnam Limited Liability Company No. 0318345197.

Where UK or Vietnamese data protection laws apply, the relevant GBST group entity that determines the purposes and means of processing your personal information will be the controller of that information. This will usually be the GBST entity that communicates with you, provides services to you or your organisation, receives services from you or your organisation, or otherwise manages the relevant relationship with you.

If you would like further information about which GBST entity is responsible for handling your personal information, please contact our Privacy Officer using the details in section 11.

2. Whose personal information do we process

The personal information that we collect, use and disclose, and the purposes for which we do so, will depend on your relationship with GBST. This section explains how we use personal information about different categories of individuals.

We do not generally seek to collect sensitive information, special category data or criminal offence information unless it is necessary for a specific purpose and permitted by law. Where required, we will seek your consent or rely on another applicable lawful basis, condition or permitted exception before collecting or using that information.

If you provide personal information to us about another individual, you must ensure that you are authorised to do so and, where required, that the individual has been informed about the collection and disclosure of their personal information.

Where UK or Vietnamese data protection laws apply, we must have a lawful basis to process personal information. Depending on the circumstances, the lawful bases we rely on may include:

  • performance of a contract with you, or taking steps before entering into a contract;
  • our legitimate interests or those of a third party, provided those interests are not overridden by your rights and freedoms;
  • compliance with our legal and regulatory obligations;
  • your consent, where required or appropriate; or
  • another lawful basis permitted by law.

2.1 Customers, Prospective Customers and Customer Contacts

  • What personal information do we collect?

We may collect and use:

  • general information, such as your name, business contact details, phone number and email address;
  • professional information, such as your employer, job title, role and information about your job responsibilities;
  • account, service and relationship information relevant to our dealings with you or your organisation;
  • communications data, including information contained in emails, meeting records, enquiries and correspondence;
  • marketing preferences, consents, unsubscribe records and related information;
  • information about reports, whitepapers, webinars, events or other content you request or access;
  • website usage information and analytics data; and
  • any other information you choose to provide to us.
    • How do we obtain your personal information?

We typically collect this information directly from you. We may also collect it from:

  • other individuals within your organisation;
  • other GBST group entities;
  • publicly available sources, such as company websites and professional directories;
  • events, webinars, meetings and demonstrations;
  • website forms, preference centres and subscription pages; and
  • cookies, tracking and similar technologies used on our website.
    • For what purpose do we use your personal information?
Purpose for processing your personal information Lawful basis
(where UK data protection laws apply)
Providing and managing our products, services and customer relationships, including account management, support, communications and business administration. Performance of a contract, where applicable. Legitimate interests in operating and managing our business and customer relationships.
Responding to enquiries and providing requested information and content. Legitimate interests. Consent, where required.
Sales, marketing, customer engagement, business development activities and personalising our services and communications. Legitimate interests. Consent, where required.
Compliance, regulatory, legal and risk management activities, including responding to lawful requests and defending legal claims. Legal obligation and legitimate interests.
Corporate transactions and business restructuring activities. Legitimate interests.

 

  • Who do we share your personal information with?

We may disclose your personal information to:

  • other GBST group entities;
  • representatives within your organisation;
  • service providers supporting our business operations;
  • professional advisers;
  • regulators, courts and law enforcement bodies;
  • parties involved in a corporate transaction; and
  • others where required or authorised by law.

2.2 Suppliers, Service Providers and Business Partner Contacts

  • What personal information do we collect?

We may collect:

  • name and business contact details;
  • employer, role and job title;
  • communications and correspondence;
  • account and relationship management information;
  • marketing preferences and consent records;
  • information relating to events, webinars, reports, whitepapers and other content you request;
  • website usage information, cookies, tracking and analytics data; and
  • other information you choose to provide.
    • How do we obtain your personal information?

We typically collect this information directly from you. We may also collect it from:

  • from your organisation;
  • from referrals;
  • from publicly available sources;
  • through procurement processes; and
  • from other GBST group entities.
    • For what purpose do we use your personal information?
Purpose for processing your personal information Lawful basis

(where UK data protection laws apply)
Supplier onboarding, procurement, due diligence and supplier relationship management. Contract and legitimate interests.
Billing, payment administration and management of business relationships. Contract, legal obligation and legitimate interests.
Communications regarding products and services provided to GBST. Contract and legitimate interests.
Compliance, legal, audit and risk management activities. Legal obligation and legitimate interests.
Corporate transactions and business restructuring activities. Legitimate interests.

 

  • Who do we share your personal information with?

We may disclose your personal information to:

  • other GBST group entities;
  • service providers supporting procurement and supplier management;
  • professional advisers;
  • screening providers where appropriate;
  • regulators and government authorities; and
  • parties involved in corporate transactions.

2.3 Website Users, Subscribers and Content Recipients

  • What personal information do we collect?

We may collect:

  • name and business contact details;
  • employer and professional details;
  • information submitted through website forms;
  • newsletter and communication preferences;
  • event registration information;
  • records of downloads, subscriptions and interactions;
  • analytics and website usage information; and
  • cookie-related information.
    • How do we obtain your personal information?

We typically collect this information directly from you. We may also collect it from:

  • website forms, registrations, subscriptions, event registrations and content requests;
  • cookies and analytics technologies; and
  • approved business contact sources where permitted by law.
    • For what purpose do we use your personal information?
Purpose for processing your personal information Lawful basis

(where UK data protection laws apply)
Providing and managing access to our website and online resources. Legitimate interests.
Personalising and improving website functionality, user experience and communications. Legitimate interests and consent where required.
Responding to enquiries and requests. Legitimate interests.
Providing reports, whitepapers, webinars, event registrations, newsletters and other requested content. Legitimate interests and consent where required.
Managing subscriptions, communication preferences and consent records. Consent and legitimate interests.
Sending newsletters, updates and other communications you have subscribed to, requested or agreed to receive. Consent or legitimate interests, depending on the communication and applicable law.
Sales, marketing and business development follow-up activities. Legitimate interests.
Website analytics, performance monitoring and security. Consent where required and legitimate interests where permitted by law.
Compliance, legal and risk management activities. Legal obligation and legitimate interests.

 

  • Who do we share your personal information with?

We may disclose your personal information to:

  • other GBST group entities;
  • website, hosting and cloud providers;
  • analytics, marketing technology and communications providers;
  • webinar and event providers;
  • professional advisers;
  • regulators and government authorities; and
  • parties involved in corporate transactions.

2.4 Job Applicants, Prospective Contractors and Recruitment Candidates

Your personal information is processed in accordance with our Recruitment Privacy Notice, which is available on our recruitment site.

3. Marketing, newsletters and business development communications

We may use your personal information to send you information about GBST products, services, events, updates, reports, whitepapers, publications or industry developments that may be of interest to you.

This may include:

  • sending newsletters, updates and other communications you have subscribed to, requested or agreed to receive;
  • managing your subscriptions and communication preferences;
  • providing reports, whitepapers and other content you have requested;
  • inviting you to events, webinars and demonstrations;
  • contacting you about content, products or services that may be relevant to you or your organisation;
  • undertaking related sales and business development follow-up activities; and
  • maintaining records of your communication preferences and consent status.

We will only send marketing communications where permitted by applicable law. Where required, we will obtain your consent before sending electronic marketing communications or before using or disclosing your personal information for direct marketing purposes. You can opt out of receiving marketing communications at any time by using the unsubscribe link in our emails or by contacting us using the details in section 11. Even if you opt out of marketing communications, we may still send you important operational, administrative, service-related or legal communications.

4. International Transfers

GBST operates globally. We may transfer personal information between GBST group entities and to service providers located in different countries, including Australia, the United Kingdom, Vietnam and other jurisdictions where GBST or its service providers operate.

Where required by applicable law, we implement appropriate safeguards for international transfers of personal information. These may include intra-group agreements, contractual safeguards, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, standard contractual clauses or other lawful transfer mechanisms.

We take reasonable steps to ensure that personal information transferred internationally is protected in accordance with applicable privacy and data protection laws.

For more information about the safeguards we use for international transfers of your personal information, please contact privacyofficer@gbst.com.

5. Security and Storage

We store personal information in systems, databases and records operated by us or by our service providers.

We take reasonable technical and organisational measures to protect personal information from misuse, interference, loss, unauthorised access, modification or disclosure.

These measures may include access controls, security policies, confidentiality obligations, monitoring, incident response processes and other information security measures appropriate to the nature of the information we hold.

However, no method of transmitting or storing information electronically is completely secure. You should take care when sending information to us electronically.

6. Retention

We retain personal information for as long as reasonably necessary to fulfil the purposes described in this Privacy Policy, including to provide products and services, provide requested content, manage subscriptions and preferences, manage business relationships, comply with legal and regulatory obligations, resolve disputes, maintain records and protect our legal rights.

The retention period will depend on the type of personal information, the purpose for which it is held, our legitimate business needs and any applicable legal, regulatory, contractual, accounting, reporting or record-keeping requirements. Unless a longer retention period is required or permitted by law, we will generally retain personal information for the applicable limitation period plus one (1) year, to allow reasonable time for review and deletion or anonymisation. In most cases, this will be seven (7) years after our relationship with you ends.

When personal information is no longer required, we take reasonable steps to delete, destroy or anonymise it, subject to applicable legal and operational requirements.

For more information about retention periods, please contact privacyofficer@gbst.com.

7. Automated Decision Making

We do not currently use personal information to make automated decisions that are regulated under applicable data protection laws, including decisions based solely on automated processing that produce legal or similarly significant effects on individuals, or decisions that are reasonably likely to significantly affect an individual’s rights or interests. If this changes, we will update this Privacy Policy and provide additional information where required by applicable law.

8. Cookies and website analytics

Our website may use cookies and similar technologies such as pixels or other tracking technologies. Cookies are small text files placed on your device when you visit a website. We may use cookies and similar technologies to:

  • provide and manage website access;
  • operate and maintain our website;
  • improve website functionality;
  • personalise and tailor your website experience;
  • remember preferences;
  • analyse website usage;
  • improve website performance;
  • support website security;
  • provide requested website functionality;
  • understand how visitors use our website and online resources; and
  • support marketing, sales and business development activities where permitted by law.

Some cookies are placed directly by us. Others may be placed by third party providers, including analytics, media or marketing technology providers. For more information, please see our Cookies Policy at:

9. Your privacy rights

Depending on where you are located and the laws that apply to your personal information, you may have rights to:

  • request access to a copy of personal information we hold about you and certain details of how we use it;
  • request correction of inaccurate, incomplete, out-of-date, irrelevant or misleading personal information;
  • request deletion or erasure of your personal information in certain circumstances;
  • request restriction of processing in certain circumstances;
  • object to processing in certain circumstances;
  • object to direct marketing;
  • withdraw consent, where we rely on consent;
  • request portability of certain personal information in certain circumstances;
  • request information about safeguards used for international transfers; and
  • make a complaint to us or to a privacy or data protection regulator.

These rights are subject to applicable legal limitations and exceptions. We may need to verify your identity before responding to a request.

If Australian privacy laws apply, you may request access to personal information we hold about you or ask us to correct personal information that is inaccurate, out of date, incomplete, irrelevant or misleading. We generally aim to respond to access and correction requests within 30 days. If we refuse to provide access or make a correction, we will provide written reasons where required by law.

If UK data protection laws apply, you may also have specific rights under the UK GDPR, including rights of access, rectification, erasure, restriction, portability, objection, withdrawal of consent, rights relating to automated decision-making, and the right to complain to the Information Commissioner’s Office. We aim to respond to UK rights requests within one month, although we may extend this period where permitted by law, for example if a request is complex.

If Vietnamese personal data protection laws apply, you may have rights in relation to your personal information, including rights to be informed, to access, receive a copy of your personal information, correct, delete, restrict or object to processing, withdraw consent, and make a complaint in accordance with applicable law. You may exercise your rights by contacting our Privacy Officer and completing our Vietnam Data Subject Request Form, which is available on request. We will respond to and handle your request within the timeframes required by Vietnamese law, as set out in that form.

You may also ask us to delete or de-identify your personal information. We will consider such requests in accordance with applicable law and our legal, regulatory, contractual, record-keeping and operational requirements.

To exercise your rights, please contact our Privacy Officer using the details in section 11.

10. Anonymity and Pseudonymity

Where lawful and practicable, you may interact with us anonymously or using a pseudonym. However, in some circumstances we may need to identify you to provide products, services or information, manage a business relationship or comply with legal obligations.

11. Contacting us

If you have any questions about this Privacy Policy, wish to exercise your privacy rights or would like to make a complaint, please contact:

Privacy Officer
Email: privacyofficer@gbst.com

Australia
GBST Holdings Ltd
Level 5, 55 Market Street
Sydney NSW 2000
Australia		 United Kingdom
GBST UK Holdings Ltd 1 Old Street Yard
London EC1Y 8AF
England		 Vietnam

GBST Vietnam Limited Liability Company

Unit 6.8 and 6.9, Level 6, e.town 1 Building, 364 Cong Hoa Str., Tan Binh Ward,

Ho Chi Minh City

Vietnam

 

12. Complaints

If you believe that we have not handled your personal information in accordance with this Privacy Policy or applicable privacy laws, you may make a complaint by contacting our Privacy Officer.

We will investigate your complaint and respond within a reasonable timeframe and where relevant in accordance with time frames required under applicable law. We may ask you to provide further information so that we can assess and respond to your complaint.

If you are not satisfied with our response, you may have the right to complain to a privacy or data protection regulator.

If you are in Australia, you may contact the Office of the Australian Information Commissioner:

Office of the Australian Information Commissioner
Website: www.oaic.gov.au
Phone: 1300 363 992 within Australia
Phone: +61 2 9942 4099 outside Australia
Mail: GPO Box 5288, Sydney NSW 2001

If you are in the United Kingdom, you may contact the Information Commissioner’s Office:

Information Commissioner’s Office
Website: ico.org.uk
Phone: 0303 123 1113

13. Third party websites

Our website may contain links to third party websites or services. We are not responsible for the privacy practices, content or security of websites, services or platforms that are operated independently by third parties.

We recommend that you review the privacy policies of any third party websites or services before providing personal information to them.

14. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. Any updated version will be published on our website and will take effect from the date of publication.

We encourage you to review this Privacy Policy periodically to stay informed about how we handle personal information.