1. Introduction

This Privacy Policy describes how  Next Chapter Music Pty Ltd(ABN 90 675 443 866) ("Musos Corner", "we", "us", "our") collects, uses, discloses, and manages your personal information. We operate the website www.musoscorner.com.au and related services, including in-store retail at our Charlestown and Sydney CBD (The Guitar Lounge) locations.

Musos Corner sells and delivers products exclusively within Australia. This policy applies to all customer interactions with us, whether in-store, by phone, or via our website.

We are bound by the Privacy Act 1988 (Cth) ("Privacy Act"), as amended by the Privacy and Other Legislation Amendment Act 2024, and the thirteen Australian Privacy Principles ("APPs") contained in that Act. This policy explains how we comply with those obligations.

If you have any questions about this policy or wish to make a privacy-related request or complaint, please contact us at:

Privacy Officer
Musos Corner Pty Ltd
Email: privacy@musoscorner.com.au
Phone: 1300 687 672
Postal address: 252 Pacific Hwy, Charlestown NSW 2290, Australia

2. Personal Information We Collect

"Personal information" means information or an opinion about an identified individual, or an individual who is reasonably identifiable. We collect personal information that is necessary for our functions and activities as a retail business.

2.1 Information you provide to us

When you purchase from us, create an account, contact us, or use our services, you may provide:

• full name and contact details (email address, phone number, mailing and delivery address)
• payment information (credit or debit card details, which are processed securely through our payment gateway provider - we do not store full card numbers)
• username and password for your Musos Corner account
• order history and transaction records
• communications you send us (enquiries, support requests, feedback, complaints)
• trade-in information, including proof of identity and ownership documentation, where you trade in an item as part of a purchase (handled in accordance with our Website Terms and Conditions of Sale and our obligations as a licensed second-hand goods dealer in New South Wales)
• luthier work details, including details of instruments you ask us to service, your contact details for collection and notification, and any historical service records you provide
• marketing preferences and opt-in or opt-out status for email or SMS communications

2.2 Information collected automatically

When you visit our website, we may automatically collect:

• IP address and general location data derived from your IP address
• browser type, version, and operating system
• pages visited, time spent on site, and referring URLs
• shopping cart and browsing behaviour, including abandoned cart contents
• cookie and device identifiers (see Section 8)

2.3 Information collected when you contact us by phone or in store

When you call our customer service line, attend one of our stores, or attend an in-store event, we may collect:

• the content of your communication, including any details necessary to address your enquiry
• a recording of your phone call where call recording is in operation - you will be informed of call recording at the start of the call where it applies
• CCTV footage of your visit to our retail premises, recorded for safety and security purposes in accordance with our in-store privacy notices

2.4 Sensitive information

Under the Privacy Act, "sensitive information" has a specific meaning and includes information about racial or ethnic origin, political opinions or memberships, religious or philosophical beliefs, trade union or professional memberships, sexual orientation or practices, criminal records, health or genetic information, and biometric information.

We do not intentionally collect sensitive information in the ordinary course of our business. If you provide such information incidentally (for example, in a support message), we will handle it in accordance with the stricter requirements of APP 3 and will not use it for any purpose beyond resolving your enquiry.

3. How We Collect Personal Information

We collect personal information in the following ways:

• directly from you when you place an order, create an account, subscribe to our mailing list, complete a form, contact us, attend our stores, or transact with us in any other way
• automatically through your use of our website, via cookies, analytics tools, and server logs (see Section 8)
• from third parties such as payment processors, freight and logistics providers, marketing platform providers, and identity verification providers, where relevant to fulfilling your order or enquiry
• from publicly available sources, where you have actively made information public (for example, public business directories or social media public profiles) and only where it is reasonably necessary for our business activities

Where it is lawful and practicable to do so, you may interact with us anonymously or by using a pseudonym (for example, when browsing our website without registering). However, to complete a purchase or access account features, we require certain personal information.

4. Why We Collect and How We Use Your Personal Information

We collect and use personal information for the following purposes:

• processing, fulfilling, and delivering your orders, including communicating with delivery and freight providers
• managing your customer account and authenticating you when you log in
• responding to enquiries, complaints, and support requests across phone, email, in-store, and online channels
• sending transactional communications including order confirmations, shipping notifications, payment receipts, and password resets
• sending marketing communications by email or SMS, where you have consented or where permitted by law, including promotional information about our products, in-store events, artist performances, and offers (see Section 7)
• sending abandoned cart reminder messages by email or SMS where you have provided the relevant contact details and have not opted out
• processing and recording trade-in transactions in accordance with our obligations as a licensed second-hand goods dealer in New South Wales
• providing luthier and repair services and contacting you about the progress, completion, and collection of work on your instrument
• improving our products, services, and website through analytics
• conducting interest-based advertising and remarketing across digital advertising platforms (see Section 8)
• complying with our legal obligations, including under consumer law, taxation law, fraud prevention, and the Pawnbrokers and Second-hand Dealers Act 1996 (NSW)
• protecting our business interests, including investigating suspected fraud, unauthorised access, abuse of our services, or breaches of our terms

We will only use your personal information for the purpose for which it was collected, or a directly related purpose that you would reasonably expect. If we wish to use your information for a new or unrelated purpose, we will seek your consent or notify you in advance.

5. Automated Decision-Making

We use computer programs that make decisions or substantially assist in making decisions affecting customers. We choose to disclose the following, in line with the transparency obligations commencing 10 December 2026 under the Privacy and Other Legislation Amendment Act 2024. The following categories of automated decision-making apply to your personal information when you interact with us:

• fraud and risk scoring at checkout, performed by our payment gateway and fraud prevention providers to detect potentially fraudulent transactions
• marketing automation and lifecycle segmentation through our customer messaging platform (Klaviyo), which assigns customers to segments based on browsing, purchase, and engagement history for the purpose of targeted marketing communications
• product recommendations and personalisation on our website, which use your browsing and purchase history to suggest items that may be of interest

These automated processes do not make final decisions about access to substantive services or about your rights as a customer. Significant customer service decisions, returns, refunds, trade-in valuations, credit decisions, and dispute outcomes are made by Musos Corner team members.

If you have questions about any automated process described above, or you wish to understand how it has applied to you, please contact our Privacy Officer at privacy@musoscorner.com.au.

6. Disclosure of Your Personal Information

6.1 Service providers and subprocessors

We disclose your personal information to third-party service providers who assist us in running our business. These providers fall into the following categories:

• ecommerce platform and website hosting providers
• inventory and order management providers
• payment gateway and fraud prevention providers
• freight, courier, and logistics companies for order delivery
• email and SMS marketing platform providers
• customer support, communication, and AI tool providers
• analytics and advertising technology providers
• IT, hosting, infrastructure, and security providers
• professional advisers including accountants, auditors, and legal advisers

A list of the specific subprocessors we currently engage, the type of personal information they handle, and the country in which they are based, is available on request by contacting our Privacy Officer at privacy@musoscorner.com.au. We update our subprocessor arrangements from time to time as part of normal business operations.

We take reasonable contractual steps to ensure all service providers are bound by confidentiality and privacy obligations consistent with the Privacy Act and the APPs.

6.2 Overseas disclosure

While Musos Corner sells and delivers exclusively within Australia, some of our service providers are based in, or store data in, countries outside Australia for the purposes of providing those services to us. The countries in which our subprocessors are or may be located include the United States, Canada, New Zealand, the United Kingdom, and member states of the European Union.

When we disclose personal information to overseas recipients, we take reasonable steps to ensure that the recipient does not breach the APPs. These steps include entering into contractual arrangements that require the overseas recipient to handle your information in a manner consistent with Australian privacy law, and selecting providers that operate to recognised international privacy frameworks.

By using our website and services, you acknowledge that we may transfer your personal information to overseas recipients as described above.

6.3 Other disclosures

We may also disclose personal information:

• where required or authorised by law, including in response to lawful requests from government agencies, courts, or law enforcement bodies
• to protect the rights, property, or safety of Musos Corner, our customers, our team, or others, including in cases of suspected fraud, theft, or unlawful conduct
• in connection with a sale, merger, or acquisition of our business, in which case the buyer will be bound to comply with this policy or seek your fresh consent

We do not sell your personal information to third parties.

7. Marketing Communications

With your consent, or as otherwise permitted under the Spam Act 2003 (Cth) and the Privacy Act, we may send you commercial electronic messages by email or SMS about promotions, new products, in-store events, artist performances, and other Musos Corner updates.

Under APP 7 of the Privacy Act, you have the right to request that we do not use or disclose your personal information for direct marketing, without giving any reason. You can exercise this right at any time by:

• clicking the "unsubscribe" link in any marketing email we send you
• replying STOP to any marketing SMS
• updating your communication preferences in your Musos Corner account
• contacting us at privacy@musoscorner.com.au

You also have the right to request the source from which we obtained your personal information for direct marketing purposes. We will respond to source requests within a reasonable time, ordinarily within 30 days, and will not charge you for doing so.

Opt-out requests usually take effect within 24 hours, and no more than 5 business days. Even if you unsubscribe from marketing communications, we will continue to send you transactional and service-related messages that are necessary to fulfil your orders, manage your account, or comply with our legal obligations.

8. Cookies, Advertising, and Remarketing

8.1 Cookies and similar technologies

Our website uses cookies and similar technologies, including pixel tags, web beacons, and local storage. A cookie is a small text file stored on your device when you visit a website. We use cookies in the following categories:

• Strictly necessary cookies, which are required for the website to function, such as cookies that keep you logged in, maintain the contents of your shopping cart, and protect against fraud and security threats
• Preferences cookies, which remember your preferences and choices and allow us to provide enhanced features
• Analytics cookies, which allow us and our service providers to understand how visitors use our site so that we can improve performance, content, and the customer experience
• Marketing cookies, which are used by us and our advertising partners to deliver relevant advertising to you across the internet, measure the effectiveness of those advertisements, and limit the number of times you see them

8.2 Cookie consent

When you first visit our website you will be presented with a cookie consent notice. You may accept all categories, reject non-essential categories, or manage your preferences individually. You can change your preferences at any time through the cookie preferences link in the website footer.

[ACTION ITEM - confirm that the cookie consent banner is configured and live on the new Shopify site at go-live (18 May 2026), with the category options described above functioning correctly before publishing this policy.]

You can also manage or disable cookies through your browser settings. Disabling strictly necessary cookies may affect the functionality of certain parts of our website.

8.3 Analytics

We use Google Analytics to understand how visitors use our website. Google Analytics collects information including pages visited, time spent on the site, the website you came from, and similar technical information, and uses cookies and similar technologies to do so. You can opt out of Google Analytics by installing the Google Analytics opt-out browser add-on, available at tools.google.com/dlpage/gaoptout.

8.4 Advertising and remarketing

We advertise our products and services across digital platforms. We use, or may use, the following advertising platforms in connection with this:

• Google Ads, including Google's remarketing features, which allow us to show advertisements to people who have previously visited our website
• Meta advertising (Facebook and Instagram), including Meta Pixel and Custom Audiences
• TikTok advertising, including TikTok Pixel
• other audio, video, and digital advertising platforms from time to time

These platforms use cookies, pixels, and device identifiers to recognise visitors to our website and to show targeted advertising on their own platforms and across the wider internet. With your consent provided through our cookie preferences, we may also share customer identifiers (such as your email address or phone number) with these platforms in hashed form, using industry-standard one-way hashing (SHA-256), for the purposes of audience matching, measurement, and conversion attribution. This sharing occurs through server-side integrations including Meta's Conversions API, Google's Customer Match and Enhanced Conversions, and TikTok's Events API. We treat hashed identifiers as personal information governed by this policy, consistent with guidance issued by the Office of the Australian Information Commissioner. We do not share sensitive information (as defined in the Privacy Act) with advertising platforms. You can withdraw consent at any time via our cookie preferences or the platform opt-out methods set out below.

You can opt out of interest-based advertising at any time by:

• visiting Google's Ad Settings at adssettings.google.com
• managing your advertising preferences in your Facebook, Instagram, or TikTok account settings
• visiting the Digital Advertising Alliance opt-out page at youradchoices.com.au
• visiting the Network Advertising Initiative opt-out page at networkadvertising.org/choices
• using the privacy or tracking settings in your web browser or mobile device

8.5 Abandoned cart reminders

If you add items to your shopping cart and leave our website without completing the purchase, we may use the information you have provided (including your cart contents and the contact details associated with your visit) to send you a reminder by email and, where you have opted in, by SMS. Typically you will receive no more than two such reminders for any given cart.

Your opt-in to email or SMS marketing campaigns is not shared with any third party for unrelated purposes. We share your personal information, including your SMS opt-in status, with our messaging platform providers solely for the purpose of delivering these messages.

9. Data Quality, Security, and Data Breaches

We take reasonable steps to ensure that the personal information we hold is accurate, complete, and up to date. We encourage you to contact us if any of your details change.

We take reasonable steps to protect your personal information from misuse, interference, loss, and from unauthorised access, modification, or disclosure. These steps include:

• encryption of data transmitted through our website (Transport Layer Security)
• restricted access to personal information within our organisation on a need-to-know basis
• password protection and access controls on systems holding personal information
• multi-factor authentication on key systems
• contractual privacy and security obligations on third-party service providers
• ongoing training of our team on privacy and information security obligations

However, no method of electronic transmission or storage is completely secure. While we strive to protect your personal information, we cannot guarantee absolute security.

9.1 Notifiable Data Breaches scheme

Musos Corner is subject to the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act. If we experience a data breach involving personal information that is likely to result in serious harm to one or more individuals, and we cannot prevent that harm through remedial action, we will notify the affected individuals and the Office of the Australian Information Commissioner as soon as practicable, in accordance with our obligations under the scheme.

If you become aware of any actual or suspected security issue involving your personal information, or any actual or suspected data breach by Musos Corner, please contact us immediately at privacy@musoscorner.com.au.

10. Retention of Your Personal Information

We retain your personal information only for as long as is necessary for the purposes set out in this policy, or as required by law. The indicative retention periods we apply are as follows:

• transaction and order records: 7 years from the date of the transaction, to meet our taxation, accounting, and Australian Consumer Law record-keeping obligations
• trade-in transaction records: retained for 7 years from the date of the transaction, being the longer of the 3-year minimum under the Pawnbrokers and Second-hand Dealers Regulation 2021 (NSW) and our general 7-year transaction record retention period for taxation, accounting, and Australian Consumer Law purposes
• customer account information: retained while your account remains active, and for a reasonable period after your account becomes inactive or you request deletion, subject to any legal hold or unresolved transaction
• marketing data: retained until you withdraw consent or opt out, after which we will cease using your information for marketing and will remove your details from active marketing lists within a reasonable period
• abandoned cart data: retained for up to 90 days from the date of cart abandonment
• customer service communications: typically 2 to 3 years from the date of the communication
• CCTV footage: typically 30 days unless retained for a specific investigation or legal matter
• call recordings: typically 12 months from the date of the call, subject to longer retention for training, quality, or dispute resolution purposes

When personal information is no longer needed for any purpose described in this policy or required by law, we will take reasonable steps to destroy or de-identify it securely.

11. Children and Minors

Our website and services are not directed at children under the age of 16. We do not knowingly collect personal information from a child under 16 except where the child is a customer of standard retail goods and is purchasing those goods directly. In all such cases we encourage parents and guardians to be aware of and involved in their child's interaction with our website and services.

Where a person under 18 establishes a Musos Corner account or transacts with us, they confirm by doing so that they have the consent of a parent or guardian and that the parent or guardian agrees to be responsible for the transaction. We may at any time require evidence of that consent or decline to proceed.

Parents and guardians who become aware that their child under 16 has provided us with personal information without their consent may contact us at privacy@musoscorner.com.au to request review or deletion of that information.

The Office of the Australian Information Commissioner is developing a Children's Online Privacy Code, which is expected to be registered by December 2026. When the Code commences and applies to our services, we will update this policy and our practices accordingly.

12. Accessing and Correcting Your Personal Information

Under APP 12 and APP 13 of the Privacy Act, you have the right to:

• request access to the personal information we hold about you
• request that we correct personal information that is inaccurate, out of date, incomplete, irrelevant, or misleading

To make an access or correction request, please contact our Privacy Officer at privacy@musoscorner.com.au. We will respond to your request within a reasonable time, ordinarily within 30 days. We may ask you to verify your identity before granting access.

We will not charge a fee for making an access request, but may charge a reasonable fee for the cost of providing access (for example, where extensive collation is required), and where appropriate. We will notify you of any charges before fulfilling your request.

In limited circumstances, we may refuse access or correction where permitted by the Privacy Act, and will provide you with written reasons for any refusal.

13. Privacy Complaints

If you believe we have breached the Privacy Act or the APPs, or have otherwise mishandled your personal information, we encourage you to contact us first so we can attempt to resolve the matter.

To make a privacy complaint, please contact our Privacy Officer:

Email: privacy@musoscorner.com.au
Phone: 1300 687 672
Post: Privacy Officer, Musos Corner Pty Ltd, 252 Pacific Hwy, Charlestown NSW 2290, Australia

We will acknowledge your complaint within 5 business days and aim to provide a full response within 30 days. If we require additional time to investigate, we will keep you informed.

If you are not satisfied with our response, you have the right to lodge a complaint with the Office of the Australian Information Commissioner (OAIC):

Website: www.oaic.gov.au
Phone: 1300 363 992
Post: GPO Box 5288, Sydney NSW 2001

For complaints relating to unsolicited commercial messages (spam), you may also contact the Australian Communications and Media Authority (ACMA) at www.acma.gov.au.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes, we will update the "Last updated" date at the top of this policy and, where the changes significantly affect how we use your personal information, we will take reasonable steps to notify you (for example, by placing a prominent notice on our website or by sending you an email).

We encourage you to review this policy periodically. Your continued use of our website and services after any changes take effect constitutes your acceptance of the updated policy.

15. Contact Us

For any privacy-related questions, requests, or concerns, please contact:

Privacy Officer - Musos Corner Pty Ltd
Email: privacy@musoscorner.com.au
Phone: 1300 687 672
Postal address: 252 Pacific Hwy, Charlestown NSW 2290, Australia
Website: www.musoscorner.com.au