Whistleblower Policy

The following persons are eligible whistleblowers under this policy and the Corporations Act:

• Current employees and officers of RedRock Systems
• Former employees and officers
• Contractors and their employees providing services to RedRock Systems
• Suppliers and their employees
• Associates of RedRock Systems
• Relatives, dependants, or spouses of any of the above

You do not need to be directly harmed by the conduct you are reporting. You may report concerns on behalf of others, or concerns about general corporate conduct.

A qualifying disclosure is one made by an eligible whistleblower with reasonable grounds to believe that the information concerns:

• Misconduct, or an improper state of affairs or circumstances, in relation to RedRock Systems or a related body corporate
• A contravention of the Corporations Act 2001, the Australian Securities and Investments Commission Act 2001, or any other Commonwealth law
• Conduct that represents a danger to the health or safety of one or more persons
• Conduct that constitutes an offence against Commonwealth law punishable by 12 months imprisonment or more
• Conduct that may cause financial loss to the company or damage to its reputation

Personal work-related grievances (such as interpersonal disputes or decisions about your role or remuneration) are not qualifying disclosures under the Corporations Act, though RedRock Systems encourages direct communication about such matters through normal channels.

You may make a disclosure through the following channels:

Eligible whistleblowers who make a qualifying disclosure are protected under the Corporations Act. These protections include:

• Identity protection: RedRock Systems will not disclose your identity without your consent, except as required by law
• Protection from detriment: RedRock Systems must not take, threaten, or cause detriment against you because of your disclosure. Detriment includes dismissal, demotion, harassment, damage to reputation, or any other adverse action
• Legal immunity: your disclosure itself is immune from civil and criminal action, including breach of confidentiality. This does not protect you from liability for your own conduct in the matters disclosed
• Civil liability protection: if you are sued for making the disclosure, RedRock Systems will take reasonable steps to ensure you are not disadvantaged by the litigation

When a qualifying disclosure is received, RedRock Systems will:

• Acknowledge receipt within 2 business days and confirm that your disclosure is being treated confidentially
• Assess the disclosure within 7 days to determine whether it warrants formal investigation
• Investigate promptly and thoroughly, maintaining confidentiality throughout
• Keep you reasonably informed of the progress and outcome of the investigation, to the extent that doing so does not compromise confidentiality or other persons' rights
• Take appropriate remedial action where a disclosure is substantiated
• Maintain records of all disclosures and investigations in a secure, confidential format

If a disclosure relates to conduct by the company director, you are encouraged to make an external disclosure directly to the relevant regulator (see Section 3).