Whistleblower Protection Policy

Endorsed by: Workforce Technologies Pty Ltd Board of Directors

Date: September 2025

1. Purpose of this policy

The Workforce Technologies Pty Ltd and its subsidiaries is committed to upholding the highest standards of integrity, fairness and ethical conduct.

Employees and others working closely with MyGig will often be the best source of information when things are not quite right. This Whistleblower Protection Policy is an important element in detecting corrupt, illegal or other undesirable conduct at MyGig.

Creating a supportive environment where people feel safe to speak up underpins MyGig's culture. When people do not speak up, this undermines the culture and exposes MyGig to risks. The MyGig Board and Executive encourage speaking up about concerns of wrongdoing at MyGig. There are various measures in place to ensure no one is discouraged from speaking up or disadvantaged or victimised for doing so.

The purpose of this Policy is to:

• explain how to speak up by reporting concerns about wrongdoing;
• outline what protections a person who reports wrongdoing will receive; and
• outline MyGig's processes for dealing with reports of wrongdoing.

2. Raising concerns at MyGig

There are a number of ways to raise concerns at MyGig, depending on the circumstances and the seriousness of the issue.

2.1. Speaking to peers or manager

Often day to day issues can be resolved between employees through open and authentic conversation, as part of normal team dynamics. Employees can escalate to their manager if they are concerned about an issue or want support to resolve an issue. MyGig encourages employees to continue to feel empowered to raise issues in this way.

2.2. Raising personal work-related grievances via People & Culture

Grievances which cannot be resolved through speaking with peers or the employee’s manager should be raised with People & Culture using the formal grievance resolution channel which are set out below:

Personal work related grievances are not within the scope of this Policy or the whistleblower channel and will be addressed through the grievance resolution process set out above.

Personal work-related grievances relate to an employee’s current or former employment and tend to have implications for them personally. Examples include:

• an interpersonal conflict between the employee and another employee;
• a concern about the behaviour of an employee;
• a decision relating to an employee’s engagement, transfer or promotion;
• an employee’s terms and conditions of employment;
• matters relating to an employee’s performance or discipline - related decisions; or
• a decision relating to the termination of employment.

2.3. Speaking up about potential wrongdoing under this Policy

There may be times when an employee is not comfortable raising concerns about a wrongdoing with their manager or with People & Culture and a formal report should be raised under this Policy through the whistleblower channel. This is available to employees and others with reasonable grounds to suspect wrongdoing in relation to MyGig. Reporting suspected wrongdoing through the whistleblower channel will enable MyGig to protect those who report from victimisation or detriment as a result of making a report. These highlighted concepts are explained in the sections below.

3. Who may make a report

Anyone with information about potential wrongdoing relating to MyGig is encouraged to report their concerns under this Policy.

This includes individuals who are or have been in relation to MyGig:

• an employee, officer or contractor;
• a supplier of services or goods to MyGig (whether paid or unpaid) including their employees; and
• a relative, dependant or spouse of any of the above individuals.

4. What to report

Any concerns of wrongdoing should be reported. This means any misconduct or improper state of affairs or circumstances in relation to MyGig.

Examples of wrongdoing may include:

• breach of laws or regulations;
• criminal activity including theft;
• serious breach of MyGig's Code of Conduct or Policies;
• offering or accepting a bribe;
• dishonest or unethical behaviour;
• conflicts of interest;
• anti-competitive behaviour;
• financial fraud or mismanagement including in relation to MyGig's tax affairs;
• falsifying financial or corporate reporting;
• insider trading;
• unauthorised use of MyGig's confidential information;
• improper use of Personal Information as described in any MyGig Privacy Policy;
• improper use of MyGig's physical or intellectual property;
• conduct endangering health and safety or causing damage to the environment; and
• deliberate concealment of any of the above.

Wrongdoing does not generally include personal-work related grievances. As described in section 2.2 and Annexure A, these should be raised with People & Culture using the formal grievance resolution channel. If a grievance may have significant wider implications for MyGig, this can be reported through the whistleblower channel applicable to MyGig.

There is an expectation that anyone reporting a wrongdoing has reasonable grounds to suspect the information they are disclosing is true, but there will be no penalty if the information turns out to be incorrect. Those reporting are expected to provide the information upon which their suspicion is based, but are not required to have all the details or have conducted their own investigation.

False or misleading reports

Any false reports made, where the person reporting is intentionally misleading or knows the information is not true, will be considered a serious matter that could result in disciplinary action including potential termination of employment. The protections under this Policy or the applicable law in Australia will not be available for deliberate false reporting.

5. How to make a report

Reports should be made through the whistleblower channel via the following nominated email: compliance@mygig.com.au (MyGig COO and Head of Legal will receive a copy of a report that is sent to the nominated email).

Those reporting should provide as much information as possible, including details of the wrongdoing, people involved, dates, locations and other related information. Under Australian law in Australia, concerns can also be reported in person to one of the following “eligible recipients”:

• Any other member of MyGig Executive Team (CEO, COO, Director of ANZ Marketplace and Operations);
• MyGig Head of Legal;
• A member of MyGig's Board;
• Any other eligible recipient listed in Annexure A

Reporting anonymously

Those not wanting to reveal their identity can make an anonymous report. However, providing the reporter’s name when reporting wrongdoing will make it easier for MyGig to investigate the concern raised. For example the context in which wrongdoing was observed is likely to be useful information. Employees and others who report wrongdoing are protected by MyGig including maintaining confidentiality of the reports and the identity of the reporter. The law in Australia contains additional whistleblower protections, which are summarised in Annexure A. Accordingly, anyone reporting should feel confident that their identity will remain confidential.

Where no name is provided, MyGig will assess the disclosure in the same way as if identity had been revealed, and any investigation will be conducted as best as possible in the circumstances. However, an investigation might not be possible unless sufficient information is provided.

6. MyGig's commitment to those who report wrongdoing

MyGig is committed to protecting and supporting people who report a potential wrongdoing under this Policy. This includes:

• protection of the identity of a reporter;
• making sure that those who report do not suffer detriment as a result of speaking up; and
• offering those who report appropriate protections based on their circumstances, the nature of the potential wrongdoing and the people involved.

Protecting a reporter’s identity

When reporting wrongdoing, the reporter’s identity and any information that MyGig has as a result of the report that is likely to lead to identification, will only be disclosed if:

• the person reporting gives consent for MyGig to disclose that information;
• MyGig considers such disclosure should be made to:

— Australian Securities & Investments Commission (ASIC), the Australian Federal Police or (for tax-related reports) the Commissioner of Taxation;

— a Commonwealth authority or a State or Territory authority for the purpose of assisting the authority perform its functions or duties;

— a lawyer for legal advice or representation in relation to whistleblower laws; or

• in the case of information likely to identify the person reporting, it is reasonably necessary to disclose the information for the purposes of an investigation, and all reasonable steps are taken to prevent someone from discovering the reporter’s identity.

Preventing victimisation and detriment to whistleblowers

MyGig will not tolerate any detrimental conduct against anyone on the basis of reporting or being suspected of reporting a wrongdoing, including conduct against that person’s colleagues, employer (if a contractor) or relatives.

Examples of detrimental conduct include the following:

• discrimination, detriment or damage to a person's reputation;
• harassment, intimidation or retaliation;
• a demotion or dismissal; or
• threats of any of the above, including implied threats.

Any person involved in detrimental conduct may be subject to disciplinary action including termination of employment or engagement. MyGig has the right to refer any person that has engaged in detrimental conduct to law enforcement authorities for further investigation.

Protecting reporters from detriment

The measures provided to protect those who report will depend on the risks present, based on the nature of the wrongdoing and people involved. Protections may include the following, at MyGig's discretion:

• assigning a whistleblower support officer as a confidential contact to discuss any concerns following the making of the report;
• monitoring and managing the behaviour of other employees;
• relocating employees (which may include the people alleged to have been involved in the wrongdoing) to a different team or location or revising the reporting lines of employees;
• offering a leave of absence or arranging flexible working while a matter is investigated;
• providing support through the Employee Assistance Program; and
• rectifying any detriment that has been suffered.

7. Investigations

MyGig takes all reports of potential wrongdoing seriously. All reports will be assessed and, based on the nature and circumstances of the disclosure, a decision made as to whether an investigation is required. For example, reports of potential wrongdoing of a minor nature that can be resolved informally will typically not require the same level of response as disclosures involving a large-scale and complex investigation.

Any investigation will be conducted in a timely, fair and objective manner, and independent from any persons to whom the report relates. Investigations will generally be overseen by the Head of Legal. Other people, including employees (for example, Head of People & Culture and Head of relevant departments/ teams) or external advisors, may also be asked to assist or run the investigation.

Where possible, the person reporting the wrongdoing will be informed how MyGig is responding to their report, including whether an investigation will be conducted.

8. Fair treatment of persons involved

Unless there are confidentiality or other reasons not to do so, employees who are the subject of a report of wrongdoing will be informed of the matters raised in the report at an appropriate time, and will be given a chance to respond to any allegations made against them. They will also be advised of the outcome of any investigation.

9. Internal reporting

The MyGig Board will receive a summary of reports made under this Policy at least quarterly. The summary will not identify individual reporters.

10. Availability of this Policy and training

MyGig will endeavour to ensure that employees (including new employees) have access to and are informed about this Policy. A copy of this Policy will also be available on MyGig Confluence (intranet).

Training will also be provided to individuals who may receive whistleblowing reports or otherwise have a role under this Policy.

11. Review of this Policy

MyGig's whistleblower protections and this Policy will be reviewed every two years. In particular, within the constraints of confidentiality and any other legal restrictions, the review will consider the fairness of the investigations undertaken, any consequences for people who have reported wrongdoing and compliance with this Policy generally. The review will consider whether the Policy is operating effectively and whether any changes are required.

12. Relationship to other policies

This Policy should be read in conjunction with the following Policies:

• Code of Conduct as applies to the business;
• Anti-Bribery and Anti- Corruption Policy; and
• Grievances Resolution Policy

13. Questions

Any questions about this Policy can be referred to MyGig Head of Legal.

Annexure A: Legal protections provided to whistleblowers in Australia

1. When legislative protections may apply

The law in Australia protects certain persons (including current and former employees and suppliers, as well as their relatives and dependants, and associates of MyGig) who make a disclosure qualifying for protection ("protected disclosure") to certain people.

MyGig encourages reporting of concerns of wrongdoing under section 5 of this Policy. The law in Australia offers the same protections if making a protected disclosure to certain other persons in some cases. Details of those persons to whom a protected disclosure can be made are set out below in section 2 to this annexure.

Protections and remedies available to those who make a protected disclosure are set out in section 3 to this Annexure. A protected disclosure that does not follow the Policy, will still attract the legal protections under applicable Australian law.

MyGig Legal Team can provide more information about the protections or remedies available under the law in Australia.

2. Protected disclosures

To be a “protected disclosure” information must relate to “disclosable matters” and be made to “eligible” persons or organisations. Examples of the type of information and eligible recipients are outlined in the following table:

A "personal work-related grievance" is not a protected disclosure, except if, in summary:

• it concerns detriment to a discloser because they have made, are suspected of making or could make a report of wrongdoing; or
• it is made to a legal practitioner for the purposes of obtaining legal advice or legal representation in relation to the operation of the law about whistleblowers.

A complaint is not a “personal work-related grievance’” and would be a protected disclosure if it:

• has significant implications for an entity regulated under the law (e.g. MyGig) that do not relate to the discloser;
• concerns conduct, or alleged conduct, in contravention of specified corporate and financial services laws, or that constitutes an offence punishable by 12 months or more imprisonment under any other Commonwealth laws;
• concerns conduct that represents a danger to the public or financial system; or
• concerns conduct prescribed by the regulations.

The law also protects certain disclosures made in "emergency" and "public interest" situations, in which case disclosures can be made to additional recipients. MyGig Legal Team can provide more information about emergency and public interest disclosures.

3. Specific protections and remedies

The Australian law provides protections if a “protected disclosure” is made, including that:

1. the discloser is not subject to any civil, criminal or administrative liability for making the disclosure (other than for making a false disclosure);
2. no contractual or other remedy may be enforced or exercised against the discloser the basis of the disclosure; and
3. in some limited circumstances (e.g. if the disclosure has been made to a regulator such as ASIC), the information provided may not be admissible in evidence against a discloser in criminal proceedings or in proceedings for the imposition of a penalty, other than proceedings in respect of the falsity of the information.

Except as provided in paragraph (c) above, the protections under Australian law do not grant immunity for any misconduct a discloser has engaged in that is revealed in their disclosure.

Compensation and other remedies may also be available through the courts for loss, damage or injury suffered because of a disclosure or if MyGig failed to take reasonable precautions and exercise due diligence to prevent detrimental conduct.