Mosa Cookie & Tracking Notice — Provisional review copy

Document Information

1. About This Notice

Mosa and Community.OS use digital technologies to provide, secure, understand and improve our websites and services.

Some of these technologies store information on your device or help us recognise information about your browser, device or interaction with Mosa.

They can include:

• cookies;

• local storage;

• session storage;

• authentication tokens;

• device or browser identifiers;

• analytics technologies;

• pixels;

• and similar technologies.

We refer to these collectively as tracking technologies in this Notice.

This Notice explains:

• the types of tracking technologies we use;

• why we use them;

• how we approach analytics;

• how we treat sensitive information;

• how we approach tracking involving children and young people;

• when third-party providers may be involved;

• and the choices available to you.

This Notice should be read together with our Mosa Privacy Policy and Privacy at Mosa.

2. Our Approach

Digital technologies help Mosa:

• work;

• stay secure;

• remember useful settings;

• identify errors;

• understand whether important journeys are working;

• and improve the experience for participants and Organisations.

But the fact that something can be tracked does not mean it should be tracked.

Our approach is simple:

Use tracking technology because it serves a legitimate purpose, not simply because it is available.

We aim to collect the information reasonably needed for that purpose without unnecessarily collecting the underlying personal information involved in somebody's participation.

We do not want tracking to become an invisible layer of unnecessary surveillance across Mosa.

3. Cookies and Similar Technologies

A cookie is a small piece of information that a website can store through your browser.

Cookies can help a service:

• keep you signed in;

• maintain a secure session;

• remember a preference;

• protect against malicious activity;

• remember a privacy choice;

• or understand how a website is being used.

Modern websites and applications also use technologies other than traditional cookies.

These can include browser storage, authentication tokens, pixels, device or browser identifiers and other technologies that perform similar functions.

Some last only for a session.

Others may remain for longer because they support a continuing function or preference.

Not every cookie or identifier identifies you directly. However, cookies and other online identifiers can sometimes form part of personal information, particularly when combined with other information.

4. What We Use These Technologies For

Mosa uses or may use tracking technologies for four main purposes:

Essential operation and security

To operate Mosa, authenticate Accounts, maintain sessions, protect the service and support requested functionality.

Preferences and functionality

To remember useful choices and make Mosa easier to use.

Analytics and product improvement

To understand performance, errors, important product journeys and how Mosa can be improved.

Public website and marketing measurement

To understand how people discover and use our public website and, where appropriate, whether our own marketing is effective.

These purposes are different.

A technology appropriate for one purpose is not automatically appropriate for another.

5. Essential and Security Technologies

Some technologies are necessary for Mosa or Community.OS to operate securely and provide the service you request.

They can support functions such as:

• authentication;

• keeping you signed in;

• session management;

• Account security;

• fraud or abuse prevention;

• security protections;

• service continuity;

• payment or transaction functionality;

• and remembering important privacy or security choices.

These technologies are part of operating the service rather than optional advertising or behavioural tracking.

Because they are necessary to provide or secure relevant functionality, it may not be possible to disable them while continuing to use that functionality.

Blocking or deleting essential browser storage may cause parts of Mosa to stop working correctly or require you to sign in again.

6. Preferences and Functionality

Mosa may store information that helps remember choices you have made.

Depending on the capabilities you use, this may include:

• interface preferences;

• accessibility preferences;

• language or regional settings;

• notification choices;

• dismissed notices;

• privacy choices;

• or other supported settings.

Remembering these choices can make Mosa easier to use and reduce the need to ask you for the same information repeatedly.

We do not treat a preference identifier as permission to use that identifier for unrelated advertising or tracking.

7. Analytics and Product Improvement

We use analytics to help understand whether Mosa is working well and where it can be improved.

This may help us understand things such as:

• which pages or capabilities are being used;

• whether important journeys are successfully completed;

• where people encounter errors;

• application and website performance;

• general browser or device characteristics;

• aggregate usage patterns;

• and how people move through particular product experiences.

For example, we may want to understand whether people successfully:

• create an Account;

• accept an invitation;

• complete onboarding;

• find an Opportunity;

• register to participate;

• create an activity;

• or complete another important Mosa journey.

The purpose is to improve the experience.

We aim to measure the interaction or outcome without unnecessarily collecting the underlying information involved in it.

For example:

Understanding that people are having difficulty completing a form does not require us to collect the sensitive information they entered into that form.

8. Sensitive Information

Some parts of Mosa may involve information that deserves additional protection.

This can include information relating to:

• health and safety;

• accessibility and support needs;

• safeguarding;

• children and young people;

• qualifications or checks;

• identity information;

• and other sensitive circumstances.

We do not intentionally use sensitive information for behavioural advertising or provide it to advertising platforms simply to target or measure advertising.

We design analytics and tracking so that, where practical, the event being measured does not include the sensitive information involved in the underlying activity.

For example, analytics might tell us:

A participant encountered an error completing a particular step.

It does not need to tell us:

The health or safeguarding information the participant entered into that step.

Where a third-party tracking technology cannot be configured consistently with this approach, we will not use it in that context unless there is another legitimate reason for doing so and appropriate privacy protections are in place.

9. Children and Young People

Mosa is designed to support participation by children and young people as well as adults.

We take additional care with tracking technologies in experiences used by children and young people.

We do not intend to use children's participation in Mosa to build behavioural advertising profiles or to sell their personal information to advertisers.

We aim to:

• minimise analytics information collected from experiences used by children and young people;

• avoid including sensitive participation information in analytics events;

• avoid unnecessary advertising tracking within participant experiences;

• carefully assess third-party technologies used in those experiences;

• and keep tracking connected to a legitimate service, security or improvement purpose.

Technologies required to provide or secure Mosa, such as authentication, session management, security and essential service operation, may still be used.

Our Children & Young People Privacy Notice explains our broader approach to children's privacy.

10. Public Website and Signed-In Mosa

Our public website and the signed-in Mosa experience serve different purposes and may use different technologies.

Signed-In Mosa

Inside Mosa, our priority is operating, securing and improving the service.

Tracking technologies within signed-in experiences are expected to be primarily connected to purposes such as:

• authentication;

• security;

• preferences;

• service operation;

• performance;

• error detection;

• and product analytics.

The signed-in experience may involve substantially more contextual and potentially sensitive information than a public marketing website.

We therefore take greater care about the tracking technologies introduced into that environment.

Public Website

Our public website may also use technologies that help us understand:

• website traffic;

• which public content people find useful;

• how people discover Mosa;

• general website performance;

• and whether our marketing is effective.

A marketing technology that is appropriate on a public website is not automatically appropriate inside a participant experience.

11. Third-Party Providers

Mosa relies on specialist technology providers to help us operate and improve the service.

The role of a provider matters.

Service Providers

Some providers help us operate capabilities such as:

• hosting;

• databases;

• authentication;

• communications;

• payments;

• security;

• monitoring;

• and other technical infrastructure.

These providers are used to help deliver or protect Mosa, not simply because we want to advertise to you.

Analytics and Product-Improvement Providers

We may use specialist providers to help us understand:

• product usage;

• performance;

• errors;

• reliability;

• and important user journeys.

Where we use these services, we aim to limit the information they receive to what is reasonably needed for their role.

We do not intentionally provide sensitive form content to an analytics provider simply because analytics are operating on that page or experience.

Marketing Providers

Our public website may use providers that help us understand marketing effectiveness or how people discover Mosa.

We treat these technologies differently from technologies required to operate the Mosa service.

We do not assume that a provider suitable for public website marketing should also have access to signed-in participant activity.

12. Marketing, Advertising and Commercial Partners

Mosa is not being designed as an advertising platform.

Our business model does not require us to fill participant experiences with unrelated advertising or indiscriminately send participant activity to advertising networks.

We may from time to time:

• promote Mosa capabilities;

• communicate relevant community opportunities;

• provide partner benefits;

• support commerce;

• present relevant commercial offers;

• run marketing;

• or measure whether our marketing is effective.

That does not automatically give a commercial partner access to your identity, participation history or Community Story.

Our broader principle is:

Commercial activity should create value for communities, not turn community participation into advertising inventory.

If we introduce advertising or marketing technologies that materially change how people are tracked or how personal information is shared, we will update this Notice and provide appropriate transparency and choice where required.

13. Your Choices

Some technologies are required to provide or secure Mosa.

Others may be optional.

Where tracking technologies require consent or another user choice, we will provide an appropriate way to make that choice.

The choices available may depend on:

• the technology;

• its purpose;

• the information involved;

• whether information is shared with another provider;

• and applicable law.

Importantly:

Using Mosa does not automatically mean consenting to every optional tracking technology.

Where optional analytics, marketing or similar technologies require a choice, that choice should remain separate from technologies genuinely required to provide the service.

14. Browser and Device Controls

Your browser or device may also provide controls over cookies and other storage technologies.

Depending on the browser or device, you may be able to:

• view stored cookies;

• delete cookies;

• block certain cookies;

• clear website data;

• restrict cross-site tracking;

• or change other privacy settings.

These controls operate independently from Mosa.

Blocking or deleting essential Mosa storage may cause some functionality to stop working correctly or require you to sign in again.

Browsers and devices may also support privacy preference signals.

Support for these signals varies. We will not claim to honour a particular browser privacy signal until Mosa has actually implemented and verified that support.

15. Retention

Different cookies, identifiers and analytics information may be retained for different periods depending on their purpose.

Some may exist only for a session.

Others may remain longer because they support:

• authentication;

• preferences;

• security;

• analytics;

• privacy choices;

• fraud prevention;

• or another legitimate purpose.

We aim to retain information for no longer than reasonably required for the relevant purpose, subject to legitimate security, legal, operational and evidentiary requirements.

Where a third-party provider processes information for us, its retention arrangements should also be appropriate to the role it performs.

16. Overseas Processing

Some technology providers may process information outside Australia.

Where information collected through analytics or tracking technologies constitutes personal information, our use of those providers remains subject to our broader privacy responsibilities.

Our Mosa Privacy Policy explains our approach to overseas disclosure and processing.

Before this Notice is published as final, we will reconcile it against the providers actually used by the production Mosa platform and public website, including relevant overseas processing locations.

17. Keeping Tracking Under Review

Technology changes.

A provider or technology can change:

• what it collects;

• how it operates;

• which subprocessors it uses;

• where information is processed;

• or how it uses information.

We therefore keep consequential tracking and analytics technologies under review rather than assuming that a technology remains appropriate simply because it was approved once.

When we consider introducing a new technology, the questions we care about include:

What information does it receive?

Why do we need it?

Who receives the information?

What can they do with it?

Does it involve children or sensitive information?

Can we achieve the same outcome with less information?

What choice should the Person have?

These questions help us decide whether a technology belongs in Mosa at all.

18. Changes to This Notice

We may update this Notice as Mosa develops.

For example, we may update it when:

• technologies change;

• providers change;

• our purposes change;

• privacy controls change;

• applicable law changes;

• or Mosa introduces materially different capabilities.

The current version and last-updated date will be identified.

Where a change materially affects how optional tracking technologies use personal information, we will provide additional transparency or choice where appropriate.

19. Contact Us

Mosa and Community.OS are operated by:

OSA Management Pty Ltd ABN 62 677 945 863 Trading as Sidekick Platforms

For privacy questions:

hello@onmosa.com

Our Mosa Privacy Policy provides more information about how we handle personal information and how you can contact us about privacy concerns.

Our Tracking & Analytics Commitment

Mosa needs technology to work well, remain secure and improve.

That does not mean every available tracking technology belongs in the platform.

We believe:

Essential technology should help Mosa work or remain secure.

Analytics should help us understand and improve Mosa without unnecessarily exposing the people using it.

Sensitive information should not become analytics data simply because it appears on a page being measured.

Children's participation should not become behavioural advertising data.

A marketing technology suitable for a public website is not automatically appropriate inside a participant experience.

Third-party providers should receive only the information reasonably required for the role we give them.

Commercial opportunity should create value without turning community participation into advertising inventory.

And most importantly:

If we don't need to track something to deliver a legitimate outcome, the fact that we technically can is not a good enough reason to do it.

As Mosa develops, we will keep this Notice aligned with the technologies we actually use and the choices available to the people using them.

Document Status

Version: v1.0 Status: Approved Reviewed: 27 September 2026 Owner: Sidekick Platforms Legal Entity: OSA Management Pty Ltd (ABN 62 677 945 863) Platform: Community.OS Product: Mosa