Effective Date: August 28, 2026

1. Policy Introduction

Kazia Therapeutics, and its affiliates (the “Company,” “we” or “our”) are committed to protecting the privacy of individuals’ personal information. This Privacy Policy sets out the principles that the Company will follow in collecting, using, holding, disclosing, and otherwise managing personal information. The Company’s American Depositary Shares (ADSs) are listed on the Nasdaq Capital Market, and the Company is subject to applicable U.S. federal securities laws, including reporting obligations with the U.S. Securities and Exchange Commission (SEC).

“Personal information” is information or an opinion about an identified individual or an individual who is reasonably identifiable, whether true or not and whether the information or opinion is recorded in a material form or not.

The Company is bound by the Privacy Act 1988 (Commonwealth) (the “Act”) and the Australian Privacy Principles that are contained in the Act. To the extent that we collect personal data from individuals located in the European Economic Area, United Kingdom, or Switzerland, we also comply with the General Data Protection Regulation. To the extent we collect personal information from California residents, we comply with the California Consumer Privacy Act, as amended by the California Privacy Rights Act.

2. Legal Bases for Processing

The Company processes personal information in accordance with applicable law, including on the following legal bases:

  1. Consent: Where an individual has provided their consent to the processing of their personal information for one or more specific purposes.
  2. Contractual Necessity: Where processing is necessary for the performance of a contract to which an individual is a party, or to take steps at an individual’s request prior to entering into a contract.
  3. Legal Obligation: Where processing is necessary for compliance with a legal obligation to which we are subject.
  4. Legitimate Interests: Where processing is necessary for the purposes of our legitimate interests or those of a third party, except where such interests are overridden by an individual’s interests or fundamental rights and freedoms.

3. Collection of Personal Information

The Company may collect personal information about an individual in a variety of ways, including when an individual interacts with the Company in person or electronically, for example when an individual accesses our website or uses our services.

The Company will only collect personal information about an individual where the information is reasonably necessary for one or more of our functions or activities. The kinds of personal information collected and held, how that information is collected and held, and the purposes for which that information will be collected, held, used, and disclosed will depend on the circumstances.

Examples of instances where personal information may be collected by the Company include:

  1. collecting personal information from shareholders for the purposes of enabling proper records to be kept, for reporting purposes, and for compliance with U.S. federal securities laws and NASDAQ listing requirements;
  2. collecting personal information from individuals who enter into service agreements, joint venture agreements or other transactions with the Company for the purpose of administering those agreements or transactions or for reporting purposes;
  3. collecting personal information from individuals who participate in clinical trials or research studies;
  4. collecting personal information from visitors to our website or users of our online services; and
  5. collecting personal information from job applicants and employees.

Examples of the kinds of personal information the Company may collect and hold include:

  1. name;
  2. address;
  3. phone number;
  4. email address;
  5. IP address, device identifiers, and browser information;
  6. information about goods or services ordered, acquired, or supplied;
  7. information from enquiries made;
  8. communications between the Company and an individual; and
  9. payment information, including credit card details.

The Company will take reasonable steps to ensure that the personal information that is collected, used, or disclosed by it is complete and up to date. The Company will only collect personal information about an individual from that individual unless it is unreasonable or impractical to do so.

The Company does not knowingly collect personal information from children under the age of 16. If we become aware that it has inadvertently collected personal information from a child under 16, we will take steps to delete such information as soon as practicable.

4. Use and Disclosure of Personal Information

At or before, or if that is not practicable, as soon as practicable after, the time that the personal information is collected, the Company will take reasonable steps to ensure that the individual is aware of the matters required by the Australian Privacy Principles and other applicable privacy laws, including:

  1. why the personal information is being collected;
  2. who else the personal information might be given to;
  3. the fact that this Privacy Policy contains information about how the individual is able to gain access to and correction of the information collected; and
  4. how to contact the Company, including to make a complaint.

If the Company collects personal information about an individual from someone else, the Company will take reasonable steps to ensure that the individual is aware that the Company has collected the information and of the above matters.

The Company will only use or disclose this personal information for:

  1. the purpose for which it was collected;
  2. any related purpose for which it would reasonably be expected to be used or disclosed;
  3. a purpose required or permitted by law; or
  4. a purpose for which the individual has provided consent.

Examples of instances where the Company may disclose personal information about individuals to third parties include disclosure to providers of services to the Company, government agencies, regulatory authorities, related bodies corporate of the Company, and professional advisors of the Company. The Company requires its service providers to keep the personal information confidential and not use it for any purpose other than performing those services.

The Company may also disclose personal information to securities regulators, including the U.S. Securities and Exchange Commission, as required or permitted by applicable securities laws and regulations.

The Company may disclose personal information to recipients located outside of Australia, including in the United States, the European Union, and other jurisdictions where our service providers, partners, or affiliates operate. Where the Company transfers personal information internationally, the Company implements appropriate safeguards, such as Standard Contractual Clauses or reliance on adequacy decisions, to ensure that your information is protected in accordance with applicable privacy laws.

5. Cookies and Tracking Technologies

Our website uses cookies, pixels, and similar tracking technologies to enhance your browsing experience, analyze website traffic, and understand where our visitors are coming from.

Types of cookies we use include:

  1. Essential cookies: Necessary for the website to function properly.
  2. Analytics cookies: Help us understand how visitors interact with our website (e.g., Google Analytics).
  3. Functional cookies: Enable enhanced functionality and personalization.

You can control cookies through your browser settings. Most browsers allow you to refuse cookies or alert you when cookies are being sent. Please note that disabling cookies may affect the functionality of our website.

Do Not Track Signals: Our website does not currently respond to “Do Not Track” browser signals. However, you may opt out of certain tracking as described above.

6. Data Retention

The Company retains personal information for as long as necessary to fulfill the purposes for which it was collected, including to satisfy any legal, accounting, or reporting requirements. Retention periods vary depending on the context of the processing and our legal obligations. When personal information is no longer required, we will securely destroy or de-identify it in accordance with our data retention policies and applicable law.

7. Security of Personal Information

The Company will take reasonable steps to ensure that the personal information that it holds is protected from misuse, interference, and loss and from unauthorized access, modification, and disclosure. These measures include encryption of data in transit and at rest, access controls, secure storage systems, and regular security assessments.

In the event of a data breach that is likely to result in serious harm to individuals, we will notify affected individuals and the Office of the Australian Information Commissioner (and other applicable regulators) in accordance with our legal obligations. Depending on the nature and scope of a data breach, the Company may also be required to disclose information regarding the breach in its filings with the U.S. Securities and Exchange Commission if the breach is determined to be material to investors.

8. Your Privacy Rights

At the request of an individual, the Company will, in most circumstances, provide access to an individual to any personal information that is being held by the Company about that individual.

There are certain circumstances where the Company will not provide individual access to such personal information in accordance with the Act. These circumstances include, among others, where providing access would have an unreasonable impact on the privacy of others, or where providing access would be unlawful.

An individual can seek access to, and update or correct, any personal information that is being held by the Company about that individual by contacting us using the details provided below.

Depending on your location, you may also have the following additional rights:

  1. Right to Erasure (Right to be Forgotten): You may request that the Company delete your personal information in certain circumstances, such as when the data is no longer necessary for the purposes for which it was collected.
  2. Right to Data Portability: You may request a copy of your personal information in a structured, commonly used, and machine-readable format, and request that the Company transmit it to another controller where technically feasible.
  3. Right to Object: You may object to the processing of your personal information where the Company is relying on legitimate interests as the legal basis for processing.
  4. Right to Restrict Processing: You may request that the Company restrict the processing of your personal information in certain circumstances.
  5. Right to Withdraw Consent: Where the Company relies on your consent to process your personal information, you may withdraw that consent at any time.

To exercise any of these rights, please contact us using the details provided below. The Company will respond to your request within the timeframes required by applicable law.

9. Additional Information for California Residents

This section applies solely to individuals who are California residents, as defined under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, “CCPA”). This section supplements the information contained in this Privacy Policy.

Categories of Personal Information Collected

In the preceding 12 months, the Company has collected the following categories of personal information as defined by the CCPA: (A) Identifiers (e.g., name, postal address, email address, IP address, account name); (B) Personal information categories listed in Cal. Civ. Code § 1798.80(e) (e.g., name, address, telephone number, financial information); (C) Protected classification characteristics (e.g., age, race, gender); (D) Commercial information (e.g., records of services purchased or considered); (E) Internet or other electronic network activity information (e.g., browsing history, interaction with our website); (F) Geolocation data; (G) Professional or employment-related information; and (H) Inferences drawn from the above categories.

Sensitive Personal Information

The Company may collect certain categories of sensitive personal information as defined by the CCPA, including social security numbers, financial account information, precise geolocation, and health information. The Company uses sensitive personal information only for purposes permitted under the CCPA, including to perform services reasonably expected by consumers, ensure security and integrity, and for short-term transient use.

Sale and Sharing of Personal Information

The Company does not sell your personal information. The Company does not share your personal information with third parties for cross-context behavioral advertising purposes. The Company does not have actual knowledge that it sells or shares the personal information of consumers under 16 years of age.

Your California Privacy Rights

In addition to the rights described in Section 8, California residents have the following rights under the CCPA:

Right to Know: You have the right to request that the Company disclose the categories of personal information collected, the categories of sources, the business or commercial purpose for collecting or selling personal information, the categories of third parties with whom the Company shares personal information, and the specific pieces of personal information collected about you.

Right to Delete: You have the right to request that the Company delete personal information collected from you, subject to certain exceptions permitted by the CCPA.

Right to Correct: You have the right to request that the Company correct inaccurate personal information that it maintains about you.

Right to Limit Use of Sensitive Personal Information: You have the right to limit the Company’s use of your sensitive personal information to purposes permitted by the CCPA.

Right to Non-Discrimination: The Company will not discriminate against you for exercising any of your CCPA rights. The Company will not deny you goods or services, charge you different prices, provide a different level or quality of goods or services, or suggest that you may receive a different price or level of goods or services for exercising your rights.

Exercising Your California Privacy Rights

To exercise your rights under the CCPA, you may submit a verifiable consumer request by emailing us at privacyofficer@kaziatx.com. To protect the security of your personal information, the Company will verify your identity before responding to your request by asking you to provide information that matches the personal information the Company has on file about you.

Authorized Agents

You may designate an authorized agent to submit a request on your behalf. The Company will require the authorized agent to provide either (1) a power of attorney authorizing the agent to act on your behalf or (2) your written authorization (which may be provided electronically). The Company may also require you to verify your own identity directly or confirm that you authorized the agent to submit the request.

Response Timing

The Company will confirm receipt of your request within 10 days and provide information about how the Company will process your request. The Company will respond to your request within 45 days. If the Company requires additional time (up to an additional 45 days), the Company will provide you with notice and an explanation of the reason. The Company will maintain records of consumer requests and responses for 24 months.

10. Automated Decision-Making

The Company does not use automated decision-making, including profiling, that produces legal effects or similarly significant effects on individuals. If this changes in the future, we will update this Privacy Policy and provide appropriate notice and safeguards.

11. Amendment of Policy

The Company may amend this Policy from time to time. Where the Company makes material changes to this Policy, the Company will notify you by posting a prominent notice on our website or by other appropriate means. We encourage you to periodically review this Policy to stay informed about how we are protecting your information.

If the Company makes material changes to this Privacy Policy that affect shareholders or the handling of information subject to U.S. securities laws, the Company will consider whether such changes require disclosure in its filings with the U.S. Securities and Exchange Commission.

12. Concerns, Queries, and Complaints

If you have any concern, query, or complaint about:

  1. any personal information that may have been collected, used, or disclosed by the Company;
  2. this Privacy Policy; or
  3. a breach of the Australian Privacy Principles or other applicable privacy laws,

please contact our Privacy Officer at privacyofficer@kaziatx.com.

The Company takes complaints very seriously. The Company aims to acknowledge your complaint within 5 business days and provide a substantive response within 30 days.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au. If you are located in the European Economic Area, you may also lodge a complaint with your local data protection authority. If you are a California resident, you may contact the California Attorney General’s office.