Supplier Code of Conduct

1 · Purpose

This Code sets out the standards Nxt7a expects of its suppliers, vendors, contractors and partners. It ensures the businesses we work with share our commitments to ethics, people, security and the environment.

2 · Scope

Applies to all third parties that provide goods, services or data to Nxt7a, and is referenced in our agreements with them. Suppliers are expected to apply equivalent standards to their own suppliers.

3 · Policy Statements

We expect suppliers to:

Act ethically. Comply with applicable laws; reject bribery and corruption (consistent with our Anti-Bribery & Corruption Policy); and avoid conflicts of interest.

Respect human rights and labour. Provide safe and fair working conditions; prohibit child labour, forced labour and modern slavery; and uphold non-discrimination. Consistent with the Modern Slavery Act 2018 (Cth), we expect suppliers to take reasonable steps to identify and address modern slavery risks in their operations and supply chains.

Protect information. Safeguard Nxt7a, client and personal data they handle, with security controls appropriate to its sensitivity, and meet the obligations in our agreements (aligned to our Information Security and Privacy policies). Report security incidents affecting Nxt7a data promptly.

Handle data lawfully. Use personal and sensitive data only as authorised; respect privacy law and any data-processing terms. Where they handle Indigenous data on our behalf, comply with the requirements of our Data Sharing & Indigenous Data Sovereignty Policy.

Operate responsibly toward the environment. Minimise environmental harm and support our sustainability aims where relevant.

Use AI responsibly. Where suppliers use AI in services to us, do so responsibly and transparently, consistent with our Responsible AI Policy.

Allow assurance. Provide reasonable information to demonstrate compliance, proportionate to risk.

4 · Roles & Responsibilities

• Supplier owners at Nxt7a share this Code, include it in agreements, and assess supplier risk.
• Suppliers comply and cascade equivalent standards.
• CEO / Operations owns the Code and supplier governance.

5 · Compliance, Monitoring & Breach

Material non-compliance may lead to remediation, suspension or termination of the relationship. Higher-risk suppliers (by data access or impact) receive greater scrutiny.

6 · Related Documents

Anti-Bribery & Corruption Policy · Information Security Policy · Privacy Policy · Access Control Policy · Environmental & Sustainability Policy · Data Sharing & Indigenous Data Sovereignty Policy.

7 · Standards Mapping

• B Corp: Community.
• ISO/IEC 27001:2022: A.5.19–5.21 (supplier relationships and ICT supply chain).
• ISO/IEC 42001:2023: A.10 (third parties and customers in the AI value chain).
• Statutory: Modern Slavery Act 2018 (Cth).

Review note. Confirm whether Nxt7a meets the Modern Slavery Act reporting threshold; even if not, voluntary alignment supports B Corp. Have [COO or delegate] confirm contractual flow-down wording.

8 · Version History