PRIVACY POLICY NQ Minerals Plc respects your privacy and is committed to protecting your personal data. This Privacy Policy describes how we look after your personal data when you visit our website (regardless of where you visit from) and how we process your personal data more generally, and tells you about your privacy rights and how the law protects you (in accordance with the EU General Data Protection Regulation (“GDPR”)). The specific areas covered in this Privacy Policy are set out below. Important information and who we are The types of data we collect How we collect your data Personal data use Disclosures of your personal data, including international transfers Data security Data retention Your rights Changes to this Privacy Policy 1. IMPORTANT INFORMATION AND WHO WE ARE Purpose of this Privacy Policy This Privacy Policy aims to give you information on how NQ Minerals Plc collects and processes your personal data through your use of this website (and otherwise). Please note that this website is not intended for children and we do not knowingly collect data relating to children. It is important that you read this Privacy Policy together with any other privacy policy or fair processing policy we may provide on specific occasions when we are collecting or processing personal data about you so that you are fully aware of how and why we are using your data. This Privacy Policy supplements other notices and privacy policies and is not intended to override them. Controller NQ Minerals Plc is part of a group of companies. This Privacy Policy is issued on behalf of that group, so when we mention “NQ Minerals Plc”, “we”, “us” or “our” in this Privacy Policy, we are referring to the relevant company in the group responsible for processing your data. NQ Minerals Plc is the data controller and responsible for this website. We have appointed a data privacy manager who is responsible for overseeing questions in relation to this Privacy Policy. If you have any questions about this Privacy Policy, including any requests to exercise your legal rights (as summarised in section 8 below), please contact the data privacy manager using the details set out below. Contact details Our aim is always to process personal data fairly, lawfully and transparently. However, if you are unhappy with the information provided in this Privacy Policy or have any broader questions or concerns please email compliance@nqminerals.com. If you remain dissatisfied you may raise any issue directly with the Information Commissioner’s Office (who can be contacted at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF or via www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance. Third-party Links This website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the Privacy Policy of every website you visit. THE TYPES OF DATA WE COLLECT Personal data means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data). When you submit your personal data on this website (or otherwise supply us with your personal data) you are agreeing to the processing and transfers of your personal data as set out in this Privacy Policy. The types of personal data we may collect, use, store, transfer and otherwise process may include: ‘identity data’ such as names, marital status, date of birth and gender; ‘contact data’ including address, e-mail address and telephone numbers; ‘technical data’ such as your IP address, browser type and location information; and ‘profile data’, which includes your username and password. We do not collect any Special Categories of Personal Data about you. This includes, for example, information relating to race or ethnic origin, religious or philosophical beliefs, and information about your health. HOW WE COLLECT YOUR DATA We may use different methods to collect data from and about you. These are set out below. Direct interactions – we may collect contact and identity data from you, for example when you register as a user on our website and when you subscribe to our mailing lists for information, invitations and updates. More generally, we may also obtain personal data when you correspond with or visit us at NQ Minerals Plc or at events. Automated technologies – as you interact with our website, we will automatically collect technical data (as described in section 2 above). We collect this personal data by using cookies and similar technologies. PERSONAL DATA USE We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances: Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests (“legitimate interests” means the interest of our business in conducting and managing our business to enable us to give you the best service and the best and most secure experience). Where we need to comply with a legal obligation that we are subject to. In accordance with the GDPR, we have identified below the ways we plan to use your personal data and which of the lawful bases we rely on to do so, and we have identified what our legitimate interests are where appropriate (note that we may process your personal data for more than one lawful ground depending on the circumstances). If you need details about the specific legal ground we are relying on to process your personal data, please contact us. We may process personal data in connection with the effective management and running of NQ Minerals Plc. This may include, but is not limited to: engaging suppliers; facilitating events; circulating company news updates and correspondence; ensuring the security of our systems and premises; for auditing, reporting and insurance purposes; for generating statistics (including measuring performance and website usage). In this context we process your personal data on the basis that it is in our legitimate interests (or those of a third party) to do so for the effective management of NQ Minerals Plc, and we are satisfied that your interests and fundamental rights do not override those interests). We may process personal data for tax and accounting purposes and fulfilling our statutory obligations. In these circumstances we are processing personal data in order to comply with our legal obligations. Generally we do not rely on consent as a legal basis for processing your personal data, although we will obtain your consent before telling you about our upcoming events and news directly related to NQ Minerals Plc. This may include receiving such further information by telephone, or email as approved by you at the time you gave us your consent. However, these decisions may be reversed at any time by opting-out of such communications or by emailing us at unsubscribe@nqminerals.com, and we will process your request as soon as possible. Cookies You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. Most internet browsers allow you to do this via options/settings. For more information about the cookies we use, please see LINK TO COOKIE POLICY. Change of purpose We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us. If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so. Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law. DISCLOSURES OF YOUR PERSONAL DATA, INCLUDING INTERNATIONAL TRANSFERS We may share your personal data with the parties (and for the purposes) set out below. Companies and individuals who perform functions on our behalf which involve processing personal data. Examples include banking services, data analysis firms, customer support specialists, webhosting companies and IT services providers. Such third parties will only process personal data in accordance with our instructions. Regulators and other authorities when this is necessary for us to comply with any applicable law, regulation or governmental request. Third parties to whom we may choose to sell, transfer or merge parts of our business or assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this Privacy Policy. Other companies within our group. We will always require all relevant third parties to respect the security of your personal data and treat it in accordance with the law. Such third parties may not use such personal data for any other purpose. Such third parties may be located in countries both inside and outside the European Economic Area (“EEA”). Whenever we transfer personal data outside the EEA we ensure a similar degree of protection is afforded to it by ensuring that adequate safeguards are in place, for example: by virtue of the fact that the country has been deemed by the European Commission to provide an adequate level of protection; by using specific contracts approved by the European Commission; or (for third parties based in the US) by transferring data pursuant to the Privacy Shield framework DATA SECURITY We implement appropriate security measures to protect the security of your personal data, and to prevent it being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. We also limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality. We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so. DATA RETENTION We will retain personal data for the length of time required for the specific purposes for which it is processed, as set out in this Privacy Policy. However, we may also keep your personal data for a longer period, for example, where required by our legal and regulatory obligations or in order to ensure we have effective back-up systems. In such cases, we will: ensure that your personal data will continue to be subject to this Privacy Policy; restrict access to any archived personal data; and ensure that all personal data is held securely and kept confidential. To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements YOUR RIGHTS The GDPR provides individuals with certain rights in relation to their personal data. These are summarised below. Right of access – you can request a copy of the personal data we hold about you and check that we are processing it lawfully. Right to rectification – you can ask us to correct any inaccurate data we hold about you. Right to erasure – you can request that we delete personal data where there is no good reason for us continuing to process it (if specific legal reasons prevent us from complying with this request, we will notify you of this). Right to object – you can object to the processing of your personal data where we rely on a legitimate interest (or those of a third party) and you feel this impacts on your fundamental rights and freedoms. You can also object where we process your personal data for direct marketing purposes. Right to restriction of processing – you can ask us to suspend the processing of your personal data in certain situations – e.g. if you want us to establish the accuracy of the data, or if you have objected to our use of your data but we need to verify if we have overriding legitimate interests to use it. Right to data portability – you can ask us to transfer certain personal data to you or a third party in a structured, commonly used, machine-readable format. Withdrawal of consent – as mentioned in section 4 above, where we rely on consent to process your personal data, you can withdraw this at any time (this will not affect the lawfulness of any processing carried out before you withdraw your consent). You can exercise any of these rights by contacting us at any time at compliance@nqminerals.com. Please contact us at unsubscribe@nqminerals.com if you wish to withdraw your consent or unsubscribe from emails we send you. Fees and time limits You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, if your request is unfounded, repetitive or excessive we may charge a reasonable fee or refuse to comply with your request. We try to respond to all legitimate requests within one month, though this may take longer if your request is complex or you have made a number of requests – we will notify you if this is the case. When you exercise any of your rights we may need to request specific information from you to verify your identity and/or to help speed up our response. CHANGES TO THIS PRIVACY POLICY This Privacy Policy is effective from 25 May 2018. We may revise this Privacy Policy from time to time and will post the revised version here. As we may make changes at any time without notifying you, and the policy governing our processing of your personal data will be the one in place at the time of the processing in question, we suggest that you periodically consult this Privacy Policy. This Privacy Policy was last updated on June 21, 2018. It is important that the personal data we hold about you is accurate and current. We will take reasonable steps to create an accurate record of any personal data submitted through the website or otherwise processed by us. However, please keep us informed if your personal data changes during your relationship with us. We do not assume responsibility for confirming the ongoing accuracy of your personal data. Cookies Policy NQ Minerals PLC may track and process information and data in relation to your use of our site using “cookies”. As a rule, cookies will make your browsing experience better. However, you may prefer to disable cookies on this website and on others. Most internet browsers allow you to stop receiving cookies via options/settings. Data collected from website users is processed anonymously. We only use cookies to monitor the performance of our website and to improve visitor experience only. We may collect non-personal identification information about visitors whenever they interact with our website. Non-personal identification information may include the browser name, the type of computer and technical information about visitors means of connection to our site. Cookies are small pieces of information stored by your browser on your computer’s hard drive. If you want to know more about cookies and how they work, please refer to the following websites: http://www.allaboutcookies.org and http://www.youronlinechoices.com. We use Google Analytics, a web analytics service provided by Google, Inc. Google Analytics uses cookies to collect information about details of our users’ visits to the Site (including IP addresses) and the resources they access on it. Google Analytics provides us with reports based on this information in order to us to help us understand how visitors engage with the Site. Google Analytics will not transfer the information it collects to any third party except where required to do so by law. Please note that we will not use Google Analytics to collect any information from which you can be personally identified, and we will not associate the information provided to us by Google Analytics with Your Information. Google Analytics’ cookies will remain on your computer for between thirty minutes and two years from being set / updated, unless you delete them before they expire. For more information about Google Analytics.