Vhalemba Mining (“Vhalemba Mining”, “we”, “us”, or “our”) respects your privacy and is committed to protecting your personal information.

This Privacy Policy explains how we collect, use, process, store, disclose and protect personal information when you visit or use our website at https://vhalemba.com/, communicate with us, submit information to us, or otherwise interact with our business.

This Privacy Policy is intended to comply with applicable South African data protection laws, including the Protection of Personal Information Act 4 of 2013 (“POPIA”), and other applicable privacy and data protection requirements. POPIA establishes conditions for the lawful processing of personal information and provides rights to data subjects.

1. Who We Are

Vhalemba Mining is responsible for processing personal information collected through our website and through our interactions with customers, prospective customers, suppliers, contractors, business partners, employees and other stakeholders, where applicable.

2. What Is Personal Information?

For purposes of this Privacy Policy, “personal information” generally means information relating to an identifiable, living natural person and, where applicable, an identifiable existing juristic person.

Personal information may include information such as your name, contact details, identification information, address, employment information, correspondence, online identifiers and other information that can reasonably be associated with you.

3. Information We May Collect

Depending on how you interact with Vhalemba Mining, we may collect different categories of personal information.

3.1 Information You Provide to Us

This may include:

• Full name;
• Email address;
• Telephone or mobile number;
• Physical or postal address;
• Company or organisation name;
• Job title or position;
• Information contained in enquiries or correspondence;
• Information provided through website forms;
• Information contained in applications or expressions of interest;
• Information contained in documents voluntarily provided to us; and
• Other information that you voluntarily provide.

3.2 Technical and Website Information

When you visit our website, certain information may be collected automatically, depending on the technology and services used by our website.

This may include:

• IP address;
• Browser type and version;
• Device type;
• Operating system;
• Pages visited;
• Date and time of visits;
• Referring website or source;
• General website usage information; and
• Cookies and similar technologies.

4. How We Collect Personal Information

We may collect personal information directly from you when you:

• Visit our website;
• Complete a contact or enquiry form;
• Send us an email;
• Telephone us;
• Request information about our business or services;
• Enter into a business relationship with us;
• Apply for employment or submit an expression of interest;
• Communicate with our employees or representatives; or
• Otherwise voluntarily provide information to us.

We may also receive personal information from third parties where permitted by law and where such information is relevant to our legitimate business activities.

5. Purposes for Which We Process Personal Information

We may process personal information for legitimate and lawful business purposes, including:

• Responding to enquiries and requests;
• Communicating with customers and prospective customers;
• Managing business relationships;
• Providing information about our business, products and services;
• Managing suppliers, contractors and business partners;
• Considering applications and expressions of interest;
• Processing and administering contracts;
• Operating and maintaining our website;
• Improving our website, services and customer experience;
• Maintaining security and preventing fraud or misuse;
• Managing administrative and operational activities;
• Complying with applicable laws and regulatory requirements;
• Establishing, exercising or defending legal rights and claims; and
• Other purposes disclosed at the time information is collected.

6. Lawful Processing of Personal Information

We will process personal information in accordance with the conditions for lawful processing established by POPIA.

Depending on the circumstances, we may process personal information where:

• You have provided consent;
• Processing is necessary to perform a contract with you;
• Processing is necessary to take steps at your request before entering into a contract;
• Processing is required to comply with a legal obligation;
• Processing protects a legitimate interest of the data subject;
• Processing is necessary to pursue our legitimate business interests, where permitted by law; or
• Another lawful basis under applicable law applies.

Where processing is based on consent, you may withdraw your consent where applicable. Withdrawal of consent will not affect the lawfulness of processing carried out before the withdrawal.

7. Purpose Specification and Data Minimisation

We seek to collect personal information for specific, explicitly defined and lawful purposes related to our business activities.

We will seek to limit the collection of personal information to information that is adequate, relevant and not excessive in relation to the purpose for which it is processed.

8. Accuracy of Personal Information

We take reasonable steps to ensure that personal information in our possession is accurate, complete, not misleading and updated where necessary.

If you become aware that personal information we hold about you is inaccurate or incomplete, please contact us so that we can consider correcting the information.

9. Cookies and Similar Technologies

Our website may use cookies and similar technologies to provide functionality, improve website performance, understand website usage and enhance your experience.

Cookies may be used for purposes including:

• Essential website functionality;
• Security;
• User preferences;
• Website performance;
• Analytics; and
• Understanding website usage.

You may manage cookies through your browser settings. Disabling certain cookies may affect some website functionality.

Where required by applicable law, we will obtain appropriate consent before using non-essential cookies or similar technologies.

10. Third-Party Service Providers

We may use third-party service providers to support our business and website operations.

These may include providers of:

• Website hosting;
• Email services;
• Cloud storage;
• Website analytics;
• Cybersecurity services;
• Communications services;
• Payment processing; and
• Other technology or business services.

Where such providers process personal information on our behalf, we will take reasonable steps to ensure that appropriate safeguards and confidentiality obligations are in place.

11. Sharing and Disclosure of Personal Information

We do not sell personal information as a business practice.

We may disclose personal information where lawful and reasonably necessary, including to:

• Employees and authorised representatives;
• Contractors and consultants;
• Professional advisers;
• Technology and service providers;
• Auditors and accountants;
• Business partners;
• Financial institutions where necessary;
• Government departments and regulatory authorities;
• Law-enforcement agencies or courts where required or permitted by law; and
• Other persons where you have authorised the disclosure or where permitted by law.

We seek to limit disclosures to information that is reasonably necessary for the relevant purpose.

12. Operators and Service Providers

Where another party processes personal information on our behalf, we may enter into appropriate contractual arrangements requiring that party to establish and maintain appropriate safeguards for the protection of personal information.

We will take reasonable steps to ensure that such parties process personal information only in accordance with our instructions and applicable law.

13. Cross-Border Transfers

Certain service providers or business partners may process or store personal information outside South Africa.

Where personal information is transferred outside South Africa, we will take reasonable steps to ensure that the transfer complies with applicable requirements under POPIA, including applicable requirements concerning the transfer of personal information to third parties outside the Republic.

14. Security Safeguards

We take appropriate, reasonable technical and organisational measures to protect personal information against loss, damage, unauthorised destruction, unlawful access or unlawful processing.

Security measures may include:

• Access controls;
• Password protection;
• Authentication procedures;
• Confidentiality obligations;
• Secure information systems;
• Backups;
• Monitoring and security controls; and
• Other safeguards appropriate to the risks involved.

No electronic transmission or storage system can be guaranteed to be completely secure. We therefore cannot guarantee absolute security of personal information.

15. Security Compromises

If we become aware of a security compromise involving personal information, we will take reasonable steps to assess, contain, investigate and remedy the incident.

Where required by POPIA, we will notify the Information Regulator and affected data subjects of a security compromise in accordance with applicable legal requirements.

16. Retention of Personal Information

We will not retain personal information for longer than is necessary to fulfil the purpose for which it was collected or processed, unless retention is required or permitted by applicable law.

Retention periods may depend on:

• The purpose for which the information was collected;
• Our business relationship with you;
• Contractual obligations;
• Legal and regulatory requirements;
• Accounting and tax requirements;
• Dispute resolution; and
• The establishment, exercise or defence of legal claims.

17. Your Rights as a Data Subject

Subject to applicable legal limitations, POPIA provides data subjects with rights concerning their personal information.

These may include the right to:

• Request access to personal information we hold about you;
• Request correction or updating of inaccurate personal information;
• Request deletion of personal information where applicable;
• Object to certain processing of your personal information;
• Object to processing for direct marketing by unsolicited electronic communications;
• Withdraw consent where processing is based on consent;
• Request information about how your personal information is processed; and
• Lodge a complaint with the Information Regulator where you believe your rights have been infringed.

18. Access to Personal Information

You may request access to personal information that we hold about you, subject to the requirements and limitations of applicable law.

Requests for access should be submitted using the contact details provided in this Privacy Policy.

We may need to verify your identity before processing an access request in order to protect your personal information from unauthorised disclosure.

19. Correction or Deletion of Personal Information

If you believe that personal information we hold about you is inaccurate, misleading, incomplete or outdated, you may contact us and request that the information be corrected or updated.

Where applicable, you may also request the deletion of personal information, subject to any legal requirements that require us to retain the information.

20. Direct Marketing

We may use personal information for direct marketing where permitted by applicable law and where the relevant requirements have been met.

Where applicable, you may object to receiving direct marketing communications or withdraw your consent to receive such communications.

You may contact us at unite@vhalemba.com to request that we stop sending direct marketing communications where applicable.

21. Children’s Personal Information

We do not intentionally collect personal information from children unless permitted by applicable law and the required conditions have been satisfied.

If we become aware that we have collected a child’s personal information in circumstances where processing is not permitted, we will take reasonable steps to address the situation in accordance with applicable law.

22. Special Personal Information

Certain categories of personal information receive additional protection under POPIA, including information relating to matters such as health, race, ethnic origin, religious or philosophical beliefs, trade-union membership, political persuasion, criminal behaviour, biometric information and certain other sensitive matters.

We will only process special personal information where permitted by POPIA or another applicable legal basis.

23. Automated Decision-Making

We do not currently intend to make decisions about individuals solely through automated processing where such processing produces legal consequences or similarly significant effects, except where permitted by applicable law.

If our practices change, we will provide information and safeguards required by applicable law.

24. Third-Party Websites

Our website may contain links to third-party websites or services.

Third-party websites operate independently from Vhalemba Mining and may have their own privacy policies and terms of use.

We are not responsible for the privacy practices, security or content of third-party websites. We encourage you to review the applicable privacy policy before providing personal information to any third party.

25. Business and Mining-Related Information

In conducting our business and mining-related activities, we may process information relating to customers, prospective customers, suppliers, contractors, consultants, employees, business partners, investors, visitors and other stakeholders.

Such information will be processed for legitimate business, contractual, operational, regulatory, safety, security and legal purposes, as applicable.

26. Confidential Business Information

This Privacy Policy primarily addresses personal information.

Confidential commercial, technical, geological, financial, operational or proprietary information may also be subject to contractual confidentiality obligations, non-disclosure agreements or other applicable protections.

27. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect:

• Changes in applicable laws and regulations;
• Changes to our business;
• Changes to our website;
• Changes to our services;
• Changes to technology or security practices; or
• Changes in how we process personal information.

When we make material changes, we may update the “Last Updated” date at the beginning of this Privacy Policy and, where appropriate, provide additional notice.

28. Complaints and the Information Regulator

If you believe that your personal information has been processed unlawfully or that your rights under POPIA have been infringed, you may contact us first so that we can investigate and attempt to resolve your concern.

You may also have the right to lodge a complaint with the Information Regulator of South Africa.

The Information Regulator is the independent regulatory authority established under POPIA and is responsible, among other functions, for monitoring and enforcing compliance with POPIA.

Further information about the Information Regulator is available at: https://inforegulator.org.za/

29. Contact Us

If you have questions, concerns, complaints or requests relating to this Privacy Policy or your personal information, please contact us:

30. Governing Law

This Privacy Policy shall be governed by and interpreted in accordance with the laws of the Republic of South Africa, including the Protection of Personal Information Act 4 of 2013, where applicable.

Nothing in this Privacy Policy limits any rights or remedies available to a data subject under applicable South African law.