Privacy Policy

Purpose

Mineral Resources Limited (ACN 118 549 910), together with its related bodies corporate (MinRes, we, us or our), is committed to handling your personal information with care and transparency. This Privacy Policy explains how we collect, use, disclose and store your personal information. It applies to personal information collected or held through our business activities and information disclosed to us, in connection with those activities.

Scope

This Policy applies to individuals whose personal information is processed by us, including:

• our shareholders and investors
• visitors to our offices, sites, websites and digital platforms
• our business partners (suppliers, service providers, joint venture partners)
• landowners, traditional owners and community stakeholders
• customers and prospective customers
• other individuals who interact with us as part of our business activities.

If you are considering working with us, or currently working through the recruitment process, please refer to our Candidate Privacy Policy on our Careers Portal. If you are part of our workforce (employees, contractors or sub-contractors), you can view the applicable policies on our intranet or speak to your leader for a copy.

For information on how our business partners, suppliers and service providers collect or handle your personal information, please refer to their privacy policies directly.

What personal information we collect about you

Personal information is any information or opinion that could identify you, either on its own or when combined with other information. Depending on your relationship with us, we collect, use, disclose and store the following personal information:

• Contact information - addresses, telephone numbers, email addresses and next of kin.
• Personally identifiable information - full name, date of birth, gender, government-issued identifiers (such as driver’s licence, passport, visa details) and public social media profiles.
• Professional information - employer, job title/role, qualifications, certifications and licences.
• Your image - photographs, CCTV footage, video and audio recordings, visitor records.
• Financial and insurance information - bank account details, payment information, ABN, insurance information, tax file numbers.
• Technical information - web usage data, IP addresses, cookies, device identifiers, browser information, online preferences.
• Location and access information - vehicle registration, site access records, GPS and location data.
• Communications - correspondence, enquiries, announcements, feedback, complaints.
• Any other information you provide to us in connection with your dealings with MinRes.

Sensitive personal information is a subset of personal information and includes:

• Racial or ethnic origin.
• Trade union or professional association membership.
• Criminal history or record.
• Government-issued identifiers - driver’s license, passport, visa, other government identity documents.
• Health information - medical record/history, disability information, dietary information.

We only collect sensitive personal information with your consent where it is reasonably necessary for one or more of our functions or activities, unless an exception under the Privacy Act 1988 (Cth) (Privacy Act) applies, including where collection is required or authorised by law.

How we collect your personal information

We collect personal information where it is necessary for our business functions and activities. We collect personal information in the following ways:

• Directly from you - when visiting our offices, sites, websites, by phone, post, forms, correspondence, electronic communication, updating your details or social media.
• From our business partners or other third parties - who disclose your information with us for the purposes of conducting our business functions.
• Collected automatically - when you visit our websites, we collect via cookies or other tracking technologies and through our digital platforms and operational systems.

We hold your personal information in paper and electronic forms, including in business records, email systems, document management systems, contractor platforms, security systems and with approved third-party providers.

Where it is lawful and practicable, you may choose to deal with us anonymously or by using a pseudonym. In some circumstances, we may be unable to engage with you without identifying you, for example, where we are required or authorised by law to do so, or where it is otherwise impracticable.

How we use your personal information

We collect, store, use and disclose your personal information for the purpose of conducting and supporting MinRes' business activities, including:

• Mining and business operations - operating and managing our mining, mining services and related business activities, including onboarding and engaging business partners and managing commercial relationships.
• Health, safety and site access - managing site access and emergency response, meeting health and safety obligations, security and emergency response, operating CCTV and GPS monitoring.
• Verifying your identity - when you visit our premises or sites.
• Communications - responding to your enquiries, complaints or feedback, contacting you for operational or administrative purposes.
• Due diligence - conducting due diligence as part of our commercial practices and/or regulatory requirements.
• Investor and shareholder information - communicating with you about our business, news, events and investor engagements.
• Financial administration - managing our commercial relationships with business partners, maintaining business records.
• Technology and digital platforms - operating, improving and maintaining the security of our websites, digital platforms and systems, and measuring performance.
• Community engagement - engaging with Traditional Owners, landowners and community stakeholders to comply with regulatory obligations and social license to operate.
• Legal and regulatory - meeting our legal and regulatory obligations (such as workplace health and safety, mining regulations, court orders), investigating incidents or suspected unlawful activity.

Additional purposes

We may use or disclose your personal information for a purpose other than the primary purpose for which it was collected (secondary purpose) where the following may apply:

• The secondary purpose is related to the primary purpose of collection, and you would reasonably expect us to use or disclose the information for the secondary purpose.
• You have consented to the secondary purpose.
• The secondary purpose is required or authorised by law, or another exception under the Privacy Act applies.

Where we use or disclose sensitive personal information for a secondary purpose, we will only do so where the secondary purpose is directly related to the primary purpose of collection, or as otherwise required or permitted by law.

Cookies and tracking technologies

Our website uses cookies and similar tracking technologies to operate efficiently, improve your experience and understand how our website is used. Cookies are small data files that may be stored on your browser or device. You can manage or disable cookies through your browser or device settings.

For full details on the cookies we use, their purposes and how to manage them, please refer to our Cookie Notice.

Communications

We may use your contact details to provide you with information about us, including investor communications, updates, news and events, that may be of interest to you. We will only do so where you have consented or where we are otherwise permitted to do so under applicable law.

If you subscribe to ASX announcement alerts through our website, you will receive an email from our service provider, who sends the alert on our behalf. You can unsubscribe at any time using the link in each alert.

Who we disclose your personal information with

We may disclose your personal information with third parties where reasonably necessary for the conduct of our business, or as required or authorised by law. We may disclose your personal information with:

• MinRes group companies - who support our business operations and group-wide activities.
• IT and technology service providers - who host security and system support to assist us in operating and maintaining our systems and digital platforms.
• Professional advisors - who support and advise on our business activities and help us meet our regulatory and legal obligations.
• Financial service providers - banks, payment processors, debt collection partners.
• Business partners - third parties who we engage to support or assist us in delivering our business activities.
• Government agencies or regulators - regulatory bodies, law enforcement agencies, as required or permitted by law.
• Other third parties - where necessary or required by law, to support our business activities.

We do not sell your personal information to third parties.

Where we disclose your personal information overseas

Some of our third-party service providers, business partners, software platforms, cloud storage systems, support and hosting are located overseas. Some of the countries where your personal information may be disclosed include the United States, United Kingdom, Ireland, New Zealand and Singapore. Before sharing personal information overseas, we take reasonable steps to ensure appropriate safeguards are in place to protect your personal information.

How we protect personal information

MinRes is committed to the security of personal information. We have technical and organisational measures in place to protect your personal information from misuse, interference, loss and from unauthorised access, modification, disclosure or destruction. Our security measures are regularly reviewed and updated to incorporate technological advancements and to address emerging threats.

How long we keep your personal information

We keep your personal information for only as long as it is needed for a purpose permitted by the Privacy Act or to meet our legal and regulatory obligations.

Accessing and correcting your personal information

You may request access to, or correction of, the personal information we hold about you by contacting our Privacy Office using the contact details below. We will verify your identity before processing your request and aim to respond to your request within 30 days. There is no fee for making an access or correction request, but we may charge the reasonable costs of providing access.

Where we are unable to provide access or correct your personal information, we will provide written notice of the reasons, unless it would be unlawful or unreasonable to do so.

Resolving privacy concerns and complaints

We are committed to being transparent and responsive in how we handle your personal information. If you feel that we have not met that commitment, you may make a written complaint to us using the contact details below.

We will make a record of your complaint, and we will address it promptly while keeping you informed on the progress. For more information, please contact our Privacy Office using the details below.

Contact us

For all privacy-related enquiries, access or correction requests, complaints, or to exercise any of your rights under this policy, please contact our Privacy Office at:

Address: Mineral Resources Limited
Locked Bag 13
Osborne Park DC 6916

Telephone: +61 8 9329 3600

Email: privacy@mrl.com.au

Website: https://www.mineralresources.com.au/privacy-policy/

Office of the Australian Information Commissioner

If you are not satisfied with our response, you have the right to escalate your concern to the Office of the Australian Information Commissioner (OAIC) at:

Post: Office of the Australian Information Commissioner
GPO Box 5218
Sydney NSW 2001

Telephone: 1300 363 992

Website: www.oaic.gov.au

Changes to this Privacy Policy

We may update this Policy from time to time to reflect changes in our practices, operations, technologies or legal obligations. An updated Policy will be available on our website, and we encourage you to review this Policy to stay informed about how we handle your personal information.