Privacy policy

Valterra Platinum, a company registered in South Africa under company number 1946/022452/06 whose registered office is at 144 OXFORD ROAD, ROSEBANK, MELROSE, GAUTENG, 2196 and/or one or more of the companies within Valterra Platinum of companies, depending upon your location, is the Data Controller and responsible for the processing of personal data.

Information on how to contact us, is available at this email address dataprotection@valterraplatinum.com

If you have a contractual relationship with us, the Valterra Platinum group company identified in that contract (whether issued by us or a third party) will be the data controller of your personal data.

If you are a prospective customer, the data controller could be one of the following entities:

• Valterra Platinum Marketing Limited
• Valterra Platinum Marketing Limited (Singapore)
• Atomatic Trading (Pty) Limited
• Platmed (Pty) Ltd
• Rustenburg Platinum Mines Limited
• Unki Mines (Private) Limited
• Whiskey Creek Management Services (Pty) Ltd

On our website:

If you provide us with personal data through the Websites, we will process your personal data in order to, in accordance with applicable law:

• Let you use special features and download brand content when you want to.
• Make sure the website content works well for you and your computer.
• Provide information you ask for or that we think might interest you, including through alerts you subscribe to.
• Inform you about changes to our websites and branding that might be relevant to you.
• Show you relevant ads on other websites like Google, YouTube, and LinkedIn.

Customer management and administration

If you communicate with us as a customer, prospective customer, client or similar contact, we use your personal data to manage and maintain our relationship with you and keep necessary records.

This includes:

• Communicating with you in connection with the relevant customer or contact's business with us
• Contacting you in order to be able to provide the customer with pricing information, deliver the product, manage and facilitate the relationship and raise invoices
• Facilitating payment for goods and services
• Creating, managing and maintaining a CRM database, including relevant organisational charts
• Keeping records and audit information relating to our customers and contacts, including minutes of meetings and other notes
• Facilitating any planned exports in compliance with Export Control laws
• We may also process your personal data in order to send marketing communications via email.
• Talking to you about the customer's business with us.
• Getting in touch to provide prices, deliver products, manage relationships, and send invoices.
• Helping with payments for goods and services.
• Creating and updating a database to keep track of customers and their businesses.
• Keeping records, including meeting notes and other important information.
• Handling exports while following Export Control laws.
• Using your personal data to send marketing emails.

We use your personal data to decide which marketing communications to send to you. These decisions do not have any legal effects concerning you or significantly affect you. We tailor our marketing communications based on industry, job title and preferences that you have selected. As a result of this activity, you will receive tailored marketing material relating to your industry or selected interest areas.

Customer due diligence

We may need to undertake due diligence before commencing our relationship with you or the relevant customer. This is also performed on individuals associated with companies that are acquisition targets for Valterra Platinum. We do this to ensure that the relationship with the customer is appropriate and that any associated risk is identified and managed effectively.

This includes, where relevant and appropriate, vetting activities for individuals associated with such customers. These vetting activities may include Know Your Client ("KYC") and anti-money laundering ("AML") screening checks, anti-bribery and corruption checks, credit checks, identity fraud checks and criminal record checks (if and to the extent permitted by applicable laws).

Stakeholders

Our stakeholders are individuals who care about or are affected by what Valterra Platinum does. This includes representatives from various organizations, interest groups, businesses (including schools), government officials at different levels, and members of local communities where we operate.

We collect personal data about stakeholders for the following purposes:

• Stakeholder & Community Engagement
• Stakeholder Profiling and International Government Relations
• Stakeholder Visits, Events & Event Management
• Media Monitoring
• Investigations

General correspondence:

You may decide to write to us, send us an email or contact us by telephone. If you do so, we will process your personal data as needed to respond to your communication. We may also keep records of this communication once our correspondence is completed.

On-site visitors:

We collect personal data for the following purposes:

• Access Control
• Incident Management
• Information Management (Access to guest WI-FI)
• Investigations (Escalating criminal activity to legal authorities & investigating whistleblowing claims)
• Security Threat Monitoring
• Security Clearance Checks
• Site Security (Baggage Checks, License Plate Scanning)
• Visitor Management
• We operate Closed Circuit television (CCTV) systems on our sites (both inside and outside our offices and premises, including our operational sites). This includes CCTV recording of external site areas covering walkways, roads and other public areas. For enhanced security and safety, some of our personnel are also equipped with body worn video cameras.
• To meet legal requirements

Social performance

If you are involved in our social impact initiatives to deliver lasting, positive contribution to local communities and those affected by Platinum Valterra's activities. We collect personal data for the following purposes:

• Background Checks
• Contact Information
• Education and Skills
• Family Information
• Welfare activities.

Insurance:

• We process your personal data in connection with the administration and management of our insurance policies.
• This may include processing your personal data in connection with insurance claims and risk management.

Legal claims and risk management

We process your personal data in connection with our legal rights and obligations.

This includes taking steps to enforce or defend any legal claims made by, against or otherwise involving you.

However, it also includes complying with lawful requests by public authorities (including without limitation to meet national security or law enforcement requirements), discovery requests, or where otherwise required or permitted by applicable laws, court orders, regulations, or regulatory authorities (including without limitation data protection, tax and employment), whether within or outside your country.

This will also include investigations into security or compliance concerns, as appropriate.

If you contact us using the "contact us" section of our Websites

• The personal data that we process to do so will be the personal data that you provide to us, such as your name, your contact details (such as email address and telephone number) and the content of your query.
• If you leave a comment on a blog on our social media channels or on our websites
• The personal data that we process to do so will be the personal data that you provide to us, such as the content of your comment and any personal data you choose to provide.
• If you sign up to subscriber alerts
• The personal data that we process to do so will be the personal data that you provide to us, such as your name, your email address, your country of residence and your occupation.

We process any other personal data which you choose to disclose to us during the course of your use of the Websites, whether through email or otherwise.

We may automatically process some technical data such as your Internet Protocol (IP) address to identify what companies have interacted with the website. This processing only identifies a company name and will not be used to identify an individual.

We use your IP address to track traffic flows and to make our websites easier for you to use and to better understand how our websites are used.

Cookies:

• Cookies can collect your personal data such as IP address, operating system and browser type. Please see our Cookie Policy for details.
• One of the analytics tools that our website uses is Google Analytics, to learn more about Google Analytics, you can visit www.google.com/policies/privacy/partners/
• We also collect, use and share aggregated data such as statistical or demographic data for any purpose. Aggregated data may be derived from your personal data but is not considered personal data in law as this data does not directly or indirectly reveal your identity. For example, we may aggregate your usage data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect aggregated data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this Privacy Policy.

Social Performance

• Education services assessments and income assessments.
• Address, city of residence, country of residence, email address, telephone number, job title/role and organisation.
• Education level, language skill, work history, qualifications/skills, type of school attended, training history.
• Children's age, family member's complaints and grievances, spouse's/civil partner's/partner's national identification number, spouse’s/civil partner’s/partner’s address.
• Details of your complaint or grievance (including bullying and harassment concerns).
• We may collect Sensitive Data relating to your religious or philosophical beliefs, race or ethnic origin, political opinion, trade union membership, sexual orientation and health (including disability status, medical conditions, details about the health of your family member, physical characteristics and psychological impact).
• We may also collect data relating to criminal convictions and offences under some circumstances, for example, where the candidate is successful in applying for one of our Youth Development programmes.
• Financial Information: bank account information, bank statement and credit check status.
• Social: Responses to survey questions, social media profile and opinion/views expressed publicly.
• Reviewing income and education services assessments.
• Collecting contact details like address, phone number, email, job title, and organisation.
• Gathering information about education, language skills, work history, qualifications, and training.
• Recording details about children’s ages, family complaints, and partner’s identification and address.
• Keeping track of complaints, including bullying or harassment issues.
• Collecting sensitive information such as religious beliefs, ethnicity, political views, union membership, sexual orientation, health details (including disabilities, medical conditions, and family health), and physical or psychological effects.
• Gathering legal records if needed, like criminal history, especially for those joining Youth Development programs.
• Managing financial details such as bank account information, bank statements, and credit check results.
• Collecting social information, including survey responses, social media profiles, and publicly shared opinions.

Customer management and administration

• To manage your relationship with us, we process your name, address and email.
• We may also process other personal data regarding you or your colleagues that have been provided to us by you, your colleagues or our customers.

Customer due diligence

The types of personal data we process in connection with these checks depend on our relationship with you or the business that you represent. In particular:

• For individuals dealing with Valterra Platinum, we process: Name; passport number; nationality; date of birth; country of birth; copy of passport; residential address; description of individual’s experience in the industry and supporting documentation; proof of address; source of wealth; details of any companies the individual owns/manages, whether directly or indirectly.
• For directors / beneficial owners of customers and intermediaries, we process: name; nationality; date of birth; % ownership of company (where applicable).
• For individuals completing the form on behalf of the company, we process: name; position in the company.
• In all cases, we process the result of the screening check itself.

Job applicants

• Personal details: your name, gender, nationality, civil/marital status, date of birth, age, personal contact details (e.g. address, telephone or mobile number, e mail), national ID number, immigration and eligibility to work information, driving licence, passport, languages spoken, details of any disability and any reasonable adjustments required as a result;
• Recruitment and selection data: skills and experience, qualifications, references, CV and application, interview and assessment data (including results of psychometric tests, if appropriate), information related to the outcome of your application, interview notes and records, details of any offer made to you;
• Financial information: your bank details, tax information, social security information, student loan information (if applicable) and previous employment details (where relevant);
• Vetting and verification data: vetting and verification information (e.g. results of right to work verification, credit reference check, global watch list check and a basic disclosure criminal record check relating to unspent convictions, where carried out and permitted by applicable law);
• Role information: including job title, start date and salary;
• Equality and diversity data: where permitted by law and provided voluntarily, data regarding gender, age, race, nationality, religious belief and sexuality (stored anonymously for equal opportunities monitoring purposes); and
• Any other personal data which you choose to disclose to us during the course of your application and onboarding, whether verbally or in written form.

Onsite visitors

• Contact Information: email address, telephone number, job title/role and organisation.
• Browsing Information: IP Address, Device ID, Website History
• Personal Identification: name (first name and surname), title, age, gender and photograph
• Social: social media profile, your opinion of Valterra Platinum
• Visit Information: date of visit, reason for visit, time of arrival, time of departure, site location, vehicle license registration plate, access requirements.
• In some cases for sites in South Africa, we may ask visitors to conduct a randomised and mandatory substance test. This is a requirement of the Occupational Health & Safety Act which requires not to admit anyone that appears or may be intoxicated.
• We also process details of our interactions with you.
• We collect and store video footage and images on which you may appear. This may also capture vehicle registration information and in some locations, audio recordings.

We use this personal data to:

• To provide services that you request under an agreement between us.
• To manage and administer your relationship with us, which will be related to the business of the relevant customer or contact.
• We use your personal data to send your targeted marketing information, which is intended to promote our business products and services.
• In order to consider and respond to queries submitted through the website.
• To improve the Websites and provide a better service and source of information to you.
• We undertake customer due diligence to ensure that we are compliant with all applicable legal and regulatory obligations, but also to ensure that we know who we are doing business with. We make decisions relating to our commercial relationships as a result of these checks and the screening process.
• We maintain a contact database of key stakeholder contacts in order to be able to communicate with key stakeholders and interested parties.
• We maintain a media monitoring database to record stakeholders’ opinions of Valterra Platinum and monitor the Company’s reputation in the media.
• We profile stakeholders using publicly available information to understand who our stakeholders are. This is necessary for Valterra Platinum to effectively communicate with stakeholders and government officials.
• We organise corporate events, trips and business activities to manage our relationships with our stakeholders.
• To create profiles of stakeholders in the local communities who are affected by Valterra Platinum operations to monitor opinions or influence particular topics.
• We use your personal data to manage and administer your relationship with us, which will be related to the business of the relevant supplier or subcontractor.
• We undertake supplier due diligence ensure that we are compliant with all applicable legal and regulatory obligations, but also to ensure that we know who we are doing business with. We make decisions relating to our commercial relationships as a result of these checks and the screening process.
• We operate access control systems to prevent unauthorised access to our site operations.
• We collect personal data from you to provide you with an access card.
• We allow visitors to connect to our guest WI-FI network to access the internet. We store information about your device and the activity you undertake on the Guest WI-FI network. This is to monitor compliance with our Terms & Conditions and to prevent and detect crime.
• We manage and report on health and safety incidents that take place at Valterra Platinum that may involve visitors, such as accidents and injuries.
• We operate visitor management systems at our corporate offices to record the individuals who have visited Valterra Platinum.
• To meet regional Health & Safety legal obligations.
• Some of our sites and companies in Europe are required to conduct sanction screening of visitors which involves checking names of visitors against individuals who have been placed on the EU & Terror list.
• We provide the services you ask for under our agreement.
• We manage your relationship with us, based on business needs.
• We use your personal details to send you marketing messages about our products and services.
• We look at and respond to questions you send through our website.
• We work to improve our website so it’s more useful for you.
• We check our customers to follow laws and make sure we know who we’re working with. These checks help us decide on business partnerships.
• We keep a list of important contacts so we can stay in touch with them.
• We track media coverage to see what people think about our company.
• We research public information to understand our key contacts. This helps us communicate with them and government officials.
• We organise events and trips to strengthen relationships with key contacts.
• We gather information on people affected by our business to understand their concerns and viewpoints.
• We handle your relationship with us, which may relate to suppliers or subcontractors.
• We check our suppliers to follow laws and ensure we know who we’re working with. These checks help us decide on business partnerships.
• We use security systems to stop unauthorized people from entering our sites.
• We collect personal details to give you an access card.
• We let visitors use our guest Wi-Fi and store information about their devices and activity to follow our rules and prevent crime.
• We report health and safety issues, like accidents, that affect visitors at Valterra Platinum.
• We record visitor details at our offices for security and tracking.
• We follow health and safety laws.
• Some of our European locations must check visitor names against a security list of restricted individuals.

Area	Details & legal basis
Customer management and Administration	If we are contracting directly with you, we process your personal data in connection with the performance of a contract between us. Otherwise, this processing is necessary for the purpose of the legitimate interests pursued by the Company and its customers and contacts. Where we are required to do so by applicable law, we will get your explicit consent to marketing communications.
Customer Due Diligence	This processing is necessary for the compliance with legal obligations to which the Company is subject. Further, as these checks are a prerequisite to entering into a commercial relationship: where you enter this relationship in a personal capacity, your personal data is processed on the basis that the processing is necessary for the performance of a contract to which you are a party; and where you enter this relationship as a representative of a company, your personal data is processed on the basis of the legitimate interests of both us and your organisation.
Stakeholders	We process your personal data on the basis you have provided consent, or on the basis of our legitimate interests.
Supplier Management and Administration	This processing is necessary for the purpose of the legitimate interests pursued by the Company and its suppliers or subcontractors. Some of this processing may be required as a result of our legal and regulatory obligations, such as those set out in the Mining Charter. If we are contracting directly with you, we process your personal data in connection with the performance of a contract between us.
Supplier Due Diligence	This processing is necessary for the compliance with legal obligations to which the Company is subject. Further, as these checks are a prerequisite to entering into a commercial relationship: Where you enter this relationship in a personal capacity, your personal data is processed on the basis that the processing is necessary for the performance of a contract to which you are a party; and Where you enter this relationship as a representative of a company, your personal data is processed on the basis of the legitimate interests of both us and your organisation.
On-site Visitors	We process your personal data on the basis of our legitimate interests. In some cases, this processing is necessary to protect your vital interests or the vital interests of another natural person. It may be necessary to process your personal data to comply with our legal obligations.
Job Applicants	The processing is necessary for compliance with a legal obligation to which the Company is subject (for example, disclosing the information to any relevant tax and social security authorities, avoiding unlawful discrimination, meeting statutory record keeping requirements or health and safety obligations); and/or Where there is no legal obligation we will process your data where the processing is necessary in order to take steps at your request prior to entering into an employment contract or contract for services or similar (for example collecting bank details to pay your remuneration or processing information to provide you with the contractual benefits you are entitled to); and/or Where the above two grounds do not apply we may process your personal data where the processing is necessary for the legitimate interests pursued by the Company, except where such interests are overridden by your interests or fundamental rights and freedoms which require protection of personal data. The Company considers that it has a legitimate interest in processing data for the purposes set out above. This is necessary to ensure fair and effective recruitment of suitable personnel and the effective reward, administration, support, development and management of applicants. This is important to ensure that the Company continues to meet its business objectives and goals both in the short and long term; maintains its reputation; and continues to attract and retain high caliber applicants. We may on occasion process your personal data for the purpose of legitimate interests pursued by a third party, except where such interests are overridden by your interests or fundamental rights and freedoms which require protection of personal data (for example to meet the security requirements of our clients). In exceptional circumstances where we have no legitimate interest in processing but you ask us to process data for a particular purpose we may carry out the processing on the basis of your consent. Where we rely on this we will make this clear at the time. If applicable privacy law(s) does not enable collection, use and disclosure of personal data upon such legal bases, we will obtain your consent to such processing in accordance with those law(s).
Social Performance	Valterra Platinum processes the following under consent: To communicate with community stakeholders to promote a positive relationship between Valterra Platinum and local communities where mine sites are located. To investigate complaints and grievances to resolve stakeholders’ concerns. Radio competitions and prize-draws ran in order to increase listenership and create a positive opinion of Valterra Platimun in the local community. The physical resettlement of a community to a different location. To provide young people with access to education and work experience. We may collect information about your political opinion and religious or philosophical beliefs if you provide us with this information. Valterra Platinum processes the following under legal obligation: To improve local enterprise skills and identify suitable suppliers for Valterra Platinum. To sponsor individuals’ interests within the community. The funding (loan) aims to encourage the development of local enterprise. The physical resettlement of a community to a different location. Valterra Platinum processes the following under legitimate interest: To provide young people with access to education and work experience. To provide charitable grants to charities and community-based organisations. To support local entrepreneurs to develop their businesses through advice and training. To investigate complaints and grievances to resolve stakeholders’ concerns. To communicate with community stakeholders to promote a positive relationship between Valterra Platinum and local communities where mine sites are located.

If the personal data processing activity falls under any other jurisdiction, the legal basis for processing your data is your Consent. Where you provide us with the personal data of third parties, you confirm that you have obtained the Consent from the third-party individuals for the disclosure of their personal data to the Company for the purposes set out in this Policy.

Yes. Any sensitive personal data will be processed on the basis of your explicit consent.

Personal data relating to criminal convictions and offences will only be processed where authorised by applicable laws and in accordance with applicable laws. For example, a criminal record check may be carried out as part of customer or supplier due diligence.

Where we process personal data regarding criminal offences or convictions in connection with our relationship with you, the legal ground for the same is set out in this Policy.

We collect and record your personal data from a variety of sources, but mainly directly from you. You will usually provide this information directly to a member of our team who will record this information manually or electronically in our systems. For example, you provide us with your personal data when you communicate with Valterra Platinum staff and complete forms at our premises or at off-site locations. We may also collect information when you contact us by email, telephone or complete applications on our website.

We also obtain some information from third parties, including:

• Community Organisations
• Educational Institutions
• Financial Institutions
• Local Authorities
• National Governments
• Non-Governmental Organisations
• Non-Profit Organisations and Foundations
• Social Enterprises

We may collect information about your computer, including where available your IP address, operating system and browser type, for system administration purposes. This is statistical data about your browsing actions and patterns and does not identify you as an individual. The source of personal data gathered by cookies will be you. Some information may also come from analytics providers (such as Google). For further details please see our Cookie Policy.

Internal recipients

Within the Company, your personal data can be accessed by or may be disclosed internally on a need-to-know basis. Your personal data may be accessed by:

• Local, and global departments, including line management and team members;
• Local and executive management responsible for managing or making decisions in connection with your relationship with the Company or when involved in a process concerning your relationship with the Company (including, without limitation, staff from Compliance, Marketing, Legal, Audit and Security);
• System administrators; and where necessary for the performance of specific tasks or system maintenance by staff in teams such as the Finance and IT departments.

Personal data may also be shared with certain interconnecting systems such as the invoicing system or customer management system. In addition to internal recipients, data contained in such systems may be accessible by providers of those systems, their associated companies and sub-contractors.

Where relevant, certain basic personal data (which may include your name, location, job title, contact information and any published skills and experience) may also be accessible to the Company's employees for the purposes set out in this Policy.

External recipients

Your personal data may also be accessed by third parties, including suppliers, advisers, national authorities and government bodies. Third party recipients may include the following:

• service providers;
• tax authorities,
• regulatory authorities,
• our insurers,
• bankers,
• IT administrators,
• lawyers,
• Auditors,
• investors,
• consultants and other professional advisors and
• customers.

Personal data contained in our IT systems may be accessible by providers of those systems, their associated companies and sub-contractors (such as those involved with hosting, supporting and maintaining the framework of our information systems).

We expect these third parties to process any data disclosed to them in accordance with the contractual relationship we have with them and applicable law, including with respect to data confidentiality and security. Where appropriate, the third parties set out above have agreed to confidentiality restrictions and use any personal data we share with them or which they collect on our behalf solely for the purpose of providing the contracted service to us.

In addition, we may share personal data with national authorities in order to comply with a legal obligation to which we are subject. This is for example the case in the framework of imminent or pending legal proceedings or a statutory audit.

There are circumstances where we may need to disclose your personal data to third parties, to help manage our business and deliver our services. We may disclose your personal data to third parties if:

• We sell or buy any business, in which case we may disclose your personal data to the prospective seller or buyer of such business; Valterra Platinum, any relevant group company or substantially all of its assets are acquired by a third party, in which case personal data held by it about you will be transferred to that third party;
• we are under a duty to disclose or share your personal data in order to comply with any legal or regulatory obligation, or in order to enforce or apply our legal rights, in which case we may share your personal data with our regulators and law enforcement agencies in the EEA and around the world, or to our legal advisers;
• it is necessary to protect the rights, property, or safety of Valterra Platinum or any member of the Valterra Platinum, our customers, suppliers or others, in which case we may disclose your personal data to our legal advisers and other professional services firms; and
• they provide services to us connected with your relationship with us.

Where these third parties (or any others) act as a data processor (for example, an IT vendor), they carry out their tasks on our behalf and upon our instructions for the reasons that we have set out in this Policy. In this case your personal data will only be disclosed to these parties to the extent necessary to provide the required services.

We share your personal data within Valterra Platinum as set out in this Policy (see "When do you share my information with others?"). Some of the people who access your personal data may not be in the same country as you. In particular, your data may be shared within our group to managers and other employees based in the UK, South Africa, Zimbabwe, Singapore, China and other countries in which Valterra Platinum operates or does business.

Any transfers within Valterra Platinum will be covered by an intra-group agreement which gives specific contractual protections to ensure that your personal data receives an adequate and consistent level of protection wherever it is transferred within the group.

In addition, some of the external organizations we share your personal data with (see "When do you share my information with others?") may not be in the same country as you. We will always take steps to ensure that any transfer of information outside of your country is carefully managed to protect your privacy rights:

• We will only transfer personal data to countries which are recognized as providing an adequate level of legal protection or where we can be satisfied that alternative arrangements are in place to protect your privacy rights,
• Transfers to service providers and other third parties, including to the US, will be protected by contractual commitments (such as the European Commission-approved Standard Contractual Clauses), and certification schemes.
• Any requests for information we receive from law enforcement or regulators will be carefully checked before personal data is disclosed.

If you have any questions regarding overseas transfers, please contact us for further details.

As set out above, if you sign up to our subscriber alerts, we will use your personal data to let you know about our products and services that we believe will be of interest to you. We will do so by email. We will respect your preferences for how you would like us to manage marketing activity with you.

To protect privacy rights and to ensure you have control over how we manage marketing with you:

• We will take steps to limit direct marketing to a reasonable and proportionate level and only send you communications which we believe may be of interest or relevance to you;
• You can ask us to stop direct marketing at any time - you can ask us to stop sending email marketing, by following the "unsubscribe" link you will find on all the email marketing messages we send you. Alternatively, you can contact us. Please specify whether you would like us to stop all forms of marketing or just a particular type; and
• You can change the way your browser manages cookies, which may be used to deliver online advertising, by following the settings on your browser as set out in our Cookie Policy.
• We recommend you routinely review the Privacy Policy and preference settings that are available to you on any social media platforms as well as your preferences within your account with us.

• Automated decision-making takes place when an electronic system uses personal data to make a decision without human intervention. We do this only where we have your consent (if required by applicable laws), or where it is necessary to perform the contract with you and appropriate measures are in place to safeguard your rights.
• When recruiting for certain roles, we may automatically reject applicants based on their answers to some screening questions. This will happen where there are legal requirements pertaining to the role (e.g. right to work or minimum qualifications or certifications). If this applies, the candidate will be unsuccessful in their job application. All requirements of the role will be clearly articulated in the job description.
• For certain roles, we may use artificial intelligence to scan job applications and CVs to assess their alignment with the requirements of the role, as described in the job description. This will result in applicants being ranked based on the outcome of the scanning. Hiring decisions will then be made by a human being.
• In a limited number of cases, we may also automatically reject applicants if they do not achieve a pass score in an assessment test that they take as part of the application process. If this applies, the applicant will be unsuccessful in their job application.
• In any specific situation described above and subject to local laws, you have 21 days to request a reconsideration of any decision taken by automated means.

Whether these rights apply to you will depend on the nature of the personal data processing activity, and the jurisdiction in which the processing takes place:

Right to access and correct your personal data:

• The Company aims to ensure that all personal data is correct. You also have a responsibility to ensure that changes to your personal data are notified to the Company as soon as possible so that we can ensure that your data is up-to-date.
• You have the right to request access to any of your personal data that the Company may hold, and to request correction of any inaccurate data relating to you.
• You should note that we do not always need to comply with your requests, but we will ensure that this is explained to you if this is the case.

Data portability:

• Where we are relying upon your consent or the fact that the processing is necessary for the performance of a contract to which you are party as the reason or legal ground for processing, and that personal data is processed by automatic means, you have the right to receive all such personal data which you have provided to the Company in a structured, commonly used and machine-readable format, and also to require us to transmit it to another controller where this is technically feasible.

Right to rectify or erase personal data:

You have a right to request that we rectify inaccurate personal data. We may seek to verify the accuracy of the personal data before rectifying it.

You can also request that we erase your personal data in limited circumstances where:

• it is no longer needed for the purposes for which it was collected; or
• you have withdrawn your consent (where the data processing was based on consent); or
• you have made a successful objection (see right to object below); or
• it has been processed unlawfully; or
• it is necessary to comply with a legal obligation to which we are subject.

We are not required to comply with your request to erase personal data if the processing of your personal data is necessary:

• for compliance with a legal obligation; or
• for the establishment, exercise or defence of legal claims.

Right to restriction of processing

You have the right to restrict our processing of your personal data but only where:

• you contest the accuracy of the personal data, pending us taking sufficient steps to correct or verify its accuracy;
• the processing is unlawful but you do not want us to erase the data;
• we no longer need the personal data for its original purpose, but we require it for the establishment, exercise or defence of legal claims; or
• you have objected to processing justified on legitimate interest grounds (see below), pending verification as to whether the Company has compelling legitimate grounds to continue processing.

Where personal data is subjected to restriction in this way, we will only process it with your consent; for the establishment, exercise or defence of legal claims; or to protect the rights of another natural or legal person.

Right to withdraw consent:

• Where you have provided us with your consent to process data, you have the right to withdraw such consent at any time. You can do this by (i) in some cases deleting the relevant data from the relevant IT system (although note that in this case it may remain in back-ups and linked systems until it is deleted in accordance with our policy) or (ii) contacting us . In some cases, your withdrawal of consent may mean that we will no longer be able to continue our relationship with you. We will always inform you of the likely consequences of your withdrawal of consent.

Right to object to processing justified on legitimate interest grounds:

• Where the reason for processing your personal data is our legitimate interests, you have the right to object to that processing. If you object, we must stop that processing unless we can either demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or where we need to process the data for the establishment, exercise or defence of legal claims. Where we rely upon legitimate interest as the legal ground for processing, we believe that we can demonstrate such compelling legitimate grounds, but we will consider each case on an individual basis.

Right to object to automated decision making:

• You have the right to object to any decision that significantly affects you being taken solely by a computer or other automated process. In such a case, you have the right to obtain human intervention, to express your point of view, and to contest the automated decision.

Right to object to how we use your personal data for direct marketing purposes:

• You can request that we change the manner in which we contact you for marketing purposes. You can request that we not transfer your personal data to unaffiliated third parties for the purposes of direct marketing or any other purposes.

Right to obtain a copy of personal data safeguards used for transfers outside your jurisdiction:

• You can ask to obtain a copy of, or reference to, the safeguards under which your personal data is transferred outside of the EEA. We may redact data transfer agreements to protect commercial terms.

Right to complain to a supervisory authority

• You also have the right to lodge a complaint with a supervisory authority, in particular in your country of residence, if you consider that the processing of your personal data infringes applicable law.

Further information

For further information regarding your rights, or to exercise any of your rights, please contact us.

If you wish to exercise your rights, you should contact us or make contact with your usual Valterra Platinum contact or manager or email the Data Protection team on the following address dataprotection@valterraplatinum.com.

We may ask you for proof of identity when making a request to exercise any of these rights. We do this to ensure we only disclose information or change account details where we know we are dealing with the right individual.

We will not ask for a fee, unless we think your request is unfounded, repetitive or excessive, or where charging a fee is otherwise permitted under applicable privacy legislation. Where a fee is necessary, we will inform you before proceeding with your request.

We aim to respond to all valid requests within one month. It may however take us longer if the request is particularly complicated or you have made several requests. We will always let you know if we think a response will take longer than one month. To speed up our response, we may ask you to provide more detail about what you want to receive or are concerned about.

We may not always be able to fully address your request, for example, if it would impact the duty of confidentiality we owe to others, or if we are otherwise legally entitled to deal with the request in a different way.

Valterra Platinum is committed to protecting the security of the personal data you share with us or we otherwise process about you. In support of this commitment, we have implemented appropriate technical, physical and organisational measures to ensure a level of security appropriate to the risk.

We will retain your personal data for as long as is reasonably necessary for the purposes explained in this Policy.

In some circumstances we may retain your personal data for longer periods of time than is needed for those purposes described in this Policy. For instance: where we are required to do so in accordance with legal, regulatory, tax or accounting requirements; to ensure that we have an accurate record of your dealings with us in the event of any complaints or challenges; or if we reasonably believe there is a prospect of litigation relating to your relationship with us.

We maintain policies governing the creation, retention and disposal of records in our care. These policies set out our requirements for the management of records, including guidance on keeping personal data as current as possible, securely deleting records and irrelevant or excessive data, and storing information anonymously or in a manner which no longer identifies you.

We may amend this Policy from time to time, for example, to keep it up to date or to comply with legal requirements or changes in the way we operate our business.

Should we change our approach to data protection, you will be informed of these changes or made aware that we have updated the Privacy Policy so that you know which personal data we process and how we use this information.

We may undertake certain processing of personal data which are subject to additional Privacy Policies and we shall bring these to your attention where relevant.

This Privacy Policy was last reviewed and updated 13 May 2025.