Effective from 1 July 2024
1 INTRODUCTION
Sibanye-Stillwater European Region (“Sibanye-Stillwater“, “we“, or “us“), is committed to protecting the privacy of website visitors and business partners. This Privacy Notice (“Notice”) is applicable to personal data collected from (i) website visitors on our website www.sibanyestillwater.com, (ii) personnel, representatives and other authorized persons working under or in relation to our business partners (e.g., suppliers, customers, and other business contacts), and (iii) private landlords. This Notice is applicable to all Sibanye- Stillwater group companies and/or branches located within the EU, European Economic Area (“EEA”) and UK.
This Notice explains how we collect and use personal data and what rights you have under applicable data protection laws, including the EU General Data Protection Regulation (2016/679, “GDPR”) and the UK GDPR (that is, the retained UK version of the EU GDPR, as amended) as well as local laws and regulations supplementing the GDPR. The last section of this Notice amends and/or clarifies the information in the Notice to reflect local deviations from the Notice applicable to the individual Sibanye-Stillwater group company alone.
2 CONTROLLER AND CONTACT DETAILS
Our business partners: The controller of your personal data will be the relevant local Sibanye- Stillwater group company who you have a business relationship with or otherwise engage with. In case more than one Sibanye-Stillwater company engages with a business partner, Sibanye-Stillwater group companies act as joint controllers.
Website: Sibanye-Stillwater group companies act as joint controllers in relation to our website. This means that we decide together why and how your personal data is processed and are jointly responsible to you under applicable data protection laws.
For the purpose of this Notice, Sibanye-Stillwater consists of the following group companies:
- Sibanye Europe Oy
- Keliber Oy
- Keliber Technology Oy
- Sibanye UK Limited
- Sibanye Stillwater Sandouville Refinery
- Sibanye France SAS
Should you have any questions regarding the processing of your personal data or if you wish to use your rights under applicable data protection laws, please contact our Compliance Officer at privacyeu@sibanyestillwater.com. Alternatively, your local contact point and contact details are described in Section 10 below.
3 PURPOSES AND LEGAL BASIS OF THE PROCESSING OF PERSONAL DATA
This Section will explain what personal data we collect, for what purpose, on what legal basis and for how long we store your personal data. First part is applicable to the processing of partner personal data while the second part applies to website visitors.
PART I – BUSINESS PARTNERS
3.1 Selection and management of business relationship
We process personal data for the purpose of business partner selection, including tendering, evaluation, and vetting. Our supplier vetting process may include verification of relevant documentation (e.g. licenses and certifications), financial data on the company and occasionally security screenings as permitted by local law.
Further, we process personal data during our business relationship to communicate with our business partners, manage projects, process payments and complaints, carry out accounting and audits and other necessary measures relating to the business relationship.
| Categories of personal data | Legal basis |
| – Name – Contact details – Identification data – Organisation data (incl. contract) – Payment and accounting data – Communication data – Vetting data – Security screening data (if applicable) | Legitimate interest. Legitimate interest. The processing is necessary to fulfil our legitimate interest to (i) evaluate and select reliable business partners and mitigate associated risks (ii) conclude a contract with the business partner and (iii) manage our relationship with relevant business partners, with whom we have any engagements or agreements with. (GDPR Art. 6(1)(f)). |
| Exemption for special categories of data | |
| Criminal offence data is processed only as permitted by local law (GDPR Art. 10). | |
| Retention period | |
| Your personal data is retained during the term of the contract or as long as we engage with you. Payment and accounting data is retained as required by local accounting and tax laws. We note that we retain company data (non-personal) longer than stated here. Personal data relating to unsuccessful tenders and prospect data is retained no more than three years after the last contact. | |
3.2 Enable payments for mining extraction and research on the property (Finland)
| Categories of personal data | Legal basis |
| – Name – Contact details – Contract data – Payment and accounting data – Property data | Legal obligation. The processing is necessary to fulfil our legal obligations to which Sibanye- Stillwater is subject to regarding inter alia to compensate landlords for mining on their properties (GDPR Art.6(1)(c)). |
| Exemption for special categories of data | |
| N/A | |
| Retention period | |
| Your personal data is retained for as long as necessary to fulfil our legal obligation. This means at least for as long as we carry on mining and/or research on the property and have related reimbursements pending. Payment and accounting data related to your property is retained in accordance with local accounting laws. | |
3.3 Marketing and management of events
We process personal data for marketing and external communication purposes, which includes maintaining our contact lists and communicating with you with respect to announcements, newsletters and events, and provide other information which may be of interest to you. Further, we process your personal data for the purposes of arranging the events. We may take photos at our events and use them in our external communications.
| Categories of personal data | Legal basis |
| – Name – Contact details – Organisation data – Dietary preferences – Marketing data – Communication data – Photo(s) | Legitimate interest. The processing is necessary to fulfil our legitimate interest of communicating with you and inviting you to and arranging events. (GDPR Art. 6(1)(f)). Consent. The use of photos where you may be identified is based on your consent. (GDPR Art. 6(1)(a)). |
| Exemption for special categories of data | |
| We do not actively collect special categories of personal data for the said purpose. However, your dietary preferences may include special categories of data (e.g. allergies or health conditions) which is processed based on your explicit consent. (GDPR Art.9(2)(a)). | |
| Retention period | |
| Prospect data for marketing purposes is retained as long as necessary but no more than three years after the last contact. Dietary preferences are retained until the event is arranged. | |
3.4 Video surveillance and access control
We operate video surveillance and access control on our sites and premises to prevent unauthorized access to our workplace facilities and sites, to supervise proper operation of production processes, for detection and prevention of crime, to ensure protection of property and health and safety at sites.
| Categories of personal data | Legal basis |
| – Camera footage – Access control data | Legitimate interest. The processing is necessary to fulfil our legitimate interest to supervise the proper operation of production processes and ensure protection of property, health and safety at our sites and premises and detection and prevention of crime. (GDPR Art. 6(1)(f)) |
| Exemption for special categories of data | |
| In case any data about suspected or actual criminal activities will be handled in connection with an investigation, it will be processed only to the extent necessary to establish, exercise and defend legal claims. (GDPR Art. 9(2)(f)) | |
| Retention period | |
| Camera footage is retained only for the duration necessary to fulfil the purposes above, generally no more than a month. It may be retained for longer in the event of an incident, legal proceedings or similar reasons. | |
3.5 Groupwide compliance programs
Sibanye-Stillwater group companies act as joint controllers when they provide a whistleblowing channel that enable the reporting of suspicions of misconduct, disloyalty, and/or policy breaches.
| Categories of personal data | Legal basis |
| – Name and contact details – Whistleblowing data | Legitimate interest. The processing is necessary to fulfil our legitimate interest to prevent misconduct and unlawful actions as well as make sure our policies are followed. (GDPR Art. 6(1)(f)) |
| Exemption for special categories of data | |
| In case any data about suspected or actual criminal activities will be handled in connection with an investigation, it will be processed only to the extent necessary to establish, exercise and defend legal claims. (GDPR Art. 9(2)(f)) | |
| Retention period | |
| Personal data is retained during the period necessary to fulfil the specified purpose and/or establish, exercise and defend the legal claim, within local statutory limitations. | |
3.6 Establish, exercise and defend legal claims
For establishing, exercising and defending legal claims, (for example in connection with a dispute or legal process) we may process your personal data.
| Categories of personal data | Legal basis |
| – Name – Contact details – Organisation data – All data that is necessary to fulfil the specified purpose | Legitimate interest. The processing is necessary to fulfil our legitimate interest to establish, exercise or defend the legal claim, for example in connection with a dispute or legal process (GDPR Art.6(1)(f)). |
| Exemption for special categories of data | |
| In case any special categories of data or data about suspected or actual criminal activities will be handled in connection with an investigation, it will be processed only to the extent necessary to establish, exercise and defend legal claims (GDPR Art.9(2)(f)). | |
| Retention period | |
| Your personal data is retained during the period necessary to establish, exercise and defend the legal claim, within local statutory limitations. | |
3.7 Fulfil legal obligations
We will process your personal data for the purpose of fulfilling legal obligations within the area of e.g., accounting, taxation, and environment.
| Categories of personal data | Legal basis |
| – Name – Contact details – Organisation data – Payment and accounting data – Property data | Legal obligation. The processing is necessary to fulfil our legal obligations (GDPR Art. 6(1)(c)). |
| Exemption for special categories of data | |
| N/A | |
| Retention period | |
| Your personal data is retained for as long as necessary to fulfil the legal obligations that we are subject to. For example, accounting material is retained as required by local accounting laws. | |
PART II – WEBSITE VISITORS
3.8 Management of our website
We will process your personal data when you visit our website or fill out a form or otherwise contact us on our website.
| Categories of personal data | Legal basis |
| – Name – Contact details – Organisation data – Technical data related to website management | Legitimate interest. The processing is necessary to fulfil our legitimate interest of providing you the website and monitoring the performance of our website from IT security perspective (GDPR Art. 6(1)(f)). |
| Exemption for special categories of data | |
| N/A | |
| Retention period | |
| Your personal data is retained for as long as necessary to respond to your request. If we engage in a business relationship with you, personal data will be retained in accordance with Section 3.1 of this Notice. Data collected via cookies is retained in accordance with our Cookie Policy. | |
3.9 Improve your experience on our website
When you visit our website, we collect and store IP addresses browser type, operating system and other usage information about your use of our website, including a history of the pages you view to help us design our website to better suit our website visitors’ needs. We may also use the data to help diagnose problems with our server, analyse trends, track visitor movements, and gather broad demographic information that assists us in identifying visitor preferences.
For statistical purposes we store information about how many individual visitors we have to our website, and how often these individual users visit our website. We collect and store this information to better understand our website visitors needs and interests, so that we can develop and improve our services in the future. For more information about our use of cookies, please read our Cookie Policy.
| Categories of personal data | Legal basis |
| – User generated data – Analytics data | Consent. We collect information via the use of optional cookies based on your consent. For more information about our use of cookies, please read our Cookie Policy. |
| Exemption for special categories of data | |
| N/A | |
| Retention period | |
| Data collected via optional cookies is retained in accordance with our Cookie Policy. Reports and statistics on an aggregated level (i.e., non-personal data) will be retained until further notice. | |
4 REGULAR SOURCES OF DATA
We collect your personal data from:
Yourself, when you visit our website, communicate with us, sign up for an event organised by us or otherwise engage with us during our business relationship.
Business partner, which, inter alia, may include personnel and authorized persons working under or in relation to the business partners (e.g., suppliers, customers, and other business contacts).
Public authorities, for the purposes of taxation, accounting, mining extraction and fulfilling related legal obligations.
Public and private registers and auditors, for the purpose of business partner vetting and auditing.
You can always choose not to provide us with voluntary information e.g. referred in Sections 3.3 and 3.8. However, personal data processed for purposes referred in Sections 3.1–3.2 and 3.5–3.7 in this Notice are strictly necessary for us to initiate or carry out the business relationship with our business partner, to comply with legal obligation or to manage our website. Not providing such personal data may prevent us from concluding a contract with our business partner or fulfilling our contractual or legal obligations.
5 DATA DISCLOSURES AND TRANSFERS OUTSIDE OF THE EU/EEA
(i) Between Sibanye-Stillwater group companies
Sibanye-Stillwater group companies may disclose and share personal data to other companies belonging to the same group e.g. for the purpose of providing our website. Data disclosures are based on our legitimate interest to centralise common administrative tasks and to manage and maintain group-wide systems, such as our website and to create efficiency gains benefitting all group companies involved.
(ii) Third parties
Sibanye-Stillwater uses external parties such as service providers that we have engaged. These parties provide services within the areas of, inter alia, IT (such as data storage, support, and management services) and finance (e.g., book-keeping systems). These external parties will act as data processors of Sibanye-Stillwater and may only process your personal data in accordance with our instructions, appropriate confidentiality and not for their own purposes.
In addition, we may also disclose your personal data to third parties in the following circumstances:
- when required to do so by law;
- in response to a legitimate request for assistance by the police or other law enforcement agency;
- to seek legal advice from our external advisors (e.g. lawyers or auditors) or in connection with litigation with a third party;
- in connection with the sale, purchase or merger of a business; and/or
- to provide a third party (such as a potential supplier or customer) with a means of contacting you in the normal course of business, for example, by providing your contact details, such as your business phone number and email address.
6 TRANSFERS OUTSIDE OF THE EU/EEA/UK
We use third-party service providers who process personal data outside the UK and the EU/EEA. Where we do, for transfers to service providers in territories which are not considered adequate by the European Commission or (where UK GDPR apply) the UK Information Commissioner, our service providers have adopted Standard Contractual Clauses to ensure appropriate and lawful protection of personal data.
Any personal data shared or disclosed to Sibanye-Stillwater Limited in South Africa or other group companies in USA or Australia entail transfers to countries outside of the UK and EU/EEA. Therefore, Sibanye-Stillwater group companies have entered into the intra-group data processing agreement, which also adopts Standard Contractual Clauses to ensure adequate level of data protection.
7 PRINCIPLES OF HOW THE PERSONAL DATA IS SECURED
Personal data will be processed lawfully, fairly and in a transparent manner, collected for specified, explicit and legitimate purposes, and will not be further processed in a manner that is incompatible with said purposes mentioned in this Notice. We will only process adequate and relevant personal data, limited to what is necessary in relation to the purposes for which it is processed.
We use appropriate technical and organisational measures designed to protect the personal data that are collected and processed. The measures used provide an adequate level of security for the processing of the personal data of the data subjects.
Only individuals, who due to their duties as employees, are authorised to access the personal data are entitled to process the personal data. The data is protected by firewalls, access control (personal usernames and passwords) and other adequate technical means.
8 YOUR RIGHTS
Under Applicable Data Protection Laws, you have certain rights in relation to the processing of your personal data. We process your personal data to the extent necessary to fulfil your rights. Please note that all of these rights are not absolute and some of these rights may be overridden by our legitimate rights. These rights include:
| Access | You may request confirmation whether personal data about you is processed by us and, if that is the case, access your personal data and additional information regarding the operation, such as the purposes of the processing. You are also entitled to receive a copy of the personal data undergoing processing. |
| Object to certain processing | You have the right to object to the processing of your personal data based on a legitimate interest for reasons which concern your particular situation. In such a situation, we will stop using your personal data where the processing is based on a legitimate interest, unless we can show that the interest overrides your privacy interest or that the use of your personal data is necessary to manage or defend legal claims. |
| Rectification | You have the right to obtain from us the rectification of inaccurate personal data concerning you. |
| Erasure | You may have your personal data erased under certain circumstances, such as when your personal data is no longer needed for the purposes for which it was collected. Certain personal data cannot be deleted e.g., when we are under a legal obligation to process the data. |
| Restriction of processing | You may ask us to restrict the processing of your personal data (for example, to only comprise storage of your personal data under certain circumstances), such as when the processing is unlawful, but you do not want your personal data erased. |
| Withdrawal of consent | You have the right to at any time withdraw your consent to the processing of personal data to the extent the processing is based on your consent. This would not affect the lawfulness of the processing based on your consent prior to the withdrawal. |
| Data Portability | You have the right to receive the personal data concerning you which you have provided to us, in a structured, commonly used, and machine-readable format and ask for the information to be transferred to another data controller (where possible). This right is only applicable to personal data we have collected based on your consent or contract with you. |
In case of any complaints regarding Sibanye-Stillwater’s privacy practices, you have the right to lodge a complaint with the competent supervisory authority. For more information, please check the contact details provided in Section 10 and visit the relevant authority’s website.
9 CHANGES TO THIS NOTICE
This Notice is subject to change. You will be adequately notified of any changes to this Notice unless such changes are non-material or insignificant.
10 LOCAL CONSIDERATIONS
The purpose of this Section 10 is to amend and/or clarify the information provided in the Notice, to the extent set forth below, in order to reflect national deviations coming from local regulation that have an effect in the processing activities and the collection of your personal data. As indicated below, Sections 10.1 to 10.3 apply only in their respective countries.
10.1 Finland
10.1.1 Data controller and contact details
Local contact point:
| Company name and business ID | Address |
| Keliber Oy (0752546-7) | Toholammintie 496, 69600 Kaustinen |
| Keliber Technology Oy (2914395-3) | Toholammintie 496, 69600 Kaustinen |
| Sibanye Europe Oy (3283284-8) | Siltasaarenkatu 6-10, 00530 Helsinki |
- Finland-specific deviations
| Section reference | Deviation |
| 3.1 – Selection and management of business relationship | Legal obligation. The supplier vetting is also necessary to comply with legal obligations to which Sibanye- Stillwater is subject to inter alia contractors’ obligations under the Finnish Act on Contractor’s Liability. |
| 8 – Your rights | The competent data protection authority in Finland is the Data Protection Ombudsman (www.tietosuoja.fi). |
10.2 France
10.2.1 Data controller and contact details
Local contact point:
| Company name and business ID | Address |
| Sibanye France SAS (921 917 639 RCS Le Havre) | Zone Industrielle portuaire du Havre Port 5059, 76430 Sandouville, France |
| Sibanye Stillwater Sandouville Refinery (817 398 993 RCS Paris) | Zone Industrielle portuaire du Havre Port 5059, 76430 Sandouville, France |
| Sibanye Europe Oy (3283284-8) | Siltasaarenkatu 6-10, 00530 Helsinki |
10.2.2 France-specific deviations
| Section reference | Deviation |
| 8 – Your rights | The competent data protection authority in France is Commission Nationale de l’Informatique et des Libertés (www.cnil.fr/fr). |
10.3 UK
10.3.1 Data controller and contact details
Local contact point:
| Company name and business ID | Address |
| Sibanye UK Limited (00103002) | Address: 22 King Street, 22, James’s, London SW1Y 6QY, UK |
10.3.2 UK-specific deviations
| Section reference | Deviation |
| 2 – Controller | Sibanye UK Limited is a corporate extension of the parent company Sibanye-Stillwater (South Africa). Therefore, the aforementioned group companies process UK personal data together as joint controllers. |
| 8 – Your rights | The competent data protection authority in the UK is the Information Commissioner’s Office (www.ico.org.uk). |
