Privacy Statement

This Privacy Statement applies to Sibanye Stillwater Limited
Registration Number 2014/243852/06
(“Sibanye-Stillwater”)
including all subsidiaries

The latest version of this statement is available for inspection at the Company and is available on the Company website at www.sibanyestillwater.com.

Introduction

1. For purposes of this Statement:
   • “Applicable Laws” means all laws, regulations that Sibanye-Stillwater is required to comply with;
   • “Data Subject” means “Employee”, “Vendor”, “Contractor and Contractor employee’’, “Visitor”, “Customer”, “Third-party” or “you” as referred to in the Privacy Statement; and
   • “Sibanye-Stillwater” or “we” or “us” means Sibanye Stillwater Limited and its direct and indirect subsidiaries.
2. This Statement sets out how your personal information will be used by Sibanye-Stillwater and applies to any information, including personal and special personal information, you give to us or which we may collect from third parties.
3. It is important that you read this Statement carefully before sharing any personal information with Sibanye-Stillwater.
4. By sharing any personal information with us, you agree to the processing of your personal information as set out in this Statement.
5. The provisions of this Statement are subject to mandatory, unalterable provisions of Applicable Laws.

How to contact us

If you have any comments or questions about this Statement, please contact the Deputy Information Officer at:

Physical address:	Libanon Business Park,1 Hospital Street (Off Cedar Avenue), Libanon, Westonaria, 1779
Postal address:	Private Bag X5, Westonaria, 1780
Telephone number:	+27 11 278 9600
E-mail:	privacy@sibanyestillwater.com

Amendment of this Statement

1. We may amend this Statement from time to time for any of the following reasons:
   • to provide for the introduction of new systems and methods of operation;
   • to comply with changes to any legal or regulatory requirement;
   • to ensure that our Statement is clearer and more favourable to you;
   • to rectify any inaccuracies that may be discovered from time to time; and/or
   • for any other reason which Sibanye-Stillwater, in its sole discretion, may deem reasonable or necessary.
2. Any such amendment will come into effect and become part of any agreement you have with us when notice is given to you of the change by publication on our website. It is your responsibility to check the website often.

Privacy and indemnity

1. Sibanye-Stillwater takes your privacy and the protection of your personal information very seriously, and we will only use your personal information in accordance with this Statement and applicable information protection legislation. It is important that you take all necessary and appropriate steps to protect your personal information yourself (for example, by ensuring that all passwords and access codes are kept secure).
2. We have implemented reasonable technical and operational measures to keep your personal information secure.
3. You hereby indemnify and hold Sibanye-Stillwater harmless from any loss, damages or injury that you may incur as a result of any unintentional disclosures of your personal information to unauthorised persons or the provision of incorrect or incomplete personal information to Sibanye-Stillwater.

Information of children

We do not intend to collect and/or process any personal information of minors, unless we make this clear. If you do provide any personal information of children, you must consent to us processing this information as set out in this Statement.

Information which we may collect about our Data Subjects

1. We may collect the following information about you:
   • your name, surname, title, address details, contact details, date of birth, age, place of birth, nationality, gender, identity number, passport number, work permit number, industry number, bank account details, vehicle registration number, details about your employment history, tax number and financial information, education-, qualification-, and skills and training history, as well as assessment results;
   • Company name, company registration number, company service category details, contact details, address details, Tax/VAT numbers, financial information, director information, criminal record, share certificates and Broad Based Black Economic Empowerment (BBBEE) status;
   • records of correspondence or enquiries from you or anyone acting on your behalf;
   • details of transactions you carry out with us;
   • details of contracts, sales or leases you conclude with us; and
   • sensitive or special categories of personal information, including biometric information (such as images, fingerprints and X-rays), ethnicity and race, health information, union membership and criminal behaviour and records.
2. Where you provide us with the personal information of third parties (spouse, dependent, beneficiary, relative and/or next of kin), you should take steps to inform the third party that you need to disclose their details to us, and identify us to your third-parties. We will process their personal information in accordance with this Statement.

How we collect your information

1. You may provide personal information to us either directly or indirectly, whether in writing, through our website, over the telephone or any other means.
2. We may also collect your personal information from your appointed agent, any regulator, or other third party that may hold such information.

Use of information collected

1. We may use, transfer and disclose your personal information for the purposes of:
   • concluding and executing an employment contract with you;
   • fulfilling a business agreement and matters relating to the agreement;
   • detecting and preventing fraud and money laundering and/or in the interest of security and crime prevention;
   • assessing and dealing with complaints and requests;
   • operational, marketing, auditing, legal and record keeping requirements;
   • due diligence, statistical and research purposes;
   • verifying your identity or the identify of your beneficial owner;
   • transferring or processing your personal information outside of the Republic of South Africa to such countries that may not offer the same level of data protection as the Republic of South Africa, including for cloud storage purposes and the use of any of our websites. If this happens, we will ensure that anyone to whom we pass your information agrees to treat your information with the same level of protection as if we were dealing with it;
   • complying with Applicable Laws, including lawful requests for information received from local or foreign law enforcement, government and tax collection agencies;
   • recording and/or monitoring your electronic communications to/with Sibanye-Stillwater in order to accurately carry out your instructions and requests, to use as evidence and in the interest of crime prevention;
   • conducting market research to improve or evaluate the effectiveness of Sibanye-Stillwater’s business or products, services or offerings;
   • disclosing your personal information to third parties for reasons set out in this Statement or where it is not unlawful to do so;
   • monitoring, keeping record of and having access to all forms of correspondence or communications received by or sent from Sibanye-Stillwater or any of its employees, agents or contractors, including monitoring, recording and using as evidence all communications between you and Sibanye-Stillwater; and
   • prevention and control of any disease.

Disclosure of your information

1. Your personal information may be shared with Sibanye-Stillwater’s subsidiaries, our agents and selected third parties who process the information on our behalf.
2. We may also disclose your personal information to third parties in the following circumstances:
   • to assess, verify and monitor any of your applications;
   • for purposes of prevention, detection and reporting of fraud and criminal activities, the identification of the proceeds of unlawful activities and the combatting of crime;
   • to any regulator or supervisory authority, including those in foreign jurisdictions, if Sibanye-Stillwater is required to do so in terms of Applicable Laws;
   • to a prospective buyer or seller of any of our businesses or assets;
   • to any person if we are under a duty to disclose or share your personal information in order to comply with any Applicable Laws, or to protect the rights, property or safety of Sibanye-Stillwater, other clients or other third parties; and/or
   • to your agent or any other person acting on your behalf.
3. We may transfer your information to another of Sibanye-Stillwater’s entities, an agent, or third party who carries on business in another country, including one which may not have data privacy laws similar to those of the Republic. If this happens, we will ensure that anyone to whom we pass your information agrees to treat your information with the same level of protection as if we were dealing with it.
4. If you do not wish us to disclose this information to third parties, please contact us at the contact details set out above.

Retention of your information

We may retain your personal information indefinitely, unless you object, in which case we will only retain it if we are permitted or required to do so in terms of Applicable Laws. However, as a general rule, we will retain your information in accordance with retention periods set out in Applicable Laws, unless we need to retain it for longer for a lawful purpose (for example, for the purposes of complaints handling, legal processes and proceedings).

How we safeguard your personal information

We have implemented generally accepted standards of technology and operational security in order to protect the personal information we process from unauthorised access, loss, destruction, alteration or misuse. We, on an ongoing basis, review our security controls and related processes to ensure that your personal information is secure.

• Physical and logical security;
• Computer and network security;
• Secure communications;
• Security in contracting out activities or functions;
• Retention and disposal of personal information;
• Acceptable usage;
• Governance and regulatory issues;
• Monitoring access and usage of personal information; and
• Investigating and reacting to security breaches and/or incidents.

Access to, correction and deletion of your personal information

1. You have the right, having provided adequate proof of identity, to:
   • request Sibanye-Stillwater to confirm, free of charge, whether or not we hold personal information about you; and
   • request from Sibanye-Stillwater the record or a description of the personal information, including information about the identity of all third parties or categories of third parties, who have or have had, access to the information.
2. You may request the correction of personal information Sibanye-Stillwater holds about you. Please ensure that the information we hold about you is complete, accurate and up to date.
3. You have a right in certain circumstances to request the destruction or deletion of and, where applicable, to obtain restriction on the processing of personal information held about you. The request will be subject to the lawfulness of the processing of personal information before such destruction or deletion will be affected.
4. You have a right to object on reasonable grounds to the processing of your personal information where the processing is carried out in order to protect our legitimate interests or your legitimate interests, unless the law provides for such processing.
5. You have the right to withdraw your consent at any time if your consent was the lawful basis for us processing your personal information. You should be aware that your withdrawal of consent may result in us no longer being able to continue our relationship with you. We will however inform you of the likely consequences of your decision to withdraw your consent.
6. If you wish to exercise these rights, please complete and return our Access to Information Request Form (PDF, 261kb).

Breach notification

Should we become aware of any breach of security or operational measures that may potentially lead to the unauthorised access, loss, destruction, alteration or misuse of your personal information, we will, as soon as reasonably possible, investigate the matter and notify you and other affected parties, as well as the Information Regulator, of such breach, in the prescribed manner and form, and will take reasonable steps to mitigate against any risks resulting from such breach.

Complaints

1. Should you believe that Sibanye-Stillwater has utilised your personal information contrary to Applicable Laws, you undertake to first attempt to resolve any concerns with Sibanye-Stillwater at the contact details set out above.
2. If you are not satisfied with the outcome of such process, you may have the right to lodge a complaint with the Information Regulator, using the contact details listed below:
   Tel: 012 406 4818
   Fax: 086 500 3351
   Email: inforeg@justice.gov.za.

This Privacy Statement was last modified on 28 June 2021.