Privacy Policy

Types of personal information we collect

We may collect the following types of personal information:

• Name, organisation and job title.
• Contact information, including email address, phone number, postal address and residential address.
• Identification details, e.g. passport numbers and national ID numbers.
• Payment details, e.g. to pay staff.
• Engagement information, e.g. enquiries, complaints and other information about your interactions, dealings and communications with us or relating to our business, including any contact by telephone, by email, by online activity at our websites or at physical sites.
• Details of interests, preferences and opinions relevant to our business and operations.
• Information about incidents, inappropriate conduct, unfair treatment and investigations.
• CV and recruitment information about staff and prospective staff, e.g. qualifications, skills, experience, character and screening checks (including health, reference, background, directorship, financial probity, identity, eligibility to work, vocational suitability and criminal record checks).
• Employment information about staff, e.g. information about training, emergency contacts, performance, conduct, use of our IT and communications resources, payroll matters, drug/alcohol tests, leave and tax/financial affairs.
• Recruitment and engagement information about consultants and prospective consultants, e.g. qualifications, skills, experience, character, screening checks, information about training, conduct, use of our IT and communications resources, payment details and drug/alcohol tests.
• Information about the personnel of our contractors, e.g. qualifications, skills, residential location and screening checks (including health) and drug/alcohol tests.
• Historical information, including past investor information.

How we collect personal information

We collect personal information in the following ways:

• From you or your authorised representatives – e.g. where you submit information to us in writing, orally, online or by email.
• Where you consent to the collection from another source.
• By generating new personal information – e.g. reports, analysis, reviews or investigations based on other information we hold about you.
• From activity records – e.g. records we make of your interactions with us and activities relating to our operations or at our mine sites, offices, websites and facilities. This may include monitoring records in relation to things like CCTV, site or office access, telephone recordings and use of IT resources.  See below for further information about how we use cookies on our websites.
• From third parties – e.g. the types of entities listed under ‘Who we exchange personal information with’ below.
• From publicly available information.

We will only collect personal information from third parties where it is lawful to do so.  Accordingly, where you provide us with personal information about someone else we rely on you to have made them aware of this Policy, and obtained their consent where that is required pursuant to applicable law for us to collect and handle their personal information.  You must let us know in advance if you are not able to do this, and we may be able to assist.

What we do with personal information

We collect, store, use and disclose personal information to understand your needs and to operate and improve our business, and in particular for the following reasons:

• Internal record keeping and updating.
• Communicating with you about our business or other information which we think you may find interesting. If you wish to unsubscribe from any promotional communications, please utilise the unsubscribe mechanism in those communications or otherwise contact us with your request.
• Customising our websites and communications according to your preferences and interests.
• Managing our relationships with stakeholders including our staff, parent company, business contacts and host communities.
• Recruiting, training and managing staff and prospective staff.
• Training and managing contractors, suppliers and prospective contractors and suppliers.
• Protecting the health, safety and security of our staff, sites and assets, as well as the health and safety of our contractors and the public.
• Carrying out reviews or investigations where considered appropriate or requested in respect of our staff or our business, including in relation to allegations of unfair treatment or inappropriate conduct.
• Conducting identity and screening checks where legally required, appropriate for risk management purposes and required pursuant to Base policies or standards.
• Complying with our legal obligations and protecting and defending our legal rights and interests.
• Facilitating acquisitions and potential acquisitions of our business.
• For the performance of contractual obligations.

Who we exchange personal information with

We may exchange your personal information with third parties, including:

• Within the Base group – e.g. to our ultimate parent company (Energy Fuels Inc.), Energy Fuels Inc.’s other subsidiaries, or related or joint venture entities from time to time.
• Your and our representatives.
• Our service providers that assist us with archival, auditing, accounting, company secretarial matters, complaints, distribution of promotional material, business consulting, banking, payment, debt collection, delivery, data processing, data analysis, document management, information broking, research, review, investigation, insurance, recruitment, screening checks, website, technology, payroll, superannuation, staff benefits, surveillance and training services.
• Government authorities, courts and lawyers, e.g. in relation to lawful information requests.
• Additionally, for staff and job applicants: academic institutions, health service providers, professional and trade associations and referees.
• For whistleblowers, our independent external whistleblower service provider, One Trust. Please visit onetrust.com for details of One Trust’s privacy policy.
• Some of the third parties described above may be located in Australia, Kenya, Madagascar, the United States of America and other countries.

Rights under the Kenya DPA

If the Kenya Data Protection Act No.24 of 2019 (Kenya DPA) applies, you will have certain rights under that Act. Those rights are:

• To be informed of the use to which your personal information is to be put.
• To access your personal information in the custody of a data controller or data processor.
• To object to the processing of all or part of your personal information.
• To have false or misleading information corrected.
• To have false or misleading information about you deleted.
• Data portability, i.e. the right to receive your personal information or request that your personal information is transferred to another data controller or data processor in a structured, commonly used and machine-readable format.
• These rights conferred on a data subject may be exercised by any person duly authorized by the data subject.
• The Kenya DPA will apply if your personal information is processed (i.e. collected, recorded, erased, disseminated, stored, transferred, etc.) by a data controller (in this case, Base) or data processor (such as the parties set out above) that:
  • is established or ordinarily resident in Kenya and processes personal information while in Kenya; or
  • is not established or ordinarily resident in Kenya, but you as the data subject are located in Kenya.

Marketing communications

You will receive marketing/promotional communications from us if you specifically consent to it or have requested information from us and you have not opted out of receiving marketing/promotional communications.

You can ask us or third parties to stop sending you marketing messages at any time by following the opt-out links on any marketing communications sent to you or by contacting us at any time.

Security

We are committed to protecting the security of your personal information. To help prevent unauthorised access or disclosure, we have put in place suitable physical, digital and cyber-security risk management safeguards to secure the personal information we collect. Depending on the circumstances, those measures include firewalls, application control, endpoint security, user access restrictions, secure data centre facilities and regular software security updates and offsite data backups.

Data Retention

We will only retain your personal information for as long as reasonably necessary, including for the purposes of satisfying any legal, regulatory, tax, accounting, or reporting requirements.

We may retain your personal information for a longer period if:

• it is required or authorised by law;
• it is reasonably necessary for a lawful purpose including for Base’s legitimate interests; and
• authorized or consented by you.

We keep retention periods under regular review. Once the retention period expires, your personal information shall be deleted or anonymized.

International transfers

Where we transfer your personal information to third parties or outside of the country of collection, we take reasonable steps to ensure the recipient has appropriate safeguards with respect to the security and protection of personal information prior to the transfer, and in adherence with the applicable laws.

For data subjects in Kenya, we may transfer personal information we collect about you outside of Kenya on the basis of contractual measures or other legal transfer mechanisms permitted under the applicable data protection laws. For the transfer of sensitive personal information regulated under the Kenyan DPA, we will obtain your consent prior to transfer in addition to confirming that the recipient has appropriate data protection safeguards in place. Please contact us if you require more information on the specific mechanism used by Base when transferring your personal information outside Kenya.

Our websites and online content

We use cookies on our websites. Cookies are small files stored by your computer or device in connection with your browser software.

Cookies allow web applications to tailor their operations and content to your needs, likes and dislikes by gathering and remembering information about your preferences.

We use traffic log cookies to identify which pages are being used. This helps us analyse data about web page traffic and improve our website in order to tailor it to the needs of its users.

In this way, cookies help us provide you with a better website, by enabling us to monitor which pages you find useful and which you do not. A cookie in no way gives us access to information stored on your computer, other than the cookie itself.

You can choose to accept or decline cookies. Most web browsers automatically accept cookies, but you can usually modify your browser setting to decline cookies if you prefer. This may prevent you from taking full advantage of the website.

Our website may use Google services such as Google Analytics from time-to-time which stores information such as what you click, your duration on the site and how you accessed the site. No personal information is collected through Google Analytics. For more about how Google collects and processes data, and your privacy choices with Google, please see Google’s privacy policy and their information at google.com/policies/privacy/partners/.

Our website may contain links to other websites of interest. However, once you have used these links to leave our site, you should note that we do not have any control over that other website. Therefore, we cannot be responsible for the protection and privacy of any information which you provide whilst visiting such sites and such sites are not governed by this Policy.  You should exercise caution and look at the privacy policy applicable to the website in question.

Further requests

You can contact us if you wish to:

• Access, correct or erase any personal information we hold about you.
• Request that we restrict the processing (i.e. collection, use, storage, transfer, etc.) of your personal information where:
  • you contest the accuracy of your personal information;
  • your personal information is no longer required for the purpose of the processing, unless we require the personal information for the establishment, exercise or defence of a legal claim;
  • you believe processing of your personal information is unlawful and you oppose the erasure of the information and request the restriction of its use instead; or
  • you have objected to the processing, pending verification as to whether our legitimate (i.e. valid) interests override yours.
• Unsubscribe from promotional communications.
• Make a privacy complaint.
• Seek clarity on this Policy.

We may need to verify your identity and may ask for your request in writing.

If you are requesting access to, the correction or erasure of, or the restriction of the processing of, your personal information (each a Request), please provide as much detail as you can about the particular information in question to help us locate it. We will provide our reasons if we deny any Request. Where we refuse to make a correction that you request, you can ask us to make a note of your requested correction with the information.

We may need to engage or consult with other parties to investigate and deal with any complaints. We will keep records of your complaint and any resolution.

We can be contacted in any of the ways below. In each, case please state that your request is for the attention of our Chief Legal Officer and indicate your country of residence.

Post:

Australia
PO Box 928, West Perth
BC 6872, Australia

Kenya
PO Box 1214,
Ukunda, 80400, Kenya

Madagascar
Fanjava Mahafaly Property Avenue, Monja Jaona,
Toliara Centre 601,
Toliara, Madagascar

Email: info@baseresources.com.au

Last updated: 10 April 2025

Base Resources Limited ABN 88 125 546 910