Protecting your privacy

At Galaxy Resources Limited (“Galaxy”, “we”, “us” or “our”), we take our privacy obligations and the protection of your personal information very seriously. This Privacy Policy is designed to describe the personal information we collect, how we protect it, what we do with it, as well as your privacy rights.

This Privacy Policy relates to all of our activities, except to the extent inconsistent with a different more specific privacy statement we have provided for a particular product, service or activity.

Please review this Privacy Policy carefully. When you submit your personal information to us, register for or use any of the services we offer, or voluntarily interact with us, we may collect, use and disclose your personal information as set out in this Privacy Policy, as revised from time to time.

What information do we collect?

“Personal information” means information about an identifiable individual. Note that in Canada and some other countries, personal information does not include any business contact information that is solely used to communicate with you in relation to your employment, business or profession, such as your name, position name or title, work address, work telephone number, work fax number or work electronic address. Personal information also does not include information that has been anonymized or aggregated in such a way that there is no possibility it can be used to identify an individual, whether on its own or in combination with other information.

We collect current and historical personal information including:

(a) name

(b) contact details

(c) appropriate identification details (eg date of birth, driver’s licence, vehicle registration, facial recognition data where used)

(d) payment details (eg banking details, payroll tax file number)

(e) details of interactions and activity (eg communications, enquiries, complaints, transactions and activity relating to our business)

(f) preferences, interests and opinions (eg preferences about communications with us)

In addition, subject to applicable laws, in relation to staff and job applicants:

(a) experience, qualifications, skills and character

(b) screening checks (eg reference, background, health, directorship, financial probity, identity, eligibility to work, vocational suitability and criminal record checks)

(c) drug and alcohol checks

(d) conduct and performance at work

(e) use of workplace resources and IT

(f) payroll and superannuation details

(g) emergency contacts

In addition, in relation to investors:

(a)shareholder reference number (SRN) or holder information number (HIN)

(b)investment and transaction details

We collect some personal information pursuant to and to comply with applicable laws including the Income Tax Assessment Act and other tax laws, Corporations Act, Fair Work Act, Superannuation Guarantee (Administration) Act, occupational health and safety acts, workers compensation acts and any other applicable regulations as the relevant jurisdiction may require.

How do we collect your information?

We may collect personal information in ways including:

(a) directly from you (eg through application forms)

(b) records of communications (eg phone, email, online)

(c) records of activity (eg via CCTV at our sites, website/IT usage records, facial recognition and licence plate recognition)

(d) publicly available information

(e) other third-party sources (eg our related companies and service providers (see below), your representatives, referees, academic institutions).

What do we use and disclose your information for?

We may use and disclose your personal information and other information when we believe such use or disclosure is permitted, necessary or appropriate to:

(a) deal with your enquiries and requests

(b) operate our business

(c) provide and improve our products and services

(d) maintain and update our records

(e) personalise your experience with us

(f) protect our operations, including those of any of our affiliates or subsidiaries

(g) protect our rights, privacy, safety, security, staff or property, and/or those of our affiliates, you or others

(h) allow us to pursue available remedies or limit the damages that we may sustain

(i) comply with the law or legal process, including laws outside your country of residence (eg where we receive a subpoena or need to provide limited investor details to members of the public on request)

(j) respond to requests from law enforcement and public and government authorities, including outside your country of residence (eg for workers compensation claims)

(k) enforce the terms of the agreements for our products and services

(l) investigate and manage matters relating to unlawful activity and misconduct

(m) recruit, train and manage our staff

(n) facilitate your investments

(o) facilitate a reorganization, merger, sale, joint venture, assignment, transfer or other disposition of all or any portion of our business, brands, affiliates, subsidiaries or other assets.

We may not be able to do these things without your personal information. For example, we may not be able to communicate with you or deal with your enquiries. For staff, we may in some cases take disciplinary action including termination if you refuse to provide necessary information.

Do we disclose any information to outside parties?

Although we try to avoid sharing your personal information with third parties where possible, we have set out below the instances in which such sharing may occur.

In addition to relevant third parties for the purposes described in the previous section, we may also provide your information to our related companies and to third party service providers (including providers of share registry, recruitment, screening check, training, payroll, superannuation, auditing, accounting, contact centre, legal, business consulting, banking, payment, delivery, data processing, data analysis, document management, research, surveillance, investigation, identity/data verification, insurance, website and technology services). However, we require our service providers to maintain the confidentiality of your personal information and to keep your personal information securely. We require that our service providers only use your personal information for the limited purposes for which it is provided. When our service providers no longer need your personal information for those limited purposes, we require that they dispose of the personal information. In some circumstances, we may permit our service providers to retain aggregated, anonymized or statistical information that does not identify you. We do not authorize the service providers to disclose your personal information to unauthorized parties or to use your personal information for their direct marketing purposes.

In relation to our staff, we may disclose personal information to other employers seeking a reference.

Please see the investor section of our website www.gxy.com for details of our share registry provider and its website. You can view that provider’s privacy policy by visiting its website.

The outside parties we share with may be located in Australia, Canada, Argentina and other countries outside your country of residence. As a result, your personal information may be transferred to countries outside your country of residence, which may have different data protection rules than in your country.While such information is outside of your country, it is subject to the laws of the country in which it is located, and may be subject to disclosure to the governments, courts or law enforcement or regulatory agencies of such other country, pursuant to the laws of such country. In the event we share personal data with outside parties which are located in countries that do not provide adequate levels of protection, we will comply with the applicable data protection regulations.

How do we protect your information?

We implement a variety of security measures to maintain the safety of your personal information, including building security, access restrictions, network firewalls and contractual protections where our service providers store this information on our behalf. We have taken steps to ensure that the only personnel who are granted access to your personal information are those with a business ‘need-to-know’ or whose duties reasonably require such information. We hold information in hard copy and electronic form.

We will use, disclose or retain your personal information only for as long as necessary to fulfil the purposes for which that personal information was collected and as permitted or required by law. If you would like further information regarding the periods for which your personal information will be retained, please contact us as set forth in the “Contacting us” section below.

What do you need to know about privacy on our website?

We use cookies. A cookie is a piece of information that allows our system to identify and interact more effectively with your browser. The cookie helps us to maintain the continuity of your browsing session and remember your details and preferences when you return. You can configure your web browser software to reject cookies however some parts of our website may not have full functionality in that case.

We may use Google services such as Google Analytics from time to time. For more about how Google collects and processes data, please see Google’s privacy policy and their information at www.google.com/policies/privacy/partners/.

This Privacy Policy applies only to our products and services. This Privacy Policy does not extend to any websites or products or services provided by third parties. We do not assume responsibility for the privacy practices of such third parties, and we encourage you to review all third party privacy policies prior to using third party websites or products or services.

What are your privacy rights?

(a)Subject to applicable laws, you can request access or correction of your personal information that we hold. We may need to verify your identity. Please provide as much detail as you can about the particular information you seek, in order to help us locate it. We will let you know why if we are unable to provide the access or corrections you seek. If you disagree in relation to a correction that we have refused, you can ask us to note your requested correction with the information.

(b)You can ask us to send you a copy of this Privacy Policy.

(c)Subject to applicable laws, you can ask us not to use or disclose your personal information for direct marketing.

(d)Subject to applicable laws, you can make a complaint if you feel we have breached your privacy. We may seek further details from you and may need to engage or consult with other parties to investigate and deal with your complaint. We will keep records of your complaint and any resolution.

Please contact us as set out below if you wish to make any of these requests.

Changes to our Privacy Policy

This Privacy Policy is current as of the date which appears at the bottom of this Privacy Policy. If we decide to change our Privacy Policy, we will update the Privacy Policy modification date below. Please revisit this Privacy Policy periodically to stay aware of any changes.

Contacting us

If there are any questions, comments, concerns, requests or complaints regarding this Privacy Policy or your personal information, you may contact us using the information below.

Privacy Officer

Galaxy Resources Limited

Level 4/21 Kintail Road, Applecross

Western Australia 6153

+61 8 9215 1700

privacy@gxy.com