SAWIMIH

South African Women in Mining Investment Holdings (Pty) Ltd

Website and General Privacy Policy

Effective Date: 18 August 2026

Issued in accordance with the Protection of Personal Information Act 4 of 2013 ("POPIA")

1. INTRODUCTION

South African Women in Mining Investment Holdings (Pty) Ltd ("SAWIMIH", "we", "us" or "our") respects and is committed to protecting the privacy of individuals whose personal information we process.

This Privacy Policy explains how SAWIMIH collects, uses, stores, shares, protects and otherwise processes personal information when you visit or use our website, communicate with us, participate in our activities, apply for, hold or deal with shares in SAWIMIH, or otherwise provide personal information to us.

This Privacy Policy is issued in accordance with the Protection of Personal Information Act 4 of 2013 ("POPIA") and applies to all personal information processed by SAWIMIH, whether collected through our website, in writing, electronically, telephonically or in person.

This Privacy Policy should be read together with any other notices, terms or consent forms that may apply to particular services, transactions or activities involving SAWIMIH.

2. DEFINITIONS

For ease of reference, the key terms used in this Privacy Policy have the meanings given to them in POPIA, summarised below:

3. WHO WE ARE

South African Women in Mining Investment Holdings (Pty) Ltd is a private company incorporated in South Africa, focused on creating equity investment and economic-participation opportunities for women, youth and persons with disabilities in the mining and natural resources sector.

For the purposes of POPIA, SAWIMIH is the "responsible party" in relation to the personal information it collects and for which it determines the purpose and means of processing, as described in this Privacy Policy.

Company: South African Women in Mining Investment Holdings (Pty) Ltd
Registration Number: 2003/025168/07
Website: www.sawimih.co.za
Registered/Business Address: 96 Rivonia Road, Sandton, 2194
Telephone: 010 746 0146
Privacy/POPIA Email: siphiwe@sawimih.co.za
Information Officer: Siphiwe Jiyane
Information Officer Email: siphiwe@sawimih.co.za

As required by section 55 of POPIA, SAWIMIH has designated the Information Officer named above, who is responsible for encouraging compliance with POPIA within SAWIMIH, dealing with requests made to SAWIMIH in terms of POPIA and PAIA, working with the Information Regulator, and otherwise ensuring compliance with the conditions for lawful processing.

4. WHAT PERSONAL INFORMATION WE PROCESS

"Personal information" means information relating to an identifiable, living natural person and, where applicable, an identifiable existing juristic person, as defined in POPIA.

Depending on your relationship with SAWIMIH, the personal information we process may include:

We will only collect personal information that is adequate, relevant and limited to what is reasonably necessary for a specific, explicitly defined and legitimate purpose, in accordance with the processing limitation and purpose specification conditions in POPIA.

5. HOW WE COLLECT PERSONAL INFORMATION

Wherever reasonably possible, SAWIMIH collects personal information directly from the data subject. We may also collect personal information:

Where personal information is collected from a source other than the data subject, SAWIMIH will only do so where permitted by POPIA, for example, where the information is contained in or derived from a public record, you have consented, collection would not prejudice your legitimate interests, or collecting it directly from you is not reasonably practicable.

Where required by POPIA, we will take reasonable steps to ensure that you are aware of the collection of your personal information, the purpose of collection, and the other matters listed in section 18 of POPIA, including whether supplying the information is voluntary or mandatory, the consequences of not providing it, and your right to object.

6. WHY WE PROCESS PERSONAL INFORMATION

SAWIMIH may process personal information for the purposes set out below.

6.1 Shareholder and investment administration

We may process personal information to:

6.2 Business and corporate purposes

We may process personal information to:

6.3 Website purposes

We may process information relating to your use of our website to:

7. LAWFUL BASIS FOR PROCESSING

SAWIMIH will only process personal information where a lawful basis exists under section 11 of POPIA. Depending on the circumstances, this may be because:

SAWIMIH does not rely on consent as the sole basis for every form of processing. Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal and may be subject to legal or contractual consequences.

8. SPECIAL PERSONAL INFORMATION

Because part of SAWIMIH's mandate involves promoting the economic participation of women, youth and persons with disabilities in the mining and natural resources sector, SAWIMIH may, in limited circumstances, process special personal information as defined in section 26 of POPIA, for example, information about a data subject's gender, disability status, or race or ethnic origin, to verify eligibility for shareholding, membership or participation in SAWIMIH's programmes, or to comply with applicable legislation.

SAWIMIH will only process special personal information where permitted by section 27 of POPIA, including where you have consented, processing is necessary to establish, exercise or defend a right or obligation in law, processing is for historical, statistical or research purposes subject to safeguards, or processing is otherwise authorised or required by law.

Where SAWIMIH processes special personal information, it will apply safeguards appropriate to the sensitivity of that information and limit access to those who require it for the relevant purpose.

9. SHAREHOLDER INFORMATION

Because SAWIMIH administers and maintains information relating to shareholders and investments, certain personal information may be required for shareholder administration and regulatory purposes. This may include identity verification, share ownership, share purchases or transfers, dividend payments, banking details, contact details, correspondence concerning shareholding, legal or authorised representatives, deceased estates, and other information required to comply with legal and regulatory obligations.

Where necessary, SAWIMIH may share relevant information with authorised professional advisers, service providers, financial institutions, registrars, auditors, legal advisers, regulators or other parties, where permitted or required by law.

10. DIRECT MARKETING

SAWIMIH may send communications relating to its business, activities, shareholder communications, events, initiatives or other information that may be relevant to you. Where POPIA requires consent for direct marketing by unsolicited electronic communications, SAWIMIH will send such communications for your consent.

You may object to receiving direct marketing communications, or request that SAWIMIH stop sending them, at any time and free of charge. Nothing in this section limits communications necessary for the administration of your shareholding, a contractual relationship, compliance with a legal obligation, or other legitimate business purposes that do not constitute direct marketing.

11. DISCLOSURE OF PERSONAL INFORMATION

SAWIMIH will not sell your personal information. We may disclose or provide access to personal information where reasonably necessary and lawful, including to employees and authorised representatives, share registrars, banks and payment service providers, auditors and accountants, legal and professional advisers, information technology and hosting providers, government departments and regulatory authorities, law enforcement agencies, courts or dispute-resolution bodies, and other third parties where you have consented or disclosure is permitted or required by law.

Where third parties process personal information on our behalf, SAWIMIH will take reasonable steps to ensure appropriate confidentiality and security obligations apply.

12. OPERATORS AND SERVICE PROVIDERS

SAWIMIH may appoint third-party service providers to process personal information on its behalf as operators under POPIA. In accordance with section 21 of POPIA, SAWIMIH will only appoint an operator under a written contract that requires the operator to process personal information only with SAWIMIH's knowledge or authorisation and in accordance with its instructions, treat personal information as confidential, and implement appropriate security safeguards.

13. CROSS-BORDER TRANSFERS

Certain service providers or technology platforms used by SAWIMIH may process or store personal information outside South Africa. In accordance with section 72 of POPIA, SAWIMIH will only transfer personal information to a third party in a foreign country where the third party provides adequate protection substantially similar to POPIA, you have consented, the transfer is necessary for a contract, or the transfer otherwise benefits you under the conditions set out in POPIA.

14. SECURITY MEASURES

SAWIMIH takes reasonable technical and organisational measures to protect personal information against loss, damage, unauthorised destruction, unlawful access, unauthorised processing, accidental disclosure and other reasonably foreseeable security risks. These measures may include appropriate access controls, confidentiality requirements, secure storage, system protections and other safeguards appropriate to the nature of the information and the risks involved.

SAWIMIH regularly reviews its security practices and will take reasonable steps to address identified risks and improve its safeguards in accordance with section 19 of POPIA.

15. SECURITY COMPROMISES

If SAWIMIH has reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, SAWIMIH will take reasonable steps to investigate and respond to the incident. Where required by section 22 of POPIA, SAWIMIH will notify the Information Regulator and affected data subjects as soon as reasonably possible after becoming aware of the compromise.

16. RETENTION OF PERSONAL INFORMATION

SAWIMIH will not retain personal information for longer than is necessary for the purpose for which it was collected or subsequently processed, unless retention is required or authorised by law, required for contractual or legitimate business purposes, necessary for legal proceedings, consented to, or otherwise lawful.

Certain records, including SAWIMIH's Securities Register, records of Directors, and annual financial statements, must be retained for periods prescribed by the Companies Act 71 of 2008 and SAWIMIH's Memorandum of Incorporation, generally seven years. When personal information is no longer required, SAWIMIH will take reasonable steps to securely delete, destroy or anonymise it where appropriate.

17. ACCURACY OF PERSONAL INFORMATION

SAWIMIH will take reasonable steps to ensure that personal information in its possession is accurate, complete, not misleading and updated where necessary. You are encouraged to notify us if your personal information changes or if you become aware that information we hold about you is incorrect.

18. YOUR RIGHTS AS A DATA SUBJECT

Subject to applicable law, you have the right to ask whether SAWIMIH holds personal information about you, request access, request correction or updating, request deletion where legally permissible, object to certain processing, object to direct marketing, withdraw consent where processing is based on consent, and lodge a complaint concerning processing.

Requests to access personal information held by SAWIMIH are dealt with under sections 23 to 25 of POPIA, read together with PAIA, and prescribed fees may be payable. To exercise these rights, contact our Information Officer using the details in Section 3.

19. AUTOMATED DECISION-MAKING

SAWIMIH does not currently make decisions about data subjects based solely on automated processing, including profiling, that would result in legal or similarly significant effects. If this changes, SAWIMIH will update this Privacy Policy and provide the rights required by section 71 of POPIA.

20. COOKIES

Our website may use cookies and similar technologies. Essential cookies may be necessary for the website to operate properly. Analytics cookies may help us understand how visitors interact with our website and improve functionality. Functionality cookies may remember preferences or settings. Third-party services may place their own cookies. Where applicable, you may manage cookies through your browser settings or other controls provided on the website.

21. WEBSITE LOGS AND TECHNICAL INFORMATION

When you visit our website, certain technical information may automatically be collected, including IP address, browser type, operating system, device information, pages visited, date and time of visits, referring website and other technical information necessary for website operation, security and analytics. Where such information can reasonably be linked to an identifiable individual, SAWIMIH will treat it as personal information in accordance with POPIA.

22. THIRD-PARTY WEBSITES

Our website may contain links to third-party websites, social media platforms or other online services. These operate independently from SAWIMIH and may have their own privacy policies and terms. SAWIMIH is not responsible for the privacy practices of third-party websites that it does not control. You should review their privacy policy before providing personal information.

23. CHILDREN'S PERSONAL INFORMATION

In accordance with sections 34 and 35 of POPIA, SAWIMIH does not knowingly process the personal information of a child, except where and to the extent permitted by POPIA, such as with prior consent of a competent person, where necessary to establish, exercise or defend a right in law, or where otherwise authorised by law.

24. CHANGES TO THIS PRIVACY POLICY

SAWIMIH may update this Privacy Policy from time to time to reflect changes in legislation, regulatory developments, our services or business, our website, or how we process personal information. The updated Privacy Policy will be published on our website and will indicate the date on which it was last updated.

25. COMPLAINTS

If you have a concern about how SAWIMIH processes your personal information, contact our Information Officer first so that we can investigate and attempt to resolve your concern. You also have the right to lodge a complaint with the Information Regulator of South Africa.

Information Regulator of South Africa:
Toll-Free: 0800 017 160
Telephone: 010 023 5200
Email: enquiries@inforegulator.org.za
Website: https://inforegulator.org.za/
eServices Portal: https://eservices.inforegulator.org.za/

26. CONTACT US

For questions, requests or concerns relating to this Privacy Policy or SAWIMIH's processing of your personal information, please contact:

Company: South African Women in Mining Investment Holdings (Pty) Ltd
Attention: Information Officer (Siphiwe Jiyane)
Address: 96 Rivonia Road, Sandton, 2194
Telephone: 010 746 0146
Email: siphiwe@sawimih.co.za

27. GOVERNING LAW

This Privacy Policy is governed by the laws of the Republic of South Africa. Any dispute concerning the processing of personal information will be dealt with in accordance with applicable South African law, including POPIA and any other legislation applicable to the matter.

END OF PRIVACY POLICY