APPLICANT PRIVACY NOTICE

Sibanye-Stillwater is committed to protecting the privacy of your personal information.

This Privacy Notice describes how we collect, process and store your personal information in accordance
with the Protection of Personal Information Act No. 4 of 2013 (“POPIA”).

Sibanye-Stillwater is the responsible party for your personal information unless this Privacy Notice specifically
states otherwise.

Personal Information we collect, process and store

We collect, process and store the following information about you during the application and selection
activities:
• Personal details such as name, surname and title;
• Contact details such as addresses, telephone numbers and e-mail addresses;
• Gender;
• ID Number and/or Passport- and Work Permit number;
• Date of birth;
• Industry Number (if applicable);
• Race;
• Current/previous/expected salary;
• Details of relatives/family members employed at Sibanye-Stillwater;
• Biometric information i.e. fingerprints;
• Health information;
• Assessments applicable to the position;
• Recruitment information such as employment and education history including your qualifications,
employment references, disciplinary records, as well as criminal records; and
• Credit record information.

The personal information collected, processed, stored and shared as detailed above, may not be applicable
in all instances.

Lawful basis for processing

We rely on the following lawful bases for processing your personal information:
• processing necessary for potential conclusion of a contract;
• to comply with our legal obligations;
• to protect your legitimate interests; and
• for the purposes of our legitimate interests.

Where the information we process is special personal information, the additional bases for processing that we
rely on are:

Race information
Processing that is necessary to comply with laws and other measures designed to protect or advance persons,
or categories of persons, disadvantaged by unfair discrimination.

Health information and Job-related assessments

Processing that is necessary for:
• reasons related to enforcement of a potential contractual obligation;
• compliance with laws; and
• protection of our legitimate interests.

Criminal behaviour
We process information about criminal record, offences and disciplinary records. The lawful bases we rely on
to process this information are:
• processing necessary for performance of a potential contract; and
• for the purposes of our legitimate interests.

Page 1 of 3

This notice must be read in conjunction with the POPI Act and its Regulations for more detailed information.
How we collect your personal information

We collect personal information about job applicants through the application and recruitment activities, either
directly from you or from an employment agency or third-party sources. The third-party sources include
reference checks from former employers, credit bureaus, academic institutions, law enforcement (criminal
record) and other background verification agencies.

How we use your personal information

We will process your personal information for the following purposes:

• Process applications for recruitment and selection;
• Screen and shortlist candidates;
• Conduct interviews;
• Identify and select successful candidates;
• Perform background checks;
• Conduct medical and job-related assessments;
• Perform criminal record checks;
• Audit and record keeping; and
• Compliance with applicable legislation and regulatory requirements.

Personal information of successful candidates, collected during the application and selection processes, will
be used for employment administration and management on and after engagement of the successful
candidate.

With whom we share your personal information

We may share your personal information with third parties for the following purposes:
• Sourcing;
• Employment reference checks;
• Verification of certificates and qualifications;
• Criminal record checks;
• Financial reference checks;
• Job-related assessments; and
• Our legitimate business interests.

We may also share your personal information with our Operators (third parties that collect, process and/or
store personal information on our behalf). We will have agreements in place with the third parties with whom
your personal information is shared to ensure that the confidentiality and integrity thereof is maintained.

How we safeguard your personal information

We have implemented generally accepted standards of technology and operational security in order to
protect the personal information we process from unauthorised access, loss, destruction, alteration or misuse.
We, on an ongoing basis, review our security controls and related processes to ensure that your personal
information is secure.

Our information security policies and practices include:

• Physical and logical security;
• Computer and network security;
• Secure communications;
• Security in contracting out activities or functions;
• Retention and disposal of personal information;
• Acceptable usage;
• Governance and regulatory issues;
• Monitoring access and usage of personal information; and
• Investigating and reacting to security breaches and/or incidents.

Page 2 of 3

This notice must be read in conjunction with the POPI Act and its Regulations for more detailed information.
Cross border transfer of your personal information

We will ensure that the personal information transferred to a third party situated in a destination outside of
South Africa, is protected by similar or stricter privacy legislation. We will also put agreements in place that will
ensure legally enforceable commitment to protect the personal information transferred.

Retention and destruction of your personal information

We will retain your personal information for as long as it is necessary to fulfil the purposes for which it was
collected, after which your personal information will be deleted or destructed. The periods for which
information must be retained are determined by:
• Legal, contractual or other obligations to retain personal information as part of an investigation or for
litigation purposes;
• Information retention legislation;
• Personal information required to maintain accurate business and financial records in line with relevant
legislation; and
• Specific business requirements.

Your rights

You have the right to:

• request access to and correction of your personal information;
• request rectification, deletion or destruction of your personal information;
• request restriction of processing of your personal information;
• object to processing of your personal information; and
• object to your personal information being used for automated decision making.

You should be aware that we will not always comply with your request. In such instance we will ensure that the
reason is explained to you. You should also be aware that we are not required to comply with your request to
delete or destruct your information if your personal information is necessary for compliance with a legal
obligation or for the establishment, exercise or defence of legal claims.

Breach notification

Should we become aware of any breach of security or operational measures that may potentially lead to the
unauthorised access, loss, destruction, alteration or misuse of your personal information, we will, as soon as
reasonably possible, investigate the matter and notify you and other affected parties, as well as the
Information Regulator, of such breach, in the prescribed manner and form, and will take reasonable steps to
mitigate against any risks resulting from such breach.

Changes to this Privacy Notice

This Privacy Notice may change from time to time as needed to comply with changing laws and regulations.

How to contact us

If you have questions about this Privacy Notice or believe we have not adhered to it, or need further
information about our privacy practices, please contact us at privacy@sibanyestillwater.com .

Should you wish to exercise your right to request access to your information, correction or deletion of your
personal information refer to our Privacy Statement on https://www.sibanyestillwater.com .

How to contact the Information Regulator

Complaints relating to our processing of your personal information may be directed to the Information
Regulator in the prescribed manner and form. The contact details can be found on the website of the
Information Regulator located at https://www.justice.gov.za/inforeg .

Page 3 of 3

This notice must be read in conjunction with the POPI Act and its Regulations for more detailed information.