Privacy Policy

Terms: 

This privacy notice applies to a wide range of individuals who interact with Thungela Resources, including our directors, officers, employees, contractors (and their workers), employees from other regions, visitors to our offices or sites, job applicants, scholarship or bursary recipients, users of our websites, investors and their employees, business partners and service providers, joint venture participants, and stakeholders. Key terms include: 

• consent, which may be express or implied but must always be informed and voluntary;
• health/medical information, which covers any personal data related to an individual’s physical or mental health, medical history, or treatment;
• personally identifiable information (PII), which refers to any data that identifies or could identify an individual; and
• sensitive PII, which includes data about race, ethnicity, political or religious beliefs, union membership, sexual orientation, criminal records, health, genetics, or biometrics.

What PII does Thungela Resources collect?

When you engage with Thungela Resources, we may collect various types of PII necessary to support our operations and meet legal obligations. This includes your name, contact details, job title, and biographical data; employment-related information such as date of birth, gender, emergency contacts, medical and vaccination status, banking and tax details, qualifications, and background checks; records of leave and associated health information; photographs, CCTV footage, and voice recordings; biometric data and system access credentials; travel documentation and personal protective equipment requirements; details related to incidents, complaints, or grievances; information about potential conflicts of interest; diversity-related data including race, religion, sexuality, and disability status; survey responses; due diligence findings; incentive plan participation; and any other information we are legally required or authorised to collect and retain.

What about my health / medical information?

Thungela Resources may collect health and medical information where necessary to ensure a safe and compliant working environment. This includes data related to fitness for work assessments, occupational exposure monitoring, wellbeing initiatives (such as medication details), and workers’ compensation claims. For contractors and their employees, this may also include compliance statements, alcohol and drug test results, fitness assessments, and records from visits to Thungela Resources medical clinics. 

In the event of an infectious disease outbreak (e.g., COVID-19), personnel and visitors to our offices or sites may be required to provide health-related information, including infection status, test results, temperature readings, vaccination history, travel history, and potential exposure to affected individuals. In some cases, the collection and use of this information may be mandated by law. In other cases, Thungela Resources may determine that such data is necessary to maintain a safe workplace. Where required, we will seek your informed consent before collecting this information.

What about government related identifiers?

Thungela Resources may collect government-issued identifiers that have been assigned to you by official agencies or authorities, such as your Personal Income Tax Number or Medical Aid Number. These identifiers are used strictly for their intended purposes, for example, administering payroll or fulfilling legal obligations, and not to link or identify other PII we may hold about you.

Third-Party PII

In certain situations, Thungela Resources may collect PII about third parties, for example, when you provide details of an emergency contact, next of kin, or a referee. If you share such information, you are responsible for informing the individual that their personal data has been provided to us, that this Privacy Notice applies to its collection, use, and disclosure, and for obtaining their consent where required.

Why does Thungela Resources collect PII?

Thungela Resources collects, retains, uses, and, where necessary, discloses PII to support our operations as a coal producer and to meet legal and regulatory obligations. This includes activities such as human resource management (e.g., recruitment, onboarding, performance and talent development, payroll, taxation, and superannuation), occupational health and safety (e.g., fitness for work assessments, health monitoring, incident investigations), security services (e.g., access control to sites and systems), travel and accommodation coordination, participation in volunteering or external activities, supply chain and procurement, finance and accounting, audit and assurance, corporate governance, business development (e.g., due diligence, acquisitions, joint ventures), stakeholder engagement, and communication.

We may also collect PII for legal compliance, internal investigations, cooperation with authorities, or to protect the health and safety of individuals or the public. Generally, PII is used only for the purpose for which it was collected. However, we may use or disclose it for related purposes where permitted by law, with your consent, or where you would reasonably expect such use. For sensitive PII, any secondary use must be directly related to the original purpose. For example, if your data was collected for corporate administration and you later submit a complaint, we may use that data to investigate the matter.

Consent and Legal Basis for Processing

Thungela Resources will only collect, retain, use, or disclose personal and sensitive PII as permitted by applicable laws. In most cases, we do not require explicit consent to collect PII, as much of it is embedded in routine communications and interactions. However, we will only collect sensitive PII when it is necessary for our operational activities or legal obligations, and where we have obtained your informed consent.

How does Thungela Resources collect PII?

Thungela Resources primarily collects PII directly from you. This may occur through written communications, emails, applications, phone or video calls, event attendance (including third-party hosted events), and interactions via our websites, which may involve the use of cookies. We may also collect information from your employer (particularly for contractor employees), third-party agents acting on our behalf (such as health service providers or insurers), and through digital tools or applications used to gather site access or other required data.

Additional sources may include background screening services (e.g., SAPS), CCTV and dashcam footage, audio recordings (including MS Teams or radio communications), health monitoring equipment (e.g., temperature or blood pressure devices), public media, official registers (e.g., ASIC), and social media platforms such as Facebook, Instagram, Twitter, and LinkedIn.

Occasionally, we may receive unsolicited PII (e.g., a resume not linked to a job advertisement). In such cases, we will assess whether the information could have been lawfully collected. If so, we will retain and use it in accordance with this Privacy Notice; if not, we will securely destroy or de-identify it.

How are cookies used?

When you visit the Thungela Resources website, we may record details of your visit, including your IP address, browser type, operating system, pages accessed, and documents downloaded. This information is used for statistical analysis and to help us improve the functionality and user experience of our website.

Our website uses cookies to understand visitor usage patterns and enhance your browsing experience. You have the option to refuse the use of cookies via your browser settings. Refusing cookies will not affect your ability to use the website.

Thungela Resources does not attempt to identify individual users or track browsing activities. However, in certain circumstances, government agencies may be legally entitled to inspect these records as part of an investigation.

How does Thungela Resources protect my PII?

The security of your PII is a priority for Thungela Resources. We take all reasonable steps to protect your data from misuse, interference, loss, and unauthorised access, modification, or disclosure. While we continuously review and enhance our systems and processes to maintain high security standards, we cannot guarantee absolute protection.

Thungela Resources sites prescribe to industry best practice and endorse the ISO 27001 Information Security Management Standard. As part of our commitment to data security, we implement measures such as:

• Securing hard copy documents in restricted-access facilities
• Limiting access to personal and culturally sensitive information on a strict need-to-know basis
• Using multi-factor authentication and other technologies to prevent unauthorised system access
• Enforcing mandatory IT usage policies
• Conducting regular penetration testing to identify and address vulnerabilities

We discourage the use of email for sharing PII due to its lack of security. Where possible, we use encrypted secure links for data transmission.

For cloud-based systems, we identify server locations and prioritise in-country hosting. We also ensure that all cloud service providers meet stringent security requirements.

In the event of a security breach involving your PII, we will notify you promptly and provide details of the incident, including the level of risk and the actions taken, in accordance with applicable laws. If you become aware of any potential breach, please contact us immediately at dataprivacy@thungela.com and informationofficer@thungela.com.

How long will my PII be retained by Thungela Resources?

We retain PII in accordance with our internal record-keeping and retention guidelines, which align with industry best practices. The specific retention period depends on applicable legal and regulatory requirements, the purpose for which the information was collected, relevant limitation periods for potential legal claims, and any applicable industry standards.

If we hold PII that is no longer required, we will take reasonable steps to securely destroy it or ensure it is de-identified unless we are legally required to retain it under frameworks such as the Australian Privacy Act (APA), the Australian Privacy Principles (APPs, General Data Protection Regulation (GDPR), or other applicable laws.

Who does Thungela Resources disclose PII to?

Unless you instruct us otherwise, Thungela Resources may disclose your PII to the following parties:

• Thungela Resources Group companies, including any prospective purchaser of all or part of the Group or its assets.

• Professional advisors, such as legal, tax, accounting, and payroll consultants.
• Regulatory and law enforcement authorities, including the Government and the South African Police Force, in connection with current or historical investigations or legal matters (which may include health-related information).
• Stakeholders and third parties we engage with during business operations, including government bodies, community representatives, industry associations (e.g., the Chamber of Mines), and media contacts.
• Service providers and contractors who supply goods or services to Thungela Resources or act on our behalf, such as legal firms, auditors, technical consultants, training providers, and travel companies.

These disclosures are made in line with the purposes outlined in this Privacy Notice and are subject to appropriate confidentiality and data protection measures.

Does Thungela Resources disclose PII to overseas parties?

As part of our global operations, Thungela Resources may share your PII with entities within the Thungela Resources Group and third-party service providers located in various regions worldwide.

Many of these jurisdictions have privacy and data protection laws comparable to South Africa’s Protection of PII Act (POPIA), such as the Australian Privacy Act (APA) PII and the European Union’s General Data Protection Regulation (GDPR). Regardless of location, all Thungela Resources subsidiaries and third-party providers are required to treat your PII confidentially, store it securely, and use or disclose it only for the purposes outlined in this Privacy Notice.

Additionally, our service providers and contractors may use cloud-based systems and servers located both within and outside of South Africa. We ensure that all cloud providers comply with relevant data protection laws and Thungela Resources’ internal Data Security and Information Management Governance policies and standards.

What rights do I have in relation to my PII?

Under data protection laws such as the Protection of PII Act (POPIA), the General Data Protection Regulation (GDPR), and the Australian Privacy Principles (APPs), you have a range of rights regarding your PII. These include the right to access, correct, or delete your data, and the right to withdraw your consent for its continued use.

To exercise any of these rights, please contact Thungela Resources’ Information Officer. If your request cannot be fulfilled, the Information Officer will provide a clear explanation of the reasons why.

How do I get access to my PII?

You may request access to any PII we hold about you by submitting a written request to our Information Officer at informationofficer@thungela.com. In most cases, we will respond within a reasonable timeframe, considering the volume and accessibility of the requested information.

We generally do not charge fees for access requests, unless the request is complex or resource intensive. There are limited circumstances where we may be unable to grant access, including where doing so would:

• Unreasonably impact the privacy of others
• Prejudice negotiations with you
• Be unlawful
• Interfere with investigations into suspected unlawful activity or serious misconduct

We may also decline access if the information relates to existing or anticipated legal proceedings and is not accessible through the legal discovery process (e.g., documents subject to legal privilege).

If we are unable to provide access, we will inform you in writing, explain the reasons, and advise you on how to lodge a complaint regarding our decision.

How does Thungela Resources make sure that my PII is accurate?

Thungela Resources takes all reasonable steps to ensure that the PII we collect, use, and disclose is accurate, up-to-date, complete, and relevant. These steps include promptly updating records when new or revised information is provided (e.g., changes to your name or job title), reminding you to review and update your details during interactions (such as when completing site access forms), and offering self-service tools like the SuccessFactors Employee Central Portal or Ariba for example to manage your own information.

Where PII is expressed as an opinion, we may verify the source’s reliability and, where appropriate, share the opinion with you before using or disclosing it. In some cases, we will also record the identity of the individual who provided the opinion.

What can I do about incorrect PII held by Thungela Resources about me?

If Thungela Resources determines that any PII we hold about you is inaccurate, outdated, incomplete, irrelevant, or misleading, we will take reasonable steps to correct it as soon as possible. Where applicable, we will also notify any third parties to whom the information was previously disclosed unless you request otherwise, or if it is unlawful or impracticable to do so. You may request details of these third parties.

If we are unable to correct your PII, we will inform you in writing, explain the reasons for our decision, and advise you on how to lodge a complaint.

You also have the right to request that we attach a statement to your PII indicating that it is inaccurate, outdated, incomplete, irrelevant, or misleading. If you make such a request, we will take reasonable steps to ensure that the statement is clearly visible to users of the information.

Can I choose to remain anonymous instead of providing PII?

Thungela Resources understands that in certain situations, you may prefer to interact with us anonymously or using a pseudonym, for example, when using the Employee Wellness Programme.

Where possible, we will accommodate such requests and inform you if anonymity or pseudonymity is feasible. However, in some cases, it may not be practical to assist you without knowing your identity. We may also be unable to proceed anonymously or pseudonymously if:

• We are legally required or authorised to verify your identity, or
• It is impracticable for us to provide the requested service or support without identifying you.

Can I withdraw my consent in relation to my PII?

If you have previously provided consent for Thungela Resources to collect, use, or disclose your PII, you may withdraw that consent at any time by submitting a written request to our Information Officer at informationofficer@thungela.com.

You may also contact the Information Officer to:

• Object to the use of your PII (either generally or for a specific purpose)
• Request the deletion of some or all of your PII

When you make such a request, we will inform you of any potential implications. For example, if certain PII is required to access our operations, withdrawing consent may affect your ongoing employment or engagement. You will then have the opportunity to decide whether to proceed with your request.

How can I complain about a breach?

If you believe that Thungela Resources has not adequately protected your PII and has failed to comply with this Privacy Notice, you may lodge a complaint by contacting our Information Officer at informationofficer@thungela.com.

Upon receiving your complaint, we will acknowledge receipt and promptly investigate the concerns raised. We may request additional information from you to assist with the investigation. Our goal is to provide a written response, including any actions we intend to take, within 30 days of receiving your complaint.

If you are dissatisfied with the outcome, you may escalate your complaint to the South African Information Regulator:

• Phone: 010 023 5200 or 0800 017 160

• Email: enquiries@inforegulator.org.za