PRIVACY POLICY

1. Purpose of this Policy

KB Mining (Pty) Ltd (“KB Mining”, “we”, “us” or “our”) recognises the importance of lawful, responsible and secure processing of personal information. This Privacy Policy sets out how KB Mining collects, uses, stores, shares and protects personal information obtained through kbmining.co.za and through related business activities.

This Policy is intended to give effect to KB Mining’s commitment to privacy, confidentiality, good governance and regulatory compliance. It must be read together with any specific notice, form, contract, consent, application, recruitment document or engagement letter issued by KB Mining from time to time.

2. Responsible Party

For purposes of applicable data protection law, including the Protection of Personal Information Act, 4 of 2013 (“POPIA”), KB Mining is the responsible party in respect of personal information processed by it, unless expressly stated otherwise.

KB Mining (Pty) Ltd
Registration Number:
Physical Address:
Postal Address:
Telephone:
Email:
Website: kbmining.co.za

3. Information Officer

KB Mining has appointed an Information Officer to oversee privacy compliance, internal governance, data subject requests, PAIA-related processes and engagement with the Information Regulator.

Information Officer:
Email:
Telephone:

Where required by law, KB Mining will ensure that the Information Officer and any duly designated Deputy Information Officer(s) are registered with the Information Regulator.

4. Application of this Policy

This Policy applies to personal information processed by KB Mining in connection with:

use of the website;
general business correspondence and stakeholder engagement;
enquiries, quote requests, tender submissions and commercial negotiations;
supplier, subcontractor, consultant and contractor onboarding;
recruitment and employment-related processes;
health, safety, security and operational compliance processes; and
any other lawful business activity reasonably connected to KB Mining’s operations.

This Policy applies whether personal information is collected directly from the data subject, from a representative, from a contracting entity, from a third party, or through automated website technologies.

5. Personal Information We May Process

Depending on the nature of the engagement, KB Mining may process one or more of the following categories of personal information:

5.1 Identity and contact information
Names, surnames, titles, identity or passport numbers, dates of birth, nationality, physical and postal addresses, email addresses, telephone numbers and related contact details.

5.2 Employment, recruitment and personnel information
CVs, qualifications, training records, licences, certifications, references, work history, remuneration details, next-of-kin details, payroll information, tax information, banking details and related employment records.

5.3 Commercial and vendor information
Company details, company registration numbers, VAT numbers, B-BBEE information, pricing information, tender documents, banking details, invoices, payment records, due diligence records, contractual records and compliance documentation.

5.4 Website and system usage information
IP addresses, browser type, device identifiers, operating system details, timestamps, page interactions, referral paths, cookie data, usage patterns, server logs and similar technical information.

5.5 Communications and correspondence
Emails, contact form submissions, attachments, call notes, meeting records, enquiry details, tender communications, quote requests, supplier engagements and other written or recorded communications.

5.6 Compliance, security and access information
Information processed for site access, induction, safety compliance, incident management, security control, contractor verification, investigations, governance, insurance or legal compliance.

6. Special Personal Information

Where strictly necessary and legally permitted, KB Mining may process special personal information or other sensitive categories of information, including health information, biometric information, or information relating to criminal behaviour, particularly where relevant to occupational health and safety, access control, contractor vetting, legal claims, incident response, insurance requirements or other regulated operational processes.

Such processing will be limited to what is necessary, will occur only where there is a lawful basis to do so, and will be subject to appropriate safeguards.

7. Sources of Personal Information

KB Mining may collect personal information directly from the data subject or from other lawful sources, including:

representatives of clients, suppliers, subcontractors and consultants;
publicly available records and professional sources;
referees and verification service providers;
recruitment agencies and background screening providers;
project principals, mine operators, site managers and stakeholders;
regulatory or statutory bodies; and
website analytics, cookies and technical infrastructure.

Where required by law, KB Mining will provide appropriate notice when personal information is collected.

8. Purposes of Processing

KB Mining processes personal information only for legitimate, defined and lawful purposes, including to:

communicate with clients, suppliers, applicants and stakeholders;
evaluate and respond to tenders, requests for proposals and commercial enquiries;
conclude, administer and perform contracts;
verify identity, credentials, qualifications, authority and compliance standing;
recruit, assess, appoint and manage employees, contractors and consultants;
administer supplier, subcontractor and project relationships;
manage site access, inductions, occupational health and safety obligations, and operational compliance;
maintain governance, audit, insurance, legal and risk management processes;
secure KB Mining’s website, systems, records, premises and operations;
investigate incidents, misconduct, fraud, cyber events or unlawful conduct;
comply with statutory, regulatory, tax, labour, safety and contractual obligations; and
establish, exercise or defend legal rights.

KB Mining does not knowingly process personal information in a manner incompatible with the purpose for which it was collected, unless such further processing is authorised by law.

9. Legal Grounds for Processing

KB Mining processes personal information where there is a lawful basis for doing so, including where:

the data subject has consented;
processing is necessary to conclude or perform a contract;
processing is necessary to comply with a legal duty;
processing protects a legitimate interest of the data subject;
processing is necessary for KB Mining’s legitimate interests or those of a third party; or
processing is otherwise permitted or required by law.

10. Disclosure of Personal Information

KB Mining may disclose personal information where lawful and necessary to:

its directors, officers, employees and authorised personnel;
affiliated or associated entities where operationally required;
IT providers, cloud providers, hosting providers, website administrators and cybersecurity providers;
attorneys, auditors, insurers, brokers, accountants and other professional advisers;
payroll, HR, screening, induction and verification service providers;
clients, principals, mine owners, operators, project managers or site controllers where contract delivery, access control or compliance requires it;
banks and payment service providers;
courts, regulators, law enforcement, government authorities or statutory bodies; and
any other person where disclosure is required by law or authorised by the data subject.

Where third parties process personal information on behalf of KB Mining, KB Mining will take reasonable steps to ensure that such parties are contractually bound to maintain confidentiality and apply appropriate safeguards.

11. Cross-Border Transfers

Certain service providers or systems used by KB Mining may host or process personal information outside South Africa. Where cross-border transfers occur, KB Mining will ensure that such transfers take place only where authorised by law and subject to appropriate protections.

12. Retention and Destruction

KB Mining retains personal information only for as long as it is reasonably required for the purpose for which it was collected or subsequently processed, unless a longer retention period is required or permitted by law, regulation, contract, insurance protocol, internal governance requirements, litigation hold or legitimate operational necessity.

Retention periods may differ depending on the category of record and the legal or operational context in which it is held. Once retention is no longer justified, KB Mining will take reasonable steps to securely destroy, delete, anonymise or de-identify the relevant information.

13. Security Safeguards

KB Mining maintains reasonable technical and organisational measures to protect personal information against accidental or unlawful destruction, loss, damage, unauthorised access, disclosure, misuse or alteration.

These measures may include controlled access, password protection, document security, device security, backup procedures, limited permissions, staff confidentiality undertakings, vendor management controls and security monitoring practices.

No electronic environment can be guaranteed to be completely secure. However, KB Mining takes data protection seriously and expects all personnel and service providers handling personal information to do the same.

Where there are reasonable grounds to believe that a security compromise has occurred, KB Mining will act in accordance with its legal obligations, including notification where required.

14. Cookies and Website Technologies

The KB Mining website may use cookies, analytics tools, server logs and similar technologies to support website functionality, performance measurement, user experience, cybersecurity and administrative management.

These technologies may collect technical and behavioural information relating to how users interact with the website. Users may limit or disable cookies through browser settings, although this may affect the performance or availability of certain website functions.

Where required, KB Mining will implement an appropriate cookie notice or preference mechanism on the website.

15. Direct Marketing

KB Mining may from time to time send business-related updates or marketing communications where lawful to do so. Direct marketing by electronic means will be managed in accordance with applicable law, and recipients may opt out at any time.

Service messages, contractual notices, legal notices and operational communications do not constitute direct marketing.

16. Data Subject Rights

Subject to applicable law and any lawful grounds for refusal or limitation, a data subject may request:

confirmation of whether KB Mining holds personal information relating to that person;
access to such information;
correction, updating or deletion of personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained;
objection to certain forms of processing;
withdrawal of consent where consent is the legal basis for processing; and
details of third parties to whom personal information has been disclosed, where applicable and lawful.

All such requests must be directed to the Information Officer and may be subject to verification of identity and procedural requirements.

17. PAIA Manual

KB Mining maintains a PAIA Manual in accordance with applicable law. The Manual sets out the categories of records held by KB Mining, the process for requesting access to such records, applicable forms, and related procedures.

PAIA Manual link:
PAIA Contact Email:

The Information Regulator states that private bodies are required to make their PAIA manuals publicly available.

18. Third-Party Websites

The KB Mining website may contain links to external websites or platforms. KB Mining is not responsible for the privacy, data handling, security or content practices of third-party sites. Users access such sites at their own discretion and should review the relevant third-party privacy notices.

19. Breach Reporting and Complaints

Any person who believes that KB Mining has processed personal information unlawfully or in a manner inconsistent with this Policy should first direct the complaint to KB Mining’s Information Officer.

If the matter is not resolved satisfactorily, a complaint may be lodged with the Information Regulator (South Africa). The Regulator publishes the current complaint channels for POPIA and PAIA complaints on its official platforms.

20. Changes to this Policy

KB Mining reserves the right to amend this Privacy Policy at any time in order to reflect changes in law, regulation, technology, operations, governance standards or website functionality. The current version will be published on the website together with its effective date.

21. Contact Details

All privacy-related enquiries, PAIA requests, objections, corrections, complaints and general data protection correspondence must be addressed to:

Information Officer
KB Mining (Pty) Ltd
Physical Address:
Email:
Telephone: