Policy Statement

Gold Corporation (trading as The Perth Mint ABN 98 838 298 431) (us, we, our) is committed to protecting the privacy of your (you, your) Personal Information. Please read this privacy policy (policy) to learn what we are doing with your Personal Information, how we protect it and what privacy rights you may have under applicable privacy laws such as the Commonwealth Privacy Act 1988 (Privacy Act), including the Australian Privacy Principles, and the Privacy Amendment (Notification of Data Breaches) Act 2017 (Privacy Law).

What is covered by this Policy?

This Privacy Policy applies to all prospective, current and past employees, board members, peers, agents and vendors, third-party suppliers and contractors who provide services to Gold Corporation.

This Privacy Policy applies to how we collect, hold, use, and disclose Personal Information. It provides information on how we deal with your Personal Information as prospective, current, or past employees, including the other roles outlined above.

For specific processing activities we may also provide you with additional “Collection Notices” prior to collecting and processing your information based on the requirements of Privacy Law. Where required, Collection Notices will be provided at the time of collection and are also available for reference on our website.

What is not covered by this Policy?

Employee records

This Privacy Policy does not apply to information classified as an Employee Record. The handling of employee records by Gold Corporation is exempt from the Australian Privacy Principles if it directly relates to a current or former employment relationship between you and Gold Corporation.

While me may be exempt from complying with the Australian Privacy Principles in relation to Employee Records, we endeavour to be transparent in the way we handle your Personal Information, which includes where possible, handling it in the same manner we would if it were not exempt.

Customers or visitors to our website

This Privacy Policy does not apply to the handling of Personal Information relating to:

• Customers
• Visitors to our website
• Persons making use of our products and services.

The handling of this personal information is covered by Gold Corporation’s Privacy Policy available here.

Information which does not constitute personal information

Information is not considered Personal Information is it is not maintained in a manner that:

• Identifies
• Relates to
• Describes
• Is reasonably capable of being associated with or
• Could be reasonably linked, directly or indirectly, with a particular individual.

What can you find in this Policy?

This Policy tells you, among other things:

• What Personal Information we collect about you, how we obtain it and who we share it with.
• For what purposes we use that Personal Information.
• How long we keep your Personal Information.
• Your rights about the Personal Information we collect about you and how you can exercise those rights.
• How we protect your Personal Information.
• How to contact us.

What Personal Information we process, how we obtain it and Third Parties that we share information with

We collect Personal Information as reasonably necessary to allow us to:

• Manage our business affairs.
• Engage third party suppliers and contractors for the purposes of providing us with services.
• Engage board members, peers, and agents.
• Consider the suitability of prospective employees, including conducting background checks.
• Enter into formalised agreements with employees.
• Provide services and benefits to our employees, including offering training opportunities.
• Advertise employment opportunities.

We may also need to collect Personal Information meet certain contractual, legal, or regulatory obligations.

The table below describes the categories of Personal Information we may have collected about you.

If we are unable to collect Personal Information we reasonably require, we may not be able to assess an application you submit or proceed with formal engagement or employment.

We may transfer your Personal Information to Third Parties overseas. We will only transfer your Personal Information to overseas third parties in compliance with requirements of Privacy Law and if needed we will make sure that appropriate safeguards are in place. These safeguards may include:

• We have taken reasonable steps to ensure that the overseas third party does not breach Privacy Law relevant to us.
• The overseas recipient is bound by a similarly stringent privacy protection regime.
• You have provided your consent.

Other disclosures of your Personal Information

We may disclose your Personal Information to the extent required by law. For example, we may disclose your Personal Information to government or regulatory authorities to comply with contractual, legal, or regulatory obligations.

We may also disclose your Personal Information if we transfer all or some of our company’s business interests, assets, or both, during a corporate restructuring.

Emergency contact details and referees

We may collect, use, disclose and store Personal Information that you provide to us about other individuals (e.g. name and contact details of referees and emergency contacts). We rely on you to inform those individuals that their Personal Information is being provided to us and that they may contact us for further information about how their information is handled.

Provision of devices and access management

We may collect, use, disclose and store Personal Information to provide you with access to corporate devices such as computers and mobiles and to manage access and licences so you can use our systems and software. This may include your internet protocol (IP) address or location data. Asset and access management are an integral part of our Information Security processes and help us to protect the data held within our systems.

For what purposes do we use your Personal Information?

We will use and/or disclose your Personal Information for the purpose it was originally collected, for other purposes which you consent to, or as required or permitted by law. We may process your Personal Information for purposes including:

• Providing you with information related to your prospective or current engagement with us.
• Verifying your identity.
• Assessing and processing an application you submit.
• Managing our relationship with you.
• Conducting pre-employment checks.
• Offering you benefits and services.
• Providing you with training opportunities.
• To conduct our business.

Opting out

By registering for a profile on our recruitment website, you are opting in to receive email notifications about employment positions that we believe match the personal preferences you have selected. You can tell us if you no longer want to receive these emails by contacting our People and Culture Team.

How long we keep your Personal Information

We will retain your Personal Information for as long as is necessary to fulfil the purpose for which we collected it, or any other permitted linked purpose in compliance with our data retention policies. For example, we will retain and use your Personal Information for the extent necessary to engage you, manage our relationship with you, or to comply with our legal and regulatory obligations.

If Personal Information is used for more than one purpose, we will retain it until the purpose with the longest retention period expires. If we no longer need your Personal information, including if we are not required to retain it by law, we will take reasonable steps to destroy or deidentify it within twelve (12) months of receiving it.

If you wish for us to maintain your application and accompanying information for future use beyond this twelve (12) month period, you should tell us by contacting our People and Culture Team.

Data integrity and security

We are strongly committed to keeping your Personal Information safe and protecting the information that we hold from unauthorised processing.

Unauthorised processing includes:

• Misuse
• Interference
• Loss
• Unauthorised access
• Exfiltration
• Theft
• Modification
• Destruction

The steps we take to secure the Personal Information we hold include security (such as encryption, firewalls, anti-virus software, login, and password protection), secure office access, personnel security and training and workplace policies.

Despite the reasonable steps we will take to secure your Personal information, there is a risk that breaches may occur. We have established procedures in place to investigate whether a data breach has occurred and if notification or other action is required under Privacy Law.

If you reasonably believe that there has been unauthorised use or disclosure of your Personal Information, please contact our Privacy Officer.

Privacy of children

If you are under the age of eighteen (18) you must obtain the consent of a parent or guardian prior to providing your information to us. Your parent or guardian will be responsible for appropriately supervising the provision of any information, including consenting to the terms outlined in this Privacy Policy on your behalf.

What Privacy Rights do you have?

If you are currently employed or engaged by Gold Corporation, you should ensure that any Personal Information we hold is up to date and accurate. If your Personal Information changes, you should amend the information or notify us as soon as possible so we can update it. In some instances, you may be able to do this yourself otherwise you may also contact our People and Culture Team and request they do this for you.

You have the right to request access to your Personal Information that we hold. You also have the right to request its correction if it is inaccurate, incomplete, or out of date. We will take reasonable steps to give access to the information or correct it, subject to any exemptions allowed under the Privacy Act 1988.

To access any of your rights please contact our Privacy Officer.

If we are required to verify your identity, we will contact you to describe our identity verification process. Please allow us up to thirty (30) days from the day received for us to reply to your request. We will send our written response by mail or electronically, at your option.

If you are not satisfied by our response, you may acquire further information regarding privacy from the office of the Australian Information Commissioner using the following contact details:

If you have provided your Personal Information to us using a job board website or recruitment agency, you must contact them directly if you need to access or correct your information. We are not responsible for how they handle your information, and you should review their Privacy Policy for more information.

Contact our Privacy Officer

If you have any queries about the personal information that we hold about you or the way we handle that personal information , please contact our Privacy Officer at the contact details provided below: