Information on Boliden’s processing of your personal data

This information describes how companies within the Boliden Group ("Boliden") process your personal data, and your rights. The information is addressed to anyone that:

• visits our website;
• registers a profile on our website or otherwise contacts Boliden to subscribe for information from Boliden, e.g. press-releases, quarterly reports and annual reports, as well as to obtain stock price information or to order printed information through our website or otherwise;
• communicates with us e.g. via forms on our website or via e-mail;
• visits one of our sites;
• gets in touch with Boliden in your work or assignment with any of our customers, suppliers or business partners; and
• gets in touch with Boliden representing investors, potential investors, financial institutions, “buy-side” and “sell-side” equity and credit analysts etc. or in the capacity of journalist or politician.

1. WHAT IS PERSONAL DATA?

Personal data means any information which relates to an identified or identifiable natural person, e.g. name, address, telephone number, email address, personal ID number, title, role, photograph and IP address.

2. WHO IS THE CONTROLLER FOR THE PROCESSING OF YOUR PERSONAL DATA?

Boliden Mineral AB, reg. no. 556231–6850, Box 44, 101 20 Stockholm, is the controller of personal data for Boliden’s processing of personal data which takes place when you visit our website; communicate with us via forms on our website, register a profile on our website or otherwise contacts Boliden for subscription to information or order printed information via our website or otherwise.

For the processing of personal data which takes place in connection with your contacts with Boliden in your work or assignment with any of our customers, suppliers or business partners, it is the legal entity (company) within Boliden that has a relationship with your employer or customer, e.g. through an agreement, that is the controller of personal data.

In other cases, it is the legal entity (company) that you visit or with which you communicate within Boliden that is the controller of personal data for the processing which takes place when you visit a site or communicate with us via e-mail or in other ways.

3. WHAT PERSONAL DATA DO WE PROCESS ABOUT YOU AND WHY?

3.1 When you visit our website

We process the following personal data

When you visit our website, we process your IP address, as well as information about your IT equipment (e.g. operating system and whether the visit is done by computer or smartphone). In addition, we also process information about your visit to our website through so-called cookies. For more information on cookies and to set your preferences, please go to Cookie Settings

Purpose

We process the personal data in order to:

- ensure technical functionality;

- establish statistics and evaluate our website;

- understand the visitor's behaviour on our website; and improve our website

Legal basis

We base the processing of personal data for the purposes described above on the legal basis legitimate interest.

The processing is necessary for our legitimate interest in providing a secure and user-friendly website with a content relevant to the website-visitor.

For how long do we store the personal data?

The personal data is stored as long as necessary for the purpose of the processing, however, not for a period exceeding 24 months. For duration of cookies please go to Cookie Settings

3.2 When you register a profile on our website or otherwise contact Boliden to subscribe to information from Boliden or order printed information via our website or otherwise

We process the following personal data

We process the following personal data: name, address, email address, company (if you choose to enter it), username, password and information about your subscription and order.

Purpose

We process the personal data in order to administer your order and deliver the ordered information.

Legal basis

We base the processing of personal data for the purposes described above on the legal basis legitimate interest. The processing is necessary for our (and your) legitimate interest in receiving the ordered information.

For how long do we store the personal data?

To secure traceability in our communication, we store your personal information for up to 12 months after your subscription period has ended or your order has been delivered.

3.3 When you communicate with us e.g. via forms on our website or via e-mail

We process the following personal data

When you communicate with us we process the personal data that you provide us with such as name, contact information, information concerning your question, feedback or matter.

Purpose

We process the personal data to answer your question and to handle your feedback or matter.

Legal basis

We base the processing of personal data for the purposes described above on the legal basis legitimate interest. The processing is necessary for our (and your) legitimate interest in being able to answer your question and handle your feedback or matter.

For how long do we store the personal data?

We pursue storage limitation, but the storage period depends on the purpose of the specific processing.

3.4 When you visit one of our sites

We process the following personal data

We process your name, information about the company you represent, entry and exit times at location and in some instances contact details and photography. During your visit, entry and exit times and positioning may also be recorded within the area (e.g. if there are different zones). At Boliden sites using camera surveillance (marked with informational signs at the respective site) we may process your photography and/or you may be caught on film.

Purpose

We process the personal data on entering Boliden’s area for the following purposes:

- in order to ensure that only persons with a right to be in the area, as well as within different zones within the area, are given access;

- in order to ensure your safety and the safety of others; and

- in order to protect Boliden’s property.

Camera surveillance is used for the following purposes:

- in order to monitor production;

- in order to ensure safety and prevent accidents; and

- in order to prevent crime.

Legal basis

We base the processing of personal data for the purposes described above on the following legal bases:

A legal obligation. Processing is necessary to comply with legal obligations concerning the work environment that are designed to ensure that only persons with the necessary qualifications are granted access to certain areas within the workplace; and

A legitimate interest. The processing of personal data that takes place in connection with entry control and camera surveillance is necessary in order to safeguard Boliden’s legitimate interest of knowing who has access to and enters Boliden’s areas, to ensure safety and security, e.g. so that everyone can be evacuated in an emergency, to prevent accidents and to protect Boliden’s property against sabotage and theft, for instance.

For how long do we store the personal data?

We pursue storage limitation, but the storage period depends on the purpose of the specific processing. More details on local storage periods are available at the site you visit.

3.5 In connection with your contacts with Boliden in your work or assignment with any of our customers, suppliers or business partners.

We process the following personal data

We process your name, phone number, mobile number, e-mail address, address, title, role and description of work tasks, as well as other personal data that may need to be processed to achieve the purposes described below, e.g. in documentation related to agreements that Boliden has with your employer or customer, by email contact, or by publication on Boliden's intranet or in other media in order to make the personal data available primarily to Boliden's employees.

Purpose

We process the personal data to:

- fulfill obligations under agreements with your employer or customer;

- administer agreements, negotiations or other cooperation;

- handle customers’, suppliers’ and business partners’ demands; and

- market Boliden’s products.

Legal basis

We base the processing of personal data for the purposes described above on the legal basis legitimate interest.

The processing is necessary for our legitimate interest in being able to fulfill obligations under agreements, administer agreements, negotiations or other cooperation, handle customers’, suppliers’ and business partners’ demands and market Boliden’s products.

For how long do we store the personal data?

We pursue storage limitation, but the storage period depends on the purpose of the specific processing.

3.6 In connection with your contacts with Boliden representing investors, potential investors, financial institutions, “buy-side” and “sell-side” equity and credit analysts etc. or in the capacity of journalist or politician

We process the following personal data

We process your name, phone number, mobile number, e-mail address, role and description of work tasks, as well as other personal data that may need to be processed to achieve the purposes described below.

Purpose

We process the personal data to:

- provide the capital market and the general public with information on Boliden;

- send out invitations to Boliden’s Capital Market Day and other events, administer and to carry out such events (including visits to Boliden sites); and

- create and uphold relations with decision-makers in local, regional and central governments.

Legal basis

We base the processing of personal data for the purposes described above on the legal basis legitimate interest. The processing is necessary for our legitimate interest to provide information on Boliden, send out invitations to Boliden’s Capital Market Day and other events and to create and uphold relations with decision-makers.

For how long do we store the personal data?

We pursue storage limitation, but the storage period depends on the purpose of the specific processing.

3.7 To fulfill a legal obligation or to exercise, establish or defend our legal rights

In addition to what is described above, there might be other situations, when, we process your personal data to fulfil legal obligations, such as the obligation to maintain accounts, or at the request of an authority. The legal basis for the processing in such case is that the processing is necessary to fulfil a legal obligation. In those cases, we will store the data as long as we are obliged to.

We might also process your personal data to exercise, establish or defend our legal rights. The legal basis for the processing in such case is our legitimate interest to exercise, establish or defend our legal rights. In those cases, we will store the data as long as is necessary to fulfil the purpose of the processing.

4. FROM WHICH SOURCES DO WE COLLECT YOUR PERSONAL DATA?

In addition to the personal data you provide to us, we process the following personal data:

- data which is stored regarding visitors to our website, which the visitor to the website provides via their electronic tools, for example computer or smartphone;

- data which is provided by customers, suppliers and other business partners;

- data from public records, websites and media; and

- data from surveillance cameras (at sites where surveillance cameras are used).

5. PARTIES WITH WHOM WE MAY SHARE YOUR PERSONAL DATA

Your personal data may be disclosed to:

- legal entities (companies) within Boliden other than the controller legal entity;

- auditors, advisors, legal representatives and similar agencies;

- so-called processors (external suppliers which process personal data on Boliden’s behalf) e.g. suppliers of IT systems, system management and support, or IT infrastructure providers; and

- other recipients as required by law, other constitution or authority decision.

6. TRANSFER OF PERSONAL DATA TO THIRD COUNTRIES

We may transfer your personal data to a third country, i.e. a country outside of the EU/EEA. This may take place, for example, through the storage of personal data on servers located in a third country, or where we retain an IT supplier to provide support and maintenance of IT systems from a third country. In the event we transfer personal data to a third country, we will enter into agreements and take other measures to protect your personal data in accordance with applicable legal requirements.

7. YOUR RIGHTS You have the right to request information about the use of your personal data. You also have the right to request correction of incorrect personal data. Moreover, in certain cases, you also have the right to erasure of personal data, or restriction of the processing, and you are entitled to object to the processing. In addition, in certain cases, you also have the right to receive your personal data in a machine-readable format (only when you have provided us with the personal data and the processing of your personal data is based on consent or on a contract).

8. BOLIDENS DATA PROTECTION OFFICER, “DPO”

Boliden has appointed a data protection officer who, on an overall level, shall ensure that we comply with the GDPR. The data protection officer can be reached at [email protected] and by telephone +46 8 610 1551.

9. COMPLAINTS

In the event you believe that our processing of your personal data is in violation of the data protection legislation, you are asked to firstly contact the legal entity (company) within Boliden that is the controller for the processing of your personal data, see section 2 above, so that the processor is given the opportunity to correction. You can also contact our DPO, see section 8. However, you always have the possibility of submitting complaints to the supervisory authority (the Swedish Authority for Privacy Protection (IMY) in Sweden or your local supervisory authority) where you believe that Boliden is processing your personal data in violation of data protection legislation.