Privacy Policy

PRIVACY STATEMENT

NordX’s website does not collect any personal information (see Section 1 for further details on the collection of “Personal Data”) about visitors to its website other than that which is specifically and knowingly provided by you. That personal information will not be transferred to any third party unless otherwise stated at the time of collection. NordX does use “cookies” to collect and maintain statistics relating to the number of visits to the website, the types of browsers used and the Internet Protocol Address (IP Address) of the originator. This information is used only for internal purposes (see Section 2 below for further detail on “Use of Cookies”).

1. PERSONAL DATA

On our website, we provide an option to subscribe to our email list by filling out a form in order to receive news releases or other information concerning NordX. By providing your e-mail address on this form, you are consenting to receive this information. However, you may withdraw your consent at any time.

The information we ask for on this form is simply your email address. Personal data that is collected through the subscribe form on our website is shared with the Company’s external service providers who assist us with our services and functions. Personal data that is collected through this website may be stored and processed in any country where NordX or its external service providers operate. Newsfile Corp. disseminates our news releases and Global One Media Group maintains and processes our email lists.

We take all reasonable steps to protect the security of information (including personal data) that is provided by you or exchanged with you through this website. Our security measures include using firewalls, intrusion detection systems and virus scanning tools to protect against unauthorised persons and viruses from accessing the information that you provide to us, and we to you. However, please be aware that there are inherent risks in transmitting information by use of the Internet and other online or electronic transmission systems and that we cannot guarantee the security of information transmitted in this way.

This website may contain links to third party websites. Before providing personal data to third party websites, we recommend you examine the privacy policies on those websites. NordX is not responsible for the privacy practices on third party websites.

NordX’s website, external service providers and linked third party sites are not for use by children under the age of 16 years and the Company does not knowingly collect, store, share or use the personal data of children under 16 years. If you are under the age of 16 years, please do not provide any personal data, even if prompted by the sites to do so. If you are under the age of 16 years and you have provided personal data, please ask your parent(s) or guardian(s) to notify the Company and we will delete all such personal data.

2. COOKIES

This Cookies Statement places all users of this website on notice about our use of cookies. Your continued use of this website confirms to us that you are aware of our use of cookies and have no objection to this.

When you first visit NordX’s website, you will be asked if you accept the use of cookies when you browse our website.

A cookie is a short text file that may be stored on your hard drive when you visit a website. We use the following types of cookies on this website:

• “Google Analytics” cookies (a web analytics service provided by Google, Inc). Google Analytics sets cookies that allow us to analyse traffic on the website. Google Analytics cookies allow us to recognise and count the number of visitors to this website and to see how visitors move around the site (in particular, what pages of the website are being visited). This helps us to improve the way our website works. The information provided by the cookie is transferred to our server and saved there, to enable us to analyse user behaviour. Your IP address will be immediately anonymised; users are thus anonymous. The information generated by the cookie regarding how you use the website will not be passed on to third parties.

• Display and preference settings cookies — for example, if you changed the size of the text on our website when you last visited, a cookie will remember that so that you don’t need to do it again.

• “Session cookies” — to identify and maintain a browsing session, and to remember whether you have rejected cookies through your browser settings.

• Cookies that track whether a social networking option has been used to forward material from our website (so that we know which social networking tools are in use).

These cookies do not collect or track any personal data or information about you as an individual. Instead, they are focused on how the website is used, and seek to enhance the accessibility of the website.

We also log your domain and IP address automatically when you visit this website. This data identifies the computer that you are using to view this website and your approximate geographic location. Again, we do this to track usage patterns.

Note that most web browsers allow some control of cookies through browser settings. If you delete or block our cookies, some parts of the website may not work properly, because some of our cookies are necessary for the operation of this website. A useful site on how to manage and control cookies on different browsers is: https://www.aboutcookies.org/

Our website is hosted and maintained by Adnet.

If you have concerns relating to the privacy or confidentiality of this website, please contact us at ir@nordxmetals.com.

STAKEHOLDER PRIVACY NOTIFICATION

OVERVIEW

The purpose of this privacy policy (hereinafter the “Stakeholder Privacy Policy” or “Policy”) is to inform you how NordX Metals Corp. (hereinafter “NordX”, “we”, or “us”) processes your personal data for the purpose of our internal stakeholder management. This Stakeholder Privacy Policy applies to all individuals, employees, communities, organizations, industry affiliates and contractors who we identify as a stakeholder (hereinafter “Stakeholder” or “you”).

NordX recognizes that you care about how your information is used, and your privacy is important to us. This Stakeholder Privacy Policy explains how we may collect and use your information, particularly your personal data, and the choices you can make about what information you share.

INFORMATION WE COLLECT

NordX collects information provided by you when you correspond with us directly, either by filling in our forms or by contacting us by post, phone, email or in person. We may also collect personal information about you from publicly available sources. This includes information such as your name, telephone number, email address, physical address, country of residence / region / sub-region, and whether you are employed by NordX or if you are a contractor.

Based on our perception, we may also process information about your Stakeholder group (civil society, community member, community-based organization, indigenous communities, media agencies, industry affiliates, etc.) and your level of interest, influence and position towards NordX as well as your areas of interest, such as environmental impacts or social investment.

HOW WE USE THE INFORMATION WE COLLECT ABOUT YOU

We may use your information to communicate with you; to map and have a clear visibility over our important Stakeholder relationships; to review our Stakeholder interactions and the status of such interactions; to focus on our engagement priorities; to manage and improve our business operations; and for the performance of a contract.

WHO WE SHARE YOUR PERSONAL DATA WITH

If you are a Stakeholder, your personal data may be disclosed to: legal entities (companies) within the NordX group of companies; auditors, advisors, legal representatives and other agencies; and external suppliers which process personal data on our behalf (e.g. suppliers of IT systems, system management and support and IT infrastructure providers).

In addition, we may disclose information about you if we are required to do so by law or legal process; to law enforcement authorities or other government officials, as necessary; when we believe disclosure is necessary or appropriate to prevent physical harm or financial loss or in connection with an investigation or suspected or actual illegal activity; if necessary to protect the vital interests of a person; to protect our property, services, and legal rights; to prevent fraud against NordX, our affiliates and business partners; and to support auditing, compliance, and corporate governance functions.

BUSINESS STRUCTURE CHANGES

We reserve the right to disclose and transfer all information including personal data in connection with a corporate merger, consolidation, or restructuring, the sale of substantially all of our stock and/or assets, or other corporate change, including, without limitation, during the course of any due diligence process. In these cases, we will require that your personal data is processed in accordance with our instructions, which includes secure storage, retention only for the period instructed and not subsequently shared with other organizations without our prior and express authorization.

TRANSFERS OUTSIDE THE EUROPEAN UNION

Given the Company’s exploration activities in Sweden and Finland, in the event of transfer of personal data outside the European Union, NordX shall ensure that all personal data from individuals in the European Union is processed in accordance with the General Data Protection Regulation (“GDPR”). We shall ensure that such transfers shall be made through an approved transfer mechanism with appropriate safeguards in place.

YOUR RIGHTS

We process your personal data when we have a legal basis to do so. For the processing of your personal data under this Stakeholder Policy, we will rely on the following legal bases as appropriate under the GDPR: your consent (which you may withdraw at any time by contacting us); our legitimate interest in understanding our Stakeholders and complying with applicable laws; compliance with a legal obligation under EU law; and where necessary to perform a contract with you or fulfill a request you have made.

Right of Access: You have the right to obtain confirmation as to whether we are processing personal data about you, and if so, to request a copy of the information. To help protect your privacy and security, we will take reasonable steps to verify your identity before granting access to your information.

Right to Rectification: You have the right to correct any inaccuracies in the information that we hold about you and, where applicable, complete any incomplete information that we hold.

Right to Erasure: You have the right to request that we erase personal information that we hold about you, subject to certain conditions.

Right to Restrict Processing: You have the right to restrict our processing of your information, subject to certain conditions.

Right to Object: You have the right to object to processing of your personal information based on our legitimate interests at any time. We will no longer process the information, unless there are compelling legitimate grounds for our processing that override your interests or the processing serves the purpose of asserting, exercising or defending legal claims.

Right to Withdraw Consent: When data processing is based on your consent, you have the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before such withdrawal.

Right to Data Portability: You have a right to data portability when the data processing is based on your consent or on a contract between you and NordX and the data was processed by automated means.

Right to Lodge a Complaint: You have the right to lodge a complaint with the appropriate national data protection authority at any time.

If you want to request that we exercise any of the abovementioned rights, please contact us at ir@nordxmetals.com.

HOW WE PROTECT PERSONAL DATA

We use commercially reasonable security measures, including administrative, technical, and physical safeguards to protect against loss, misuse, unauthorized access, disclosure, alteration, or destruction of the information you provide.

RETENTION OF INFORMATION

NordX retains all personal information for the duration of the relevant business relationship or, where required, in accordance with its information management policies and schedules, subject to applicable laws. When deleting personal information based on a request from the Stakeholder to whom the information relates, NordX will make reasonable attempts to ensure that all instances of the information are deleted in their entirety.

NordX is the data controller with respect to the processing of data under this Stakeholder Privacy Policy. If you have any questions regarding privacy and this Policy, please contact us at ir@nordxmetals.com.