Effective Date: 5 February 2026
1. Introduction
CMMINGING DEALS (Pty) Ltd (“the Company”) is a South African mining and resource investment enterprise engaged in commercial mineral development, commodity facilitation, and strategic resource partnerships. This Privacy Policy governs the collection, processing, storage, and disclosure of personal information obtained through our operations, contractual engagements, regulatory submissions, and digital platforms. The policy reflects our commitment to compliance with the Protection of Personal Information Act No. 4 of 2013 (POPIA), applicable international data protection standards, and the principles of responsible corporate governance.
CMMINGING DEALS (Pty) Ltd (“the Company”) is a South African mining and resource investment enterprise engaged in commercial mineral development, commodity facilitation, and strategic resource partnerships. This Privacy Policy governs the collection, processing, storage, and disclosure of personal information obtained through our operations, contractual engagements, regulatory submissions, and digital platforms. The policy reflects our commitment to compliance with the Protection of Personal Information Act No. 4 of 2013 (POPIA), applicable international data protection standards, and the principles of responsible corporate governance.
2. Scope and Application
This policy applies to all personal information processed by CMMINGING DEALS in the course of its business activities, including but not limited to interactions with investors, joint venture partners, contractors, government authorities, suppliers, service providers, and website visitors. It extends to data collected physically at operational sites, through electronic communications, and via our corporate website.
This policy applies to all personal information processed by CMMINGING DEALS in the course of its business activities, including but not limited to interactions with investors, joint venture partners, contractors, government authorities, suppliers, service providers, and website visitors. It extends to data collected physically at operational sites, through electronic communications, and via our corporate website.
3. Lawful Basis for Processing
The Company processes personal information only where such processing is lawful under POPIA. Primary legal bases include:
The Company processes personal information only where such processing is lawful under POPIA. Primary legal bases include:
- Performance of a contract or pre-contractual measures;
- Compliance with statutory or regulatory obligations;
- Legitimate interests pursued by the Company, provided these are not overridden by the data subject’s rights;
- Consent, where explicitly obtained for specific purposes.
4. Categories of Personal Information Collected
The Company may collect and process the following types of personal information:
The Company may collect and process the following types of personal information:
- Identity and contact details (name, title, company affiliation, email, telephone number);
- Professional credentials and institutional affiliations;
- Financial and banking information for transactional purposes;
- Know Your Customer (KYC) and Anti-Money Laundering (AML) documentation;
- Geospatial and operational data linked to mining activities where individuals are identifiable;
- Technical data from website usage, including IP address and browser type.
5. Purpose of Collection and Use
Personal information is used strictly for legitimate business purposes, including:
Personal information is used strictly for legitimate business purposes, including:
- Executing mineral supply, investment, or partnership agreements;
- Fulfilling statutory reporting and regulatory compliance requirements;
- Conducting due diligence on counterparties and service providers;
- Managing investor relations and corporate communications;
- Securing and maintaining operational infrastructure;
- Responding to legitimate inquiries submitted through official channels.
6. Data Collection Methods
Information is collected directly from data subjects, through contractual documentation, regulatory filings, secure digital forms, and verified third-party sources. The Company does not engage in covert or automated mass surveillance. Website data collection is limited to essential operational and security purposes.
Information is collected directly from data subjects, through contractual documentation, regulatory filings, secure digital forms, and verified third-party sources. The Company does not engage in covert or automated mass surveillance. Website data collection is limited to essential operational and security purposes.
7. Data Security and Integrity
CMMINGING DEALS implements appropriate technical and organisational measures to safeguard personal information against unauthorised access, loss, or unlawful processing. These include encrypted communications, role-based system access, physical site security, staff confidentiality undertakings, and periodic security audits. While absolute security cannot be guaranteed, the Company maintains controls commensurate with the sensitivity of the data and prevailing industry standards.
CMMINGING DEALS implements appropriate technical and organisational measures to safeguard personal information against unauthorised access, loss, or unlawful processing. These include encrypted communications, role-based system access, physical site security, staff confidentiality undertakings, and periodic security audits. While absolute security cannot be guaranteed, the Company maintains controls commensurate with the sensitivity of the data and prevailing industry standards.
8. Data Retention
Personal information is retained only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. Retention periods are determined by contractual duration, statutory limitation periods, tax and audit requirements, and regulatory obligations—typically ranging from five to ten years post-relationship termination.
Personal information is retained only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. Retention periods are determined by contractual duration, statutory limitation periods, tax and audit requirements, and regulatory obligations—typically ranging from five to ten years post-relationship termination.
9. Disclosure and Sharing
The Company does not sell, rent, or trade personal information. Disclosure occurs only under the following circumstances:
The Company does not sell, rent, or trade personal information. Disclosure occurs only under the following circumstances:
- To regulatory or governmental authorities as mandated by law;
- To auditors, legal advisors, or compliance partners bound by confidentiality obligations;
- To logistics, verification, or financial service providers strictly necessary for transaction execution;
- With explicit consent or where otherwise permitted under POPIA.
10. Cross-Border Transfers
Where personal information is transferred outside South Africa, the Company ensures adequate safeguards are in place, including contractual clauses aligned with POPIA Section 72, and confirmation that the recipient jurisdiction provides an adequate level of protection or equivalent contractual assurances.
Where personal information is transferred outside South Africa, the Company ensures adequate safeguards are in place, including contractual clauses aligned with POPIA Section 72, and confirmation that the recipient jurisdiction provides an adequate level of protection or equivalent contractual assurances.
11. Data Subject Rights
In accordance with POPIA, data subjects have the right to:
In accordance with POPIA, data subjects have the right to:
- Request confirmation of whether their personal information is being processed;
- Access and request correction of inaccurate information;
- Object to processing based on legitimate interests;
- Request deletion where retention is no longer lawful;
- Lodge a complaint with the Information Regulator.
Requests must be submitted in writing to the Company’s Information Officer and will be addressed within the statutory timeframe.
12. Cookies and Website Analytics
Our website uses strictly necessary cookies to ensure functionality and security. We do not deploy tracking, advertising, or third-party analytics cookies. Users may disable cookies via browser settings, though this may affect site performance.
Our website uses strictly necessary cookies to ensure functionality and security. We do not deploy tracking, advertising, or third-party analytics cookies. Users may disable cookies via browser settings, though this may affect site performance.
13. Third-Party Services
Where third-party services are integrated (e.g., secure document portals, payment processors), the Company ensures such providers adhere to data protection obligations through binding agreements. The Company remains accountable for the integrity of data processing conducted on its behalf.
Where third-party services are integrated (e.g., secure document portals, payment processors), the Company ensures such providers adhere to data protection obligations through binding agreements. The Company remains accountable for the integrity of data processing conducted on its behalf.
14. Policy Review and Updates
This policy is reviewed annually or as necessitated by legal or operational changes. Material updates will be published on the corporate website with an updated effective date. Continued engagement with the Company constitutes acceptance of the revised terms.
This policy is reviewed annually or as necessitated by legal or operational changes. Material updates will be published on the corporate website with an updated effective date. Continued engagement with the Company constitutes acceptance of the revised terms.
All requests will be handled with discretion, diligence, and in strict accordance with POPIA.