Privacy Policy

Last updated: April 2026

This Privacy Policy describes how Rift Valley Minerals Ltd. ("Rift Valley Minerals," "we," "our," or "us") collects, uses, and protects information submitted through our website, buyer inquiry forms, email correspondence, and KYC processes. We take data protection seriously and comply with Uganda's Data Protection and Privacy Act 2019 and, where applicable, the EU General Data Protection Regulation (GDPR) and the UK Data Protection Act 2018.

1. Who We Are

Rift Valley Minerals Ltd. is a limited liability company registered in the Republic of Uganda, with its principal office at Plot 8, 5th Street, Kololo, Kampala, Uganda. For privacy-related inquiries, contact compliance@riftvalleyminerals.com.

2. Information We Collect

We collect information in the following circumstances:

a. Information you provide directly

• Name, job title, and contact details submitted through our inquiry form or by email.
• Company name, jurisdiction, registration details, and licence information submitted for KYC.
• Ultimate beneficial ownership and director identification required under AML/CFT law.
• Bank reference letters and financial capacity documentation.
• Transaction-related correspondence, contracts, and settlement records.

b. Information collected automatically

• IP address, browser type, device type, and operating system.
• Pages viewed, referral source, and time spent on the site.
• Cookie identifiers (see Section 8).

3. How We Use Your Information

We use the information we collect for the following purposes:

• Responding to inquiries submitted through our contact form or by email.
• Conducting KYC and due diligence on prospective counterparties as required by Ugandan law and international AML/CFT standards.
• Negotiating and fulfilling transactions, including contract execution, export documentation, payment settlement, and logistics.
• Compliance with legal obligations, including sanctions screening, suspicious-transaction reporting to the Uganda Financial Intelligence Authority, and record retention under tax and AML law.
• Website analytics to understand aggregate usage patterns and improve the site.
• Fraud prevention and security, including investigating misuse of our brand or the impersonation of our staff.

4. Legal Bases for Processing (GDPR)

Where GDPR applies, we rely on the following legal bases:

• Contract — processing necessary to take pre-contractual steps at your request and to perform contracts.
• Legal obligation — processing necessary to comply with AML/CFT, tax, and trade laws.
• Legitimate interests — operating and securing our business, preventing fraud, and conducting due diligence on counterparties.
• Consent — where you have given explicit consent for specific processing (you may withdraw at any time).

5. Sharing of Information

We share information only as needed to conduct our business and as required by law. Recipients may include:

• Our auditors, banks, legal counsel, and insurance providers.
• Accredited assay laboratories (SGS, Alfred H Knight, Alex Stewart) and secure logistics providers (Brinks, G4Si, Loomis).
• The Uganda Financial Intelligence Authority, Uganda Revenue Authority, Ministry of Energy and Mineral Development, and other regulators where legally required.
• Screening services used for sanctions and politically exposed persons (PEP) checks.
• Courts, law enforcement, or regulators in response to valid legal process.

We never sell personal information.

6. International Data Transfers

Because we trade internationally, your information may be transferred to and processed in jurisdictions outside your country of residence. Where such transfers occur, we rely on appropriate legal mechanisms (adequacy decisions, standard contractual clauses, or equivalent safeguards) to protect your information.

7. Data Retention

We retain personal and corporate information for as long as necessary for the purposes described above. Under Ugandan AML/CFT law, we retain KYC and transaction records for a minimum of ten (10) years after the end of a business relationship. Website analytics data is retained for up to 26 months.

8. Cookies

Our website uses a small number of cookies for essential functionality and anonymous analytics. You can disable cookies in your browser settings; some site features may not function correctly without them.

9. Security

We implement appropriate technical and organisational measures to protect information against unauthorised access, loss, or alteration — including encrypted transmission (TLS), access controls, staff confidentiality obligations, and secure storage. No system is perfectly secure; we commit to continuous improvement of our security posture.

10. Your Rights

Depending on your jurisdiction, you may have the right to access, correct, delete, or restrict processing of your personal data; to object to processing; and to data portability. You may also lodge a complaint with the Personal Data Protection Office of Uganda or, if in the EU/UK, your national data protection authority.

To exercise these rights, contact compliance@riftvalleyminerals.com.

11. Children

Our website and services are directed exclusively at corporate professional buyers. We do not knowingly collect personal information from anyone under 18 years of age.

12. Changes to This Policy

We may update this policy from time to time. Material changes will be notified by updating the "Last updated" date above and, where appropriate, by direct notice to active counterparties.

13. Contact

Rift Valley Minerals Ltd.
Plot 8, 5th Street, Kololo, Kampala, Uganda
compliance@riftvalleyminerals.com
+256 700 315 881