Privacy Policy

1. About this policy

This Privacy Policy explains how Blackstone Minerals Limited (ACN 614 534 226) (Blackstone, we, us or our) collects, uses, discloses and protects personal information. It applies to information collected through this website (blackstoneminerals.com.au) and when you otherwise deal with us as an investor, enquirer or member of the public.

We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

2. What personal information we collect

We only collect personal information that we need. Depending on how you deal with us, this may include:

• Email alerts: if you subscribe to receive ASX announcements and company updates, your first name, surname and email address, together with the date you subscribed and where on the site you signed up.
• Enquiries: if you contact us by email, phone or post, your contact details and the content of your enquiry.
• Technical information: when you visit the website, our hosting provider automatically processes information such as your IP address, browser and device type, and the pages you request. This is used to deliver and secure the website and is not used by us to identify you.
• Search queries: text you enter into the announcement or news search boxes, which is processed to return results and is not linked to your identity.
• Website usage (analytics): if you accept cookies, Google Analytics collects information about how you use the website, such as the pages you visit, how long you stay, how you arrived at the site, your approximate location (city or region), and your device, browser and screen size. We use this information in aggregate and do not use it to identify you.

We do not intentionally collect sensitive information (such as health information or political opinions). Please do not send us sensitive information through the website or by email.

Shareholder information

If you are a Blackstone shareholder, information about your holding is kept by our share registry, Automic Group, as required by the Corporations Act 2001 (Cth). The registry's own privacy policy applies to that information. To update your holding details, contact Automic on 1300 288 664 (within Australia), +61 2 9698 5414 (international), or at automicgroup.com.au.

3. How we collect personal information

We collect personal information directly from you, for example when you subscribe to email alerts or contact us. We do not buy personal information from third parties.

You can browse this website without telling us who you are. However, we cannot send you email alerts without your name and email address.

4. How we use personal information

We use personal information to:

• send you the ASX announcements and company updates you have asked to receive;
• respond to your enquiries;
• operate, maintain and protect the security of the website;
• understand how the website is used so we can improve it (only if you accept analytics cookies); and
• comply with our legal and regulatory obligations, including under the Corporations Act 2001 (Cth) and the ASX Listing Rules.

We do not sell or rent personal information, and we do not use it for third-party marketing. We do not make decisions about you using solely automated processes.

5. Email alerts and unsubscribing

We only send email alerts to people who have subscribed, in line with the Spam Act 2003 (Cth). You can unsubscribe at any time using the unsubscribe link in any email we send, or by contacting us using the details below.

6. Cookies and similar technologies

When you first visit the website, we ask whether you accept cookies. Nothing described in this section as requiring consent is loaded unless you accept.

Strictly necessary

We use your browser's local storage to remember your cookie choice and whether you have closed the email sign-up pop-up. This does not require consent and is not shared with anyone.

Analytics (with your consent)

We use Google Analytics, a service provided by Google LLC, to understand how visitors use the website. It sets the following cookies:

• _ga: distinguishes unique visitors; expires after 2 years; and
• _ga_<ID>: keeps track of your session; expires after 2 years.

Google Analytics does not log or store full IP addresses. We do not use Google Analytics for advertising, and we have not enabled Google signals or advertising features. Google processes this information on our behalf; see how Google uses information from sites that use its services. You can also opt out of Google Analytics on all websites by installing the Google Analytics opt-out browser add-on.

Third-party content (with your consent)

Some pages include content from third parties, which may set their own cookies:

• YouTube (Google) videos on our news and media pages; and
• Google Maps on our contact page.

Changing your choice

If you reject cookies, analytics is not loaded and a placeholder is shown in place of third-party content, which you can choose to load later. You can change your choice at any time using the Cookie settings link in the website footer. If you withdraw consent, we stop Google Analytics and remove the Google Analytics cookies it set on this website.

The share price chart and market data on our website are supplied by Weblink Pty Ltd and are loaded from Weblink's servers, which receive your IP address and browser information when the chart loads.

7. Who we disclose personal information to

We may disclose personal information to:

• service providers who help us run the website and our communications, such as our hosting and data storage provider (Cloudflare, Inc.), our website analytics provider (Google LLC) and any email delivery provider we use to send alerts;
• our professional advisers, such as lawyers, auditors and accountants; and
• regulators, courts, law enforcement or government authorities where we are required or authorised by law to do so.

We require our service providers to handle personal information only for the services they provide to us.

8. Overseas disclosure

Our website is hosted by Cloudflare, which operates a global network. As a result, personal information may be processed or stored outside Australia, including in the United States and other countries where Cloudflare operates. Google, which provides Google Analytics and the embedded YouTube and Google Maps content, is based in the United States and may process information there and in other countries where it operates. We take reasonable steps to ensure overseas recipients handle personal information consistently with the Australian Privacy Principles.

9. Storage, security and retention

We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification or disclosure. The website is served over an encrypted (HTTPS) connection, and access to subscriber information is restricted to people who need it.

We keep email alert details while you remain subscribed. Google Analytics data is kept for no more than 14 months and then deleted automatically. When personal information is no longer needed, and we are not required by law to keep it, we take reasonable steps to destroy or de-identify it.

10. Accessing and correcting your information

You can ask for access to the personal information we hold about you, or ask us to correct it, by contacting us using the details below. We will respond within 30 days. We do not charge for making a request. If we refuse your request, we will tell you why in writing, unless it would be unreasonable to do so.

11. Visitors outside Australia

If you are in the European Union or United Kingdom, we rely on your consent to send email alerts and on our legitimate interests to operate and secure the website. We rely on your consent for analytics cookies, and you can withdraw it at any time using the Cookie settings link in the website footer. You may also have rights to ask us to delete your information, to object to or restrict how we use it, and to receive a copy of it in a portable format. Contact us to make a request.

12. Complaints

If you have a concern about how we have handled your personal information, please contact our Privacy Officer in writing using the details below. We will acknowledge your complaint promptly and aim to respond within 30 days.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992.

13. Changes to this policy

We may update this Privacy Policy from time to time. The current version will always be published on this page, with the date it was last updated.

14. Contact us