At Tulla Resources, we take the protection of your personal information very seriously. This policy is designed to describe the personal information we collect, how we protect it and what we do with it.

The kinds of personal information we collect and hold

We collect various kinds of current and historical personal information about individuals, which may include:

• name

• contact details

• identification details

• payment details

• work details – e.g. work capabilities, CV information, work conduct, payroll details, training records, background checks

• application and registration information – e.g. when apply for a job or to invest in Tulla Resources

• preferences and opinions in relation to our services and business

• enquiry/complaint details

• transactions and communications with us

• next of kin, emergency contacts and nominated representatives.

The types of information we collect about different individuals will vary depending on the nature of our relationship with the individual. For example, we collect different information about job applicants and investors.

Some of this information is collected under applicable laws such as the Fair Work Act, Superannuation Guarantee (Administration) Act, the Income Tax Assessment Act and other tax laws, Corporations Act, ASX Listing Rules, occupational health and safety acts and workers compensation acts.

How we collect personal information

We collect personal information directly from individuals. In some circumstances we also collect personal information through other sources including relatives, guardians, representatives, public sources, professional registers, background check providers and academic institutions.

See the section on ‘Our website’ below for more about our collection of personal information online, and ‘Sharing of personal information’ for more about third parties who may share personal information with us.

Why we handle personal information

Tulla Resources is a gold development and mineral exploration company. Amongst other things, we interact with individuals who are our staff, investors and website visitors.

We collect, hold, use and disclose personal information to operate our business and manage our team. This includes:

•providing, administering and improving our services

• providing investor services including processing investment applications, servicing investor needs, providing requested facilities and services and carrying out appropriate administration

• contacting you in relation to our services

• processing payments and refunds

• verifying your identity and personal information

• maintaining and updating our records

• recruiting, training and managing staff and service providers

• meeting our legal obligations and defending and exercising our legal rights

• protecting the safety and security of staff, third parties and facilities

• facilitating acquisitions and potential acquisitions of our business.

We may not be able to do these things without your personal information. For example, we may not be able to communicate with you or process your investment application.

We may provide marketing communications and targeted advertising to you on an ongoing basis by telephone, electronic messages (eg. email), online (including websites and mobile apps) and other means, unless you opt out or we are subject to legal restrictions. See the marketing materials for details of how to opt out, or contact us as set out below.

Sharing of personal information

We share personal information with third parties and vice versa. Those parties include our related bodies corporate (who may handle personal information pursuant to this privacy policy), our joint venture partners, your and our representatives and our service providers. Our service providers include providers of share registry, investor, archival, auditing, accounting, customer contact, legal, business consulting, banking, payment, debt collection, delivery, data processing, data analysis, document management, information broking, research, investigation, insurance, printing, website and technology services.

Third parties that personal information is shared with may be located in the UK and other countries. These parties will often be subject to obligations to protect the personal information they have access to, but we will not necessarily ensure that they meet the specific requirements of Australian privacy laws.

Our website

This section applies to our website at tullaresources.com and to any other websites we operate or for which we authorise the use of this Privacy Policy (the ‘Websites’).

If you use our Websites to read, browse or download information, our system may record information such as the date and time of your interaction, the pages accessed and any information downloaded. This information is used for statistical, reporting and website administration and maintenance purposes.

Like many other websites, our Websites may use ‘cookies’ from time to time. A cookie is a piece of information that allows our system to identify and interact more effectively with your browser. The cookie helps us to maintain the continuity of your browsing session and remember your details and preferences when you return. You can configure your web browser software to reject cookies however some parts of our Websites may not have full functionality in that case.

The Websites may contain links to other sites. We are not responsible for the privacy practices or policies of those sites.

How we hold and protect personal information

We hold personal information electronically and in hard copy form, both at our own premises and with the assistance of our service providers.

We implement a range of measures to protect the security of personal information, including – depending on the circumstances – electronic access controls, premises security and network firewalls.

Accessing and updating your personal information

If you wish to seek access to or correct of any personal information we may hold about you, please contact us or our share registry (as appropriate). We aim to respond within a reasonable time and may need to verify your identity. You may be asked to pay a reasonable charge for access.

Please provide as much detail as you can about the particular information you seek, in order to help us locate it. We may deny some requests for access to or correction of personal information where the law allows us to do so.

Our contact details are in the ‘Contact us’ section below. Our share registry, Computershare, can be contacted as follows:

web.queries@computershare.com.au

Telephone: 1300 850 505 (within Australia) or + 61 3 9415 4000 (outside Australia)

Contact us

Attention: Stephen Law (Privacy Officer)

Email: admin@tullaresources.com

Telephone: +61 (0)2 9095 4266

Suite 5, Level 2

2 Grosvenor Street

Bondi Junction NSW 2022

Australia

Tulla Resources Plc ARBN 122 088 073

Last updated: 4 March 2021