Recruitment Portal Privacy Notice

Recruitment Portal Privacy Notice

Tavex Gold Ltd — United Kingdom

Last updated: 2 July 2026

1. General Provisions

(1) This Recruitment Portal Privacy Notice (“the Notice”) explains how Tavex Gold Ltd processes your personal data when you access and use the Tavex Recruitment Portal (“the Portal”) to apply for a vacancy published by Tavex Gold Ltd. It describes your rights and our obligations under the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018. Nothing in this Notice restricts or removes any right you have under that legislation.

(2) If you have any questions about this Notice, or wish to contact us about any matter concerning your personal data, you can write to us at: Tavex Gold Ltd, 110 Hatton Garden, London, EC1N 8LY; email: tavex@tavexbullion.co.uk; telephone: +44 (0)20 4541 4145.

(3) For applications to vacancies in the United Kingdom, the data controller is Tavex Gold Ltd, a company registered in England and Wales under company number 11167367, VAT registration number GB414694879, with its registered office at 110 Hatton Garden, London, EC1N 8LY (“Tavex”, “the Company”, “we”). Technical operation of the Portal may be supported by other companies in the Tavex corporate group acting on our behalf.

(4) “Personal data” means any information relating to an identified or identifiable natural person — in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that person. “Processing” means any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

(5) Tavex respects the following principles when processing your personal data: (i) lawfulness, fairness and transparency; (ii) purpose limitation; (iii) data minimisation; (iv) accuracy; (v) storage limitation; (vi) integrity and confidentiality, ensuring an appropriate level of security; (vii) accountability.

(6) As a data controller, Tavex collects only the personal data necessary for the purposes described in this Notice and protects it responsibly and lawfully. We apply technical and organisational measures across our staff, premises, software, hardware, networks, encryption, access control, monitoring and vulnerability management, providing physical, personnel, documentary and cryptographic protection against unauthorised or accidental access, loss, alteration, disclosure or destruction, proportionate to the risks involved. All our employees are bound by confidentiality obligations in respect of personal data they access in the course of their work.

(7) We process the personal data you provide when applying for a job through the Portal. In addition, we may collect further personal data about you to the extent permitted or required by UK law for purposes related to your specific application(s).

2. Categories of Personal Data and Retention Periods

(1) When you apply for a job through the Portal, we collect your personal data as follows:

(i) information you provide or update when completing fields or forms on the Portal: names; permanent address; place and date of birth; telephone number; email address; type and level of education and/or professional qualifications; name and location of educational institutions attended; and publicly available information you direct us to, including where you provide a link to your LinkedIn or other social network profile, to the extent the Portal offers that functionality;

(ii) information you provide when reporting a technical issue with the Portal or contacting us on another matter, whether in writing (via the contact form or email) or by telephone. If you contact us, we may keep a record of the correspondence;

(iii) details of your visits to the Portal, including the date and time of access, pages visited, IP address, hardware and software used, traffic data, approximate location data, and the time, date and IP address of your acknowledgement of this Notice;

(iv) if you access the Portal via a mobile device, data about that device, such as its identification number and type, and approximate location data. If you do not wish us to receive location details, you can disable the relevant functions on your device where it offers that option.

(2) When applying via the Portal, you may use personal data stored on platforms operated by other providers, such as LinkedIn. The processing of your personal data by those providers is governed by their own privacy policies, which you should consult.

(3) You may also provide us with additional material, such as a CV (with a photograph, if you choose to include one), a cover letter, attachments (for example diplomas, training certificates, or references from previous employers), and information about your professional experience, certifications, language skills, geographical mobility, and the channel through which you found the vacancy.

(4) When administering the Portal, Tavex does not collect or intentionally process:

(i) personal data of persons under the age of 18, or of persons lacking legal capacity;

(ii) special categories of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, nor genetic data, biometric data, data concerning health, sex life or sexual orientation, nor personal data relating to criminal convictions and offences.

If we become aware that we have received such personal data through the Portal, we will take steps to erase it as soon as possible. This does not affect the statutory right-to-work checks that we carry out for successful candidates at offer stage, which are conducted separately and explained to the candidate at that point.

(5) In addition to the above, your personal data may be processed where necessary to comply with legal obligations to which Tavex is subject (Article 6(1)(c) UK GDPR) and to pursue the legitimate interests of Tavex or a third party (Article 6(1)(f) UK GDPR), such as the establishment, exercise or defence of the legal rights of Tavex or any other member of the Tavex corporate group. Your personal data will also be processed in the operation and management of Tavex’s IT systems, whether hosted internally or externally.

(6) The core information requested in the application form is necessary for us to consider your application for the selected vacancy; we process it as part of the steps taken at your request prior to potentially entering into an employment contract with you (Article 6(1)(b) UK GDPR). Any additional information you choose to provide is voluntary. If you do not provide the core information, we will not be able to process your application. We will retain your details for consideration in future selection procedures only with your consent.

(7) Retention periods. We keep your personal data as follows:

(i) data relating to an application that does not result in an offer, or that you withdraw, is retained for the duration of the recruitment exercise and for 12 months after its conclusion, for the purposes of administration, audit, and the establishment, exercise or defence of legal claims;

(ii) where you have given your explicit consent, we retain your details for up to a further 24 months so that we can consider you for future vacancies; after that period your data is deleted unless you renew your consent. You may withdraw this consent at any time;

(iii) if your application is successful, the relevant data is transferred to your employment file and handled in accordance with the employee privacy notice provided to you at that stage;

(iv) where a role is filled under Tavex’s sponsor licence, recruitment records relating to the sponsored worker are retained for the periods required by Home Office sponsor guidance;

(v) cookies are retained for the periods described in Section V, depending on the type of cookie.

3. Legal Grounds for Processing

(1) Depending on the purpose for which your data is used, the legal grounds for processing are one or more of the following:

(i) processing necessary for steps taken at your request prior to entering into a contract (Article 6(1)(b) UK GDPR) — the assessment of your application for the vacancy you have applied to;

(ii) your consent (Article 6(1)(a) UK GDPR) — for retaining your details for future selection procedures, and for any optional information you choose to provide. You may withdraw consent at any time by contacting us at the details in Section I(2); withdrawal does not affect the lawfulness of processing carried out before it;

(iii) the legitimate interests of Tavex or a third party (Article 6(1)(f) UK GDPR) — including ensuring the proper functioning and secure use of the Portal by you and other users; maintaining and administering the Portal; settling disputes; detecting and preventing malicious acts; identifying and resolving technical issues; developing and improving the Portal; communicating with you, including by electronic means, on matters relating to the Portal or your application; handling any queries or requests from you; and establishing, exercising and protecting the rights and legitimate interests of Tavex, Tavex corporate group companies, other users of the Portal, or affected third parties, including through legal proceedings;

(iv) compliance with legal obligations to which Tavex is subject under UK law (Article 6(1)(c) UK GDPR).

4. Your Rights

You have the following rights in respect of our processing of your personal data. You can exercise them by writing to Tavex Gold Ltd, 110 Hatton Garden, London, EC1N 8LY, or by email to tavex@tavexbullion.co.uk. Requests can be made in free text, and we will assist you in formulating a request if needed. We will respond within one month; where a request is complex or we receive a number of requests from you, we may extend this by up to two further months, in which case we will inform you of the extension and the reasons for it within the first month. Exercising your rights is free of charge, although where a request is manifestly unfounded or excessive we may charge a reasonable fee or decline to act on it, as permitted by the UK GDPR. To prevent abuse, we may ask you to verify your identity before we act on a request.

(1) The right of access — to request confirmation as to whether we process personal data concerning you and, where we do: information on the purposes of processing, the categories of personal data, and the recipients or categories of recipients to whom it has been or will be disclosed; a copy of the personal data in an intelligible form, together with any available information as to its source; and meaningful information about the logic involved in any automated decision-making concerning you, where applicable.

(2) The right to rectification — to have inaccurate personal data concerning you corrected, and incomplete data completed, without undue delay.

(3) The right to erasure (“right to be forgotten”) — to have your personal data erased without undue delay where: (i) it is no longer needed for the purposes for which it was collected or otherwise processed; (ii) you object to processing based on legitimate interests and there are no overriding legitimate grounds, or you object to processing for direct marketing purposes; (iii) the processing was unlawful; (iv) erasure is required to comply with a legal obligation under UK law to which Tavex is subject; (v) you have withdrawn the consent on which the processing is based and there is no other legal ground; or (vi) the data was collected in relation to the offer of information society services.

We may decline to erase your personal data where processing remains necessary: (a) for exercising the right of freedom of expression and information; (b) for compliance with a legal obligation under UK law, or for the performance of a task carried out in the public interest; (c) for reasons of public interest in the area of public health; (d) for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes; or (e) for the establishment, exercise or defence of legal claims. Tavex does not erase data it has a legal obligation to retain, including data needed for defence against legal claims or to demonstrate its rights.

(4) The right to restriction of processing — where: (i) you contest the accuracy of the data, for a period enabling us to verify it; (ii) the processing is unlawful but you prefer restriction to erasure; (iii) we no longer need the data but you require it to establish, exercise or defend legal claims; or (iv) you have objected to processing, pending verification of whether our legitimate grounds override yours. Where processing is restricted, we will only process the data (beyond storage) with your consent, or for the establishment, exercise or defence of legal claims, or to protect the rights of another person, or for reasons of important public interest. We will inform you before any restriction is lifted.

(5) The right to object — at any time, on grounds relating to your particular situation, to processing based on our legitimate interests or those of a third party, including any profiling based on those interests. We will then cease processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed for the establishment, exercise or defence of legal claims. Where personal data is processed for direct marketing, you may object at any time and we will stop without exception.

(6) The right to data portability — to receive the personal data you have provided to us in a structured, commonly used and machine-readable format, and to transmit it to another controller without hindrance, where the processing is carried out by automated means and is based on your consent or on a contract. Where technically feasible, you may ask us to transmit the data directly to another controller. This right does not affect the right to erasure and may not be exercised where it would adversely affect the rights and freedoms of others.

(7) The right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, except in the circumstances permitted by the UK GDPR and subject to appropriate safeguards. Tavex does not currently make recruitment decisions based solely on automated processing.

(8) The right to ask us to inform you of the recipients to whom personal data subject to rectification, erasure or restriction has been disclosed, unless this proves impossible or involves disproportionate effort.

(9) The right to be notified without undue delay where a breach of the security of your personal data is likely to result in a high risk to your rights and freedoms, including information on the measures taken or proposed. We are not obliged to notify you where: (i) appropriate technical and organisational protection measures were applied to the data affected; (ii) subsequent measures ensure the high risk is no longer likely to materialise; or (iii) notification would involve disproportionate effort, in which case a public communication or similar measure will be used instead.

(10) The right to be informed if Tavex finds that, for any reason, it is unable to fulfil its obligations under this Notice or under applicable data protection law.

(11) The right to be notified in advance of any merger, acquisition or sale of Tavex’s assets affecting the processing of your personal data.

(12) The right to contact us about any of the above at the details set out in Section I(2).

(13) The right to lodge a complaint with the supervisory authority if you consider that your data protection rights have been infringed. The supervisory authority in the United Kingdom is the Information Commissioner’s Office (ICO): Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF; telephone: 0303 123 1113; website: www.ico.org.uk. You may contact the ICO at any time, although we would welcome the opportunity to address your concerns first.

5. Cookies

(1) For the Portal to operate as intended, and to improve your experience and tailor your visits, we sometimes store small data files called “cookies” on your device. This is standard practice across the web. This section explains how we do so, consistent with the Privacy and Electronic Communications Regulations 2003 (“PECR”) and the UK GDPR.

(2) What are cookies? Cookies are small text files saved by your browser on your device. They make it possible to recognise the user’s device and ensure the Portal behaves correctly in line with individual preferences — for example, retaining session information so you do not have to re-enter it on every page. Cookies typically include the name of the website, the storage period, and a unique identifier. In certain cases, cookies can allow personal identification of users.

(3) How do we use them? Cookies are used to adapt the content of the Portal to your preferences, to optimise its use, and to generate anonymised statistics about how visitors use the Portal, which help us improve its structure, design and content.

(4) What types do we use? (i) “Session cookies”, which are temporary and are normally deleted when you leave the page, close your browser, or switch off your device; and (ii) “persistent cookies”, which are stored on your device for a fixed period indicated in the cookie’s parameters, or until you delete them manually, and may be reused on your next visit.

(5) Tavex may also permit third-party cookies — cookies set by software products that record anonymised statistical data about usage (for example, analytics tools), or cookies linked to social sharing buttons and integrations. For those tools, the social networks or providers concerned (such as LinkedIn or Facebook) may set cookies via the Portal in the manner and for the purposes described in their own policies. Tavex has no access to or control over cookies set by third parties, and this Notice does not govern how those third parties collect and handle information. Please consult their policies directly.

(6) Personal data collected by cookies is used only for the performance of specific functions on the Portal relating to the user, and is protected against unauthorised access.

(7) Non-essential cookies are set only with your consent, which you can give or withdraw through the Portal’s cookie controls. Most browsers also allow you to manage cookies through their settings, usually under “Options”, “Settings” or “Preferences”. You can delete cookies already stored on your device and set most browsers to block them entirely, although doing so may require manual adjustment of preferences on each visit and may prevent some functions of the Portal from working.

(8) To find out more about cookies, including how to control them, you can visit http://aboutcookies.org.

6. Disclosure to Third Parties and International Transfers

(1) In some cases — to fulfil legal obligations, to comply with an order of a competent authority, to protect and pursue the legitimate interests (rights, property, security) of Tavex or a third party, or to ensure the technical operation of the Portal — we may be obliged, or may need, to disclose your personal data to third parties in the following categories:

(i) competent authorities and regulators, such as the Information Commissioner’s Office, HM Revenue & Customs, the Home Office, the police, and courts or tribunals;

(ii) external advisers acting as independent controllers, such as solicitors, accountants and auditors;

(iii) providers of IT services, hosting, database support, technical equipment, software and applications which may contain data about you (sometimes involving access to your personal data for the performance of those tasks). In particular, the hosting of the physical servers supporting the Portal is managed by Amazon Web Services EMEA SARL, established in the Grand Duchy of Luxembourg, 38 Avenue John F. Kennedy, L-1855 Luxembourg;

(iv) other legal entities of the Tavex corporate group, all of which are registered and established in the United Kingdom, in European Union Member States, or in states party to the Agreement on the European Economic Area. Within each of those entities, access to your personal data is granted only to authorised staff whose duties require it.

(2) Where your personal data is transferred outside the United Kingdom to the EU or EEA, those transfers are covered by the UK’s adequacy regulations, which recognise that EU and EEA states provide an adequate level of protection for personal data. Any transfer to a country not covered by UK adequacy regulations will be made only with appropriate safeguards in place, such as the ICO’s International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, and you may contact us for details of the safeguards applied.

(3) Tavex may provide your personal data to third parties unrelated to Tavex only for predetermined and specific processing purposes, and only where those third parties commit to ensuring an adequate level of protection, to complying with applicable data protection law and with our instructions under this Notice, and to refraining from processing your personal data for any other purpose.

7. Miscellaneous; Amendments to This Notice

(1) Where, in the application process, you provide the personal data of another person — for example, a referee — you confirm that you are authorised to do so and that you have informed that person of this Notice before providing their details.

(2) If any provision of this Notice proves invalid or inapplicable, the remaining provisions remain valid and applicable.

(3) Matters not covered by this Notice are governed by applicable law. This Notice is governed by the law of England and Wales, and any disputes arising from or relating to it are subject to the jurisdiction of the courts of England and Wales.

(4) Tavex may amend or supplement this Notice at any time; the date of the most recent update is shown at the top of this document. Amendments take effect on publication on the Portal unless otherwise stated. Where changes are material, we will highlight them on the Portal. Please review this page periodically.

Contact

Tavex Gold Ltd (company number 11167367)

VAT no: GB414694879

110 Hatton Garden, London, EC1N 8LY

tavex@tavexbullion.co.uk

+44 (0)20 4541 4145