Privacy Policy

This Privacy Policy explains how CUPITOR MINING SA ("Cupitor Mining", "we", "us") collects, uses, discloses and protects personal data when you visit our website at cupitormining.com or contact us through it.

We are committed to processing personal data lawfully, fairly, and transparently. This policy is drafted in line with the Democratic Republic of the Congo's data protection framework and, where visitors are located in the European Economic Area, the principles of the General Data Protection Regulation (EU) 2016/679 (GDPR).

The data controller responsible for processing your personal data is CUPITOR MINING SA, headquartered in Kinshasa, Democratic Republic of the Congo.

For any question about this policy or to exercise your rights, please write to contact@cupitormining.com.

We collect only the personal data you choose to provide:

Contact form submissions — first name, surname, email address, phone number (optional), and the content of your message.

Email correspondence — any information you include in an email addressed to us.

Technical data — limited to information required for the website to function, such as your IP address and browser user-agent, captured in server logs. We do not use third-party analytics or advertising trackers.

We do not knowingly collect personal data from children under sixteen (16) years of age.

We process personal data for the following purposes:

Responding to enquiries, partnership requests, and investor relations correspondence. Legal basis: your consent and our legitimate interest in handling your message.

Protecting the security and integrity of our website, detecting and preventing abuse. Legal basis: our legitimate interest and, where applicable, compliance with legal obligations.

Complying with applicable laws and responding to lawful requests from competent authorities. Legal basis: compliance with legal obligations.

We retain personal data only for as long as necessary for the purposes for which it was collected.

Contact form and email correspondence: up to thirty-six (36) months from the date of the last meaningful exchange, after which the records are either anonymised or deleted.

Server logs: up to twelve (12) months.

Where we are required by law to retain data for a longer period (e.g. for accounting, tax, or anti-money-laundering purposes), we will do so and restrict access accordingly.

We do not sell personal data. We may share personal data with:

Our hosting and infrastructure provider, which processes data strictly on our behalf and under a data processing agreement (see Legal Notices for hosting details).

Professional advisers — including legal counsel, auditors, and accountants — where required for the defence of legal claims or regulatory compliance.

Competent public authorities, where disclosure is required by law or by a valid legal order.

We do not share personal data with advertising networks, data brokers, or for profiling purposes.

Our hosting infrastructure is located in Germany. If you contact us from outside the European Economic Area, your personal data may be transferred to and stored on servers located in the European Economic Area.

Where personal data is transferred from the European Economic Area to the Democratic Republic of the Congo, we rely on your explicit consent and on appropriate contractual safeguards within our organisation to ensure a level of protection consistent with applicable law.

Subject to applicable law, you have the following rights regarding your personal data:

Right of access — to obtain confirmation of whether we process your personal data and, if so, to receive a copy.

Right to rectification — to have inaccurate or incomplete data corrected.

Right to erasure — to request deletion of your personal data where the legal grounds apply.

Right to restriction — to ask us to limit how we process your data.

Right to object — to object to processing based on our legitimate interests.

Right to data portability — to receive your data in a structured, machine-readable format.

Right to withdraw consent — at any time, where processing is based on consent, without affecting the lawfulness of processing already carried out.

Right to lodge a complaint — with the competent data protection authority in your jurisdiction.

To exercise any of these rights, please write to contact@cupitormining.com. We will respond within thirty (30) days, subject to identity verification.

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction. These include transport-layer encryption (HTTPS), access controls, logging, and the principle of least privilege applied to internal accounts.

No online transmission is entirely risk-free. In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority and, where required, affected individuals without undue delay.

This website uses a minimal set of strictly necessary cookies, as described in our Cookie Policy. We do not use third-party tracking, advertising, or analytics cookies.

We may update this Privacy Policy from time to time to reflect changes in our practices or in applicable law. The updated version will be posted on this page with a revised "last updated" date. Material changes will be signalled more prominently where appropriate.

Last updated: April 2026