Data Protection & Privacy Policy

Compliant with the UK GDPR, the EU GDPR, and the Data Protection Act 2018, and applicable U.S. privacy laws, including CCPA

Last updated: Jul 20 2026

Effective date: Jul 20 2026

Introduction

Guardian Metal Resources PLC (“we”, “us”, “our”, the “Company”) is committed to protecting and respecting your privacy. This Data Protection & Privacy Policy (the “Policy”) explains how we collect, use, disclose, and safeguard personal data when you visit our website at guardianmetalresources.com (the “Website”), subscribe to our communications, contact us, or otherwise interact with us as an investor, shareholder, business contact, or member of the public.

This Policy is designed to meet our obligations under the UK General Data Protection Regulation (“UK GDPR”), the EU General Data Protection Regulation (Regulation (EU) 2016/679, the “EU GDPR”) where applicable, the Data Protection Act 2018, and applicable U.S. privacy laws, including the California Consumer Privacy Act (“CCPA”) and other state privacy laws where applicable.

Please read this Policy carefully so that you understand your rights in relation to your personal data and how we will collect, use, and process it. This Policy is provided for transparency purposes and does not require your agreement. 

Who we are (Data Controller)

For the purposes of applicable data protection law, the data controller responsible for your personal data is:

If you have any questions about this Policy or how we handle your personal data, or if you wish to exercise any of your rights, please contact us using the details above and mark your communication for the attention of our data protection contact, Ben Hodges, Director. 

Scope of this Policy

This Policy applies to personal data we collect through the Website and through our wider investor relations, shareholder communications, and corporate activities. It does not apply to any third-party websites, applications, or services that may be linked from the Website. We are not responsible for the privacy practices of third parties, and we encourage you to review their privacy notices before providing them with your personal data.

Personal data we collect

“Personal data” means any information relating to an identified or identifiable natural person. Depending on how you interact with us, we may collect and process the following categories of personal data:

• Identity and contact data — such as your first name, last name and, where provided, your job title, company, or organisation.
• Contact details — such as your email address and, where you provide it, your telephone number, and postal address.
• Communications data — the content of any enquiry, message, or correspondence you send to us, including via our contact form, email, telephone, or social media.
• Subscription and marketing data — your preferences in receiving newsletters and corporate updates from us, and your communication preferences.
• Investor and shareholder data — where you are a shareholder, information relating to your shareholding that we receive directly from you or via our registrars, brokers, and other intermediaries (this may include holding details and correspondence).
• Technical and usage data — including your internet protocol (IP) address, browser type and version, device information, operating system, time zone setting, and location, and information about how you use the Website, collected through cookies and similar technologies.

We generally do not seek to collect special category data (such as data revealing racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data) through the Website. Please do not provide us with such data unless we specifically request it and explain the lawful basis for processing it.

How we collect your personal data

We collect personal data in the following ways:

• Directly from you when you complete and submit our newsletter sign-up or contact forms, send us an email, or otherwise correspond with us.
• Automatically as you navigate the Website, we may automatically collect technical and usage data through cookies and similar technologies (see Section 8).
• From third parties and public sources: we may receive personal data about shareholders and investors from our share registrars, brokers, regulatory filings, and other third parties, and from publicly available sources, in connection with our investor relations and statutory obligations.

Legal bases for processing

Under the UK GDPR and EU GDPR, we must have a lawful basis for processing your personal data. We rely on the following lawful bases, depending on the circumstances:

• Consent: Where you have given clear consent for us to process your personal data for a specific purpose, such as sending you our newsletter and marketing communications. You may withdraw your consent at any time.
• Legitimate interests: Where processing is necessary for our legitimate business interests, such as responding to your enquiries, managing investor relations, maintaining and improving the Website, and ensuring network and information security, provided those interests are not overridden by your rights and freedoms.
• Legal obligation: Where processing is necessary to comply with a legal or regulatory obligation to which we are subject, including obligations arising from our status as a publicly listed company.
• Performance of a contract: Where processing is necessary to take steps at your request prior to entering into, or to perform, a contract with you.

How and why we use your personal data

We use your personal data for the following purposes:

• To respond to your enquiries, requests, and correspondence;
• To send you newsletters, corporate updates, regulatory news, and other communications you have requested or consented to receive;
• To manage our relationships with shareholders, investors, and other stakeholders, and to meet our investor relations obligations;
• To operate, maintain, secure, and improve the website and our communications;
• To comply with our legal, regulatory, and corporate governance obligations, including those applicable to a company listed on the London Stock Exchange, NYSE American and OTCQB;
• To detect, prevent, and address technical issues, fraud or security incidents; and
• To establish, exercise, or defend legal claims where necessary.

Cookies and similar technologies

The Website uses cookies and similar technologies to distinguish you from other users, to remember your preferences, and to help us understand how the website is used. Cookies are small text files placed on your device when you visit a website.

We may use strictly necessary cookies (required for the Website to function), performance and analytics cookies (to understand how visitors use the Website), and functionality cookies (to remember your choices). Non-essential cookies are only set where you have given your consent, which you can manage or withdraw at any time through your browser settings or any cookie preference tool provided on the Website.

Disclosure of your personal data

We do not sell your personal data or share your personal data to third parties for their marketing or advertising purposes. We may transfer or disclose your personal data with the following categories of recipients, in each case subject to appropriate safeguards and only to the extent necessary:

• Service providers and processors who provide services to us, such as website hosting, email and newsletter distribution, IT support, analytics, professional advisers (legal, accounting, audit), share registrars, and investor relations service providers, acting on our instructions as data processors.
• Regulatory and legal recipients including regulators, stock exchanges, government bodies, law enforcement and courts, where we are required to do so by law or regulation.
• Corporate transactions in connection with any actual or proposed merger, acquisition, financing, or reorganisation of our business.

We have disclosed for a business purpose, to one or more third parties, the following categories of personal information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a consumer:

• Identity and contact data — such as your first name, last name and, where provided, your job title, company, or organisation.
• Contact details — such as your email address and, where you provide it, your telephone number and postal address.
• Communications data — the content of any enquiry, message, or correspondence you send to us, including via our contact form, email, telephone, or social media.
• Subscription and marketing data — your preferences in receiving newsletters and corporate updates from us, and your communication preferences.
• Investor and shareholder data — where you are a shareholder, information relating to your shareholding that we receive directly from you or via our registrars, brokers, and other intermediaries (this may include holding details and correspondence).
• Technical and usage data — including your internet protocol (IP) address, browser type and version, device information, operating system, time zone setting and location, and information about how you use the Website, collected through cookies and similar technologies.

Mailchimp

6ix Inc.

International transfers

As a company with operations and stakeholders in the United Kingdom, the United States, and elsewhere, your personal data may be transferred to, stored in, or accessed from countries outside the UK or the European Economic Area (EEA). Where we transfer personal data internationally, we aim to ensure an appropriate level of protection is in place, for example by relying on an adequacy decision/adequacy regulations, the UK International Data Transfer Agreement or Addendum, the EU Standard Contractual Clauses, or another lawful transfer mechanism. You may request further information about the safeguards we apply by contacting us.

How long we keep your personal data

We will retain your personal data only for as long as is necessary to fulfil the purposes for which it was collected, including to satisfy any legal, accounting, regulatory, or reporting requirements. When determining retention periods, we consider the amount, nature, and sensitivity of the data, the potential risk of harm from unauthorised use or disclosure, the purposes for which we process it, and applicable legal requirements.

Where you have subscribed to our communications, we will retain your contact data until you unsubscribe or otherwise ask us to stop contacting you. Once personal data is no longer required, we will securely delete or anonymise it.

Retention periods for certain types of data have been determined by the Board as follows:

Data security

We have implemented appropriate technical and organisational measures designed to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. We limit access to your personal data to those who have a genuine business need to access it. Where we are legally required to do so, we will notify you and any applicable regulator of any suspected, personal data breach. Please note that the transmission of information via the internet is never completely secure, and any transmission is at your own risk.

Your UK and EU data protection rights

Under the UK GDPR and EU GDPR, you have the following rights in relation to your personal data, which you may exercise free of charge in most circumstances:

• The right to be informed — to be informed about how we collect and use your personal data.
• The right of access — to request a copy of the personal data we hold about you.
• The right to rectification — to ask us to correct personal data that is inaccurate or incomplete.
• The right to erasure (“right to be forgotten”) — to ask us to delete your personal data in certain circumstances.
• The right to restrict processing — to ask us to restrict the processing of your personal data in certain circumstances.
• The right to data portability — to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format, and to have it transferred to another controller.
• The right to object — to object to the processing of your personal data, including processing for direct marketing, and processing based on our legitimate interests.
• The right to withdraw consent — where processing is based on your consent, to withdraw that consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

We will respond to any valid request within one month, although this period may be extended for complex or numerous requests, in which case we will inform you.

Automated Decision-Making and Profiling

We do not use your personal data for automated decision-making (i.e., making decisions solely by automated means without any human involvement) or profiling that produces legal effects concerning you or similarly significantly affects you. If this position changes in the future, we will update this Policy accordingly and, where required, seek your explicit consent or provide you with information about the logic involved and the significance and envisaged consequences of such processing, in accordance with Articles 13(2)(f) and 22 of the UK GDPR.

Your US state data privacy rights

You may be entitled the following privacy rights listed below based on various state privacy laws, including if you are a resident of California, Colorado, Connecticut, Florida, Oregon, Texas, Utah, and Virginia: 

• The rights to know/access. You may have the right to request to access or know (i) the specific pieces of personal data we have about you; (ii) the categories of personal data we have collected about you; (iii) the categories of sources from which that personal data was collected; (iv) the categories of personal data we have sold or disclosed; (v) the categories of third parties to whom your personal data was sole or disclosed; and (vi) the purposes for collecting and selling your personal data. Generally:

• Company has collected the categories of personal data detailed in the section titled “Personal data we collect” above. 
• Company has disclosed the categories of personal data detailed in the section titled “Disclosure of your personal data” above. 

• The right to correction. You may have the right to request that we correct the personal data that we have collected or maintain about you.
• The right to data portability. You may have right to request your personal data in a format that is portable and useable.
• The right to deletion. You may have the right to request that we delete the personal data that we have collected or maintain about you. We may deny your request under certain circumstances, such as if we need to comply with our legal obligations or complete a transaction for which your personal data was collected. If we deny your request for deletion, we will let you know the reason why. 
• The right to restrict or opt out of the sale or sharing of your personal data. You may have the right to restrict or opt out of the sale or sharing of your personal data. We do not sell your personal data or share your personal data to third parties for their marketing or advertising purposes. If this changes, we will update our privacy policy accordingly.
• The right to equal service. If you choose to exercise any of these rights, we will not discriminate against you in any way. If you exercise certain rights, understand that you may be unable to use or access certain features of our services.

You may request your right to know and your right to deletion free of charge up to two (2) times in any twelve (12) month period. 

How to exercise your rights

To exercise any of your rights, or to unsubscribe from our communications, please contact us at Info@guardianmetalresources.com to be made to the attention of the data protection contact. We may need to request specific information from you to help us confirm your identity before responding to your request. You can also unsubscribe from marketing emails at any time using the unsubscribe link contained in those emails.

Marketing communications

Where you have signed up to receive our newsletter, or corporate updates, we will send you communications about Guardian Metal Resources PLC, our projects and matters we consider may be of interest to you. You can opt out of receiving these communications at any time by using the unsubscribe link in any such email or by contacting us directly. We will not share your contact details with third parties for their own marketing purposes without your consent.

Children’s privacy

The Website and our communications are intended for an adult, professional, and investor audience and are not directed at children. We do not knowingly collect personal data from children. If you believe that we have inadvertently collected personal data from a child, please contact us so that we can take appropriate steps to delete it.

Third-party links

The Website may contain links to third-party websites, plug-ins, and applications, including our social media channels. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy practices. We encourage you to read the privacy notice of every website you visit.

Changes to this Policy

We may update this Policy from time to time to reflect changes in our practices or in applicable law. Any changes will be posted on this page with a revised “Last updated” date. We encourage you to review this Policy periodically. Where the changes are significant, we may also notify you by other means.

Complaints and the supervisory authority

If you have any concerns about how we handle your personal data, we would encourage you to contact us first so that we can address them. You also have the right to lodge a complaint with the relevant supervisory authority. In the United Kingdom, this is the Information Commissioner’s Office (ICO): ico.org.uk, helpline +44 (0)303 123 1113. If you are located in the EEA or U.S., you may also contact the supervisory authority in your country of residence.

Contact us

If you have any questions, comments or requests regarding this Policy or our handling of your personal data, please contact us:

© 2026 Guardian Metal Resources PLC. All rights reserved.

¹ The right to erasure is not absolute. The Company will endeavour to comply with requests for deletion of personal data, subject to the Company’s legal, regulatory, accounting or reporting obligations, maintenance of shareholder and corporate records, establishment of or defense against legal claims or other occurrences in which a lawful basis for retention applies.

² The right to restrict processing only applies when certain legal conditions are met. The Company will endeavour to comply with requests to restrict processing subject to the Company’s legal, regulatory, accounting or reporting obligations, maintenance of shareholder and corporate records, establishment of or defense against legal claims or other occurrences in which a lawful basis for processing data applies.