1Introduction

Congo Rare Minerals (“we,” “us,” or “our”) respects your privacy and is committed to protecting the personal data you share with us. This Privacy Policy explains how we collect, use, store and protect information when you visit our websites, submit an inquiry, request a quote or engage with us as a buyer.

By using our websites at congorareminerals.com, marketing.congorareminerals.com, or related subdomains (together, the “Sites”), you agree to the practices described in this policy.

2Who we are

Congo Rare Minerals is a licensed gold exporter headquartered in the Democratic Republic of the Congo, with operations in Uganda. We supply gold bars and gold grain to refineries, manufacturers, bullion traders and institutional buyers worldwide.

Registered office: 6m2r+6w9, Goma, North Kivu, Democratic Republic of the Congo
Email: info@congorareminerals.com
Phone: +243 820 928 379

For the purposes of applicable data protection laws (including the EU General Data Protection Regulation, where relevant), Congo Rare Minerals acts as the data controller of the personal data you provide to us.

3Data we collect

3.1  Information you provide directly

When you use our contact form, quote request form or order inquiry form, we collect the information you submit, which may include:

• Full name
• Company name and role
• Business email address
• Phone / WhatsApp number
• Country of operation or destination
• Product preferences (type, purity, quantity)
• Order preferences (Incoterm, delivery hub, payment instrument, timeline)
• Any free-text notes or requirements you share with us

3.2  KYC and compliance data

For commercial transactions, we are legally required to collect additional information as part of our Know Your Customer (KYC) and Anti-Money Laundering (AML) obligations. This may include:

• Company incorporation documents and registration numbers
• Identification of directors, beneficial owners and authorized signatories
• Proof of address for the company and its signatories
• Bank reference letters or proof of funds
• Refinery nomination and consignee details at the delivery hub

3.3  Technical and usage data

When you visit our Sites, we (or our service providers) may automatically collect:

• IP address and approximate location
• Browser type, device type and operating system
• Pages viewed, time on page and referral source
• Cookies and similar technologies (see Section 11)

4How we use your data

We process personal data for the following purposes:

• To respond to inquiries — replying to your contact, quote or order request and arranging follow-up communication.
• To negotiate and perform contracts — preparing Sale & Purchase Agreements (SPAs), coordinating logistics, assay and settlement.
• To meet legal and regulatory obligations — completing KYC/AML checks, satisfying export licensing requirements and responding to lawful requests from authorities.
• To prevent fraud and protect our business — verifying counterparties, detecting suspicious activity and safeguarding shipments.
• To improve our Sites and services — understanding which pages perform well and where we can be clearer.
• To send relevant updates — if you have an active inquiry or contract with us, we may send transactional emails (e.g. quote updates, SPA drafts, shipment notifications).

We do not use your data for unsolicited marketing outside the scope of your inquiry without your consent, and we do not sell personal data to third parties.

5Legal basis for processing

Where the EU/UK GDPR or similar laws apply, we rely on the following legal bases:

• Contract — processing necessary to respond to your request, negotiate an SPA or perform an agreed transaction.
• Legal obligation — KYC/AML, sanctions screening, tax and customs compliance, and responses to lawful government requests.
• Legitimate interests — running and protecting our business, preventing fraud, securing our systems and improving our Sites, balanced against your rights.
• Consent — where we specifically ask for it, for example before using non-essential cookies or sending marketing communications unrelated to an active inquiry. You can withdraw consent at any time.

6Sharing & disclosure

We share personal data only when necessary to deliver our services or comply with the law. Specifically, we may share data with:

• Refineries and assay offices nominated by you or agreed in the SPA.
• Logistics and security providers handling freight, insurance and secure transport.
• Banks and financial institutions facilitating payment instruments (TT, LC, SBLC, escrow).
• Government and regulatory bodies in the DRC, Uganda, destination countries or transit jurisdictions when required by law.
• Professional advisors such as lawyers, auditors and compliance consultants, under duties of confidentiality.
• IT and form-processing providers — for example, FormSubmit.co, which delivers our web form submissions to our inbox, and hosting providers that store site data.

We require all third parties with access to personal data to respect its security and process it only for agreed purposes.

7International transfers

Because we operate between Africa, the Middle East, Europe and Asia, your data may be transferred to, stored in, or processed in countries other than your own. These jurisdictions may have data protection standards that differ from those in your country.

Where we transfer personal data from the EU, UK or other regulated regions, we rely on recognized safeguards such as contractual commitments and the data recipient’s internal policies. You can contact us for details of the safeguards applicable to a specific transfer.

8Data retention

We retain personal data only for as long as necessary to fulfil the purposes described in this policy and to meet legal obligations:

• Inquiry / quote data — up to 24 months from the date of last contact, unless you ask us to delete it earlier.
• KYC and transaction records — retained for the minimum period required by applicable AML, tax and customs laws (typically 5–10 years after the end of the business relationship).
• Website analytics and server logs — typically up to 26 months, or less where our providers enforce shorter periods.

When data is no longer required, we delete it or anonymize it so it can no longer be linked to you.

9Security

We take reasonable technical and organizational measures to protect personal data against loss, unauthorized access, alteration or disclosure, including:

• HTTPS encryption across our public Sites
• Access controls for staff handling sensitive buyer documents
• Segregation of KYC documents from general marketing data
• Vendor due diligence for third-party processors

No system is completely secure. If you believe your data has been compromised, please contact us immediately at info@congorareminerals.com.

10Your rights

Depending on where you live, you may have the following rights over your personal data:

• Right to access — request a copy of the personal data we hold about you.
• Right to rectification — ask us to correct inaccurate or incomplete data.
• Right to erasure — ask us to delete your data, subject to legal retention requirements.
• Right to restrict processing — ask us to limit how we process your data in certain circumstances.
• Right to data portability — receive your data in a portable format and transfer it to another provider.
• Right to object — object to processing based on legitimate interests or direct marketing.
• Right to withdraw consent — where processing is based on consent, withdraw it at any time.
• Right to complain — lodge a complaint with your local data protection authority if you believe your rights have been breached.

To exercise any of these rights, email info@congorareminerals.com. We will respond within 30 days, and may ask for information to verify your identity first.

11Cookies & tracking

Our Sites use cookies and similar technologies to function correctly and to help us understand how visitors use the Sites. Broadly, these fall into the following categories:

• Essential cookies — required for basic site functionality, such as remembering you accepted the cookie banner.
• Analytics cookies — for example, from Google Analytics, to measure traffic and page performance in aggregated form.
• Advertising cookies — for example, from Google Ads, to measure campaign performance and show relevant ads.

You can control cookies through your browser settings and, where offered, through our cookie banner. Disabling certain cookies may limit site functionality.

12Third-party services

Our Sites may contain links to third-party websites (for example, our documentation hosted on congorareminerals.com, WhatsApp, Google Maps, LinkedIn and other social platforms). We are not responsible for the privacy practices of those third parties. We encourage you to review their privacy policies before providing data.

Service providers we currently use include:

• FormSubmit.co — delivery of form submissions to our inbox.
• Google Analytics & Google Ads — web traffic measurement and advertising performance.
• Google Maps — embedded maps on our Contact page.
• Our hosting provider — which may process server logs on our behalf.

13Children’s privacy

Our Sites and services are directed at professional buyers and organizations, not at children. We do not knowingly collect personal data from anyone under the age of 18. If you believe a minor has provided us with personal data, please contact us so we can delete it.

14Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in law, our services or our operational practices. The revised policy will be posted on this page with an updated “Last updated” date. For significant changes, we will take reasonable steps to notify you directly, for example by email where we have an active inquiry or contract with you.

15Contact us

If you have any questions about this Privacy Policy, how we handle your data, or wish to exercise your rights, please contact us:

Congo Rare Minerals
6m2r+6w9, Goma, North Kivu, Democratic Republic of the Congo
Email: info@congorareminerals.com
Phone: +243 820 928 379