Privacy Policy

Last updated: 1 June 2026

1. Who we are

This website is operated by Cornish Tin & Lithium Limited ("we", "us", "our"), a company registered in England & Wales (company number 10935672), with its registered office at Osprey House, Malpas Road, Truro, Cornwall TR1 1UT, United Kingdom.

We are the "data controller" responsible for your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We are registered with the Information Commissioner's Office (ICO) under registration reference ZB150453.

2. How to contact us

For any questions about this policy or your personal data, contact us at:

• Email: contact@ctl.co.uk
• Post: Data Protection, Cornish Tin & Lithium Limited, Osprey House, Malpas Road, Truro, Cornwall TR1 1UT, United Kingdom

3. The personal data we collect

Depending on how you use this site, we may collect:

• Mailing list data — the email address you provide when subscribing to updates, and any optional information you choose to give (such as the type of investor you are).
• Enquiry data — your name, email address, and the content of any message you send us via our contact form or by email.
• Account data — if you hold a login for this site, your email address and an encrypted (hashed) password.
• Technical data — limited technical information such as your IP address and browser type, collected automatically by our servers in standard log files for security and to operate the site.

4. How and why we use your data (our lawful basis)

What we do	Why	Lawful basis
Send you updates, news and investor information	Because you asked to join our mailing list	Consent (you can withdraw it at any time)
Respond to your enquiries	To answer your questions and provide information	Legitimate interests (responding to people who contact us)
Provide and secure login accounts	To give authorised users access to the site	Legitimate interests / performance of a contract
Keep the website secure and working	To prevent abuse and maintain the service	Legitimate interests

5. Who we share your data with

We do not sell your personal data. We share it only with trusted service providers who help us run our business, and only as needed:

• Mailchimp (Intuit Inc.) — our email marketing platform, used to manage our mailing list and send updates.
• Heroku (a platform operated by Salesforce, Inc.) — our cloud hosting provider, which stores and runs the website and its data on our behalf.
• Professional advisers and authorities — such as our lawyers, accountants or regulators, where we are required to do so by law.

6. International transfers

Some of our service providers (for example Mailchimp and Heroku) are based outside the UK, including in the United States. Where your data is transferred outside the UK, we rely on appropriate safeguards such as the UK's adequacy regulations or the International Data Transfer Agreement / Standard Contractual Clauses to ensure your data remains protected.

7. How long we keep your data

We keep your personal data only for as long as necessary for the purposes set out above. Mailing list data is kept until you unsubscribe or ask us to remove it. Enquiry data is kept for as long as needed to deal with your query and a reasonable period afterwards.

8. Your rights

Under UK data protection law you have the right to:

• access the personal data we hold about you;
• ask us to correct inaccurate or incomplete data;
• ask us to delete your data ("right to erasure");
• object to, or ask us to restrict, our processing of your data;
• request a copy of your data in a portable format;
• withdraw your consent at any time (for example, by unsubscribing); and
• complain to a supervisory authority (see below).

To exercise any of these rights, contact us using the details in section 2. You can unsubscribe from our emails at any time using the link in every message we send.

9. Cookies

Our website uses only essential cookies needed to make it work and keep it secure. For full details, please see our Cookie Policy.

10. Complaints

We hope to resolve any concerns directly, so please contact us first. You also have the right to complain to the Information Commissioner's Office (ICO), the UK regulator for data protection: ico.org.uk or by calling 0303 123 1113.

11. Changes to this policy

We may update this policy from time to time. Any changes will be posted on this page with a revised "last updated" date.