Privacy Notice to European Investors and Shareholders
1 - Who we are
1.1 Heliostar Metals Ltd, a company registered in British Columbia with company number BC023452 and company address 800 – 885 West Georgia Street, Vancouver, BC, V6C 3H1, Canada, ('our', 'us', 'we', 'Heliostar') are, for the purposes of the European data protection law, controllers of personal data.
2 - Scope
2.1 - This privacy notice applies to our former and current investors and shareholders. Where an investor or a shareholder is a body corporate, then we will process personal data about the directors, officers, ultimate beneficial owners and other representatives of such bodies corporate. This notice also applies to these individuals ('you', 'your'). This privacy notice explains what personal data we collect about you and what we do with it. It also explains your rights in respect of your personal data and it informs you what to do if you have any questions or complaints about our use of your personal data.
3 - Contact details
Please direct any questions or comments about this privacy notice to us as follows:
- By post: 1090 West Georgia Street, Suite 700, Vancouver BC V6E 3V7, Canada
- By email: info@heliostarmetals.com
- By phone: +1 844-753-0045
4 - Personal data we process
4.1 - In order for you to purchase shares in Heliostar, we need to collect, receive, keep and share certain personal data about you. This section details the different categories of personal data we process, together with the reasons and the legal justification for processing. These may vary depending on the way you purchase shares, eg via a subscription agreement or through an intermediary such as fund or a broker. All other sections of this privacy notice apply equally in all circumstances and without prejudice to the way you have purchased your Heliostar shares.
4.2 - If you purchase shares through a subscription agreement with us
(a) Categories of personal data. We will process all information you submit to us through the agreement where we will ask you for, among other things, your name, address, telephone number and social insurance or social security number.
(b) - Purposes for processing. We will use the information you provide to us for the purposes of:
(i) - Ensuring that under securities laws you are entitled to purchase shares in Heliostar and performing filings with and responding to inquiries from relevant securities commissions;
(ii) - Communicating with you in relation to shareholder meetings and the outcomes of such meetings and enabling you to take part in such meetings;
(iii) - Any other data processing necessary for performing our obligations under the subscription agreement; and
(iv) - For purposes of complying with applicable law or regulation.
(c) - Legal justification.
(i) - Securities laws require the processing of all of the above personal data to permit Heliostar to sell shares. As such the provision of this personal data is mandatory under applicable law or may be required as part of communicating with applicable regulators.
(ii) - Communicating with you is part of our legitimate interests that are to keep investors up to date with Heliostar's development, management and operations.
(iii) - Where the processing of personal data about you is required under the subscription agreement itself, such processing is justified by the necessity of us to perform our obligations under the agreement.
4.3 - If you have purchased shares through a market intermediary such a fund or a broker
(a) - Categories of personal data. Shares could also be bought through an intermediary such as a fund or a broker. If you buy your Heliostar shares through an intermediary, we may receive your name, address and number of shares through the intermediary.
(b) - Purposes for processing. We will use the information we receive from intermediaries for the purposes of:
(i) - Ensuring that under securities laws you are entitled to purchase shares in Heliostar and performing filings with and responding to inquiries from relevant securities commissions;
(ii) - Communicating with you in relation to shareholder meetings and the outcomes of such meetings and enabling you to take part in such meetings; and
(iii) - For purposes of complying with applicable law or regulation.
(c) - Legal justification. Communicating with you is part of our legitimate interests that are to keep investors up to date with Heliostar's development, management and operations. We may also need to communicate with intermediaries or regulators, as required by applicable laws.
5 - Disclosures of personal data
5.1 - Intra-group disclosures. Personal data about you will be accessible to senior management within our corporate group that includes, among others, the CEO, the CFO, the Manager of Investor Relations, the Corporate Secretary and the Corporate Manager.
5.2 - Compliance with lawful requests for information. Please note that pursuant to applicable law we are obliged to disclose shareholder names, address, numbers of shares and, where necessary for the purposes of a lawful request, potentially other information to all Heliostar officers, directors, shareholders and other third parties, such as regulators, stock exchanges and securities commissions upon request for the purpose of such parties accessing the corporate record books.
5.3 - Regulatory disclosures. Pursuant to applicable law we may be obliged or compelled to disclose personal data about you to relevant securities commissions for the purpose of such commissions carrying out their own obligations under applicable law.
5.4 - Order processing. In order to fulfil your order for shares, your personal data will be shared with transfer agents in order for such agents to be able to issue the shares to you.
5.5 - Professional advisors. In line with our legitimate interests that are to offer and manage share subscriptions in Heliostar, your personal data may be shared with our professional advisors, such as lawyers, accountants and others for the purposes of them providing their services to us.
5.6 - Other suppliers. Other suppliers, such as our software vendors, may process personal data about you on our behalf in order for us to be able to operate our share scheme. Such suppliers include our cloud storage providers, customer relationship management systems providers, email services providers and other technology solutions providers.
5.7 - Corporate restructuring. If we or substantially all of our assets are acquired by a third party, personal data about our investors and shareholders will be one of the transferred assets. The transfer is justifiable on the basis of our legitimate interests that are to allow the prospective buyers of our business to maintain your shareholding.
5.8 - Other disclosures. If we need to protect the rights, property, or safety of Heliostar, our customers, or others, we may disclose personal data about you to other third parties including professional advisors and official authorities, the court service and relevant regulators or law enforcement agencies. Such disclosures are usually made in connection with actual or potential proceedings or investigations which may be taking place anywhere in the world. Such disclosures are justified on the basis of our legitimate interests that are to exercise and defend our legal rights. In some circumstances, we may be compelled to make such disclosures in line with applicable law or a relevant court order.
6 - Exports outside the EEA or the UK
6.1 - Heliostar and its key regulators are based in British Columbia, Canada. All personal data about you will be stored electronically on computer systems located in Canada. At present, the EU's European Commission and the UK's Information Commissioner's Office consider commercial organisations in Canada as adequate recipients of personal data for the purpose of European data protection law. On the basis of the European Commission Decision of 20 December 2001 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data provided by the Canadian Personal Information Protection and Electronic Documents Act, the transfer of personal data about you to us is not restricted under applicable law.
6.2 - Please contact us if you would like further details of the specific safeguards (or derogations from the requirement to implement safeguards) to the export of your personal data to parties other than Heliostar.
7 - How long we retain personal data about you
7.1 - We will hold personal data about you for as long as is necessary in order to conduct the processing detailed above, deal with any specific issues that may raise, or otherwise as is required by law or any relevant regulatory authority. Please note some personal data may need to be retained for up to seven years after your shareholding ends to ensure compliance with applicable (tax) laws and internal compliance procedures. Please note that personal data about you that enters corporate record books is retained indefinitely in line with applicable law.
7.2 - To determine the appropriate retention period for personal data, in all other circumstances we consider the amount, nature, and sensitivity of the personal data, the personal risk or harm from unauthorised use or disclosure, the purpose for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.
8 - Your rights
8.1 - Under European data protection law, you have various rights in relation to personal data about you that we process. Please note these rights may be subject to limitations. Your rights can be exercised by contacting us at the email address specified above.
8.2 - You have the right to:
Be informed (of the processing).
Access (such information).
Rectification (of inaccurate information).
Erasure (of such information).
Restrict processing (in certain cases).
Object to profiling.
Data portability.
Complain to the Information Commissioner's Office.
Withdraw consent (if we have collected your personal information on this basis).
8.3 - Detailed information on the full content of your rights (and any conditions that may apply) is provided in English by the UK Information Commissioner's Office and is available on their website: https://ico.org.uk/your-data-matters/.
8.4 - Please note that the majority of personal data about you we process is mandatory for contractual or regulatory purposes. If you do not provide the personal data outlined above or if we do not receive it from a third party, we will be unable to issue Heliostar shares in your name.
9 - Date of last amendment
13 May 2021.
