Privacy Policy

1. Introduction

Crustal Resources AB ("Crustal", "we", "us" or "our") respects your privacy. This Privacy Policy describes how we collect, use, retain and protect personal data when you visit our website, use features on the website or communicate with us.

We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and other applicable data protection legislation.

2. Data controller

Crustal Resources AB
Box 55689
102 15 Stockholm
Sweden

Email: info@crustal.se

Crustal Resources AB is the data controller for the processing of personal data described in this Policy.

3. Personal data we process

Depending on how you use the website and communicate with us, we may process the following types of information:

• Contact details, such as your name and email address, that you provide when contacting us or using a subscription or contact function.

• Communication data, such as the contents of messages or enquiries you send to us.

• Technical information and usage data, such as pages visited, traffic source, sessions, timestamps and information about how the website is used. Such information is collected through analytics tools only after you have consented to analytics cookies.

• Consent information, such as the cookie categories you have accepted or rejected and when your choice was made.

4. Why we process your personal data and our legal basis

We process personal data for the following purposes:

Communications and enquiries

We process contact and communication information in order to respond to questions, handle enquiries and communicate with investors, shareholders and other stakeholders.

The legal basis is generally our legitimate interest in being able to communicate with persons who contact the company.

Subscriptions and information requested by you

If you actively subscribe to a mailing list or other information service, we process the information required to provide that service.

The processing is based on consent where required. You may withdraw your consent at any time.

Website analytics

With your consent, we use Google Analytics 4 to compile statistics about how the website is used. This may include, for example, page views, sessions, traffic sources and how visitors navigate between different parts of the website.

The legal basis for this processing is consent. Google Analytics is not activated for a visitor who has not consented to analytics cookies.

Legal obligations and legal claims

We may also process personal data where necessary to comply with a legal obligation or to establish, exercise or defend legal claims.

5. Cookies and consent

The website uses cookies and similar technologies.

Cookies that are strictly necessary for the operation of the website and for managing your cookie preferences may be used without consent.

Non-essential cookies, including analytics cookies, are used only after you have provided consent through the website's cookie banner.

We use CookieYes as our consent management platform. CookieYes is used to display the cookie banner, record your choices and communicate the relevant consent status to the website's tag-management system.

You can choose to:

• accept all optional cookies,

• reject all optional cookies, or

• make an individual selection between different cookie categories.

You may change or withdraw your consent at any time through the website's cookie settings.

An up-to-date list of the cookies used, including their purpose, provider and duration, is available through the website's cookie settings.

6. Google Analytics and Google Tag Manager

We use Google Analytics 4 (GA4) for website analytics.

Google Analytics is implemented through Google Tag Manager (GTM) and is technically connected to our consent-management system using Google Consent Mode and CookieYes.

For visitors who have not consented to analytics cookies, analytics storage is denied by default and the Google Analytics tag is not activated.

We currently have, among other things, chosen to:

• not activate Google Signals,

• not collect user-provided data,

• not allow Analytics data to be used for ads personalisation,

• not enable granular location and device data collection beyond what is required for basic reporting.

These settings may change over time. If our processing changes in a way that affects your privacy, this Policy and, where relevant, our consent-management configuration will be updated accordingly.

7. Service providers and disclosure of data

We do not sell personal data.

We may share or make personal data available to service providers that process information on our behalf, including providers of website, analytics, IT and consent-management services.

For the website analytics described above, we use services provided by Google. For consent management, we use CookieYes.

Such providers may only process personal data in accordance with applicable agreements, our instructions and applicable data protection legislation.

We may also disclose personal data to authorities or other third parties where required by law, regulation or a binding decision.

8. Transfers of personal data outside the EU/EEA

Some of our service providers are international organisations and processing may therefore involve personal data being transferred or made accessible outside the EU/EEA.

Where such transfers take place, they must be based on a valid transfer mechanism under the GDPR, such as an adequacy decision or the European Commission's Standard Contractual Clauses, together with additional safeguards where required.

9. Data retention

We retain personal data only for as long as necessary for the relevant purpose.

• Contact and communications: for as long as necessary to handle the matter and thereafter for such period as may reasonably be required for follow-up or legal purposes.

• Subscriptions: until you unsubscribe or withdraw your consent, unless another lawful basis permits continued processing.

• Google Analytics: our GA4 property is configured with a 2-month retention period for user-level and event-level data subject to GA4's data-retention settings. Aggregated reporting data may remain available for longer.

• Cookies: retention periods vary by cookie and are shown in the website's cookie settings.

• Consent records: retained for as long as necessary to document and administer your consent choices.

10. Your rights

Under the GDPR, depending on the circumstances, you may have the right to:

• obtain information about and access to the personal data we process about you,

• have inaccurate personal data corrected,

• request deletion of your personal data,

• request restriction of processing,

• object to processing based on legitimate interests,

• withdraw consent at any time,

• in certain circumstances, receive personal data in a structured, commonly used and machine-readable format.

Withdrawal of consent does not affect the lawfulness of processing carried out before the consent was withdrawn.

To exercise your rights, please contact us at info@crustal.se.

You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) if you believe that our processing of your personal data infringes applicable data protection legislation.

Further information about your rights is available on the IMY website.

11. Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration, disclosure or other unlawful processing.

12. Changes to this Policy

We may update this Privacy Policy when our processing of personal data changes or where required due to changes in legislation, guidance or technical solutions.

The latest version is always available on our website.

Last updated: 25 August 2026