Privacy Policy

1. Who we are

The website bloodniobium.org is operated by Glória Duarte, responsible for the Blood Niobium dossier — an independent intelligence platform dedicated to documenting and translating hidden legal, accounting, regulatory and humanitarian liabilities in critical minerals supply chains, operating as a transnational accountability documentary protocol focused on CMOC Group Limited's (HKEX: 3993; SSE: 603993) operations in Brazil. The platform operates in three languages (Portuguese, English, Mandarin) and is addressed to a global audience.

To contact the data controller directly:

2. Data we collect

We collect only data voluntarily provided by you through the platform's official channels:

• Full name
• Country of origin
• Email address
• Professional profile (when provided in the identification form)
• Content of messages sent via the contact form
• Content of messages sent via WhatsApp (+55 (64) 98100-6046)
• Professional identification data voluntarily provided to access official case documents
• Stakeholder profile selected when using Strategic Notifications by Profile (Canal 06 of the platform)

We do not collect: browsing data, IP addresses, geolocation, device information, or any data not directly provided by you. We do not use tracking cookies, third-party pixels, analytics tools, or advertising SDKs.

3. Purpose of use

Collected data is used exclusively for:

• Responding to your contact message or request;
• Sending documents and information related to the Blood Niobium case, when requested;
• Recording and forwarding to the case protocol: support manifesto signatures, strategic suggestions, and formal notifications submitted through the platform;
• Verifying the identity of professionals requesting access to restricted official documents.

Your data will never be used for commercial purposes, marketing campaigns, advertising, or sale to third parties.

4. Legal basis (GDPR / LGPD)

Data processing is based on the following legal grounds:

• Consent (GDPR Art. 6(1)(a) / LGPD Art. 7, I): expressed when filling forms or initiating WhatsApp contact;
• Legitimate interest (GDPR Art. 6(1)(f) / LGPD Art. 7, IX): to respond to requests and conduct advocacy activities;
• Exercise of legal rights (LGPD Art. 7, VI): for documentation and legal protection within the Blood Niobium case.

5. Data sharing

Personal data may be shared in the following exceptional circumstances:

• When required by a court order or competent authority;
• With your explicit consent, in the case of Support Manifesto signatories (name and country published in the Weekly Dossier forwarded to the CMOC Board, Deloitte, ESG agencies and other bodies of interest in the Blood Niobium case, as described in the platform's Consent Form).

6. Storage and security

Data is stored on secure servers for the period strictly necessary to fulfil the stated purpose, or for the duration of the litigation related to the Blood Niobium case. We adopt technical and organisational measures to protect it against unauthorised access, loss, or unlawful disclosure.

Messages received via WhatsApp are treated with the same level of confidentiality applied to all other platform communications.

7. Your rights (GDPR Arts. 15–22 / LGPD Art. 18)

Under the GDPR and LGPD, you have the right to:

• Confirm whether we process your personal data;
• Access the data we hold about you;
• Correct incomplete or inaccurate data;
• Request erasure of your data (right to be forgotten);
• Request data portability to another service provider;
• Object to processing based on legitimate interest;
• Withdraw your consent at any time, without prejudice to the lawfulness of prior processing;
• Lodge a complaint with a supervisory authority (e.g., the UK ICO, the EU lead DPA, or Brazil's ANPD).

To exercise any of these rights, please contact us using the details in Section 11. We will respond within 15 business days.

8. Cookies and tracking

Any strictly necessary technical cookies (e.g., for form sessions) are temporary, do not identify the user, and are deleted when the session ends.

9. International dimension

Blood Niobium operates on a global scale and may receive data from users located outside Brazil. For those users:

• EU / EEA users: processing is fully compliant with the GDPR (EU Regulation 2016/679). You may lodge a complaint with your local Data Protection Authority;
• UK users: processing observes the UK GDPR and the Data Protection Act 2018. You may contact the Information Commissioner's Office (ICO);
• Hong Kong users: we observe the principles of the Personal Data (Privacy) Ordinance (Cap. 486);
• US users: data is not sold to third parties, in line with CCPA principles (California Consumer Privacy Act), applied by analogy;
• Chinese users: we observe the applicable principles of the Personal Information Protection Law (PIPL, 个人信息保护法).

The platform's primary data protection law is Brazil's LGPD (Law No. 13,709/2018).

10. Changes to this policy

This policy may be updated periodically to reflect operational, legal, or regulatory changes. The current version will always be available on this page with the date of last revision. Material changes will be communicated through the platform's official channels.

11. Contact — Data Controller

For questions, requests, or to exercise your data rights under this Privacy Policy:

Data Controller: Glória Duarte · Blood Niobium · Catalão, Goiás, Brazil.