Notice at Collection

Perpetua Resources Corp | Effective Date: April 3, 2026

Categories of Personal Information We Collect

We collect the following categories of personal information when you interact with our website, submit forms, or use our services:

Sources of Collection

We collect personal information from multiple sources:

• Direct from You: When you fill out forms (contact, employee intake, vendor intake, scholarship application, feedback/grievance), create an account, call, email, or otherwise communicate with us
• Automatic Collection: Through cookies, web beacons, and tracking technologies (Google Tag Manager GTM-THLL9MZ, Google Analytics, website analytics, heat mapping)
• Third-Party Platforms: When you use social login (Google, Facebook, Twitter/X, LinkedIn, GitHub, Microsoft, Amazon, Yahoo, WordPress.com, VK), we receive basic profile data
• Service Providers: From vendors and partners (email service providers, form processors, analytics platforms, hosting providers)

Business Purposes for Collection

We collect and use your personal information for the following business purposes:

• Responding to inquiries and fulfilling requests (contact forms, employee intake, vendor intake)
• Processing applications (scholarships, vendor partnerships, employment)
• Administering programs and services
• Understanding website usage and user behavior (analytics)
• Improving website functionality and user experience
• Marketing communications (email newsletters, event invitations)
• Fraud prevention, security, and legal compliance
• Communicating about grievances and feedback
• Retargeting and personalized advertising

Whether Information is Sold or Shared

Sale of Personal Information: Perpetua Resources does not sell your personal information in the traditional sense (i.e., we do not exchange your information for money).

Sharing for Cross-Context Behavioral Advertising: Under CPRA regulations, "sharing" includes providing information to third parties for cross-context behavioral advertising. We use Google Analytics and may work with advertising platforms that could constitute "sharing" under this definition. If you are a California resident, you have the right to opt out of this sharing.

Third-Party Advertising: We use Google Tag Manager and Google Analytics, which may be considered third-party advertising partners for purposes of California privacy law. These platforms may collect and share your data for marketing purposes.

Sensitive Personal Information

We do not intentionally collect sensitive categories of personal information such as Social Security numbers, financial account information, biometric data, health information, or racial/ethnic origin, except:

• Social login credentials are handled securely by third-party providers (Google, Facebook, etc.) and we do not store passwords or sensitive authentication data
• Limited professional/employment information may be collected via forms but is used only for stated business purposes

Your Privacy Rights Under CCPA/CPRA

As a California consumer, you have the following rights:

• Right to Know: Request what personal information we have collected about you
• Right to Delete: Request that we delete personal information we have collected from you (with certain exceptions)
• Right to Correct: Request that we correct inaccurate personal information (CPRA)
• Right to Opt-Out: Opt out of the "sale" or "sharing" of your personal information
• Right to Limit Sensitive PI: Request that we limit our use of sensitive personal information to only the purposes necessary to provide you services (CPRA)
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights

For complete information about these rights and how to exercise them, please see our full Privacy Policy and our California Privacy Notice.

How to Exercise Your Rights

You may submit a privacy request through any of the following methods:

• Email: community@perpetua.us (subject: "California Privacy Request")
• Phone: 208-901-3060
• Online Form: perpetuaresources.com/privacy-request
• Mail: Perpetua Resources Corp, Privacy Department, 13181 Highway 55, PO Box 429, Donnelly, Idaho 83615

We will verify your identity before processing your request and respond within 45 calendar days (up to 90 days if an extension is necessary).

Global Privacy Control (GPC)

We honor Global Privacy Control (GPC) signals as valid opt-out requests for the sale and sharing of personal information. When we detect a GPC signal, we will treat it as a request to opt out of the sale or sharing of your personal information, consistent with California Civil Code §1798.135(b)(1).

Additional Resources

• Full Privacy Policy
• California Privacy Notice
• Cookie Policy
• Do Not Sell My Personal Information
• Privacy Request Form