Last Approved: October 26, 2026
At Troilus, protecting your privacy is a priority for us. This summary highlights the key points of our full Website and External Privacy Policy.
1. What personal information do we collect?
Personal information means any information relating to a natural person that allows that person to be identified directly, or indirectly when combined with other information. We may collect the following categories of personal information about you: (i) Contact Details; (ii) Identity Information; (iii) Internet Activity Information; (iv) Job Application Information; (v) Shareholder Information; and (vi) Technical Information.
2. Why do we collect, use, and share your personal information?
We collect, use, and share your personal information with your consent, unless otherwise permitted or required by law, for the following purposes:
3. With whom do we share your personal information?
To achieve the purposes mentioned above at Section 2, we may share your personal information with third parties, including our service providers (e.g., web hosting and web services, marketing); and legal authorities (where required by law).
4. What are your rights regarding your personal information?
You have important rights regarding your personal information, subject to certain exceptions provided by law, including:
5. How to contact us?
Daniel Guay Designated Privacy Officer privacy@troilusmining.com
Last Approved on October 26, 2026.
This website and external privacy policy (“Website and External Privacy Policy”) sets out how Troilus Mining Corp., its subsidiaries and other related entities (“Troilus”, "we", "us" and "our") manage, collect, use, disclose, hold and otherwise process personal information about you via our websites https://troilusmining.com/ and https://troilustogether.com/ (collectively, our “Websites”) and other interactions that you may have with us. By "you" and "your", we refer to each and every individual whose personal information we may handle from time to time.
Troilus collects, uses and communicates personal information with consent where required, or as otherwise permitted or required by applicable law. This Website and External Privacy Policy describes our practices and the rights and choices that may be available to you regarding your personal information.
We encourage you to review this Website and External Privacy Policy before providing personal information to us. You may withdraw your consent as further described at Section 9 (Your Rights).
This Website and External Privacy Policy is divided into the following sections:
Personal information means any information which relates to a natural person and allows that person to be identified, directly or indirectly, in combination with other information.
We may collect and process the following categories of personal information about you:
If you provide Troilus with the personal information of another individual, you represent that you have obtained all necessary consents from such person to enable us to collect and process such personal information for the purposes set forth in this Website and External Privacy Policy.
We use different methods to collect personal information from and about you.
Direct interactions
You may provide us with your personal information when you interact with us directly, including when you:
Automated technologies or interactions
As you interact with our Websites, we will automatically collect Technical Information and Internet Activity Information about your equipment, browsing actions and patterns. We collect this information by using cookies, pixels, server logs and other similar technologies. Cookies are small pieces of text stored by your web browser.
In addition to this, we also use Google Analytics as part of the analytics cookies on our Websites. Google Analytics is Google’s analytical tool that helps us to understand how users engage with our Websites. The information we collect through Google Analytics is page views, time spent through the Network Services, number of visitors, the source they come from, the pages they have visited, session and Websites usage, the whole in an anonymous form. It uses a set of cookies to collect such information and reports site usage statistics without allowing us to identify individual visitors.
You can opt out of having your activity on our Websites available to Google Analytics by installing the Google Analytics opt-out browser add-on. The add-on prevents the Google Analytics JavaScript (ga.js, analytics.js and dc.js) from sharing information with Google Analytics about visits activity. For more information on the privacy practices of Google, please visit the Google Privacy & Terms web page: https://policies.google.com/privacy.
Depending on your location and applicable legal requirements, our Websites may present tools that allow you to manage your cookie preferences. You may also modify cookie settings through your browser, although doing so may affect Website functionality.
Automated Decision Making
Troilus does not currently make decisions about individuals based solely on automated processing of personal information.
If we ever use personal information to make a decision based exclusively on automated processing, we will inform you at or before the time the decision is made. You will have the right to be informed of the personal information used to render the decision, to access the principal factors and reasons leading to it, to have the underlying data rectified, and to submit observations to a member of our personnel who is authorized to review the decision.
We may collect and use your personal information for the following purposes, as well as for any other purpose authorized or required by law, or for any other purpose with your consent.
We will only collect, use, and disclose your personal information with your consent, except where permitted or required by law.
Your consent may be express or implied, depending on the circumstances and the sensitivity of the personal information. You will be asked to expressly consent to any collection of sensitive personal information about you. In other cases, your consent may be implied. Additionally, in certain circumstances, applicable law may permit or require Troilus to collect, use, or disclose personal information without consent.
For the purposes of this Policy, "sensitive personal information" includes information that, due to its nature, particularly its medical, biometric or otherwise intimate nature, or the context of its use or communication, it entails a high degree of reasonable expectation of privacy.
If Troilus intends to use personal information for a purpose that is materially different from the purposes described in this Website and External Privacy Policy, we will provide any notice and obtain any consent required by applicable law before doing so.
Please refer to Section 9 (Your rights) for more information about your right to withdraw your consent.
(A) Service Providers
Troilus does not sell, distribute or otherwise disclose personal information to third parties, unless set out in this Policy, permitted by applicable law or for specifically consented uses.
We may engage third-party service providers to support our operations and administration. This may require Troilus to transfer personal information. Troilus will treat any information it transfers to service providers in accordance with this Policy.
Troilus requires its service providers to protect personal information, to use it only for the purposes for which it is provided, and to process it in accordance with our instructions and applicable law. Service providers are not permitted to use personal information for their own purposes unless permitted by law, clearly disclosed and in accordance with Troilus’ instructions.
We may also disclose your personal information to our share registrar and transfer agents, in Canada, the US or any other jurisdiction where a register of Troilus' securities is maintained.
(B) Our Affiliates
We may transfer or disclose your personal information to our affiliates for the purposes set out in this Website and External Privacy Policy and as otherwise permitted or required by applicable law.
(C) Business transactions
Troilus may disclose personal information without your consent in connection with an actual or proposed business transaction, such as a merger, acquisition, financing, reorganization, sale of assets or similar transaction, where permitted by law and subject to appropriate safeguards. If the transaction is completed, personal information may be transferred to the relevant successor or counterparty, subject to applicable law and such successor or counterparty will inform you that it now holds your personal information.
(D) Law enforcement or governmental authorities
Troilus may disclose your personal information to law enforcement or governmental authorities to investigate actual or potential fraud, any violation of law, regulation, website terms of use and to protect the rights, property, or safety of Troilus, its customers, or its partners.
Troilus may communicate, store or transfer your personal information outside of the jurisdiction in which it was collected, including elsewhere in Canada or in other jurisdictions where Troilus or its service providers operate. The laws regarding the processing of personal information may be less stringent in those jurisdictions than the laws of the jurisdiction where the collection occurred. Troilus will take reasonable steps to ensure such personal information receives adequate protection, including through contractual or other safeguards where appropriate. You may contact the Designated Privacy Officer for more information about the processing of your personal information outside of your jurisdiction.
Before communicating personal information outside Québec, Troilus will, where required by applicable law, perform a privacy impact assessment to evaluate the protection that will be afforded to such information. The assessment may consider the sensitivity of the personal information, the purposes for which it is to be used, the measures in place to protect it, and the legal framework applicable in the destination jurisdiction. Troilus will not proceed with such communication unless it is satisfied that the personal information will receive adequate protection or that appropriate safeguards have been implemented.
To prevent unauthorized access or disclosure, maintain data accuracy and facilitate the appropriate use of data, Troilus uses physical, technological and administrative procedures to attempt to protect the integrity of its Websites and the confidentiality of personal information that it processes. Nevertheless, Internet transmissions are never completely private or secure.
Troilus will take reasonable precautions to protect personal information with appropriate security measures, physical safeguards and electronic precautions. Troilus maintains personal information through a combination of paper and electronic files. Troilus will make commercially reasonable efforts to ensure that:
If a confidentiality or privacy incident occurs involving your personal information that presents a risk of serious injury to you, we will notify you promptly and the appropriate data protection authorities, as required by applicable law. In addition, Troilus maintains an internal register of all confidentiality incidents regardless of the level of risk. We will take all reasonable measures to reduce the risk of injury and prevent new incidents of the same nature, and we will make our incident register available to the Commission d’accès à l’information upon request. Additionally, Troilus will take reasonable steps to contain and assess the incident and provide any required notifications in accordance with applicable law.
Troilus retains personal information only for as long as reasonably necessary to fulfill the purposes for which it was collected, to satisfy legal, regulatory, accounting, operational, or reporting requirements, and to protect Troilus' legitimate business interests. Once personal information is no longer required, it will be destroyed safely and securely, anonymized or otherwise handled in accordance with applicable law. However, applicable laws may require that certain personal information be kept for a specified amount of time. Where this is the case, the law supersedes this Policy.
When personal information is no longer required, Troilus will take reasonable steps to securely destroy, delete, anonymize, or otherwise dispose of such information in accordance with applicable law and its records management practices. Anonymized data is irreversibly stripped of identifying details so that it can no longer be associated with an identifiable natural person. Retention periods vary depending on the type of information and the purpose for which it was collected.
Subject to certain exceptions, as permitted by law, you have the following rights in relation to the personal information we hold about you:
Your Right of Access
You have the right to access the personal information we hold about you and to receive a general account of our uses of that personal information. Upon receipt of a written request from you, we will provide you with a copy of your personal information, although in certain limited circumstances, we may not be able to make all relevant personal information available to you, for example, where that personal information also relates to another individual. In such circumstances, we will, upon request, provide you with the reasons for such refusal. We will endeavour to deal with all requests for access to personal information within 30 days.
Your Right to Rectification
If the personal information we hold about you is inaccurate or incomplete, you are entitled to have it rectified. Where appropriate, such amended personal information will be provided to the parties to whom we are authorized to disclose your personal information. We will endeavour to deal with all requests for rectification of personal information within 30 days.
Your Right to Withdraw Consent
Whether we rely on your implicit or explicit consent, you have the right to withdraw that consent at any time. However, this will not affect any processing carried out before you withdrew your consent. If you withdraw your consent, we may not be able to provide certain products, services, and information to you. We will advise you if this is the case at the time you withdraw your consent.
Withdrawal of consent will not prevent Troilus from communicating with you where such communication is necessary in connection with an existing contractual, business, employment or other relationship, or where otherwise permitted or required by law.
Your Right to Data Portability
Subject to applicable law, you may request that computerized personal information collected from you be communicated to you, or to a person or organization authorized by you, in a structured and commonly used technological format.
How to Exercise Your Rights
To exercise any of the rights described in this section, you may submit a written request to our Designated Privacy Officer using the contact information set out below.
We may request information necessary to verify your identity before responding to your request. Where applicable law requires a response within a specific timeframe, we will make reasonable efforts to comply with those requirements.
Certain rights may be limited or unavailable where an exception applies under applicable law.
Our Websites may occasionally contain links to other sites that are not operated by Troilus. Troilus is not responsible for the privacy practices or the content of those websites. Please be sure to review the privacy policies of those external sites.
If you would like further information about how we manage your personal information, have any queries or feedback relating to this Website and External Privacy Policy, or wish to lodge a complaint, you may contact the office of our Designated Privacy Officer at:
Troilus Mining Corporation Daniel Guay Senior Director, Human Resources e-mail: privacy@troilusmining.com
Our Designated Privacy Officer is accountable for compliance with applicable privacy laws and is responsible for coordinating the investigation of any complaints and resolving privacy-related issues. The Designated Privacy Officer will manage any complaints received in a timely manner and provide you with a response to your complaint.
We encourage you to contact the Designated Privacy Officier first in the case of any complaints so that we can address your concerns. If you are not satisfied with our response or do not wish to contact the Designated Privacy Officier, you may contact the relevant privacy regulator.
In Québec, you may also contact the Commission d’accès à l’information du Québec.
Troilus may review this Policy periodically and may amend it to reflect legislative, organizational, technological or operational developments.
Where required by applicable law, you will be notified of material amendments by an appropriate means, and the current version will be made available on our Websites.
This Policy is available in French and English. Both versions are intended to have the same meaning and effect. In the event of any inconsistency, ambiguity or discrepancy between the two versions, the French version shall prevail to the extent of such inconsistency, ambiguity or discrepancy. La présente politique est disponible en français et en anglais. Les deux versions sont destinées à avoir le même sens et la même portée. En cas d’incompatibilité, d’ambiguïté ou de divergence entre les deux versions, la version française prévaut dans la mesure de cette incompatibilité, ambiguïté ou divergence.