Legal

MEC Privacy Policy

2 July 2026

This Privacy Policy (“this Policy”) explains how Resource Point Pty Ltd (ABN 51 165 739 408) and its subsidiaries (all of which are wholly-owned, and including MEC Mining Group Pty Ltd and MEC Technical Services Pty Ltd) (“MEC”, “we”, “us” or “our”) collect, use, share, store and retain (i.e. ‘process’) information relating to identified or identifiable human beings (‘personal data’) when we do so independently for our own purposes (as a so-called ‘data controller’). This means that details of how we may process our clients’ data as part of our services for them are not set out here but are instead contained in our client service agreements.  We may update this Policy from time to time by placing a revised version thereof on our website at www.mecmining.com.au (“Website”).

This Policy is divided into different parts, to describe how we process personal data in different contexts, as follows:

  • Part 1 – visitors to our Website;
  • Part 2 – our clients and prospective clients;
  • Part 3 – job candidates;
  • Part 4 – vendors, service providers and other business partners;
  • Part 5 – general provisions relating to all personal data (detailing how it is stored, protected, otherwise shared, and what your rights are).

IMPORTANT: Our services are aimed at corporate clients in the mining sector who act through their duly authorized representatives. We thus have no need for, and do not knowingly process, any data related to minors. If you are under 18 years of age you should not use our Website or otherwise attempt to contact us.

  • Privacy Policy MEC Mining

PART 1: WEBSITE VISITORS

As people cannot open accounts and/or log into our Website, all Website users are pure visitors and when we refer to ‘you’ in this Part 1, we are referring to a Website visitor.

Technical & Behavioural Data: As a Website visitor, any/all technical and/or behavioural data which may be automatically collected during your Website visit (like IP address, browser type, date/time accessed, error logs, page response times, files downloaded etc) would only be regarded as personal data to the extent that it can be associated with you in an identifiable way i.e. if your IP address is unique/personal to you or if you submit one of our web forms (as described below). Nevertheless, note the following:

  • No marketing or analytics tracking: We do not deploy any tracking beacons, web bugs, invisible image-based trackers, analytics or marketing tracking on our Website (be it Google Analytics, Tag Manager, Meta Pixel, LinkedIn Insight Tag, Hotjar, Microsoft Clarity or otherwise). However, we cannot control certain cookies from being independently deployed by third parties (like advertising networks or web traffic analysis providers).
  • Minimal Functional Tracking: Your IP address and HTTP request headers are sent to Cloudflare to enable passive content delivery on the Website, and your IP address and browser information is sent to Google to render Google Maps showing our office premises.
  • Your Social Media sharing: The Website may incorporate social media features enabling you to share content on social media (eg a Facebook ‘like’ button) and in doing so, you will be sharing your IP address and the page you are visiting with such social media site, subject to its own privacy policy and practices.

Webform Data: The Website makes one or more contact forms available which you may choose to complete and submit and if so, your personal data is used by us for purposes of responding to your request and for our related legitimate interests, as follows:

  • your email address, phone number, and message content are needed to respond to your specific request and to give you further information about our services more generally (and in the latter regard, note that you are entitled to unsubscribe from our unsolicited promotional communications at any time via the email unsubscribe links and/or by contacting enquiries@mecmining.com.au). Note that if you have accepted our website cookies, your email address will be associated therewith for business intelligence purposes.
  • Your name is needed to address our response to you and avoid our email response being caught by your spam filters.
  • As we provide different types of services aimed at corporate entities in the mining industry in specific countries, we may require your job title, the company and/or industry you represent, the type of services your company is interested in, and your country, in order for us to best respond to your request, as well as for business intelligence purposes (i.e. to ascertain where there’s a demand for our services and for which types of services, and/or to assess the user-friendliness and performance of our Website).
  • Your Website visit behavioural data (as described above) will be associated with your webform (and thus you) via Google’s reCAPTCHA for bot scoring purposes (ie to ensure we’re dealing with a human being and not a bot).

Data Controller:  The Website is operated by Resource Point Pty Ltd for itself and the rest of the MEC group.

Links to other websites:  Although our Website may contain links to and from the websites of others, we do not control and do not accept any responsibility or liability in relation to such other third-party websites. Such websites are provided by third parties subject to their own privacy policies, so please check these policies before you submit any personal data to these other websites.

Personal Data: Our clients (and prospective clients) are corporate entities, but we do process some personal data associated with their human representatives as follows: their name and client-related contact details, including position, email address and phone numbers; and records of their client-related communications with us.

How we collect it: We collect personal data associated with prospective clients directly and indirectly in various ways, i.e., via their representatives’ participation at conferences, networking events, seminars etc; our Website (as detailed in Part 1); the operators of third party websites on which our content has been published (subject to the notice and consent requirements of privacy and direct marketing laws); our marketing/sales related service providers; and publicly available sources (e.g. prospective client’s website; LinkedIn etc).  As regards our clients, we collect such personal data via their human representatives (be it in person, via phone, email, virtual meeting platforms, or our Website as detailed in Part 1) with our clients being responsible for the completeness and accuracy thereof and for ensuring that the relevant people have been notified (and, where required by law, have consented).

Why we need it: Although our business is not consumer-facing and our clients (and prospects) are corporate entities, we need the contact details of their human representatives to promote, explain, and provide our services, including to carry out incidental functions, like account management, billing, service support, debt collection, investigating complaints and resolving disputes, otherwise administering our agreement with each client, as well as to communicate new services and related promotions (in the latter case, provided they have not opted-out of receiving such promotional material, as described in Part 5);

How we share it: To the extent necessary for the above purposes (or otherwise permitted by law), with the client’s other authorised representatives; the client service-related subcontractors (if any); our debt collection agencies; and as otherwise provided in Part 5.

How long we keep it: As long as needed to satisfy the above purposes, i.e.  for so long as we are engaging in discussion with a prospective client and if resulting in a client relationship, then for so long as the relevant client relationship is effective and for such further period as required or permitted by law.

Data Controller: The MEC group entity holding the relationship with that client, possibly in joint control with other MEC group entities

When we refer to ‘you’ in this Part 3, we are referring to anyone who applies for a job with us and when we refer to ‘us’, we mean the specific MEC group entity that will be employing you, possibly in joint control with one or more other group entities.

Personal Data: We process what one would ordinarily expect of any job application process, i.e. contact details (like your name, physical address, email address and phone number); employment-related information (eg previous work experience, skills, qualifications, referees, working rights and police clearance, to the extent permitted under relevant employment laws); records of your communications with us (including information gathered during interviews); results of any pre-employment assessments (e.g. personality, aptitude, situational judgment or skills test); and whatever other information you have chosen to include in your resume and cover letter.  Note that, save for very specific roles which may necessitate police checks or other background checks (as allowed by applicable law), we do not need any sensitive personal data (i.e. data relating to race, ethnicity, health, political opinions, religious, philosophical or other beliefs, political or trade union membership, biometrics, sexual orientation or criminal convictions) and your provision thereof would be entirely voluntary.

How we collect it:  Either directly from you, be it in person, by phone, email, and/or our Website and related recruitment system, or indirectly via recruitment agencies, the recruitment websites and/or social media accounts you applied through (including ‘Seek’ and ‘Employment Hero’ platforms) your referees, background checking service providers, and from other public sources (eg your public LinkedIn profile).

Why we need it:  We only process your personal data to the extent needed for the job application process and/or your subsequent employment, as required by our overriding legitimate interests, applicable laws and/or for purposes of entering into an employment contract with you.  More specifically, we use it to assess and process your job application; decide whether to employ you; deal with your queries; defend against potential claims relating to the recruitment process; consider you for future job opportunities (if you have consented to us retaining your details for such purpose); and, if you are hired, make decisions about your employment with us.  If we don’t receive certain required information, we may not be able to properly assess or proceed with your job application.

How we share it: To the extent necessary for the above purposes (or otherwise permitted by law), we may share such data with your referees; third parties who conduct background/police checks; the institutions that issued your qualifications, and as otherwise detailed in Part 5.

How long we keep it:  We delete unsuccessful candidates’ personal data after the application process is finished (i.e. once a suitable candidate is hired) save for those who have consented to their data being retained for future employment offers or applicable laws entitle or require us to retain the data for longer (e.g. for up to 6 months to defend against potential legal claims related to the recruitment process). The successful candidate’s personal data will be retained and processed in accordance with our internal employee-facing policies and processes.

Data Controller: the MEC group entity recruiting for the relevant role.

In doing business we engage with various suppliers and service providers (“Vendors”) including for purposes of acting as our subcontractors on certain client projects (“Subcontractors”) and we process certain personal data in relation thereto, as follows:

Personal Data: We process the contact details of Vendors’ human representatives (i.e. the name, position, email address and phone numbers) along with their communications with us. In the case of sole proprietorships or partnerships, we also process their banking details, billing and service history (as required for our contract with them or by law, or in our overriding legitimate interests). As regards Subcontractors more specifically, we may also process personal data relating to their key personnel on any specific Client projects, being their names, contact details, and relevant timesheets.

How we collect it:  We collect such data directly from the Vendor via their websites or representatives (be it in person, via phone, or email) with Vendors being responsible for the completeness and accuracy thereof and for ensuring that the relevant people have been notified and, where required by law, have consented.  Personal data related to prospective Vendors is collected from publicly available sources (e.g. their website or LinkedIn), via participation at conferences and other events, and via referrals from existing business associates.

Why we need it:  We need such data to appropriately engage with the Vendor to manage our relationship with it (as required by our contract with it and/or in our overriding legitimate interests).  More specifically, we use it for prospective Vendor assessment and contract negotiation purposes as well as the ongoing administration of our Vendor agreement.

How we share it:  To the extent necessary for the aforesaid purposes (or otherwise permitted by law), we may share a Vendor’s personal data with the Vendor’s other authorised representatives; in the case of a Subcontractor, also with our relevant Client; and as otherwise detailed in Part 5.

How long we keep it: Vendor-related personal data is stored only as long as needed to satisfy the above purposes, normally being for so long as Vendor’s business relationship with us is effective and for such period thereafter as required or permitted by law.

Data Controller: The MEC entity holding the relevant account or business relationship with the Vendor, possibly in joint control with one or more other MEC companies.

Promotional communications: It’s in our legitimate business interest to promote our business and service offerings, but we will only do so in accordance with applicable direct marketing laws, including that recipients of direct marketing communications be entitled to opt-out therefrom by following the unsubscribe links at the bottom of promotional emails or by contacting marketing@mecmining.com.au with “UNSUBSCRIBE” typed into the subject line. Note that opt-outs won’t be of immediate effect (as we require reasonable time to give effect thereto in our systems). Also note that service and/or billing-related communications cannot be unsubscribed from as these are not promotional in nature.

Survey responses: We may conduct surveys for purposes of research, business development and/or service improvement.  These surveys are usually done on an anonymous basis, but if not, they are voluntary, with any information so provided being based on that person’s consent.

Other people who contact us:  As regards people who contact us via email, phone or other available methods (whether to make queries, complaints or otherwise), note that we collect and process their name, contact details and the content of their communications in order to respond, manage and facilitate their complaint/request which, depending on the context and nature of the communication itself, would be on the basis of their having consented thereto by proactively engaging with us, alternatively based on statutory requirements or our overriding legitimate interests.

Automated decision-making: Decisions having a significant impact on someone personally (e.g. whether to hire someone or not) are not taken automatically (whether based on traditional algorithms, AI, or otherwise). We also do not do any automated profiling about people for such purposes. Although automation may be used in our business to varying degrees, including to assist in decision-making, no decision is fully automated. There is always human involvement.

Anonymous data: We may anonymise personal data (so that it is no longer reasonably possible to associate the data with the person) in order to produce aggregated and/or individualised anonymous reports (eg: anonymous aggregated internal statistical analysis of job applicants) and/or as an alternative to deletion where deletion is not reasonably possible.  Subject to applicable law, we may use and share such anonymised information for any purpose, including for research and marketing purposes.

How else we may share data:  In addition to what is specified in Part 1 to 4 above, we only share personal data as follows:

  • with our outsourced service providers who perform functions on our behalf such as our mailing functions, debt collectors, IT service providers, cloud-based service providers (incl. our Employment Hero recruitment platform, Hubspot CRM, Xero finance system, and Microsoft 365) as well as our legal, accounting and financial advisers and those assisting us with fraud protection, spam/malware prevention, and credit risk reduction.
  • to government, law enforcement & regulatory bodies if required or if we in good faith believe that disclosure is reasonably necessary to comply with law or legal process (eg court order) or to enforce our agreements;
  • For purposes of any merger or acquisition, with the specific third party and its advisors in order to facilitate the transaction between such third party and MEC (which is most likely to occur in relation to a purchase by it of any MEC entity or its business or assets);

Where we process data: All MEC entities are registered in Australia and most of our client data is hosted on dedicated servers located in Australia. However, we also operate through various outsourced cloud-based system/service providers who may be located in other countries (eg Microsoft), meaning that personal data may be hosted outside of Australia, including the United States.  We put appropriate measures in place to protect the personal data, as required by applicable laws, to ensure that the foreign recipient thereof provides appropriate standards of protection thereto. Nonetheless, you acknowledge that your personal data may be processed and stored in foreign ‎jurisdictions and consequently that foreign governments, courts, law ‎enforcement or regulatory agencies may be able to ‎access or obtain disclosure of your personal data ‎under a lawful order or otherwise through the ‎laws of that foreign jurisdiction.

How long we keep data: We only retain personal data for as long as needed for the purposes we collected it for (including to satisfy any legal, accounting, or reporting requirements).  In determining the appropriate retention period, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure thereof, the purposes for which we process it, and any particular legal requirements.

How we protect data:  We store personal data electronically and sometimes in hard copy form. We take a range of technical, physical and organisational measures to protect the security of personal data, including storage in password-protected servers in restricted and monitored areas, and multi-factor authenticated cloud-hosted environments with reputable, ISO-certified, cloud-based system providers. However, you acknowledge that no method of transmission over the internet and no means of electronic or physical storage, is absolutely secure.

Your rights & how to exercise them:

  • You have the right to not receive any direct marketing messages from us; to withdraw your consent to the future processing of any voluntarily-provided personal data; to request information about the personal data of yours we process; and to demand the correction of incorrect data (and in the latter regard, although we take reasonable steps to ensure that the personal data we hold remains accurate, please keep us informed if your personal data changes during your relationship with us). You may also have additional rights under the privacy laws applicable to you. Also, if our processing is stated as being based on our overriding legitimate interests, you may object thereto based on your special set of circumstances.
  • You can contact us to exercise such rights and we will respond to you within 30 days (bearing in mind that we may request certain information from you to verify your identity before responding to your request). Please use the following contact details:

Privacy queries and complaints: If you have an enquiry regarding your privacy more generally or you wish to raise a complaint, please contact privacy@mecmining.com.au.  Although you may have the right to complain to the Australian Information Commissioner (https://www.oaic.gov.au/) or other relevant data protection authority, we encourage you to contact us first to facilitate swift resolution of your complaint