Shareholder privacy statement

Scope

This notice applies to shareholder representatives and institutional investor contacts engaged by Rio Tinto through investor relations activities.

Data we process

We may collect and use personal information related to your:

• Name, job title, and contact details
• Representation of shareholders or institutions
• Participation in meetings, events, or investor engagement activity
• Ownership-related data (including data sourced from Computershare or other register services if authorised)

Purpose

This information is used to:

• Manage our investor relations obligations
• Log and track engagement history
• Support shareholder analytics and targeting using selected third-party tools

Lawful basis

We process this data under our legitimate interest in engaging with shareholders and complying with listed company obligations.

Data access and transfers

Data may be processed by selected third-party providers, in particular those providing CRM systems and services, in accordance with data processing agreements.

Retention

Data is retained only as long as necessary for the above purposes. Trial and evaluation data is reviewed quarterly and deleted after the trial period unless a longer retention is justified.

Your rights

To learn more about how Rio Tinto handles personal data and your rights, please see our full External privacy statement or contact askE&C@riotinto.com.