Privacy Statement

This Privacy Statement explains how BHP Engage (“the Platform”) collects, uses, stores, and protects personal information about BHP employees. BHP is committed to handling your personal information responsibly and in accordance with applicable privacy legislation, including the Privacy Act 1988(Cth) and BHP's global Privacy Policy.

This statement applies only to the Platform. Please refer to BHP's corporate privacy policy for information about how BHP handles personal information across its broader operations.

The Platform collects and processes the following categories of personal information:

The Platform does not collect sensitive personal information (as defined in the Privacy Act 1988) and does not use cookies for tracking or advertising purposes.

Your information is used exclusively for the following purposes:

• Authenticating your access to the Platform via BHP Microsoft Entra ID;
• Awarding and tracking recognition points and badges;
• Displaying leaderboards — your name may be shown to other employees unless anonymisation is enabled for the relevant program;
• Processing reward redemption requests through HR;
• Generating HR reports on engagement activity for program management;
• Maintaining an audit trail for administrative governance; and
• Sending you email notifications about your account activity via Microsoft Graph API.

Your data is not used for automated decision-making that produces legal or similarly significant effects, is not shared with third parties outside BHP, and is not used for marketing purposes.

All Platform data is stored on-premises on BHP-managed infrastructure located within Australia. No personal data is stored in or transmitted to public cloud services.

The Platform applies the following technical safeguards:

• Authentication via BHP Microsoft Entra ID — the Platform does not manage passwords;
• Role-based access controls limiting HR data visibility to authorised HR administrators;
• TLS encryption for all data in transit;
• Encrypted storage for data at rest within BHP's internal infrastructure; and
• Access logging via an append-only audit trail.

Engagement activity data (points, badges, scans) is retained for the life of your BHP account. Audit log records are retained in accordance with BHP's records management policy.

When your BHP account is deprovisioned, access to the Platform is automatically revoked. Retention of historical records after account deprovisioning is subject to BHP's data retention schedule. Requests for earlier deletion should be directed to your HR Business Partner.

The overall leaderboard displays your full name and accumulated point score and is visible to all employees with Platform access. Program-specific leaderboards may be configured by HR to display anonymised participant identifiers instead of names, depending on program settings.

If you have concerns about leaderboard visibility, contact your HR Business Partner. Leaderboard opt-out is subject to applicable policy.

Under applicable privacy legislation, you may have the right to:

• Request access to personal information the Platform holds about you;
• Request correction of inaccurate personal information; and
• Lodge a complaint about how your information has been handled.

To exercise these rights, contact your HR Business Partner or submit a request through the BHP IT Service Desk, referencing “BHP Engage Privacy”.

BHP may update this Privacy Statement as the Platform evolves. The date of the most recent revision is shown at the top of this page. Material changes will be communicated to affected users via the Platform or email.