Cookie Policy

1. About This Policy

This Cookie Policy (the "Policy") explains what cookies are, which cookies we use on our websites, for what purpose and how you can control them. Controller: Köber Energy Holding S.R.L., 18 Cluceru Udricani street, 4th floor, Bucharest, Romania · Trade Register J2025042093001, CUI 51959799 · office@koberholding.com Websites covered: https://www.koberholding.com/ · https://koberenergy.com/ · https://utvromania.com/ · https://bessintegrator.com/ · https://gridpowerx.com/ Legal framework: The use of cookies is governed by Law no. 506/2004 on the processing of personal data and the protection of privacy in the electronic communications sector (which transposes Directive 2002/58/EC, "ePrivacy"), by Regulation (EU) 2016/679 (GDPR) and by the guidelines of ANSPDCP and of the European Data Protection Board. Cookies that are not strictly necessary are placed only with your prior, freely given, specific and informed consent.

2. What Cookies and Similar Technologies Are

A cookie is a small text file that a website saves in your browser when you visit it. On subsequent visits, the browser sends the cookie back to the website, which can thus "recognise" it. Cookies cannot run programs and cannot access other files on your device. Session cookies — Are deleted automatically when the browser is closed. Persistent cookies — Remain on the device until they expire or until you delete them. First-party cookies — Are placed by the website you are visiting. Third-party cookies — Are placed by other domains (for example, analytics tools, embedded video content, social networks). Similar technologies — Tracking pixels, web beacons, local storage, session storage, device identifiers — they have similar functions and are treated in this Policy in the same way as cookies.

3. The Categories of Cookies We Use

3.1 STRICTLY NECESSARY COOKIES They are indispensable for the operation of the websites and cannot be disabled from the consent banner. Legal basis: legitimate interest; no consent required (Art. 4(6) of Law no. 506/2004). cookie_consent / cc_settings · Köber website · Stores your choices regarding cookies · Duration: 12 months PHPSESSID / session · Köber website · Maintains the browsing session and form security · Duration: Session csrf_token · Köber website · Protects forms against CSRF attacks · Duration: Session _cf_bm / cf_clearance · Cloudflare (if used) · Protection against bots and attacks · Duration: 30 minutes – 1 year wp_lang / language · Köber website · Stores the selected language · Duration: 12 months 3.2 ANALYTICS COOKIES They help us understand how the websites are used (pages visited, duration, traffic source, device) in order to improve them. The data is aggregated; IP addresses are anonymised where the tool allows it. Legal basis: consent. _ga, _ga_* · Google Analytics 4 · Distinguishes users and sessions, measures audience · Duration: 13 months _gid · Google Analytics · Distinguishes users · Duration: 24 hours _pk_id, _pk_ses · Matomo (if used) · Audience measurement with data hosted in the EU · Duration: 13 months / 30 minutes 3.3 FUNCTIONAL COOKIES They enable additional functions, such as storing preferences or displaying embedded content (maps, videos). Legal basis: consent. YSC, VISITOR_INFO1_LIVE · YouTube (Google) · Playback of embedded videos and storing playback preferences · Duration: Session / 6 months NID · Google Maps · Display of embedded maps · Duration: 6 months lang, li_gc · LinkedIn · Embedded LinkedIn buttons and content · Duration: Session / 6 months 3.4 MARKETING COOKIES They serve to display relevant content and advertisements on our websites and on third-party platforms and to measure the effectiveness of campaigns. They may create a profile of your interests and may be shared with advertising platforms. Legal basis: consent. _gcl_au, IDE, test_cookie · Google Ads / DoubleClick · Conversion measurement and remarketing · Duration: 3 months – 13 months _fbp, fr · Meta (Facebook, Instagram) · Campaign measurement and remarketing · Duration: 3 months li_sugr, bcookie, UserMatchHistory · LinkedIn · B2B advertising and campaign measurement · Duration: 1 – 12 months The detailed and up-to-date list of cookies active on each website is displayed in the consent banner, under the "Details" section, and is reviewed at least once every 6 months. We do not currently use marketing cookies on the corporate websites unless this is expressly indicated in the consent banner of the website concerned.

4. How You Make and Change Your Choices

4.1 THE CONSENT BANNER On your first visit to each website a consent banner is displayed through which you can: • Accept all cookies; • Refuse all non-essential cookies, with a single click, as easily as accepting; • Configure each category individually. Non-essential cookies are not placed before you have made your choice. You may revisit your choices at any time via the "Cookie Settings" link in the footer of each website. We will ask for your consent again no later than after 12 months or when we add new categories. 4.2 BROWSER SETTINGS You can block or delete cookies from your browser settings. Please note that blocking strictly necessary cookies may affect the operation of the websites. Google Chrome · Settings → Privacy and security → Cookies and other site data Mozilla Firefox · Settings → Privacy & Security → Cookies and Site Data Microsoft Edge · Settings → Cookies and site permissions Apple Safari · Preferences → Privacy → Manage Website Data Mobile devices · Settings of the browser application or of the operating system 4.3 OPTING OUT OF THIRD-PARTY TOOLS Google Analytics can also be disabled through the official browser add-on (https://tools.google.com/dlpage/gaoptout). Advertising preferences can be managed at https://www.youronlinechoices.com/ro/ and in the settings of your Google, Meta and LinkedIn accounts.

5. Personal Data and Transfers

Cookies may contain or generate personal data (online identifiers, IP address). The processing of such data is described in the Privacy Policy (KEH-LG-02), including your rights and how to exercise them. Some providers (Google, Meta, LinkedIn) may transfer data to the United States; transfers are made on the basis of the EU-U.S. Data Privacy Framework or the Standard Contractual Clauses, in accordance with Chapter 4 of the Privacy Policy.

6. Updates

We may update the Policy when we change the tools used or when legislation and the guidelines of the authorities so require. The version in force, with the date of the last update, is published on each website.

7. Contact

Controller: Köber Energy Holding S.R.L. Address: 18 Cluceru Udricani street, 4th floor, Bucharest, Romania E-mail: office@koberholding.com Web: www.koberholding.com Supervisory authority: ANSPDCP · www.dataprotection.ro This version enters into force on 27 September 2026. Document code: KEH-LG-03 · Version 1.0