Privacy Policy

1. Introduction

This Privacy Policy (the "Policy") explains how Köber Energy Holding S.R.L. ("Köber", "we") collects, uses, stores and protects the personal data of visitors to our websites, of customers, partners, job applicants and other persons with whom we interact. Controller: Köber Energy Holding S.R.L. Registered office: 18 Cluceru Udricani street, 4th floor, Bucharest, Romania Trade Register no. / CUI: J2025042093001 / 51959799 Data protection e-mail: office@koberholding.com Websites covered: www.koberholding.com · koberenergy.com · utvromania.com · bessintegrator.com · gridpowerx.com Where a Group company (a "Subsidiary") processes data for its own contracts or services, that company is the controller; its identification details are indicated in the relevant contract or form. Köber Energy Holding S.R.L. and the Subsidiaries may act as joint controllers for shared systems (for example, websites, group CRM), in which case the essence of the arrangement between them is available on request. Legal framework: We process data in accordance with Regulation (EU) 2016/679 (the "GDPR"), Law no. 190/2018 implementing the GDPR, Law no. 506/2004 on the processing of personal data and the protection of privacy in the electronic communications sector and the decisions of ANSPDCP (the Romanian National Supervisory Authority for Personal Data Processing). Scope: The Policy applies to all processing carried out through the Group's websites and in our commercial, recruitment and institutional relationships. The processing of employee data is described in a separate internal policy. Third-party websites to which we link have their own policies.

2. What Data We Process, for What Purpose and on What Basis

WEBSITE VISITORS Data: IP address, browser and device type, pages accessed, date and time, traffic source (server logs) Purpose: Operation and security of the websites, prevention of abuse, error diagnosis Legal basis: Legitimate interest (Art. 6(1)(f) GDPR) · Retention: 12 months Cookie identifiers and usage data · Purpose: Audience measurement, functionalities, marketing — in accordance with the Cookie Policy Legal basis: Consent (Art. 6(1)(a)); legitimate interest for strictly necessary cookies · Retention: According to the duration of each cookie (maximum 13 months) PERSONS WHO CONTACT US OR REQUEST A QUOTATION Data: Surname, first name, e-mail, telephone, company, position, content of the message, attached documents Purpose: Responding to enquiries, preparing quotations, negotiating and concluding contracts Legal basis: Performance of a contract or pre-contractual steps (Art. 6(1)(b)); legitimate interest for general enquiries Retention: 3 years from the last interaction; for the duration of the contract plus the statutory limitation period, if a contract is concluded CUSTOMERS, SUPPLIERS AND BUSINESS PARTNERS Data: Identification and contact details of representatives and contact persons, position, signature, bank details of natural persons, correspondence, data from contractual and invoicing documents Purpose: Performance of contracts, invoicing, accounting records, the business relationship, integrity checks (KYC, sanctions, anti-corruption), management of disputes Legal basis: Performance of a contract (point (b)); legal obligation (point (c)) for accounting and tax records; legitimate interest (point (f)) for checks and the defence of rights Retention: For the duration of the contract, then 10 years for financial and accounting documents (Accounting Law no. 82/1991); 5 years for integrity checks JOB APPLICANTS Data: CV, cover letter, contact details, education, experience, references, interview results Purpose: Recruitment and selection Legal basis: Pre-contractual steps (point (b)); consent for keeping the CV in the applicant database Retention: For the duration of the recruitment process; up to 2 years with consent for future positions SUBSCRIBERS TO COMMERCIAL COMMUNICATIONS Data: E-mail, name, company, preferences, message interaction data (opens, clicks) Purpose: Sending newsletters, event invitations, information about products and projects Legal basis: Consent (point (a)); legitimate interest for existing customers, with the right to object (Law no. 506/2004) Retention: Until withdrawal of consent or unsubscription; 3 years from the last interaction VISITORS TO PREMISES AND FACILITIES Data: Name, identity document, company, time of entry and exit, video images (CCTV) in signposted areas Purpose: Security of persons, energy facilities and property; occupational safety obligations Legal basis: Legitimate interest (point (f)); legal obligation (point (c)) for critical infrastructure Retention: Access registers: 1 year; CCTV recordings: 30 days, except in the case of incidents PERSONS MAKING INTEGRITY REPORTS Data: Identity of the reporting person (if not anonymous), content of the report, data of the persons concerned Purpose: Receiving, investigating and resolving reports of breaches of the law Legal basis: Legal obligation (Law no. 361/2022 on the protection of whistleblowers); legitimate interest Retention: 5 years from the closure of the report, except for ongoing proceedings We do not process special categories of data (health, political opinions, trade union membership, etc.) through the websites. We do not make decisions based solely on automated processing that produce legal effects concerning you.

3. To Whom We Disclose Data

Data is accessible only to persons who need it for the purposes above. We may transmit it to: • The companies of the Köber Group, for the centralised management of business relationships, IT systems and support functions; • Service providers acting as processors on the basis of contracts compliant with Art. 28 GDPR: web and cloud hosting, e-mail and newsletter platforms, traffic analytics tools, CRM, IT and security services, archiving, recruitment, courier services; • Professional advisers: lawyers, auditors, accountants, tax advisers, notaries, bound by confidentiality obligations; • Banks and financial institutions, for payments; • Public authorities (ANRE, ANAF, the Trade Register, ANSPDCP, courts, criminal investigation bodies), where required by law; • Prospective purchasers in the event of a reorganisation, merger or sale of assets, subject to confidentiality. We do not sell or rent personal data.

4. Transfers Outside the European Economic Area

We prefer providers that store data in the European Union. If a provider (for example, a web analytics or e-mail service) transfers data outside the EEA, we ensure that the transfer is made to a country with an adequacy decision of the European Commission, to a recipient certified under the EU-U.S. Data Privacy Framework or on the basis of the Standard Contractual Clauses approved by the Commission, supplemented with additional measures where necessary. You may obtain a copy of the safeguards at office@koberholding.com.

5. How Long We Keep Data

We keep data only for as long as necessary for the purpose of the processing, in accordance with the periods set out in Chapter 2, after which we delete or anonymise it. The periods may be extended where the law so requires (for example, 10 years for accounting documents) or where the data is necessary for the establishment, exercise or defence of legal claims.

6. How We Protect Data

We apply technical and organisational measures appropriate to the risk: encryption of traffic (HTTPS), role-based access control, two-factor authentication for critical systems, backups, logging, security updates, staff training and confidentiality clauses. Providers are selected and vetted also from a security perspective. In the event of a personal data breach that presents a risk to your rights, we notify ANSPDCP within 72 hours and, where the risk is high, we inform you directly.

7. Your Rights

Access (Art. 15): To find out whether we process data about you and to receive a copy. Rectification (Art. 16): To have inaccurate data corrected or completed. Erasure (Art. 17): To request the deletion of data where it is no longer necessary, you have withdrawn your consent or the processing is unlawful. Restriction (Art. 18): To limit the processing while we verify a challenge. Portability (Art. 20): To receive the data you have provided in a structured format or to have it transmitted to another controller. Objection (Art. 21): To object to processing based on legitimate interest and, at any time, to direct marketing. Withdrawal of consent (Art. 7): At any time, without affecting the lawfulness of prior processing. Complaint: To ANSPDCP (B-dul G-ral Gheorghe Magheru nr. 28-30, Bucharest; www.dataprotection.ro) or to the competent courts. To exercise your rights, write to office@koberholding.com or by post to our registered office, marked "Data Protection". We respond within no more than one month; the period may be extended by two months for complex requests, with notice to you. The exercise of rights is free of charge, except for manifestly unfounded or excessive requests.

8. Minors

Our websites and services are addressed to professionals and adults. We do not knowingly collect data from persons under 16 years of age; if we learn that we have done so, we delete it.

9. Cookies

The use of cookies and similar technologies is described in the Cookie Policy (KEH-LG-03), available on each website, where you can also configure your preferences.

10. Updates

We may update the Policy when the processing operations, providers or legislation change. The version in force, with the date of the last update, is published on the websites; significant changes are announced prominently on the website or by e-mail, where we have your address.

11. Contact

Controller: Köber Energy Holding S.R.L. Address: 18 Cluceru Udricani street, 4th floor, Bucharest, Romania E-mail: office@koberholding.com Web: www.koberholding.com Supervisory authority: ANSPDCP · www.dataprotection.ro · anspdcp@dataprotection.ro This version enters into force on 27 September 2026. Document code: KEH-LG-02 · Version 1.0