PRIVACY NOTICE

About Us

Elawan Energy S.L.U. (“Elawan”) is a private company with limited liability incorporated in Spain with trade register number B85146215 and registered office at C/ Ombú 3, PL10, 28045, Madrid, Spain. Elawan is a global operator in the renewable energy industry which offers integrated solutions along the green energy life circle, from the promotion, development and construction of wind farms, photovoltaic plants and hydropower plants until their operation, maintenance and the sale of this green energy produced. Elawan is a wholly owned subsidiary of ORIX Corporation, a publicly owned Tokyo-based international financial services company founded in 1964.

About our Privacy Notice

This privacy notice (this “Notice”) is applicable to your relationship with Elawan. In this Notice Elawan will be hereinafter referred to as (“we”/ “us”/ “our”/ “Elawan”) and is addressed to you being (i) (the representative of) a current or potential business partner, acquisition target, acquired business or portfolio company, supplier or vendor (“Business Partner”); or (ii) a job applicant. This Notice sets the context in which we may process your personal data and explains your rights and our obligations when we do so.

The protection of personal data is important to us. We therefore process any personal data entrusted to us in line with applicable data protection rules, including the EU General Data Protection Regulation 2016/679 (the “GDPR”).

Elawan will be the “controller” of the personal data that Elawan processes about its job applicants. That means that we are responsible for determining how we collect, store and use (i.e., “process”) your personal data.

WHAT TYPES OF PERSONAL DATA DO WE PROCESS?

The types of personal data we process depend on your relationship with us. Set out below are the categories of personal data we may process, defined by the nature of our relationship to you.

The personal data we process if you are a Business Partner

If you are a Business Partner of Elawan or an individual working for a Business Partner, we will process personal data about you for the purposes of performing and managing our business relationships and our agreements we have with our Business Partners and also to comply with our legal obligations, including the obligation to undertake identification checks and those under tax law. The types of personal data we may process include identity data (such as your full name, postal address, e-mail address, phone number, job title, the company you work for), financial data (such as the Business Partner’s bank account details, billing contact address/email details and tax identification or VAT number), and information related to your interactions with our website (such as IP address, information provided through our online forms).

The personal data we process if you are a job applicant

If you are a job applicant, we process the following categories of personal data about you: identity data (such as your full name, postal address, e-mail address, phone number, age, gender, job title, the company you work for) and human resources related data (such as CV, language skills, education, training, visas, work and residence permits, social security or national insurance number/national ID or driving license number, passport information, employment contract, consent forms).

Insofar as necessary in the context of legal obligations or rights in connection with employment law, we may also need to process more sensitive types of personal data. For example, we may need to process information about your health in order to make reasonable adjustments to our recruitment process. Further detail about the more sensitive types of personal data we may process in limited circumstances is set out in section 4 below.

HOW DO WE OBTAIN YOUR PERSONAL DATA?

The types of personal data we obtain depend on your relationship with us. We obtain your personal data in the following situations:

If you are a Business Partner

• when you provide us with your personal data, or when you interact with us by e-mail, phone, letter or in person, or access our website (www.elawan.com);
• when you enter into an agreement with us;
• when we carry out due diligence on you or your staff members as part of our Business Partner selection or onboarding process. We may collect information from publicly available sources, background check providers or credit reference agencies for those purposes, in compliance with applicable law;
• when we receive and process your invoices; and
• when we collect personal data from other sources, such as local counsel, counterparties, the trade register, commercial databases or by using public sources.

If you are a job applicant

• when you provide us with your personal data, or when you interact with us by e-mail, phone, letter or in person, or access our website (www.elawan.com);
• when you enter into an agreement with us; and
• when we carry out due diligence on you, we may collect information from publicly available sources, background check providers or credit reference agencies for those purposes, in compliance with applicable law.

WHY DO WE PROCESS YOUR PERSONAL DATA AND ON WHICH BASIS?

We process your personal data for the following purposes (which also describe our legitimate interests, where a legal basis is required) when we:

If you are a Business Partner

• process and respond to requests, enquiries or complaints received from you or from third parties about you;
• onboard you as a Business Partner (which may include appropriate due diligence, screening and background checks, in compliance with applicable law) and execute our services and supporting processes and systems required;
• manage and administer our relationship with you;
• comply with legal, tax, accounting, regulatory requirements, including the prevention of fraud and misuse of our products or services as well as the security of our IT systems, architecture and networks;
• provide services requested by you;
• communicate with you about our services;
• monitor, analyze, develop and improve our business processes and systems and our services (e.g. by using cloud platforms operated by third party suppliers);
• meet our corporate and social responsibility objectives;
• carry out business development activities;
• identify, seek and defend claims;
• fulfil our internal and external financial and other reporting obligations, including the preparation of group consolidated accounts;
• enable good and user friendly functionality of our website; and
• carry out legitimate internal administrative purposes relating to Elawan and its shareholders.

If you are a job applicant

• manage our job application and recruitment process.

Whether you are a Business Partner or job applicant

We also may process your personal data on one or more of the following legal bases:

• to perform the contract, we may enter into or have entered into with you;
• to comply with a legal or regulatory obligation;
• with your consent (where applicable); or
• where it is necessary for the purposes of performing or exercising obligations or rights which are imposed or conferred by law on us or you in connection with employment, social security or social protection.

If you do not provide certain personal data when requested, it may impede our ability to perform any contract we have entered with you or to provide you with requested information or services.

We will only process more sensitive personal data (e.g., information on your health) in limited circumstances, and when permitted by applicable law. We may process sensitive personal data for the following purposes and on the following legal bases:

• carry out necessary due diligence or background checks (which, depending on the nature of your role or our business partnership, may require us to carry out criminal checks) in order to comply with regulatory requirements, protect the public from dishonesty and for fraud prevention purposes;
• ensure health and safety in the workplace; and
• comply with our legal obligations or exercise rights in connection with employment, such as anti-discrimination or equal opportunities law.

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis that allows us to do so.

HOW LONG DO WE KEEP YOUR PERSONAL DATA?

We will retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, tax, regulatory or reporting requirements, and any contractual obligations we may have with you. This means that the period of time for which we store your personal data may depend on the type of data we hold. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax or accounting requirements.

TO WHOM DO WE DISCLOSE YOUR PERSONAL DATA?

Where appropriate for the above purposes, we share your personal data with other Elawan Group Companies (i.e., Elawan subsidiaries, joint ventures and affiliates effectively controlled directly or indirectly by Elawan). We also transfer (or may grant access to) your personal data to the following third parties:

• service providers and contractors for the performance of any agreement we conclude with them (such as our (IT) systems, cloud service, storage and database providers);
• any third party to whom we assign or novate any of our rights or obligations under a relevant agreement;
• any third party in connection with a proposed reorganization, merger, sale or other form of corporate transaction or process;
• any national or international governmental or judicial authority or arbitral tribunal, where we are required to do so by applicable law or regulation or at their request, in compliance with applicable laws; and
• professional advisers such as accountants, financial services providers, legal advisers and medical professionals.

In that context, your personal data may be transferred and processed outside of the European Economic Area (“EEA”), including in Japan and the UK, which have both been recognized as offering an adequate level of protection by the European Commission.

Your personal data may also be transferred to other jurisdictions outside of the EEA, where the privacy and data protection laws may not be as protective as those in your jurisdiction. In this case, we will implement a safeguard or rely on a derogation as set out in the GDPR to validate such data transfer. In particular, together with our shareholders and certain other ORIX group companies, we have entered into the most recent EU Standard Contractual Clauses adopted by the European Commission (the “SCC”) and the UK addendum. You can obtain a copy of these safeguards by contacting us by one of the means set out at the end of this Notice.

In other cases where we share your personal data with third parties located outside of the EEA, we will only do so if (i) such transfer is to a jurisdiction in respect of which an adequacy decision has been granted by the European Commission; or (ii) the transfer of data is governed by the SCC.

HOW DO WE PROTECT YOUR PERSONAL DATA?

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorized way, altered or disclosed. In addition, we limit access to your personal data to those employees, contractors and other third parties who have a business need to know. We require that they only process your personal data on our instructions, and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any relevant supervisory authority of a breach where we are legally required to do so.

RIGHTS REGARDING OUR PROCESSING OF YOUR PERSONAL DATA

You may (i) request confirmation that we process your personal data, access to the personal data we hold about you and obtain a copy thereof, (ii) request correction of any incorrect, incomplete or obsolete data, (iii) request restriction of the processing of your personal data, (iv) request erasure of your personal data, (v) object to the processing of your data and (vi) request that a copy of your personal data be transmitted in a structured, commonly used machine-readable format, where technically feasible, to another controller, provided that you exercise the above rights within the limits of applicable law including the GDPR.

If you would like to exercise these rights or understand if these rights apply to you, please contact us by one of the means set out at the end of this Notice. Where allowed by applicable law, we may charge a reasonable fee if a request in relation to your personal data, is manifestly unfounded, excessive (in particular because of their repetitive character). We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or exercise any other of your rights). This is another appropriate measure to ensure that personal information is not disclosed to any person who has no right to receive it.

In circumstances where you may have provided consent to the processing of your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please contact us by one of the means set out at the end of this Notice. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, but this withdrawal will not affect the lawfulness of processing based on the consent before withdrawal thereof.

COMPUTER COOKIES

Computer cookies are small text files often including unique identifiers that web servers send to browsers. They are created when your browser loads a particular website, and the site sends information to your browser which then creates a text file. These cookies then can be sent back to the server each time your browser requests a new page. It is a way for a website to remember you.

Our website (www.elawan.com) is using cookies that are necessary for a user friendly experience and good functionality of our website. Although such essential cookies in principle do not require prior consent, we, however, created a cookie-consent banner to inform every website visitor through this Notice of the cookies set out below that are used by our website.

DATE AND CHANGES TO THIS NOTICE

The effective date of this Notice is the 20^th of November 2024. This Notice may be updated if developments so require. Any changes to this Notice will become effective when we post the revised Notice.

QUESTIONS OR COMPLAINTS

If you have any questions or complaints relating to this Notice, please contact us at:

Email: compliance@elawan.com

Post mail: Elawan Energy S.L.U.

Attn. Compliance Privacy matters

C/ Ombú 3, 6PL, 28045, Madrid Spain

You may lodge a complaint with your local data protection regulator. The Spanish Data Protection Agency (Agencia Española de Protección de Datos – AEPD) is available at https://www.aepd.es/.