Privacy Policy

Your privacy is important to Voltalia SA, and we are committed to treating your Personal Information lawfully, fairly and transparently. This Privacy Policy discloses the privacy practices of Voltalia Group and its subsidiaries with respect to the collection, use, retention or other processing of personal data in connection to its websites, mobile applications, email contacts or forms.

Introduction

You will find below the entirety of our privacy policy (“the Policy”) in accordance with the requirements of the various regulations relating to the protection of personal data including but not limited to the European Regulation 2016/679 (“the GDPR”), as well as any legislation adopted pursuant to this regulation or the Lei Geral de Proteção de Dados no. 13.709/2018 in Brazil The terms “we”, “us” or “our” used in this document refer to Voltalia Group and its affiliates, and “you”, “your” and “yours” refer to the User of the Site. Through this policy Voltalia commits to:

1. Respect your privacy and your choices.

2. To ensure that all issues relating to privacy and security are central to our activities.

3. Collaborate only with partners who share our values.

4. Respect your rights to fulfil your requests to the extent possible.

Voltalia remains at your disposal for any questions regarding your Personal Data.

Scope of the policy

This Policy provides information on:

• The types of personal data Voltalia Group may collect about you (e.g., your contact information);

• How personal data is collected;

• The purposes and legal basis for processing your personal data (e.g. to comply with the law, for marketing purposes with your consent);

• Your rights and choices regarding your personal data;

• How to contact us.

Responsible for the treatment

Voltalia is responsible for the processing of Personal Data and you can contact us at the following address: privacy@voltalia.com

In this respect, Voltalia is responsible for determining the purposes and means of processing Personal Data.

Voltalia undertakes to protect the Personal Data collected, not to transmit them to third parties without the User’s knowledge and to respect the purposes for which this data has been collected.

Furthermore, Voltalia undertakes to notify the User in case of rectification or deletion of the data, unless this would entail disproportionate formalities, costs and steps for Voltalia.

If the integrity, confidentiality or security of the User’s Personal Data is compromised, Voltalia undertakes to inform the User by any means.

Personal data collected and processed by Voltalia

Personal data means any information relating to an identified or identifiable natural person; an identifiable person is one who can be identified, directly or indirectly, by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity.

Voltalia processes the following personal data:

• Personal and business contact information, such as name, last name, gender, mailing address, email address, telephone number

• Profile information such as User ID, login and password, profile picture, university, degree, certification and courses taken, type of organization (company, school, etc.), name, size, department, industry

• Transaction information, such as bank account or credit card information and tax reference number

Please note that we may collect your Personal Information

directly:

• When you contact Voltalia through the website, by phone, email, newsletter

• When filling out the fields in the career section (“Careers”)

or indirectly:

• When Voltalia collects data using cookies to obtain information that is used only to produce anonymous statistics, which does not track your browsing on other sites or for more precise location data than country information only for the purpose of identifying the browser language.

The Site contains links to social networks such as LinkedIn, Instagram, Twitter, Facebook and YouTube. Voltalia shall not be held responsible, directly or indirectly, for the data they collect.

We encourage you to get information on their own privacy and data protection policies.

Use of cookies

Cookies are small files deposited on the hard drive of a visitor’s computer when he visits a site. They are randomly assigned in alphanumeric characters that constitute a kind of identification of a visitor, allowing the site manager to know that this visitor has already navigated on the site and to follow up the frequency rate of his visits as well as his preferences. These cookies may also be used to keep you logged in, remember your preferences, and provide you with relevant local information. Voltalia uses cookies on this website. To learn more, consult the cookie policy (“Cookies Policy”).

Why is your data processed by Voltalia?

In accordance with the requirements of regulations on of Personal Data protection, Voltalia relies on at least one of the following legal basis to process your data:

❖ The User has expressly consented to the processing for instance, for the purpose of receiving marketing e-mails, newsletters and news about our business, online campaigns, Leads generation;

❖ The processing is necessary for the proper performance of a contract and pre-contractual diligence;

❖ The processing responds to a legal obligation;

❖ The processing is necessary to pursue Voltalia’s legitimate interests such as the recruitment process, the operation and optimization of the website, the management of the User’s account and for online support, the processing of User requests through the contact form, sales statistics, follow-up contacts by phone or e-mail, after-sales support.

Data security

The Personal Data that we collect, and that we have subsequently obtained, is intended for us in our capacity as data controller. We make sure that only authorized persons have access to this data.

We maintain reasonable standards of physical, technical and administrative security to protect your data from loss, unauthorized access, misuse, alteration, destruction or damage. However, despite Voltalia’s efforts to protect your personal data, Voltalia cannot guarantee the infallibility of this protection against any data leakage due to risks associated with the Internet. It is important that you exercise caution to prevent unauthorized access to your personal information. You are responsible for maintaining the confidentiality of your password and account information. Therefore, you should be sure to log off when using a shared computer.

Recipient of data and transfer to third parties

Voltalia may communicate your Personal Data to employees of the Group and/or to duly authorized service providers and subcontractors, for example subcontractors involved in a subscription process and/or during the commercial relationship.

The Personal Data is communicated for the sole purpose of achieving the purpose for which it is collected, in accordance with this Policy.

Subject to your express prior consent, we may also pass on your personal data to business partners, who may use them for their own purposes, for commercial purposes and/or direct advertising.

Finally, Voltalia may also be legally or legally obliged to disclose your Personal Data to the competent authorities. This is the case in the event of a legal dispute or an order from a public authority.

How long do we keep your data?

✓ Regarding the data communicated in the sections “Contacts, Newsletter, Voltalia Dashboard”:

We will not keep your personal data longer than is necessary for the purposes for which it is processed.

✓ Regarding the data provided in the “Careers” section:

Our approach is to retain candidate data for a period of two years after the last contact with us in order to be able to consider you for future employment opportunities, unless you expressly object. Voltalia will provide you with the appropriate policy in this regard.

✓ Concerning the registration of online requests, sales statistics, commercial communications, follow-up contacts by phone or e-mail, after-sales support:

We will retain your personal data for as long as is necessary for the purpose for which it is processed or until you notify Voltalia that you do not consent to the use of your data for this purpose.

In general, we will not keep your personal data longer than is necessary for the purposes for which it is processed.

When the data is no longer needed, it is permanently deleted or crypted, unless its retention is legally required.

Your rights

In accordance with regulations concerning the processing of Personal Data, the User has the rights listed below. For the data controller to comply with the request, the User must provide the following information: name, surname and e-mail address.

The data controller is obliged to respond to the User within a maximum of 30 (thirty) days.

➢ Rights of access, rectification and deletion

The User may view, update, modify or request the deletion of data concerning him/her/them, by following the procedure set out below:

The User must send an email to the following address: privacy@voltalia.com specifying the reason for the request.

➢ Right to data portability

The User has the right to request the portability of their personal data, held by the site, to another site, by complying with the procedure below. The User must send an e-mail to the following address: privacy@Voltalia.com for request.

➢ Right to limit and object to the processing of data

The User has the right to request the limitation of, or to oppose the processing of his/her/their data by the Site, without the Site being able to refuse, unless it can demonstrate the existence of legitimate and compelling reasons, which can prevail over the interests and rights and freedoms of the User.

In order to request the limitation of the processing of his/her/their data or to formulate an objection to the processing of his/her/their data, the User must follow these steps:

The User will send an email to privacy@voltalia.com for request.

➢ Right not to be subjected to a decision based exclusively on an automated process

The User has the right not to be subject to a decision based exclusively on an automated process if the decision produces legal effects concerning him/her/them, or significantly affects him/her/them in a similar way.

➢ Right to refer to the competent supervisory authority

If the data controller decides not to respond to the User’s request, and the User wishes to contest this decision, or if he/she believes that one of the rights listed above has been infringed, he/she is entitled to refer the matter to the competent National Authority.

You can contact the French National Authority (CNIL) for more information and to file complaint if necessary:

You can contact the Information Commissioner’s Office (ICO) for more information and to file a complaint if necessary:

You can contact the Brazilian National Authority (ANPD) for more information and to file complaint if necessary:

You can contact the Portuguese National Authority (CNPD) and file a complaint at:

CNPD

Update of the Privacy Policy

Voltalia reserves the right to modify this policy to ensure its compliance with applicable legislation and regulations.

Therefore, the User is invited to consult this Privacy Policy regularly to be informed of the latest changes.

Any changes to this Policy will be effective upon Voltalia’s publication of the new terms and/or upon implementation of the new changes on the website.