HELIOX PRIVACY NOTICE DIGITAL PLATFORMS

HELIOXGROUP B.V. and AFFILIATES - June 2021

Dear user of Heliox Digital Platforms,

Heliox has over 30 years of Professional Power Conversion experience and is a Global Market Leader in charging infrastructure for electric buses. Our products are being used in the world’s largest opportunity DC charging projects in Europe. Our excellent R&D capabilities enable us to create and develop, together with our customers and suppliers, innovative and high quality future proof charging solutions in the most demanding markets.

Heliox has a strong focus on Compliance and Corporate Social Responsibility. We care about the impact we have on our customers, suppliers, our people, our environment and future generations to come. Part of it is personal data of the persons we are doing our business with.

Heliox (“we”, “Heliox”) and Heliox Affiliated Companies  take the protection of your personal data seriously. We are committed to process your personal data held by us in accordance with the applicable legislation and regulations for the protection of personal data.

DATA CONTROLLER

For the purpose of this Heliox Privacy Notice Digital Platforms (“Privacy Notice”), the data controller is Heliox Group B.V., with registered offices at De Waal 24, (5684 PH) Best.

Heliox Affiliated Companies may also receive and process your personal data, either in the capacity of controller or processor and this Privacy Notice applies equally to them.

Michael Colijn, CEO Heliox

We believe that taking care of people and the environment is fundamental to the success of our business.

“Affiliate” means a (legal) entity that is affiliated with, or that directly or indirectly controls, is controlled by or is under common control with, Heliox. ‘Control’ meaning ownership of 50% (fifty percent) or more of the share capital or the right to exercise 50% (fifty percent) or more of the voting rights in the appointment of the directors of such company, firm, partnership or other legal entity, but any such legal entity shall be deemed to be an Affiliate only as long as such liaison exists.

1. TYPES OF CUSTOMER PERSONAL DATA WE COLLECT

When you visit one of our websites (“Websites”) or use our (Software or other technical) Applications (“Digital Platforms”), the following types of personal data about you:

Identification data - name and last name, civil status (for salutation), gender;

Contact data - telephone number, email address and language;

Financial data - banking data, cost centre required for invoicing or payments, credit status, creditworthiness;

Other business details - login credentials, interests in Heliox products and services, subscription preferences, personal preferences, training, posts/comments/opinions on the Digital Platforms, business title or professional role, fulfilment of our contractual obligations, records relating to queries/questions/complaints/order;

Electronic identification data - information on technology use (system access and IT and Internet use), device identifier (mobile device, laptop, browser type/version, operating system used, referrer URL (the previously visited site), time and URL accessed, cookies, host name, registration and login credentials, of the computer accessing the site (IP address), time of the server request;

Criminal conviction and offences - personal data can screened based on the sanction list to the extent required for the purposes of the international obligations of Heliox (Know Your Supplier and Anti-Money Laundering obligations).

2. SOURCES OF THE PERSONAL DATA:

We automatically collect and store information transmitted to us by your browser in its server log files. We cannot attribute these data to specific individuals. These data are not amalgamated with other data sources. Furthermore, the data are deleted after statistical analysis.

Cookies

Some of the webpages use so-called cookies. Their purpose is to make our Internet presence more user-friendly, more effective and more secure. Most of the cookies we use are 'session cookies'. They are automatically deleted at the end of your visit. If you do not want cookies to be stored on your hard disk, you can adjust your browser's settings accordingly.

Personal information collected by Google Analytics

The Websites uses Google Analytics, a web analytics service provided by Google, Inc. (“Google”). Google Analytics uses “cookies”, which are text files placed on your computer, to help the website analyze how users use the site. The information generated by the cookie about your use of the website (including your IP address) will be transmitted to and stored by Google on servers in the United States. In case of activation of the IP anonymization, Google will truncate/anonymize the last octet of the IP address for Member States of the European Union as well as for other parties to the Agreement on the European Economic Area. Only in exceptional cases, the full IP address is sent to and shortened by Google servers in the USA. On behalf of the website provider Google will use this information for the purpose of evaluating your use of the website, compiling reports on website activity for website operators and providing other services relating to website activity and internet usage to the website provider. Google will not associate your IP address with any other data held by Google. You may refuse the use of cookies by selecting the appropriate settings on your browser. However, please note that if you do this, you may not be able to use the full functionality of this website. Furthermore, you can prevent Google’s collection and use of data (cookies and IP address) by downloading and installing the browser plug-in available under https://tools.google.com/dlpage/gaoptout?hl=en-GB.

You can refuse the use of Google Analytics by using the following switch. An opt-out cookie will be set on the computer, which prevents the future collection of your data when visiting this website.

OnOffx

Current status: Your data will be tracked

(send an email to marketing@heliox-energy.com to modify your current status)

Further information concerning the terms and conditions of use and data privacy can be found at http://www.google.com/analytics/terms/gb.html or at https://www.google.de/intl/en_uk/policies/. Please note that on this website, Google Analytics code is supplemented by “anonymizeIp” to ensure an anonymized collection of IP addresses (so called IP-masking).

3. PURPOSES OF THE PERSONAL DATA PROCESSING

We process your personal data:

• to understand your interests and preferences in relation to Digital Platforms;

• to register a user’s account, grant you access to and authenticate you for Heliox Applications;

• to monitor access to Digital Platforms or downloads;

• to subscribe and in the course of the subscription to follow comments, posts, articles, authors, webinars, news and updates about Heliox products and services;

• in the course of creation of and publishing media and press releases, to create brochures, news, media assets (such as images, videos), newsletters etc.;

• in order to create articles that will be published on Heliox’s internal and external Digital Platforms;

• to provide you the possibility to create your profile on Heliox Application for example to use Heliox Software;

• to be able to verify the user’s account as one of our customers.

• to allow you making posts, comments, upload content, publishing opinions on Heliox’s Digital Platforms;

• to collect your image and your personal data in the course of an event to show impressions of an event;

• to register and organize webinars;

• for other business purposes (analysing and managing our businesses, market research, audits, developing new products, improving our services and products, determining the effectiveness of our promotional campaigns, gauging customer satisfaction and providing customer services);

• as we believe necessary or appropriate (to comply with our legal obligations (e.g. to comply with economic and trade sanctions), to monitor credit status, to respond to requests from public and government authorities, to enforce our terms and conditions, to protect our operations or those of any of Heliox Affiliated Companies, to protect our rights, privacy, safety or property, and/or that of Heliox Affiliated Companies, you or others, and to allow us to pursue available remedies or limit the damages that we may sustain).

4. LEGAL BASIS OF THE PERSONAL DATA PROCESSING

The mentioned processing activities are necessary to:

(i) enter into and perform a contract with you;

(ii) to serve our legitimate business interests (e.g. by providing you with more information about our services and products, gauging customers’ satisfaction, improving our products and services); or

(iii) to comply with our legal obligations.

We will ask your consent for the activities described in this Privacy Notice when required by applicable law and the activities are not covered by one of the above mentioned legal basis for personal data processing.

If you do not want to provide us with your personal data and they are necessary for the purposes described above, we will not be able to enter into a contract with you or conduct business with you.

If you are a customer, we consider to have legitimate business interests to provide you with certain marketing information about our products and services, our promotions and events that we believe may interest you. If you are a prospect or a business lead, we provide you with certain marketing information about our products and services, our promotions and events once we have obtained your consent (opt-in).

You can easily withdraw your consent or opt-out from our e-marketing messages by clicking the “unsubscribe” link at the bottom of each marketing email.

You can also unsubscribe (opt-out) from our newsletters or change your personal preferences by contacting us at marketing@heliox-energy.com.

5. HOW WE DISCLOSE OR TRANSFER YOUR PERSONAL DATA

To the extent permissible by applicable laws and in line with this Privacy Notice, we may disclose your personal data:

to Heliox Affiliated Companies, for purposes consistent with this Privacy Notice. We take precautions to limit the access to your personal data only to those staff members who have a legitimate business need to access it in accordance with the Privacy Notice;

to our third-party services providers such as payment or invoicing processing, IT services, website hosting, order fulfilment, infrastructure provision, security, auditing services and other services, to enable them to provide their services;

to any competent law enforcement body, regulatory, government agency, court or other third party, such as without being limited to, the police authorities, the tax authorities, the social security authorities, when such transfer is necessary (i) as a matter of applicable law or regulation, (ii) to exercise, establish or defend our legal rights, (iii) to protect your vital interests or the ones of any other individual, or (iv) based on a court order;

to our auditors, advisors, legal representatives and similar agents in connection with advisory services they provide to us for legitimate purposes and in accordance for the purposes described in this Privacy Notice;

in the event that we, or any portion of our assets, are acquired, we may share all types of personal data with the acquiring company.

We do not transfer your personal data to third parties outside the EEA (European Economic Area) other than to Heliox Affiliated Companies, except in the following cases:

• you have explicitly consented to the transfer;

• the transfer is necessary for the performance of a contract between you and us or the implementation of pre-contractual measures taken at your request;

• the transfer is necessary for the conclusion or performance of a contract concluded in your interest between us and another natural or legal person;

• the transfer is necessary for important reasons of public interests;

• the transfer is necessary for the establishment, exercise or defence of legal claims;

• the transfer is necessary in order to protect your vital interest or of other persons, where the data subject is physically or legally incapable of giving consent;

• when using standard EU model clauses; or

• when authorized by the data protection authority.

We always put adequate safeguards (European Commission or Standard Contractual Clauses) and take necessary measures to protect your personal data while transferring your personal data to the third parties within or outside EU or EEA.

6. HOW WE PROTECT YOUR OF PERSONAL DATA

We take technical and organizational measures to adequately protect your personal data and to maintain its quality. We make improvements to this protection on an ongoing basis in line with technical progress. We use a range of physical, electronic and managerial measures to ensure that we keep your personal data secure.

7. HOW LONG WE KEEP YOUR PERSONAL DATA

We retain your personal information for the period necessary to fulfil the purposes mentioned above:

• as long as you remain a customer or a business stakeholder or remain using Heliox Digital Platforms; or

• as long as you want to receive this information, newsletters and other promotional or marketing information from us. If you decide to opt-out of or withdraw your consent to our newsletters and other promotional or marketing information, we will no longer use your personal data for this purpose. We may however need to keep your personal data for another purpose (e.g. to carry out our customer relationship).

• as long as the statutory limitation period to initiate a claim or legal action; or

• for a longer retention period if it is required or permitted by law (e.g. health and safety legislation, in case of a litigation).

8. HOW CAN YOU EXERCISE YOUR RIGHTS?

You have a number of rights under the applicable data protection laws.

Right to be informed - You have the right to be informed about how we process your personal data. This is the purpose of this Privacy Notice.

Right to access - You have the right to access your personal data and review your personal data.

Right to have your data erased - You have the right to have your personal data deleted.

Right to have your data corrected - You have the right to have your personal data to be corrected or updated.

The right to restrict data processing - You have the right to object or restrict processing of your personal data.

The right to data portability - You have the right to ask portability of your personal data and to receive your personal data in a structured, machine-readable format for your own purposes or to request to share it with a third party.

Right not to be subject to a decision based on an automated process - You have the right not to be subject to a decision based solely on an automated process, including profiling, which produces legal effects concerning you or similarly significantly affect you.

Right to withdraw your consent - You have the right to withdraw your consent at any time, where we rely on it to process your personal data.

The above rights may be subject to some legal conditions. To exercise any of your above rights, or if you have any questions on this Privacy Notice, please contact us at this email address: legal@heliox-energy.com.

We will take all reasonable steps to respond to your request in accordance with applicable data protection laws. When you exercise any of the above rights, we will ask you to provide us with a copy of a valid identification document (e.g. your ID card) in order to authenticate you.

You may also use the above contact details if you have any concern or wish to make a complaint to us relating to how we process your personal data.

You have also the right to complaint to your local data protection authority in your jurisdiction.

9. UPDATE TO THIS PRIVACY NOTICE

We may update this Privacy Notice from time to time. To let you know when we make changes to this Privacy Notice, we will amend the revision date at the top of the page. The new modified or amended Privacy Notice will apply from the revision date. Therefore, we encourage you to periodically review this Privacy Notice to be informed about how we are protecting your personal data.