Privacy Statement for Plug

Introduction

Your privacy matters to us.

Personal data is information that can be linked to you as an individual, such as your name and contact details, but also other information that can identify you directly or indirectly.

Plug is committed to processing personal data in a responsible and transparent manner. This Privacy Statement explains why and how we collect and process personal data, what categories of data are involved, how we safeguard your privacy, and what rights you have.

This statement applies to Plug AS and its subsidiaries.

Data Controller

Plug AS is the data controller for personal data processed in connection with our services, website, marketing activities, and business operations.

If you have entered into an agreement with a specific Plug entity, that entity will normally be the data controller for your personal data.

When do we process personal data?

Plug processes personal data in the following contexts:

• When entering into or fulfilling agreements with customers and partners
• In connection with shore power and maritime charging operations
• When managing supplier relationships
• In recruitment processes
• When you visit our website
• When you attend our events or meetings
• When you contact us by phone, email, or social media
• When required to comply with legal obligations

Legal basis for processing

We process personal data based on one of the following legal grounds:

• Your consent
• Performance of a contract
• Compliance with legal obligations
• Our legitimate interests, such as improving services or ensuring secure operations

What personal data do we process?

Contact information

Name, job title, company affiliation, address, telephone number, and email address.

Contractual data

Information required to manage agreements, including customer identifiers, invoicing information, correspondence, and service details.

Payment and financial data

Bank account details, invoicing data, payment status, and credit information where relevant.

Operational and technical data

Information related to the use of shore power and maritime charging infrastructure, including metering data, system logs, and performance data.

Website and electronic data

Information related to visits to our website, such as IP address, browser type, device information, visitor statistics, and cookies.

Plug uses cookies to improve user experience and understand how our website is used. You may adjust your browser settings to restrict cookies, but some website functionality may be limited.

Security data

Recruitment data

Information provided in job applications, including CV, certificates, references, and interview notes.

Use of data processors

Plug engages external service providers to process personal data on our behalf. All such providers are subject to data processing agreements and may only process personal data according to our instructions.

Where do we obtain personal data from?

Personal data is normally collected directly from you when you contact us, visit our website, or enter into agreements with us.

In certain cases, we may obtain data from third parties such as public registers, credit agencies, or business partners where this is necessary for contractual or legal purposes.

How do we protect your data?

We implement technical and organizational security measures to protect personal data against unauthorized access, alteration, disclosure, or destruction.

Access to personal data is restricted to employees who require it for legitimate business purposes and who are subject to confidentiality obligations.

Storage and deletion

Personal data is retained only as long as necessary to fulfill contractual purposes, comply with legal obligations, or safeguard legitimate interests.

Retention periods depend on the type of relationship and applicable regulatory requirements.

Disclosure of personal data

Plug does not disclose personal data to third parties unless:

• You have given consent
• Disclosure is required by law
• Disclosure is required by a court or public authority
• It is necessary for legitimate debt collection or contractual enforcement

Website analytics

We use analytics tools to understand how our website is used and to improve its functionality. Data collected is aggregated or pseudonymised where possible.

We may share anonymised or aggregated data with marketing partners to measure the effectiveness of marketing activities. This data is not used for individual profiling.

Your rights

Under the Norwegian Personal Data Act and the General Data Protection Regulation, you have the right to:

• Access your personal data
• Request correction of inaccurate data
• Request deletion where applicable
• Request restriction of processing
• Object to processing based on legitimate interests
• Withdraw consent
• Request data portability where applicable

Requests may be submitted using the contact details below.