Last Updated September, 2023

We Respect Your Privacy

ENGIE Insight Services Inc. dba ENGIE Impact and the companies comprising the ENGIE Impact business unit listed below (hereinafter “Company” or “we” or “us”), respect your privacy and are committed to protecting it through our compliance with this Privacy Policy ("Policy") which applies where we are the data controller. Where we are processing on behalf of our clients, their privacy policy applies.

Note that this Privacy Policy does not apply to the processing of Personal Information via our Careers page which is linked to an ENGIE group website. Information about the way we process the Personal Information of job applicants can be found in the Privacy Notice on our Careers page here.

This Policy describes the types of personal information we may collect from you or that you may provide when you visit or use our websites or portals (our “Websites”) and our practices for collecting, using, maintaining, protecting and disclosing your information as data controller.

This Policy applies to the personal information we collect:

• On our Websites.
• In e-mail, text or other electronic messages between you and us.
• When you subscribe to one of our communications.
• When you attend a webinar or an event hosted or sponsored by us, or where we have collected your information from you or the organizer.
• When you supply us with goods and services as an individual rather than via a company.
• From third-party sources, such as social media (Facebook, Twitter, LinkedIn), for instance when you send us instant message requests or download pieces of content about us, or providers of data collection technologies (please see our Cookie Policy for details). It only covers your personal information held by us so you need to refer to refer to the relevant third party to see how they use and protect your personal information.

Please read this Policy carefully to understand our policies and practices regarding your information and how we will treat it. This Policy may change from time to time so we encourage you to check the Policy periodically for updates.

1. General Information

Information We Collect About You And How We Collect It

We collect several types of personal information about you (“Personal Information”), including information that you provide to us and information we collect automatically via data collection technologies, as detailed below:

• Identity and contact details, such as name, postal address, e-mail address, and telephone number.
• Information that you provide by filling in forms on our Websites. This includes information provided when subscribing to our newsletters, webinars, or email notifications or when requesting further information or services.
• Correspondence with us in a personal capacity, e.g. student research, or writing to us about a job.
• Financial information such as bank account details where you are providing goods or a service.
• Photographs.
• Your responses to surveys or your opinions given through communication with us or via postings on a message board owned by us.
• Information that we obtain from cookies.
• Details of your visits to our Websites, including traffic data, location data, logs, and other communication data and the resources that you access to use on our Websites.
• Information about your computer and internet connection, including your IP address and geolocation.

Data Controller

The data controller of the ENGIE Impact website is ENGIE Insight Services Inc. dba ENGIE Impact (“ENGIE Insight”) whose registered office is at 1313 N. Atlantic Street, Suite 5000, Spokane, WA 99201.

For other activities, the data controller may vary according to the product or service. A list of our data controllers and their addresses is given at the end of this Policy.

Our lawful basis of processing is generally legitimate interest (we have a business or commercial reason for using your personal data) but for some activities (such as marketing), it may be based on consent or legal obligation. If based on consent, you may withdraw your consent for future processing at any time by simply contacting us.

How We Use Your Information

We use your information:

• To present our Websites and its contents to you.
• To provide you with information, products or services.
• To respond to your queries, exercise of rights, or complaints.
• To notify you about changes to our Websites or any other products or services we offer or provide through it.
• To allow you to participate in interactive features on our Websites.
• To improve our Websites and deliver better and more personalized services to you.
• For marketing purposes as permitted by the applicable legislation.
• For purposes of managing security, risk, and crime prevention.

For any other purpose with your consent. We also may use technologies to collect information about your online activities over time and across third-party websites or other online services (behavioral tracking). There is no personal impact: the purpose is solely to improve our services and Websites. You may reject the behavioral tracking. For more information regarding the technologies we use to automatically collect your data (including cookies) and how to manage them, please refer to our Cookie Notice.

Disclosure Of Your Information

We may disclose Personal Information that we collect, or you provide, as described in this Policy:

• To our subsidiaries and affiliates.
• To contractors, service providers, and other third parties we use to support our business (for example, to support the delivery of, provide functionality on, or help to enhance the security of our Websites) and who are bound by contractual obligations to keep Personal Information confidential.
• To our clients, for example where you or your employer are providing us with a service.
• Other members of the message board community (messages in public areas only).
• To a potential buyer or other successor in the event of a merger, divestiture, restructuring, reorganization, dissolution or other sale or transfer of some or all of our assets.
• To any competent law enforcement body, regulatory, government agency, court or other third party where we believe disclosure is necessary (i) as a matter of applicable law or regulation, or (ii) to exercise, establish or defend our legal rights.
• To any other person with your prior consent.

Data Security

We maintain physical, electronic and procedural safeguards in connection with the collection, storage and disclosure of Personal Information along with measures designed to secure your Personal Information from accidental loss and from unauthorized access, use, alteration and disclosure.

The safety and security of your information also depends on you. Where we have given you (or where you have chosen) a password for access to certain parts of our Websites, you are responsible for keeping this password confidential. We urge you to be careful about giving out information in public areas of our Websites like message boards.

Children Under The Age Of 18

Our Websites are not intended for children under 18 years of age and should not be accessed by children.

Any processing by us of the data of children under 18 years of age, for example in the context of educational visits to our offices are covered by a separate Children’s Privacy Policy.

Data Retention

We retain your Personal Information no longer than is necessary and relevant for the purpose it was collected for or as required by applicable laws. Following this, it will be securely deleted. (In some instances a limited anonymized version of information may be kept for statistical purposes. As it cannot be linked to you, it is no longer legally seen as Personal Information.)

2. Information Addressed To Californian Users

If you are a resident of California, the following additionally applies to you.

Your California Privacy Rights

We allow third parties through automated technologies to collect information related to the use of our websites for analytics purposes. At this moment, we do not have actual knowledge of any sale or sharing of personal information to third parties for their advertising purposes. If your browser is sending ”do not track” signals, we do not interact with them in any way.

In addition, we do not have actual knowledge that we sell or share the personal information of minors under 16 years of age.

California residents have certain rights regarding their personal information (subject to certain exemptions or other limitations under applicable laws). These include:

• Access – the right to request, twice in a 12-month period, disclosure of the personal information collected, used, and disclosed about you, the categories of sources from which the personal information is collected, the categories of third parties with whom the data has been shared and the specific pieces of personal information collected.
• Correction – the right to request correction of inaccurate personal information.
• Deletion – the right to request the deletion of certain personal information collected from you, subject to certain exceptions.
• Limit Use and Disclosure - the right to request limited use and disclosure of sensitive personal information collected about you to the extent required by applicable law.
• Shine the Light Request – the right to request that you be provided with a list of certain personal information that has been disclosed to third parties for their direct marketing purposes during the immediately preceding calendar year and the identity of those third parties.

The collection of geolocation data constitutes sensitive personal information.

3. Information Addressed To European Users

If you are based in Europe, the following additionally applies to you.

Transfer Of Personal Information Outside The European Union

We may transfer your Personal Information to, and process it in, countries other than the country in which you are resident, which are located outside the European Union (EU).

The legal basis of transfer in such situations are as follows:

• ENGIE Group companies – Binding Corporate Rules.
• Others – an adequacy decision from the European Commission where this exists, or Standard Contractual Clauses with appropriate additional safeguards.

For further information concerning the Standard Contractual Clauses and safeguards we have put in place, please contact us as indicated in the section "Contact Information" below.

Your Data Protection Rights

You have the following data protection rights:

• If you wish to access, correct, update, or request deletion of your Personal Information, you can do so at any time including by contacting us using the contact details at the bottom of this privacy policy.

• In addition, in certain circumstances, you can object to the processing of your Personal Information, ask us to restrict the processing of your Personal Information, or request portability of your Personal Information in a commonly used, machine-readable format. Again, you can exercise these rights by contacting us using the contact details at the bottom of this privacy policy.

• If we have collected and processed your Personal Information with your consent, then you can withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect the processing of your Personal Information conducted in reliance on lawful processing grounds other than consent.

• If you have a complaint or concern about how we are processing your Personal Information then we will endeavor to address such concern(s). If you feel we have not sufficiently addressed your complaint or concern, you may have the right to complain to a data protection authority about our collection and use of your Personal Information. For more information, please contact your local data protection authority.

We respond to all requests we receive from individuals wishing to exercise their data protection rights in accordance with applicable data protection laws.

We do not process Special Category Personal Data (also known as sensitive personal data.)

4. Information Addressed To UK Users

If you are based in the United Kingdom, the following additionally applies to you.

Transfer Of Personal Information Outside The UK

We may transfer your Personal Information to, and process it in, countries other than the country in which you are resident, which are located outside the UK ( a “restricted transfer”).

The legal basis of transfer in such situations are as follows:

• ENGIE Group companies – Binding Corporate Rules.
• Others – an adequacy decision from either the European Commission while the UK was still deemed to be part of the European Union or the Information Commissioner’s Office (“ICO”), or the UK Standard Contractual Clauses with appropriate additional safeguards.

For further information concerning UK Standard Contractual Clauses and the safeguards we have put in place, please contact us as indicated in the section "Contact Information" below.

Your Data Protection Rights

You have the following data protection rights:

• If you wish to access, correct, update, or request deletion of your Personal Information, you can do so at any time including by contacting us using the contact details at the bottom of this privacy policy.
• In addition, in certain circumstances, you can object to the processing of your Personal Information, ask us to restrict the processing of your Personal Information, or request portability of your Personal Information in a commonly used, machine-readable format. Again, you can exercise these rights by contacting us using the contact details at the bottom of this privacy policy.
• If we have collected and processed your Personal Information with your consent, then you can withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect the processing of your Personal Information conducted in reliance on lawful processing grounds other than consent.
• If you have a complaint or concern about how we are processing your Personal Information then we will endeavor to address such concern(s). If you feel we have not sufficiently addressed your complaint or concern, you may have the right to complain to the ICO about our collection and use of your Personal Information.

We respond to all requests we receive from individuals wishing to exercise their data protection rights in accordance with applicable data protection laws.

We do not process Special Category Personal Data (also known as sensitive personal data.)

5. Contact Information

To ask questions or comment about this Privacy Policy and our privacy, contact us at privacy.impact@engie.com.