Privacy

Pandell Privacy Notice

Introduction

This Privacy Notice explains how ESG Global (Energy) Ltd, Cubs, Pandell, WhiteStar and our affiliated companies ("we," "our," or "us") collect, use, and protect personal information obtained through our website. We are committed to complying with global privacy laws, including the General Data Protection Regulation (GDPR), UK Data Protection Act 2018, California Consumer Privacy Act (CCPA/CPRA), Virginia Consumer Data Protection Act (VCDPA), Colorado Privacy Act (CPA), Connecticut Data Privacy Act (CTDPA), Utah Consumer Privacy Act (UCPA), Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA), Brazil’s Lei Geral de Proteção de Dados (LGPD), and, where applicable, China’s Personal Information Protection Law (PIPL).

Scope

This Privacy Notice applies to users in Canada, the United States (including California, Virginia, Colorado, Connecticut, Utah), the United Kingdom, the European Union, Brazil, China, and other jurisdictions where local privacy laws require notice and rights.

1. Information We Collect

We may collect the following types of personal information:

• Cookies and Tracking Data: We use cookies to enhance user experience. Non-essential cookies will only be activated with your consent or the relevant opt-out mechanism, depending on your jurisdiction.
• Business Contact Information: Your name, email address, phone number, and job title when provided via forms or inquiries.
• Usage Data: IP addresses, browser types, operating systems, and browsing behaviour on our website.
• Transaction Data: If purchases are made: billing information, credit card details, employee numbers and annual revenue (optional).
• Sensitive Data: As defined under applicable laws (e.g., precise geolocation, biometric, sensitive identifiers) when strictly necessary and with additional consent or opt-out per legal requirements (e.g., CPRA, VCDPA, LGPD, PIPL).
• Other data as required for legal compliance in your jurisdiction.

2. How We Use Your Information

We use your information for:

• Providing and improving our services
• Responding to inquiries or requests
• Complying with legal obligations (e.g., GDPR Article 6(1)(c), CPRA, LGPD)
• Marketing purposes (only with explicit consent or opt-in/opt-out, as required)
• Fulfilling requests for data access, deletion, correction, portability, restriction, objection, or appeals, as required under applicable privacy laws

See our separate Marketing Privacy Notices as applicable.

3. Cookies Policy

• Essential Cookies: Necessary for website functionality. These do not require consent.
• Non-Essential Cookies: Used for analytics and advertising purposes.
• • Consent or opt-out is required before activation, according to applicable law
• Cookie preferences are managed via our cookie banner, browser settings, or Global Privacy Control (GPC) signals, as supported.
• EU/UK/Brazil/China users: Non-essential cookies require opt-in consent.
• Canadian users: Implied consent unless cookies are disabled in browser settings.
• U.S. users (California, Virginia, Colorado, Connecticut, Utah): You have the right to opt out from non-essential cookies and targeted advertising.

4. Your Rights

Depending on your location, you have the following rights:

• EU/UK Residents: Right to access, rectify, erase, restrict processing, data portability, object to processing, withdraw consent, and lodge complaints with supervisory authorities.
• California Residents (CPRA): Right to access, correct, delete personal data; opt out of selling/sharing data; restrict use of sensitive data; non-discrimination; appeal if a request is denied.
• Virginia, Colorado, Connecticut, Utah Residents: Right to access, correct, delete personal data; opt out of targeted advertising, sale, or profiling; appeal if denied.
• Canadian Residents: Right to access, correct personal data, withdraw consent.
• Brazilian Residents (LGPD): Right to confirm, access, correct, anonymize, block, delete, port, revoke consent, oppose processing, and lodge complaints.
• Chinese Residents (PIPL): Right to access, copy, correct, withdraw consent, restrict, delete, data portability, and complain to authorities.

To exercise your rights, please contact us at DPO@esgglobal.com. We support verifiable consumer requests and appeal processes for all jurisdictions requiring them.

5. Data Sharing

We do not sell your personal data. We may share information with:

• Service providers assisting us in operating the website and providing services
• Legal authorities or regulators, if required by law
• Affiliated companies
• Third parties, only as permitted or required under applicable law, with contractual safeguards for cross-border transfers (e.g., SCCs, adequacy decisions, or equivalent under LGPD/PIPL)

6. International Data Transfers

Personal data may be transferred to and processed in countries outside your residence. We implement adequate safeguards—including Standard Contractual Clauses, adequacy decisions, data transfer agreements, or other mechanisms—to ensure lawful international transfers in compliance with GDPR, UK DPA, LGPD, PIPL, and relevant U.S. state laws.

7. Data Retention

We retain personal data only as long as necessary for the purposes stated in this notice, or as required by law or regulation. Data retention periods reflect the requirements of GDPR, CPRA, LGPD, PIPEDA, and other applicable laws.

8. Contact Information

For any privacy questions or to exercise your rights:

• Email: DPO@esgglobal.com
• Data Protection Officer: Paul Etherington DPO@esgglobal.com

9. Updates to This Privacy Notice

We may update this Privacy Notice periodically. Changes will be posted here with the updated "Last Updated" date.

Last Updated: Oct 31, 2025