Privacy to us is very important and you should be aware how we collect and use your data. This document has set out full details in this policy. Please take the time to read this policy in full and understand it.

You have complete control over your personal data processed by us and you have a genuine choice to accept or decline our requests to process your data.

Any personal information which you provide to us will only be processed when we have a legitimate business interest or lawful obligation to use this data, and provided that in doing so, your personal rights are not harmed in any way. We will only process your personal data with your consent, which we will confirm is freely given, specific, informed and unambiguous. You may withdraw your consent at any time where our right to process your personal data is based only on your

consent.

To be helpful, we’ve included some links to other websites in this policy. Please note that these websites are controlled by other people, not us, and we are not responsible for them.

This Privacy Statement has been applied on 1st September 2021 and will be applied on 17th September 2021. This statement may change over time and the most up-to- date version is published on our website. If significant changes are being made, we will actively inform you.

WHO ARE WE?

Cairn Renewables Limited is based in Scotland at East Gogar, Blairlogie, Stirling, FK9 5QB but has a registered office at 139-143 Union Street, Oldham, Lancashire, OL1 1TE and is register on companies house 10287192.

Our websites www.cairnrenewables.com and the related products, services and materials available thereon (together, the “Website“) is owned and operated by Cairn Renewables Limited, a company incorporated in Scotland but registered in England at 139-143 Union Street, Oldham, Lancashire, OL1 1TE and registered on companies house 10287192.

We are what is known as ‘data controller’ of the information you provide to us. This term is a legal phrase used to describe the person or entity who controls the way

information is used and processed. We will never willfully disclose your personal data to any third parties without your prior consent.

Cairn Renewables Ltd sells and supplies its products directly and through the Website (the “Products “) amongst other platforms.

FOR WHICH PURPOSES DO WE PROCESS YOUR PERSONAL DATA?

Cairn Renewables Ltd will process your personal data when you do business with us, when you use our websites or apps or when you interact with us.

1. For answering your questions

If you get in touch with us, we will use your personal data in order to reply and answer your question(s). When you call us, we may record the conversation for training and evaluation purposes.

For this purpose

• we process your personal data for this purpose on the basis of your consent when you provide us with your personal data or on the basis of our legitimate interest to train and evaluate our staff so that they can better help our customers.
• we process your name, contact details, your correspondence with us your question, call recording and all other personal data which are necessary to answer your question.2. For the development and improvement of products and/or servicesWe process your personal data in order to assess, analyse and improve our products and (customer) services. We use aggregated personal data to analyse customer behavior and to adjust our products and services accordingly. When you use a website or the App, enter or search data through this website or the App; we also process your personal data to compile analytics reports. We use aggregated personal data to analyse customer behavior and to adjust our products and services accordingly, to ensure that it is relevant to our customers. This means that we analyse how often you read our newsletters, how often you visit our website or Apps, which pages you click on and what goods you purchase through our website or

Apps. We may purchase supplementary data from public sources to complement our database for the above purposes.

For this purpose

• we process your information based on our legitimate interest to develop and improve our products and services.
• we process your contact details such as your address and email address, personal details such as your name and date of birth, payment and credit information, and correspondence with us. In addition, we process the personal data you entered into a website or that were generated by the functionalities you used in a website and the technical data from your device such as its IP-address, the pages you visited on our websites, your click- and surf behavior and the length of your session.
• If you choose to participate in our surveys, we may ask you to provide us with personal data, such as name, location, personal circumstances and those of your firm, family or household. We may also use the personal data that you have provided in the survey for this purpose.3. For the assessment and acceptance of a customer, supplier or business partnerWhen you get in contact with us, we will process your personal data for assessment and acceptance purposes, for example in order to confirm and verify your identity. Cairn Renewables Ltd will further process your personal data for other administrative purposes such as due diligence and screening against publicly available government and/or law enforcement agency sanctions lists.For this purpose

• we process personal data because this is necessary for the conclusion of a contract between you and us. Cairn Renewables Ltd cannot enter
  into contracts without obtaining the required information
• we process your contact details such as your address and email address, personal details such as your name and date of birth, payment and credit information and details of your correspondence with us.4. For the conclusion and execution of agreement

When you have purchased a product or service from us as a customer, or when you work together with us as a supplier or business partner, we process your personal data for administrative purposes such as sending invoices and making payments.

We also use your personal data in order to deliver or receive and administer our or your products or services. Cairn Renewables Ltd will process your personal data in order to further execute our agreement, including for the delivery of customer services. When you require access to Cairn Renewables Ltd premises, we process your personal data for screening purposes.

For this purpose

• we process personal data because this is necessary for the conclusion of a contract between you and us and to ensure compliance with environmental and health and safety laws. Cairn Renewables Ltd cannot enter
  into contracts without obtaining the required information.
• we process your contact details such as your address and email address, personal details such as your name and date of birth, payment and credit information and details of your correspondence with us, fuel usage details, fuel safety details, location of the fuel store.5. For relationship management and marketingWe use the information stored in our customer database to send you suitable offers and newsletters, as well as to provide customer services, perform account management and communicate recalls. We also use your personal data for the development, execution and analysis of market surveys and marketing strategies.For this purpose

• when sending you newsletters and/or other relationship management and marketing communications, we process personal data based on your consent. In addition, we process personal data based on our legitimate interest to improve our marketing strategies
• we process your contact details such as your address and email address, personal details such as your name, contact preferences, payment information, order history and correspondence with us.

6. For business process execution and internal management

We process your personal data in the performance and organisation of our business. This includes general management, order management and management of our assets. Cairn Renewables Ltd also processes your personal data for its internal management. We provide central processing facilities in order to work more efficiently. We conduct audits and investigations, implement business controls, and manage and use customer, supplier and business partner directories. Also, we process your personal data for finance and accounting, archiving and insurance purposes, legal and business consulting and in the context of dispute resolution.

For this purpose

• we process personal data based on our legitimate interest to maintain and improve sound business operations.
• we process your contact details such as your address and email address, personal details such as your name, payment and credit information, payment and order history, correspondence with Cairn Renewables Ltd and data generated during the performance of the agreement between youand Cairn Renewables Ltd.7. For organisational analysis and development, management reporting and acquisition and divesturesAt Cairn Renewables Ltd, we process your personal data in the preparation and performance of management reporting and analysis. We use aggregated / anonymised personal data to create management reports and to analyse our business. We conduct customer, supplier and business partner surveys to learn more about your views and opinions in preparation of our management
  reporting. We also process your personal data for management reporting purposes in the context of mergers, acquisitions and divestitures and in order to manage such transactions.For this purpose

• We process personal data based on our legitimate interest to maintain and improve sound business operations.
• we process your contact details such as address and email address, personal details such as your name and date of birth, payment and order history, correspondence with us and the information you provide when responding to our surveys.

8. When you use our websites or apps

If you use our website, we process technical data to offer you our website’s functionalities and to allow our website’s administrators to manage and improve our website’s performance as well as secure our website and underlying IT-systems and network. If you enter data in our websites, such as a product preference or your location to receive relevant information or functionalities, Cairn Renewables Ltd processes this data to provide you with the requested information or
functionalities. Further, we process your personal data to allow you to save your data (such as preferences and products) to your saved items and to allow you to share these with others using the sharing options you have configured on your device. We also register if we have obtained any consents from you for our compliance with laws

For this purpose

• we process personal data based on our legitimate interest to offer technically adequately working Websites and to improve our websites’ performance.
• we process the personal data you have entered into our websites or that is generated by the functionalities you have used in our websites and the technical data from your device such as its IP address, the internet browser you use, the pages you have visited on our websites, your click- and surf behavior and the length of your session.9. To monitor and investigate complianceWe monitor our processes to check compliance with our policies and regulations. During monitoring activities, your personal data may be accessed and viewed.For this purpose

• we may process your personal data based on our legitimate interest to monitor our internal processes and in order to comply with the law
• any personal data that is stored in our systems may be accessed and viewed for compliance purposes. The personal data that is accessed and viewed will not be stored for compliance purposes, unless we need them to further investigate potential non-compliant behavior
• we do not retain your personal data for this purpose, unless they are linked to non-compliant behavior. We will then retain the relevant personal data until the investigation or proceedings have been concluded.

10. To protect health, safety, security and to ensure integrity

At Cairn Renewables Ltd, we value your health, safety, security and integrity highly. We process your personal data in order to safeguard our employees, customers, suppliers and business partners. As such, we authenticate your access rights to our premises and may screen your personal data against publicly available government and/or law enforcement agency sanctions lists. We also process your personal data to protect Cairn Renewables Ltd and employee and customer assets. More specifically, we protect our premises by using CCTV cameras that register what happens in our property.

For this purpose

• we may process your personal data based on our legitimate interest to monitor our internal processes and the protection of society and our habitat as well as our property and in order to comply with the law including transport, environmental and health and safety laws and regulations
• we process your contact details such as your address and email address, personal details such as your name and date of birth, payment and order history, and your visiting history to our premises.11. To safely deliver our productsCairn Renewables Ltd uses vehicle technology including road facing cameras to know where its trucks are located at any given moment. Reasons for this include environmental and health and safety purposes, promoting safe driving and protecting the well-being of employees and environment, for public security and protection of property (tracking stolen trucks for malicious purposes and for efficient driving) and for efficient driving and a reduction of CO2 emission as a result from more efficient driving.For this purpose

• we may process your personal data based on our legitimate interest to monitor our internal processes and the protection of society and our habitat as well as our property and in order to comply with the law including transport, environmental and health and safety laws and regulations.
• we may process your personal data (including your image) through road facing vehicle camera imagery CCTV imagery.

12. To comply with the law

In some cases, we process your personal data to comply with laws and regulations. This could, for example, be the case where tax or business conduct related obligations apply. In order to comply with relevant laws and regulations, we may need to disclose your personal data to government institutions or supervisory authorities.

For this purpose

• we process your personal data in order to comply with the law
• we process your contact details such as your address and email address,personal details such as your name and date of birth, payment information, payment and order history, and your chamber of commerce and VAT details and tax details.13. When you participate in events or promotionsWe send you emails with promotions and invitations to participate in events. If you choose to participate in one of these activities, we need your personal data to be able to announce and organise these. In addition, if you participate in any of these activities, we need your personal data to measure the response to events and/or promotions.For this purpose

• we process personal data based on your consent. You can withdraw your consent at any time, without this affecting the lawfulness of processing based on consent before withdrawal.
• we process your name, address, email address and your entries in the relevant event.HOW DO WE USE YOUR INFORMATION?We do so in part by matching information common to the various different sources of information we have about you, to build a bigger, richer picture. So for example, if you sign up to a Cairn Renewables Ltd competition and provide your email address, and then register for an online account with us using the same email address, we link those two pieces of information together. We can achieve the same effect through matching product order transaction details and use data as well. By doing

so, we can understand you better and provide a better service to you, as described above.

We use the information we collect for many different things:

• To supply you with products and offer you supply of products;
• To supply you with safety and technical information in relation to your productpurchase;
• To answer your question(s). When you call us, we may record the conversation for training and evaluation purposes;
• To ensure the product we supply to you is delivered and properly stored;
• To provide you with our websites and mobile apps, which require acertain amount of technical information in order to work properly;
• To power security measures and related services relating to your access to our website and mobile apps for example to enable us to recognise your username and password, but also allow you to reset those if you forget
  them;
• To enable you to buy products and services from us, which again requires a certain amount of information to be collected, for example your payment card details so we can take payment and provide you with a receipt;
• To enable us to run competitions and offers for which you have signed up, about which we need to be able to communicate with you;
• To gather feedback from you about our products, websites, mobile apps, other services and activities from time to time. We may invite you to provide this feedback on occasion, for example by emailing you to ask you if you would like to review a product you have bought or a service you have used. We may use independent research and feedback providers to do so on our behalf.
• To contact you from time to time about things you have told us you want to hear about, for example our products, news, offers, new competitions and sponsored events;
• To respond to any questions, suggestions, issues or complaints you have raised with us;
• To respond to any social media posts or other public comments you make where these are made directly to or about us, our products, websites, mobile apps, services or other activities;

• To communicate with you about operational changes to our products, services, websites and mobile apps, for example if we were to withdraw one of our products, or change this privacy policy;
• To perform any purchase contract or supply agreement we have entered into with you but also to enforce a contract against you if you do not honor it, including seeking to collect any debts that we may be owed;
• To gather statistics about how you and other people use our website and mobile apps and what you think of our adverts, offers, news, product information, competitions, sponsored events, social media and other digital content. We then analyse these statistics to understand if these things appear interesting and meet most people’s needs, or if they should be improved, and if so, what design or other changes (e.g. around the nature and timing of communications) would be most beneficial both for our customers, and for our business.
• To check that you have or are likely to have the means to pay us for any products you have ordered from us;
• To monitor use of our websites and mobile apps to see if they are being abused or threatened for example by people posting inappropriate comments in review areas or by potential hackers looking to undermine their security;
• To protect you and our business against any other potential criminal behavior, including potential identity theft and fraud;
• To understand you better and in particular, your habits and use of our products, where you are from time to time, your personal circumstances and those of your firm, family or household.Our aim is to excite you as much as possible and provide great service and value to you in everything we do.By retaining information about you, we can focus on the things we think are most likely to be of real interest to you in everything we do, and especially when we send you offers, news, information on our products and details of new competitions and sponsored events or present you with adverts and content online.We can then, for example, provide you with money-off vouchers and rewards for the things you are actually buying from us, or for the product you are using, and for the things we think you might be most interested in from us in the future. We can also

tailor these to your precise location, for example if there is a promotion local to you we think you may be interested in.

• To maintain administrative and statutory records about our business to enable us to understand what products we have sold, how, when, where and at what price and account to the tax authorities for the related taxes that
  we have to pay;
• To enable us and our third-party service providers, to plan and manage our day-to-day business and related services as effectively as possible, for example in predicting likely sales volumes of any one product or geographic area, so we can try and make sure we have enough stock to meet likely demand;
• To enable us to understand what our customer and user base looks
  like across all our products and geographic areas. We do this by combining your information with information about our other customers and users of our products, websites, mobile apps, so we can spot trends and common factors amongst everyone. We can then further tailor our business approach and in particular, our marketing communications, use of digital media, products and services to the things we think you and other people like you would be most interested in. This process involves analysis of many human traits and is sometimes called “market segmentation” or “customer segmentation”. We look at common trends or “segments” based on people’s geographic location, behaviors, shopping experience, financial standing, things they do on special occasions and the benefits they look for from products, amongst other things.
• To enable us to conduct focused market research based on those trends and factors, which we can then use to further improve our products and services for all of our customers;
• In the process of anonymising your information so that you are no longer identifiable to us or our third-party service providers;
• To track your product use for the purpose of billing and planning supply, which may include telemetry, which is an automated communications process by which measurements and other data are collected and transmitted to receiving equipment in Cairn Renewables Ltd for monitoring.
• To comply with our commitment to reduce harmful emissions;

• To test new products and delivery systems and processes as we roll them out (but generally only in anonymous form) to make sure they work and will meet the high expectations we set for ourselves;
• To assist us in the development of new products and services over time, for example to gauge whether a new product is likely to be appealing to a large proportion of our customer base or not; and
• To analyse whether the money we spend on advertising, on any media and in search engines represents good value for us or not.WHO DO WE SHARE YOUR INFORMATION WITH?We cannot run our business or provide many of the services, product supply, and benefits you expect to receive without involving other people and businesses, and sometimes we pass your information to these other people and businesses as set out below.We only share your information where we can do so in accordance with our legal data protection and privacy obligations.We may share the information we collect with:

• all of our group companies, brands and business units that have relationships with our customers;
• other people and businesses who help us provide our installations, websites, mobile apps, products, and related services to you, for example, information technology companies who design and host our websites, and payment services companies who enable you to use credit or payment cards with us;
• our insurers and insurance brokers where required in order for us to be able to obtain insurance against risks we face in running our business. [They may retain this information for the purpose of ongoing risk assessment and insurance broking and underwriting services.
• credit reference agencies who provide anti-fraud and credit-insight information to us, central and local government departments, for example, banks and finance companies who also provide anti-fraud services, and customer insight companies (as set out above) in each case as necessary in order to benefit from their services. Where we do so for anti-fraud purposes, the recipient organisation may hold your information on file for the purpose of their fraud-prevention services in future.

• any new business partners we may have over time, for example a joint venture, reorganisation, business merger or sale affecting us.
• our professional advisors for example our lawyers, accountants, auditors, and technology consultants when they need it to provide advice to us.
• the Police Services, local authorities, the Courts and any other central or local government bodies where they request it and we may lawfully disclose it, for example for the prevention and detection of crime.
• other people who make a subject access request or “SAR” to us, where
  we are allowed to do so by law (see “Managing Your Information” below for what we mean by a “subject access request”).We also may share the information we collect where we are legally obliged to do so, for example e.g., to comply with a court order.Any blog, review or other posts or comments you make about us, our products and services on any of our blog, review or user community services will be shared with all other members of that service and the public at large.You should ensure any comments you make on these services, and on social media in general are fit to be read by the public, and in particular are not offensive, insulting, defamatory, or infringing upon Cairn Renewables Ltd. You are responsible for ensuring that any comments you make comply with any relevant policy on acceptable use of those services.SECURITY OF YOUR INFORMATIONMuch of the information we receive is provided in paper form, on our product supply contracts, or electronically, originating with your relevant device and then transmitted to us by your relevant telecoms network provider.Where it is within our control, we put measures in place to ensure this “in flight” data is reasonably secure.Once your information is received by us, we take its security very seriously.We use appropriate procedures and technical security measures (including strict encryption and archiving techniques) to safeguard your information across all our computer systems, networks, websites, mobile apps, offices and stores as much as possible).

We follow the Payment Card Industry’s Data Security standards (otherwise known as “PCI-DSS”).

We also use secure means to communicate with you where appropriate, such as ‘‘https’’ and other security and encryption protocols.

If you have any concerns about the security of your own personal computers and mobile devices, we suggest you read the advice of Get Safe Online, which can be accessed here. https://www.getsafeonline.org

INTERNATIONAL TRANSFER OF YOUR INFORMATION

Although we are a business based in the United Kingdom, we need to use suppliers who are of an international standing on occasion to help ensure you receive the very best in products and services from us.

To allow us to run our business on this basis, the information we collect may be transferred to, stored and used at premises in countries around the world, outside of the EEA.

Please note that information protection laws do vary from country to country. In particular, the law of the country in which you are resident or domiciled may offer a higher standard of protection than the laws of those other countries in which we store and use the information we collect.

Our transfer of information to other countries could result in that information being available to government and other authorities in those countries under their laws.

Cairn Renewables Ltd will never transfer data abroad without strict adherence to the requirements of the General Data Protection Regulation (“GDPR”) and EU law to ensure your personal data enjoys the same safeguards elsewhere as it would at home.

HOW LONG DO WE KEEP YOUR INFORMATION FOR?

In accordance with our legal data protection, marketing and privacy obligations, we will only retain your information for as long as we actually need it to achieve the purpose(s) for which we obtained it in the first place.

We will then either securely delete it or anonymise it so that it cannot be linked back to you.

See ‘How do we use your information?’ above for full details of those purposes.

MANAGING YOUR INFORMATION

You can contact us to discuss your information at any point in time using the details provided below.

It is very important to us that all the information we hold about you remains accurate and up-to-date at all times to reduce the chances of us having a misunderstanding. We try hard to make sure this is the case at all times regardless of what information we hold about you.

We need your help in doing so though. If you have any account with us or are a Cairn Renewables Ltd employee, please ensure that the information you provide to us through that account /registration (e.g. any contact information you provide) remains accurate and up-to-date. Please review and update it regularly. You have a number of rights which we respect and aim to uphold in all that we do. These rights include:

• Correcting inaccurate information. If you have reason to believe any of the information, we collect on you may be inaccurate, and you cannot correct such inaccuracy yourself through your registered accounts with us, please contact us (see below for how to do this).
• Stopping our marketing. We provide the means for you to stop all email and test (SMS or MMS) communications you receive from us – please see the ‘unsubscribe’ link and ‘STOP’ details we include in each email and text respectively. We also check all our post and telephone marketing activity against the UK mail and telephone preference services, so you can register with these services as one way of stopping any such communications from us. You can also contact us at any time using the details below and let us know what you would like us to change.
• Asking us about your information. You have the right to ask us whether we hold information about you and if so, for us to give you certain details about that information and/or the information itself. This right is commonly known as a ‘subject access request’ or SAR. Certain exemptions and conditions

apply to this right, including that it should be in writing and that you give us

reasonable details about the information you seek.

• Reviewing our use of automatic computer processing. You can ask us tohave one of our staff review a decision about you which has been taken automatically by computer. One common example is if we decline an order for product you place with us for anti-fraud or credit check reasons. Please note that these decisions can come about due to policy decisions taken by banks, card and payment processing companies, and credit reference agencies who separately hold information about you and to resolve them you may have to speak to them directly.
• Asking us to forget you. You have the “right to be forgotten” and we will erase your personal data held and processed by Cairn Renewables Ltd where we do not need to hold it for regulatory or legislative reasons.We reserve the right not to comply with any requests we receive where we may lawfully do so, for example if we reasonably believe a request to be malicious, technically very onerous, to involve disproportionate effort or harmful to the rights of others.If you have any complaints about our use of your information, please contact us. We will do our very best to resolve any complaint to your satisfaction. If, for whatever reason, you feel we do not meet the high standards we expect of ourselves, you have a right to complain to the UK Information Commissioner’s Office (or “ICO”). Please see the section “Where to go if you want more information about your privacyrights” for further details.Please don’t forget that with modern technology you increasingly have personal control over what information we and other organisations collect. For example, you can delete cookies and tracking technologies stored on your own device through your web browser, and change related settings to restrict them going forward, for example by using private browsing modes (although this can affect your browsing experience on some websites).You can also use the settings options in your mobile devices to restrict what information websites and mobile apps can access and use about you. Online advertising networks, social media platforms and search engines (for example Google) also increasingly provide you with tools to manage the data they collect about you, how it is used and shared. We encourage you to proactively look for such

functions and tools and use them to manage your privacy in a manner with which you are happy.

UPDATES TO THIS PRIVACY POLICY

We review our use of your information regularly. In doing so, we may change what we collect, how we keep it and what we will do with it.

As a result, we will need to change this policy from time to time to keep it accurate and up to date.

The effective date at the end of this document indicates the last time this policy was revised or amended.

If, following any changes, you continue to use our websites and mobile apps, contact us by telephone or otherwise provide information to us (for example through our stores or social media) we will take it that you agree to those changes.

CCTV INFORMATION

We have CCTV in operation at our operating base in Scotland as well as onboard our delivery fleet vehicles.

All CCTV footage we capture is kept separate from all of the other information we collect about you (as set out above). It is not used or shared in the manner described above either.

All CCTV footage is captured purely for your security and for the prevention and detection of crime. For further details, please see our signage at each of our premises monitored by CCTV or contact us using the details provided below.

WHERE TO GO IF YOU WANT MORE INFORMATION ABOUT YOUR PRIVACY RIGHTS

The UK Information Commissioner’s Office regulate data protection and privacy matters in the UK.

They make a lot of information available to consumers on their website. https://ico.org.uk/for-the-public/

They also make the registered details of all data controllers such as Cairn Renewables Ltd available publicly.

You can make a complaint to the ICO about our use of your information at any time. As mentioned above, please consider raising any issue or complaint you have with us first though. Your satisfaction is very important to us, and we strive to solve all problems and complaints wherever possible.

CONTACT US

If you want any further information about our use of your information, our websites or mobile apps or have any other privacy questions relating to us, we’d be happy to help you.

Our contact details are:

[email protected]
Alternatively feel free to contact [email protected] EFFECTIVE DATE:
This policy was last reviewed on 1st September 2021