UK PRIVACY NOTICE SUPPLEMENT

Version 1.0 · Effective 2 November 2026

1. About this supplement

This supplement explains how ECOFACTOR TECH UK LIMITED (“ECOFACTOR UK”, “we”, “us”) collects and uses personal data about individuals we deal with in the United Kingdom. It is provided under Articles 13 and 14 of the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018.

It applies to:

• representatives and contact persons of our UK customers and prospective customers;
• contacts at local authorities and other public bodies, including in connection with public procurement and tenders;
• owners, occupiers and representatives of sites in the UK where charging equipment is or may be installed (“site hosts”);
• contacts at our UK suppliers, accredited delivery partners and their subcontractors;
• other individuals who contact ECOFACTOR UK about our UK activities.

Relationship with the website Privacy Policy. The website ecofactortech.com is operated by ECOFACTOR Sp. z o.o. (Poland), which is the controller for personal data collected through the English and Polish versions of the website, including website forms, cookies and analytics. Its Privacy Policy (https://ecofactortech.com/legal/privacy/) and Cookie Policy (https://ecofactortech.com/legal/cookies/) explain that processing. ECOFACTOR UK also acts as the representative of ECOFACTOR Sp. z o.o. in the United Kingdom under Article 27 UK GDPR for that website processing, so UK visitors can contact us about it at the address below. This supplement covers what ECOFACTOR UK does with personal data, including enquiries about the UK that are passed to us from the website. Where this supplement and the website Privacy Policy differ on processing carried out by ECOFACTOR UK, this supplement applies.

What this supplement does not cover. The ECOFACTOR mobile app has its own privacy notice, available in the app. Our own employees and job applicants receive separate privacy information.

2. Who we are and how to contact us

The controller of your personal data is:

Item	Details
Controller	ECOFACTOR TECH UK LIMITED
Registered in	England and Wales, company number 16400124
Registered office	86-90 Paul Street, 3rd Floor, London EC2A 4NE, United Kingdom
Data protection contact	info@ecofactor.eu

We have not appointed a data protection officer, as we are not required to do so under Article 37 UK GDPR: our core activities do not involve large-scale regular and systematic monitoring of individuals or large-scale processing of special category or criminal offence data. Questions about this supplement or requests to exercise your rights can be sent to the contact above.

3. Personal data we use

Who you are	Personal data we may use
Customer or prospect contact	Name, job title, employer, business email, telephone number, business address, communications with us, meeting notes, preferences about marketing
Public-sector or tender contact	Name, role, contracting authority, contact details, procurement correspondence and clarification questions, meeting and site-visit records, contract management records
Site host	Name, contact details, property address and details, ownership or occupation information, information from title documents, terms of any lease, licence or wayleave, payment and bank details for payments due to you, correspondence
Supplier, delivery partner or subcontractor contact	Name, role, employer, contact details, qualifications, accreditations and certifications relevant to the work, site attendance records, due diligence information (such as sanctions screening results), payment details for sole traders
Any person who contacts us	Name, contact details, content of your message and our reply

We do not seek to collect special category data (such as health data) about the individuals covered by this supplement. If due diligence or procurement rules require us to process information about criminal convictions or offences (for example, supplier screening), we will do so only where permitted by section 10 and Schedule 1 of the Data Protection Act 2018. We do not currently carry out criminal record checks on suppliers or their staff.

4. Where we get personal data

We collect personal data directly from you, and also from:

• your employer or the organisation you represent;
• ECOFACTOR Sp. z o.o., when you contact ECOFACTOR through the website about the UK;
• public procurement portals and notices (such as the Find a Tender service and Contracts Finder) and contracting authorities;
• public registers, such as Companies House and HM Land Registry;
• our accredited delivery partners;
• public sanctions lists and other public sources used for due diligence;
• professional networking sites and events, where you have made your business details available.

5. Why we use personal data and our lawful bases

Purpose	Lawful basis under Article 6(1) UK GDPR
Responding to enquiries and preparing proposals	Steps at your request before entering into a contract (Art. 6(1)(b)) where you are the contracting party; otherwise our legitimate interests in responding to business enquiries (Art. 6(1)(f))
Taking part in public procurement: reviewing notices, asking clarification questions, preparing and submitting bids, communicating with contracting authorities, and managing awarded contracts	Our legitimate interests in competing for and performing public contracts (Art. 6(1)(f)); compliance with legal obligations that apply to suppliers in procurement, including under the Procurement Act 2023 (Art. 6(1)(c))
Performing contracts with UK customers: planning, delivery, installation, commissioning, maintenance, warranty, support and invoicing	Performance of a contract (Art. 6(1)(b)) where you are the contracting party; otherwise our legitimate interests in performing contracts with your organisation (Art. 6(1)(f))
Finding and assessing sites, agreeing and managing leases, licences or wayleaves, arranging grid connections and making payments to site hosts	Performance of a contract or pre-contract steps (Art. 6(1)(b)); our legitimate interests in developing our charging infrastructure (Art. 6(1)(f))
Selecting and managing suppliers and delivery partners, including due diligence on anti-bribery, sanctions, modern slavery and health and safety	Performance of a contract (Art. 6(1)(b)); legal obligations (Art. 6(1)(c)); our legitimate interests in a compliant and safe supply chain (Art. 6(1)(f))
Sending business news and information about our products and services	Our legitimate interests in promoting our business (Art. 6(1)(f)), or your consent (Art. 6(1)(a)) where the Privacy and Electronic Communications Regulations 2003 require it (see section 6)
Keeping accounting and tax records, and responding to lawful requests from public authorities	Legal obligations (Art. 6(1)(c))
Establishing, exercising or defending legal claims	Our legitimate interests (Art. 6(1)(f))
Sharing information within the ECOFACTOR group for administration, reporting and project delivery	Our legitimate interests in running the business of the companies operating under the ECOFACTOR brand efficiently (Art. 6(1)(f))

Where we rely on legitimate interests, we have balanced our interests against your rights and freedoms. You can ask us for more information about this balancing. Where we rely on consent, you can withdraw it at any time; this does not affect processing carried out before withdrawal.

Providing personal data is generally voluntary, but if you do not provide information we need to enter into or perform a contract, or that procurement rules require, we may not be able to work with you or your organisation.

6. Direct marketing

We send electronic marketing in line with the Privacy and Electronic Communications Regulations 2003 (“PECR”):

• Corporate subscribers. We may send marketing emails to individuals at companies, limited liability partnerships, public bodies and other corporate bodies at their business email address without prior consent, based on our legitimate interests. Every message identifies us and includes a simple way to opt out.
• Individual subscribers. For sole traders and some partnerships, we send marketing emails only with consent, or where you obtained a product or service (or negotiated for one) from us, the message concerns our similar products or services, and you were given a simple opportunity to opt out when your details were collected and in every message (regulation 22 PECR, the “soft opt-in”).
• Telephone. We do not make marketing calls to numbers registered with the Telephone Preference Service or the Corporate Telephone Preference Service unless you have told us you do not object to our calls.

You can object to direct marketing at any time, free of charge, by using the unsubscribe link or writing to info@ecofactor.eu. We will then stop. We keep a suppression record so that we do not contact you again.

7. Who we share personal data with

We share personal data only where necessary for the purposes above, with:

• other companies operating under the ECOFACTOR brand: ECOFACTOR Sp. z o.o. (Poland), as website operator and hardware supplier, and ТОВ «ЗАРЯДНІ МЕРЕЖІ» (Ukraine), for technical support, software development and support of the ECOFACTOR charge point management system;
• our accredited delivery partners and their subcontractors, for installation, maintenance and site works;
• contracting authorities and other customers, as part of bids and contract delivery;
• distribution network operators and other utilities, for grid connection applications;
• service providers acting on our behalf, such as IT, cloud hosting, email (Microsoft 365) and CRM providers;
• professional advisers, auditors, insurers and banks;
• HM Revenue & Customs, Companies House, regulators, courts, the police and other public authorities, where required by law;
• a prospective buyer or investor, under confidentiality obligations, if all or part of our business is sold or restructured.

Service providers that process personal data on our behalf act under a written contract as required by Article 28 UK GDPR.

Information given to public bodies. Public authorities are subject to the Freedom of Information Act 2000, the Environmental Information Regulations 2004 and, in Scotland, the Freedom of Information (Scotland) Act 2002. Information we include in bids or provide under public contracts, including names of personnel, may be disclosed by the authority under those laws, subject to the exemptions they contain.

8. International transfers

Some recipients are located outside the United Kingdom:

• EEA. Transfers to ECOFACTOR Sp. z o.o. in Poland and to other recipients in the European Economic Area are permitted under the UK adequacy regulations that apply to the EEA.
• Ukraine. Ukraine is not covered by UK adequacy regulations. Before personal data is transferred to ТОВ «ЗАРЯДНІ МЕРЕЖІ» or any other recipient in Ukraine, we put in place the International Data Transfer Agreement (IDTA) or the International Data Transfer Addendum to the EU Standard Contractual Clauses issued by the Information Commissioner, and carry out a transfer risk assessment.
• Other countries. Where a service provider processes personal data in another country (for example the United States), we rely on UK adequacy regulations where they apply (including the UK Extension to the EU-US Data Privacy Framework for certified US organisations) or on the IDTA or the Addendum. Our main providers in this category are Microsoft, Google and Cloudflare.

You can request a copy of the relevant safeguards by writing to info@ecofactor.eu. Commercially sensitive terms may be removed.

9. How long we keep personal data

Category	Retention period
Enquiries and prospect records that do not lead to a contract	3 years after the last contact
Marketing preferences and opt-out (suppression) records	As long as needed to respect your choice
Tender records where we are not awarded the contract	3 years after the procurement ends
Customer, supplier and delivery-partner contract records	Term of the contract plus 6 years, reflecting the limitation period under the Limitation Act 1980
Leases, licences, wayleaves and other agreements executed as a deed	Term of the agreement plus 12 years, reflecting the limitation period under the Limitation Act 1980
Accounting and tax records	At least 6 years, to meet HM Revenue & Customs requirements
Records relating to legal claims	Until the claim is finally resolved and any appeal period has ended

After these periods we delete or anonymise personal data, unless the law requires us to keep it longer.

10. Security

We use appropriate technical and organisational measures to protect personal data, including access controls, encryption where appropriate and confidentiality obligations on staff and service providers, and limiting access to personal data to those who need it.

11. Your rights

Under the UK GDPR you have the right to:

• access your personal data and receive a copy (Article 15);
• have inaccurate data corrected (Article 16);
• have your data erased in certain circumstances (Article 17);
• restrict our processing in certain circumstances (Article 18);
• receive data you provided to us in a portable format, where processing is based on consent or contract and is automated (Article 20);
• object to processing based on our legitimate interests, and object at any time to direct marketing (Article 21);
• withdraw consent at any time, where we rely on consent.

We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.

To exercise your rights, write to info@ecofactor.eu or to our registered office. We may need to verify your identity. We respond within one month, which may be extended by up to two further months for complex or numerous requests; if so, we will tell you why. Exercising your rights is free of charge, except where a request is manifestly unfounded or excessive.

12. Complaints

If you are unhappy with how we have used your personal data, please contact us first at info@ecofactor.eu so that we can try to resolve your concern.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator:

• website: ico.org.uk
• telephone: 0303 123 1113
• post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

13. Changes to this supplement

We may update this supplement from time to time. The current version and its effective date are shown on this page. Where changes are significant, we will take reasonable steps to tell individuals we are in contact with.

Document control

Version	Date	Owner	Approved by
1.0	2 November 2026	Director, ECOFACTOR TECH UK LIMITED	Board of directors of ECOFACTOR TECH UK LIMITED (written resolution)