Version effective as of 30 November 2023

The protection of your privacy is important to us. With this Privacy Policy we, Erdgas Ostschweiz AG (hereinafter "EGO", "we" or "us"), describe what we do with your data when you use our website www.erdgasostschweiz.ch ("website"), obtain or use our services and products, interact with us, communicate with us, or otherwise deal with us. This Privacy Policy is not necessarily a comprehensive description of our data processing. It is possible that other privacy policies, consent forms, terms and conditions or similar documents are applicable to specific circumstances.

The term "personal data" in this Privacy Policy means any information that identifies, or could reasonably be used to identify any natural person.

If you provide us with personal data of other persons (such as family members, co-workers etc.), we assume that you are authorized to do so, and that the relevant data is accurate. When you share data about others with us, you confirm that. Please make sure that these individuals have been informed about this Privacy Policy.

This Privacy Policy is aligned with the revised Swiss Data Protection Act ("DPA") and the EU General Data Protection Regulation ("GDPR"). However, the application of these laws depends on each individual case.

1. Controller

The "controller" of data processing as described in this Privacy Policy is Erdgas Ostschweiz AG, Bernerstrasse, Postfach 610, CH-8010 Zurich, unless we have informed you differently in certain cases.

You can notify us of any data protection related concerns using the following contact details: datenschutz@clutterego-ag.ch / +41 44 733 61 11

2. Collection and Processing of Personal Data

We primarily process personal data that we directly collect from our current or future customers and other business partners and persons involved (including, but not limited to, employees and auxiliary persons of customers or business partners) as part of our business relationship with them, that is sent to us in the context of application procedures or that we collect from users when they use our website and other applications. The data collected includes, in particular, master data (e.g. name, address, e-mail address, telephone number, other contact and identification data), contract data (e.g. customer number, financial data, payment details, etc.), application data (e.g. professional background, education, school degrees and certificates, other qualifications or skills and other typical information from the CV, etc.), communication data and technical data.

You are generally not obliged or required to disclose data to us. However, if you wish to enter into contracts with us or use our services, you must also provide us with certain data as part of your contractual obligation and/or in order for us to provide our services.

In addition, to the extent permitted, we also process personal data that we collect from publicly accessible sources or from authorities or other third parties. In addition to the data that you provide to us directly, the categories of data that we collect about you from third parties include, in particular, data from public registers (e.g. commercial register, land register, debt collection register, etc.), data that we receive in connection with official and court proceedings, data in connection with your professional functions and activities, data about you in correspondence and meetings with third parties, creditworthiness and other credit information, data about you that people in your environment provide to us so that we can conclude or process contracts with you or with your involvement (e.g. references for job applications, address for deliveries, powers of attorney, information on compliance with legal requirements, etc.), data from (social) media and the internet (insofar as this is appropriate in the specific case, e.g. as part of a job application or for marketing/sales etc.), your address(es) and, if applicable, interests and other socio-demographic data (for marketing) as well as data in connection with the use of the website (e.g. IP address, MAC address of the smartphone or computer, information about your device and settings, cookies, date and time of the visit, pages and content accessed, functions used, referring website, location data, etc.).

3. Purpose of Data Processing and Legal Grounds

We primarily use the data collected to provide our services as a regional natural gas supplier, to conclude and process contracts with our customers and business partners as well as to comply with our domestic and foreign legal obligations. If you work or have worked for one of our customers or business partners, you may also be affected by our data processing in this capacity.

In addition, in line with applicable law and where appropriate, we may process your personal data and personal data of third parties for the following purposes, which are in our (or, as the case may be, any third parties') legitimate interest, such as:

• providing, developing and improving our products and services as well as the website or other platforms, on which we are active;
• communication with third parties and processing of our or their requests (e.g. for job applications);
• advertising, marketing (e.g., newsletters, organizing competitions, contests or events etc.) and market research, provided that you have not objected to the use of your data for this purpose;
• exercising legal rights, asserting legal claims and defense in legal disputes and official proceedings;
• prevention and investigation of criminal offences and other misconduct (e.g., conducting internal investigations, data analysis to combat fraud etc.);
• ensuring our operation, including management of our communication systems, our IT, our website and other appliances;
• measures to ensure the safety and security of our IT, our premises and our facilities and for the protection of our employees and other persons as well as assets belonging to us or entrusted to us (e.g. video surveillance, access controls, visitor logs, network and mail scanners, telephone recordings, etc.);
• acquisition and sale of business divisions, companies or parts of companies and other corporate transactions and the transfer of personal data related thereto, as well as measures for business management and compliance with legal and regulatory obligations as well as internal regulations.

If you have given us your consent to process your personal data for certain purposes, we will process your personal data within the scope of and based on this consent, unless we have another legal basis, provided that we require one. Consent given can be withdrawn at any time, but this does not affect data processed prior to the withdrawal.

4. Cookies / Tracking and Other Techniques Regarding the Use of our Website

We typically use "cookies" and similar techniques on our website, which allow for an identification of your browser or device.

A cookie is a small text file that is sent to your computer and automatically saved by the web browser on your computer or mobile device when you visit our website. If you revisit our website, we may recognize you, even if we do not know your identity. Besides cookies that are only used during a session and deleted after your visit of the website, we may also use cookies to save user configurations and other information for a certain period of time.

The purpose of our use of cookies is, in particular, to distinguish between visitors so that we can improve the use and functionality of our website, tailor our website and services to your needs and preferences, process requests and analyze the use of our website for statistical evaluation. We do not use the collected information to create visitor profiles.

Accepting cookies is not a prerequisite for visiting our website. Most browsers are preset to accept cookies automatically. If you do not want this, you can configure your browser so that it rejects cookies, only saves them for one session or otherwise deletes them prematurely. If you block cookies, certain functions on the website (e.g. language selection) may no longer work properly.

We may also use Google Analytics or similar services on our website. These are services provided by third parties, which may be located in any country worldwide (in case of Google Analytics, it is Google LLC located in the United States; www.google.com) and which allow us to measure and evaluate the use of our website (on an anonymized basis). For this purpose, cookies set by the service provider are used. The data generated by the cookie about your use of the website (including your IP address) is transferred to a server of the service provider (in the case of Google, to the United States) and stored there. Although we assume that the data received by the service provider is not personal data, it may be possible that the service provider may be able to draw conclusions about the identity of visitors based on the data received, create personal profiles and link the data with the service provider's accounts of individuals for its own purposes. If you have registered with the service provider, the service provider will also
know your identity. In this case, the processing of your personal data by the service provider will be conducted in accordance with its data protection regulations. The service provider only provides us with data regarding the use of our website (but no personal data about you).

In addition to, or in combination with, cookies we may also use web beacons (or clear GIFs) and other similar technologies. A web beacon is typically a transparent graphic image (usually 1 pixel x 1 pixel) that is placed on a website or in an e-mail and that helps us to understand the behavior of visitors of our website. You may disable this in your browser settings or in your e-mail program.

By using our websites or agreeing to receive newsletters and other marketing e-mails, you consent to the use of the aforementioned technologies. If you do not want this, you must configure your browser or e-mail program accordingly.

5. Data Transfer and Transfer of Data Abroad

In line with the purposes of data processing mentioned under Section 3, and to the extent permitted or deemed appropriate, we may or must also transfer data to third parties (including companies affiliated with us) as part of our business activities (e.g. to provide our services, to operate our website or to respond to inquiries, etc.) in order for the recipients to process data for us or, as the case may be, their own purposes.

We particularly transfer data to the following categories of recipients (collectively the "Recipients"):

• clients, dealers, suppliers, subcontractors and other business partners;
• accountants, auditors, lawyers and other outside professional advisors of us;
• service providers and processors (e.g. payment service providers, hosting partners, call center, IT providers etc.);
• legal and regulatory authorities, upon request or for the purpose of reporting any actual or suspected breach of applicable law or regulation;
• domestic and foreign authorities, courts or other parties in possible or pending legal proceedings;
• any relevant party for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including safeguarding against the prevention of threats to public security;
• acquirers or parties interested in the acquisition of all or parts of our business or assets;
• affiliates of EGO (e.g. Open Energy Platform AG, Energie 360° AG etc.)

If we transfer data to a Recipient, the Recipient will be subject to contractual obligations to (i) only process the data in accordance with our instructions and (ii) use measures to protect the confidentiality and security of the data, together with any additional requirements under applicable law. If a Recipient is located in a country without adequate statutory data protection, we require the recipient to undertake to comply with data protection in accordance with the standards of the DPA or GDPR, unless the Recipient is subject to a legally accepted set of rules to ensure data protection or unless we can rely on an exception. An exception may apply, for example, in case of legal proceed-
ings abroad, but also in case of overriding public interests or if the performance of a contract requires disclosure, if you have consented or if data has generally been made available by you and you have not objected against the processing.

6. Retention Periods for your Personal Data

We process and retain your personal data as long as necessary for the performance of our contractual obligation and compliance with legal obligations or other purposes pursued with the processing, i.e., for the duration of the entire business relationship (from the initiation, during the performance of the contract until it is terminated) as well as beyond this duration in accordance with legal retention and documentation obligations. Personal data may be retained for the period during which claims can be asserted against us or insofar as we are otherwise legally obliged to do so or if legitimate business interests require further retention (e.g., for evidence and documentation purposes). As soon as your personal data are no longer required for the above-mentioned purposes, they will be deleted or anonymized, to the extent possible.

In addition, we will delete your data if you request us to do so and we have no legal or other obligation to retain it.

7. Data Security

We have taken appropriate technical and organizational measures designed to protect your personal data from unauthorized access, misuse, destruction, loss or alteration.

Because the internet is an open system, the transmission of information via the internet is not completely secure. Although we will implement reasonable measures to protect your personal data, we cannot guarantee the security of the data transmitted to us using the internet (including e-mail). We are not responsible or liable for the security of your data whilst in transit via the internet. Any such transmission is at your own risk and you are responsible for ensuring that any personal data that you send to us is sent securely.

8. Obligation to Provide Personal Data To Us

In the context of our business relationship you must provide us with certain personal data that is necessary for the conclusion and performance of a business relationship and the performance of our contractual obligations (as a rule, there is no statutory requirement to provide us with data). Without this information, we will usually not be able to enter into or perform a contract with you (or the entity or person you represent). In addition, the website may not be used unless certain information is disclosed to enable data traffic (e.g., IP address).

9. Profiling

We may automatically evaluate personal aspects relating to you (profiling) based on your data for the purposes set out in Section 3, where we wish to determine preference data, but also to detect misuse and security risks, to perform statistical analysis or for operational planning. If we do so, we pay attention to the proportionality and reliability of the results and take measures against misuse of these profiles or profiling. Where profiling can produce legal effects concerning you or similarly significantly affect you, we generally ensure human review.

10. Your Rights

In accordance with, and as far as provided by, applicable law you have the right of access, the right to rectification, the right to erasure, the right to restrict data processing, the right to object to our data processing (if our data processing is based on your consent) and the right to receive certain personal data in a commonly used electronic format for transmission to another body (data portability). In addition, you also have the right not to provide us with any personal data. Please note, however, that in this case we may not be able to provide you with the full benefit of our services.

If you wish to exercise the above-mentioned rights, please contact us at the address provided in Section 1. In general, exercising these rights requires that you can prove your identity (e.g., by a copy of identification documents, if your identity is not evident otherwise or can be verified in another way). If exercising certain rights will incur costs on you, we will notify you thereof in advance.

Please note that conditions, exceptions or restrictions apply to these rights under applicable data protection law and that we reserve the right to invoke or enforce such conditions, exceptions or restrictions, for example, to protect third parties or trade secrets or if we are obliged to retain or process certain data or need the data for asserting claims. Please further note that the exercise of these rights may conflict with your contractual obligations and may thus result in consequences such as premature contract termination or involve costs. If this is the case, we will inform you in advance unless it has already been contractually agreed upon.

In addition, you have the right to lodge a complaint with the competent data protection authority. The competent data protection authority of Switzerland is the Federal Data Protection and Information Commissioner.

11. Amendments of this Privacy Policy

We may amend or update this Privacy Policy at any time without prior notice. The current version published on our website applies. If the Privacy Policy is part of an agreement with you, we will notify you by e-mail or other appropriate means in case of an amend