Privacy Notice

Effective date: June 1 2026 Version number: 1.0

When visiting our website we may process your personal data. When processing personal data, we respect your privacy, including by complying with the General Data Protection Regulation (GDPR).

This notice explains when we collect personal data, what we collect, why we use it, how long we keep it, and the choices and rights you have and applies to everyone who visits our website or contacts us through our contact form.

For information about cookies, please also read our Cookie Statement.

1. Data controller

We (Zeevonk Phase 1 C.V., Zeevonk Phase 2 C.V., and Zeevonk Electrolyser, together referred to as "Zeevonk") are the controller for the processing of your personal data described in this notice.

2. Your personal data

2.1 When do we collect personal data and what data is collected?

When you visit and interact with us through this website, we may collect personal data in two ways:

1. Contact Form – If you submit an enquiry through our contact form, we will process your:
• Name
• Email address
• Your enquiry (free-text message)

We ask you not to submit personal data within the form.

1. Cookies – When you visit our website we place strictly necessary cookies and otherwise only those you choose to allow. For further information on the use of cookies, purposes, and lifetimes, see our Cookie Statement.

2.2 Purpose & Legal Basis

2.3 Retention

We store personal data for only as long as necessary for the purposes set out in this Privacy Notice. The retention of personal data may differ depending on the type of personal data and purpose for which it was collected and is set out below:

1. Contact Form Data: as long as necessary to resolve your enquiry and for three months thereafter to evidence our handling. Following this the information will be securely deleted or anonymised. Personal data used to improve our service, will be anonymised before this will be used.
2. Cookies: retained in accordance with our Cookie Statement.

2.4 Third parties

We may share your personal data with third parties when necessary. Insofar as these third parties have access to personal data for their work, we have put in place clear technical and organisational agreements to protect personal data against loss or unlawful processing.

• Service providers (processors) who host our website, provide cookie and analytics tools (where you consent), or support our contact handling.
• Companies within the Vattenfall and/or Copenhagen Infrastructure Partners group: We share your personal data with other group companies within the group when necessary.
• Advisors: including lawyers, accountants, auditors.

2.5 International transfers

If personal data is transferred outside of the European Economic Area (EEA), we ensure that appropriate safeguards are in place. This is achieved through:

• The use of the standard data protection clauses approved by the European Commission and completion of transfer assessments where required.
• Engaging with countries for which the European Commission has adopted an adequacy decision for the purpose of ensuring a level of protection comparable to the GDPR is provided.

3. Data Subject Rights

The GDPR sets out certain rights for all individuals which we have explained below.

• Right of access: You have the right to see what personal data we hold and the purpose for which we use it.

3.2 Right to rectification: You have the right to have your personal data corrected if it is incorrect or incomplete.

3.3 Right to erasure: You have the right to have your personal data deleted where:

• Your personal data is no longer necessary for the purposes for which it was collected.
• You have objected to processing for direct marketing or profiling.
• There is no longer a legitimate interest for the processing.
• Your personal data appears to have been unlawfully processed.

We may not be able to comply with your request, or may not be able to do so in full, where we have an obligation to retain personal data.

• Right to restriction: You have the right to restrict the processing of your personal data in the following situations:

• Where the accuracy of the personal data has been contested and we are verifying it at your request.

• The processing of the personal data is unlawful and you oppose the erasure of the personal data and request restriction of the use instead.

• We no longer need the personal data for the purpose of the processing but you need it for the establishment, exercise, or defence of a legal claim.
• You have objected to our processing of personal data pursuant to legitimate interest and the legal basis is being verified.

• Right to data portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to have the data transmitted to another Controller.

• Right to object: You have the right to object to the use of your personal data for the purposes of direct marketing, profiling, or legitimate interest.

To request these rights, you can contact our data protection team at dpc.ba.wind@vattenfall.com, send a letter to our postal address, or contact us through other available channels.

Because it concerns your personal data, we may need to ask you additional questions or for a secure copy of your identification to validate your identity. Tip: check the website of the Dutch government to find out how to safely provide us with a copy of your ID.

4. Security

We take the security of your personal data seriously and have taken appropriate technical and organisational measures to ensure that your data is properly secured and only processed for specific purposes. These measures include but are not limited to:

1. Regularly performing automated security scans on our website.
2. Communication via the website or e-mail is encrypted, controlled and secure.
3. Making sure that we are up-to-date with our software and technology.
4. We have many systems that communicate with each other. When we send your data from one system to another, it is done securely and in a controlled manner.
5. We protect our systems against malware, viruses, cryptoware and hacking software.
6. Our employees have different access rights. With this, we strive to ensure that only employees who need it for the performance of their job can view your data for specific purposes.

5. Questions or Complaints?

For privacy questions, complaints, or to exercise your rights, please contact us using the details on our website or via the channels indicated below. For Netherlands and Wind related privacy matters you can contact the dedicated mailbox: dpc.ba.wind@vattenfall.com (please reference “Zeevonk Phase 1 C.V.” in your message).

You also have the right to lodge a complaint with the Dutch Supervisory Authority ‘Autoriteit Persoonsgegevens (AP)’ which you can do through their website – www.autoriteitpersoonsgevens.nl

6. Changes to this notice

We may update this notice from time to time where required due to legal or operational changes. The latest version will always be available on our website.