PRIVACY POLICY

This is version 4, which was last updated the 19.12.2022

1. Introduction
1.1 This Data Protection and Privacy Policy (the “Policy”) describes how Norlys Energy
Trading A/S (“us”, ”we” or ”our”) collects and processes personal data relating to the
purchase of services, membership, products or general use of our website.
1.2 The Policy is prepared and made available to comply with the General Data Protection
Regulation (2016/679 of 27 April 2016) (the ”GDPR”) and the rules included herein on
information to be provided to you.

2. Collecting personal data with cookies
2.1 By visiting and using our website(s), cookies are collected and used on the basis of
consent. Information in these cookies include (hereinafter “Cookiedata”):
a) IP address
We use cookies to see which sites our users visit and when – and which sites they visit
before visiting ours. We use these data to understand how users as a total group
navigate on our websites. The information is used as general statistics and cannot be
linked to individuals. The tool we use for web statistics is Google Analytics.
2.2 Cookiedata is used improvement of the website(s) and the user experience .
2.3 Our use of cookies for the purpose of collecting personal data is being carried out in
accordance with the Cookie Order (No. 1148 of 9 December 2011), section 3.
2.4 If you wish to limit or decline the cookies placed on your computer when visiting our
website you can do so at any time by changing your browser settings. However, you
should be aware that if you decline or reject cookies it will impact the functionality of
the website which means that there are features on the website that you will not be
able to see. Any browser allows you to delete cookies collectively or individually. How
this is done depends on the used browser. Remember to delete the cookies in all
browsers, if you use several different browsers.
2.5 Below you will see an overview of the duration of the cookies we use:
The information is stored in the period that is allowed according to the law, and we
delete them, when they are no longer necessary. The period depends on the character
of the information and why the cookies were stored. It is therefore not possible to give
a general time frame.

3. Types of personal data processed
3.1 We process personal data about you when this is necessary and in accordance with
the applicable legislation. Depending on the specific circumstances, the processed
personal data include the following types of personal data:
a) IP addresses
b) Google data
c) name
d) email
3.2 If we need to collect more personal data than specified above, we will inform about
this. Such information will be provided by updating this Policy.

4. Purposes for processing the personal data
4.1 The personal data we collect about you is processed for the following purposes:
a) To improve our products, services or website.
If you choose to send us a message using the contact form at our webpage, your
name, email and content will be stored in our mail system and will be deleted when it
is no longer necessary to store the information.

5. Legal basis for processing personal data
5.1 We only process your personal data when we have a legal basis to do so in accordance
with the GDPR. Depending on the specific circumstances, the processing of personal
data is done on the following legal basis:
a) The processing is necessary for the purposes of the legitimate interests where
such interests are not overridden by the interests or fundamental rights and
freedoms of the data subject which require protection of personal data, cf. the
GDPR, article 6(1)(f).

6. Disclosure and transfer of personal data
6.1 We only pass on personal data to others when the law allows it or requires it, including
when relevant and asked to do so by you or a data controller when applicable.

7. Erasure and retention of personal data
7.1 We ensure that the personal data is deleted when it is no longer relevant for the
processing purposes as described above. We also retain personal data to the extent
that it is an obligation from applicable law, as is the case with for example accounting
and bookkeeping materials and records. If you have any questions about our retention
of personal data, please contact the email mentioned in the last section of this Policy.

8. Data subject rights
8.1 As a data subject under GDPR, you have a number of rights.

8.1.1 You have the right to request access to the personal data we process about you,
the purposes we process the personal data, and whether we disclose or transfer
your personal data to others.
8.1.2 You have the right to have incorrect information rectified.
8.1.3 You have the right to have certain personal data deleted.
8.1.4 You may have the right to restriction of our processing of your personal data.
8.1.5 You may have the right to object to our processing of your personal data based
on reasons and circumstances that pertain to your situation.
8.1.6 You have the right not to be subject to a decision based solely on automated
means, without human interference unless the decision is necessary for your
employment, the decision has a legal basis, or is based on your explicit consent.
8.1.7 If the processing of your personal data is based on your consent, you are
entitled to withdraw such consent at any time. Withdrawal of your consent will
not affect the lawfulness of the processing carried out prior to your revocation
of consent.
8.1.8 You are entitled to receive personal data which you have provided to us in a
structured, commonly used, and machine-readable format (data portability).
8.1.9 You can always lodge a complaint with the data protection agency.
8.2 Your rights may be subject to conditions or restrictions. Accordingly, there is no
certainty that you will be entitled to for example data portability in the specific
situation; it will depend on the circumstances of the processing.
8.3 More information about data subject rights can be found in the guidelines of the
national data protection authorities.
8.4 Please use you the contact details below if you want to use your rights.
8.5 We try to meet your wishes about our processing of personal data, but you can always
file a complaint to the data protection authorities.

9. Changes to this Policy
9.1 We reserve the right to update and amend this Policy. If we do, we correct the date
and the version at the bottom of this Policy. In case of significant changes, we will
provide notification in the form of a visible notice, for example on our website or by
direct message.

10. Contact
10.1 You may contact us at the below specified email if you:
• disagree with our processing or consider our processingof your personal data
infringeson the law,
• havequestions or comments to this Policy, or
• want toinvoke one or more of your rights as a data subject described in this Policy.

If you have questions or comments to this Policy or if you would like to invoke one or
more data subject rights, please contact us at Phone: +45 72 46 46 46, email:
info@norlysenergytrading.com