PRIVACY POLICY

Alchemy Utilities Limited Privacy Statement – Last updated on May 17, 2018

Introduction

When it comes to your Personal Data (“Personal Data”), Alchemy Utilities Limited, Inc. (“Alchemy Utilities Limited”, “we”, “us”), as
well as our employees, contractors and service providers are committed to providing you with transparency and
choice. Alchemy Utilities Limited is committed to providing reliable and trustworthy information to our customers using a
variety of means, which are supported by a comprehensive privacy program. We aim to process Personal Data in
accordance with applicable legislation, while taking into account and transparently balancing the relevant interests
of our customers, ourselves and other stakeholders.

This Privacy Statement (“Statement”) provides an overview of how Alchemy Utilities Limited, via our websites, products
and services, handle privacy, and how we protect your Personal Data.

This Privacy Statement applies to the Alchemy Utilities Limited websites, products and services that link to or reference this
Statement and describes how we handle Personal Data and the choices available to you regarding collection,
process, access, and how to update, correct and delete your Personal Data. Additional information on our Personal
Data practices may be provided in offer descriptions, contractual terms, supplemental privacy statements, or
notices provided prior to or at the time of data collection. Certain Alchemy Utilities Limited products and services may have
additional specific privacy notices that describe how we handle Personal Data for those products and services. If
any other privacy notice conflicts with this Privacy Statement, such specific notice will take precedence.

What This Statement Covers

This Statement describes the following general aspects of our collection and processing of Personal Data
concerning you. Please refer to our complementary product and service privacy notices for additional detail
specific to those products and services.

• What Personal Data we collect;
• How Personal Data is used and for what purposes;
• When and why Personal Data is transferred to third parties;
• How we maintain the accuracy, integrity and security of your Personal Data;
• How your Personal data is retained and destroyed;
• What individual rights available to you as it pertains to your Personal Data;
• Where applicable, how we may process the Personal Data of children under 13 years of age; and
• Who you can contact if you have any questions regarding the use of your Personal Data.

Personal Data We Collect

When you visit and use our websites, products and services, we may collect data or ask you to provide certain
data, including Personal Data, about you as you use our websites, products and services and interact with us, for
the purpose of helping us manage our relationship with you. “Personal Data” is any data relating to an identified or
identifiable individual, and may include name, address, email address, phone number, login (account number,
password), marketing preferences, social media account, or payment card number. If we link other data with your
Personal Data, we will treat that linked data as Personal Data. We also collect Personal Data from trusted thirdparty
sources and engage third-parties to collect Personal Data to assist us. This data may include:

• Contact details, such as name, mailing address, email address and phone number;
• Shipping and billing data, including credit card and payment data;
• Your transaction history;
• Data you provide to us to receive technical assistance or during customer service interactions;
• Data about other people that you may provide with any program or services including Refer-a-Friend;
• Data about your computer or device, including browser type and settings, IP address and traffic data
relating to your Internet connection; and
• Alchemy Utilities Limited product performance data and details about how you use our products and services.

When you choose to provide us with Personal Data about third-parties, we will only use this data for the specific
reason for which you elect to provide it. It is your responsibility to ensure that when you disclose to Alchemy Utilities Limited
Personal Data of individuals other than yourself – such as your contacts, your users or other third-parties
– you abide by applicable privacy and data security laws, including informing users and third-parties that you are
providing their Personal Data to Alchemy Utilities Limited, informing them of how it will be transferred, used, or processed,
securing appropriate legal permissions and safeguards required for such disclosures, transfers and processing. If
you choose to provide Alchemy Utilities Limited with a third-party’s Personal Data (such as name, email, and phone
number), you represent that you have the third-party’s permission to do so. Examples include forwarding
reference or sending job referrals. You also acknowledge that when we interact with such third-party individuals
whose Personal Data you share with us, it is our duty to inform them that we obtained their Personal Data from
you. Where applicable, third-parties may unsubscribe from any future communication following the link provided
in the initial message or as indicated in the “Contact Us” section of this Statement. If you believe that one of your
contacts has provided us with your Personal Data and you would like to request that it be removed from our
database, please contact us at privacy@nomailinuse.alchemyutilities.ie.

If applicable, for more information about what Personal Data we process on a product basis, please refer to the
relevant product and service privacy notices accessible below.

How We Process Your Personal Data

We use your Personal Data for the purposes outlined below as well as in the relevant Product Notices on the
following grounds:

On the basis of fulfilling our contract with you or entering into a contract with you on your request, in order to:

• Create and manage your Alchemy Utilities Limited Account when needed to access communications and services;
• Verify your identity and entitlement to products or services, when you contact us or access our services;
• Update you on the status of your orders;
• Manage your subscriptions; and
• Provide you with technical and customer support.

On the basis of your consent, in order to:

• Subscribe you to a newsletter, send product updates or technical alerts;
• Send you marketing communications and information on new products, services and assets;
• Communicate with you about, and manage your participation in contests, offers or promotions;
• Solicit your opinion or feedback, provide opportunities for you to test software; and
• Provide you with interest-based ads on sites other than our own.

On the basis of legal obligations, we are obligated to, for instance, keep records for tax purposes or answer
compelling orders and provide information to public authorities.

On the basis of our legitimate interest in the effective delivery of our products, services and communications to
you as well as to our other customers and partners, in order to:

• Communicate commercial promotions and provide quotes for our products and services;
• Research and implement product improvements and product updates;
• Evaluate and improve the performance and quality of our products, services and websites;
• Provide you with a customized experience when you visit our websites;
• Allow interoperability within our applications;
• Secure our systems and applications;
• Allow for the provisioning of services;
• Enforce our legal rights; and
• Share your data with partners for sales conversions and lead generation.

We will only process any special categories of Personal Data (“Sensitive Personal Data”) relating to you for specific
purposes outlined above or in relevant Product Notices, because either: 1. You have given us your explicit consent
to process that data; or 2. The processing is necessary to carry out our obligations under employment, social
security or social protection law; 3. The processing is necessary for the establishment, exercise or defense of legal
claims; or 4. You have made the data public.

On the basis of our legitimate interest, we and our third-party partners, may combine the data we collect from
you over time from our websites, products and services with data obtained from other sources. We combine your
data with other sources to improve user experience on our websites and services we provide. In some instances,
Alchemy Utilities Limited and the third-parties we engage may automatically collect data through cookies, web logs and
other similar applications. This data is used to better understand and improve the usability, performance, and
effectiveness of our websites, products and services to help tailor content or offers for you. Please reference the
“Tracking Technologies, Cookies & Do-Not-Track” section below for more information.

On the basis of legitimate interest, we process Personal Data for network and information security purposes.
Pursuant to Recital (49) of the EU General Data Protection Regulation (“GDPR”), organizations have a recognized
legitimate interest in collecting and processing Personal Data to the extent strictly necessary and proportionate for
the purposes of ensuring network and information security. According to said Recital (49), network and
information security means the ability of a network or of an information system to resist events, attacks or
unlawful or malicious actions that could compromise the availability, authenticity, integrity and confidentiality of
stored or transmitted data, or the security of the related services offered by, or accessible via those networks and
systems.

Both as an organization in our own right, and as a provider of technologies and services which may
include hosted and managed computer emergency and security incident response services, it is in our legitimate
interests as well as in our customers’, as laid down in Article 6(1)(f) of the GDPR, to collect and process Personal
Data to the extent strictly necessary and proportionate for the purposes of ensuring the security of our own, and
of our customers’ networks and information systems. This includes the development of threat intelligence
resources aimed at maintaining and improving on an ongoing basis the ability of networks and systems to resist
unlawful or malicious actions and other harmful events (“cyber-threats”). The Personal Data we process for said
purposes includes, without limitation, network traffic data related to cyber-threats such as:

• sender email addresses (e.g., of sources of SPAM);
• recipient email addresses (e.g., of victims of targeted email cyberattacks);
• reply-to email addresses (e.g., as configured by cybercriminals sending malicious email);
• filenames and execution paths (e.g., of malicious or otherwise harmful executable files attached to
emails);
• URLs and associated page titles (e.g., of web pages broadcasting or hosting malicious or otherwise
harmful contents); and/or
• IP addresses (e.g., of web servers and connected devices involved in the generation, distribution,
conveyance, hosting, caching or other storage of cyber-threats such as malicious or otherwise harmful
contents).

Depending on the context in which such data is collected, it may contain Personal Data concerning you or any
other data subjects. However, in such cases, we will process the data concerned only to the extent strictly
necessary and proportionate to the purposes of detecting, blocking, reporting (by removing any personally
identifiable elements) and mitigating the cyber-threats of concern to you, and to all organizations relying on our
products and services to secure their networks and systems. When processing Personal Data in this context, we
will not seek to identify a data subject unless strictly indispensable to the remediation of the cyber-threats
concerned, or required by law.

If you believe that your Personal Data was unduly collected or is unduly processed by Alchemy Utilities Limited for such
purposes, please refer to the “Your Rights” and “Contact Us” sections below. Please be aware that if it is
determined that Personal Data concerning you is processed by Alchemy Utilities Limited because it is necessary for the
detection, blocking or mitigation of convicted cyber-threats, in line with GDPR Article 21(1), objection, rectification
or erasure requests may be rejected. It is our compelling legitimate interests to protect our organization and our
customers from cyber threats, and therefore our interest may override your objection, rectification or erasure
requests until you demonstrate the measures necessary to dissociate your Personal Data from any identified
cyber-threat.

Marketing and Community Networking

Alchemy Utilities Limited has a legitimate interest in promoting our commercial offerings and to optimize the delivery of
communications to that effect to our customers and audiences that are most likely to find them relevant. We will
therefore collect and process data to that end as explained below. However, where we are legally required to
obtain your consent to provide you with certain marketing materials, we will only provide you with such marketing
materials where we have obtained such consent from you. If you do not want to continue receiving any marketing
materials from us, you can click on the unsubscribe function in the communication or e-mail, or clicking on the
following link:https://info.alchemyutilities.ie/email-preference-center.html

Messages

In addition to the purposes described above, we may, in compliance with applicable legal requirements, use your
Personal Data to provide you with advertisements, promotions and information about products and services
tailored to you and your needs. This may include demographic data or trend data provided by third-parties, where
permitted. Contact details, including phone numbers, mail and email addresses, may be used to contact you. If you
do not want us to use your Personal Data in this way, you can simply choose not to consent to such use of your
data on the webpages and/or forms through which such Personal Data is collected. You can also exercise this right
at any time by contacting us as explained below.

Interest-Based Ads

We may provide your data including the data about your interests in our products to Third-Parties for the purposes
of serving you more relevant ads. Where we provide you with interest-based ads on a site other than our own, we
do not track your other activities on that site. If you click on our ads, we will know only the domain you came from.
For more information, please see the Tracking Technologies, Cookies & Do Not Track section below.

Data from Third-Parties

Third-parties may provide us with Personal Data they have collected about you from you or from further online
and offline sources, such as marketing data from our partners and third-parties that is combined with information
we already have about you, to provide you with more relevant communications and better tailored offers. We
make reasonable efforts to verify that the third-parties we engage for such purposes are reputable and law-abiding
and we will not solicit them to disclose to us Personal Data we do not have a lawful purpose to collect and process.
However, we are not liable for any processing of your Personal Data by such third-parties prior to, during or after
them providing it to us. We may combine such Personal Data with the Personal Data we already have about you to
provide you with a better experience, evaluate your interest in our products or improve the quality of our
offerings.

Tracking Technologies, Cookies & Do-Not-Track

Cookies

A cookie is a commonly used automated data collection tool. Cookies are small text files that are placed on your
computer or device by websites that you visit or HTML-formatted emails you open, to make websites work, or
work more efficiently. We and our partners may use cookies, web beacons, pixel tags, scripts or other similar
technologies on our websites or emails to:

• Ensure the proper functioning of our websites and the proper delivery of legitimate electronic
communications;
• Tailor information presented to you based on your browsing preferences, such as language and
geographical region;
• Collect statistics regarding your website usage;
• Provide us with business and marketing information; and
• In some cases, to enable a third-party to deliver future advertising for our products and services to you
when you visit certain websites owned by third-parties.

We use different kinds of cookies:

• Essential cookies are necessary to provide you with services and features available through our websites.
Without these cookies, services you may need, cannot be provided.
• Analytics or customization cookies collect data that is either used in aggregate form to help us
understand how the website is being used or how effective our marketing campaigns are, or to help us
customize the website for you.
• Advertising cookies and tracking scripts are used to make advertising messages more relevant to you.
They perform functions like preventing the same ad from continuously reappearing, ensuring that ads are
properly delivered and, in some cases, featuring ads based on your interests. If your website includes a
cookie management tool, you will find a hover button at the bottom of your screen.

If you do not wish to receive cookies you may be able to refuse them by not agreeing to the use of them upon
entering the website. If you do so, we may be unable to offer you some of our functionalities, services or support.
If you have previously visited our websites, you may also have to delete any existing cookies from your browser.

We gather certain data automatically and store it in log files. This data may include internet protocol (IP)
addresses, browser type, internet service provider (ISP), referring/exit pages, operating system, date/time stamp,
and/or clickstream data. We may combine this log data with other data we collect about you. We do this to
improve services we offer you, to improve marketing, analytics, or site functionality.

We use local storage, such as HTML5, to store content data and preferences. Third-parties with whom we partner
to provide certain features on our website or to display advertising based upon your web browsing activity also use
HTML5 to collect and store data. Various browsers may offer their own management tools for removing HTML5
content.

Do-Not-Track

There are different ways you can prevent tracking of your online activity. One of them is setting a preference in
your browser that alerts websites you visit that you do not want them to collect certain data about you. This is
referred to as a Do-Not-Track (“DNT”) signal. Please note that our websites may not recognize or act in response to
DNT signals from web browsers. There is currently no universally-accepted standard for what a company should do
when a DNT signal is detected. In the event a final standard is established, we will assess how to appropriately
respond to these signals. For more detailed information about cookies, Do-Not-Track and other tracking
technologies, please visit www.allaboutcookies.org and https://allaboutdnt.com.

Third-Party Data Collection

Cookies may also be placed by third-parties to deliver tailored information and content which may be of interest to
you, such as promotions or offerings, when you visit third-party websites after you have left our websites. We do
not permit these third-parties to collect Personal Data about you beyond such cookies (e.g., email address) on our
site.

Social Media Features and Widgets

Our websites include social media features, such as Facebook’s “Like” button, and widgets, such as the “Share
This” button, or interactive mini-programs that run on our site. These features are usually recognizable by their
third-party brand or logo and may collect your IP address, which page you are visiting on our websites, and set a
cookie to enable the feature to work properly. Social media features and widgets are either hosted by a third-party
or hosted directly on our site. Your interactions with any such third-party feature is governed by the privacy policy
of the company providing it.

How to Opt out of Interest-based Advertising

We partner with a third-party to display advertising on our website or to manage our advertising on other sites.
Our third-party partner may use cookies or similar technologies to provide you advertising based upon your
browsing activities and interests. If you do not wish to receive cookies you may be able to refuse them If you wish
to opt out of interest-based advertising, you can do so by not agreeing to the use of them upon entering the
website. Please note that if you opt out, you will continueto receive generic ads not based on your interests.

Automated Individual Decision-Making and Profiling

Where Alchemy Utilities Limited processes network traffic data for the purpose of network and information security based
on our or our customers’ legitimate interest as outlined in the corresponding section of this Statement, automated
decisions concerning particular data elements may occasionally be made. This could involve in particular assigning
relative cybersecurity reputation scores to IP addresses and URLs based on objective cyber-threat indicators
measured by our cyber-threat detection engines. Such indicators may be for instancethe determination that
malicious or otherwise harmful contents are hosted at a given URL, or are emanating from a given IP address. Such
automatically-assigned reputation scores may be leveraged by you, by Alchemy Utilities Limited, by our partners and by
other customers to detect, block and mitigate the identified cyber-threats. They could therefore result in our
products and services blocking network traffic coming from or going to such URLs and IP addresses. No such
processing is intended to produce any other effect than protecting you, Alchemy Utilities Limited, our partners and our
other customers from cyber-threats. Should you nevertheless consider that such automated processing is unduly
affecting you in a significant way, please contact directly the relevant data controller whose use of our products
and services is thus impacting you. In case that data controller is Alchemy Utilities Limited, please refer to the “Your Privacy
Rights” and “Contact Us” sections of this Statement to raise your concerns and to seek our help in finding a
satisfactory solution.

How We Disclose Your Personal Data

We do not sell, lease, rent or give away your Personal Data. We only disclose your Personal Data as described
below, within Alchemy Utilities Limited, with our partners, with service providers that process data on our behalf and with
public authorities, as required by applicable law. Processing is only undertaken for the purposes described in this
Statement and the relevant product and service privacy notices. If we disclose your Personal Data, we require its
recipients to comply with adequate privacy and confidentiality requirements, and security standards.

Partners

We may provide your Personal Data to our partners for the purpose of allowing them to conduct Alchemy Utilities Limited
business. Our partners may use your Personal Data to communicate with you and others about Alchemy Utilities Limited
products or services. If you do not wish to receive promotional emails from our partners, you can unsubscribe
directly using the unsubscribe link or tool provided in the partner’s email or other communication to you.

Service Providers Processing Data on Our Behalf

We may use contractors and service providers to process your Personal Data on our behalf for the purposes
described in this Statement and the relevant product and service privacy notices accessible below. We
contractually require service providers to keep data secure and confidential and we do not allow our data
processors to disclose your Personal Data to others without our authorization, or to use it for their own purposes.
However, if you have an independent relationship with these service providers their privacy statements will apply
to such relationships. Such service providers may include in particular contact centers, payment card processors
and marketing/survey/analytics suppliers.

Public Authorities

In certain instances, it may be necessary for Alchemy Utilities Limited to disclose your Personal Data to public authorities or
as otherwise required by applicable law. No Personal Data will be disclosed to any public authority except in
response to:

• A subpoena, warrant or other process issued by a court or other public authority of competent
jurisdiction;
• A legal process having the same consequence as a court-issued request for data, in that if Alchemy Utilities Limited were to refuse to provide such data, it would be in breach of local law, and it or its officers,
executives or employees would be subject to liability for failing to honor such legal process;
• Where such disclosure is necessary for Alchemy Utilities Limited to enforce its legal rights pursuant to applicable
law;
• A request for data with the purpose of identifying and/or preventing credit card fraud; or
• Where such disclosure of Personal Data is necessary to prevent or lessen a serious and imminent threat
of bodily or other significant harm to the data subject or other individuals potentially concerned.

Cross-Border Transfers of Personal Data among Alchemy Utilities Limited Entities and to Third-Party Vendors

We are a global company and, as such, we process data in many countries. To conduct our business, and in
accordance with this Statement, your Personal Data may be transferred to Alchemy Utilities Limited in Ireland,
and to subsidiaries and third-party vendors of Alchemy Utilities Limited located worldwide. All transfers will occur in
compliance with data transfer requirements of applicable laws and regulations. Where Personal Data originating
from the European Economic Area is transferred to Alchemy Utilities Limited entities or to third-party vendors engaged by
Alchemy Utilities Limited to process such Personal Data on our behalf who are located in countries that are not recognized
by the European Commission as offering an adequate level of Personal Data protection, such transfers are covered
by alternate appropriate safeguards, specifically standard data protection clauses adopted by the European
Commission. If applicable to you, you may obtain copies of such safeguards by
contacting privacy@nomailinuse.alchemyutilities.ie.

In the process of continuing to develop our business, we may also occasionally acquire subsidiaries or other
business entities. As a result of such transactions, and for maintaining a continued relationship with you, we may
transfer your Personal Data to a related affiliate.

If we are involved in a reorganization, merger, acquisition or sale of our assets, your Personal Data may be
transferred as part of that transaction. We will notify you of any such deal and outline your choices in that event.

 

How We Protect Your Personal Data

Safeguards

We take reasonable and appropriate administrative, technical, organizational, and physical security and risk
management measures in accordance with applicable laws to ensure that your Personal Data is adequately
protected against accidental or unlawful destruction, damage, loss or alteration, unauthorized or unlawful access,
disclosure or misuse, and all other unlawful forms of processing of your Personal Data in our possession.

Securing Personal Data is an important aspect of protecting privacy. Our security organization applies policies,
standards and supporting security controls at the level appropriate to the risk level and the services provided. In
addition, appropriate security controls are communicated to application owners and technology teams across the
business to support secure development of products and a secure operating environment.

We pay specific attention to the protection of Personal Data and the risks associated with processing this data.

Measures we take to protect Personal Data include:

Physical Safeguards

We lock doors and file cabinets, control access to our facilities, implement a clean desk policy, and apply secure
destruction to media containing your Personal Data.

Technology Safeguards

We use network and information security technologies such as anti-virus and Alchemy Utilities Limited endpoint protection
software, encryption, intrusion detection and data loss prevention, and we monitor our systems and data centers
to ensure that they comply with our security policies. For example confidential information is transmitted using
Transport Layer Security (“TLS”) encryption.

Organizational Safeguards

We conduct regular company-wide, as well as role-specific and targeted training and awareness programs on
security and privacy, to make sure that our employees and contractors understand the importance of protecting
your Personal Data, and that they learn and maintain the necessary knowledge and skills effectively to protect it in
practice. Our organizational privacy policy and standards also guide our handling of your Personal Data.

Personal Data Breaches

Alchemy Utilities Limited takes every reasonable measure to prevent Personal Data breaches. When these do occur, we
have a process in place to take swift action within our responsibilities. These actions will be consistent with the
role we have in relation to the products,services or processes affected by the breach. In all cases, we will work
together with affected parties to minimize effects, to make all notifications and disclosures that are required by
applicable law or otherwise warranted, and to take action to prevent future breaches. We systematically outline
responsibilities in case of Personal Data breaches in our contracts, both with customers as well as with our
vendors.

Storage of Your Personal Data

The data we collect from you may be stored, with risk-appropriate technical and organizational security measures
applied to it, on in-house as well as third-party servers in Ireland, as well as anywhere Alchemy Utilities Limited
or our vendors operate.

Links to Other Websites

Our websites may contain links to other websites, which are owned or operated by other companies. If you choose
to visit any linked websites, we encourage you to review their privacy statements carefully, as they may differ from
ours. We are not responsible for the content or privacy practices of websites that are owned by companies that
are not within Alchemy Utilities Limited Corporation. Our websites may also link to co-branded websites that are
maintained by Alchemy Utilities Limited and one or more of our business partners, who are collecting your Personal Data
pursuant to their own privacy practices. We encourage you to read the privacy statements on any co-branded site
to which you link for information on the privacy practices of that site.

Children’s Privacy

Our websites are not directed to, nor do we knowingly collect data from, children under 13 years of age, except
where explicitly described otherwise in the privacy notices of products and services designed specifically to assist
you by providing child online protection features. In such cases, we will only collect and process Personal Data
related to any child under 13 years of age which you choose to disclose to us or otherwise instruct us to collect and
process. Please refer to the specific applicable notices for important additional information.

Managing Your Personal Data

How long we retain or store your Personal Data

We will hold your Personal Data on our systems for the longest of the following periods: 1. As long as necessary to
maintain our ongoing business relationship, or as needed to provide you with the products, services or information
which you are entitled to or can otherwise reasonably expect to receive from us; 2. For as long as necessary for the
purpose for which we collected it or for which you supplied it to us in accordance with any product or service
relevant activity or process; 3. Any retention period that is necessary to comply with our legal obligations, to
resolve disputes, to enforce our agreements; or 4. The end of the period in which litigation or investigations might
arise in respect of our business relations or other interactions with you.

For the sake of clarity where Alchemy Utilities Limited is a data controller processing your Personal Data for our own
purposes, your Personal Data will be deleted or de-identified when it is no longer needed for its originally stated
processing purposes, or any additional compatible purpose for which Alchemy Utilities Limited may lawfully further process
such data.

Moreover, where Alchemy Utilities Limited is a data processor processing your Personal Data for the purposes and on the
instructions of another data controller or data processor, we will comply with the time limits agreed with that
other Controller or Processor unless we are compelled by applicable laws and regulations to delete such data
sooner, or to retain it further.

If applicable, for more information about how your Personal Data may subsequently be retained on a per product
basis, please refer to the product and service specific supplemental information.

Your Privacy Rights

Subject to applicable laws, as an individual data subject, you may have the right:

a) to ask us to provide you with information regarding the Personal Data we process concerning you;

b) to rectify, update or complement inaccurate or incomplete Personal Data concerning you;

c) to delete or request the erasure of Personal Data concerning you;

d) in certain circumstances to obtain of us that we restrict the way in which we process Personal Data concerning
you;

e) to withdraw any consent you may have given for us to process Personal Data concerning you;

f) to object to our processing of Personal Data concerning you on the basis of our, or of third-parties’ legitimate
interests;

g) to obtain of us the portability of Personal Data concerning you which we process using automated means on the
basis of your consent or of a contract you have entered into with us; and

h) in the European Economic Area, to lodge a privacy complaint with a supervisory authority if you are unhappy
with the way we have handled your Personal Data or any privacy query or request that you have raised with us.
Where your exercise of any of the rights above is dependent on Alchemy Utilities Limited’s action, we will abide by our legal
obligation to take reasonable measures to ascertain your identity and the legitimacy of your request, and may ask
you to disclose to us any information necessary for that purpose. We will respond to legitimate request within 1
(one) calendar month or 31 (thirty-one) calendar days (whichever is longer). In certain limited circumstances, we
may need to extend our response period as permitted by applicable law. Pursuant to any such requests, we may
retain certain data necessary to prevent fraud or future abuse or as otherwise required or permitted by law,
including to comply with legal obligations we are subject to, as well as to establish, exercise and defend our legal
claims.

Communication Choices

You may also update your Alchemy Utilities Limited Email Preferences as well as unsubscribe from General Marketing
Offers.

Contact Us

To exercise any of your rights, or if you have any other questions or complaints about our use of your Personal
Data and its privacy, write or call our Privacy Team at the most convenient location below:

Alchemy Utilities Holdings Limited – Attn: Legal
2 Harmony Court, Harmony Row, Dublin, Ireland
Call us: +353 (0) 1907 9234
Email us: privacy@nomailinuse.alchemyutilities.ie

Changes to this Statement

We reserve the right to revise or modify this Statement. In addition, we may update this Privacy Statement to
reflect changes to our data practices, further development of our website, government regulations or the implementations of new technologies. If we make any material changes the revised policy will be posted to this page so that you are always aware of the information we collect, how we use it and under what circumstances we disclose it. We therefore recommend you read the current data protection information again from time to time.