Date of last revision: October 2026

1. WHO ARE WE?

1.1. We are Companion.energy BV, a private limited liability company (besloten vennootschap) incorporated under Belgian law, having its registered office at Quantum Building, Oktrooiplein 1/bus 201, 9000 Gent, Belgium (“Companion.energy”, “we”), and registered with the Crossroads Bank for Enterprises (Kruispuntbank van Ondernemingen or KBO) under enterprise number 0791.776.356.

1.2. We at Companion.energy provide an online software-as-a-service platform that enables businesses to optimize and manage energy-related processes (the “Platform”), which is made available to customers (“Customer”) and the individuals whom a Customer authorizes to use the Platform on its behalf (“Authorized Users”).

1.3. We value your right to privacy and make every effort to protect your personal data in accordance with applicable data protection law, including the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and national implementing legislation. In this Privacy Policy, we explain what personal data we collect from you, for what purposes we process this data, on what legal basis we base this processing, to whom your personal data may be transferred, how long we keep your data, how we protect your data and what rights you have in relation to the processing of your personal data.

1.4. All concepts not explicitly defined in this Privacy Policy have the same meaning as in our Terms and Conditions.

2. FROM WHOM DO WE COLLECT DATA?

2.1. In the course of our business, we may collect personal data from Authorized Users of the Platform, contact persons of prospective and existing Customers, visitors to our website, and persons who contact us by e-mail or otherwise.

3. WHAT PERSONAL DATA DO WE REQUEST AND WHY?

3.1. In the course of our activities, we collect and process personal data relating to the persons identified in article 2 above. We process the following categories of personal data, for the following purposes, on the basis of the following legal grounds:

Account creation and management for Authorized Users
Which data: Name, e-mail address, phone number, address (and, where applicable, job title and employer/Customer name).
On what basis: The necessity for the performance of the contract we have concluded with the Customer, in particular the Terms and Conditions (art. 6.1 b) GDPR).

To help you with technical problems or other questions
Which data: Name, e-mail address, and any information you voluntarily provide in your support request.
On what basis: The necessity for the performance of the contract we have concluded with the Customer, in particular the Terms and Conditions (art. 6.1 b) GDPR), or when necessary for the exercise of our legitimate interests (art. 6.1 f) GDPR), in particular responding to inquiries and developing business relationships.

To monitor and log the use of AI-powered features (AI chat assistant & MCP server)
Which data: Metadata relating to the use of AI-powered features: user identity, API endpoint called, timestamp, and data transmitted from our API to the AI provider.
On what basis: Necessary for the exercise of our legitimate interests (art. 6.1 f) GDPR), in particular the monitoring, security, and improvement of the Platform and its AI-powered features.

To provide our AI chat assistant and improve this feature
Which data: The content of your questions and answers, and any files you upload insofar they contain personal data, which are stored in our database with the applicable AI model provider.
On what basis: The necessity for the performance of the contract (art. 6.1 b) GDPR), in particular to provide the chat assistant. Necessary for the exercise of our legitimate interests (art. 6.1 f) GDPR) with respect to improving our AI chat assistant.

To inform you about new functionalities of, or important updates to, our Platform
Which data: Name, e-mail address.
On what basis: Necessary for the exercise of our legitimate interests (art. 6.1 f) GDPR).

To operate, secure and maintain the Platform (e.g. login and session management, error logging, security monitoring)
Which data: Name, e-mail address, account settings, IP address, device and browser information, usage and activity logs.
On what basis: The necessity for the performance of the contract (art. 6.1 b) GDPR).

To comply with legal obligations
Which data: Data required by applicable law.
On what basis: Necessary to comply with a legal obligation (art. 6.1 c) GDPR).

To prevent, detect and combat fraud and other illegal or unauthorized activities
Which data: Data required for the detection of fraud and illegal activities (e.g. login and usage logs).
On what basis: Necessary for the exercise of our legitimate interests (art. 6.1 f) GDPR), in particular the prevention of fraud and other illegal activities.

To send you marketing communications about our products, services, and offers
Which data: Name, e-mail address.
On what basis: Your explicit consent (art. 6.1 a) GDPR). You may withdraw your consent at any time, free of charge, by using the unsubscribe link in our communications or by contacting us.

3.2. Our Platform includes an AI-powered chat assistant that allows Authorized Users to ask questions about their data and our Platform. Each Authorized User's chat history is only visible to that Authorized User and to Companion.energy, and is not shared with or made visible to other Authorized Users of the same Customer. In addition, our MCP-server allows Authorized Users to connect their own third-party AI applications or tools to retrieve certain data about the service. While the AI features are not intended to process personal data, we as provider of the service have no control over such free-text input and therefore cannot exclude that we may incidentally process personal data. We encourage Authorized Users to avoid entering personal data into these features unless necessary.

3.3. When an Authorized User uses the MCP-server, the free-text input provided is processed by the relevant third-party AI application chosen by the Authorized User. We do not have visibility into the content of the prompts entered by the Authorized User through the MCP-server, nor into the output generated by the connected AI application. We do, however, process metadata associated with each call made through the MCP-server, being the identity of the user, the API endpoint called, the timestamp, and the data transmitted from our API to the connected AI application (as described above). To the extent that personal data is included in the free-text input, such data is processed by the relevant third-party AI application in accordance with its own privacy policy.

4. WITH WHOM DO WE SHARE YOUR PERSONAL DATA?

4.1. We may disclose your personal data to the following parties:

• With our service providers and partners: we use third parties to help us operate and improve our Platform, including hosting providers, IT and security service providers, and customer support tools. These third parties only process your personal data on our documented instructions and are subject to appropriate contractual data protection obligations (e.g. a data processing agreement).

• With law enforcement / when required by law: we may disclose your information if reasonably necessary (i) to comply with a legal process, such as a court order, subpoena or search warrant, or a government or law enforcement investigation; (ii) to assist in the prevention or detection of crime; or (iii) to protect the safety of any person.

4.2. We do not sell, rent or lend your personal data to third parties for marketing or advertising purposes.

4.3. When transferring personal data to third parties, we always ensure that we implement appropriate technical and organizational protection measures. Where necessary, we conclude a data processing agreement, which sets out restrictions on the use of your personal data and obligations in respect of the security of your personal data.

4.4. To the extent your personal data is transferred to countries outside the European Economic Area which do not provide an adequate level of protection for personal data, we will ensure that the recipients of your data provide an adequate level of protection, for instance by concluding Standard Contractual Clauses (SCCs) with them. We verify, on a case-by-case basis, whether an adequate level of protection is in place for any such transfer.

5. HOW LONG DO WE STORE YOUR PERSONAL DATA?

5.1. We do not keep your personal data longer than necessary for the purposes for which it is collected and processed, as described above.

• For account creation and management, we retain your personal data for as long as the Customer's commercial relationship with Companion.energy is in place, and deleted upon your request or following termination of the Agreement or deactivation of your account.

• For support-related purposes, we retain your personal data for as long as the commercial relationship is in place and deleted following termination of the Agreement.

• For the chat history and uploaded files through the chat assistant, we retain your data for as long as your account is active, until you delete a conversation, or until we delete it following deactivation of your account or termination of the Agreement.

• For informing you about new functionalities or updates, we retain your personal data for as long as the commercial relationship is in place, unless you object to such processing earlier.

• For sending you marketing communications, we retain your personal data until you withdraw your consent or unsubscribe.

• For operating, securing, and maintaining the Platform, we retain usage and activity logs for 6 months from the date of collection.

• For complying with legal obligations, we retain your personal data for the period required or permitted by the applicable legislation.

• For preventing, detecting and combating fraud and other illegal or unauthorized activities, we retain your personal data for 6 months following the date of collection or, where an investigation is ongoing, until such investigation and any related proceedings have been concluded.

5.2. The retention periods above can be longer if (i) necessary to cover our liability, or (ii) required or permitted by law.

6. HOW DO WE SECURE YOUR PERSONAL DATA?

6.1. We take appropriate technical and organizational measures to ensure a level of security appropriate to the specific risks we have identified.

6.2. We thus protect your personal data as best as we can against the destruction, loss, alteration or unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed.

6.3. For further questions regarding security, or for more information on our security measures, please contact us at support@companion.energy.

7. COOKIES

7.1. We use cookies and similar tracking technologies on our Platform and website to ensure their proper functioning, to remember your preferences, and to analyze how our Platform and website are used so that we can improve them.

7.2. Some cookies are strictly necessary for the functioning of our Platform and website and do not require your consent. Other cookies (e.g. analytics or preference cookies) are only placed with your consent, which you can give or withdraw at any time via the cookie settings on our website.

7.3. For more information on the cookies we use, their purpose, and how you can manage your cookie preferences, please refer to our website.

8. WHICH RIGHTS DO YOU HAVE AS A DATA SUBJECT?

• Withdraw your consent at any time: you have the right to withdraw consent where you have previously given your consent to the processing of your personal data.

• Object to processing of your personal data: you have the right to object to the processing of your personal data if the processing is carried out on the legal basis of a legitimate interest. This right is absolute and we will always comply with it.

• Right to access: you have the right to obtain confirmation from us as to whether or not we are processing your personal data, to obtain access to that personal data and how and why it is being processed, and to receive a copy of that data.

• Right to rectification: you have the right to obtain a correction of your personal data or to request that we complete your personal data if it is incorrect or incomplete.

• Right to erasure: you have the right to obtain erasure of your personal data in certain specific cases.

• Right to restriction: you have the right to have the processing of your personal data restricted in certain specific cases.

• Right to data portability: you have the right to obtain the personal data you have provided us with in a structured, commonly used and machine-readable format, and to transfer that data (or have it transferred) to another controller.

You may exercise the above rights by sending an e-mail to support@companion.energy. Exercising these rights is, in principle, free of charge. Only in the case of unreasonable or repeated requests may we charge a reasonable administrative fee. We always try to respond to your requests as quickly as possible; we may first ask you for proof of identity to verify your identity.

In addition to the above rights, you also have the right at any time to lodge a complaint with the Belgian Data Protection Authority in connection with our processing of your personal data. For further information, please visit the website of the Data Protection Authority: www.gegevensbeschermingsautoriteit.be. You can also contact the authority at contact@apd-gba.be or by mail at the following address:

Gegevensbeschermingsautoriteit
Drukpersstraat 35
1000 Brussels

9. REFERENCES TO OTHER WEBSITES

9.1. Our Platform and website may contain links to other sites that are not operated by us. If you click on a third-party link, you will be redirected to that third-party site. We strongly recommend that you review the privacy policy of each site you visit.

9.2. We have no control over, and assume no responsibility for, the content, privacy policies, or practices of any third-party website or platform.

10. CHANGES TO THE PRIVACY POLICY

10.1. From time to time it may be necessary to amend this Privacy Policy. When we post changes to the policy, we will change the “last updated” date at the top of the document. The most recent version of this Privacy Policy will be available on our Platform and website at all times.

11. CONTACT

11.1. If you have any questions or concerns regarding this Privacy Policy or our processing of your personal data, you may contact us at:

Companion.energy
Quantum Building
Oktrooiplein 1/bus 201
9000 Gent
Belgium
E-mail: support@companion.energy