Privacy Policy

| Document Control | Details | |------------------|---------| | Legal Entity | Soleos Energy Limited | | Website / Digital Property | https://soleosenergy.com/ | | Effective Date | 18-06-2026 | | Review Frequency | Annual, or earlier upon change in law, business model, website functionality or data-processing practice | | Policy Owner | IT Manager | | Approved By | Board of Directors and IT Manager | | Grievance Officer | [Name, designation, email, phone and postal address to be inserted before publication] |

1. PURPOSE AND POLICY STATEMENT

This Privacy Policy explains how Soleos Energy Limited, together with its applicable group entities, affiliates, subsidiaries, regional offices and authorised representatives (collectively, "Soleos", "Company", "we", "us" or "our"), collects, receives, uses, stores, processes, shares, transfers, protects, retains and deletes personal information when any person uses our website, contacts us, submits an enquiry, seeks a proposal, applies for employment, engages with us as a vendor, partner, customer, investor, consultant or stakeholder, or otherwise interacts with us through our official digital or business channels.

This Policy is intended to comply with the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"), the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025, as amended, notified and applicable from time to time.

Where the General Data Protection Regulation, other overseas privacy laws, sectoral regulations or contractual data protection obligations apply to a particular Soleos entity, project, customer or jurisdiction, Soleos will also apply such additional requirements to the relevant processing activity.

2. WHO WE ARE AND HOW TO CONTACT US

Soleos is engaged in renewable energy, solar EPC, project development, operations and maintenance, asset management, finance facilitation, insurance facilitation and related energy-transition services for residential, commercial, industrial, institutional, utility and international customers.

| Particulars | Details | |------------|---------| | Registered Office | 802, 8th Floor, Altimus, Shreyas Colony, Tera Panth Road, Off. Ashram Road, Navrangpura, Ahmedabad, Gujarat - 380009 | | Website | https://soleosenergy.com/ | | Email | sales@soleosenergy.com | | Phone | +91 8320095024 | | Privacy / Grievance Contact | [privacy@soleosenergy.com / grievance officer email to be inserted] |

3. SCOPE AND APPLICABILITY

This Policy applies to personal data or personal information processed by Soleos through the website, contact forms, email, newsletters, CRM systems, proposal submissions, tender interactions, customer onboarding, vendor onboarding, recruitment, project-support communications, complaint handling, investor or corporate communications, and other online or offline business interactions controlled by Soleos.

This Policy does not replace any separate agreement, data-processing addendum, confidentiality agreement, non-disclosure agreement, employment document, customer contract, vendor agreement, tender condition or project-specific privacy term. In case of conflict, the stricter privacy, confidentiality or security obligation shall apply unless applicable law requires otherwise.

4. KEY DEFINITIONS

| Term | Meaning | |------|---------| | Personal Data / Personal Information | Any information relating to an identified or identifiable natural person, including data that can identify a person directly or indirectly. | | Sensitive Personal Data or Information / SPDI | Sensitive categories recognized under Indian SPDI Rules, including passwords, financial information, health information, sexual orientation, medical records and history, biometric information, and information received by a body corporate for processing or stored or processed under lawful contract. | | Data Principal | The individual to whom digital personal data relates, including the parent or lawful guardian where applicable. | | Data Fiduciary | The person or entity that determines the purpose and means of processing personal data. Soleos may act as a Data Fiduciary for website, customer, vendor, recruitment and stakeholder data. | | Data Processor | A person or entity that processes personal data on behalf of a Data Fiduciary, such as cloud, hosting, CRM, analytics, IT support, cybersecurity, communication or professional service providers. | | Processing | Any operation performed on personal data, including collection, recording, organization, storage, use, sharing, disclosure, transfer, retrieval, restriction, erasure or destruction. | | Consent | Free, specific, informed, unconditional and unambiguous indication of the Data Principal’s agreement to the processing of personal data for a specified purpose, where consent is the applicable legal basis. |

5. CATEGORIES OF PERSONAL DATA WE MAY COLLECT

Depending on the nature of the interaction, Soleos may collect the following categories of personal data. We collect only such data as is reasonably necessary, proportionate and connected to a lawful and specified purpose.

| Category | Examples | |-----------|-----------| | Identity and Contact Data | Name, company name, designation, email address, phone number, postal address, city, state, country, business website and preferred communication details. | | Business and Project Data | Site location, electricity consumption, roof or land details, drawings, technical inputs, electricity bills, project feasibility details, proposal data, tender documents, project correspondence and related commercial inputs. | | Communication Data | Messages submitted through forms, emails, call notes, meeting requests, support tickets, complaints, feedback and correspondence records. | | Usage, Device and Technical Data | IP address, browser type, device identifiers, operating system, pages visited, timestamps, referring URLs, logs, diagnostics, cookies and similar technology data. | | Recruitment Data | CV, employment history, qualifications, references, assessment information, interview notes, identity details and other job-application information. | | Vendor, Partner and Compliance Data | GST, PAN, bank details, payment details, due-diligence documents, tax information, certifications, registrations, work records, insurance information and compliance confirmations. | | Finance, Insurance and Transaction Data | Information required to assess, arrange, process or support project finance, subsidy, payment, billing, insurance or related commercial arrangements. | | Public and Third-Party Data | Information lawfully received from public sources, business networking platforms, referrals, channel partners, affiliates, lead providers, regulators, distribution companies, professional advisers or authorized service providers. | | Sensitive Personal Data or Information | SPDI is collected only where necessary for a lawful purpose, with appropriate consent or legal basis, and with additional safeguards. Examples may include passwords, financial information, medical information, biometric information or other sensitive information where relevant to a specific transaction, employment, insurance, security or legal requirement. |

6. HOW WE COLLECT PERSONAL DATA

Directly from you when you submit forms, contact us, request information, apply for a job, submit documents, communicate with our representatives or engage in business discussions.
From your organization, employer, authorized representative, consultant, channel partner, lender, insurer, vendor, customer, contractor or referee.
Automatically through cookies, logs, analytics tools, security systems and similar technologies used on the website.
From public databases, government records, business directories, professional networks, regulatory portals, tender platforms and publicly available sources.
From third-party service providers, professional advisers, project partners, distribution companies, financing partners, insurance partners, due-diligence providers and other lawful sources.

7. PURPOSES FOR WHICH WE USE PERSONAL DATA

To respond to enquiries, calls, emails, website forms, proposal requests, meeting requests and business communications.
To evaluate project feasibility, prepare technical and commercial proposals, share quotations, process tenders and support EPC, O&M, asset management, finance, insurance or renewable-energy services.
To negotiate, execute, administer and perform contracts with customers, vendors, consultants, contractors, lenders, insurers, investors, advisors and partners.
To onboard and manage vendors, consultants, employees, contractors, channel partners, customers and other stakeholders.
To process recruitment applications, conduct interviews, assess suitability, verify credentials and manage hiring-related communications.
To operate, administer, secure, audit, improve, maintain and troubleshoot the website, CRM, IT systems, forms, security logs, communication platforms and digital infrastructure.
To send service, transactional, administrative, legal, security, project, billing, warranty, safety or operational communications.
To send marketing communications, newsletters, case studies, event updates or thought-leadership content where permitted by law and subject to your choices.
To comply with legal, tax, accounting, regulatory, audit, subsidy, tender, labor, safety, environmental, exchange-listing, ESG, investor, litigation or reporting obligations.
To prevent fraud, misuse, cybersecurity incidents, unauthorized access, illegal activity, contractual breach or harm to Soleos, its users or third parties.
To support internal governance, risk management, corporate transactions, investment due diligence, restructuring, merger, acquisition, financing, listing or sale of business assets, subject to confidentiality safeguards.

8. LEGAL BASES AND CONSENT

Soleos processes personal data on one or more lawful bases recognised under applicable law, including consent, performance of contract, pre-contractual steps requested by you, legal obligation, legitimate business purpose, employment or vendor administration, compliance and security requirements, or any other ground permitted by law.

Where consent is required, Soleos will seek consent in a clear and informed manner. You may refuse to provide personal data or withdraw consent, subject to applicable legal, contractual and operational consequences.

For SPDI, Soleos will collect and process such information only for lawful purposes connected with a function or activity of Soleos, where the collection is necessary for that purpose, and where consent or another legally recognised basis applies.

9. DATA MINIMISATION, ACCURACY AND USER RESPONSIBILITY

Soleos aims to collect only information that is adequate, relevant and limited to what is necessary for the relevant purpose. You are responsible for providing accurate, complete and current information and for ensuring that any personal data relating to another person is submitted only with proper authority, consent or legal basis.

10. COOKIES, ANALYTICS AND SIMILAR TECHNOLOGIES

The website may use cookies, pixels, tags, logs, local storage, analytics tools, embedded tools and similar technologies to operate the website, secure forms, remember preferences, understand website performance, improve user experience, measure engagement and support marketing or communication activities.

Note: A separate Cookie Policy should be published where the website uses analytics, remarketing, third-party tracking or non-essential cookies.

11. MARKETING COMMUNICATIONS

Soleos may send business updates, newsletters, event invitations, project insights, service information, case studies or marketing communications where permitted by law. You may opt out of marketing communications by using the unsubscribe option, replying with an opt-out request or contacting us.

12. SHARING AND DISCLOSURE OF PERSONAL DATA

Soleos does not sell personal data.

Personal data may be shared with:

Soleos group entities, affiliates, subsidiaries and authorized representatives.
Hosting providers, cloud providers, CRM vendors, IT support providers and cybersecurity vendors.
Customers, vendors, contractors, consultants, lenders and insurers.
Lawyers, accountants, auditors and professional advisers.
Government bodies, regulators, courts and law enforcement agencies.
Parties involved in financing, investment, mergers, acquisitions or restructuring.
Any other person where disclosure is authorized by you or required by law.

13. INTERNATIONAL DATA TRANSFERS

Soleos operates and works with stakeholders across India and other jurisdictions. Personal data may be accessed, stored, transferred or processed in India or other countries where Soleos, its service providers or business partners operate.

14. DATA RETENTION AND DELETION

| Data Type | Indicative Retention Approach | |------------|------------------------------| | Website enquiries and general leads | Up to 24 months from the last meaningful interaction. | | Customer, project, EPC, O&M, warranty and technical records | Contract term plus a reasonable post-contract period, typically up to 8 years or longer where required. | | Vendor, finance, tax, compliance and payment records | As required under applicable tax, accounting and regulatory requirements. | | Recruitment records | Usually up to 12 months unless longer retention is required. | | Security logs, cookie logs and access logs | As long as reasonably necessary for security and compliance purposes. | | SPDI | Retained only as long as required for the lawful purpose or compliance obligations. |

15. SECURITY PRACTICES AND SAFEGUARDS

Soleos maintains reasonable technical, organizational, administrative and physical safeguards designed to protect personal data against unauthorized access, use, alteration, disclosure, loss, destruction or misuse.

Security measures may include:

Access controls
Role-based permissions
Authentication mechanisms
Password controls
Encryption where appropriate
Secure hosting
Backups
Network security
Logging and monitoring
Vendor due diligence
Incident response procedures

16. PERSONAL DATA BREACH

If Soleos becomes aware of a personal data breach, it will take reasonable steps to contain, assess, investigate, mitigate and remediate the incident. Where notification is required by applicable law, Soleos will notify relevant authorities and affected individuals in the prescribed manner.

17. YOUR RIGHTS

Depending on applicable law, you may have the right to:

Request information about personal data processed by Soleos.
Access a summary of personal data and processing activities.
Correct, update or rectify inaccurate personal data.
Request deletion of personal data.
Withdraw consent.
Opt out of marketing communications.
Lodge a grievance with the Grievance Officer.
Nominate another person to exercise rights in the event of death or incapacity.
Exercise additional rights available under GDPR or other applicable privacy laws.

18. GRIEVANCE REDRESSAL AND REQUEST HANDLING

For privacy questions, complaints, consent withdrawal, rights requests or data-protection concerns, please contact the Grievance Officer using the contact details mentioned in this Policy.

Soleos will endeavor to acknowledge and resolve grievances within the timelines prescribed under applicable law.

19. CHILDREN AND MINORS

The website and Soleos business services are not directed at children. Soleos does not knowingly collect personal data from children except where permitted by law and supported by required parental or guardian consent.

20. SENSITIVE INFORMATION AND DOCUMENTS

Users should not submit sensitive personal data, passwords, financial credentials, health information, biometric information or confidential documents through the website unless specifically requested by Soleos through an appropriate channel.

21. THIRD-PARTY WEBSITES, PLATFORMS AND EMBEDDED CONTENT

The website may contain links to third-party websites or embedded content such as maps, videos, forms, social media widgets, analytics scripts, job portals, CRM forms, payment links or external resources.

Users should review the privacy notices of third-party platforms before interacting with them.

22. AUTOMATED PROCESSING AND PROFILING

Soleos does not use the website to make solely automated decisions that produce legal or similarly significant effects on individuals without appropriate human involvement.

23. CORPORATE TRANSACTIONS AND LISTING-RELATED USE

Soleos may disclose or review personal data in connection with financing, investment, due diligence, merger, acquisition, restructuring, listing, audit, valuation, ESG review, investor reporting or sale of business assets.

24. CHANGES TO THIS POLICY

Soleos may update this Policy from time to time to reflect changes in law, technology, website functionality, business operations, data practices or governance requirements.

The updated version will be posted on the website with a revised effective date.

25. CONTACT DETAILS

| Contact Field | Details | |--------------|---------| | Company | Soleos Energy Limited | | Grievance Officer | [Name and designation to be inserted] | | Email | [privacy@soleosenergy.com / grievance officer email to be inserted] | | Phone | [Phone number to be inserted] | | Address | 802, 8th Floor, Altimus, Shreyas Colony, Tera Panth Road, Off. Ashram Road, Navrangpura, Ahmedabad, Gujarat - 380009 |

Document Reference

Source document provided by user. :contentReference[oaicite:0]{index=0}