EH2 Privacy Policy - Electric Hydrogen

Last updated: May 1, 2025

Electric Hydrogen Co. and its affiliated companies and subsidiaries (“EH2”, the “Company”, “we”, “us”, “our”), takes your privacy seriously. This Global Privacy Statement (“Statement”) describes how we collect, use, disclose, transfer across borders, and otherwise handle (collectively, “process”) your personal data. This Statement also describes your choices regarding our handling of your personal data and how to make those choices, how we safeguard your personal data, and how you may contact us regarding our privacy practices.

The term “personal data” as used in this Statement means, unless specified otherwise, any information related to or about an identified or identifiable natural person.

This Statement contains the following sections:

1. Scope of this Statement

This Statement applies to the personal data of individuals (“you”, “your”, or “yours”) collected by EH2, including the personal data collected when you visit our websites https://eh2.com/ and https://eh2.app/ as they may be modified, relocated and/or redirected from time to time (the “Site”), as well as when you use any of our services, communicate with us, or attend an event hosted by EH2. This Statement also applies to personal data we may collect from or about the corporate representatives of our customers, vendors, suppliers, business partners, and others for the purposes of conducting our own business, such as contracting and invoicing.

This Statement does not apply with respect to the personal data processed by EH2 in our capacity as an employer, including the personal data of job applicants or the Company’s current or former employees. EH2 maintains separate policies, as required by law, with respect to the Company’s processing of personal data in its capacity as employer.

Third-Party Sites: The Site may include links to, and plug-ins from, sites or applications operated by third parties (“Third-Party Sites”). EH2 does not control any Third-Party Sites and is not responsible for any personal data they may collect. The information collection practices of Third-Party Sites are governed by their privacy policies. If you choose to enter any Third-Party Site from this Site, please refer to that site’s privacy policy to learn more about that site’s processing of your personal data.

Children’s Online Privacy Protection Act Compliance: We do not collect information from anyone under 16 years of age. The products and/or services we provide, together with our Site, are all directed to individuals who are at least 16 years old. If you are under the age of 16, you are not authorized to use our Site.

2. Personal Data We Collect

The types of personal data we collect will vary depending upon the reason that you are interacting with us and may include the following:

Identifiers: such as your name, email, mailing address, and phone number.
Commercial Data: such as records of products or services purchased from EH2 by your employer, and purchasing or consuming history.
Professional Data: such as your employer, job title, business contact information (business email address, mailing address, and phone number), and other information necessary to manage the relationship between EH2 and your employer.
Communications Data, for example: during our communications with you, we collect the content of these communications as well as metadata about the communications, i.e., date and time of the call or text (SMS or MMS) message and phone numbers.
Internet or Other Electronic Network Activity Information: information about your usage of the Site, such as the pages you viewed, the services and features you used or interacted with, your IP address or unique device identifier, and operating systems and platform to the extent related to an identified or identifiable individual.
Account login credentials: such as username, email, password, and related security information when you create an account on the Site.
Geolocation Data: When we collect IP addresses, we may be able to obtain general location information such as city, state, or geographic area.
Marketing and Communications Preferences: such as interests and preferred language. To improve our marketing communications, we may also collect information about interactions with, and responses to, our marketing communications.
Comments, Feedback or Other Information Provided to Us: such as content you submit when you contact customer service or otherwise contact EH2, social media interactions with our social media presence, comments provided on feedback forms or surveys, or other information you chose to provide to us. This may include recordings you create, including audio recordings or voicemail you submit in connection with customer service.

If you provide us with personal data relating to other people (e.g., a colleague, a business contact, etc.), we will process that information in accordance with this Statement. You are responsible for the accuracy of such information and for ensuring that those people are informed that you provided their personal data to EH2 and that we will process their personal data in accordance with this Statement.

3. Cookies

A. What are cookies?

Cookies are small files that are downloaded to your device when you visit a website. The cookie then sends information back to the originating website or to another website that recognizes that cookie.

Cookies are useful because they allow a website to recognize a user’s device. Cookies do lots of different jobs, like letting you navigate between pages efficiently, remembering your preferences, and generally improving the user experience. You can find more information about cookies at: www.allaboutcookies.org.

B. Cookies we use and why we use them

i. Categories of cookies

Our cookies categorized by function:

We may use up to three types of cookies on our Site:

(a) Essential Cookies

These are cookies that are strictly necessary for the functioning of the Site or for performing services that an individual user has requested. Some examples of functions performed by essential cookies are cookies that remember previous actions (e.g., entered text) when navigating back to a page in the same session.

(b)Analytical Cookies

These cookies, sometimes called “performance cookies,” collect information about how visitors use a website, for instance which pages visitors go to most often, and if they get error messages from web pages. These cookies are used only to improve how the Site functions.

(c) Functional Cookies

These cookies allow the website to remember choices users make and to provide enhanced, personalized features. For example, these cookies could remember users’ language preferences.

Our cookies categorized by persistence:

Cookies can also be categorized by how long they remain on your device. There are two broad categories of duration:

(a) Persistent Cookies

Persistent cookies remain on your device until deleted manually or automatically.

(b) Session Cookies

Session cookies remain on your device until you close your browser when they are automatically deleted.

We use both persistent and session cookies. Our persistent cookies last no longer than fourteen (14) months.

Our cookies categorized by who places them:

First-party cookies are cookies that we place on the Site. In contrast, third-party cookies are cookies placed by another party.

We use first-party cookies. In addition, EH2 has relationships with business partners to place cookies on the Site and to perform tracking and reporting functions for the Site.

ii. Other types of trackers

We include small graphic images or other web programming code, called web beacons (also known as “pixel tags”, “web bugs” or “clear GIFs”), on the Site. The web beacons are minute graphics with a unique identifier. They are used to track the online movements of Web users. In contrast to cookies, which are stored in a user’s computer hard drive, web beacons are embedded invisibly on Web pages and are about the size of the period at the end of this sentence.

C. Information collected by our cookies:

Our cookies collect several types of information, including information about your usage of our Site, details about your device, and your IP address. Usage of our Site might include the time at which your device accesses our Site, the page you visit, how long you spend on each page, and the links you click. Cookies might also collect the link that brought you to our Site and webpage you visit after you leave our Site.

Details about your device might include the type of browser you used to access the Site, the version of that browser, and what kind of device you use.

To the extent that data collected by our cookies and trackers is personal data under applicable data protection law, we treat it as personal data. If we link information collected through cookies with any personal data you provide to us through the Site, e.g., through submitting a form, we also treat that information as personal data.

D. Location of information processing:

The information collected by our cookies is processed in servers located in the United States.

E. Your choices:

In certain jurisdictions, when you first come to our Site, you will receive a banner notification that cookies are present. By clicking or tapping “Accept All,” you agree to the use of these cookies as described here.

You can change your cookie consent preferences at any time using our Cookies Settings tool, available here. In addition, you can refuse or accept cookies from the Site (or any other site) in your browser’s settings. If you refuse cookies in your browser settings, some features may not work as intended on our Site.

4. Sources of Personal Data

We may collect personal data about you from the following sources:

You, for example, when you register with our Site, submit feedback, or otherwise provide information directly to us.
Service providers, for example, analytics providers, IT, and system administration services.
Affiliated companies, for example, assist other companies in the EH2 family of companies in providing you with products or services.
Automated technologies, for example, browsing activity collected by automated technologies on the Site.
Third parties, for example, lawyers, bankers, auditors, and insurers who provide consultancy, banking, legal, insurance, and accounting services.
Public sources, for example, public databases or information on publicly-available social media
Surveillance/recording technologies installed by EH2, for example, video surveillance in common areas of EH2 facilities and voicemail technologies with consent to the extent required by law.
Government or administrative agencies, for example, law enforcement, public health officials, and other government authorities.
Acquired entity, if EH2 acquired another entity, EH2 might collect personal data from that entity.

5. How We Use Personal Data

Depending on the nature of your interaction with EH2, we may use the categories of personal data listed above for the following purposes and on the following legal bases:

Category of Personal Data	Purpose of Use	Lawful Basis
1, 2, 3, 4, 5, 6, 7, 9	To deliver our products and administer our services.	To perform our obligations under our contract with your organization. To pursue our legitimate business interests in providing informational services through the Site and other add-on services.
1, 3, 4, 8, 9	To communicate with you.	To enter into a contract with your organization. To perform our obligations under our contract with your organization. To pursue our legitimate business interests in providing information about our products and services and to protect our legal interests. To comply with our legal obligations.
1, 2, 3, 4, 5, 8, 9	To improve our products and services, develop new products and services, and conduct research on further improvements.	To pursue our legitimate business interests in developing and improving our products and services.
1, 2, 3, 4, 5, 7, 8, 9	To enhance your experience using our products and services and to personalize your online experience.	To pursue our legitimate business interests in developing and improving our products and services.
1, 2, 3, 4, 5, 6, 7, 8, 9	For customer support.	To perform our obligations under our contract with your organization. To pursue our legitimate business interests in pleasing our customers.
1, 2, 3, 4, 5, 7, 8, 9	To send you marketing information about our products and services, including notifying you of marketing events, promotions, and sweepstakes, with your consent in accordance with applicable law.	To pursue our legitimate business interests in marketing our products and services growing our business.
1, 2, 3, 4, 5, 6, 7, 8, 9	To administer and protect our business and our Site (including troubleshooting, analysis, testing, system maintenance, support, reporting and hosting of data, and preventing fraud and abuse).	To pursue our legitimate business interests in protecting our business. To comply with our legal obligations.
1, 2, 3, 4, 5, 6, 7, 8, 9	To store, host, or backup (whether for disaster recovery or otherwise) our services or any data contained therein.	To pursue our legitimate business interests in protecting our business. To comply with our contractual and other legal obligations.
1, 2, 3, 4, 5, 6, 7, 8, 9	To protect the rights, property, or safety of EH2, you, or others.	To pursue our legitimate business interests in protecting our business. To comply with our contractual and other legal obligations.
1, 2, 3, 4, 5, 6, 7, 8, 9	In connection with a corporate transaction, sale, or assignment of assets, merger, divestiture, or other changes of control or financial status of EH2 or any of its subsidiaries or affiliates.	To pursue our legitimate business interests in corporate transactions and to protect our legal interests.
1, 2, 3, 4, 5, 6, 7, 9	To report suspected criminal conduct to law enforcement and cooperate in investigations.	To pursue our legitimate business interests in protecting our legal interests.
1, 2, 3, 4, 5, 6, 7, 9	To exercise EH2’s rights under applicable law and to support any claim, defense, or declaration in a case or before a jurisdictional and/or administrative authority, arbitration, or mediation panel.	To pursue our legitimate business interests in our legal interests.
1, 2, 3, 4, 5, 6, 7, 9	To ensure compliance with applicable laws and regulatory obligations.	To comply with our legal obligations.

Under the data protection law of some jurisdictions, by providing your personal data to EH2 as data controller, you consent to EH2’s processing of your personal data as described in the Statement, as it may be modified from time to time. As our business evolves, this Statement may change, so check back to this page periodically to make sure you understand how your personal data will be handled. Where processing of your personal data requires explicit consent, such as when collecting your sensitive personal data in some jurisdictions, the Company will provide you with a separate notice and request your explicit consent.

Please understand that you are not obliged to provide your personal data to the Company. However, if you do not provide your personal data, or otherwise do not consent to the processing of your personal data or withdraw your consent to the processing, where your consent is required, we may not be able to provide you with certain services and may be required to terminate the services currently provided to you or your employer.

You may have the right under applicable law to withdraw your consent. For more information about this right, please refer to Section 10 of this Statement, below.

No Automated Decision Making

The Company does not use the personal data collected for automated decision-making, including profiling, that produces legal effects or similarly significantly effects.

6. How We Disclose Personal Data

We may disclose personal data to the following categories of third parties for the following purposes:

Service Providers: We may disclose your personal data to service providers to provide services to us or on our behalf and to assist us in meeting our business needs and contractual and legal obligations—for example, to host all or portions of this Site, or to ship orders. Service providers will be permitted to process your personal data only for the purpose(s) for which it was disclosed to them and in accordance with the Company’s instructions.
Professional Advisers and Related Third Parties: For example, we may disclose personal data to lawyers to assist us with legal compliance, auditors, accountants, or consultants to assist us in providing services to you or in otherwise conducting our business.
Corporate Affiliates: Your personal data may be disclosed to EH2’s corporate affiliates, for example, to provide you with our products and services or to provide you with information about their products and services.
Government Authorities or Administrative Agencies: We may disclose your personal data, for example, to law enforcement or regulatory bodies or tax authorities.
Other Third Parties: We may disclose your personal data to other third parties—
- When Required By Law: for example, when we respond to subpoenas, court orders, legal process, or discovery requests in civil litigation.
- To Protect Rights, Property or Safety: If we believe that your actions violate applicable law, or threaten the rights, property, or safety of the Company, our clients, or others.
- In Corporate Transactions: We may disclose and transfer your personal data, including to a subsequent owner or co-owner, of our business, including in connection with a corporate merger, consolidation, bankruptcy, the sale of all or substantially all of our membership interests and/or assets, or other corporate change.

The Company will make the disclosures described above only as permitted by applicable laws.

7. Cross-Border Data Transfers

Due to the global nature of our business and for the purposes set forth above, we may transfer personal data to parties located in countries other than the one where you reside, including in the United States. For example, we may transfer personal data internationally to our subsidiaries, affiliates, service providers, business partners and governmental or public authorities in another country in connection with the performance of our services. The laws of these countries may provide a different level of protection for personal data than the country where you reside.

Before transferring personal data across borders, we will take steps to ensure an adequate level of protection for the transfer whenever required by applicable law to do so. This includes, when required by applicable law, relying on approved mechanisms, such as consent or standard contractual clauses or other model clauses approved for use by applicable data protection authorities. Please contact us using the contact details provided under Section 12 of this Statement, below, if you would like to request a copy of the relevant standard contractual clauses.

8. Data Security

We work to secure your personal data from being lost, accessed, used, modified, or disclosed by/to unauthorized persons. During transmission of personal data between you and our Site, we use Transport Layer Security (TLS) software to encrypt information you input. Only employees who need the information to perform a specific job are granted access to personal data. These employees are made aware of our security and privacy practices. As another security measure, the servers that we use to store personal data are kept in a secure, restricted access area.

Please note that despite our reasonable efforts, no security measure is ever perfect or impenetrable, so we cannot guarantee the security of your personal data. Consequently, you should take steps to protect against unauthorized access to your password, phone, and computer by, among other things, signing off after using a shared computer, choosing a robust password that nobody else knows or can easily guess and keeping your log-in username and password private.

9. Retention of Personal Data

We keep personal data for as long as is reasonably required for the purposes explained in this Statement. We also hold records, which may include personal data, to meet legal, regulatory, tax, accounting and/or internal data retention policy needs. For example, we strive to retain an accurate record of your dealings with us, so we can respond to any complaints or concerns you or others might raise later. We’ll also retain files if we reasonably believe there is a prospect of litigation. The specific retention period for your personal data will depend on your relationship with us and the reasons we hold your personal data.

10. Data Rights Specific to Your Region

A. Additional Information Specific to Individuals Who Reside Outside the United States

If you reside in the European Union (EU) or the United Kingdom (UK), the following also applies to you:

Your Rights With Respect to Your Personal Data

Subject to any limitations and exceptions provided by the law applicable to your country of residence, you have the right to:

Request access to your personal data, i.e., to ask the Company to provide you with copies of your personal data;
Request that the Company update, correct or delete (the “right to be forgotten”) your personal data, i.e., to rectify personal data that is incomplete or inaccurate or to erase your personal data;
Withdraw your consent to the processing of your personal data, at any time, where you previously consented to the processing of your personal data. If the Company requests your consent to process your personal data and you do consent, you may use the contact information below to withdraw your consent. Any withdrawal shall not affect the lawfulness of processing based on your consent before its withdrawal. In addition, if EH2 has an alternative lawful ground for processing your personal data without your consent, the Company may continue processing your personal data based on that alternative lawful ground for processing.
Request data portability: Subject to certain limitations, the right to data portability allows you to obtain from the Company, or to ask the Company to send to a third party, a copy of your personal data in electronic form that you provided to the Company.
Request restriction of processing of your personal data in certain situations, such as while a dispute concerning the accuracy of personal data is being resolved;
Object to the processing of your personal data: You have the right to object to the processing of your personal data in certain circumstances.
- Objection to processing based on legitimate interests: You can object to processing of personal data based solely on the Company’s legitimate interests, for example, for direct marketing purposes, unless the Company has compelling legitimate grounds for the processing that override other interests.
Lodge a complaint with the supervisory authority where you live, where you work, or where you believe the violation occurred if you believe that your personal data has been processed in violation of applicable data protection law.

EU residents can find contact information for your data protection authority here: https://edpb.europa.eu/about-edpb/board/members_en
UK residents can find contact information for your data protection authority here: https://ico.org.uk/.

How to Exercise Your Rights

You can exercise your rights by submitting a request to us at [email protected]. The Company will respond to such requests in accordance with applicable data protection law.

11. Contact Us

If you have any questions about this Statement or the rights conferred to you under the applicable data privacy law, please contact [email protected].

12. Changes to this Statement

We review this Statement regularly and may make changes at any time to take account of changes in our business activities, legal requirements, or the manner in which we process personal data. We will place updates on this website and where appropriate we will give reasonable notice of any changes. You should periodically review this Statement to ensure you understand how we collect and use your personal data.