PRIVACY POLICY

ClimaTwin Corp. (“ClimaTwin,” “we,” “us,” or “our”) provides CLIMATE BUSINESS INTELLIGENCE™ software. This Privacy Policy explains how ClimaTwin collects, uses, discloses, retains, and protects personal information in connection with the public website at climatwin.com, the web application at app.climatwin.com, and the other interactions described below. It applies when ClimaTwin determines why and how personal information is processed.

“Personal information” means information that identifies, relates to, describes, or could reasonably be linked with an identifiable person. It does not include information that applicable law treats as anonymous, deidentified, or aggregated.

Privacy at a glance. ClimaTwin collects contact, professional, communications, account-administration, recruiting, technical, security, and privacy-choice information according to the interaction.

ClimaTwin uses personal information to operate and secure the Sites and services, respond to requests, administer business relationships, recruit, improve performance, comply with law, and honor privacy choices.

ClimaTwin discloses personal information to service providers, professional advisers, authorities, transaction participants, an organization a person represents, and recipients the person directs or authorizes.

ClimaTwin does not sell personal information or share personal information for cross-context behavioral advertising, as those terms are defined by the California Consumer Privacy Act.

Depending on location, a person may have rights concerning personal information. Select Submit a Privacy Request or email support@climatwin.com to submit a request. Use the Cookie Settings control available on the relevant Site to manage cookies and similar technologies.

1. Scope. This Policy applies to personal information that ClimaTwin processes as a controller, business, or other organization responsible for determining the purposes and means of processing in connection with the activities described below.
   The Sites. The public website at climatwin.com and the web application at app.climatwin.com, including content and functionality ClimaTwin controls on those domains, are together called the “Sites.”

Requests and relationships. This includes contact, assessment, sales, and support requests; business relationships with customers, prospective customers, partners, suppliers, advisers, and public agencies; and communications with ClimaTwin, including email, meetings, demonstrations, and support interactions.

Recruiting. This includes job applications and recruiting activities.

ClimaTwin’s own administration. This includes account, administrative, authentication, security, billing, contractual, support, and compliance information that ClimaTwin processes for its own business purposes.

This Policy does not apply to personal information that ClimaTwin processes solely on behalf of a customer under a contract or data processing agreement; an activity governed by a separate privacy notice presented at collection; a third-party website, platform, or service ClimaTwin does not control; or information that applicable law does not treat as personal information.

2. ClimaTwin’s privacy roles. For the activities covered by this Policy, ClimaTwin generally acts as the controller, business, or organization responsible for deciding why and how personal information is processed.

A customer may submit information to the ClimaTwin Platform or direct ClimaTwin to process information on its behalf. For that information, the customer generally acts as the controller or business, and ClimaTwin acts as a processor, service provider, or contractor. The customer’s privacy notice and agreement with ClimaTwin govern that processing.

ClimaTwin remains responsible for personal information it processes for its own account-administration, authentication, security, billing, contractual, support, and compliance purposes. If a request concerns information that a customer submitted or directed ClimaTwin to process, contact that customer first. ClimaTwin may refer the request to the customer where appropriate.

3. Personal information ClimaTwin collects. The information ClimaTwin collects depends on the person’s interaction with ClimaTwin.

Contact and identity information. This may include a name, business email address, telephone number, organization, job title, and account or contact identifiers.

Professional and business-relationship information. This may include an employer, role, professional responsibilities, business needs, relationship history, and information about an existing or proposed commercial relationship.

Inquiries, communications, and support information. This may include information submitted through a form, email, support request, assessment request, meeting, or other communication, together with related correspondence, attachments, and follow-up records.

Customer and service-administration information. This may include authorized-user details, account settings, service selections, contract and transaction records, support history, training participation, and information needed to administer a customer relationship.

Applicant information. If a person applies for a position, ClimaTwin may collect contact details, a resume or curriculum vitae, employment and education history, qualifications, work authorization, professional references, interview information, and other information the applicant chooses to provide. If a background check or additional sensitive information is required, ClimaTwin provides any separate notice or authorization required by law.

Technical, usage, and security information. When a person uses the Sites, ClimaTwin’s servers and security infrastructure may record an IP address, browser and device type, operating system, requested pages or functions, referring page, timestamps, session events, diagnostic information, error information, security events, and approximate location inferred from an IP address. Information collected through optional cookies or similar technologies is addressed in the Cookies and Similar Technologies Policy.

Privacy-choice and compliance information. This may include cookie choices, privacy requests, consent records, objections, restrictions, suppression preferences, and records needed to demonstrate compliance.

Sensitive information. Do not submit government identification numbers, financial-account credentials, health information, precise geolocation, or other sensitive personal information through general Site forms. If ClimaTwin specifically requests sensitive information for a lawful purpose, it will provide a separate notice or an appropriately protected method where required. If ClimaTwin receives sensitive information, it uses and discloses that information only as reasonably necessary for the stated purpose, as permitted by law, and subject to any additional notice or consent required.

4. Sources of personal information. ClimaTwin obtains personal information directly from the person, including through forms, emails, meetings, support requests, applications, contracts, and other communications.

ClimaTwin obtains personal information automatically from the Sites’ servers, authentication systems, security tools, logs, and active technologies identified in the Cookies and Similar Technologies Policy.

ClimaTwin may receive personal information from the person’s organization when it identifies the person as a contact, representative, administrator, or authorized user.

ClimaTwin may receive personal information from service providers when they generate hosting, security, diagnostic, account-administration, communications, support, recruiting, or compliance records for ClimaTwin.

5. How and why ClimaTwin uses personal information. ClimaTwin uses personal information for the purposes below and for compatible purposes permitted by law.

Operate the Sites and services. This includes delivering requested pages and functions, authenticating authorized users, administering accounts, providing support, and maintaining availability. Where required, the legal basis is performance of a contract, steps requested before entering a contract, or ClimaTwin’s legitimate interest in operating its business.

Respond to requests and manage business relationships. This includes answering inquiries, scoping an assessment, scheduling demonstrations, communicating with customer and prospective-customer contacts, and managing contracts. Where required, the legal basis is performance of a contract, pre-contract steps, consent, or ClimaTwin’s legitimate interests in administering business relationships and responding to requests.

Analyze and improve performance. This includes diagnosing errors, measuring technical performance, understanding use of the Sites where permitted, conducting research, and improving content, functionality, and services. Where required, ClimaTwin relies on consent for optional technologies and otherwise on its legitimate interests in improving and securing its services.

Protect ClimaTwin and others. This includes authenticating users, securing systems, detecting misuse, preventing fraud, investigating incidents, enforcing terms, and protecting rights, property, and safety. Where required, the legal basis is ClimaTwin’s legitimate interests in security and fraud prevention, compliance with legal obligations, or the establishment, exercise, or defense of legal claims.

Meet legal and compliance obligations. This includes maintaining required records, responding to valid legal process, conducting audits, and complying with tax, accounting, sanctions, employment, privacy, and other legal obligations.

Recruit. This includes evaluating applications, conducting interviews, communicating with applicants, verifying qualifications where permitted, and administering recruiting. Where required, the legal basis is pre-contract steps, legitimate interests in recruiting qualified personnel, legal obligations, or consent.

Conduct corporate operations. This includes planning, reporting, due diligence, restructuring, financing, mergers, acquisitions, and asset transfers. Where required, the legal basis is legitimate interests in managing ClimaTwin’s business or compliance with legal obligations.

Honor choices and demonstrate compliance. This includes recording and applying consent, opt-outs, objections, restrictions, privacy requests, and suppression preferences. Where required, the legal basis is consent, legal obligation, or ClimaTwin’s legitimate interest in demonstrating compliance.

Where ClimaTwin relies on legitimate interests, it considers whether the processing is necessary and whether the person’s rights and interests outweigh ClimaTwin’s interests. A person may contact ClimaTwin for information about the legal basis applicable to a particular activity.

If information is needed to perform a contract, respond to a request, meet a legal requirement, or secure an account, declining to provide it may prevent ClimaTwin from completing the activity.

6. How ClimaTwin discloses personal information. ClimaTwin may disclose personal information to hosting, cloud, authentication, security, backup, and information-technology service providers.

ClimaTwin may disclose personal information to providers that support forms, communications, account administration, customer-relationship management, support, consent management, technical measurement, or recruiting.

ClimaTwin may disclose personal information to professional advisers and insurers, including lawyers, accountants, auditors, consultants, and insurance providers.

ClimaTwin may disclose personal information to the organization a person represents or to a ClimaTwin customer where the person interacts with ClimaTwin as an employee, representative, administrator, or authorized user.

ClimaTwin may disclose personal information to government authorities, courts, and other parties where disclosure is required by law or reasonably necessary to protect rights, safety, security, or legal interests.

ClimaTwin may disclose personal information to transaction participants, including potential purchasers, investors, lenders, and their advisers, in connection with a proposed or completed financing, merger, acquisition, reorganization, or transfer of assets.

ClimaTwin may disclose personal information to other recipients at the person’s direction or with the person’s consent.

Service providers acting on ClimaTwin’s behalf are contractually required to protect personal information and process it only for authorized purposes. Some recipients, such as professional advisers, may act as independent controllers under their own privacy notices.

ClimaTwin does not sell personal information or share personal information for cross-context behavioral advertising, as those terms are defined by the California Consumer Privacy Act. ClimaTwin did not sell or share personal information during the 12 months preceding the Published date.

7. Cookies and similar technologies. ClimaTwin uses cookies and similar technologies to operate and protect the Sites, remember privacy choices, and support other disclosed purposes. The Cookies and Similar Technologies Policy explains these technologies and the available choices.

As of October 1, 2026, ClimaTwin has not completed a verified production inventory of all cookies and similar technologies operating across climatwin.com and app.climatwin.com. Accordingly, this Policy does not represent that an optional category is unused. After completing a production scan, ClimaTwin will update the Cookies and Similar Technologies Policy to identify each active technology’s name, provider, domain, purpose, category, information stored or accessed, type, duration, covered service, and applicable provider notice.

Where consent is required, optional technologies remain off until the user makes an affirmative choice. Users can revisit their choices through the Cookie Settings control available on the relevant Site. Withdrawing consent stops future use of the affected optional technologies but does not affect processing that occurred before withdrawal.

Where applicable law recognizes an opt-out preference signal, including Global Privacy Control, ClimaTwin treats a valid signal as a request to opt out of processing covered by that law when the signal is relevant to a practice in which ClimaTwin engages. Recognizing a signal does not imply that ClimaTwin sells or shares personal information.

When optional third-party content is enabled, its provider may store or access information on the user’s device and receive information about the browser, device, visit, or interaction under its own privacy notice.

8. International transfers. ClimaTwin is based in the United States. ClimaTwin and its service providers may process personal information in the United States and other countries whose privacy laws may differ from those where the person is located.

Where applicable law restricts an international transfer, ClimaTwin implements and documents the lawful transfer mechanism or safeguard applicable to that transfer before it occurs. A person may contact ClimaTwin for information about safeguards applicable to their personal information. Information provided in response may be redacted as necessary to protect confidential or commercially sensitive information.

9. Retention. ClimaTwin retains personal information only for as long as reasonably necessary for the purpose for which it was collected, including to provide services, maintain security and continuity, comply with legal obligations, resolve disputes, demonstrate compliance, and enforce agreements. ClimaTwin considers the amount, nature, and sensitivity of the information; the risk of harm; the purpose of processing; and applicable legal, contractual, and limitation periods.

The following periods and criteria apply subject to documented legal holds and verified system configurations.

Website, server, diagnostic, and security logs. Routine website and diagnostic logs are scheduled for deletion after 90 days. Security, audit, and privileged-access logs are scheduled for deletion after 12 months. Incident-related records are retained until the investigation and any resulting legal, contractual, or regulatory matter are resolved.

Cookie, analytics, and similar identifiers. The lifetime of each active cookie or similar technology will be stated in the verified production inventory. Records of privacy choices are retained only as long as reasonably necessary to honor the choice, demonstrate compliance, resolve a claim, or meet a legal obligation.

Contact, assessment, sales, and general inquiry records. These records are retained for three years after the last meaningful interaction unless a customer relationship begins or a longer period is needed for a dispute, legal obligation, or legal hold.

Customer relationship, account, acceptance, contract, and support records. Account and relationship records are retained for the duration of the relationship. Routine support records are retained for three years after the ticket closes. Contracts, invoices, transaction records, and records needed for tax, accounting, audit, dispute, or enforcement purposes are retained for seven years after the relationship ends, or longer where required by law or legal hold. Records evidencing acceptance of applicable terms or policies may include the user or organization, exact accepted version, UTC date and time, acceptance method, and IP address or other limited technical information needed to establish the acceptance.

Applicant and recruiting records. Applicant information is retained during the recruiting process. If an applicant is not hired, the information is retained for two years after the position closes or the last applicant contact, whichever is later, unless a shorter period is required by law. A longer period may apply when the applicant separately agrees to future consideration or an active claim, investigation, or legal hold requires preservation.

Privacy requests, consent records, and compliance evidence. Privacy-request and response records are retained for at least 24 months after the request is closed. Consent and privacy-choice records are retained only as long as needed to apply the choice, demonstrate compliance, or resolve a claim, and no longer than five years after the choice expires, is withdrawn, or is replaced unless a longer period is legally required. Identity-verification documents are deleted when verification is complete unless an active dispute or legal obligation requires continued retention.

When retention ends, ClimaTwin deletes or deidentifies the information, subject to reasonable backup cycles and legal holds. ClimaTwin may retain a minimal suppression or choice record where necessary to honor an ongoing privacy preference.

10. Security. ClimaTwin uses administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, use, alteration, loss, or disclosure. Safeguards are selected in light of the nature of the information and the risks involved.

No Internet transmission, system, or storage method can be guaranteed to be completely secure. Use care when sending information electronically, and do not send sensitive information through an unsecured channel unless ClimaTwin requests it and provides an appropriately protected method.

11. Privacy rights and choices. Depending on location and applicable law, a person may have the right to know whether and how ClimaTwin processes personal information; access or receive a copy; correct inaccurate information; request deletion; restrict or object to processing; obtain portable data; withdraw consent; appeal a denial; and lodge a complaint with a privacy or data-protection authority. Applicable law may also provide rights concerning sale, sharing, targeted advertising, sensitive personal information, or covered automated decision-making.

These rights are not absolute. Exceptions may apply where information is needed to perform a contract, protect security, comply with law, preserve legal claims, protect another person’s rights, or complete another permitted activity.

To exercise an applicable privacy right, select Submit a Privacy Request or email support@climatwin.com. Identify the right you wish to exercise and the relationship through which ClimaTwin may know you.

ClimaTwin may need to verify identity and authority before completing a request. ClimaTwin requests only information reasonably necessary for verification. If it cannot verify a request, ClimaTwin explains the limitation where permitted. ClimaTwin responds within the period required by applicable law and generally does not charge a fee unless applicable law permits one.

ClimaTwin does not currently sell personal information or share personal information for cross-context behavioral advertising. If ClimaTwin’s practices change, it will provide any required notice and opt-out mechanism before beginning the covered processing.

12. Regional information. European Economic Area and United Kingdom. If applicable data-protection law covers ClimaTwin’s processing, a person may have rights of access, correction, erasure, restriction, objection, portability, consent withdrawal, and protection from certain decisions based solely on automated processing. A person may object at any time to processing for direct marketing. If processing is based on legitimate interests, the person may object based on the particular situation. A person may lodge a complaint with the data-protection authority where the person lives, works, or believes a violation occurred.

Switzerland. If Swiss data-protection law covers ClimaTwin’s processing, a person may have rights to information, access, correction, deletion, data portability, and review of certain automated individual decisions, subject to applicable conditions and exceptions. A person may complain to the Swiss Federal Data Protection and Information Commissioner.

Canada. If applicable Canadian federal or provincial privacy law covers ClimaTwin’s processing, a person may request access to personal information ClimaTwin holds about them, ask how it has been used or disclosed, challenge its accuracy and completeness, request correction, and withdraw consent subject to legal or contractual restrictions and reasonable notice. Concerns may be submitted to ClimaTwin’s Privacy Officer at support@climatwin.com. A person may also have the right to complain to the Office of the Privacy Commissioner of Canada or an applicable provincial regulator.

Other United States jurisdictions. Residents of certain states may have rights to confirm processing, access, correct, delete, or obtain a portable copy of personal information and to opt out of sale, targeted advertising, or profiling in furtherance of decisions that produce legal or similarly significant effects. Where state law provides a right to appeal, instructions for appealing appear in ClimaTwin’s response to a denied request. An authorized agent may be used where permitted by law.

13. California Privacy Notice. This section supplements the rest of this Policy for California residents. It applies only to the extent the California Consumer Privacy Act, as amended (“CCPA”), covers ClimaTwin and the relevant information.

Notice at collection. At or before collecting personal information, ClimaTwin provides or links to a notice identifying the categories of personal information to be collected, the purposes for which they will be used, and whether they are sold or shared. This Policy provides additional detail.

Categories collected, sources, purposes, and disclosures. During the 12 months preceding the Published date, ClimaTwin collected the categories below, depending on the person’s interaction, and disclosed them for the listed business purposes.

Identifiers. Examples include a name, business email address, telephone number, IP address, account identifier, device identifier, or cookie identifier. Sources include the person, the person’s organization, automatic collection, and service providers. Purposes include Site and service operation, communications, relationship management, security, and compliance. ClimaTwin disclosed identifiers for business purposes to hosting, information-technology, security, form, communications, customer-relationship-management, technical-measurement, and professional-adviser recipient categories, and to the person’s organization where appropriate.

California customer-record information. Examples include contact details, signature, account information, and business-relationship information. Sources include the person, the person’s organization, contracts, and communications. Purposes include contracting, account administration, support, compliance, and relationship management. ClimaTwin disclosed this information for business purposes to cloud, account-administration, support, customer-relationship-management, and professional-adviser recipient categories, and to the person’s organization where appropriate.

Commercial information. Examples include services considered, requested, purchased, or used and customer or support history. Sources include the person, the person’s organization, and ClimaTwin’s records. Purposes include assessment, sales, service delivery, support, planning, and reporting. ClimaTwin disclosed commercial information for business purposes to cloud, support, customer-relationship-management, communications, and professional-adviser recipient categories.

Internet or electronic-network activity. Examples include requested pages and functions, referring page, timestamps, session events, browser and device information, diagnostics, and security events. Sources include automatic collection through the Sites’ infrastructure and active technologies. Purposes include Site operation, technical measurement, security, troubleshooting, and consent management. ClimaTwin disclosed this information for business purposes to hosting, security, consent-management, and technical-measurement recipient categories.

Geolocation information. This is limited to approximate location inferred from an IP address. Sources include automatic collection and service providers. Purposes include security, localization, technical measurement, and diagnostics. ClimaTwin disclosed this information for business purposes to hosting, security, and technical-measurement recipient categories.

Professional or employment-related information. Examples include employer, title, role, professional responsibilities, employment history, resume, qualifications, and references. Sources include the person, the person’s organization, and service providers. Purposes include business-relationship management, recruiting, assessment, sales, and support. ClimaTwin disclosed this information for business purposes to customer-relationship-management, recruiting, communications, cloud, and professional-adviser recipient categories, and to the person’s organization where appropriate.

Sensitive personal information. Account credentials, applicant information, or legally required records may include limited sensitive personal information. ClimaTwin uses and discloses sensitive personal information only for purposes permitted without a right to limit and does not use or disclose it for purposes that trigger the CCPA right to limit use and disclosure.

ClimaTwin does not intentionally collect biometric information or nonpublic education records through the Sites. ClimaTwin does not request sensitive personal information through general Site forms. Applicant, account-security, or legal processes may involve limited sensitive information when necessary and subject to appropriate notice and safeguards.

Sale and sharing. ClimaTwin does not sell personal information or share personal information for cross-context behavioral advertising, as those terms are defined by the CCPA. ClimaTwin did not sell or share personal information during the 12 months preceding the Published date. ClimaTwin does not knowingly sell or share the personal information of consumers under 16 years of age.

California rights. Subject to applicable exceptions, a California resident may request access to categories or specific pieces of personal information; information about sources, purposes, and recipients; correction; deletion; or a portable copy. A California resident may also exercise any applicable right concerning sale, sharing, sensitive personal information, or covered automated decision-making technology. ClimaTwin does not discriminate or retaliate against a person for exercising a CCPA right.

A California resident may submit a request by selecting Submit a Privacy Request or emailing support@climatwin.com. ClimaTwin may verify identity by matching information provided with information already held. A request concerning sale or sharing does not require identity verification, although ClimaTwin may request information needed to apply the preference.

An authorized agent may submit a request where permitted by law. ClimaTwin may require proof of the agent’s authority and may ask the resident to confirm the request directly, except where the agent has a legally valid power of attorney.

Where applicable law recognizes an opt-out preference signal, including Global Privacy Control, ClimaTwin treats a valid signal as a request to opt out of processing covered by that law when the signal is relevant to a practice in which ClimaTwin engages. Recognizing a signal does not imply that ClimaTwin sells or shares personal information.

14. Artificial intelligence and automated decisions. The ClimaTwin Platform analyzes climate, geospatial, asset, portfolio, operational, and financial scenario information to support business decisions concerning infrastructure and assets. Its model-generated estimates, scores, summaries, forecasts, and recommendations support decisions about infrastructure and assets; they are not designed to evaluate an individual or make a decision concerning an individual.

If personal information covered by this Policy is processed through an AI-assisted or automated tool, that processing remains subject to this Policy, applicable contracts, and applicable law. ClimaTwin will not use personal information for a materially different AI-related purpose without first providing any notice or choice required by law. Customer-directed processing remains governed by the customer’s instructions, agreement, and privacy notice.

The Sites and Platform are not designed to make decisions concerning an individual’s employment, credit, housing, insurance eligibility, education admission, or access to essential services. Before ClimaTwin uses automated decision-making technology to make or substantially facilitate a decision that produces legal or similarly significant effects concerning an individual, ClimaTwin will provide the notices and rights required by applicable law.

15. Children’s privacy. The Sites and ClimaTwin’s business services are not directed to children. ClimaTwin does not knowingly collect online personal information from children under 13 and does not knowingly permit use of the Sites or services by anyone under 16.

If a person believes a child has provided personal information to ClimaTwin, email support@climatwin.com. ClimaTwin investigates and takes appropriate action, including deletion where required.

16. Third-party services and links. The Sites may link to or display services operated by third parties. Their privacy practices are governed by their own notices. A link does not mean that ClimaTwin controls or endorses the third party’s privacy practices. Review the applicable privacy notice before providing information.

17. Changes to this Policy. ClimaTwin may update this Policy to reflect changes in its practices, services, technologies, or legal obligations. ClimaTwin will post the revised Policy and update the Last reviewed date. If a change materially affects how ClimaTwin uses personal information, ClimaTwin will provide additional notice or obtain consent where required before beginning the materially different processing.

18. Contact. Questions, complaints, and privacy requests may be submitted to ClimaTwin Corp.’s Privacy Officer at support@climatwin.com or through Submit a Privacy Request.

Do not send highly sensitive personal information through ordinary email.