PRIVACY NOTICE

on the processing of personal data in the context of the webinar relating to France’s Energy Efficiency Certificate (CEE) scheme

Vertis Environmental Finance Ltd (“data controller” or “Vertis”), in accordance with Articles 13, 14 and 26 of the Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (“General Data Protection Regulation” or “GDPR”), hereby provides information on the processing personal data in the context of organising and holding a webinar to be organised in relation to France’s Energy Efficiency Certificate (CEE) scheme.

Identity and contact details of the data controller

Name of the controller: Vertis Environmental Finance Ltd.

Seat of the controller: 1124 Budapest, Csörsz utca 45., Hungary

Email: privacy@vertis.com

Data protection officer contact: vertis@dataprotection.eu

Purpose of the processing

Vertis is organising and, on the 29^th of January, 2026 holding jointly with its affiliated company STX Commodities B.V. (“STX”), a webinar (hereinafter the “Webinar”), with the aim of exploring the latest regulatory and market developments within France’s Energy Efficiency Certificate (CEE) scheme as it enters Phase 6.

In relation to the Webinar the following personal data will be processed:

For registering participants accepting the invitation, the data controller sends a form to record the personal data necessary for ensuring the participation.

The purpose of the data processing is therefore the proper organisation of the Webinar.

Based on information received during the Webinar, invitees may wish to extend their business connections and may wish to receive information on business opportunities from STX. For this, Vertis would share the contact information of the participant (including name of company he/she represents).

The purpose of such second data processing is therefore the forwarding of contact details of the participant to STX for STX contacting the participant in relation to potential business opportunities.

Legal basis for the processing

The legal basis of the data processing is (with respect to the purpose described under point 1 above) the legitimate interest of Vertis and STX in jointly holding the Webinar.

With respect to sharing your contact details with STX (see purpose described under point 2 above), the legal basis of the processing is the consent of the participant. Such consent may be provided on the registration form, or subsequently via email or other durable medium.

Provision of your personal data is not a statutory or contractual requirement in any case, including that it is not necessary to enter into a contract with you, and consequently, you are not obliged to provide the personal data requested at registration to the Webinar, however it may be necessary for ensuring your participation at the Webinar.

Personal data processed

For the above purposes, the data controller is processing the following personal data of the participant:

Full name;
Company/organisation represented
business email address,
other business contact details if available (in case data sharing with STX has been consented)

The period for which the personal data will be stored

Personal data collected explicitly for the organisation of the Webinar will only be stored until the Webinar takes place (or in case of consent to STX data sharing is withdrawn, if that happens earlier). We may however retain your name and company data for any post-event duties, and for keeping internal marketing records of the Webinar organised, for three years after the event.

In case of representatives/traders/contact persons of data controller’s clients, the data controller will keep on storing (and processing for other lawful purposes) the name, company, business contact data even after that period, for the data processing purposes relating to the client relationship.

Rights of the data subject

As a data subject, you can exercise, subject to the conditions as set out by the GDPR,

the right to access;
the right to rectification;
the right to erasure (right to be forgotten);
the right to restrict the processing

Where the legal basis of the processing is our legitimate interest, you can also object to the processing.

For that part of data processing where the legal basis of the processing is consent, you

can withdraw the consent at any time; however, the withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal;
have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from us.

Recipients of the personal data

In case you consent to the data sharing with STX as explained in point 2 of the “Purpose of the processing” part of this privacy notice, STX Commodities BV shall be the recipient of the data.

Data transfer to third countries / Automated decision making, including profiling

No data transfer to third countries is carried out by the data controller. Automated decision making, including profiling, does not occur in the context of the processing.

The right to lodge a complaint

As a data subject, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, if you consider that the processing of personal data relating to you infringes the GDPR. For a list of the data protection supervisory authorities, see https://edpb.europa.eu/about-edpb/about-edpb/members_en