Privacy Policy – Green SM

Green SM Denmark ApS, and Green SM Sweden AB (“GSM Europe”) are part of the Green and Smart Mobility Joint Stock Company group of companies ("Green and Smart Mobility", "GSM", "we", "us", or "our"). When processing users' personal data, GSM Europe and the local GSM company act as joint data controllers, meaning they jointly determine the purposes and means of processing. The country-specific joint data controller for Denmark is: Green SM Denmark ApS Rådhuspladsen 16 1550 Copenhagen V Denmark Business reg. no.: 46406583 If you have questions about how we handle your personal data, please see Section 9 below.

We only process personal data to the extent necessary and appropriate for the specific processing purpose. The personal data we collect and process falls into two broad categories. Data you provide to us. Our website includes a driver recruitment application and a contact form for business partnership enquiries. Depending on which form you submit, we may collect the following personal data: • Full name • Phone number • Email address • City of residence • Vehicle ownership status • Driving experience • Preferred financing package • Contact details of the relevant contact person at your organisation • Details of the proposed cooperation or partnership Data generated automatically when you visit our website. When you visit our website, certain technical data is collected automatically to ensure the website operates correctly and securely. This includes: • IP address • Browser type and version • Device type and operating system • Language settings • Date and time of access • Pages visited • Cookie consent preferences (recorded as evidence of the consent you have given or refused, in accordance with applicable data protection law) We also use cookies and similar technologies to collect and store information — please see Section 4 below for more details.

We process your personal data only to the extent that it is necessary and appropriate for the specific purpose. To receive and manage driver recruitment applications and business partnership enquiries: We use the personal data you submit through our website forms to receive, review and manage your application or enquiry, and to communicate with you in connection with it. We rely on our legitimate interests in operating and developing our business. Where we rely on legitimate interests, we balance our interests against your right to privacy, and you have the right to object to processing carried out on this basis. To ensure the security and stable operation of our website: We use technical data collected automatically when you visit our website — such as IP address, device information and browsing data — to maintain, protect and improve our website, and to detect and prevent malicious activity, spam and automated attacks. We rely on our legitimate interests in keeping our website secure and operational. For analytics: Where you have given your consent, we use performance and analytics cookies (via Google Analytics) to collect aggregated statistical information about how our website is used. This helps us understand visitor behaviour and improve our website. You may withdraw your consent at any time through the Cookie Consent Banner on our website. For advertising and marketing: Where you have given your consent, we use targeting and advertising cookies (via platforms such as Google Ads and Meta/Facebook) to measure the effectiveness of our advertising campaigns and to deliver relevant content to you. You may withdraw your consent at any time through the Cookie Consent Banner on our website. To comply with our legal obligations: We record your cookie consent preferences as evidence of the consent you have given or refused, as required by applicable data protection law. We process this data to comply with our legal obligations. To direct you to the appropriate language version of our website: We use your IP address and browser language settings to automatically redirect you to the most appropriate language version of our website. We rely on our legitimate interests in providing a relevant and user-friendly website experience.

Our website uses cookies and browser storage technologies to support website functionality, security, and analytics. Cookies are small text files placed on your device when you visit a website. They enable the website to remember information about your visit and make it easier and more useful for you. We use four categories of cookies: strictly necessary cookies, which are essential for the operation and security of the website and cannot be disabled; functional cookies, which remember your preferences such as language settings; performance and analytics cookies, which collect aggregated information about how visitors use our website (via Google Analytics), subject to your consent; and targeting and advertising cookies, which are used to measure the effectiveness of advertising campaigns and deliver relevant content to you, subject to your consent. When you first visit our website, you will be presented with a Cookie Consent Banner that allows you to accept, reject, or customise your cookie preferences. You may modify or withdraw your consent at any time through the cookie preference settings available on our website. Please note that disabling certain cookies may affect the functionality of the website.

We share your personal data only where necessary and in accordance with applicable law. With our service providers: We may share personal data with carefully selected third-party service providers who process data on our behalf under our instructions and pursuant to data processing agreements. These include providers of cloud storage and hosting, customer support, security and anti-fraud tools (including Google reCAPTCHA Enterprise), analytics, and marketing and advertising technology (including Google and Meta/Facebook, subject to your consent where required), as well as legal, accounting and professional services. For legal reasons: We may disclose your personal data to public authorities, law enforcement agencies, courts, or regulatory bodies where required by applicable law, regulation, or court order, or where necessary to protect the rights, safety, or property of Green and Smart Mobility, our users, or others.

Green and Smart Mobility operates in Europe and aims to process your personal data within the EEA wherever possible. That said, as an organisation with service providers and affiliated entities across multiple regions, it may be necessary to transfer or process your personal data in jurisdictions outside the European Economic Area or your country of residence. GSM is committed to ensuring that your personal data receives an appropriate level of protection wherever it is processed. Where transfers outside the European Economic Area are required, GSM implements suitable safeguards to protect your data, including through agreements with service providers based on the Standard Contractual Clauses or other recognised transfer mechanisms.

GSM does not retain your personal data for longer than is permitted under applicable law and necessary for the purposes described in this Notice or the relevant parts thereof. The retention period depends on the nature of the data and the purpose for which it is processed. The maximum period may therefore vary depending on the type of data and the use for which it is held. We continuously assess the retention periods applicable to personal data to ensure that data is only held for as long as is necessary for the relevant purpose.

You have the following rights in relation to your personal data. We will respond to all valid requests within one month. In complex cases, we may extend this period by a further two months, in which case we will inform you of the extension and the reasons for it. To exercise any of the rights below, please contact us using the details set out in Section 9. To protect your security, we may need to verify your identity before processing your request. Right of access. You have the right to obtain confirmation of whether we process personal data about you and, if so, to receive a copy of that data and information about how we use it. Right to rectification. You have the right to ask us to correct inaccurate or incomplete personal data we hold about you. Right to erasure. You have the right to ask us to delete your personal data in certain circumstances, for example where the data is no longer necessary for the purpose for which it was collected, or where you withdraw your consent and there is no other legal basis for processing. Right to restriction of processing. You have the right to ask us to restrict our processing of your personal data in certain circumstances, for example while we verify the accuracy of data you have contested. Right to data portability. Where processing is based on your consent or on a contract and carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format, and to request that we transmit it to another controller where technically feasible. Right to object. You have the right to object to processing of your personal data where we rely on legitimate interests. You also have an absolute right to object to the processing of your personal data for direct marketing purposes at any time, with immediate effect. Rights in relation to automated decision-making. You have the right not to be subject to solely automated decisions that produce a legal or similarly significant effect on you, unless certain conditions apply. Where such decisions do occur, you have the right to request human review. Right to withdraw consent. Where we process your personal data on the basis of your consent, you may withdraw that consent at any time, without affecting the lawfulness of processing carried out before the withdrawal. Right to lodge a complaint. You have the right to lodge a complaint with the competent data protection supervisory authority. In Denmark, this is Datatilsynet (the Danish Data Protection Agency): Carl Jacobsens Vej 35, 2500 Valby — www.datatilsynet.dk — dt@datatilsynet.dk.

If you have questions about this Privacy Notice or wish to exercise any of your data subject rights, please contact us at: privacy.eu@greensm.com We aim to resolve all queries and complaints promptly and fairly. If you are not satisfied with our response, you have the right to complain to Datatilsynet (see Section 8 above).