HUMBERHEAD SOLAR LIMITED – PRIVACY NOTICE

Last updated: August 2026

Humberheard Solar Limited (the “Project Entity”, “we”, “us” or “our”) is committed to protecting and respecting your privacy.

This privacy notice explains how and why we collect, use and process personal data relating to individuals in connection with Humberhead Solar (the “Project”). This may include, without limitation, visitors to our website; landowners or occupiers; land agents; statutory consultees; members of the community; individuals participating in consultation activities; business partners; suppliers; contractors; consultants; investors; and other stakeholders.

It also describes your data protection rights, including your right to object to certain processing which we carry out. More information about your rights and how to exercise them is set out in Section 9 (“What rights you have”).

At the Project Entity we take your privacy very seriously and this privacy notice outlines how we will collect, hold and process your personal data under UK data protection laws, including the Data Protection Act 2018 and the UK General Data Protection Regulation (“Data Protection Legislation”).

1. Who we are

1.1 The legal entity responsible for the processing of your personal data Humberhead Solar Limited, Unit 25.7 Coda Studios, 189 Munster Road, London, England, SW6 6AW, company number 13290216

The Project Entity is the data controller of personal data provided by you or collected about you in connection with the Project.

2. The data we collect about you and how we collect it

2.1 We may collect, use, store and transfer different kinds of personal data about you when you interact with us, the Project and/or our website. The categories of data we collect, hold and process will depend on our relationship and interactions with you, so not all categories described below will apply to all individuals.

We may also receive personal data about you from third parties and publicly available sources in connection with the development, delivery and operation of the Project.

2.2 The personal data we collect

We may collect and process different types of personal data depending on your relationship and interactions with us. This may include:

2.2.1 Identity and contact information, such as your name, date of birth, occupation, nationality, address, telephone number, email address, company name and number, information about the organisation you represent and, where relevant, information relating to your family, solicitors or other related parties;

2.2.2 Property information, including information about property ownership, occupation, interests in land, mortgages and other information relevant to the development, delivery and operation of the Project;

2.2.3 Business information, including information about your business, professional role and business activities;

2.2.4 Communications and meeting information, including correspondence with us and, where meetings are recorded or transcribed, audio or video recordings, transcripts, chat messages, shared content and AI-generated meeting summaries;

2.2.5 Website and device information, including information about the device and browser you use to access our website and information collected through cookies and similar technologies;

2.2.6 Marketing and preference information, including your communication preferences and any consents you have provided; and

2.2.7 Special Category Data, which may include information relating to health, disabilities or other protected characteristics where this is provided to us or its processing is necessary in connection with the Project, our legal obligations or our relationship with you. We will only process Special Category Data where a valid condition under applicable Data Protection Legislation applies.

2.3 How we collect your personal data

We may collect personal data directly from you when you communicate or engage with us, use our website, subscribe to communications, attend meetings, events or consultations, complete a Land Interest Questionnaire, provide feedback or enquiries, or otherwise interact with us in connection with the Project.

We may also obtain personal data from third parties and publicly available sources, including our consultants, environmental consultants, land agents and land referencers, legal advisers, suppliers and business partners, vetting and verification providers, government and local authorities, statutory undertakers, public bodies, public registers and other publicly available sources.

For example, we may engage land referencing agents to identify and obtain land-related rights required to develop and deliver the Project. They may contact you on our behalf about the Project, enquire about any rights or obligations you may have, put you in contact with us and share your details with us.

We may also collect information from public records and other sources such as the Land Registry, Companies House, the electoral roll, Experian 192, the Charity Commission, the Financial Conduct Authority, TraceIQ and the BT Directory, equivalent or similar registers applicable in Scotland and Wales, online registers, websites of organisations, general internet searches and other persons with a legal or beneficial interest in relevant land.

We may combine personal data received from these sources with personal data you provide to us and personal data we otherwise collect about you.

2.4 If you provide information to us about another person, you must ensure that they understand how their information will be used and that you are permitted to disclose their information to us and allow us and our service providers to use it in accordance with this notice.

3. How do we use this information and what is the legal basis for this use?

3.1 We may use your personal data for the following purposes, depending on our relationship and interactions with you.

3.1.1 Project, land and stakeholder engagement

We may use your personal data to identify and communicate with landowners, occupiers and other stakeholders; carry out enquiries into land ownership, occupation and land values or compensation; obtain and manage land rights; arrange and manage leases and payments; conduct surveys; undertake consultation and stakeholder engagement; respond to enquiries, comments and complaints; and otherwise support the development, delivery and operation of the Project.

This may include consultation and engagement required under applicable planning legislation and reporting to relevant authorities, including the Secretary of State, Planning Inspectorate, Scottish Ministers, the Scottish Government's Directorate for Planning and Environmental Appeals, Welsh Ministers, Planning and Environment Decisions Wales and relevant local authorities.

Where required as part of a planning or consenting process, personal data may be provided to relevant authorities and, in certain circumstances, may be required to be published.

We process this information where necessary to comply with our legal obligations, to enter into or perform a contract with you, and/or where necessary for our legitimate interests in developing, managing and operating the Project and engaging effectively with relevant stakeholders.

3.1.2 Contracts and land-related rights

We may process your personal data where you make an enquiry about leasing, selling or agreeing other rights or obligations in respect of land that you own or occupy in connection with the Project.

This may include verifying your identity; communicating and negotiating with you; arranging leases, land rights and payments; managing leases and other agreements; and arranging or managing access to land.

We process this information where necessary to take steps at your request before entering into a contract, to enter into or perform a contract with you, to comply with our legal obligations and/or for our legitimate interests in developing and delivering the Project.

3.1.3 Compliance, due diligence and legal purposes

We may process personal data for identity verification, due diligence and verification, fraud prevention, regulatory compliance, investigations, audits and the establishment, exercise or defence of legal claims.

We may also process personal data where necessary to respond to requests from government, regulatory or law enforcement authorities.

We process this information where necessary to comply with our legal and regulatory obligations and/or for our legitimate interests in protecting the Project Entity, managing risk and ensuring appropriate compliance and governance.

3.1.4 Investors, funding and corporate transactions

We may use personal data to manage investor relationships, discuss or obtain funding for the Project, communicate with potential purchasers or investors and evaluate or carry out a merger, acquisition, restructuring, reorganisation, sale or other corporate transaction involving all or part of the Project Entity's business or assets.

We process this information where necessary for our legitimate interests in managing our business, obtaining funding, managing investor relationships and evaluating or completing corporate transactions.

3.1.5 Meetings, communications and AI-enabled technologies

We may process information obtained through meetings, correspondence and other interactions with you, including where meetings are recorded, transcribed, summarised or analysed using AI-enabled technologies.

Further information about our use of AI, including Fathom AI, Microsoft Copilot and other AI tools, agents, models or services, is provided in Section 4 (“Use of AI technology”).

We process this information where necessary for our legitimate interests in maintaining appropriate business and Project records, facilitating collaboration, improving our operations and managing our relationships with stakeholders, suppliers, business partners and other parties.

3.1.6 Website operation and improvement

We may process information about your use of our website and devices to operate, protect, monitor and improve our website, provide an appropriate user experience and understand how our website is used. This may include the use of cookies and similar technologies.

We process this information on the basis of our legitimate interests in operating, securing and improving our website and, where required by applicable law, your consent.

3.1.7 Marketing and communications

Where appropriate, we may use your contact details and preferences to send you information about the Project, consultation activities, events, investor materials and other communications which may be of interest to you.

We will rely on your consent where required by law. In other circumstances, we may rely on our legitimate interests where permitted to do so. You can object to or opt out of direct marketing at any time.

3.1.8 Compulsory acquisition and statutory processes

Where an order has been made under the Planning Act 2008 or other applicable legislation authorising the Project Entity to construct, operate, maintain and/or decommission the Project, we may process additional personal data about you in connection with the exercise of compulsory acquisition powers.

Although the Project Entity may seek to acquire necessary land, interests and rights by agreement, certain interests may need to be compulsorily acquired in order for the Project to be delivered. As part of that process, we may be required to request information from people and organisations with a legal or beneficial interest in affected land in order to establish whether they may be entitled to compensation.

Where applicable, we may process personal data:

• to comply with our legal obligations under the relevant order, the Planning Act 2008, the Compulsory Purchase Act 1965 and the Compulsory Purchase (Vesting Declarations) Act 1981;

• to contact you regarding the acquisition of land or rights over land and any compensation payable;

• to prepare documents required by law, including a General Vesting Declaration, which may be registered at the Land Registry and become publicly available;

• to notify you of the making of a General Vesting Declaration;

• to serve a Notice to Treat or Notice of Entry; and

• where applicable, to share mortgage information or references with lenders or mortgagees to enable relevant information to be verified.

We process this information where necessary to comply with our legal obligations and to exercise statutory powers relating to the development and delivery of the Project.

3.1.9 Special Category Data

In general, we will not proactively seek to collect Special Category Data and do not expect consultation responses routinely to contain such information. However, in limited circumstances you may voluntarily provide information concerning, for example, your health, disability or other protected characteristics when engaging with us.

We may use Special Category Data where necessary to manage our relationship with you or for purposes such as environmental, equality or other impact assessments relating to the Project.

Where any of the activities described in this notice involve Special Category Data, we will only process such information where an appropriate condition under Article 9 of the UK GDPR and, where applicable, Schedule 1 of the Data Protection Act 2018 applies. Depending on the circumstances, this may include where you have provided explicit consent, where processing is necessary for reasons of substantial public interest, to comply with applicable legal obligations, or for the establishment, exercise or defence of legal claims.

Where consultation responses containing Special Category Data are required to be retained and provided to the Secretary of State under applicable planning legislation, we may process such information on the basis that processing is necessary for reasons of substantial public interest.

3.2 We have carried out balancing tests for the data processing we carry out on the basis of our legitimate interests described above. You can obtain information about our balancing tests by contacting us using the details set out in Section 11 (“Contacting us”).

3.3 Wherever we rely on your consent, you will be able to withdraw that consent, although we may have other legal grounds for processing your data for other purposes.

You have an absolute right to opt out of direct marketing, or profiling carried out for direct marketing purposes, at any time. You can do this by following the instructions contained in an electronic communication or by contacting us using the details set out in Section 11 (“Contacting us”).

3.4 We will only use your personal data for the purpose for which it is collected, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose.

If we need to use your personal data for an unrelated purpose, we will notify you and explain the legal basis which allows us to do so.

4. Use of AI technology

4.1 From time to time, we may process your personal data using artificial intelligence (“AI”) and other similar technologies, including generative artificial intelligence (“GenAI”), to support the development, delivery and operation of the Project and our related business activities and internal operations.

This may include third-party AI services, such as Fathom AI (which may be used to record, transcribe and generate summaries of meetings), AI tools made available through the Microsoft Copilot environment, and other AI-enabled tools, agents, models or services that we may use or enable from time to time.

Such functionality may be provided within our existing technology environments or through other third-party platforms and services. Our use of AI may therefore evolve as new AI tools, agents, models and functionality become available.

4.2 Should you wish to object to the use of Fathom AI, you can ask the meeting host not to enable recording or transcription. Objections will be considered by us but may not always be accepted, depending on the circumstances of the meeting. We will provide details of the appropriate reasons for recording or transcription in response to any objections.

You may choose to keep or turn off your microphone or camera, or leave the meeting at any point, but this may result in you not being able to participate fully in a meeting or event.

4.3 Where we use AI systems, including AI tools, agents, models or AI-enabled services, we will ensure that their use is appropriately assessed and subject to applicable data protection requirements, appropriate security and access controls and, where appropriate, human oversight.

Depending on the particular AI tool, agent, model, service or functionality being used, personal data may be transferred to, accessed from or otherwise processed in the United States or another jurisdiction outside the UK or European Economic Area (“EEA”).

Where personal data is transferred outside the UK or EEA, we will ensure that appropriate safeguards and lawful transfer mechanisms are in place in accordance with applicable Data Protection Legislation, as further described in Section 6 (“How we store information and international transfers”).

4.4 If you have concerns about your personal data being processed using AI tools, or wish to object to such processing, please contact us using the details set out in Section 11 (“Contacting us”).

5. Who will we share your data with, where and when?

5.1 We may share your personal data with companies within the Island Green Power group and with professional advisers and external technical consultants, including communications consultants, environmental consultants, land agents, land referencers, surveyors and legal advisers, where necessary in connection with the development, planning, delivery and operation of the Project.

5.2 Personal data may be shared with government bodies, planning and other relevant authorities, regulators and/or law enforcement officials where required for the purposes described in this notice, where mandated or permitted by law, or where required for the legal protection of our legitimate interests.

5.3 Personal data may also be shared with outsourced third-party service providers who process personal data on our behalf for the purposes identified above. This may include providers supporting IT services and support, website hosting and maintenance, data storage, compliance and verification activities and other technology services.

Personal data, including information captured during recorded meetings or interactions, may be shared with Fathom AI for the purpose of recording, transcribing and generating meeting summaries. Personal data contained in meetings or meeting summaries may also be shared with other parties who reasonably require that information, including other companies within the Island Green Power group. Fathom AI processes personal data on our behalf under appropriate data protection arrangements.

We may also process personal data through Microsoft Copilot and other approved AI- enabled tools, agents, models or services as described in Section 4.

5.4 In the event that the Project Entity, Project or relevant business or assets are sold, transferred or integrated with another business, personal data may be disclosed to our advisers, prospective purchasers and their advisers and may subsequently be transferred to the new owner.

5.5 We will not rent or sell your personal data to third parties without your consent.

6. How we store information and international transfers

6.1 In general, the personal data that we collect from you will be stored and processed within the UK or European Economic Area (“EEA”).

However, we may also transfer, store, access or otherwise process your personal data outside the UK or EEA where we use external platforms, service providers or technology solutions, including AI-enabled tools, agents or models.

The location of processing may vary depending on the particular service or functionality being used and may include the United States or other jurisdictions outside the UK or EEA.

6.2 Some countries outside the UK or EEA may provide a lower standard of protection for personal data, including different security requirements and fewer rights for individuals.

Where your personal data is transferred, stored and/or otherwise processed outside the UK or EEA, we will take appropriate steps to ensure that your personal data is treated securely and in accordance with this notice.

When personal data is transferred internationally to a country that is not recognised as providing an adequate level of protection by the European Commission or the UK Secretary of State, we will rely on an appropriate lawful transfer mechanism, such as applicable standard contractual clauses approved by the European Commission or UK Government.

7. Data security

7.1 We take care to ensure the security of your personal data in use, storage and transmission and that it is only accessed by verified persons who have the necessary authority. All personnel who have access to personal data are legally and contractually obliged to respect the confidentiality of this information and we provide appropriate training to support this.

7.2 We have in place appropriate policies, rules and technical and organisational measures to protect your personal data from unauthorised or unlawful processing and against accidental loss, destruction or damage.

8. Retention of personal data

8.1 We will retain your personal data only for as long as we need it for the purposes set out in this notice, except where we need to retain it for longer to comply with legal obligations, statutory requirements or to establish, exercise or defend legal claims.

At the end of the applicable retention period, we will take steps to delete your personal data or hold it in a form that no longer identifies you.

8.2 Where we process personal data for marketing purposes or with your consent, we process the data until you ask us to stop and for a short period afterwards to allow us to implement your request.

We may also retain a record that you have asked us not to send you direct marketing or otherwise process your data in a particular way so that we can respect your request in the future.

8.3 Personal data relating to the Project, land interests, consultation, planning or compulsory acquisition may need to be retained for longer periods where required by applicable planning, property or other legal requirements, or where necessary in connection with the development, construction, operation or decommissioning of the Project.

9. What rights you have

9.1 You have a number of rights under the Data Protection Legislation in relation to the way we process your personal data. You may contact us using the details at the end of this privacy notice to exercise any of these rights.

Right to be informed

You have the right to be informed about the personal data we hold about you and how we use it.

Right of access

You have the right to request access to the personal data we hold about you.

Right to rectification

You have the right to require us to correct any inaccurate or incomplete personal data we hold about you.

Right to erasure

You have the right, in certain circumstances, to ask us to delete the personal data we hold about you. This may apply, for example, where:

• we no longer need your personal data for the purpose for which it was collected;

• you withdraw your consent where we rely on consent to process your personal data; or

• you successfully object to our processing of your personal data.

Right to restrict processing

You have the right, in certain circumstances, to ask us to restrict the processing of your personal data. This may apply, for example, where:

• you dispute the accuracy of the personal data we hold about you;

• you would otherwise have the right to ask us to delete the personal data but would prefer that its use is restricted; or

• we no longer need the personal data for the purposes for which it was collected, but you require it for the establishment, exercise or defence of legal claims.

Right to data portability

In certain circumstances, you have the right to receive personal data that you have provided to us in a structured, commonly used and machine-readable format.

You may also have the right to ask us to transfer that personal data directly to another organisation, where technically feasible.

Rights in relation to automated decision-making and profiling

You have the right, in certain circumstances, not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

We do not currently carry out solely automated decision-making or profiling of this nature.

Right to withdraw consent

Where we rely on your consent to process your personal data, you have the right to withdraw that consent at any time. Withdrawal of consent will not affect the lawfulness of processing carried out before your consent was withdrawn.

9.2 You also have the right to object to processing of your personal data as follows:

• If processing of your personal data is based on it being necessary to comply with a legal obligation or for legitimate interests, you have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal data.

• Where your personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data about you for such marketing.

9.3 There may be conditions or limitations on these rights. It is therefore not certain, for example, that you will have the right to data portability in every case, as this depends on the specific circumstances of the processing activity.

9.4 If you have any concerns regarding our processing of your personal data, are not satisfied with our handling of any request made by you, or would otherwise like to make a complaint, please contact the Project Entity in the first instance using the details set out in Section 11 (“Contacting us”) so that we can seek to resolve the matter.

9.5 You have the right to make a complaint at any time to the Information Commissioner's Office (“ICO”), the UK supervisory authority for data protection issues.

The ICO can be contacted by telephone on 0303 123 1113; by post at Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF; or by email at casework@ico.org.uk.

If you are based in the EU, you may also have the right to contact the relevant data protection supervisory authority in the country in which you are based.

10. Changes to this privacy notice

We will keep this notice under regular review. Any changes we make to this notice in the future will be published on the relevant Project website.

11. Contacting us

If you have any queries, comments or requests regarding this notice, or would like to exercise any of your rights set out above, you can contact us:

• by post at Humberhead Solar Limited, Unit 25.7 Coda Studios, 189 Munster Road, London, England, SW6 6AW; or

• by email at info@humberheadsolar.co.uk

Review date: August 2026