Privacy Policy

---

Version 3.6
Effective Date:  1 August 2025
Last Reviewed: 20 July 2025

This Privacy Policy ("Policy") is a comprehensive, detailed, and exhaustive document intended to articulate, delineate, and otherwise explicate the ways in which STRATUS Energy Partners ("Company", "we", "us", or "our"), in its capacity as a Data Controller (as defined below), collects, processes, stores, transmits, safeguards, and/or otherwise engages with personal data belonging to individuals ("Data Subjects", "Users", "you", or "your") who access, browse, interact with, or otherwise utilise our website, accessible at www.stratusenergypartners.com (hereinafter referred to as the "Website").

By continuing to access, browse, navigate, submit information to, or otherwise engage with the Website, you signify your explicit, informed, unambiguous, and freely given agreement to the practices and procedures outlined in this Policy, which are implemented in accordance with the provisions, stipulations, requirements, and spirit of both the United Kingdom General Data Protection Regulation (UK GDPR) and the European Union General Data Protection Regulation (EU GDPR), collectively referred to as the "Applicable Law."

1. DEFINITIONS

For the purposes of this Policy, the following terms shall have the meanings assigned to them below:

• "Personal Data": any information relating to an identified or identifiable natural person.
   
• "Processing": any operation or set of operations performed on personal data, whether or not by automated means.
   
• "Data Subject": any natural person whose personal data is processed by the Data Controller.
   
• "Data Controller": the natural or legal person which determines the purposes and means of the processing of personal data.
   
• "Supervisory Authority": an independent public authority established under Article 51 of the GDPR.
   
• "Consent": any freely given, specific, informed, and unambiguous indication of the Data Subject’s wishes.
   
• "Website": the domain, subdomains, mobile versions, APIs, or associated services at [yourwebsite.com].
   

2. DATA CONTROLLER IDENTIFICATION

The Data Controller for purposes of the Applicable Law is STRATUS Energy Partners Ltd., reachable as registered in the UK Chamber of Commerce.

3. CATEGORIES AND TYPES OF PERSONAL DATA COLLECTED

We may collect, and have collected in the last 12 months, the following categories and types of personal data from or about you. This list is non-exhaustive and subject to expansion based on additional processing activities:

3.1. Data You Provide Voluntarily:

• Full name (including any middle names, initials, or suffixes)
• Email address(es)
• Contact phone number(s)
• Company or organisation name
• Billing and/or postal address
• Any other data you manually input via forms, email communications, surveys, or contractual documents
   

3.2. Data Collected Automatically:

• Internet Protocol (IP) address
• Device identifiers (e.g., MAC address, UUID)
• Browser type and version
• Operating system and platform
• Referrer URL
• Pages accessed, time spent, click patterns
• Date and time of access
• Session data, scroll behaviour, and mouse movement (where applicable)
   

3.3. Data from Third Parties (Where Applicable):

• Data brokers, business partners, or public records
• Social media platforms (if you connect via APIs or widgets)
• Analytics providers (e.g., Google Analytics) and marketing affiliates
   

4. LAWFUL BASES FOR PROCESSING

The legal justifications under which we process your personal data—individually or collectively—include, but are not limited to, the following:

1. Consent (Article 6(1)(a)): where you have given explicit, specific, freely given and informed agreement to the processing.
    
2. Contractual Necessity (Article 6(1)(b)): where processing is necessary for the performance of a contract with you or in order to take steps at your request prior to entering into a contract.
    
3. Legal Obligation (Article 6(1)(c)): where we are under a statutory or regulatory requirement to process your data.
    
4. Legitimate Interests (Article 6(1)(f)): where processing is required for the purposes of legitimate interests pursued by us or a third party, provided your fundamental rights do not override those interests.
    

Where special category data is processed (which we generally do not do), we will rely on Article 9 conditions and obtain explicit consent.

5. PURPOSES OF PROCESSING

Your personal data may be processed for multiple purposes, including, but by no means limited to:

• Facilitating access to and usage of our Website and its features 
• Communicating with you regarding your inquiries, requests, or accounts
• Conducting customer service and support activities
• Processing payments (if applicable)
• Sending marketing communications (only if you have opted in)
• Complying with applicable laws, regulations, judicial orders, and statutory obligations
• Monitoring, analysing, and enhancing the user experience
• Maintaining the integrity and security of our systems, networks, and platforms
   

6. DATA RETENTION AND STORAGE DURATION

We retain your personal data for no longer than is strictly necessary to achieve the specific purposes for which it was collected, unless a longer retention period is mandated by applicable legal, tax, or regulatory obligations.

The duration of retention shall vary depending on:

• The type of data
• The context of collection
• Statutory limitation periods
• Our internal data retention policies, which may be reviewed periodically and amended without prior notice
   

7. RECIPIENTS AND CATEGORIES OF RECIPIENTS OF PERSONAL DATA

Your personal data may be disclosed to and processed by the following categories of recipients:

• Internal personnel (limited to those with a legitimate need-to-know) 
• External service providers (data processors) who provide IT, hosting, email, analytics, or CRM services
• Legal, accounting, and compliance consultants
• Governmental, regulatory, or law enforcement authorities (where required by law)
• Third parties in the context of business restructuring, acquisition, or transfer of assets (subject to adequate safeguards)
   

All third-party processors are subject to contractual obligations to ensure data protection and confidentiality consistent with Applicable Law.

8. INTERNATIONAL TRANSFERS OF PERSONAL DATA

Where personal data is transferred beyond the territorial jurisdiction of the United Kingdom or the European Economic Area (EEA), we ensure that such transfers occur only:

• To countries that have been formally recognised by the UK or EU as providing adequate data protection,
  Or, subject to the execution of Standard Contractual Clauses (SCCs), International Data Transfer Agreements (IDTAs), or other lawful instruments ensuring appropriate safeguards.
   

A copy of these instruments may be made available to you upon written request, subject to redactions for commercial confidentiality.

9. YOUR RIGHTS UNDER THE UK/EU GDPR

As a Data Subject, you may exercise the following rights under Applicable Law:

• Right to Access – You may request confirmation and a copy of the personal data we hold about you. 
• Right to Rectification – You may request correction of inaccurate or incomplete data.
• Right to Erasure – You may request deletion of your data, subject to certain legal exceptions. 
• Right to Restriction of Processing – You may request that we temporarily or permanently stop processing your data.
• Right to Data Portability – You may request to receive your data in a machine-readable format or have it transmitted to another controller.
• Right to Object – You may object to our processing of your data, particularly for direct marketing or profiling.
• Right to Withdraw Consent – You may withdraw your consent at any time, with effect for the future.
• Right to Lodge a Complaint – You may file a complaint with a Supervisory Authority, including but not limited to:
   

United Kingdom
Information Commissioner’s Office (ICO)
Website: https://ico.org.uk

European Union
Contact your national data protection authority: https://edpb.europa.eu/about-edpb/board/members_en

All rights may be exercised by submitting a request in writing to our registered postal address. We may request additional information to verify your identity and will respond within the statutory timeframe.

10. SECURITY MEASURES

We implement, maintain, and continuously review reasonable, proportionate, and industry-standard technical and organisational measures to protect personal data. These may include:

• HTTPS (SSL/TLS) encryption
• Firewalls and access control protocols
• Periodic security audits and penetration testing
• Staff training on data protection best practices
• Data minimisation and pseudonymisation (where appropriate)

Nevertheless, no electronic transmission or digital storage mechanism is entirely immune from risk, and we therefore disclaim absolute guarantee of security.

11. CHILDREN’S DATA

This Website is not intended for, directed at, or designed to attract individuals under the age of 13 (or such higher age as required in your jurisdiction). We do not knowingly collect personal data from such individuals. If you believe we have inadvertently collected data from a minor, please contact us immediately to initiate deletion.

12. AUTOMATED DECISION-MAKING AND PROFILING

We do not engage in fully automated decision-making, including profiling, that produces legal or similarly significant effects on individuals as defined by Article 22 of the UK/EU GDPR.

13. COOKIES AND TRACKING TECHNOLOGIES

We use cookies, web beacons, pixels, and other tracking technologies in accordance with our Cookie Policy, which is incorporated herein by reference. You may configure or disable cookies through your browser settings. However, certain functions of the Website may not work properly without them.

 13.1. Purpose and Scope

The Cookie Policy ("Cookie Policy") is hereby incorporated by reference into and forms an inseparable component of the Privacy Policy ("Policy") set forth above. It outlines the types, purposes, and legal bases for the use of cookies and similar technologies and sets forth your rights as a user  in relation to such technologies under the United Kingdom General Data Protection Regulation (UK GDPR), the European Union General Data Protection Regulation (EU GDPR), the UK Privacy and Electronic Communications Regulations (PECR), and related legislative instruments, as updated, amended, or replaced from time to time.

13.2. Definition of Cookies

Cookies are small text files composed of alphanumeric characters that are placed on your device (e.g. computer, smartphone, tablet) by your web browser upon your accessing or navigating a website. Cookies serve various technical and functional purposes, including session management, preference storage, analytics, authentication, and advertising.

For the purposes of this Policy, the term “cookies” shall also encompass similar tracking technologies such as web beacons, pixel tags, local storage, and JavaScript objects, to the extent such technologies function analogously.

13.3. Categories of Cookies We Use

We utilise several different types of cookies, each with distinct purposes and durations. The following classification scheme is provided for maximum clarity:

a. Strictly Necessary Cookies

These cookies are essential for the Website to function and cannot be switched off in our systems. They are typically set in response to your actions (e.g. setting privacy preferences, logging in, filling in forms). Without these cookies, certain core functionalities may not be available.

b. Functional (Preference) Cookies

These cookies enable the Website to remember choices you make (such as language settings, region, or user preferences), thereby providing a more personalised experience.

• Example: language, theme 
• Lifespan: persistent
• Lawful basis: Consent (Article 6(1)(a))
   

c. Performance (Analytics) Cookies

These cookies allow us to collect aggregated, anonymised, or pseudonymised data about how users interact with our Website. This data helps us improve site performance, usability, and content quality.

• Example: Google Analytics (_ga, _gid) 
• Lifespan: varies (typically up to 2 years)
• Lawful basis: Consent (Article 6(1)(a))
   

d. Targeting (Marketing) Cookies

These cookies may be set through our site by third-party advertisers, social media platforms, or analytics providers. They are used to track your browsing habits across different websites and deliver advertising that is more relevant to your interests.

• Example: Facebook Pixel, LinkedIn Insight Tag 
• Lifespan: varies
• Lawful basis: Consent (Article 6(1)(a))

13.4. Third-Party Cookies

We may allow carefully vetted third parties to place cookies on your device via our Website. These third parties may include, but are not limited to:

• Google LLC (for analytics and advertising services)
• Meta Platforms, Inc. (Facebook advertising tools)
• LinkedIn Corporation (conversion tracking) 
• Mailchimp/SendGrid (if using email marketing integrations)
   

Each third party is independently responsible for their own cookie practices. You are encouraged to review their respective cookie and privacy policies.

13.5. Cookie Consent Mechanism

In compliance with the PECR and the GDPR, we implement a cookie consent mechanism. When you first visit our Website, you will be presented with a cookie banner (or equivalent interface).

13.6. Cookie Duration and Retention

Cookies may be classified by lifespan as follows:

• Session cookies: Deleted when the browser is closed.
• Persistent cookies: Remain on your device for a predefined duration or until manually deleted.
   

We periodically audit all cookies to ensure that they do not persist longer than necessary for their respective purposes.

13.7. Disabling or Managing Cookies

You retain full control over your cookie preferences. You may manage or delete cookies via:

1. Our consent management tool accessible from the banner or footer of our Website. 
2. Your browser settings, where you can configure or disable cookies per browser (e.g., Chrome, Firefox, Safari).
3. Industry opt-out platforms, such as:
   • https://www.youronlinechoices.eu
   • https://optout.aboutads.info
      

Please note that disabling certain cookies may impair Website functionality or limit access to certain features.

13.8. Legal Basis for Processing Cookie Data

The deployment and use of cookies, except those strictly necessary for Website operation, shall be conducted solely on the basis of your prior informed consent, in accordance with Article 6(1)(a) of the GDPR and Regulation 6 of the PECR.

Necessary cookies are used on the basis of our legitimate interests under Article 6(1)(f), namely to ensure the security, integrity, and functionality of the Website.

13.9. Updates to This Cookie Policy

This Cookie Policy is reviewed at regular intervals and may be updated without prior notice to reflect changes in law, technology, or our operational practices. The date of the most recent revision shall appear at the top of this document.

You are encouraged to re-review this Policy periodically.

14. REVISIONS AND AMENDMENTS TO THIS POLICY

We reserve the unilateral right, at our sole discretion and without prior notice, to modify, amend, revise, replace, or otherwise update this Policy. Any such changes shall take effect immediately upon being posted to the Website. The most current version shall always be accessible at [yourwebsite.com/privacy].

Continued use of the Website following such amendments constitutes acceptance thereof.

15. CONTACT INFORMATION

To contact us with questions, requests, or complaints regarding this Privacy Policy or your personal data, please submit in writing to our registered postal address.