Last updated June 7, 2024.

™ Energy Management Systems and the design are trademarks of Energy Management Systems Inc., used under license.

The privacy of individuals connected with Energy Management Systems, Inc. and all its subsidiaries¹ (together, “EMS” or “we”) is of great importance to us, and is something we take very seriously. This privacy policy (“Privacy Policy” or “this Policy”) describes how we collect, handle, use, disclose and protect (collectively, “Processing”) Personal Information under our control, including on the EMS website and the visitors/customer portal/client portal (collectively, the “EMS Platform”).

Please read through this Policy in its entirety and understand its terms. We may update this Policy from time to time, so please check it occasionally. You can view more detail on any of the sections below by clicking on the following topics:

• Personal Information We Collect;
• How We Collect Your Personal Information;
• How We Use Your Personal Information;
• How We Share Your Personal Information With Third Parties;
• How We Protect Your Personal Information;
• Accuracy and Access to Your Personal Information
• Privacy Information For California Residents;
• Changes to the Policy;
• Questions About This Policy.

ACCEPTANCE OF PRIVACY POLICY

By providing Personal Information to EMS and visiting the EMS Platform, engaging with our social media or otherwise, you are consenting to our collection, use and disclosure of your Personal Information in accordance with the terms of this Privacy Policy.

PERSONAL INFORMATION WE COLLECT

We collect information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to any individual or a household (“Personal Information”). We also collect non-Personal Information that cannot be linked or associated with any individual person or household. When non-Personal Information is combined with other information so that it does identify an individual person, we treat that combination as Personal Information.

We may collect, use, store, disclose and transfer different kinds of Personal Information about you, which we have grouped together as follows:

• Identifiers: name, alias, postal address, unique personal identifier, online identifier, IP address, email address, telephone number, account name, or similar;

1 If one of our subsidiaries has adopted their own privacy policy that are consistent with the provisions of this Privacy Policy, it may supersede this Privacy Policy.

• Financial: While EMS allows customers to pay online, all payments are directed to and processed by a third-party payment provider. EMS does not store any customer financial information directly;
• Internet and Other Electronic Network Activity such as internet protocol (IP) address, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform of the devices you use to access the EMS Platform, unless you opt-out of such activity via the website’s cookie pop-up function;

• Commercial Information: products and services used relating to meters and service agreements for billing, occupancy dates, whether your premises is rented or owned, consumption and meter reading data, and collection information;
• Audio and Visual Information: content of telephone calls and emails;
• Sensitive Information: definitions of sensitive information vary by state, but typically include (but are not limited to): business tax IDand credit reports.

How Long Will EMS Use My Personal Information?

We will only retain your Personal Information for as long as reasonably necessary to fulfill the purposes for which we collected it, as well as for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your Personal Information for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

To determine the appropriate retention period for Personal Information, we consider the amount, nature and sensitivity of the Personal Information, the potential risk of harm from unauthorized use or disclosure of your Personal Information, the purposes for which we process your Personal Information and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.

If You Do Not Provide Personal Information. Where we need to collect Personal Information by law, or under the terms of a contract we have with you or relating to your property or residence, and the Personal Information is not provided when requested, we may not be able to perform the contract we have, or are trying to enter into. In this case, we may have to cancel a product or service you have with us but we will notify you if this is the case at the time.

Children’s Privacy. The EMS Platform is intended for adult use only and is not directed towards children, minors, or anyone under the age of 18. If you are under the age of 13, you are not authorized to provide us with any Personal Information.

HOW WE COLLECT YOUR PERSONAL INFORMATION

Information You Provide To Us

We may collect Personal Information from you that you voluntarily provide to us in various ways, including, but not limited to, when you:

• Use or interact with the EMS Platform or our services;
• Call, email or otherwise communicate with us;
• Create an account with us; or
• Otherwise interact with us.

Information We Collect When You Use Our Services

Automated technologies or interactions. As is true of most websites, we receive and store certain types of Personal Information whenever you interact with us or our services. This information may include technical and usage data. You may manage how your mobile device and mobile browser share location information with us, as well as how your mobile browser handles cookies and related technologies by adjusting your mobile device privacy and security settings. Please refer to instructions provided by your mobile service provider or the manufacturer of your device to learn how to adjust your settings.

Cookies and Tracking Technologies. We may also collect Personal Information through the EMS Platform, which may use tracking software in the form of “cookies” (text files containing unique identification numbers identifying technical information about visitors, but not necessarily the identity of the visitor). This information is transmitted to us each time the EMS Platform is visited, and these cookies allow us to collect and store information such as the type of internet browser and operating system a visitor uses; the date, time and duration of the visit to the EMS Platform; the Internet protocol (IP) address used to connect their computer to the Internet, the internet address of the website from which they linked to the EMS Platform; and the pages they visited while on the EMS Platform. EMS has adopted a Cookie Policy, available online at www.EMS3.com/cookie-policy

Information We Collect From Third Parties

We may collect Personal Information from those third parties listed below. We do not control third-party websites and are not responsible for any information they may collect. The collection, use, and disclosure of Personal Information received from third parties is governed by the privacy policies listed on the website where the information was collected by the third party and/or submitted by the user. Third parties may send their own cookies and pixel tags to you and may collect information and use it in a way that is different from this Privacy Policy. Please carefully review these third-party privacy policies to understand how your information may be collected, used and disclosed by these third parties.

Landlord or Property Managers. We collect Personal Information from building owners, condominium corporations, strata corporations, co-operative corporations, landlords and/or property managers who provide Identifiers and Commercial Information.

Third Party Service Providers. We collect Personal Information from service providers including payment processors, collection agencies, analytics providers, email service providers, customer service providers, marketing and advertising providers, website hosting platforms, identity authentication providers, and review platforms.

Your ‘Do Not Track’ Browser Setting. Some web browsers incorporate a Do Not Track (“DNT”) feature that signals to the websites that you visit that you do not want to have your online activity tracked. At this time, the EMS Platform does not respond to DNT signals. Other third party websites may keep track of your browsing activities when they provide you with content, which enables them to customize what they present to you on their websites.

HOW WE USE YOUR PERSONAL INFORMATION

We will collect, use and disclose your Personal Information for the following purposes:

Transactional Purposes:

• Process, fulfill, and deliver requests for services;

• Billing and collecting overdue amounts, including providing credit reports to credit reporting agencies;

• Reviewing the products and services that we provide;

• Reviewing the products and services that we obtain from third parties;

• Informing you of our other products and services, or those of carefully selected third parties;

• Providing you with newsletters and energy or conservation tips; or

• Providing customer support.

Other Business Purposes:

• Resolve disputes and troubleshoot problems and support;

• Enforce our terms and this Privacy Policy;

• Customize, measure, and improve our services and content;

• To protect our interests, including establishing, exercising, and defending legal rights and claims;

• As necessary to comply with legal requirements, to prevent fraud, to cooperate with law enforcement and regulatory authorities, and to stop other prohibited, illegal, or harmful activities; and

• For purposes disclosed at the time you provide/we request your Personal Information or as otherwise set forth in this Privacy Policy.

HOW WE SHARE YOUR PERSONAL INFORMATION

We may share or disclose your Personal Information to third parties in the ways described below.

Landlord or Property Managers

We share information relating to billing, payments and collection services with a property’s landlord or property manager.

Service Providers

We may use third-party service providers to perform certain business services and may disclose Personal Information to such service providers as needed for them to perform these business services. Business services provided include, but are not limited to, hosting services, communications services, the EMS Platform development services, payment processing services, compliance services, analytics services, advertising/marketing services, and customer support services. The following categories of Personal Information that have been disclosed to service providers and internal third parties for a business purpose include:

Identifiers:

• Contact Information;
• Financial Information;
• Internet and Other Electronic Network Activity;
• Commercial Data; and
• Audio and Visual Information.

Personal Information provided to our service providers may be stored and processed outside of the United States. You acknowledge and agree that, as a result, your Personal Information may be processed, used, stored, or accessed in other jurisdictions and may be subject to the laws of those jurisdictions. For example, information may be disclosed in response to valid demands or requests from government authorities, courts, or law enforcement in other countries.

Business Transactions

We may do business with third parties to whom we may choose to sell, transfer, or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your Personal Information in the same way as set out in this Privacy Policy.

Legal Process

Subject to applicable law, we may disclose information about you: (i) if we are required to do so by law, regulation or legal process, such as a subpoena; (ii) in response to requests by government entities, such as law enforcement authorities; (iii) when we believe disclosure is necessary or appropriate to prevent physical, financial or other harm, injury or loss; or (iv) in connection with an investigation of suspected or actual unlawful activity.

Personal Information Sold or Shared

Other than as identified in this Privacy Policy, we have not sold or shared any Personal Information in the past twelve months. “Sharing” is defined under California privacy law as “renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s Personal Information by the business to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration, including transactions between a business and a third party for cross-context behavioral advertising for the benefit of a business in which no money is exchanged.”

HOW WE PROTECT YOUR PERSONAL INFORMATION

We have reasonable security measures in place to prevent your Personal Information from being accidentally lost, used, or accessed in an unauthorized way, altered or disclosed. In addition, we limit access to your Personal Information to those employees, agents, contractors and other third parties who have a business need to know. They will only process your Personal Information on our instructions, and they are subject to a duty of confidentiality.

We endeavor to keep your Personal Information confidential and protected against unauthorized access, misuse, or alteration with commercially reasonable physical, technical, and administrative measures. However, as effective as these measures are, no security system is impenetrable. We cannot guarantee the security of electronic data, nor can we guarantee that the information you supply will not be intercepted.

ACCURACY AND ACCESS TO YOUR PERSONAL INFORMATION

We strive to ensure that all Personal Information is accurate, correct, and up-to-date, and take all reasonable efforts to ensure that the integrity and accuracy of such information is protected.

You can ask to see the Personal Information that we hold about you. If you want to review, verify or correct your Personal Information, or find out how it has been used or disclosed, please contact our Privacy Officer using the contact information set out below. Please note that any such communications must be in writing. Consistent with applicable law, if an individual requires an alternative method of accessing their Personal Information to accommodate a sensory disability, we will work to provide such alternatives.

When making an access request, we require specific information from you to confirm your identity as well as to search for, and provide you with, the Personal Information that we hold about you. We may charge you a reasonable fee to access your Personal Information; but we will advise you of any fee in advance. If you need help in preparing your request, please contact the office of our Privacy Officer.

There are only a few circumstances under which we will not comply with your request to provide you with access to your Personal Information. These circumstances include:

• If doing so could reveal Personal Information about a third party;
• If the information is subject to legal privilege or was generated in the context of a formal dispute resolution process;
• If the information relates to the actual or suspected breach of an agreement or of applicable law; or
• Where permitted or required by applicable law.

We will inform you of the reasons why, subject to any legal or regulatory restrictions, access has been denied.

Should you identify any incorrect or out-of-date Personal Information in your file, please let us know and we will determine if revisions are required. You may request correction of the Personal Information we hold about you, though we may need to verify the accuracy of the new information you provide to us. If inaccurate Personal Information is mistakenly sent to a third party, we will communicate relevant changes to the third party where appropriate.

PRIVACY INFORMATION FOR CALIFORNIA USERS

If you are a resident of California, the California Consumer Privacy Act (“CCPA”) and California Privacy Rights Act (“CPRA”) provide you with specific rights regarding your Personal Information. These include:

Right to Know: You have the right to know the categories of Personal Information that we collect about you over the past 12 months, the categories of sources from which the Personal Information was collected, the business or commercial purposes for which the Personal Information was collected, sold, shared, and the categories of third parties with whom we share the Personal Information, and the specific pieces of personal information we collected about you.

Right to Correct: You have the right to correct inaccurate personal information that we maintain about you.

Right to Delete: You have the right to request that we delete Personal Information that we collected from you and retained, subject to certain exceptions.

Right to Opt-Out of the Sale/Sharing: We do not sell your Personal Information. We only share your Personal Information as identified in this Policy for required business purposes.

Right to Limit the Use or Disclosure of Sensitive Personal Information: We do not use or disclose your sensitive Personal Information other than as identified in this Policy for required business purposes.

Other California Privacy Rights: California residents have the right to receive information that identifies any third-party companies or individuals that EMS has shared your Personal Information within the previous calendar year, as well as a description of the categories of Personal Information disclosed to that third party. You may obtain this information once a year and free of charge by contacting us at the address below.

Non-Discrimination: The CCPA provides the right to be free from discrimination if you choose to exercise your rights under the statute, and we will not discriminate by:

• Denying you products or services;

• Charging you different prices or rates for products or services, including through granting discounts or other benefits, or imposing penalties;

• Providing you a different level or quality of products or services; or

• Suggesting that you may receive a different price or rate for products or services or a different level or quality of products or services.

General Terms Regarding Your Rights

Exercising Your Rights. Any questions regarding this Privacy Policy, requests to know, correct or delete, or requests to Opt Out of certain information handling practices, can be submitted by calling our toll-free number 1-800-965-9642 or emailing us at privacy@ems3.com. Only you or an authorized agent may make a verifiable consumer request related to your Personal Information.

Designating a Third-Party to Act on Your Behalf. For those residents in California, in order to designate a third party to act on your behalf, that person must be registered with the California Secretary of State and must have valid written evidence of authority from you to act on your behalf, e.g., a validly executed Power of Attorney or some other written, notarized documentation that they can provide to us. Absent such documentation, we reserve the right to refuse to comply with third-party requests for information.

Verifying Your Requests. During the verification process, depending on the nature of your request, e.g. whether you are seeking access to information versus deleting information, we will first seek to verify your identity against known information in our environment, such as your name, e-mail address, and telephone. Upon receiving your request, we may also contact you via email and/or other secured communication channel to verify your identity. In certain instances, e.g. a mismatch against known information or where you are seeking information on behalf of another person with authorization, we may seek additional verification from you, which may be in the form of you providing a copy of a valid, government issued identification or a notarized attestation.

Response Timing and Format

We endeavor to respond to a verifiable consumer request within forty-five (45) days of its receipt. If we require more time (up to 90 days), we will inform you of the reason and extension period in writing. If you have an account with us, we will deliver our written response to that account. If you do not have an account with us, we will deliver our written response by mail or electronically, at your option.

Any disclosures we provide will only cover the 12-month period preceding the verifiable consumer request’s receipt. The response we provide will also explain the reasons we cannot comply with a request, if applicable. For data portability requests, we will select a format to provide your personal information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Exceptions

These rights are not absolute and are subject to certain exceptions. For example, we cannot disclose or permit access to specific pieces of Personal Information if granting your request would present a certain level of risk to the security of the Personal Information at issue, your account with us or the security of the EMS Platform. We may deny your deletion request for certain reasons. For example, if retaining the information is necessary for us or our service providers and/or contractors to:

• Complete the transaction for which we collected the Personal Information, provide a product or service that was requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform our contract;

• Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities;

• Debug products to identify and repair errors that impair existing intended functionality;
• Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law;
• Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546

seq.);

• Enable solely internal uses that are reasonably aligned with consumer expectations based on our relationship;

• Comply with a legal obligation; or
• Make other internal and lawful uses of that information that are compatible with the context provided to us.

We endeavor to respond to a verifiable consumer request within forty-five (45) days of its receipt. If we require more time (up to 90 days), we will inform you of the reason and extension period in writing.

PROTECTING YOUR PERSONAL INFORMATION

Integrity and Security

EMS uses industry standard measures, including administrative, organizational, technical, and physical safeguards, to help protect Personal Information from loss, theft, misuse, and unauthorized access, disclosure, alteration, and destruction. We implement measures and processes to help us to keep your Personal Information secure and to maintain its quality, such as keeping electronic files in a secured environment with restricted access and use. We regularly review our security and related policies to adapt the technology as new threats evolve and monitor our systems to help ensure the highest level of availability. If you have any questions about the security of the EMS Platform, you can reach out to our Privacy Officer.

Access to private, sensitive and confidential information, including Personal Information, is restricted to authorized employees or contractors with legitimate business reasons. EMS’ employees and contractors understand the importance of keeping your Personal Information private. All employees and contractors are expected to maintain the confidentiality of Personal Information.

Risks

Despite the foregoing security measures and significant steps EMS has taken to protect your Personal Information, no company can fully eliminate all security risks associated with the Processing of Personal Information. With that in mind, we cannot guarantee the security of any Personal Information provided to or received by us. We encourage you to provide only the Personal Information you are comfortable with providing to a third party, keep watch for communications that are suspicious, and report any suspicious activity to us as soon as possible.

PLATFORM GOVERNED BY THIS POLICY

Our Website is governed by the provisions and practices stated in this Policy. Our Website may contain links to third-party sites or applications that are not governed by this Policy. Although we endeavor to only link to sites or applications that share our commitment to your privacy, please be aware that this Policy will no longer apply once you leave our Website, and that we are not responsible for the privacy practices of third-party sites or applications. We therefore suggest that you closely examine the respective privacy policies of third-party sites and applications to learn how they collect, use and disclose your Personal Information.

UPDATES TO THIS PRIVACY POLICY

Revisions to the Privacy Policy are effective when posted on the EMS Platform on the date stated in the Privacy Policy. We encourage you to regularly review the Privacy Policy.

QUESTIONS OR CONCERNS

EMS’ compliance with this Privacy Policy and with applicable privacy laws is overseen by our Privacy Officer. If you have any questions or concerns regarding this Privacy Policy or our privacy practices, please contact our Privacy Officer at the following address:

Privacy Officer

Energy Management Systems, Inc.

801 Springdale Dr – Suite 200, Exton, PA 19341

Email:privacy@ems3..com