1. Introduction

We are committed to your right to privacy. This Privacy Notice contains information about how we process personal data about you. If you have additional questions or require more information about our processing activities, do not hesitate to contact us.

2. Who We Are

The controller for your data is Inherit Carbon Solutions AS (collectively referred to as the "Company", "we" or "us").

3. Who We Process Personal Data About

As part of our business activities, we process personal data about the following individuals:

• Contact persons at our business customers, suppliers, and other business partners.

• Visitors of this website and our social media profiles.

• Individuals who apply for a job with us.

Note: If you are an employee, consultant, or similar personnel working for us, please refer to our internal privacy notice.

4. How We Use Your Personal Data

The text below lists the personal data that we may typically collect about you, our sources for such data, and our legal basis for processing it.

(Purpose | Types of Data | Source | Legal Basis)

• To respond to inquiries & book meetings (via online contact forms or embedded Calendly calendar) | Name, e-mail address, company, time zone, and any personal data included in the meeting booking or attachments. | From you | The legitimate interest in following-up on customer requests and scheduling inquiries concerning our business.

• To manage relationships (with business customers, suppliers, and other business partners) | Name, job position, e-mail address, and phone number. | From you | The legitimate interest in purchase, sale, and business administration.

• To recruit employees | Name, residential address, e-mail address, phone number, CV, application, qualifications, and interview notes. | From you, from references, and from public sources. | The legitimate interest in recruiting employees and assessing if you are qualified for the position.

• To conduct surveys (such as customer satisfaction surveys) | Name and e-mail address. | From you | The legitimate interest in improving our services and receiving feedback.

We may also collect or receive other types of data if required to fulfil the purposes listed above, or use data on a case-by-case basis for compatible purposes such as audits, analytics, reporting, and innovation.

5. How We Share Your Personal Data

We may disclose your personal data to the following categories of recipients, to the extent necessary for the purposes mentioned above:

• To other companies within our Group for internal administrative purposes.

• To our suppliers (such as website providers, IT system suppliers, and scheduling tools like Calendly). We enter into agreements with suppliers to ensure they do not process data for other purposes.

• To authorities and third parties if required by law.

• To our advisors and business partners to the extent required to operate our business, including third parties in connection with possible mergers or acquisitions.

6. Transfer of Personal Data Outside the EEA

Because some of our digital suppliers (such as Google and Calendly) are located or operate outside the EEA, your personal data may be transferred globally. We ensure that your data remains secured by adopting appropriate safeguards, such as the EU's Standard Contractual Clauses (SCCs) and additional safety measures required by law.

7. How Long Do We Keep Your Personal Data?

We keep your personal data only as long as necessary for the purposes listed above. Criteria used to determine deletion include:

• Storing data for as long as required by law.

• Storing data about customers, suppliers, and business partners as long as we maintain an active relationship or dialogue.

• Storing recruitment data for up to 6 months after the process is completed (unless you are hired or consent to longer storage).

8. Third Parties and Social Media

We maintain pages on social media platforms, including LinkedIn, to interact with users. When visiting these pages, we may receive anonymized insights (such as statistics about age, sex, and location) or information you choose to share (comments, likes, chats). We act as joint controllers with the social media platforms for data processed through these tools. Your experience on those sites is governed by their respective privacy policies.

9. Your Privacy Rights

You have several rights regarding the processing of your personal data:

• Information & Access: Request further details and a copy of the information we hold about you.

• Rectification: Request correction or completion of inaccurate data.

• Erasure: Request deletion of data if there are no applicable legal grounds for continued processing.

• Restriction: Ask us to restrict how we process your information.

• Data Portability: Request that your information is transferred to you in a structured, machine-readable format.

• Objection: Object to our processing of your personal data or being subject to decisions based solely on automated processing.

Please note that these rights are subject to conditions and limitations by law.

If you believe we process your data in violation of applicable law, you have the right to file a complaint with the Norwegian Data Protection Authority (*Datatilsynet*). We encourage you to contact us prior to making a complaint so we can clarify any misunderstandings.

10. Contact Information

Please feel free to contact us if you have any questions, comments, or wish to exercise your privacy rights:

Email: mike.carpenter@inheritcs.com

We will respond to your inquiry as soon as possible, and typically within one month at the latest.

Last updated: 26 May 2026