This notice sets out what personal data we collect, for what purposes and your rights in this respect.

Every individual within Pavilion Energy group and within the Shell group of companies is responsible for protecting personal data about each other as well as that of our customers, business partners and suppliers.

This Privacy Notice provides information about personal data processed by Pavilion Energy group in relation to individuals who are or were employees, interns or individual contractors as well as dependents listed as emergency contacts of Pavilion Energy group employees.

As well as this Privacy Notice, bespoke privacy notices and supplementary privacy statements may contain further information about how we process your personal data in relation to specific HR Shell processes (such as Open Resourcing, One Health IT and International Mobility programs). In those instances, such privacy notices will be communicated to you separately. These privacy notices may vary among the countries in which we operate to reflect local practices and applicable law requirements.

This Privacy Notice explains what personal data are processed about you, why we are processing your personal data and for which purposes, how long we hold your personal data for, how to access and update your personal data, as well as the options you have regarding your personal data and where to go for further information.

For individuals applying to work or attending a recruitment event or undergoing an assessment, please refer to Pavilion Energy’s Recruitment Privacy Notice.

The categories of personal data we process.

We process personal data necessary to manage the application process, employment relationships, to provide benefits to certain dependent of employees, and to engage contractors and interns of Pavilion Energy group.

This includes personal home contact information, date of birth, marital status, payroll and wage and benefit information, emergency contacts, work history, qualifications, work performance information, information required to ensure you have the right to work in the country/ies you are engaged in, as well as any other information necessary for managing the application process and the employment relationship, for providing benefits to certain dependents of employees and engaging contractors and interns.

We may also process some special categories of personal data (’sensitive personal data’) such as data relating to an individual’s health, medical records and medical history, bank account information, their racial or ethnic origin, religious or philosophical beliefs, sexual orientation, political opinions and trade union membership. We will only process such personal data where it is necessary for the purposes of complying with employment and social security laws, for the establishment, exercise or defense of claims or where necessary for the purposes of providing occupational medical advice and support, to protect the vital interests of an individual (such as in an emergency), where necessary for reasons of public health or where the individual has provided their explicit consent.

We process your personal data:

• in order to comply with local laws and regulations;

• for legitimate business interests (e.g. performance management in order to ensure the qualification and competence of our personnel or for health, safety and security purposes, so that only authorized personnel have access to certain locations or assets, litigation and defense of claims); or

• when there is your explicit consent.

As a general principle, Pavilion Energy and Shell do not request or rely on the consent of Pavilion’s employees for the processing of personal data. However, there are particular circumstances in which consent is required, such as in cases that are mandatory under applicable local law.

The personal data requested from Pavilion Energy group represents the minimum necessary in order to comply with legal and/or contractual requirements and to provide opportunities to participate in programs or provide a benefit. Failure to provide the requested information may adversely affect your chances of remaining in employment, internship or being hired as a provider, participating in a program or receiving a benefit.

In cases where processing is based on consent, you have the right to withdraw your consent at any time. This will not affect the validity of the processing prior to the withdrawal of consent. However, the withdrawal of consent may have an impact on your chances of remaining employed or hired as a provider or participating in a program or receiving a benefit.

We process the personal data addressed in this Privacy Notice for the following purposes:

• Human Resources, personnel management, business process execution, internal management, management reports, organizational analysis and development - budgetary, financial and organizational planning, administration, compensation, performance management.

• Health, safety and security – protection of the life or health of employees, occupational health and safety, protection of Shell assets, authentication of employees’ status and access rights; or

• Legal and/or regulatory compliance - compliance with legal or regulatory requirements.

We may also process your personal data for a secondary purpose, in which they are directly related, such as:

• storage, deletion or confidentiality of your personal data;

• audits, investigations, fraud prevention, dispute resolution, insurance issues, litigation and claims defense; or

• statistical, historical or scientific research.

Monitoring

All activities using Shell IT equipment and/or connected to Pavilion Energy group's IT network may be monitored for legitimate business purposes.

Data from access and security systems are used to:

• health, safety and security effects, specifically to prevent fraud and protect Pavilion Energy group assets, Pavilion Energy group employees, as well as visitors to Pavilion Energy group facilities;

• comply with legal and regulatory requirements, specifically when it is mandatory, by virtue of local law, to provide information to governmental/regulatory authorities;

• monitor (in aggregate) the number of individuals entering and working at a Pavilion Energy group facility for human resource and real estate planning purposes; and

• only in cases of contractors (not employees of Pavilion Energy group), monitor dates and times of entry and exit in a Shell facility for the purposes of management and financial control.

In cases where the processing is based on consent, which may establish otherwise, you will have the right to withdraw your consent at any time. This will not affect the validity of the processing prior to the withdrawal of consent.

Screening

In order to comply with legal and regulatory obligations, to protect the Shell’s group's assets and employees/contractors and specifically to ensure that the Shell group, which includes Pavilion Energy group, can comply with trade control, anti-money laundering and/or bribery and corruption laws and other regulatory requirements, we carry out screening on all employees and contractors on a periodic basis. This screening takes place against publicly available or government issued sanctions lists and is compared with information held about you by Shell (for example from the Conflict of Interest register - see here for more information).

Any personal data collected through the screening will not involve profiling or automated decision-making regarding suitability for continued employment, internship or engagement as a contractor.

Your personal data are exclusively processed for the purposes referred to above and will only be shared on a strict need to know basis with:

• Other companies within the Shell group of companies, including to those which may be located outside of your location;

• Authorised third party agents, service providers, external auditors and/or subcontractors of Pavilion Energy group;

• A competent public authority, government, regulatory or fiscal agency where it is necessary to comply with a legal or regulatory obligation Pavilion Energy group is subject to or as permitted by applicable law; and

• Any person to whom Pavilion Energy group proposes to transfer any of its rights and/or duties.

Pavilion Energy group, full contact addresses and company registrations:

• Pavilion Energy Pte. Ltd. registered with the Accounting and Corporate Regulatory Authority (ACRA) of Singapore with number 201210107Z and address 12 Marina Boulevard, #37-02 Marina Bay Financial Centre Tower 3, 018982, Singapore.

• Pavilion Energy Singapore Pte. Ltd. registered with the Accounting and Corporate Regulatory Authority (ACRA) of Singapore with number 201211671M and address 12 Marina Boulevard, #37-02 Marina Bay Financial Centre Tower 3, 018982, Singapore.

• Pavilion Energy Spain S.A.U. registered with the Commercial Registry of Madrid, under Volume 39,345, Sheet 10, Section 8, Page M-698,632, having Número de Identificación Fiscal (“NIF”) A88410493 and address Torre de Cristal, Paseo de la Castellana 259C, Planta 21 Sur, 28046 Madrid, Spain.

• Pavilion Energy Trading and Supply Pte. Ltd. registered with the Accounting and Corporate Regulatory Authority (ACRA) of Singapore with number 201837333R and address 12 Marina Boulevard, #37-02 Marina Bay Financial Centre Tower 3, 018982, Singapore.

• Pavilion LNG Bunker I Pte. Ltd. registered with the Accounting and Corporate Regulatory Authority (ACRA) of Singapore with number 201837218K and address 12 Marina Boulevard, #37-02 Marina Bay Financial Centre Tower 3, 018982, Singapore.

HR emails to contact: hr@pavilionenergy.com, will be responsible for processing your personal data, either solely or jointly with its affiliates within the Shell group of companies.

Your personal data may be transferred outside of your country, subject to appropriate safeguards.

Where your personal data is transferred to companies within the Shell group and/or to authorized 3rd party agents service providers and/or subcontractors who may be located in or outside of your location we take organizational, contractual and legal measures to ensure that the personal data is exclusively processed for the purposes mentioned above and that adequate levels of protection have been implemented in order to safeguard the personal data.

These measures include Binding Corporate Rules for transfers among the Shell group and European Commission approved transfer mechanisms for transfers to 3rd parties in countries which have not been deemed to provide an adequate level of data protection as well as any additional local legal requirements. You can find a copy of the Shell Binding Corporate Rules at shell-binding-corporate-rules.pdf

We have implemented technologies and policies to protect your privacy from unauthorized access and misuse, and we will update these measures as new technologies become available where appropriate.

All information, including personal data, is managed in accordance with the Pavilion Energy group group's standards for Information and Records Management, and will be securely deleted once it is no longer necessary for legitimate business purpose or for legal/regulatory purposes.

• Some exceptions necessary to comply with local legal requirements are:

• information contained within employee files will be retained for a maximum of 10 years after the termination of employment;

• information regarding retirement benefits will be retained for a maximum of 99 years from the beginning of the employment relationship;

• any personal data collected as part of the evaluation process from publicly available or government-issued sanctions lists and media sources will be retained for a maximum of 15 years after it was first obtained;

• names, dates, times and access points of all individuals entering Pavilion Energy group facilities will be retained for 3 years from each access;

• in the event that an individual has been terminated or has their contract terminated due to serious misconduct, including violation of Shell’s Life-Saving Rules or Shell's Code of Conduct, such information will be retained for a maximum of 30 years after termination.

In all cases, the information may be retained for (a) a longer period of time when there is a legal or regulatory reason to do so (in which case it will be deleted after it has served its legal or regulatory purpose) or (b) a shorter period when you disapprove of the processing of your personal data and there is no longer a legitimate business purpose to retain it.

Our goal is to keep your information as accurate as possible. You can request:

• access to your personal data;

• correction or deletion of your personal data (but only when it is no longer necessary for a legitimate business purpose);

• that the processing of your personal data is restricted; and/or

• the receipt of the personal data you have provided to Shell in a structured and digital manner in order to transmit this data to a third party, if this is technically feasible.

Please contact your Shell Chief Privacy Office in case you want to send any subject access request under privacy-office-SI@shell.com.

If you have any problems, questions or complaints about the processing of your personal data, please contact us electronically at the following email address: dataprotectionoffice@pavilionenergy.com, or in writing at either of the following addresses:

• Singapore: The Office of the Data Protection Officer, Pavilion Energy, 12 Marina Boulevard, #37-02, Marina Bay Financial Centre Tower 3, 018982, Singapore.

• Spain: The Office of the Data Protection Officer, Pavilion Energy, Torre de Cristal, Paseo de la Castellana 259C, Planta 21 Sur, 28046 Madrid.

If you have any problems, questions or complaints regarding the processing of your personal data you can contact also Shell Chief Privacy Office under email address: Privacy-Office-SI@shell.com.

You can also contact the Shell Group Data Protection Officer by correspondence to Shell International B.V. The Hague, Netherlands - Commercial Register No. 27155369, P.O. Box 162, 2501 AN, The Hague.

If you are dissatisfied with the processing of your personal data by Shell, you have the right to lodge a complaint with your own data protection authority at PDPC in Singapore Personal Data Protection Commission Singapore | PDPC or www.aepd.es (Spain) or to the Dutch Data Protection Authority at Hoge Nieuwstraat 8, 2514 EL The Hague /The Hague NETHERLAND. Visit autoriteitpersoonsgegevens.nl/en for more information.

This Privacy Notice may change over time and this notice was last updated in March 2025.