This Privacy Policy provides information on the processing of your personal data when providing and/or contracting services of the Pavilion Energy group, (‘PavEnergy’ or ‘we’) in relation to customers, suppliers, business partners, interested parties and/or investors, as well as websites visitors. For all other interactions with Shell group companies, please refer to www.shell.com/privacy.html.

We are committed to ensuring the privacy and security of your personal information. This Privacy Policy explains, among other things, what personal data we process, for what purposes we process your personal data, how long we keep your personal data, how to access and update your personal data and where to seek more information or file a complaint.

If you would like to receive this Privacy Notice in an alternative format (e.g. in larger print) or if you have any questions about the processing of your personal information that are not addressed by this policy, please contact us at: dataprotectionoffice@pavilionenergy.com.

We will not sell or otherwise provide your personal information to third parties and will only make it available to third parties involved in the performance of the service agreed with you. Our employees and any third parties utilized by us are contractually obligated to protect the privacy and confidentiality of your information.

Except in the case of educational events organized by Shell or PavEnergy that are developed specifically for children, we do not knowingly collect personal data from individuals under the age of 13. If you are under 13 years of age (or another age indicated in the local legal requirements stated on the Shell website of your locality), do not send us your personal data, such as name, address and e-mail address. If you wish to contact PavEnergy or Shell in a manner that requires us to submit your personal data (such as for education or innovation events), please ask your parent or guardian to do so on your behalf.

We process personal data from or in relations to individuals who work for or on behalf of or who are shareholders of our Business Customers, Suppliers, Business Partners and website users in the following categories:

•  Private contact information (such as name, mailing or email address, and telephone number) only if necessary; or

•  Business or other contact information (such as professional position, department, name of the organization and its business with PavEnergy done on behalf of you or the Business Customer, Supplier, Business Partner).

PavEnergy will be responsible for processing your personal data, either solely or jointly with its affiliates within the Shell group of companies.

Full contact addresses and company registrations:

• Pavilion Energy Pte. Ltd. registered with the Accounting and Corporate Regulatory Authority (ACRA) of Singapore with number 201210107Z and address 12 Marina Boulevard, #37-02 Marina Bay Financial Centre Tower 3, 018982, Singapore.

• Pavilion Energy Singapore Pte. Ltd. registered with the Accounting and Corporate Regulatory Authority (ACRA) of Singapore with number 201211671M and address 12 Marina Boulevard, #37-02 Marina Bay Financial Centre Tower 3, 018982, Singapore.

• Pavilion Energy Spain S.A.U. registered with the Commercial Registry of Madrid, under Volume 39,345, Sheet 10, Section 8, Page M-698,632, having Número de Identificación Fiscal (“NIF”) A88410493 and address Torre de Cristal, Paseo de la Castellana 259C, Planta 21 Sur, 28046 Madrid, Spain.

• Pavilion Energy Trading and Supply Pte. Ltd. registered with the Accounting and Corporate Regulatory Authority (ACRA) of Singapore with number 201837333R and address 12 Marina Boulevard, #37-02 Marina Bay Financial Centre Tower 3, 018982, Singapore.

• Pavilion LNG Bunker I Pte. Ltd. registered with the Accounting and Corporate Regulatory Authority (ACRA) of Singapore with number 201837218K and address 12 Marina Boulevard, #37-02 Marina Bay Financial Centre Tower 3, 018982, Singapore.

We process the personal data addressed in this Privacy Policy for the following purposes:

• Commercial execution - research, development and improvement of products or services; conclusion and execution of contracts with Commercial Customers, Suppliers and Business Partners; registration and relocation of services, products and materials to or from PavEnergy; relationship management and marketing activities, such as maintaining and promoting contact with current and potential customers, account management, customer service, as well as developing, executing and analysing market research and marketing strategies;

• Organization and management of the business - financial management, asset management, mergers, spin-offs, acquisitions and divestitures, implementation of controls, issuance of management reports, analysis, internal audits and investigations;

• Health, safety and security – protection of an individual's life or health, occupational health and safety, protection of PavEnergy companies and employees, authentication of individual status and access rights; or

• Legal and/or regulatory compliance - compliance with legal or regulatory requirements.

or for a secondary purpose, in which they are directly related, such as:

• Storage, deletion or confidentiality of personal data;

• Audits, investigations, fraud prevention, dispute resolution, insurance issues, litigation and defense of claims; or

• Statistical, historical or scientific research.

Screening

In addition, in order to comply with legal and regulatory obligations, to protect the Shell group’s assets and employees/contractors and specifically to ensure that the Shell group, which includes PavEnergy, can comply with trade control, anti-money laundering and/or bribery and corruption laws and other regulatory requirements, we carry out screening (pre-contract and on a periodic basis post-contract) on owners, shareholders and directors of our Business Customers, Suppliers and Business Partners. This screening takes place against publicly available, or government issued sanctions lists and media sources.

The screening does not involve profiling or automated decision making in relation to the counterparties or potential counterparties.

Communication and marketing

You may receive offers on behalf of Business Customers, Suppliers or Business Partners. You can always use the unsubscribe functionality through the various digital channels we use to interact with you.

The personal data addressed in this Privacy Policy are processed only:

• to take action, at the request of an individual, prior to the conclusion of a contract;

• when necessary to comply with a legal or regulatory obligation to which PavEnergy's company(ies) are subject;

• where necessary for the purposes of the legitimate interests of PavEnergy's company(ies), except where the interests or freedom and fundamental rights of the individual(s) prevail over such interests; or

• (only when required by law) with the explicit consent of the individual.

In cases where the processing is based on consent and is subject to applicable local law, which may provide otherwise, you will have the right to withdraw your consent at any time. This will not affect the validity of the processing prior to the withdrawal of consent.

Security of your personal data

We implement technologies and policies to protect your privacy from unauthorized access and misuse. We may use encryption, in particular, for some of our services and apply an authentication and verification process for access to Pavilion Energy group services, and we will regularly test and evaluate the effectiveness of our security measures.

Your personal data are exclusively processed for the purposes referred to above and will only be shared on a strict need to know basis with:

• any company that is a member of our group of companies, which includes our parent company Shell, where necessary for internal administrative purposes, corporate strategy, auditing and monitoring, sanctions screening and research and development

• we may also share your personal data with our group companies where they provide products and services to us that help us to provide products and services to you as our customer.

• we may also share your data within our group of companies to offer you promotions or to inform you about related products and/or services. This is based on your marketing consent preferences and in all cases any marketing material will be sent to you by us only.

• our authorized 3rd party agents, service providers and/or subcontractors on need-to-know basis.

• a competent public authority, government, regulatory or fiscal agency where it is necessary to comply with a legal or regulatory obligation to which we are subject to or as permitted by applicable local law.

• on request of a party, we can forward your data to such party if such party has a legitimate interest to obtain your personal data. We and the requesting party will conduct a legitimate interest assessment to determine whether and which information is shared.

Interaction with Pavilion Energy group through social networks

If you choose to interact with PavEnergy through a social network operated by PavEnergy ("PavEnergy Social Network"), such as LinkedIn, your personal data (your name, your profile picture and the fact that you have an interest in PavEnergy), depending on the privacy settings set on the social media platform, will be visible to everyone who visits your personal page and also to PavEnergy. PavEnergy does not monitor your activity on the different social networks you use. If you send a message to PavEnergy via a social network's messaging service, that message will be retained for a maximum of one month after it is received.

In addition, and to the extent that PavEnergy is responsible in conjunction with the social media platform, PavEnergy will have access, through the social network, to a set of data with statistics and insights that help you understand the types of actions you take on the PavEnergy Social Networks. For more information on how your personal data is processed on social networks, including any targeted advertising you may receive, please refer to your privacy settings, accessible in your social network account.

Transmission of your personal data to other countries

When your personal data is transmitted to companies that are part of the Shell group and/or authorized third parties located outside your country, we take organizational, contractual and legal measures to ensure that it is processed exclusively for the purposes mentioned above, and that adequate levels of protection have been implemented to preserve it. Among these measures are the Binding Corporate Rules for transmissions between the Shell group and, for Shell companies in the European Union, transfer mechanisms approved by the European Commission for transmissions to third parties, as well as any other local legal requirements. You can find a copy of Shell's Binding Corporate Rules at shell-binding-corporate-rules.pdf by contacting us at privacy-office-SI@shell.com.

The personal data collected by Pavilion Energy group for these processes, whether directly or indirectly, is necessary to:

• Satisfy legal and/or necessary requirements to enter into a contract with a counterparty and continue to enter into contracts with that counterparty; or

• Maintain contact with Commercial Customers, Suppliers and Business Partners.

Failure to provide the requested information will adversely affect our ability to communicate with you or enter into or continue to enter into contracts with a counterparty.

We will only hold your personal data for a defined period.

With some exceptions which are explained in supplementary privacy statements, any personal data that are required for the purposes of conclusion and execution of agreements with Business Customers, Suppliers and Business Partners or for considering bids or tenders, will be held during the duration of the contractual relationship and up to 15 years after. For agreements which have a term of more than five years and for the purposes set out above, these agreements will be held for 35 years with effect from the commencement of the agreement.

In all other cases for the purposes set out above, including personal data gathered as part of any unsuccessful bids or which relates to the screening against publicly available or government issued sanctions lists and media sources, such personal data are held for no longer than 15 years after it was first gathered.

In all cases information may be held for (a) a longer period of time where there is a legal or regulatory reason to do so (in which case it will be deleted once no longer required for the legal or regulatory purpose) or (b) a shorter period where the individual objects to the processing of their personal data and there is no longer a legitimate business purpose to retain it.

Our goal is to keep our information as accurate as possible. You can request:

• access to your personal data;

• correction or deletion of personal data (but only when it is no longer necessary for a legitimate business purpose);

• that you stop receiving marketing communications on behalf of the Business Customer, Supplier or Business Partner;

• that the processing of your personal data is restricted; and/or

• the receipt of the personal data you have provided to PavEnergy, in a structured and digital manner, in order to transmit this data to a third party, if this is technically feasible.

To make these requests, please contact us at the e-mail privacy-office-SI@shell.com.

If you have any problems, questions, or complaints about the processing of your personal data, please contact us at dataprotectionoffice@pavilionenergy.com, or in writing at either of the following addresses:

• Singapore: The Office of the Data Protection Officer, Pavilion Energy, 12 Marina Boulevard, #37-02, Marina Bay Financial Centre Tower 3, 018982, Singapore.

• Spain: The Office of the Data Protection Officer, Pavilion Energy, Torre de Cristal, Paseo de la Castellana 259C, Planta 21 Sur, 28046 Madrid.

As we are part of the Shell group, you can also contact the Shell Group Chief Privacy Office at Shell International B.V. The Hague, Netherlands - Commercial Register No. 27155369 Correspondence: P.O. Box 162, 2501 AN, The Hague, alternatively, you can also send an email to the Shell Group Privacy Office in privacy-office-SI@shell.com

If you are not satisfied with the processing of your personal data by us, you have the right to lodge a complaint with the Shell group regulator, which is the Dutch Data Protection Authority located at Hoge Nieuwstraat 8, 2514 EL The Hague, The Netherlands. Please visit https://autoriteitpersoonsgegevens.nl/en for more information or your own data protection authority Personal Data Protection Commission at Personal Data Protection Commission Singapore | PDPC for more information or www.aepd.es (Spain).

We use cookies and similar technologies that collect and store information when you visit our website. This is to enable us to identify your internet browser and collect data on your use of our website, which pages you visit, the duration of your visits and identify these when you return so that we improve your experience when visiting our website(s). You can control and manage your cookies preferences by adjusting your browser settings or using the cookies preference tool.

This Privacy Policy may be amended from time to time. We advise you to regularly re-read this Privacy Policy to check for changes. This Privacy Policy was last updated in March 2025.