Privacy Statement

Last updated: 18 December 2025

This Privacy Statement explains how DUNE Renewables (“we”, “us”, “our”) collects, uses, and protects personal data in accordance with the General Data Protection Regulation (GDPR).

1. Who we are

DUNE Renewables

Website: https://dunerenewables.com

Email: projects@dunerenewables.com

DUNE Renewables is responsible for the processing of personal data as described in this Privacy Statement.

2. What personal data we collect

We may collect and process the following personal data:

• Name and surname

• Company name

• Email address

• Phone number

• Country or location

• Any information you provide when contacting us

• Technical data (IP address, browser type, device information)

We do not intentionally collect special categories of personal data.

3. How we collect personal data

Personal data is collected when you:

• Contact us via the website or email

• Submit a contact or request form

• Communicate with us for business or project purposes

• Visit our website (via cookies and similar technologies)

4. Purpose and legal basis of processing

We process personal data for the following purposes and legal bases:

• Responding to inquiries and project requests - Legitimate interest

• Business communication and relationship management - Legitimate interest

• Direct marketing (B2B) - Legitimate interest

• Website analytics and performance - Consent

• Compliance with legal obligations - Legal obligation

5. Direct marketing

Your personal data may be processed for direct marketing purposes related to our services. You have the right to object to direct marketing at any time by contacting us or using the provided request form.

6. Data retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law.

7. Data sharing

We do not sell personal data.

Your data may be shared only with:

• IT and website service providers

• CRM and email communication tools

• Professional advisers (if legally required)

All third parties process data under contractual confidentiality and GDPR compliance obligations.

8. Data transfers outside the EU

Where personal data is transferred outside the European Economic Area, appropriate safeguards are applied in accordance with GDPR requirements.

9. Data security

We apply appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, or disclosure.

10. Your rights under GDPR

You have the right to:

• Access your personal data

• Correct inaccurate data

• Request deletion of your data

• Restrict or object to processing

• Request data portability

• Withdraw consent at any time

• Lodge a complaint with a supervisory authority

11. Exercising your rights

To exercise your rights or submit a GDPR request, please contact us at:

projects@dunerenewables.com

We will respond within one month, as required by GDPR.

12. Changes to this Privacy Statement

We may update this Privacy Statement from time to time.

The latest version will always be available on our website.