Website Privacy Policy

Version 1.0,

October 15, 2026

1. Who is responsible, and how to reach us

EH Group Engineering AG, Chemin de la Vuarpillière 27, 1260 Nyon, Switzerland (enterprise identification number CHE-373.771.678), operating as EH Energy ("EH", "we", "us"), is the controller of the personal data collected through www.eh.energy (the "website") and in the business dealings described in section 3.

‍

Privacy contact: privacy@eh.energy, or by post to the address above, marked "Data protection".

2. Which laws apply

We process personal data in accordance with the Swiss Federal Act on Data Protection (FADP). Where the EU General Data Protection Regulation (GDPR) or the UK GDPR applies to the way we handle your data, for example because you are in the European Economic Area or the United Kingdom and we offer our products to you there, this policy also gives the additional information those laws require. Where other laws give you rights in relation to your personal data, we will honor them to the extent they apply.

3. What we collect, why, and on what basis

We collect personal data when you give it to us, when your use of the website generates it, or when we receive it in the course of our business dealings with your organization. The table lists each situation. "Basis" refers to Article 6(1) GDPR for readers in the EEA and the UK; under Swiss law the same processing rests on our legitimate interests, your consent or a contract, as indicated.

When	What we collect	Why	Basis	Kept for
You visit the website	Technical data sent by your browser: IP address, browser type and version, operating system, device type, language, referring page, pages viewed and the date and time of each request. Our hosting provider records this in access logs.	To deliver the pages you request, keep the website secure, detect abuse and fix errors.	Legitimate interest in running a secure website (Art. 6(1)(f)).	Access logs are kept by our hosting and security providers for a short period, and longer only to investigate a security incident.
You work for a customer, supplier, partner or other organization we deal with	Your name, job title, business contact details and our correspondence with you, received from you, from your colleagues or from public sources such as your organization's website or professional networks.	To manage our business relationship with your organization.	Legitimate interest in managing our business relationships (Art. 6(1)(f)).	After the relationship ends; accounting records for ten years.
You use the contact form or write to us by email	Name, company, job title, email address, telephone number (optional), country, the subject of your inquiry and the text of your message, plus any information you choose to give us.	To answer your inquiry, follow up on the business matter you raise, and keep a record of our correspondence.	Steps at your request before a contract (Art. 6(1)(b)) and our legitimate interest in responding to and following up on inquiries (Art. 6(1)(f)).	For the duration of our exchange and any resulting relationship, then after the last contact, unless a longer period is required by law or to defend legal claims. If your inquiry leads to a contract, the records that form part of our accounting, such as offers, orders, contracts and invoices, are kept for ten years under Swiss accounting law.
You download a document (a data sheet, case study, use case or white paper)	Name, company, business email address, country, the document requested and the date.	To send or unlock the document you asked for, to know who is interested in which products, and, if you tick the separate box, to send you EH news and product updates by email and measure whether they are opened and which links are clicked.	Delivering the document: steps at your request (Art. 6(1)(b)). Understanding interest in our products: legitimate interest (Art. 6(1)(f)). Marketing email: your consent (Art. 6(1)(a)), which you can withdraw at any time through the link in every message.	After your last download or interaction; marketing consent until you withdraw it, after which we keep only what is needed to honor your choice.
You apply for a position	The information in your application and CV: name, contact details, work history, education, qualifications, the position applied for, any documents you attach, and the notes of our interviews and assessments. Our careers page is provided by Ashby, a recruiting platform; the application form runs on Ashby's systems.	To assess your application, communicate with you about it, and, if you agree, consider you for future positions.	Steps at your request before an employment contract (Art. 6(1)(b)); our legitimate interest in recruiting (Art. 6(1)(f)); your consent for any longer retention (Art. 6(1)(a)).	If you are not hired, after we tell you of our decision, so that we can respond to any questions or claims about it; longer only if you agree to stay in our talent pool. If you are hired, your application becomes part of your personnel file.
You browse the website and accept analytics cookies	Pseudonymous usage data: the pages you view, how long you stay, how you arrived, your approximate location (country or city), device and browser type, and a random identifier stored in a cookie. Our analytics provider states that it does not log or store the IP addresses of visitors from Switzerland, the EU and the UK.	To understand how the website is used and improve it.	Your consent (Art. 6(1)(a)), given through the cookie banner and withdrawable at any time through "Cookie settings" in the footer.	The cookie lasts unless you delete it.
You play an embedded video	When you start a video, the video platform receives your IP address and may set cookies or use similar technologies as described in our Cookie Policy. Nothing is loaded from the platform until you click play and, where required, accept the relevant cookies.	To show you the video.	Your consent (Art. 6(1)(a)).	Governed by the platform's own policy.
You follow or interact with our LinkedIn page or other social media	Your public profile information and your interactions with our posts; LinkedIn also gives us aggregated statistics about visitors to our page.	To communicate with you and understand the reach of our posts.	Legitimate interest (Art. 6(1)(f)). For the page statistics, LinkedIn's page terms explain how responsibility is shared between LinkedIn and us.	Messages and comments as for contact form data; statistics are aggregated.

We do not ask for sensitive personal data (for example about health, religious beliefs or political opinions) through the website, and we ask you not to include any in a message or an application unless it is necessary. We do not use the website to make decisions about you based solely on automated processing. We do not track you across other websites. We do not sell personal data, and we do not share it for money or for anyone else's advertising.

‍

Apart from the technical data your browser sends automatically when you visit the website, giving us personal data is voluntary and is not required by law or by contract. Without the data marked as required on a form we cannot answer your inquiry, send the document or consider your application.

4. Cookies and similar technologies

The website uses cookies and similar technologies. Strictly necessary ones make the website work and need no consent. All others, such as analytics and marketing cookies and embedded third-party content, are used only if you agree through the cookie banner when you first visit. You can change or withdraw your choice at any time through "Cookie settings" in the website footer. Withdrawing consent does not affect the lawfulness of what was done before. Part B of this policy, our Cookie Policy, lists every cookie we set, who sets it, why, and how long it lasts.

‍

5. Who receives your data

We share personal data only with the recipients below and only to the extent needed for the purposes in section 3.

‍

Service providers who process data on our behalf under a data processing agreement and may not use it for their own purposes:

Provider	What it does for us	Where it processes data
Webflow, Inc., San Francisco, USA	Hosts the website and its content delivery network, and stores form submissions	USA (with sub-processors including Amazon Web Services and Cloudflare)
Ashby, Inc., San Francisco, USA	Provides the careers page and applicant tracking	USA
Google Ireland Limited / Google LLC	Web analytics (Google Analytics 4)	EU and USA
MailChimp	Sends our emails and stores contact and lead records	USA
CookieYes	Records your cookie choices	Malta & Ireland
IT, email and document providers we use in our day-to-day work, including Microsoft 365 and Google Workspace	Store our correspondence and files	EU and USA

Other recipients: companies in our group, EH Group Technologies Inc. (USA) and EH Group Systems Pvt Ltd (India), where your inquiry concerns their region or activities or where they provide services to us; professional advisers, insurers and auditors under a duty of confidentiality; authorities, courts and law enforcement where the law requires it or to establish, exercise or defend legal claims; and a successor to our business in the event of a merger, acquisition or reorganization, who would be bound by this policy.

‍

6. Transfers abroad

We are in Switzerland. Some of the recipients above are in the United States, in the European Economic Area, in the United Kingdom and in India. Data may also be accessed from those countries by our group companies.

‍

The European Economic Area and the United Kingdom are recognized by the Swiss Federal Council as providing adequate data protection, and Switzerland is recognized as adequate by the European Commission and the United Kingdom, so data moves between them without further safeguards.

‍

For the United States, we transfer data either to organizations certified under the Swiss-US Data Privacy Framework, the EU-US Data Privacy Framework or its UK Extension, which the Swiss Federal Council, the European Commission and the UK government respectively recognize as providing adequate protection for certified organizations, or under the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914) with the amendments required for transfers from Switzerland and for transfers from the United Kingdom.

‍

For India and any other country not recognized as adequate, we rely on the Standard Contractual Clauses with the amendments required by Swiss law. In individual cases we may instead rely on the exception for a disclosure directly connected with the conclusion or performance of a contract with you (Article 17 FADP), for example when you ask our Indian group company to prepare an offer.

‍

You can ask us for a copy of the safeguards we use through the privacy contact in section 1.

7. How we protect your data

We apply technical and organizational measures appropriate to the risk, including encrypted connections (HTTPS) across the website, access to personal data restricted to the people who need it, contractual security obligations on our providers, and regular deletion under the periods in section 3. No transmission over the internet is completely secure; if you have a concern about the security of your data, contact us.

8. Your rights

Subject to the conditions in applicable law, you have the right to:

‍

ask whether we process personal data about you, and receive a copy of it and the information listed in this policy;
have inaccurate data corrected and incomplete data completed;
have your data deleted, or its processing restricted, where the law provides for it;
object to processing that rests on our legitimate interests, including direct marketing, at any time;
receive the data you gave us in a structured, commonly used, machine-readable format, and have it transmitted to another controller where technically feasible;
withdraw any consent you have given, at any time and free of charge, without affecting the lawfulness of processing before the withdrawal;
not be subject to a decision based solely on automated processing that produces legal or similarly significant effects on you (we make no such decisions through the website).

‍

To exercise a right, write to privacy@eh.energy or to the postal address in section 1. We may ask you to verify your identity. We respond without undue delay and in any event within 30 days of receiving your request or, where the GDPR or the UK GDPR applies to it, within one month if that is shorter. Where the GDPR or UK GDPR allows, we may extend this by up to two further months because of the complexity or number of requests; we will tell you within the first month, with the reasons. Exercising your rights is free. We may charge a reasonable fee or decline to act only where a request is manifestly unfounded or excessive.

‍

You may also lodge a complaint with a supervisory authority: in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC, Feldeggweg 1, 3003 Bern, www.edoeb.admin.ch); in the EEA, the authority of the member state where you live, work or where the matter arose; in the United Kingdom, the Information Commissioner's Office (ico.org.uk). We would appreciate the chance to address your concern first.

9. Children

The website is intended for business users and job applicants. We do not knowingly collect personal data through the website from anyone under 16, except in an application for an apprenticeship, which we handle with the same care as any other application. If you believe a child has given us personal data, contact us and we will delete it.

10. Links to other websites

The website links to third-party websites and embeds some third-party services. We decide which embedded services are loaded and, where consent is needed, load them only after you agree (see Part B). What the third party then does with the data it receives is governed by its own privacy policy, which we encourage you to read.

11. Changes to this policy

We may update this policy from time to time, for example when we add a feature to the website or change a provider. The version in force is the one published on this page, with its version number and date. Material changes will be listed in the change log below.

Change log

Version 1.0, Oct 15, 2026: first publication on the new website.

‍

Part B: Cookie Policy

Version 1.0, Oct 15, 2026. This Cookie Policy is part of the Privacy Policy of EH Group Engineering AG for www.eh.energy.

B1. What cookies and similar technologies are

Cookies are small text files that a website stores in your browser. Similar technologies include local storage, pixels and scripts that read information from your device. We use them to make the website work and, only if you agree, to understand how the website is used, to measure our marketing and to show embedded content such as videos. Some are set by us ("first-party"); others are set by providers whose services are embedded in the website ("third-party").

B2. Your choices

When you first visit, a banner asks whether you accept cookies that are not strictly necessary. "Accept all" and "Reject all" have equal weight; "Settings" lets you choose by category. Nothing that needs consent is loaded before you choose. You can change or withdraw your choice at any time through "Cookie settings" in the website footer, and you can delete cookies through your browser at any time. We record your choice, with the date and time, the categories you accepted or refused and the version of the banner and of this policy, so that we can show that consent was given and respect it on your next visit. We keep this record for as long as we rely on your choice.

‍

Rejecting non-essential cookies does not limit your access to the website; a few embedded features, such as video, will ask for your consent before they load.

B3. The cookies we use

Strictly necessary (no consent needed):

Name	Provider	Purpose	Duration
cookieyes-*	CookieYes	CookieYes sets this cookie for consent solution management.	1 Year
_cfuvid	Cloudflare	Cloudflare sets this cookie to track users across sessions to optimize user experience by maintaining session consistency and providing personalized services	Session

Functional (consent needed):

Name	Provider	Purpose	Duration
documentsFormSubmitted	EH Energy	EH Energy sets this cookie when a user submits a form to download a document to prevent them from being prompted to complete the form multiple times.	1 year

Analytics (consent needed):

Name	Provider	Purpose	Duration
_ga	Google Analytics 4	Google Analytics sets this cookie to calculate visitor, session and campaign data and track site usage for the site's analytics report. The cookie stores information anonymously and assigns a randomly generated number to recognise unique visitors.	2 years
_ga_*	Google Analytics 4	Google Analytics sets this cookie to store and count page views.	2 years

Advertisement (consent needed):

Name	Provider	Purpose	Duration
_gcl_au	Google Tag Manager	Google Tag Manager sets this cookie to experiment advertisement efficiency of websites using their services.	3 months

‍

B4. Third-party providers

Some third-party providers use the data their cookies collect for their own purposes, under their own privacy policies. Other providers set cookies only on our behalf, as the service providers listed in section 5 of the Privacy Policy: Google Analytics; Ashby, on the careers page; Cloudflare, as part of Webflow's hosting. Where a provider is in the United States, section 6 of the Privacy Policy explains the safeguards for the transfer.

B5. Changes

We update this Cookie Policy whenever we add or remove a cookie or a provider. The version and date at the top show when it was last changed; when a new category is added.