Privacy Policy

This Privacy Policy applies to all Personal Information collected through:

• The Energy Panda website
• Customer Portal
• Mobile applications
• Subscription enrollment
• Utility enrollment process
• Customer Support
• Marketing communications
• Surveys
• Identity verification
• Third-party integrations used to provide the Services

This Privacy Policy does not apply to third-party websites, utility providers, Retail Electric Providers, or other organizations that maintain their own privacy policies.

This Privacy Policy is incorporated into and forms part of the Energy Panda Terms of Service.

If there is a conflict between this Privacy Policy and the Terms of Service regarding privacy matters, this Privacy Policy governs unless Applicable Law requires otherwise.

This Privacy Policy applies to information collected from:

• Customers
• Prospective customers
• Website visitors
• Authorized representatives
• Individuals communicating with Energy Panda

Certain Services may require additional privacy notices or consents, which will supplement this Privacy Policy.

Energy Panda may update this Privacy Policy from time to time to reflect:

• changes in our Services
• changes in applicable laws
• operational improvements
• security enhancements
• new technologies
• business developments

If we make material changes, we will provide notice through appropriate methods, such as email, the Customer Portal, or our website, where required by Applicable Law.

Your continued use of the Services after the effective date of an updated Privacy Policy constitutes acknowledgment of the revised Privacy Policy, except where Applicable Law requires additional consent.

Questions regarding this Privacy Policy may be directed to Energy Panda using the contact information published on our official website or otherwise provided to you in connection with the Services.

Depending on your interactions with the Services, Energy Panda may collect the following categories of information.

We may collect information that identifies or reasonably relates to you, including:

• Full legal name
• Residential address
• Mailing address
• Email address
• Telephone number
• Date of birth
• Government-issued identification
• Driver's license number
• Driver's license image
• State of issuance
• Expiration date
• Other identity verification information required to provide the Services

To provide electricity management services, we may collect:

• Utility account numbers
• ESI IDs or similar service identifiers
• Meter numbers
• Service addresses
• Current Retail Electric Provider
• Utility Provider information
• Contract expiration dates
• Rate class
• Load profile
• Historical electricity usage
• Billing history
• Account status
• Enrollment history
• Utility correspondence

When you purchase a Subscription, we or our payment processors may collect:

• Credit card information
• Debit card information
• ACH banking information
• Billing address
• Payment history
• Transaction identifiers
• Payment authorization records

Energy Panda generally relies on PCI-compliant third-party payment processors and does not intentionally store full payment card numbers unless expressly disclosed.

When you create an Account, we may collect:

• Username
• Password (stored in encrypted or hashed form, as applicable)
• Authentication credentials
• Security questions or verification methods
• Subscription status
• Communication preferences
• Customer support history

To prevent fraud and comply with utility enrollment requirements, we may collect or receive:

• Identity verification results
• Government ID validation status
• Address verification
• Utility verification results
• Fraud detection indicators
• Device verification results
• Public record confirmations where legally permitted

Verification may be performed using third-party identity verification providers.

When you use the Services, we may automatically collect certain technical information, including:

• IP address
• Browser type
• Operating system
• Device type
• Device identifiers
• Mobile device identifiers
• Internet service provider
• Language settings
• Time zone
• Referring website
• Pages viewed
• Clickstream information
• Session duration
• Error logs
• Diagnostic information

Energy Panda may use:

• Cookies
• Session cookies
• Persistent cookies
• Web beacons
• Pixels
• Local storage
• Analytics technologies
• Similar tracking technologies

These technologies help us:

• Authenticate users
• Maintain secure sessions
• Remember preferences
• Improve website performance
• Measure usage
• Detect fraud
• Personalize the user experience

You may be able to manage cookie preferences through your browser settings; however, disabling certain cookies may affect the functionality of the Services.

We may collect information contained in communications you send to us, including:

• Emails
• Customer support requests
• Live chat messages
• SMS messages
• Recorded customer service calls (where permitted by law)
• Survey responses
• Feedback
• Reviews
• Other correspondence

If you choose to receive marketing communications, we may collect information regarding:

• Marketing preferences
• Promotional campaign interactions
• Email open rates
• Link clicks
• Event registrations
• Referral participation
• Contest entries

You may opt out of marketing communications at any time, though we may continue to send transactional or legally required communications.

We may receive information from:

• Retail Electric Providers
• Utility Providers
• Identity verification vendors
• Payment processors
• Analytics providers
• Fraud prevention providers
• Public databases where legally permitted
• Business partners
• Referral partners
• Customer-authorized third parties

We may combine information received from third parties with information collected directly from you to provide and improve the Services.

Except where expressly required to provide the Services or where required by law, Energy Panda does not intentionally collect:

• Biometric identifiers
• Medical records
• Health information
• Precise geolocation data
• Information regarding children under the age permitted by applicable law to use the

Services.

If we become aware that such information has been collected inadvertently, we will take reasonable steps to delete it, subject to legal obligations.

You are responsible for ensuring that the information you provide is accurate, complete, and current. Failure to provide accurate information may affect your ability to use the Services or complete utility enrollments.

Certain information is collected automatically through our systems for purposes including:

• Security
• Fraud detection
• Website administration
• Performance monitoring
• Troubleshooting
• Product improvement
• Compliance
• Analytics

Energy Panda may create aggregated, anonymized, or de-identified information that cannot reasonably identify an individual. Such information may be used for:

• Business analytics
• Product development
• Market research
• Statistical reporting
• Operational improvements
• Benchmarking

Where required by Applicable Law, Energy Panda will maintain such information in de-identified form and will not attempt to re-identify it except as permitted by law.

The categories of information described in this Article are retained only for as long as reasonably necessary to:

• Provide the Services
• Fulfill contractual obligations
• Comply with legal and regulatory requirements
• Resolve disputes
• Detect and prevent fraud
• Enforce our agreements
• Protect the rights, safety, and security of Energy Panda, our customers, and others

Retention periods may vary depending on the type of information and applicable legal obligations.

Energy Panda collects, processes, stores, and uses Personal Information and Sensitive Personal Information only for legitimate business purposes consistent with this Privacy Policy, our Terms of Service, applicable customer authorizations, and Applicable Law.

We do not collect personal information for purposes unrelated to our Services unless you provide additional consent or Applicable Law otherwise permits or requires such processing.

We use your information to provide, operate, maintain, improve, and support the Energy Panda platform and related Services.

This includes:

• Creating and maintaining your customer account
• Verifying your identity
• Processing subscription registrations
• Managing recurring subscriptions
• Providing customer support
• Facilitating electricity shopping and comparison services
• Preparing enrollment requests
• Coordinating provider changes
• Managing electricity contract renewals
• Delivering account notifications
• Maintaining customer records

We use government-issued identification, including driver's license information when required, to:

• Verify your identity
• Prevent identity theft
• Detect fraudulent activity
• Authenticate customer accounts
• Satisfy utility enrollment requirements
• Comply with legal and regulatory obligations
• Protect both Energy Panda and our customers from unauthorized account activity

Identity verification may be performed directly by Energy Panda or through qualified third-party identity verification providers.

Where authorized by you, we use your information to:

• Obtain electricity usage history
• Retrieve utility account information
• Request pricing from Retail Electric Providers
• Compare electricity plans
• Prepare enrollment documentation
• Submit enrollment requests
• Facilitate electricity provider changes
• Coordinate contract renewals
• Communicate with Utility Providers and Retail Electric Providers on your behalf

We use your information to administer your Subscription, including:

• Processing recurring payments
• Managing billing cycles
• Updating payment information where authorized
• Sending payment confirmations
• Processing cancellations
• Managing subscription renewals
• Preventing payment fraud
• Responding to billing inquiries

We use your information to communicate with you regarding:

• Account activity
• Enrollment status
• Contract expiration dates
• Subscription renewals
• Billing matters
• Security alerts
• Identity verification requests
• Customer support
• Legal notices
• Changes to our agreements

These communications are generally considered necessary to provide the Services.

With your consent where required by law, we may use your information to send:

• Promotional offers
• Educational content
• Energy market updates
• New product announcements
• Customer newsletters
• Referral program information
• Surveys and customer satisfaction requests

You may opt out of marketing communications at any time using the unsubscribe instructions provided or by updating your communication preferences.

Opting out of marketing communications does not affect our ability to send transactional or legally required communications.

We use Personal Information to detect, investigate, prevent, and respond to:

• Fraud
• Identity theft
• Unauthorized account access
• Payment fraud
• Cybersecurity threats
• Suspicious enrollment activity
• Abuse of the Services
• Violations of our Terms of Service

Where appropriate, we may cooperate with law enforcement or regulatory authorities as permitted or required by law.

We use customer information to:

• Authenticate users
• Secure customer accounts
• Monitor for unauthorized access
• Detect suspicious login attempts
• Maintain audit logs
• Improve cybersecurity
• Protect our systems
• Investigate security incidents

Security-related processing helps protect both our customers and the integrity of the Energy Panda platform.

We may analyze information to improve:

• Website functionality
• Mobile applications
• Customer experience
• Enrollment processes
• Customer support
• Software performance
• Automation systems
• Fraud detection
• Platform reliability

Where practical, we use aggregated or de-identified information for product improvement activities.

We may use your information to comply with:

• Applicable laws
• Court orders
• Government investigations
• Regulatory inquiries
• Recordkeeping obligations
• Tax requirements
• Consumer protection laws
• Utility regulations

We may use your information to:

• Enforce our Terms of Service
• Enforce Subscription Agreements
• Resolve disputes
• Investigate complaints
• Respond to legal claims
• Collect unpaid subscription fees
• Protect the legal rights of Energy Panda

Information may also be used for legitimate internal business purposes, including:

• Financial reporting
• Internal auditing
• Business planning
• Quality assurance
• Employee training
• Risk management
• Insurance claims
• Corporate transactions

Energy Panda may use automated systems, machine learning models, or artificial intelligence tools to assist with:

• Electricity plan comparisons
• Fraud detection
• Customer support
• Workflow automation
• Data analysis
• Service optimization

These systems are intended to support human decision-making and operational efficiency. Final enrollment decisions remain subject to customer authorization and applicable provider requirements.

We may use aggregated, anonymized, or de-identified information for:

• Statistical analysis
• Product development
• Industry benchmarking
• Research
• Market analysis
• Business intelligence

We will not attempt to re-identify de-identified information except where permitted or required by Applicable Law.

Energy Panda does not sell your Personal Information or Sensitive Personal Information for monetary compensation. If our practices change in the future, we will update this Privacy Policy and provide any notices required by Applicable Law.

Sensitive Personal Information, including driver's license information, is used only for legitimate business purposes such as:

• Identity verification
• Utility enrollment
• Fraud prevention
• Security
• Compliance with Applicable Law
• Customer account administration

We do not use Sensitive Personal Information to infer characteristics about you or for unrelated advertising purposes.

Energy Panda may retain records documenting how customer information has been processed for purposes of:

• Regulatory compliance
• Audit requirements
• Security investigations
• Legal defense
• Dispute resolution
• Internal governance

Such records may include timestamps, system logs, audit trails, and verification records.

Energy Panda values your privacy and does not sell your Personal Information or Sensitive Personal Information for monetary compensation. We only disclose your information when:

• You authorize us to do so
• It is necessary to provide the Services
• It is necessary to complete utility enrollments
• It is required by law
• It is necessary to protect the rights, safety, or security of Energy Panda, our customers,

or others.

Whenever commercially reasonable, we seek to limit disclosures to only the information necessary for the intended purpose.

In order to provide electricity shopping and enrollment services, we may disclose information to Retail Electric Providers ("REPs"), including:

• Name
• Service address
• Mailing address
• Telephone number
• Email address
• Utility account number

• Historical electricity usage
• Contract information
• Identity verification status
• Driver's license information, where required by the provider or applicable law

Such disclosures are limited to information reasonably necessary to facilitate enrollment, contract administration, renewals, customer support, or other authorized Services.

We may share information with Utility Providers or Transmission and Distribution Utilities ("TDUs") when necessary to:

• Verify utility accounts
• Retrieve historical usage
• Confirm service addresses
• Coordinate enrollments
• Complete provider switches
• Resolve account issues
• Verify customer identity where required

To verify identity and prevent fraud, we may disclose information to trusted identity verification vendors.

Information shared may include:

• Name
• Date of birth
• Driver's license information
• Residential address
• Utility account information
• Telephone number
• Email address
• Device information
• Fraud indicators

These vendors are contractually expected to use such information solely to perform identity verification or fraud prevention services for Energy Panda.

Subscription payments are generally processed through independent PCI DSS-compliant payment processors.

We may disclose information necessary to process payments, including:

• Name
• Billing address
• Payment amount
• Transaction identifiers
• Subscription status

Energy Panda generally does not receive or store complete payment card numbers unless expressly disclosed.

Energy Panda may utilize secure third-party cloud infrastructure providers for:

• Data storage
• Website hosting
• Customer portals
• Disaster recovery
• System backups
• Software infrastructure

These providers process information solely on behalf of Energy Panda and under contractual obligations designed to protect customer information.

We may share limited information with vendors assisting with:

• Customer service
• Live chat
• Help desk operations
• Email communications
• Technical support
• CRM systems

Access is limited to information reasonably necessary to perform support services.

Energy Panda may share limited technical information with analytics providers to help us understand:

• Website performance
• Software functionality
• User experience
• Error reporting
• Product improvements

Analytics information generally does not include your driver's license or other sensitive identity documents unless necessary to troubleshoot a specific issue.

We may disclose information to our:

• Attorneys
• Certified Public Accountants
• Auditors
• Insurance providers
• Financial advisors
• Consultants

Such disclosures are made only when reasonably necessary for legal, regulatory, financial, insurance, or business purposes and are generally subject to confidentiality obligations.

If Energy Panda undergoes:

• A merger
• Acquisition
• Asset sale
• Corporate reorganization
• Financing transaction
• Bankruptcy
• Change of control

customer information may be transferred as part of that transaction, subject to Applicable Law.

The acquiring organization will generally be required to honor this Privacy Policy unless a revised policy is provided in accordance with Applicable Law.

We may disclose information if we reasonably believe disclosure is necessary to:

• Comply with Applicable Law
• Respond to subpoenas
• Respond to court orders
• Respond to governmental investigations
• Cooperate with regulatory authorities
• Comply with utility regulations
• Enforce our legal rights

Where legally permitted, we may notify affected customers before producing information.

We may disclose information where reasonably necessary to:

• Prevent fraud
• Protect customer safety
• Investigate security incidents
• Protect Energy Panda's legal rights
• Defend against legal claims
• Prevent financial loss
• Protect our employees
• Protect other customers

We may disclose information whenever you expressly authorize us to do so. Examples include:

• Utility Enrollment Authorization
• Limited Power of Attorney
• Written customer instructions
• Electronic authorizations
• Identity verification consents

You may revoke certain authorizations as described in the applicable agreement, although revocation may limit our ability to provide the Services.

Energy Panda may disclose aggregated or de-identified information that does not reasonably identify an individual for purposes including:

• Market research
• Statistical analysis
• Product development
• Industry benchmarking
• Academic research
• Business reporting

We will not knowingly disclose de-identified information in a manner intended to re-identify individuals.

Energy Panda does not sell:

• Driver's license information
• Government-issued identification
• Date of birth
• Utility account credentials
• Payment information
• Sensitive Personal Information

for monetary consideration.

If our practices materially change, we will update this Privacy Policy and provide any notices or obtain any consents required by Applicable Law.

Certain third-party vendors act solely as service providers or data processors on behalf of Energy Panda.

Such vendors are generally expected, through contractual obligations, to:

• Process information only under our instructions
• Maintain reasonable security measures
• Use information only for authorized purposes
• Return or securely dispose of information when services conclude, where applicable

If Energy Panda utilizes vendors that process information outside the United States, we will take commercially reasonable measures to ensure that appropriate safeguards are implemented consistent with Applicable Law.

Energy Panda does not knowingly disclose Personal Information relating to children in violation of Applicable Law. If we learn that information from a child has been collected improperly, we will take reasonable steps to address the issue consistent with legal obligations.

As Energy Panda expands its Services to include additional utility-related offerings, telecommunications, insurance referrals, smart home technologies, or other consumer services, we may share information as reasonably necessary to provide those Services, subject to this Privacy Policy and any additional notices required by Applicable Law.

Energy Panda remains responsible for managing customer information in accordance with this Privacy Policy, even when certain processing activities are performed by authorized third-party service providers on our behalf.

Energy Panda uses cookies and similar technologies to operate the Services, enhance security, improve functionality, understand website performance, personalize user experiences, and measure the effectiveness of our communications. These technologies do not replace the security measures described elsewhere in this Privacy Policy and are used in accordance with Applicable Law.

Cookies are small text files that are placed on your browser or device when you visit a website. Cookies allow websites to:

• Remember your preferences
• Authenticate users
• Maintain secure login sessions
• Improve website performance
• Measure website traffic
• Analyze visitor behavior
• Support fraud prevention
• Improve customer experience

A. Essential Cookies

These cookies are necessary for the operation of the Services.

Examples include:

• User authentication
• Secure login sessions
• Shopping cart functionality (if applicable)
• Fraud prevention
• Security monitoring
• Website performance
• Load balancing
• Customer Portal functionality

Disabling essential cookies may prevent portions of the Services from functioning properly.

B. Functional Cookies

Functional cookies remember customer preferences, including:

• Language selection
• Login preferences
• Customer settings
• User interface preferences
• Accessibility settings

C. Performance Cookies

Performance cookies help Energy Panda understand how customers interact with the Services.

Information collected may include:

• Pages visited
• Time spent on pages
• Navigation patterns
• Error reports
• Website performance metrics
• Session duration
• Device performance

This information helps improve the platform.

D. Analytics Cookies

Energy Panda may use analytics technologies to understand:

• Website traffic
• Customer engagement
• Feature usage
• Software performance
• Marketing effectiveness
• User journeys

Analytics information generally does not identify individual customers directly unless reasonably necessary for troubleshooting or security.

E. Security Cookies

Security cookies help protect both Energy Panda and its customers.

These cookies may be used to:

• Detect fraudulent activity
• Prevent unauthorized logins
• Authenticate sessions
• Monitor suspicious behavior
• Protect customer accounts

In addition to cookies, Energy Panda may use:

• Web beacons
• Pixels
• Local storage
• Session identifiers
• Device identifiers
• Log files
• Software development kits (SDKs) within mobile applications

These technologies help provide and secure the Services.

Cookies and related technologies may automatically collect:

• IP address
• Browser type
• Operating system
• Device type
• Device identifiers
• Internet service provider
• Screen resolution
• Referring website
• Pages viewed
• Time spent on pages
• Date and time of visits
• Navigation patterns
• Click activity

This information may be combined with other information described in this Privacy Policy where appropriate.

Certain cookies are used to keep you securely signed into your Account.

These cookies help:

• Prevent unauthorized access
• Authenticate customers
• Maintain secure sessions
• Detect suspicious login activity

Removing these cookies may require you to log in again.

Energy Panda may use tracking technologies to identify:

• Account takeovers
• Automated attacks
• Credential stuffing
• Fraudulent enrollments
• Bot traffic
• Malicious software
• Unauthorized account activity

These technologies are an important component of our cybersecurity program.

With your consent where required by Applicable Law, Energy Panda may use certain technologies to:

• Measure advertising effectiveness
• Evaluate referral programs
• Improve marketing campaigns
• Deliver relevant promotional content
• Understand customer engagement

If you opt out of certain marketing technologies, you may still receive non-personalized advertising.

Emails sent by Energy Panda may include technologies that allow us to understand:

• Whether an email was delivered
• Whether an email was opened
• Whether links were clicked
• Whether delivery errors occurred

This information helps improve customer communications.

Energy Panda may utilize independent analytics providers to better understand usage of the Services.

Such providers may receive limited technical information necessary to perform analytics services on our behalf. These providers are expected to process information in accordance with their contractual obligations and Applicable Law.

Most internet browsers allow you to:

• View cookies
• Delete cookies
• Block cookies
• Limit cookies
• Receive notifications before cookies are stored

Disabling cookies may reduce the functionality of portions of the Services.

You may control cookie settings through your browser. Instructions vary depending upon the browser you use. Blocking cookies does not automatically prevent all forms of online tracking.

Some browsers transmit "Do Not Track" ("DNT") signals. Because there is currently no universally accepted standard governing DNT signals, Energy Panda may not respond uniformly to all such signals. If applicable laws require us to recognize certain browser-based privacy signals, we will do so to the extent required.

As of the Effective Date of this Privacy Policy, Energy Panda does not use Sensitive Personal Information, including driver's license information, for targeted advertising. If Energy Panda introduces targeted advertising programs in the future, we will update this Privacy Policy and comply with Applicable Law, including providing any required notices or opt-out rights.

Energy Panda does not intentionally use cookies or tracking technologies to sell Sensitive Personal Information. If our practices materially change, we will update this Privacy Policy and provide any notices or choices required by Applicable Law.

Tracking technologies are used in conjunction with Energy Panda's security program to help:

• Authenticate users
• Detect unauthorized activity
• Prevent fraud
• Maintain platform integrity
• Investigate security incidents

Tracking technologies do not replace other administrative, technical, and physical safeguards described elsewhere in this Privacy Policy.

Energy Panda may update its use of cookies and similar technologies as our Services evolve. Material changes will be reflected in updates to this Privacy Policy or a separate Cookie Notice, where appropriate.

Questions regarding Energy Panda's use of cookies or similar technologies may be directed to the contact information provided at the end of this Privacy Policy.

Energy Panda recognizes that protecting customer information is fundamental to the trust our customers place in us. We maintain administrative, technical, and physical safeguards that are designed to protect Personal Information and Sensitive Personal Information from unauthorized access, acquisition, disclosure, alteration, destruction, misuse, or loss. Our security program is designed to be risk-based and is reviewed periodically as our business, technology, and regulatory obligations evolve.

Energy Panda maintains a comprehensive information security program that is intended to:

• Protect customer information
• Prevent unauthorized access
• Detect suspicious activity
• Reduce cybersecurity risk
• Maintain system integrity
• Support regulatory compliance
• Facilitate incident response
• Promote business continuity

Our security program is periodically evaluated and updated based on evolving threats and business requirements.

Administrative safeguards may include:

• Written security policies
• Employee confidentiality obligations
• Security awareness training
• Access authorization procedures
• Vendor risk management
• Background screening where appropriate
• Change management procedures
• Incident response planning
• Internal security reviews

Energy Panda uses commercially reasonable technical safeguards that may include:

• Encryption during data transmission
• Encryption of sensitive information at rest where appropriate
• Firewalls
• Secure authentication mechanisms
• Role-based access controls
• Multi-factor authentication for administrative access where appropriate
• System monitoring
• Vulnerability management
• Malware protection
• Security logging
• Secure backup procedures

Specific technical controls may change over time as technology and threats evolve.

Where applicable, physical safeguards may include:

• Controlled facility access
• Secure work environments
• Visitor management procedures
• Secure storage of records
• Equipment disposal procedures
• Environmental protections for information systems

Because driver's license information is particularly sensitive, Energy Panda applies additional safeguards intended to reduce the risk of unauthorized access.

Such safeguards may include:

• Restricted employee access
• Encryption where appropriate
• Audit logging
• Identity verification controls
• Secure retention procedures
• Secure deletion procedures when retention is no longer required

Driver's license information is collected only when reasonably necessary to provide the Services or comply with legal or utility requirements.

Access to customer information is limited to personnel, contractors, and authorized service providers who have a legitimate business need to access such information in order to perform their assigned responsibilities.

Access permissions are intended to reflect the principle of least privilege, meaning personnel should have access only to the information reasonably necessary to perform their duties.

Energy Panda employs authentication measures intended to protect customer accounts.

Depending upon the circumstances, authentication may include:

• Password verification
• Multi-factor authentication
• Identity verification
• Device recognition
• Security questions
• Verification codes
• Risk-based authentication

Customers are responsible for maintaining the confidentiality of their login credentials.

Where appropriate and commercially reasonable, Energy Panda uses encryption technologies to help protect customer information:

• During transmission across public networks; and
• During storage of certain categories of Sensitive Personal Information

Encryption methods may evolve over time to address changing technology and security standards.

Energy Panda maintains monitoring capabilities designed to identify:

• Unauthorized access attempts
• Suspicious activity
• System errors
• Potential cybersecurity incidents
• Authentication failures
• Administrative access events

Audit logs may be maintained for operational, security, compliance, and investigative purposes.

Energy Panda may periodically perform security evaluations, including:

• Vulnerability assessments
• Penetration testing
• Software updates
• Patch management
• Configuration reviews
• Security monitoring

These activities are intended to improve the security of the Services.

When Energy Panda engages third-party service providers that process customer information on our behalf, we seek to work with vendors that maintain security practices appropriate to the nature of the services provided.

Depending on the services involved, we may require contractual commitments relating to:

• Confidentiality
• Security
• Incident notification
• Appropriate use of customer information
• Secure disposal of customer information upon termination of the relationship, where

applicable.

Customers also play an important role in protecting their information.

You are responsible for:

• Maintaining strong passwords
• Protecting your devices
• Keeping contact information current
• Promptly reporting suspected unauthorized access
• Reviewing account activity
• Using secure internet connections where practical

Energy Panda cannot control the security of customer-owned devices or personal email accounts.

Energy Panda maintains procedures designed to identify, investigate, respond to, and recover from security incidents affecting the Services. If a security incident involving Personal Information requires notification under Applicable Law, Energy Panda will provide notice consistent with applicable legal requirements.

Energy Panda maintains business continuity and disaster recovery planning intended to promote the continued availability of critical business operations following certain operational disruptions. Recovery procedures may include:

• Secure backups
• System restoration
• Redundant infrastructure where appropriate
• Operational continuity planning

Although Energy Panda implements commercially reasonable safeguards designed to protect customer information, no security program, network, software, hardware, internet transmission, cloud service, or storage system can be guaranteed to be completely secure. Accordingly:

• We cannot guarantee that unauthorized access will never occur
• We cannot guarantee that cyberattacks will always be prevented
• We cannot guarantee uninterrupted availability of the Services

Customers acknowledge these inherent risks associated with electronic communications and internet-based services.

Energy Panda continually evaluates opportunities to improve its security posture. Accordingly, we may modify our security controls, technologies, vendors, and operational procedures without prior notice where doing so improves the protection of customer information.

Questions regarding Energy Panda's information security practices may be directed to the contact information provided at the end of this Privacy Policy. For security reasons, we may decline to disclose confidential details regarding our internal security controls.

Energy Panda retains Personal Information only for as long as reasonably necessary to:

• Provide the Services
• Administer customer accounts
• Process subscriptions
• Complete utility enrollments
• Comply with legal and regulatory obligations
• Prevent fraud
• Resolve disputes
• Enforce our agreements
• Protect the rights, safety, and security of Energy Panda, our customers, and others

Retention periods vary depending upon the nature of the information, legal requirements, operational needs, and applicable statutes of limitation.

We may retain customer account information for the duration of your relationship with Energy Panda and for a reasonable period thereafter to:

• Maintain business records
• Respond to customer inquiries
• Address legal claims
• Comply with tax and accounting obligations
• Detect and prevent fraud
• Meet regulatory requirements

Subscription-related information may be retained to document:

• Account creation
• Billing history
• Payment authorizations
• Subscription renewals
• Cancellations
• Refunds
• Chargebacks
• Customer communications regarding billing

These records may be retained after cancellation where reasonably necessary for legal, financial, accounting, or audit purposes.

Energy Panda may retain records relating to utility enrollment activities, including:

• Enrollment requests
• Utility account information
• ESI IDs or similar service identifiers
• Contract information
• Provider communications
• Customer authorizations
• Enrollment confirmations
• Identity verification records associated with the enrollment

These records help demonstrate customer authorization, resolve disputes, and comply with applicable legal obligations.

Driver's license information and other government-issued identification are retained only for as long as reasonably necessary to:

• Verify customer identity
• Complete utility enrollments
• Prevent fraud
• Comply with legal obligations
• Resolve disputes
• Support investigations
• Defend legal claims

Once no longer reasonably necessary, such information may be securely deleted, anonymized, or otherwise disposed of in accordance with Energy Panda's retention practices and Applicable Law.

Payment-related records may be retained to:

• Document subscription payments
• Process refunds
• Respond to payment disputes
• Resolve chargebacks
• Comply with accounting obligations
• Satisfy tax reporting requirements

Energy Panda generally relies on PCI DSS-compliant payment processors for payment card processing and does not intentionally retain complete payment card numbers unless expressly disclosed.

Energy Panda may retain customer communications, including:

• Customer support requests
• Emails
• Live chat transcripts
• Recorded calls where permitted by law
• SMS messages
• Complaint records
• Feedback

These records may be retained to improve customer service, investigate issues, comply with legal obligations, and protect the interests of both customers and Energy Panda.

Security-related records may be retained, including:

• Authentication logs
• Login history
• Audit logs
• System access records
• Security alerts
• Fraud detection information
• Incident investigation records

These records support cybersecurity, compliance, fraud prevention, and operational integrity.

If Energy Panda reasonably believes that information is relevant to:

• Pending litigation
• Arbitration
• Government investigations
• Regulatory proceedings
• Law enforcement requests
• Insurance claims
• Internal investigations

we may preserve such information beyond ordinary retention periods until the matter has been resolved or retention is no longer reasonably necessary.

When information is no longer required to be retained, Energy Panda seeks to securely dispose of or permanently de-identify such information using methods appropriate to the nature of the information and available technology.

Secure disposal methods may include:

• Secure electronic deletion
• Cryptographic erasure where appropriate
• Destruction of physical records
• Vendor-assisted secure disposal
• Anonymization or de-identification

Customer information may continue to exist within secure backup systems for a limited period after deletion from active systems.

Such backup information is generally:

• Protected using security safeguards
• Used only for disaster recovery or restoration purposes
• Removed through normal backup lifecycle processes, unless retention is required by

law.

Aggregated or de-identified information that cannot reasonably identify an individual may be retained indefinitely for purposes including:

• Statistical analysis
• Product development
• Operational improvement
• Research
• Business analytics
• Historical reporting

Energy Panda will not knowingly attempt to re-identify de-identified information except where permitted or required by Applicable Law.

Where Applicable Law grants customers the right to request deletion or correction of Personal Information, Energy Panda will evaluate and respond to such requests in accordance with applicable legal requirements.

Certain information may be retained despite a deletion request if retention is:

• Required by law
• Necessary to complete a transaction
• Necessary to prevent fraud
• Necessary to resolve disputes
• Necessary to enforce our agreements
• Otherwise permitted by Applicable Law

Certain information may be retained as part of Energy Panda's permanent business records, including records necessary for:

• Corporate governance
• Financial reporting
• Tax compliance
• Regulatory compliance
• Contract administration
• Insurance matters
• Historical business records

Such records are retained in accordance with applicable legal and business requirements.

Energy Panda periodically reviews its retention practices to help ensure that Personal Information is not retained longer than reasonably necessary, taking into account:

• Business needs
• Customer expectations
• Regulatory obligations
• Security considerations
• Technological developments

Retention schedules may be updated as our Services and legal obligations evolve.

The obligations described in this Article continue to apply after termination of your Account to the extent reasonably necessary to satisfy legal obligations, preserve evidence, resolve disputes, protect our legal rights, and maintain required business records.

Energy Panda respects your privacy rights and is committed to responding to verified privacy requests in accordance with Applicable Law.

Depending upon where you reside, you may have certain rights regarding your Personal Information.

Some rights described in this Article may not apply to every customer or every category of information.

Subject to Applicable Law, you may request information regarding:

• The categories of Personal Information we collect
• The categories of Sensitive Personal Information we collect
• The sources from which information is collected
• The purposes for which information is collected and used
• The categories of third parties with whom information is shared
• The categories of information disclosed for business purposes
• The categories of information retained

Where required by Applicable Law, Energy Panda will provide this information following verification of your identity.

You may request access to certain Personal Information that Energy Panda maintains about you.

Where required by Applicable Law, we will provide a copy of the information or make it available in a commonly used format, subject to applicable legal exceptions.

We may limit disclosure where necessary to protect:

• The rights of other individuals
• Confidential business information
• Trade secrets
• Security
• Information exempt from disclosure under Applicable Law

If you believe that Personal Information maintained by Energy Panda is inaccurate, incomplete, or outdated, you may request that we correct the information. Where appropriate, we may request documentation supporting the requested correction. Certain information maintained by Utility Providers or Retail Electric Providers may need to be corrected directly with those organizations.

Subject to Applicable Law, you may request deletion of certain Personal Information maintained by Energy Panda. We may deny or partially fulfill a deletion request where retention is necessary to:

• Complete a transaction
• Provide requested Services
• Detect or prevent fraud
• Protect against unlawful activity
• Exercise or defend legal claims
• Comply with legal obligations
• Maintain required business records
• Enforce our agreements
• Protect the rights, safety, or security of Energy Panda, our customers, or others

If deletion is approved, certain information may remain within secure backup systems until those backups expire in accordance with our retention practices.

Where required by Applicable Law, you may request a portable copy of certain Personal Information you have provided to Energy Panda.

We will provide such information in a commercially reasonable format where technically feasible and legally required.

Where our processing is based on your consent, you may withdraw that consent at any time. Withdrawal of consent does not affect:

• Processing that occurred before withdrawal
• Processing required by law
• Processing necessary to perform our contractual obligations
• Processing permitted under Applicable Law

Withdrawal of certain consents may limit or prevent our ability to provide the Services.

You may opt out of receiving promotional emails by:

• Clicking the unsubscribe link included in the email
• Updating your communication preferences within your Account
• Contacting Energy Panda

Even if you opt out of marketing communications, we may continue to send:

• Account notifications
• Security alerts
• Billing notices
• Legal notices
• Subscription communications
• Other transactional communications necessary to provide the Services

If you have consented to receive SMS messages, you may withdraw your consent at any time by following the opt-out instructions provided in the applicable message or by contacting Energy Panda.

Opting out of marketing text messages does not necessarily prevent us from sending transactional or security-related text messages where permitted by Applicable Law and consistent with your communication preferences.

Energy Panda collects Sensitive Personal Information, including driver's license information, solely for legitimate business purposes such as:

• Identity verification
• Utility enrollment
• Fraud prevention
• Security
• Compliance with Applicable Law

We do not use Sensitive Personal Information to infer characteristics about you or for unrelated advertising purposes.

To protect customer privacy and security, Energy Panda may require reasonable verification before responding to privacy requests. Verification procedures may include:

• Identity verification
• Account authentication
• Government-issued identification where appropriate
• Confirmation of account ownership
• Additional documentation reasonably necessary to verify the request

We may decline requests that cannot be reasonably verified.

Where permitted by Applicable Law, you may designate an authorized agent to submit privacy requests on your behalf.

Energy Panda may require:

• Written authorization
• Proof of agency
• Independent identity verification
• Additional documentation reasonably necessary to confirm the agent's authority

Energy Panda will respond to verified privacy requests within the timeframes required by Applicable Law. Where permitted, response periods may be extended when reasonably necessary due to the complexity or volume of requests. If additional time is required, we will notify you as required by Applicable Law.

Where Applicable Law provides a right to appeal a privacy request determination, Energy Panda will explain the process for submitting an appeal. Appeals should include sufficient information to identify the original request and explain why the requester believes the determination should be reconsidered.

Energy Panda will not unlawfully discriminate against individuals who exercise privacy rights provided under Applicable Law. However, certain Services may require specific information to function properly. If you request deletion of information that is necessary to provide the Services, we may no longer be able to provide those Services.

Residents of certain states may have additional privacy rights under Applicable Law. Where required, Energy Panda will provide supplemental state-specific privacy notices describing those rights and the procedures for exercising them. Nothing in this Privacy Policy limits any rights provided by Applicable Law.

Privacy requests may be submitted using the contact methods designated by Energy Panda. To help protect your information, we may request additional verification before processing your request. Energy Panda will maintain records of privacy requests and responses where required by Applicable Law.

As privacy laws continue to evolve, Energy Panda may update its privacy practices and this Privacy Policy to reflect new legal requirements, customer expectations, and operational improvements. Any material changes will be communicated as required by Applicable Law.

Energy Panda's Services are intended for individuals who are legally capable of entering into binding contracts under Applicable Law. Our Services are not directed to children under the age of thirteen (13), and we do not knowingly collect Personal Information directly from children under thirteen. If you believe a child has submitted Personal Information to Energy Panda without appropriate authorization, please contact us immediately so that we may investigate and take appropriate action consistent with Applicable Law.

Individuals who have not reached the age required to legally enter into binding contracts under Applicable Law may not establish an Account or purchase a Subscription unless legally permitted and acting through an authorized parent, guardian, or other legally authorized representative. Energy Panda reserves the right to terminate Accounts established in violation of this provision.

Energy Panda's Services are intended primarily for customers located within the United States. If you access the Services from outside the United States, you acknowledge that your information may be transferred to, processed, and stored in the United States or other jurisdictions where Energy Panda or its authorized service providers operate. By using the Services, you consent to such transfers to the extent permitted by Applicable Law.

Where Personal Information is processed outside the jurisdiction in which it was collected, Energy Panda will seek to implement commercially reasonable safeguards appropriate to the nature of the information and the applicable legal requirements.

As Energy Panda expands into additional states or jurisdictions, this Privacy Policy may be supplemented by:

• State-specific privacy notices
• Additional consent forms
• Supplemental disclosures
• Updated customer rights
• Revised processing practices

Such supplements shall become part of this Privacy Policy where applicable.

Energy Panda may revise this Privacy Policy from time to time. Updates may occur due to:

• Changes in Applicable Law
• New products or services
• Technology improvements
• Security enhancements
• Operational changes
• Business expansion
• Regulatory guidance

The "Last Updated" date at the beginning of this Privacy Policy will reflect the most recent revision.

If Energy Panda makes material changes to this Privacy Policy, we will provide notice through one or more commercially reasonable methods, which may include:

• Email
• Customer Portal notifications
• Website notices
• Mobile application notifications
• Other legally permitted communication methods

Where Applicable Law requires additional consent before certain changes become effective, Energy Panda will obtain such consent.

Subject to Applicable Law, your continued use of the Services following the effective date of an updated Privacy Policy constitutes your acknowledgment of the revised Privacy Policy. Nothing in this section limits any rights that Applicable Law may provide regarding material changes to privacy practices.

Questions regarding this Privacy Policy or Energy Panda's privacy practices may be directed to our Privacy Team using the contact information published on our website. Customers may also contact us regarding:

• Privacy requests
• Data correction requests
• Data deletion requests
• Security concerns
• Identity verification questions
• Complaints regarding our handling of Personal Information

Energy Panda encourages customers to contact us directly with privacy concerns before pursuing regulatory or legal remedies so that we may attempt to resolve the matter promptly and in good faith. Privacy inquiries may be submitted to: Energy Panda, LLC Privacy Office Email: privacy@energypanda.com (or such other privacy contact designated by Energy Panda) Mailing Address: Energy Panda, LLC 7005 Chase Oaks Blvd, Plano, Texas 75024

Where Applicable Law provides the right to submit complaints to governmental authorities or privacy regulators, nothing contained in this Privacy Policy limits those rights. Energy Panda encourages customers to contact us first so that we may have the opportunity to address concerns directly.

This Privacy Policy shall be interpreted in conjunction with the Energy Panda Terms of Service. Except where superseded by Applicable Law, this Privacy Policy shall be governed by the laws of the State of Texas.

This Privacy Policy becomes effective on the Effective Date stated at the beginning of the document and remains in effect until replaced by a revised version.

This Privacy Policy, together with any state-specific privacy notices and other documents expressly incorporated by reference, constitutes Energy Panda's complete privacy notice regarding the collection, use, disclosure, retention, and protection of Personal Information through the Services.