PRIVACY POLICY

Last Updated: August 12, 2020

Uplight, Inc. (“Uplight,” “we,” “our,” or “us”) delivers end-to-end consumer engagement products, applications, and services (the “Services”) via our open, secure, and scalable platform. This Online Privacy Policy (this “Privacy Policy”) explains how we may collect, use, and disclose your personal information. This Privacy Policy applies to Uplight Services and Uplight’s websites (the “Sites”).

In some cases, we may act as an agent of the energy service provider with which you have a customer relationship (the “Utility Provider”). In such a situation, the Utility Provider has engaged Uplight to provide Services. This Privacy Policy does not apply to the non-personal information described below that is collected by, used by, disclosed by, or disclosed to your Utility Provider. This Privacy Policy only applies to Uplight’s collection, use, and disclosure of personal information. For more information about your Utility Provider’s privacy practices please contact your Utility Provider directly.

1. PERSONAL INFORMATION WE COLLECT

Personal Information. We collect personal information about you both online and offline in various ways when you use our Sites or Services. “Personal information” as used in this Privacy Policy means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. The personal information we collect allows us to offer our Services in a personalized and meaningful manner. The following are the types of personal information we collect:

Non-Personal Information. Personal information does not include:

• Publicly Available Data: Publicly available information from government records.
• Deidentified Information or Aggregate Information: “Deidentified Information” means information that cannot reasonably identify, relate to, describe, be capable of being associated with, or be linked, directly or indirectly, to a particular individual, and for which Uplight has implemented technical safeguards and business processes that prohibit reidentification of the individual. “Aggregate Information” means information that relates to a group or category of individuals, from which individual identities have been removed, that is not linked or reasonably linkable to any individual or household, including via a device.
• Excluded Information: Certain laws require separate privacy notices or are exempt from general personal information privacy policy disclosure requirements. Such laws include the Fair Credit Reporting Act (FCRA).

Sources of Personal Information. We obtain the categories of personal information listed above on or through our Services and Sites from the following categories of sources:

• Personal Information You Give Us: We receive the personal information you provide to us such as your name, email address, phone number, address, and home profile. Our Services offer you the opportunity to create a profile and submit questions and comments that may be visible to other users of the Services. The information you provide in areas that are visible by other logged-in users of the Services may be read, collected, and used by others who access them. You can choose not to provide certain information, but that may limit your ability to take full advantage of the Services we provide. We may also collect personal information that is necessary for our legitimate interests, which will be disclosed to you at the time of collection. Uplight will use this personal information for the purposes of which it was collected.
• Automatically Collected Information: We receive and store certain types of information from you every time you use the Sites or Services. For example we may automatically log your browser type, language preference, the date and time of your visit to the Sites, your Internet Protocol (IP) address, and the website you visited before our Sites. In addition, we receive and store information about your use and activity on our Sites and within our Services. Uplight collects personal information automatically using cookies or other online tracking technologies as described in our Cookies Policy, available at https://uplight.com/cookie-policy/.
• Personal Information from Devices and Appliances: We may receive and store energy usage information directly from your energy management system, devices, or appliances to create a profile of your energy usage (a “Home Energy Report”). For example, we may receive and securely store the times at which your household energy use is at its highest or lowest, and may store your settings on certain Home Area Network appliances such as a smart thermostat.
• Personal Information from Your Utility Provider: We may receive and store certain personal information about you from your Utility Provider. For example, your Utility Provider may provide us your historic energy usage information so that we may present more meaningful information to you and personalize Services in a meaningful manner.

2. HOW WE USE THE PERSONAL INFORMATION WE COLLECT

We use and disclose your personal information only as described in this Privacy Policy or as disclosed to you on our Sites or within our Services. For example, we may use your personal information:

• To Provide Our Products, Services, or Home Energy Reports. This could include fulfilling your requests for products, Services, and Home Energy Reports. It could also include processing purchases or other transactions. For example, if you share your personal information to request a price quote or ask a question about our Services, we will use that personal information to respond to your inquiry. If you provide your personal information to purchase a product, Service, or Home Energy Report, we will use such information to process your payment and facilitate delivery. We may also save your personal information to facilitate new product or service orders, or process returns.
• To Improve Our Products, Services, and Sites. We use personal information to understand and analyze the usage trends and preferences of our users to make our products, Services or Sites better, diagnose technical issues, prevent fraud, and develop new features and functionality.
• To Understand Your Interests. We use your personal information to personalize your experience on with the Services and Sites, and to deliver information about Services relevant to your interests.
• To Process Your Payment for Products and Services. We use personal information to facilitate payment for products and Services that you select through our Sites.
• To Respond to Your Requests or Questions. We use personal information to provide you with support and to respond to your requests for customer support, including to investigate and address your concerns and monitor and improve our responses. This may also include responding to your feedback.
• To Determine Your Eligibility and Set Up Your Account. We use your personal information to verify your identity or determine your eligibility for some of our products, services, and promotions. For example, this may include verifying your age, date of birth, and place of residence. If you set up an account through the Services on any Site, we will use the registration information you provide in relation to that account creation to create, maintain, customize, and secure your account.
• To Market Products or Services. We provide you with information and promotions about products and Services. For example, we may use cookies or other online tracking technologies to provide customized advertisements, content, and information; monitor and analyze the effectiveness of marketing activities; and track your entries, submissions, and status in any promotions. These might be third party offers we think you might find interesting. These communications may come in the form of interest-based advertising using information gathered across multiple websites, devices, or other platforms.
• To Secure the Services and Sites. We use personal information to maintain the safety, security, and integrity of our Services, Sites, databases, and other technology assets, business, and other users.
• To Communicate with You. We may communicate with you about your account or our relationship. We may also contact you about this Privacy Policy.
• As Required by Law. We use personal information to respond to requests from law enforcement and as required by applicable law, court order, or government investigation.

We may create non-personal Deidentified Information or Aggregate Information from the information we collect, as permitted by law. We may use that data for our own purposes or disclose it in a non-personally identifiable manner to:

• Advertisers and third parties for their marketing and promotional purposes;
• Organizations and government entities that conduct research into energy usage or smart-grid technologies;
• Other users of the Services for purposes of comparing energy usage to the broader community; or
• Other interested third parties.

3. HOW WE SHARE THE PERSONAL INFORMATION WE COLLECT

In addition to the specific situations discussed elsewhere in this Privacy Policy, Uplight may share your personal information in the following circumstances:

• Service Providers. To third party service providers (i.e., device manufacturers, website hosting providers, payment processors, log monitoring analysts, forensic data scientists, threat monitoring aggregators, user data analysts, marketing assistants, and other service providers for legitimate purposes permitted by applicable law) that provide services to us and are contractually bound to safeguard your personal information, in which case Uplight will remain liable for the acts and/or omissions of such third party service providers with respect to the processing of your personal information.
• Partners. Via our cloud-based platform, we collect information that allows us to provide the Services. In some cases, we may collect this information at the direction of partner companies (“Partners”), and we may have no direct relationship with the individuals whose personal information we process. In these cases, we work with our Partners to help them provide notices concerning the purpose for which personal information is collected and used. If you are a customer of one of our Partners and would no longer like to be contacted by that Partner or seek access to the personal data we have collected at the direction of the Partner, please contact that Partner directly. Uplight may transfer personal information to companies that help us provide our Services. Transfers to subsequent third parties are covered by the provisions of this Privacy Policy regarding notice and choice and the service agreements with our Partners. Uplight will retain personal information we process on behalf of our Partners for as long as needed to provide the Services. Uplight will retain and use this personal information as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements. Certain sections of www.uplight.com utilize framing and/or masking techniques to serve content from our Partners while preserving the look and feel of our Site. Please be aware that you are providing your personal information to these third parties and not to Uplight.
• Utility Providers. To your Utility Provider for their own purposes and subject to their privacy policy and practices.
• Social Media Sites. Certain sections of our Sites may include social media sites. These social media sites may collect your IP address, which page you are visiting on our Site, and may set a cookie to enable the social media site features to function properly. Your interactions with these social media sites are governed by the privacy policy of the social media site.
• Related Companies. To our corporate subsidiaries and divisions (i.e., affiliates, parent company, sister companies, joint ventures, or other companies under common control) listed at the end of this Privacy Policy.
• M&A Transactions. To third parties in connection with any merger, acquisition, reorganization, change in capital structure, or sale of all or part of the business or any sale or transfer of assets of Uplight.
• Legal Compliance. When we have a good faith belief that disclosure is necessary to comply with law, for national security reasons, to protect or defend our rights or the rights of other users of our Sites or Service, to enforce our contracts, or act in an emergency to protect someone’s safety.
• Consent. Otherwise with your express consent.

4. DATA RETENTION

We will retain your personal information for as long as your account is active, as needed to provide you Services, and as necessary to comply with our legal obligations, to resolve disputes, and to enforce our agreements. If you wish to cancel your account or request that we no longer use your personal information, contact us using the contact information provided below.

5. SECURITY OF PERSONAL INFORMATION

We take reasonable steps to help protect your personal information in an effort to prevent loss, misuse, unauthorized access, disclosure, alteration and destruction. We follow reasonable standards to protect the personal information submitted to us, both during transmission and once we receive it. However, no method of transmission over the Internet, or method of electronic storage is 100% secure and we do not guarantee its absolute security. If you have any questions about the security of our Sites or Services, you can contact privacy@uplight.com. In the event that we are required by law to inform you of any unauthorized access or acquisition of your personal information we may notify you electronically, in writing, or by telephone, if permitted to do so by law.

6. ACCESS, CHANGE, AND DELETION

You can make the following choices regarding your personal information:

• Access to Your Personal Information. We make reasonable efforts to allow you to make inquiries about the personal information we collect from you, and when appropriate we allow you access to your personal information for review and updating. You may request access to your personal information by contacting us as described below. We will grant you reasonable access to the data that we have about you as required by law.
• Changes to Your Personal Information. We rely on you to update and correct the personal information contained in your account. If you have an account with us, you can control preferences regarding the use and disclosure of your personal information on your user profile. Note that we may keep historical information in our backup files as permitted by law. If our Site does not permit you to update or correct certain personal information, please contact us as described below.
• Deletion of Your Personal Information. Typically, we retain your personal information for the period necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law. You may, however, request that we delete your personal information by contacting us contacting us as described below. We will grant a request to delete information as required by law, but you should note that in many situations we must keep your personal information to comply with our legal obligations, resolve disputes, enforce our agreements, or for another one of our business purposes. Except as provided above, we will delete, aggregate, or de-identify all of your personal information as described in this subsection within the timeframes required by law.

7. YOUR CHOICES

You can make the following choices to opt out of certain activities regarding your personal information:

• Promotional E-mails. You may choose to provide us with your e-mail address for the purpose of allowing us to send newsletters, surveys, offers, and other promotional materials related to our Services and Site, as well as targeted offers from third parties. You can stop receiving promotional e-mails by clicking the “unsubscribe” links in the e-mails or by contacting us as described below. If you wish to unsubscribe from newsletters or marketing emails, follow the unsubscribe instructions included in these emails. If you decide not to receive promotional emails, we may still send you transactional communications, such as those about your account or to ask you to rate a Service you have requested.
• Behavioral-Based Advertising. We participate in behavioral-based advertising. This means that a third party may use technology (e.g., a cookie) to collect information about your use of our Sites so that we can provide advertising about products and Services tailored to your interest. That advertising may appear either on our Site, or on other websites. If you wish to limit third parties’ collection of information about your use of our Site, you can opt-out of such at the Digital Advertising Alliance in the US, the Digital Advertising Alliance of Canada in Canada, or the European Digital Advertising Alliance in Europe. PLEASE NOTE THAT OPTING-OUT OF BEHAVIORAL ADVERTISING DOES NOT MEAN THAT YOU WILL NOT RECEIVE ADVERTISING WHILE USING THE SITE. IT WILL, HOWEVER, EXCLUDE YOU FROM INTEREST-BASED ADVERTISING CONDUCTED THROUGH PARTICIPATING NETWORKS, AS PROVIDED BY THEIR POLICIES AND CHOICE MECHANISMS.
• Do-Not-Track. Some web browsers and devices permit you to broadcast a preference that you not be “tracked” online. At this time we do not modify your experience based upon whether such a signal is broadcast.

8. RESIDENTS OF CALIFORNIA

The following applies to residents of California.

Notice of Disclosure for California Residents. Uplight must disclose whether the following categories of personal information are disclosed for a “business purpose” or “valuable consideration” as those terms are defined under California law. Note that while a category below may be marked, that does not necessarily mean that we have personal information in that category about you. In the preceding twelve months, we have disclosed the following categories of personal information in the manner described.

Notice of Disclosure for Direct Marketing. Under California Civil Code sections 1798.83-1798.84, California residents who have an established business relationship with Uplight are entitled to ask us for a notice describing what categories of personal information we share with third parties for their direct marketing purposes. This notice will identify the categories of information shared with and will include a list of the third parties with which it is shared, along with their names and addresses. If you are a California resident and would like a copy of this notice, please submit a written request to us at privacy@uplight.com.

9. PRIVACY SHIELD

Uplight complies with the EU-U.S. Privacy Shield Program (“Privacy Shield”) and its principles as set forth by the US Department of Commerce and the European Commission regarding the collection, use, and retention of personal data from EU member states. Uplight has certified to the Department of Commerce that it adheres to the Privacy Shield Principles. Our collection, use, and disclosure of personal information transferred pursuant to the Privacy Shield is subject to the investigative and enforcement powers of the Federal Trade Commission. If there is any conflict between the terms in this Privacy Policy and the Privacy Shield Principles, the Privacy Shield Principles shall govern. To learn more about the Privacy Shield program, and to view our certification, please visit https://www.privacyshield.gov/.

In compliance with the Privacy Shield principles, Uplight commits to resolve complaints about our collection or use of your personal information. EU individuals with inquiries or complaints regarding our Privacy Shield policy should first contact our privacy and security personnel at privacy@uplight.com. If your question or concern is not satisfied through this process Uplight has further committed to refer unresolved Privacy Shield complaints to JAMS, an independent dispute resolution provider located in the United States. Information about how to file a complaint with JAMS related to our Privacy Shield program can be found at https://www.jamsadr.com/eu-us-privacy-shield. The services of JAMS are provided at no cost to you.

For residual Privacy Shield disputes that cannot be resolved by the methods above, you may be able to invoke a binding arbitration process under certain conditions. To find out more about the Privacy Shield’s binding arbitration scheme, please see: www.privacyshield.gov/article?id=ANNEX-I-introduction.

10. RESIDENTS OF THE EUROPEAN ECONOMIC AREA

The following applies to individuals in the European Economic Area (EEA).

Lawful bases for processing. Uplight is required to inform you of the lawful bases of our processing of your personal information, which are described in the table below. If you have questions about the lawful basis of how we process your personal information, contact us at the address listed in the section titled “CONTACTING US” below.

We will use your personal information only for the purposes for which we collected it, unless we reasonably determine we need to use it for another reason and that reason is compatible with the original purpose. For example, we consider deidentification, aggregation, and anonymization of personal information to be compatible with the purposes listed above and in your interest, because the deidentification, aggregation, and anonymization of such information reduces the likelihood of improper disclosure of that information.

PLEASE NOTE WE MAY PROCESS YOUR PERSONAL INFORMATION WITHOUT YOUR KNOWLEDGE OR CONSENT, IN COMPLIANCE WITH THE ABOVE RULES, WHERE THIS IS REQUIRED OR PERMITTED BY LAW.

Your Rights. European data protection laws give you certain rights regarding your personal information. You may ask us to take the following actions in relation to your personal information that we hold:

• Access. Provide you with information about our processing of your personal information and give you access to your personal information.
• Transfer. Transfer a machine-readable copy of your personal information to you or a third party of your choice.
• Correct. Update or correct inaccuracies in your personal information.
• Restrict. Restrict the processing of your personal information.
• Object. Object to our reliance on our lawful basis as the basis of our processing of your personal information that impacts your rights.
• Delete. Delete your personal information.

When we receive your request, we may ask you to verify your identity before we can act on your request. We may withhold information where we are required by law to do so or if the search for that information would require disproportionate effort or have a disproportionate effect to, for example, the cost of providing the information, the time it would take to retrieve the data, or how difficult it may be to obtain the information requested.

If you are a resident EEA and would like to exercise any of these rights, please submit your request to the address listed below. If you would like to submit a complaint about our use of your personal information or response to your requests regarding your personal information, you may contact us or submit a complaint to the data protection authority in your jurisdiction. You can find your data protection regulator here.

11. EXERCISING YOUR PRIVACY RIGHTS

When exercising the rights or options described in this Privacy Policy, the following guidelines apply:

• No Fee Usually Required. You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee or decline to comply with your request if your request is clearly unfounded, repetitive, or excessive.
• What We May Need from You. When exercising your rights or otherwise assisting you, we may need to request specific information from you to help us confirm your identity. This is a security measure to ensure we do not disclose personal information to any person who is not entitled to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.
• Time to Respond. We try to respond to all legitimate requests within 30 days of your request. Occasionally it may take us longer than 30 days to respond, for instance if your request is particularly complex or you have made a number of requests. In this case, we will notify you of the delay, and may continue to update you regarding the progress of our response.
• No discrimination. You will not be subject to discrimination as a result of exercising the rights described herein. In some cases, when you exercise one of your rights, we will be unable to comply with the request due to legal obligations or otherwise, or we will be unable to provide you certain products or Services. These responses are not discrimination and our reasons for declining your request or ceasing Services will be provided at that time.
• Authorized Agent. You may designate an authorized agent to make a request on your behalf. In order to designate an authorized agent to make a request on your behalf, you must provide a valid power of attorney, the requester’s proof of identification, and the authorized agent’s proof of identification.

12. OTHER WEBSITES

The Sites and Services may contain links, content, and advertisements from third parties. Such links, content, and advertisements are not endorsements, authorizations, or representations of our affiliation with that third party. We are not responsible for the privacy practices or the content of third parties, and we encourage you to carefully review the privacy policy of any website you visit.

13. CHANGES TO THIS PRIVACY POLICY

This Privacy Policy is subject to occasional revision without advance notice. If we make any changes in the way we use your personal information, we will notify you via email and/or post the modification on the Sites or within the Services prior to the change becoming effective. We will also update the “Last Updated” date in this Privacy Policy.

14. ADDITIONAL INFORMATION

For more information about this Privacy Policy or our privacy practices generally, please contact us at privacy@uplight.com.
Uplight, Inc.
2580 55th Street, Suite 100
Boulder, CO 80301
To exercise your rights as described in this Privacy Policy, please download this PDF.
This Privacy Policy encompasses the Uplight family of companies:
UPLIGHT, INC.
TENDRIL EA, LLC
TENRDIL OE, LLC
ENERGYSAVVY INC.
FIRSTFUEL SOFTWARE, INC.
SIMPLE ENERGY, INC.
ECOTAGIOUS INC.
FIRST FUEL EMEA LIMITED
TENDRIL AUSTRALIA PTY LIMITED
TENDRIL INTERNATIONAL B.V
TENDRIL NETWORKS UK, LTD.
For inquiries in the European Union, please contact our GDPR Representative Tendril International B.V.
Attn: GDPR Services Team
Prins Bernhardplein 200
1097 JB Amsterdam
The Netherlands
Email: GDPR-services@intertrustgroup.com