This Privacy Policy explains which personal data Bullfrog Energy GmbH (“Bullfrog Energy”, “we”, “us”) collects when you visit our website, use our platform or contact us, for which purposes and on which legal basis we process it, and which rights you have. We process personal data in accordance with the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and the German Telecommunications Digital Services Data Protection Act (TDDDG).

Protecting your data is a priority for us. We maintain high data protection standards for all users of the Bullfrog Energy website and platform and review them continuously. One of our core concerns is that you can decide to what extent we process your data and how you share personal data with us.

1. Controller and contact details

The controller within the meaning of Art. 4 No. 7 GDPR is responsible for the processing of your personal data:

Bullfrog Energy GmbH Reichenberger Straße 88 10999 Berlin, Germany

Represented by the managing directors Carl Cousin and Leopold Oettingen-Wallerstein. Registered with the Amtsgericht Charlottenburg under HRB 276822 B.

Email: info@bullfrogenergy.de

We have not appointed a data protection officer, as we are not legally required to do so. For all questions on data protection and to exercise your rights, including a full or partial objection to the collection, processing or use of your data, you can write to the postal or email address above.

2. Collection, processing and use of personal data

To offer our services, we need to collect and process personal data as described below. Personal data means any information relating to an identified or identifiable natural person, in particular your name, telephone number, postal address, email address or online identifiers such as your IP address. Statistical data that cannot be linked to your identity is not personal data.

We process your data to provide our website and the technical services of our platform, to select and tender projects, to communicate with you, to fulfil legal obligations, to prevent fraud and, where applicable, to verify your identity. Where you have opted in, we also use your data for newsletters and marketing.

2.1 Visiting our website

Each time you use our website, our servers automatically collect the access data your browser transmits:

• IP address of the requesting device

• Date and time of the request

• Address of the requested page and of the referring page

• Information on the browser and operating system used

• Online identifiers (for example device identifiers, session IDs)

This processing is necessary to deliver the website to you and to ensure the stability and security of our systems. The legal basis is Art. 6(1)(1)(b) GDPR, and, for security and abuse prevention, Art. 6(1)(1)(f) GDPR.

We also store access data in internal log files to further develop our website in line with usage patterns (for example a growing share of mobile devices) and to administer it. The legal basis is Art. 6(1)(1)(f) GDPR. Our legitimate interest is the continuous improvement of our website and services. Log files do not allow direct conclusions about you as a person; IP addresses are stored only in shortened, anonymised form. Log files are kept for 30 days and archived in anonymised form thereafter.

2.2 Contact enquiries

If you contact us by email, telephone, post or through a contact form, we process the data you provide (typically name, company, contact details and the content of your message) to handle your enquiry and any follow up questions. The legal basis is Art. 6(1)(1)(b) GDPR where your enquiry relates to a contract or pre-contractual measures, and otherwise Art. 6(1)(1)(f) GDPR, based on our interest in responding to business enquiries. We delete the data once your enquiry has been fully handled, unless statutory retention obligations apply.

2.3 Registration on the Bullfrog Energy platform

You can register for the login area of our platform to use its full functionality. The following data is required:

• Name of the company

• First and last name of the authorised representative of the company

• Email address of the authorised representative

Without this data, registration is not possible. The legal basis is Art. 6(1)(1)(b) GDPR. We store the data to set up your user account and to give you access to the platform.

2.4 Prospective and active project participation

For the duration of the platform terms of use and any related agreement, we process your personal data to provide the technical services of the platform for project selection and tendering. The platform allows prospective and active financing partners to obtain an overview of available projects, and project initiators to obtain an overview of prospective and active financing partners. For this purpose we process master data and, where applicable, application and subscription data on the basis of Art. 6(1)(1)(b) GDPR.

2.5 Identity verification

Where we are subject to obligations under the German Money Laundering Act (GwG) or comparable national provisions, we are required to obtain information on the identity and address of our counterparties and their beneficial owners. This know your customer (KYC) process helps prevent misuse of our services for identity theft, fraud or money laundering and forms part of our risk management. The legal basis is Art. 6(1)(1)(c) GDPR. Data collected for this purpose is retained for the statutory period, currently five years after the end of the business relationship under Section 8 GwG.

2.6 Marketing

Beyond registration and project processing, we use your data to send you information by post on products, services and campaigns that may interest you, on the basis of Art. 6(1)(1)(f) GDPR. Our legitimate interest is the marketing of our services. You can object to the use of your data for marketing at any time, in whole or in part, at no cost other than transmission costs at basic rates. A written message to the address in Section 1 is sufficient.

We send information on our products, services and campaigns by email or SMS only on the basis of your consent under Art. 6(1)(1)(a) GDPR, or, where you are an existing customer, under Section 7(3) of the Act against Unfair Competition (UWG) in conjunction with Art. 6(1)(1)(f) GDPR.

2.7 Newsletter

You can subscribe to our newsletter to receive regular updates on our products and campaigns. We use the double opt in procedure: we send the newsletter only after you have confirmed, by clicking a link in a confirmation email, that you are the owner of the email address provided. We then store your email address, the time of registration and the IP address used for registration until you unsubscribe. This storage serves only to send you the newsletter and to evidence your registration. You can unsubscribe at any time via the link in each newsletter or by message to the contact details in Section 1. The legal basis is Art. 6(1)(1)(a) GDPR.

Our newsletter uses established technologies to measure interactions, such as opening of the email and clicks on links, by means of embedded graphics (tracking pixels). We evaluate this data in pseudonymised form for general statistics and to improve our communication. The data is not merged with your other personal data. The legal basis is Art. 6(1)(1)(a) GDPR insofar as your consent is required for the tracking, and otherwise Art. 6(1)(1)(f) GDPR. If you do not want your usage behaviour analysed, you can unsubscribe or disable image loading in your email client by default.

2.8 Notifications

To complete your registration and keep you informed about the status of your project participation, we communicate with you by email, SMS or post using the addresses and telephone numbers you provided. Please note that unauthorised third parties may in principle be able to view, read, manipulate or delete data transmitted electronically. The legal basis is Art. 6(1)(1)(b) GDPR.

2.9 Market and opinion research

To improve our services, we also use data for general market and opinion research, only for statistical purposes and in anonymised form. Your survey responses are not published or passed on to third parties without your consent and are not stored together with your email address or other personal data. You can object to this use at any time by writing to the address in Section 1; every survey email also contains an unsubscribe link. The legal basis is Art. 6(1)(1)(f) GDPR. Our legitimate interest is to understand our target audience and improve our business.

3. Recipients of personal data

Within Bullfrog Energy, only those employees have access to your data who need it for the purposes described above. We share personal data with third parties only where this is necessary for these purposes, where you have consented, or where we are legally obliged to do so. Recipients may include:

• Service providers acting as processors under Art. 28 GDPR, such as hosting and IT providers, email and newsletter tools, and analytics providers. They process data only on our instructions and under data processing agreements.

• Professional advisers, such as lawyers, tax advisers, auditors and banks, who are bound by professional confidentiality.

• Other participants of the platform, such as financing partners and project initiators, to the extent required for project selection and tendering and only within the scope you have agreed to.

• Public authorities, courts and law enforcement agencies where we are legally required to disclose data or where disclosure is necessary to establish, exercise or defend legal claims.

We do not sell personal data.

4. Transfers to third countries

We process your data primarily within the European Economic Area. Where service providers or their sub-processors are located outside the EEA, in particular in the United States, the transfer takes place only if an adequacy decision of the European Commission exists, for example the EU-US Data Privacy Framework for certified recipients, or if appropriate safeguards under Art. 46 GDPR are in place, such as the EU Standard Contractual Clauses together with supplementary measures where required. You can request a copy of these safeguards using the contact details in Section 1.

5. Storage periods

We store personal data only for as long as required for the respective purpose, and delete or anonymise it thereafter, unless statutory retention obligations apply. In particular:

• Server log files: 30 days, then archived in anonymised form.

• Platform account and project data: for the duration of the contractual relationship, and thereafter until statutory limitation periods have expired (in general three years from the end of the year in which the relationship ended).

• Commercial and tax records: six or ten years under Sections 257 HGB and 147 AO.

• KYC data under the GwG: five years after the end of the business relationship.

• Newsletter data: until you unsubscribe; thereafter only the minimum data needed to evidence consent and to honour your objection.

• Contact enquiries: until the enquiry is fully handled.

6. Obligation to provide data

You are not obliged to provide personal data to visit our website. For registration and for participation in projects on the platform, the data marked as required in Section 2 is necessary; without it we cannot set up an account or perform the related services. Where we are legally required to verify your identity, we can enter into or continue a business relationship only if you provide the required information.

7. Cookies and similar technologies

Cookies are small text files stored on your device when you visit our website. They allow us to recognise your browser on a later visit. Some cookies are technically necessary for the website to work; others are used for analytics or marketing. Under Section 25 TDDDG, we store or read information on your device only with your consent, unless this is strictly necessary to provide a service you have requested. Subsequent processing of personal data is based on Art. 6(1)(1)(a) GDPR, or on Art. 6(1)(1)(f) GDPR for necessary cookies.

When you first visit our website, a consent banner lets you accept or reject non-essential cookies by category. You can change or withdraw your choice at any time with effect for the future via the cookie settings link in the footer of our website. You do not have to accept cookies to visit our website, but some functions may not be available if you disable them.

7.1 Necessary cookies

We use our own cookies for login identification, load balancing and to store your cookie choice. They are strictly necessary to operate the website and platform. The legal basis is Art. 6(1)(1)(f) GDPR in conjunction with Section 25(2) No. 2 TDDDG.

7.2 How to prevent cookies

You can configure your browser to reject cookies or to delete existing ones. The help function of your browser explains how. If you use a shared computer that accepts cookies, we recommend that you always log out completely after use.

7.3 Google Analytics

With your consent, we use Google Analytics, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and, in certain cases, Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”). Google Analytics uses cookies and similar technologies to analyse how you use our website. IP addresses are anonymised before analysis. Data may be transferred to and stored on servers in the United States; the transfer is based on the EU-US Data Privacy Framework and, where applicable, Standard Contractual Clauses.

Google processes the information to evaluate your use of the website, to compile reports on website activity for us and to provide further services related to website and internet use. The legal basis is your consent under Art. 6(1)(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw your consent at any time via the cookie settings link, and you can prevent the collection of data by Google using the browser add-on for deactivation of Google Analytics. Further information is available in the Google Analytics privacy information.

7.4 Hotjar

With your consent, we use Hotjar, a service of Hotjar Limited, Dragonara Business Centre, 5th Floor, Dragonara Road, St Julian’s STJ 3141, Malta, to better understand user needs and to optimise our website. Hotjar shows us, for example, how much time users spend on which pages, which links they click and what they like or dislike. Hotjar uses cookies and other technologies to collect data on user behaviour and devices, including the IP address of the device (processed during your session and stored in anonymised form), screen size, device type, browser information, country and preferred language. Hotjar stores this information on our behalf in a pseudonymised user profile and is contractually prohibited from selling the data collected on our behalf. The legal basis is your consent under Art. 6(1)(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw your consent via the cookie settings link. See also the Hotjar privacy policy.

7.5 Interest based advertising

With your consent, we use cookie based retargeting technology to show tailored offers to visitors of our website who have shown interest in our services, on websites of our partners. We use only anonymised and pseudonymised data and do not merge usage profiles with personal data. The legal basis is your consent under Art. 6(1)(1)(a) GDPR and Section 25(1) TDDDG. You can decline these cookies in the consent banner or withdraw consent at any time via the cookie settings link. Further opt out options are available at www.youronlinechoices.eu.

8. Security

We have implemented technical, organisational and procedural measures to protect your personal data appropriately, to secure our databases and to restrict access to authorised persons who are bound to confidentiality. Data is transmitted to us in encrypted form (SSL/TLS). We review our systems regularly to identify and remedy vulnerabilities and to defend against attacks.

You should not share your password with unauthorised third parties and should change it regularly. Whenever you leave the platform, log out of your session and close your browser window to prevent unauthorised access to your user account.

9. Your rights as a data subject

You have the following rights with respect to your personal data. To exercise them, contact us using the details in Section 1. We respond within one month in accordance with Art. 12(3) GDPR.

• Access (Art. 15 GDPR): confirmation of whether we process your data and a copy of the data together with the information listed in Art. 15.

• Rectification (Art. 16 GDPR): correction of inaccurate or incomplete data.

• Erasure (Art. 17 GDPR): deletion of your data where the statutory conditions are met. If deletion is not possible because of legal retention duties, processing is restricted instead.

• Restriction of processing (Art. 18 GDPR): for example while you contest the accuracy of the data.

• Data portability (Art. 20 GDPR): the data you provided to us in a structured, commonly used and machine readable format.

• Objection (Art. 21 GDPR): see Section 10.

10. Withdrawal of consent and right to object

Under Art. 7(3) GDPR you may withdraw any consent you have given at any time with effect for the future. Processing carried out before the withdrawal remains lawful.

Where we process your data on the basis of legitimate interests under Art. 6(1)(1)(f) GDPR, you may object at any time on grounds relating to your particular situation (Art. 21(1) GDPR). Where we process personal data for direct marketing, you have a general right to object, which we implement without requiring a reason (Art. 21(2) GDPR).

11. Right to lodge a complaint

Under Art. 77 GDPR you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or the place of the alleged infringement. The supervisory authority responsible for us is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit Alt-Moabit 59–61, 10555 Berlin, Germany www.datenschutz-berlin.de

12. Automated decision making

We do not use automated decision making, including profiling, within the meaning of Art. 22 GDPR to establish, perform or terminate business relationships. Should we do so in the future, we will inform you separately.

13. External links and social media

Our website may contain links to third party websites, for example LinkedIn. We have no influence on their data processing; their operators are responsible for compliance with data protection law. Please refer to their privacy policies.

14. Changes to this Privacy Policy

We update this Privacy Policy from time to time, for example when we change our website or services or when legal or regulatory requirements change. The current version is always available on our website, where you can view, print or save it using your browser functions.

Status: September 2026

Information on the processing of applicant data

This information explains how we process your personal data when you apply for a position at Bullfrog Energy.

1. Controller

Bullfrog Energy GmbH, Reichenberger Straße 88, 10999 Berlin, Germany. Email: info@bullfrogenergy.de.

2. Data we process

For the application process we process the data you provide to us:

• Name, address and email address

• Application documents (CV, cover letter, certificates and similar)

• Position applied for

• Notes on interviews

• IP address, if you apply through an online application form

We also process data you provide when you contact us during the application process. Where permitted, we may use other sources, such as recruiters or publicly available data including your profile on professional networks such as LinkedIn or Xing.

3. Purpose and legal basis

We process your data to select applicants. The legal basis is Section 26(1) BDSG in conjunction with Art. 6(1)(1)(b) GDPR. Data you provide voluntarily is processed on the basis of your consent under Section 26(2) BDSG in conjunction with Art. 6(1)(1)(a) GDPR. Data from publicly available sources is processed under Art. 6(1)(1)(f) GDPR; our legitimate interest is to obtain an overview of your professional background. If we enter into an employment relationship with you, we process the data for its performance under Section 26(1) BDSG. Storage of your data for other or future positions is based on your consent under Section 26(2) BDSG and Art. 6(1)(1)(a) GDPR. Where necessary to defend legal claims arising from the application process, for example under the General Equal Treatment Act (AGG), the legal basis is Art. 6(1)(1)(f) GDPR.

4. Recipients

Within Bullfrog Energy, only employees responsible for the application process have access to your data. Service providers that support our recruiting act as processors under Art. 28 GDPR. We may disclose data to authorities where required by law or necessary to protect our legitimate interests.

5. Storage period

Applicant data is deleted six months after the end of the specific application process. If you consent to being considered for other positions, we store your data for up to 12 months from the last offer or your last declaration of interest. Longer statutory retention periods remain unaffected. If you join us, the data is transferred to your personnel file and stored for the duration of the employment relationship; you will receive separate information on this.

6. Obligation to provide data

Applicants must provide the data required to assess their application. Without it, an application cannot be considered.

7. Your rights

You have the rights described in Sections 9 to 11 above: access, rectification, erasure, restriction, data portability, objection, withdrawal of consent and the right to lodge a complaint with the Berlin supervisory authority. Contact us at info@bullfrogenergy.de.

8. Automated decision making

We do not use automated decision making in the application process. Should we do so, we will inform you separately.