Privacy Policy

1. About this Privacy Policy

This Privacy Policy explains how Caucasus Energy Partners ("CEP", "we", "us", "our") collects, uses, discloses, and protects personal data when you: (i) visit our website; (ii) contact us or submit an enquiry; (iii) engage with us in connection with advisory services relating to energy and infrastructure projects, including hydropower and solar investments in Georgia; or (iv) otherwise interact with us (together, the "Services"). We are committed to handling personal data lawfully, fairly, and transparently and to implementing appropriate technical and organisational measures to safeguard personal data.

2. Data Controller and Contact Details

For the purposes of applicable data protection laws, CEP is the "data controller" of personal data processed in connection with the Services.

If you have questions about this Privacy Policy or would like to exercise your rights, contact us using the details above.

3. Scope and Applicable Law

We may process personal data relating to individuals located in Georgia, the United Kingdom, the European Economic Area ("EEA"), and other jurisdictions. Where GDPR/UK GDPR or similar standards apply, we will process personal data in accordance with those requirements, including the principles of purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality.

4. Personal Data We Collect

We may collect the following categories of personal data (depending on your interaction with us):

5. How We Use Personal Data and Legal Bases

We process personal data only where we have a lawful basis. The legal basis may vary by jurisdiction.

6. Sharing and Disclosure of Personal Data

We do not sell personal data.

We may share personal data with:

• Service providers (processors): hosting, analytics, CRM, email delivery, and security providers who support our operations under contractual confidentiality and data processing obligations.
• Professional advisors: legal, tax, or accounting advisers where necessary for legitimate business purposes.
• Transaction counterparties and stakeholders: only where relevant to a matter and consistent with confidentiality expectations.
• Authorities: regulators, law enforcement, or courts where required by law or to protect legal rights.
• Business transfers: if we undergo a merger, reorganisation, or asset sale, personal data may be transferred subject to appropriate safeguards.

7. International Transfers

Your personal data may be transferred to and processed in countries outside your home jurisdiction, including outside the EEA/UK, where our service providers or partners operate. Where GDPR/UK GDPR applies and a transfer is considered "restricted," we implement appropriate safeguards such as standard contractual clauses, adequacy decisions, or other lawful transfer mechanisms.

8. Data Retention

Retention periods vary depending on data type and context. We may retain certain records longer where required by law or to establish, exercise, or defend legal claims.

We retain personal data only for as long as necessary for the purposes described in this Privacy Policy, including:

• relationship management and service delivery;
• legal/regulatory obligations;
• dispute resolution; and
• security and audit purposes.

9. Security

We maintain reasonable technical and organisational measures designed to protect personal data against unauthorised access, alteration, disclosure, or destruction. These measures may include access controls, encryption in transit, secure hosting, logging/monitoring, and vendor security reviews. No method of transmission over the internet is completely secure, and we cannot guarantee absolute security.

10. Your Rights

To exercise these rights, contact us at info@caucasusenergypartners.com. We may need to verify your identity before fulfilling requests.

Depending on your jurisdiction, you may have rights to:

• access your personal data;
• correct inaccurate data;
• delete personal data;
• restrict or object to processing;
• withdraw consent (where processing is based on consent);
• data portability; and
• lodge a complaint with a supervisory authority.

11. Cookies and Similar Technologies

We use cookies and similar technologies to operate and improve our website. For details, see our Cookie Policy.

12. Third-Party Links

Our website may contain links to third-party sites. We are not responsible for the privacy practices of third parties. Please review their policies separately.

13. Children

Our website and services are intended for professional audiences and are not directed to children. We do not knowingly collect personal data from children.

14. Changes to this Privacy Policy

We may update this Privacy Policy periodically. Updates will be posted on this page with a revised "Last updated" date.