Privacy Notice Europe | Boralex Canada

1. Background

1.1 Boralex Ltd and Boralex SAS (“Boralex,” “we,” “us,” “our”) are the data controller of the personal data covered by this Privacy Notice, unless we tell you otherwise, for the purposes of applicable data protection laws, including the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR) and the UK General Data Protection Regulation, the Data Protection Act 2018 and the Data (Use and Access) Act 2025 (together “Data Protection Legislation”). This means we make decisions about how and why we process your personal data and because of this, we are responsible for the personal data we hold about you.

1.2 In accordance with Data Protection Legislation, personal data must be processed lawfully, fairly and transparently in relation to you, as a data subject. This Privacy Notice (“Notice”) therefore explains how we collect, use, disclose and otherwise process your personal data and sets out your rights and choices in relation to that processing.

2. Application

2.1 This Notice applies to you if:

2.1.1 you visit or interact on our website (accessible via https://uk.boralex.com/en or https://fr.boralex.com/fr);
2.1.2 engage with us as a business partner or when applying for opportunities with us;
2.1.3 engage with us with us for corporate social responsibility such as charity or sponsorship activities;
2.1.4 are a current shareholder or former shareholder;
2.1.5 you are engaged with us for marketing; or
2.1.6 you in any way communicate, interact or engage with us.

2.2 We’ve organised information into tables, reflecting the different ways you might interact with us, in order to help you get to the information you want quickly. Please note more than one section may apply to you.

2.3 Please take the time to read and understand this Notice. If you have any queries, you may contact us using the details at the end of this Notice.

3. Scope, Purposes and Lawful Bases

3.1 Set out in the table below is a list of the ways that we may use your personal data, the reasons for doing so and lawful basis we rely on to do so. This is also where we tell you what our (or a third parties’) legitimate interests are.

Relating to:	Description of personal data	Why we use your personal data	Lawful basis
Website user	Information via cookies, tokens, beacons and similar technologies, on browsing activity including your IP address, your device’s unique identifier, browser type, information about the web pages you have viewed on our website, your language preferences, and email click-through and open rates. Submission of enquiries including first and last name, company, email address, telephone, your preferences, location, your enquiry text.	To enable us to monitor, improve functionality and carry out analysis on our website; To personalise your experience on the website including to receive targeted advertising; To allow you to subscribe to emails and alerts; To allow you to submit a query; To facilitate your use of the website; To deal with any query you raise; and To provide you with details of opportunities.	Consent Our Legitimate Interests in: Managing our website; Build and maintain relationships; and Developing our business.
Engage with us for Opportunities as Business Partner or Host	Information provided as part of your application to be a business partner or host of a renewable energy production site including first and last name, email addresses, telephone number, information about your property interest. Banking information such as your bank account or credit card number(s) when you are required to collect rent and/or compensation as a landowner. Background checks (including to support our regulatory licenses, permits, and certifications). Visual images, photographs or videos	To manage your interest and application; To facilitate communication; For promotional purposes; For the purposes of providing information to you; and To facilitate an arrangement with you. To acquire, develop, and operate our renewable energy production sites; and To develop, construct, and operate our projects including to develop our renewable energy production sites and to enter into and enforce agreements with landowners.	Consent Contract Legal Obligation Legitimate Interests of us and our third parties: To grow our businesses; To seek and develop opportunities; To build and maintain relationships; and Build a brand and implement a strategy.
Engage with us for Corporate Social Responsibility (CSR)	First and last name. Email address. Mailing address. Phone number. Banking information such as your bank account or credit card number(s) when you submit a request for donations and sponsorships. Visual images, photographs or videos	To manage and facilitate events and CSR activities including registration; To communicate with participants; To process your requests for donations or sponsorships or when you participate in our events and open houses; To communicate internally including in reports and at Board meetings; To record charity funds; and To engage with the communities where our sites are located.	Consent Legal obligation Our Legitimate Interests: To participate and engage in communities and in charity.
Current shareholder or former shareholder	First and last name. Email address. Registered address. Shareholding and communication method preference. Bank account details.	To manage your shareholding in Boralex; Make shareholder communications and shareholder meeting materials available to you; Allow you to exercise your rights as a shareholder, such as a right to vote at shareholder meetings To keep your record on the share register up to date; Pay dividends to you; and Respond to any correspondence you send to us or to our registrar.	Consent Contract Legal Obligation including in relation to: Companies Act 2006
You are engaged with us as an investor	First and last name. Email addresses. Telephone numbers. Companies related to you as an investor.	To manage your registration; To invite you to events and presentations; To facilitate communication; To finance our projects; For the purposes of providing information on our financial performance to you; and To facilitate results presentations and manage investor relation events.	Our Legitimate Interests: Build and maintain relationships with third parties; and Grow our business.
You are engaged with us for marketing	First and last names. Email addresses. Telephone numbers. Photography or videography relating to you. Your choice of news and information services. Sensitive information including health or disability needs or requirements. Any other information provided on your registration for which you may provide.	To facilitate communication; To invite you to and manage your registration at events, workshops and presentations; To manage events, workshops and presentations including security, health and safety, and disability requirements; To facilitate communication; For marketing / advertising including on social media, websites and email; For publications, press releases and other communications; To facilitate and manage competitions; To provide relevant promotional content and other information about our products and services, newsletters, surveys, contests, promotions, and special offers; and For research and development purposes including to conduct marketing and performance studies, to evaluate our customer service and help us improve our services.	Legal obligation Legitimate Interests of us and our third parties: To build and maintain relationships; Build our brand and implement our strategy; and Grow our business.
All Data Subjects	Contact details including first and last names. Date of birth. Address. Personal and professional contact details (including, where relevant, telephone number and email address). Job title. Social media URL (including profile photo). Any contact with Boralex, prior correspondence and support interactions. Any other information you provide to us digitally or in-person.	To facilitate communication; For the purposes of complaints handling; In the administration of insurance cover and processing any claims; To respond to and comply with audits and other assessments; To facilitate the sale of one or more parts of our business; and To reorganise our operations.	Consent Legal obligation Our Legitimate Interests: To manage business operations; To deal with complaints and queries and In the exercise or defence of a legal claim

3.2 We do not use your personal data for automated decision making.

3.3 If you do not provide personal data then, depending on the purpose for which the data is required, we may be unable to comply with our legal or contractual obligations. This may mean we may not be able to provide you with contractual or legal entitlements and may in certain situations not be able to enter into or continue our engagement with you.

3.4 Generally, we will only use your personal data for the purposes for which we collected it. If over time we consider that we have a different purpose we will ensure the reason is compatible with the original purpose and where appropriate and/or permitted, generally seek your consent to any new or changed processing.

4. Sources of Personal Data

4.1 We collect personal data about you in the following ways:

4.1.1 directly from you: we may collect your personal data directly from you, for example, when you subscribe to our newsletter, or contact us with an inquiry or report a problem with our website.
4.1.2 third parties: referees, recruitment agencies, fraud prevention agencies, government bodies and departments, law enforcement agencies and our suppliers, advisers and agents.
4.1.3 publicly available information that you post online on social or business networking sites such as Facebook and LinkedIn.
4.1.4 public information sources such as the Electoral Register or Companies House.
4.1.5 within our group or associated companies.

5. Sharing of Your Personal Data

5.1 We may share your personal data with other organisations. This table describes our sharing of personal data including who we share with, the reasons why and if any personal data is transferred outside of the UK/European Economic Area (EEA).

Relating to	Third Parties	Data Sharing Purposes	Transfers out of the UK / EEA
Website User	Website service providers. Google. Email alert service providers.	Website service providers: to the extent necessary for them to perform their services to us, including maintaining and improving our website. Email alert service providers: to provide the requested email alerts and notifications.	We may transfer your personal data outside the UK/EEA
Engage with us for Opportunities as Business Partner or Host	Auditors. Agents. Solicitors.	Auditors: to audit the transactions undertaken, in accordance with legal obligations. Agents, solicitors, and partners: for the purposes of executing the property transaction.	We may transfer your personal data outside the UK/EEA
Engage with us for Corporate Social Responsibility (CSR)	5.2 Event organisers. 5.3 Services providers.	Event organisers: to manage and coordinate the CSR events. To communicate with participants.	We may transfer your personal data outside the UK/EEA
Current shareholder or former shareholder	Auditors. Agents. Solicitors.	To respond to, or assist us to respond to, any correspondence you send. To manage, on your behalf, your shareholding in Boralex. To keep your record on the share register up to date	We may transfer your personal data outside the UK/EEA
You are engaged with us as an investor	Auditors. Agents. Solicitors.	To the extent necessary for them to perform their services to us, including Facilitating results presentations and managing investor relations events.	We may transfer your personal data outside the UK/EEA
You are engaged with us for marketing	Our service partners, consultants, contractors, and subcontractors including photographers / videographers. Event organisers. PR Agency.	Our service partners: to the extent necessary for them to perform their services to us. For health and safety reasons. Event organisers: to share the attendance list when we hold a joint event with a third party in respect of a project. Corporate PR agency: To the extent necessary for them to perform their services to us, including facilitating investor relations events.	We may transfer your personal data outside the UK/EEA
All Data Subjects	Lawyers. Accountants. Financial institutions such as banks. Other service providers including transportation companies, backup and server hosting providers, software and IT maintenance providers, consultants, notaries, engineers, audit firms, and security experts. Prospective buyers.	For a sale, transfer, or financing of our business or other transaction. To facilitate the transaction including for example sharing information in the due diligence stage, or during integration or separation of the businesses. Lawyers, accountants and banks: to facilitate and perform our agreements. To advise and facilitate the payment of any taxes payable. To provide services to us. To file an application and obtain the necessary administrative permits for the construction and operation of our renewable energy production sites. To respond to legal proceedings or requests from government authorities.	We may transfer your personal data outside the UK/EEA
All Data Subjects	Within the group of companies.	For our general business and management purposes. To meet client needs where working across offices/locations. For line management, authorisations or approvals with relevant decision makers. Parental/group reporting and strategy. To manage risk. Where systems and services are provided on a shared basis.	We may transfer your personal data outside the UK/EEA

6. Rentention of Your Personal Data

6.1 We will only retain your personal data for as long as is necessary to fulfil the purposes we collected it for.

6.2 To determine the appropriate retention period for personal data, we consider:

6.2.1 the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data,
6.2.2 the purposes for which we process your personal data and whether we can achieve those purposes through other means,
6.2.3 if you have made a request to have your personal data deleted;
6.2.4 guidelines issued by relevant data protection regulators; and
6.2.5 the applicable legal requirements.

6.3 In some circumstances we may anonymise your personal data so that it can no longer be associated with you, in which case we may use such information without further notice to you.

7. International Transfers of Personal Data Outside the UK/EEA

7.1 Boralex is part of a global group of companies, and as a result, your personal data may be transferred outside the jurisdiction in which you are located.

7.2 We only send your personal data outside the UK/EEA to:

7.2.1 follow your instructions;
7.2.2 comply with a legal duty;
7.2.3 work with our group companies, suppliers and service providers that are based outside the UK/EEA; or
7.2.4 work with financial institutions, or partners that are based outside the UK/EEA.

7.3 If we transfer your personal data outside the UK/EEA, we will implement one of the following safeguards:

7.3.1 Transfers to a non-EEA country that has been deemed to provide an adequate level of protection for personal data by the European Commission. For further details, see European Commission: Adequacy of the protection of personal information in non-EU countries. (The UK has published “adequacy regulations” in relation to countries within the EEA and some countries outside of the EEA, which means that these countries are considered under UK data protection law, to provide an adequate level of protection for personal data. (see the ICO’s guidance on international transfers for a list of countries deemed adequate.)
7.3.2 Put in place a contract with the recipient that means they must protect it to the equivalent standards as the UK/EEA including standard contractual clauses for data transfers between EU and non-EU countries; the UK Information Commissioner’s International Data Transfer Agreement / Addendum and any other appropriate safeguard in place from time to time.

8. Your Data Subjects Rights

8.1 The law gives you certain rights in respect of the data that we hold about you. These rights include:

Rights	What does this mean?
The right to be informed	You have the right to be provided with clear, transparent and easily understandable information about how we use your information and your rights. This notice is an example of this right.
The right of access	You have the right to obtain a copy of personal data relating to you (and other information) from us where we are processing it. This is so you are aware and can check that we are using your data in accordance with data protection law.
The right to rectification	You are entitled to have your data corrected if it is inaccurate or incomplete. It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.
The right to erasure	This enables you to request the deletion or removal of your personal data where there is no compelling reason for us to keep using it.
The right to object	Under certain circumstances individuals have the right to stop or prevent the processing of their personal data by Boralex. Individuals also have an absolute right to stop their data being used for direct marketing.
The right to restrict processing	You have the right to ‘block’ or suppress further use of your personal data that we process. This means that it can only be used for certain things, such as legal claims or to exercise legal rights. You can ask us to restrict the use of your personal data if it is not accurate; it has been used unlawfully but you don’t want us to delete it; it is not relevant any more, but you want us to keep it for use in legal claims; or you have already asked us to stop using your data but you are waiting for us to tell you if we are allowed to keep on using it. If we do restrict your data in this way, we will not use or share it in other ways while it is restricted.
The right to data portability	You have the right to receive your personal data in a structured, commonly used and machine-readable format and to request that this data is transmitted to another party/controller where this is technically feasible. This right only applies to personal data you have directly provided to us (not any other data).
The right to lodge a compaint	You have the right to lodge a complaint about our handling or processing of your personal data to data protection regulators.
The right to withdraw consent	Where you have given your consent to us for the processing of any personal data, you have the right to withdraw your consent at any time (although this does not mean that any processing of personal data carried out by us with your consent up to that point is unlawful).

9. Contact Information - For Requests and Complaints

9.1 If you would like to exercise your data protection related rights, have any questions or would like to make a data protection related complaint, please contact us at the following address: privacyofficer@boralex.com.

9.2 When we receive a data protection complaint that we have not complied with the GDPR and UK GDPR, we will:

9.2.1 acknowledge receipt no later than 30 days from receiving it;
9.2.2 take appropriate steps to respond without undue delay, which will include:
- (a) making enquiries into the subject matter of the complaint (to the extent appropriate); and
- (b) keeping you informed about our progress in handling the complaint; and
9.2.3 inform you of the outcome without undue delay.

9.3 You can also complain to the ICO or the CNIL if you are unhappy with how we have used your data. The ICO’s
contact details are:

Information Commissioner’s Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Helpline number: 0303 123 1113

ICO website: https://www.ico.org.uk/make-a-complaint

The CNIL’s contact details can be found on the CNIL’s website: https://www.cnil.fr/fr/saisir-la-cnil/nouscontacter

10. Changes to This Privacy Notice

10.1 We reserve the right to modify and/or update this Notice at any time. We may modify this Notice to ensure it is accurate and up to date and to reflect changes in the law, the practice of the competent data protection authority, business needs and any new activity involving personal data processing. We will notify you when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal data.