Smart Retailer Privacy Notice Schneider Electric f We commit to serve you, our customers, with care, consideration, and respect and to protect your privacy and personal information. Our Data Privacy Policy explains how and why we use personal information. This notice provides additional information about Smart Retailer. This privacy notice applies to the application used as an engagement and loyalty program managed online for ESP retailers. It explains what personal information will be collected through your use of the service, how that information will be used, and how you can control the collection, correction, and/or deletion of your information. 1.​Who is in charge of data processing? The processing of personal information is carried out by Schneider Electric. 2.​What types of personal information do we process and why do we process personal information? We process the following categories of personal information: Categories of personal information Source Reasons for use Full Name Existing data – RMS application (hosted by SE) New onboarding – via Smart Retailer Mobile Application To verify retailers and provide rewards based on their performance Mobile number To enable login on the mobile application and verify the retailer Address – State and City Record of rewards are taken to provide details to agency to ship physical rewards GST Number Retailers To prevent misuse and verify the retailer Aadhar Card Number Retailers To cross-check Retailer details with PAN information Pan Card Number Retailers Required for TDS deduction on rewards exceeding ₹20,000 Camera Retailers To capture promotional activities conducted by retailers for reward point claims Notifications Device ID received via Firebase To notify users about reward points and scheme updates through the application 3.​How long do we keep your personal information? We keep information as needed to perform the purposes described above, taking into consideration the need to provide the services related to Loyalty program. We retain your personal information until 36 months of inactivity or you explicitly request its deletion on the application. In case of deletion of your personal data it may mean that you can no longer participate in the Retailer Loyalty Program. 4.​Who do we disclose personal information to and where is it processed? Personal information will be processed by our subsidiaries and authorized suppliers involved in delivering loyalty program services. We take measures to ensure that personal information receives an adequate level of protection. We do not sell or rent your personal information for monetary consideration to a third party without your permission. We have internal policies applied by our subsidiaries and we conclude relevant contracts with our suppliers to ensure appropriate safeguards. Our group has adopted Binding Corporate Rules (BCR). In addition, we conclude Standard Contractual Clauses and rely on EU Commission’s adequacy decisions. To obtain more details and copies of safeguards put into place, you may contact global-data-privacy@schneider-electric.com. We may also disclose your information, as necessary: • to competent authorities, based on a good faith belief that disclosure is necessary to respond to a judicial process, a valid official inquiry, or if otherwise required by law; • to defend our legal rights, or to protect the rights or safety of any person or entity; • as instructed by you, our customer or the user; and • in other ways described in this privacy notice or to which the data subject has otherwise consented. 5.​How do we secure personal information? We follow generally accepted industry standards to protect personal information and we maintain appropriate administrative, technical and physical safeguards to protect it against accidental or unlawful destruction, accidental loss and unauthorized alteration. However, no method of transmission over the internet, or of electronic storage, is 100% secure. Therefore, we cannot guarantee absolute security. 6.​How to exercise your choices and rights about your personal information? To exercise your choices and the data protection rights granted under applicable data protection law, such as the rights to be informed, to access, to rectify, to withdraw consent, to request erasure or restriction, the right to object and data portability, you may: - access and edit your personal information and your choices. On the application to update personal information by navigating on the Profile page - request deletion of your account in your profile page, will delete information associated with your setup, - make a request at the contact details available within the application or at Global-Data-Privacy@schneider-electric.com. To ensure the security of your personal information, we may ask you to provide other details to verify your identity. For any suggestion, question and request, you may contact us and we will be happy to assist you. You may address questions or comments about our privacy practices or this privacy notice to the correspondent for our Group Data Protection Officer (Group DPO): global-data-privacy@schneider-electric.com If you believe that we have processed your personal information in violation of applicable law, you may file a complaint with the Group DPO at the contact details above or with a supervisory authority. Last updated – 21st July 2025 Internal