Privacy Policy

This Privacy Policy describes how your personal information is collected, used, stored and shared when you visit or interact with any of the Norwich Technologies websites including: norwichsolar.com, norwichtech.com, norwichev.com, runtimesolar.com and/or breakawayrenewables.com (the “Site”)

Topics:

• What data do we collect and how do we collect it?
• What types of cookies do we use and how can you manage them?
• How do we use your data?
• How do we share your personal information?
• How do we store your data?
• What are your data protection rights?
• How do we use cookies?
• Privacy policies of other websites
• Changes to our privacy policy
• How to contact us
  
  

What data do we collect and how do we collect it?

You directly provide us with most of the data we collect. When you visit the Site, we automatically collect certain information about your device, including information about your web browser, IP address, time zone, and some of the cookies that are installed on your device. Additionally, as you browse the Site, we collect information about the individual web pages you view, what websites or search terms referred you to the Site, and information about how you interact with the Site. We refer to this automatically-collected information as “Device Information.”

We collect additional information, when you complete a form on our website, voluntarily complete a customer survey or provide feedback on any of our message boards or via email. This can include your name, address, email address, phone number and other details you provide. We refer to this information as “Contact Information.”

When we talk about “Personal Information” in this Privacy Policy, we are talking both about Device Information and Contact Information.

Norwich Technologies may request additional data in order to perform certain business transactions from the following sources:

• If you are a Community Solar Subscriber or have another type of net metering or PPA agreement with us, we may require information about your energy use and billing information through the power company.
• For Vendors we do business with we are required to collect and store FEIN numbers and SS# in order to process payments and generate tax information. We also store 1099s for year end. We do not store credit card information.
• For certain limited business transactions, we may also request information about your credit history through a third party such as Experian.
• Employee information such as Social Security Numbers are stored in our payroll program with access restricted to HR personnel only.

Cookies

Cookies are text files placed on your computer to collect standard Internet log information and visitor behavior information. When you visit our websites, we may collect information from you automatically through cookies or similar technology

We collect Device Information using the following technologies:

• “Cookies” are data files that are placed on your device or computer and often include an anonymous unique identifier. For more information about cookies, and how to disable cookies, visit www.allaboutcookies.org.
• “Log files” track actions occurring on the Site, and collect data including your IP address, browser type, Internet service provider, referring/exit pages, and date/time stamps.
• “Web beacons,” “tags,” and “pixels” are electronic files used to record information about how you browse the Site.

How do we use cookies?

Norwich Technologies uses cookies in a range of ways to improve your experience on our website, including:

• Keeping you signed in
• Understanding how you use our website
  
  

What types of cookies do we use?

There are a number of different types of cookies, however, our website uses:

• Functionality – Norwich Technologies uses these cookies so that we recognize you on our website and remember your previously selected preferences. These could include what language you prefer and location you are in. A mix of first-party and third-party cookies are used.
• Advertising – Norwich Technologies uses these cookies to collect information about your visit to our website, the content you viewed, the links you followed and information about your browser, device, and your IP address. Norwich Technologies sometimes shares some limited aspects of this data with third parties for advertising purposes. We may also share online data collected through cookies with our advertising partners. This means that when you visit another website, you may be shown advertising based on your browsing patterns on our website.
  
  

How to manage cookies

You can set your browser not to accept cookies, and the above website tells you how to remove cookies from your browser. However, in a few cases, some of our website features may not function as a result.

How will we use your data?

Norwich Technologies is committed to protecting and respecting your privacy, and we’ll only use your personal information to administer your account and to provide the products and services you requested from us. From time to time, we would like to contact you about our products and services, as well as other content that may be of interest to you.

We use the Contact Information that we collect generally to:

• Communicate personally with you;
• When in line with the preferences you have shared with us, provide you with marketing information or advertising relating to our products or services.

We use the Device Information that we collect to help us screen for potential risk and fraud (in particular, your IP address), and more generally to improve and optimize our Site (for example, by generating analytics about how our customers browse and interact with the Site, and to assess the success of our marketing and advertising campaigns).

If you have agreed to receive marketing, you may always opt out at a later date. If you no longer wish to be contacted for marketing purposes, please click the “Unsubscribe” or “Manage Preferences” link at the bottom of an email from us, or contact us directly.

Behavioral Advertising

As described above, we use your Personal Information to provide you with targeted advertisements or marketing communications we believe may be of interest to you. For more information about how targeted advertising works, you can visit the Network Advertising Initiative’s (“NAI”) educational page at www.networkadvertising.org/understanding-online-advertising/how-does-it-work.

You can opt-out of targeted advertising by:

• Facebook: www.facebook.com/settings/?tab=ads
• Google: www.google.com/settings/ads/anonymous
• Bing: advertise.bingads.microsoft.com/en-us/resources/policies/personalized-ads

Additionally, you can opt-out of some of these services by visiting the Digital Advertising Alliance’s opt-out portal at: optout.aboutads.info.

Do Not Track

Please note that we do not alter our Site’s data collection and use practices when we see a Do Not Track signal from your browser.

How do we share your personal information?

We share your Personal Information with third parties to help us use your Personal Information, as described above. We use Google Analytics to help us understand how our customers use the Site–you can read more about how Google uses your Personal Information here: www.google.com/intl/en/policies/privacy/.

You can also opt-out of Google Analytics here: tools.google.com/dlpage/gaoptout.

Finally, we may also share your Personal Information to comply with applicable laws and regulations, to respond to a subpoena, search warrant or other lawful request for information we receive, or to otherwise protect our rights.

We never sell any contact information to third parties.

How do we store your data?

Norwich Technologies securely stores your data on our cloud-based software. We have taken reasonable steps to protect this data. They are encrypted databases, and we restrict access to select employees via password protection and 2-factor authentication.

When you contact us through the Site, we will maintain your Information for our records unless and until you opt out and ask us to delete this information.

What are your data protection rights?

Norwich Technologies would like to make sure you are fully aware of all of your data protection rights. Every user is entitled to the following:

• The right to access – You have the right to request Norwich Technologies for copies of your personal data. We may charge you a small fee for this service.
• The right to rectification – You have the right to request that Norwich Technologies correct any information you believe is inaccurate. You also have the right to request Norwich Technologies to complete the information you believe is incomplete.
• The right to erasure – You have the right to request that Norwich Technologies erase your personal data, under certain conditions.
• The right to restrict processing – You have the right to request that Norwich Technologies restrict the processing of your personal data, under certain conditions.
• The right to object to processing – You have the right to object to Norwich Technologies’ processing of your personal data, under certain conditions.
• The right to data portability – You have the right to request that Norwich Technologies transfer the data that we have collected to another organization, or directly to you, under certain conditions.

If you make a request, we have one month to respond to you. If you would like to exercise any of these rights, please contact us directly. See below for details.

Privacy policies of other websites

Norwich Technologies websites contain links to other websites. Our privacy policy applies only to our websites, so if you click on a link to another website, you should read their privacy policy.

Changes to our privacy policy

We may update this privacy policy from time to time in order to reflect, for example, changes to our practices or for other operational, legal or regulatory reasons.

Norwich Technologies keeps its privacy policy under regular review and places any updates on this web page. This privacy policy was last updated on December 1, 2024.

How to contact us

If you have any questions about our privacy policy, the data we hold on you, or you would like to exercise one of your data protection rights, please do not hesitate to contact us:

• Email - info@norwichtech.com
• Phone - (802) 281-3213
• Mail - 15 Railroad Row, Suite 101, White River Junction, VT, 05001 United States

Non-Discrimination Policy

Justice, Equity, Diversity, Inclusion & Belonging Statement

Norwich Technologies believes that a strong commitment to justice, equity, diversity, inclusion, and belonging (JEDIB) is essential to our organization's success and a prerequisite for a just transition to a fossil fuel-free future. Norwich Technologies integrates JEDIB principles and considerations into our daily actions and all of the work we do.

Norwich Technologies is an equal opportunity employer with a strong commitment to diversity, equity, inclusion and belonging in our workforce. We do not discriminate on the basis of race, color, creed, religion, gender (including gender identity or expression), pregnancy, childbirth or related medical conditions, sexual orientation, marital status, sexual and domestic violence or stalking victim status, ancestry, national origin, political affiliation, alienage or citizenship, age, disability, military or veteran status, recovery status from substance use disorder, criminal history, genetic information or predisposing genetic characteristic, or any other legally protected status. We are actively seeking applications by members of all underrepresented groups. Employment with the Norwich Technologies family of companies is based solely on a person's merit and qualifications directly related to professional competence.

We are committed to fostering an inclusive culture that values and embraces diversity. Our commitment extends beyond hiring practices to creating an environment where every employee feels empowered to contribute their unique perspectives. We champion diversity and inclusion through policies that ensure equal opportunities for all employees, fostering a workplace where everyone feels valued, and respected, and has the chance to contribute to our shared success. We recognize that a diverse workforce fuels creativity, enabling us to adapt and thrive in an ever-changing business landscape.

Diversity is not limited to our internal operations. We make every attempt to apply this to our partners and supply chain. We actively seek partnerships with diverse suppliers and investors, recognizing that fostering inclusivity throughout our business ecosystem is essential for sustainable growth. We actively engage in initiatives that support underrepresented communities, recognizing that our success is intertwined with the well-being of the diverse populations we serve.

Social, economic and environmental Justice is ingrained in our work, and we strive to ensure that all stakeholders receive equitable benefits from the transition to clean energy. We recognize the ongoing need to support communities that have been historically underrepresented and those that have suffered from environmental discrimination.

Norwich Technologies recognizes that all board members and staff must contribute to an inclusive and supportive work environment and must commit to ongoing learning and growth needed to support JEDIB practices within our organization.

Responsible Communications, Marketing and Public Relations Policy

Scope and Applicability

The following policy covers a wide range of topics about internal and external communications. All employees are communicators – internal communications in-person and electronically as well as external communication with vendors, regulators and other business partners. It is important to remember that all of these actions are in some way representative of our business. Therefore this policy applies to all employees and all audiences, with additional specific recommendations for marketing and public relations activities. This policy is applied to all of Norwich Technologies (NT) and its business subsidiaries. This policy also aligns with our Non-Discrimination Policy and Privacy Policy.

Ethical Communications

When making claims about the impacts of our operations it is important that all statements are proportional to the company's actions, accurately reflect their applicable scope and are relevant to the company’s impact. All communications must be truthful, transparent, and accountable about the social and environmental impacts of the company’s operations, both positive and negative.

Furthermore, all of NT’s external communications must abide by the highest ethical standards. Every employee is responsible for ensuring that the information we share complies with the following guidelines:

1. Ensures Accuracy – We provide accurate and transparent information in all communications. All claims are precise, verifiable, and substantiated using reliable or scientific data. Where applicable including proper attribution of all references and sources.
2. Fair and Respectful Communication – We promote fair and respectful communication with all audiences, including media, customers, and employees.
3. Compliance with Laws and Regulations – We ensure that all communications, marketing and public relations activities comply with applicable laws and regulations.
4. Ensuring Transparency and Honesty – We follow ethical guidelines, communicate only what is known to be the truth.
5. Understanding Your Audience – We use language that is understandable and clear, matches the general knowledge level of consumers, and available in prevalent languages or forms relevant to stakeholders where the company operates.
6. Respecting Confidentiality and Privacy – We respect individuals privacy by not violating any individual’s privacy or disclosing confidential information regarding an organization.
7. Appropriate for the Time and Place – We are tactful and mindful in choosing the most appropriate messaging, time and place to communicate. We take time to consider outside events that may affect the way our message is received and perceived.

Inclusive Language

Norwich Technologies (NT) recognizes that “words matter” and that language is both context- and audience-specific. We therefore practice thoughtful use of language and terminology that avoids bias and unintentional harm, while adhering to our values of fostering a culture of inclusivity and creating a sense of belonging for all of our stakeholders and audiences.

We use language that:

• Respects Diversity
• Shares Power
• Does Not Discriminate
• Avoids Terminology that Promotes Harmful Inequalities

Language is taken into consideration for each audience. For example: internal communications can use highly technical terms and internal lingo that staff are familiar with, but external communications are written using terminology that a broader audience can understand and avoids unnecessary complexity.

Documents and materials including videos are in a language that the intended reader will understand. NT uses English as its official language. If a key stakeholder speaks a language other than English, translations and interpretation to their preferred language will be provided.

Social Media for Employees

We allow employees to access their personal accounts at work. We expect you to act responsibly and ensure productivity isn’t affected and that posts adhere to our confidentiality policies at all times. We also caution staff to avoid violating our anti-harassment policies or posting something that might make collaboration with your colleagues more difficult (e.g. hate speech against groups a colleague belongs to).

We advise employees to:

• Ensure others know that your personal account or statements don’t represent our company. You shouldn’t state or imply that your personal opinions and content are authorized or endorsed by the company. We advise using a disclaimer such as “opinions are my own” to avoid misunderstandings.
• Avoid sharing intellectual property like trademarks on a personal account without approval. Confidentiality policies and laws always apply.
• Avoid any defamatory, offensive or derogatory content as it may be considered a violation of our company’s anti-harassment policy if directed towards colleagues, clients or partners.
• Follow our privacy policy and observe laws on copyright, trademarks, plagiarism and fair use.
• Inform our Director of Communications when you’re about to share any major-impact content.
• Correct or remove any misleading or false content as quickly as possible.

In the unlikely situation that an employee violates these policies, we may take disciplinary action leading up to and including termination. Examples of non-conformity with the employee social media policy include but are not limited to: disclosing confidential information through personal or corporate accounts, or

• directing offensive or harassing comments towards other members of the online community.

Use of Artificial Intelligence

Employees should follow the approved Workplace Generative AI Software Policy. That Policy is intended to protect Norwich Technologies’ intellectual property, financial information, third-party information, and work product from being improperly accessed by Generative AI Software.

AI raises many ethical considerations, including ensuring fairness, transparency, accountability, and data privacy. It's crucial to use AI systems in ways that align with the ethical communications standards set forward in this policy. It is the users responsibility to ensure that:

• The information is accurate, and does not spread mis- or dis-information
• Results are fair and free from bias
• Data is used ethically and responsibly
• Individual privacy is maintained and company data protection remains secure

Additionally, it is important to consider the potential consequences of using AI including: possible job displacement, potentially exacerbating economic inequality; AI can be used for malicious purposes, such as cyberattacks, deepfake creation, and surveillance; As AI systems become more autonomous, questions arise about who is responsible when an AI system makes a mistake or causes harm; AI models consume enormous amounts of electricity, that can significantly contribute to greenhouse gas emissions

Internal Communications

• It is important that we maintain the highest ethical standards as outlined in this policy in our internal communications. This includes emails, messages, texts, phone conversations and in-person meetings. As a company, we value transparent communications that promote open and honest communication between management and employees, including addressing concerns and providing feedback. We also ensure that all employees can easily access the information they need and in a timely manner. We address any special accommodations that individuals may need in regards to audio or visual impairments. We also remain vigilant to protect and keep designated information strictly confidential.

External Communications, Public Relations and Marketing

External communications are thoughtful and strategic. There is a purpose and a process to creating outward messaging in all forms. There is a designated person, currently the Director of Brand Communications and Sustainability, that handles all communications including social media, website and blog posts, press releases and paid advertising.

Below are some specific guidelines for all staff that they may encounter.

Media Relations:

Staff should direct all media requests to the Director of Communications. Only designated people should speak on behalf of the company in media interactions. These include senior management staff and the Director of Communication.

Key Points To Remember When Dealing with the Media:

• Be polite and helpful.
• Find out what the reporter needs to know and what his or her deadline is.
• Don’t let a deadline pass without a response.
• Don’t get drawn into providing information or opinions that you don’t have the authority to provide.
• Always inform the Director of Communications.

Press Releases:

The Director of Communications will draft all Press Releases and get review and approvals from appropriate senior staff and individuals mentioned in the press release. The Director is responsible for distributing press releases, ensuring accuracy and timeliness.

Responding to Media Coverage:

All staff members are encouraged to monitor media and coverage of our company and industry. We also encourage internal sharing of relevant stories. We discourage staff from making any individual comments on behalf of NT. Should an article warrant a response from NT, the Communications Director will collaborate with senior staff and draft an appropriate message to share publicly.

Crisis Communication:

• In the rare event of a crisis situation it is important to alert the senior leadership quickly. The easiest way to contact all managers at once is via email management@norwichtech.com. Once we gather all the information, we can develop a comprehensive communication plan. During a crisis, staff members should NOT respond to media inquiries and social media comments.
•  

• Content Creation:

• For all external communications, content should be created following the above mentioned ethical standards, using inclusive language and aligns with all other relevant policies. Detailed brand guidance is available in the comprehensive Brand and Marketing guide. All written, audio, and visual content should be free from copyright infringement either because it is original work created by us, or legal rights to usage have been acquired.
•  

Social Media for Business Communications

• At the time of this policy being adopted, NT uses LinkedIn as its social media communication platform. Each company brand has its own account: NT, Norwich Solar, RunTime, Norwich EV, and Breakaway Renewables. The Twitter/X, Facebook and Instagram accounts associated with all of our company brands are dormant. We collectively decided that those accounts are not in alignment with our ethical standards, and our audience is not engaging with us on those platforms.
•  
• Acceptable content for social media includes posts about our projects or operations, staff announcements, partnership communications, topics related to our memberships and certifications (such as B Corp, REV, MREA, SEAI etc), as well as relevant industry related news. Unacceptable content includes off-topic information, personal or individual posts, and anything that does not align with our ethical standards. It is important that there is consistent brand voice and tone across all social media channels. Generally all content is created and published by the Director of Communications.
  
  

Staff is encouraged to engage with our companies on LinkedIn by commenting on and sharing our company posts!

Lobbying & Advocacy Policy

1. Purpose

Norwich Technologies (the Company) recognizes that responsible participation in public policy is an important part of operating a sustainable distributed-energy business.

The Company engages with policymakers, regulators, government officials, industry organizations, and other stakeholders to provide information and perspectives on issues that affect our business, employees, customers, communities, and the responsible development of renewable and distributed energy.

The Company is committed to conducting all lobbying and advocacy activities responsibly, transparently, ethically, and in compliance with applicable laws.

The Company seeks to engage in lobbying and advocacy only where it reasonably believes its activities can contribute to positive outcomes for society, the environment, the business community, or the responsible development of the distributed-energy sector.

The Company seeks to base its public-policy positions on credible and reliable information and, where applicable, scientific and technical evidence. In developing policy positions, the Company considers relevant economic, social, environmental, and technical factors and seeks to communicate information accurately and in good faith.

2. Definitions

Lobbying

Lobbying is any communication or activity intended to influence the introduction, enactment, modification, or defeat of legislation before the U.S. Congress or a state or local legislative body.

Lobbying may include oral, written, electronic, or other communications with legislators, legislative staff, or certain government officials when made for the purpose of influencing legislative or governmental action.

Lobbying may also include activities intended to influence specific proposed or pending regulations, administrative actions, executive orders, or governmental decisions, including certain decisions relating to government contracts, grants, loans, or cooperative agreements, to the extent defined as lobbying under applicable law.

Examples of lobbying may include:

• Asking a legislator to vote for, against, or amend introduced legislation.
• Communicating with legislators or legislative staff regarding specific pending or proposed legislation for the purpose of influencing that legislation.
• Sending a communication to Company constituents that includes a call to action urging them to contact legislators in support of or opposition to specific legislation.
• Preparing or distributing materials specifically supporting or opposing identified legislation before a legislative body.
• Attempting to influence a government official regarding the awarding, continuation, renewal, amendment, or modification of a specific government contract, grant, loan, or cooperative agreement when such activity constitutes lobbying under applicable law.
• Engaging a third party to perform lobbying activities on behalf of the Company.

Because lobbying laws vary by jurisdiction, an activity that constitutes lobbying in one jurisdiction may not constitute lobbying in another. Employees should consult Legal & Compliance whenever there is uncertainty.

Advocacy

Advocacy is activity undertaken to educate, inform, or communicate about a public-policy issue, industry matter, or other cause. Advocacy may relate to governmental or legislative matters but does not necessarily involve an attempt to influence specific legislation or governmental action.

Examples of advocacy may include:

• Sharing information with policymakers about Company operations, projects, employees, customers, or communities.
• Inviting a legislator or government official to visit a Company facility or project.
• Providing educational information, nonpartisan analysis, research, or technical information.
• Updating employees about legislation or public-policy developments without encouraging them to contact policymakers.
• Providing technical information or expertise in response to a government request for information, where the communication is not otherwise lobbying.
• Participating in industry coalitions, educational forums, or public discussions concerning renewable energy, distributed energy resources, sustainability, or related issues.

Advocacy and related expenditures are generally permitted, subject to this Policy and applicable law.

3. Responsible Lobbying Principles

The Company will conduct lobbying and advocacy according to the following principles:

Positive Impact

The Company will seek to engage in lobbying and advocacy only where it reasonably believes its activities can contribute to positive outcomes for society, the environment, or the responsible development of the distributed-energy sector.

The Company will consider the potential environmental, social, economic, and community impacts of significant public-policy positions.

Evidence-Based Positions

The Company seeks to base its policy positions on credible, reliable, and, where applicable, scientific and technical information.

Employees representing the Company should communicate information accurately, transparently, and in good faith and should not knowingly misrepresent facts, data, research, or the Company's interests.

Transparency

The Company will comply with applicable lobbying registration and disclosure requirements and will maintain appropriate records of lobbying activities and expenditures.

The Company will seek to accurately represent its identity, interests, and policy positions when engaging with government officials and other stakeholders.

Integrity

The Company will not engage in bribery, corruption, improper influence, or other unethical conduct in connection with lobbying or advocacy.

No employee or representative may offer, promise, authorize, or provide anything of value to improperly influence a government official or other person.

Respect for Democratic Institutions

The Company respects the role of elected officials, government agencies, regulatory bodies, and other public institutions. Employees engaging in lobbying and advocacy must do so professionally and respectfully and must comply with applicable laws and ethical requirements.

4. Scope and Authority

This Policy applies to all employees, officers, directors, and representatives of the Company who engage in lobbying, advocacy, government-relations activities, political contributions, or related activities on behalf of the Company.

Authorized Company Representatives

Only employees or representatives specifically authorized by the Company may communicate with federal, state, or local lawmakers, legislative staff, regulators, or other government officials on behalf of the Company regarding public policy, legislation, or governmental action.

The Company may designate executives, Government Relations personnel, Legal & Compliance personnel, or other subject-matter experts to represent the Company's interests before government officials.

Employees who are not authorized to speak on behalf of the Company may communicate with government officials in their personal capacity, provided they do not represent or imply that they are speaking for the Company.

Corporate Positions & Sign-Off

Employees must not publicly represent that the Company supports or opposes legislation, regulation, ballot measures, public-policy positions, or other governmental action without appropriate authorization.

Any formal Company position on legislation, regulation, ballot measures, or significant public-policy matters must be approved through the Company's established government-relations and legal review process.

Depending on the nature and significance of the matter, approval may be required from the CEO, Leadership Team, General Counsel, or another executive designated by the Company.

5. Governance and Accountability

Oversight

The Company's leadership team has ultimate oversight responsibility for the Company's responsible lobbying and advocacy framework.

This Policy will be reviewed at least annually and may review it more frequently when significant changes in law, Company strategy, or the Company's lobbying activities warrant an update.

The Internal Legal Counsel and/or Chief Executive Officer is accountable for implementation and enforcement of this Policy and for ensuring that appropriate resources and procedures are in place to support compliance.

Implementation and Compliance

The Company will implement this Policy through appropriate governance, procedures, training, and internal controls. The Company will:

• Identify and comply with applicable federal, state, and local lobbying, political activity, and government ethics requirements, including required registrations and disclosures.
• Provide appropriate training and guidance to employees and contractors involved in lobbying or government relations and require consultation with Legal & Compliance when an activity may constitute lobbying or otherwise present compliance risk.
• Apply appropriate review and approval processes to trade associations, lobbying firms, coalitions, consultants, and other intermediary organizations engaged in lobbying or advocacy on the Company's behalf.
• Monitor lobbying activities and related compliance risks and periodically evaluate compliance with this Policy and its related procedures.
• Investigate or coordinate investigations of reported concerns or potential violations and escalate material compliance issues to appropriate executive leadership and/or the Board.
• Periodically review and update this Policy, related procedures, training, and controls based on changes in law, risk, and lessons learned from compliance reviews.

Employees are responsible for completing required training and providing accurate and timely information necessary to support the Company's compliance obligations.

Records, Reporting, and Assurance

The Company will maintain appropriate records and procedures to identify, track, document, and report lobbying and related activities as required by applicable law and the Company's records-retention requirements.

Records may include lobbying activities and expenditures; employee and consultant time devoted to lobbying where required; lobbying firms and other third parties; registrations and disclosure filings; lobbying conducted through trade associations, coalitions, or other organizations; political contributions and PAC activities; approvals of significant policy positions; relevant training and compliance certifications; and compliance reviews, investigations, findings, and corrective actions.

The Company will periodically evaluate its lobbying and advocacy activities using a risk-based approach. Evaluation activities may include management reviews, review of registrations and disclosures, political and PAC activity, intermediary relationships, training and certifications, and internal or external audits or compliance assessments where appropriate.

Material findings will be documented and addressed through appropriate corrective action. Where appropriate, lessons learned will be incorporated into training, procedures, controls, and future Policy updates.

Employees and contractors involved in lobbying activities must provide timely and accurate information necessary for required registrations, disclosures, and compliance reviews.

6. Risk Management and Compliance Monitoring

The Company recognizes that lobbying and advocacy activities may create legal, regulatory, financial, reputational, and other risks.

Legal & Compliance will maintain a risk-based approach to identifying, assessing, managing, and monitoring these risks.

Relevant risks may include:

• Failure to comply with lobbying registration or disclosure requirements.
• Improper political contributions or expenditures.
• Violations of government ethics or gift rules.
• Bribery or corruption.
• Inaccurate or misleading public-policy communications.
• Undisclosed or unmanaged conflicts of interest.
• Lobbying conducted by third parties that is inconsistent with Company requirements.
• Reputational risk arising from the Company's policy positions or the activities of organizations with which the Company participates.

Risk management activities may include periodic reviews of lobbying activities, expenditure records, third-party relationships, trade-association participation, applicable legal requirements, and emerging regulatory developments.

Material compliance concerns will be escalated to appropriate executive leadership and, where warranted, the Board or designated Board committee.

7. Political Contributions and PACs

Financial and In-Kind Contributions

The Company will comply with all applicable federal, state, and local laws governing political contributions and expenditures.

Company funds may not be used to make political contributions to candidates, political parties, political committees, ballot-measure campaigns, or other political organizations except where expressly permitted by applicable law and approved through the Company's designated legal and compliance process.

Political contributions include both monetary and in-kind contributions, including the provision of Company goods, services, facilities, personnel time, or other resources when such activity constitutes a political contribution under applicable law.

Nothing in this Policy prohibits employees from making lawful political contributions using their personal funds.

Gifts, Meals, Travel, and Entertainment

Employees engaging with public officials or government employees must comply with all applicable federal, state, and local laws and regulations governing gifts, meals, entertainment, travel, honoraria, and other things of value.

Because these rules vary significantly by jurisdiction and government entity:

• Employees must obtain prior approval from Legal & Compliance before providing a gift, meal, entertainment, travel, or other item of value to a government official or employee when required by Company procedures.
• Employees must not provide anything of value for the purpose of improperly influencing a government official.
• Employees must comply with applicable monetary limits, disclosure requirements, and prohibitions.
• Expenses must be accurately recorded and described in Company records.

When there is uncertainty about whether an item, event, meal, or other benefit is permissible, employees must consult Legal & Compliance before offering or providing it.

Political Action Committees

If the Company sponsors or maintains a political action committee (PAC), the PAC must operate in accordance with all applicable laws and reporting requirements.

PAC contributions must be voluntary. No employee may be pressured, coerced, or retaliated against for choosing to participate or not participate in a PAC.

No Political Coercion

Managers and supervisors may not require, pressure, or coerce employees to support or oppose a candidate, political party, political committee, ballot measure, or other political activity.

Employment decisions may not be based on an employee's lawful personal political activity or political views.

8. Anti-Corruption and Bribery

The Company has zero tolerance for bribery and corruption.

Employees and representatives must not directly or indirectly offer, promise, authorize, request, or provide anything of value to a government official, business partner, intermediary, or other person for the purpose of obtaining an improper business or governmental advantage.

Lobbying and advocacy activities must comply with the Company's applicable Code of Conduct, Anti-Bribery and Anti-Corruption policies, and all applicable laws.

The use of third parties, trade associations, consultants, coalitions, or other intermediaries does not relieve the Company or its employees of their responsibility to comply with applicable anti-corruption requirements.

Suspected bribery, corruption, or improper influence must be reported promptly through the Company's designated reporting channels.

9. Trade Associations, Coalitions, and Other Intermediaries

The Company may participate in trade associations, chambers of commerce, industry coalitions, nonprofit organizations, lobbying firms, and other organizations that engage in public-policy advocacy.

The Company recognizes that these organizations may advocate on issues that do not fully align with every aspect of the Company's policy positions.

Due Diligence

Before joining or materially increasing participation in an organization that engages in lobbying or political activity, the Company should evaluate:

• The organization's stated policy and advocacy priorities.
• The nature and extent of its lobbying activities.
• The organization's governance and transparency practices.
• Whether the organization's positions are generally consistent with the Company's interests and responsible-lobbying principles.
• Potential legal, tax, regulatory, and reputational risks.

Ongoing Oversight

The Company will periodically review significant intermediary relationships based on risk.

Where a trade association, coalition, lobbying firm, or other intermediary engages in lobbying on behalf of or with financial support from the Company, the Company will take reasonable steps to ensure that such activities are consistent with this Policy and applicable law.

Depending on the circumstances, appropriate controls may include:

• Contractual requirements to comply with applicable laws and Company policies.
• Communication of the Company's approved policy positions.
• Periodic review of the intermediary's lobbying activities.
• Requests for information regarding lobbying expenditures or activities.
• Review of significant policy disagreements.
• Corrective action or reconsideration of the Company's participation where an intermediary's activities create material legal, ethical, or reputational concerns.

Company membership in an organization does not necessarily mean that the Company endorses every position taken by that organization.

Dues and Lobbying Expenditures

The Company will maintain appropriate records regarding membership dues and other payments to organizations that engage in lobbying or political activity.

Where required, the Company will identify and track the portion of dues or other payments attributable to lobbying or other non-deductible activities and comply with applicable tax and disclosure requirements.

Employees must notify Legal & Compliance when they participate in lobbying activities on behalf of a trade association or coalition if those activities may need to be included in Company records or disclosures.

10. Personal Political Activity

The Company respects employees' rights to engage in lawful personal political activity.

Employees may participate in political activities on their own time and at their own expense, subject to applicable law and Company policies.

Employees engaging in personal political activity must:

• Make clear that they are acting in their personal capacity and not on behalf of the Company.
• Use personal funds and personal resources.
• Not use Company email accounts, computers, facilities, supplies, vehicles, paid work time, or other Company resources for personal political campaigns or political fundraising, except as expressly authorized by Company policy.
• Not use the Company's name, logo, trademarks, or other branding in a manner that suggests Company sponsorship or endorsement.
• Not represent their personal political views as the position of the Company.

Nothing in this Policy prohibits employees from identifying their employment with the Company in a personal capacity, provided they do not imply that the Company endorses or sponsors their political activity.

11. Reporting Concerns and Grievances

The Company encourages employees and external stakeholders to raise concerns regarding the Company's lobbying, advocacy, political contributions, government relations, or other business conduct.

Concerns may be raised through the Company's established Grievance Procedure, Code of Conduct reporting process, Ethics/Compliance reporting channel, or other designated reporting mechanism.

The Company will review reported concerns in accordance with applicable procedures and will take appropriate action when concerns are substantiated.

The Company prohibits retaliation against any person who, in good faith, raises a concern, reports suspected misconduct, participates in an investigation, or otherwise seeks guidance regarding compliance with this Policy.

Where appropriate and legally permissible, concerns may be submitted confidentially or anonymously.

External stakeholders may use the Company's established grievance mechanism to raise concerns regarding the Company's lobbying or advocacy practices, including concerns about misleading communications, improper influence, corruption, conflicts of interest, or other conduct inconsistent with this Policy.

12. Policy Violations

Violations of this Policy may expose the Company and individuals to legal, financial, regulatory, and reputational risks.

Employees and representatives who violate this Policy may be subject to disciplinary action, up to and including termination of employment or engagement, consistent with applicable law and Company policy.

Where appropriate, the Company may report suspected violations to relevant authorities.

13. Policy Review and Revision

This Policy will be formally reviewed and approved by at least one of the senior Leadership Team at least annually.

The Company may conduct an interim review when there are significant changes to:

• Applicable lobbying, political contribution, government ethics, or anti-corruption laws.
• The Company's business or public-policy activities.
• The Company's participation in trade associations or other intermediary organizations.
• Relevant sustainability or responsible-business commitments.
• Identified compliance risks or material incidents.

Changes to the Policy must follow the Company's established governance and approval process.

Human Rights Policy

1. Purpose and Commitment

Norwich Technologies is committed to respecting and promoting internationally recognized human rights throughout our operations and value chain. We recognize that businesses have a responsibility to respect human rights and to avoid causing or contributing to adverse human rights impacts.

We are committed to conducting our business in a manner that respects the dignity, equality, safety, and fundamental rights of all people affected by our activities.

Our commitment is guided by internationally recognized human rights standards, including:

• The Universal Declaration of Human Rights (UDHR);
• The International Covenant on Civil and Political Rights (ICCPR);
• The International Covenant on Economic, Social and Cultural Rights (ICESCR), together comprising the International Bill of Human Rights;
• The International Labour Organization (ILO) Declaration on Fundamental Principles and Rights at Work and the fundamental principles and rights reflected therein; and
• The United Nations Guiding Principles on Business and Human Rights (UNGPs).

We recognize that respect for human rights is a fundamental part of responsible business conduct and is not limited to compliance with applicable law.

2. Scope

This Policy applies to Norwich Technologies, all of its divisions, its employees, officers, directors, and other personnel, and informs our expectations of business partners and other parties whose activities may be directly linked to our operations, products, or services.

We expect our suppliers, contractors, consultants, business partners, and other relevant third parties to respect internationally recognized human rights and to avoid causing, contributing to, or being directly linked to adverse human rights impacts through their business activities.

Where appropriate, we will incorporate these expectations into relevant contractual, procurement, supplier, or business-partner requirements.

3. Our Human Rights Commitments

Norwich Technologies commits to:

Respect for Human Rights

We will respect internationally recognized human rights and seek to prevent our activities from causing or contributing to adverse human rights impacts.

Identification and Assessment of Human Rights Risks

We will assess our potential and actual negative human rights impacts and risks associated with our operations, products, services, business relationships, and value chain.

Our approach will consider the perspectives of potentially affected stakeholders where appropriate and will prioritize attention to the most significant or salient human rights risks.

Prevention and Mitigation

Where we identify actual or potential adverse human rights impacts, we will take appropriate steps to prevent, cease, or mitigate those impacts.

We will seek to integrate the findings of our human rights assessments into relevant business decisions, policies, processes, and management practices.

Remediation

Where Norwich Technologies has caused or contributed to an adverse human rights impact, we will seek to provide for or cooperate in legitimate processes to remediate the impact.

Where an adverse impact is directly linked to our operations, products, or services through a business relationship, we will use our influence and appropriate business processes to seek to prevent or mitigate the impact.

Fundamental Labor Rights

We are committed to respecting fundamental labor and workplace rights, including:

• Freedom from forced, bonded, compulsory, or trafficked labor;
• The prohibition of child labor and respect for minimum-age requirements;
• Freedom from discrimination and harassment;
• Fair and equitable treatment in the workplace;
• Fair wages and compensation;
• Reasonable working hours and appropriate working conditions;
• A safe and healthy working environment;
• Respect for freedom of association and the right to form or join trade unions;
• Respect for collective bargaining;
• Respect for the right to organize and, where applicable, the right to strike;
• Appropriate protections relating to maternity and parental rights; and
• Accessibility and inclusion for persons with disabilities.

We will seek to ensure that employment practices respect the dignity and rights of workers and comply with internationally recognized labor standards and applicable legal requirements.

4. Health and Safety

We recognize health and safety as fundamental components of our responsibility to respect human rights.

We are committed to providing a safe and healthy working environment and to identifying and addressing occupational health and safety risks.

Our goal is to prevent workplace injuries, occupational illnesses, and safety and environmental incidents through appropriate policies, procedures, training, risk management, and continuous improvement.

This commitment is further supported by our Health & Safety Protocols and other applicable SOPs.

5. Human Rights Due Diligence

Consistent with the UN Guiding Principles on Business and Human Rights, Norwich Technologies will seek to implement a human rights due diligence approach appropriate to the size, nature, and circumstances of our business.

Our due diligence approach will include, as appropriate:

1. Identifying and assessing actual and potential adverse human rights impacts;
2. Integrating findings into relevant functions and processes;
3. Taking appropriate action to prevent, cease, or mitigate adverse impacts;
4. Monitoring the effectiveness of our actions; and
5. Communicating how we address human rights impacts.

We will periodically review our human rights risks and approach to account for changes in our operations, business relationships, geographic footprint, products, services, or other relevant circumstances.

6. Business Partners and Supply Chain

We recognize that human rights impacts may occur beyond our direct operations, including within our supply chain and through other business relationships.

We therefore expect relevant suppliers, contractors, and business partners to share our commitment to respecting internationally recognized human rights.

Where appropriate, we will seek to:

• Communicate our human rights expectations to relevant business partners;
• Incorporate human rights considerations into supplier and business-partner selection and management;
• Identify and assess relevant human rights risks within our value chain;
• Engage with business partners where risks or adverse impacts are identified; and
• Take appropriate action to prevent or mitigate adverse impacts, including through remediation or responsible disengagement where appropriate.

We recognize that addressing human rights risks in our value chain may require collaboration and engagement with suppliers, workers, affected communities, industry partners, and other stakeholders.

7. Reporting, Remedy & Accountability

Norwich Technologies encourages employees, workers, business partners, and other stakeholders to raise concerns regarding potential human rights violations or adverse human rights impacts without fear of retaliation. Norwich Technologies will maintain appropriate channels through which concerns may be raised and will seek to ensure that reports are handled appropriately, confidentially where possible, and without retaliation against individuals who raise concerns in good faith.

Where we identify that we have caused or contributed to an adverse human rights impact, we will seek to participate in or provide appropriate remediation through legitimate processes. This commitment is further supported by our internal Grievance Policy.

Responsibility for implementing this Policy rests with the Executive Leadership Team. Relevant employees and functions are expected to understand and implement the commitments contained in this Policy within their areas of responsibility. Human rights considerations may be integrated into relevant business processes, including employment practices, health and safety, procurement, supplier management, risk management, compliance, and other appropriate functions.

8. Training & Implementation

Norwich Technologies will promote awareness of human rights responsibilities among relevant employees and personnel. Where appropriate based on identified risks and roles, we will provide training or other guidance regarding human rights expectations, risk identification, responsible business conduct, reporting mechanisms, and appropriate responses to potential adverse impacts.

We will integrate this Policy into relevant business practices and decision-making processes and will provide appropriate resources and guidance to those responsible for implementing its commitments.

9. Legal Compliance, Transparency & Continuous Improvement

Norwich Technologies will comply with applicable laws and regulations in the jurisdictions in which we operate. Where applicable law and internationally recognized human rights standards differ or conflict, we will seek to respect internationally recognized human rights to the greatest extent possible and consider appropriate approaches to address the situation. We recognize that compliance with national law is a necessary foundation but does not, by itself, fulfill our responsibility to respect human rights.

We are committed to continuously improving our approach to human rights. Senior leadership will periodically review the effectiveness and implementation of this Policy and our human rights due diligence practices to ensure they remain appropriate to our business and evolving human rights risks.

Where appropriate, we will communicate our progress, significant findings, and actions taken to address human rights risks and impacts through relevant company reporting and communication channels.