Privacy
Policy.

This Privacy Policy applies to the KIP Investor Portal ("Portal"), operated by Uganda National Oil Company Limited ("UNOC") and Uganda Refinery Holding Company Limited ("URHC"), collectively referred to as "we", "us", or "our".

UNOC is incorporated under the Companies Act (Uganda) and is a wholly owned government enterprise under the Ministry of Energy and Mineral Development.

For privacy inquiries, contact our Data Protection Officer at privacy@unoc.co.ug.

We collect information you provide directly when you:

• Register for an investor account (name, company name, email address, country of incorporation, phone number) • Complete an Expression of Interest (EOI), including company profile, land requirements, utility needs, H3SE plans, and national content details • Make a payment (payment reference, proof of payment document; we do not store card numbers) • Upload documents (Certificate of Incorporation, company registration documents, payment proofs) • Contact our support team

We also collect certain technical information automatically: IP address, browser type and version, device type, pages visited, and session duration. This is used solely for security and performance monitoring.

We use your personal information to:

• Process your investor account registration and activation • Enable you to complete and submit your Expression of Interest • Process and confirm application fee payments • Communicate with you about your application status, clarification requests, and decisions • Notify you of relevant application window openings and policy updates • Maintain the security and integrity of the Portal • Comply with our legal obligations under Ugandan law, including the Uganda Investment Authority Act and the Data Protection and Privacy Act 2019 (DPPA) • Conduct internal analytics and improve Portal performance

We do not use your information for advertising, profiling unrelated to the application process, or sale to third parties.

Under Uganda's Data Protection and Privacy Act 2019, we process your personal data on the following lawful bases:

• Contractual necessity — to process your application and manage your investor account • Legal obligation — to comply with Uganda Investment Authority requirements and other statutory obligations • Legitimate interests — to maintain portal security and prevent fraud • Consent — where we request specific optional permissions (e.g. marketing communications)

We may share your information in the following limited circumstances:

• Within UNOC and URHC for the purposes described above • With government bodies including the Uganda Investment Authority, Ministry of Energy and Mineral Development, and other statutory agencies, as required by law • With technical service providers who host and maintain the Portal (subject to data processing agreements that prohibit independent use) • With our automated notification systems (email delivery providers) to send you application status updates • If required by law, court order, or regulatory authority

We do not sell your personal information to any third party.

We retain your personal data for as long as necessary to fulfil the purposes outlined in this policy or as required by Ugandan law. Specifically:

• Active investor accounts: retained for the duration of your relationship with KIP/UNOC • Rejected or withdrawn applications: retained for 5 years from the date of rejection/withdrawal for audit and compliance purposes • Successful allocation records: retained for the duration of the land lease plus 7 years • Technical logs: retained for 12 months

After the applicable retention period, data is securely deleted or anonymised.

Under the Uganda Data Protection and Privacy Act 2019, you have the right to:

• Access — request a copy of the personal data we hold about you • Rectification — request correction of inaccurate or incomplete data • Erasure — request deletion of your data (subject to our legal retention obligations) • Restriction — request that we limit processing of your data • Objection — object to processing based on legitimate interests • Data portability — receive your data in a structured, machine-readable format

To exercise any of these rights, contact our Data Protection Officer at privacy@unoc.co.ug. We will respond within 21 days. There is no charge for exercising these rights.

The Portal uses strictly necessary session cookies to maintain your authenticated session. We do not use tracking cookies, advertising cookies, or third-party analytics cookies.

A session cookie is deleted automatically when you close your browser. We do not use persistent tracking cookies.

We implement appropriate technical and organisational measures to protect your personal data, including:

• Encrypted data transmission (TLS/HTTPS) for all Portal communications • Encrypted storage of passwords using industry-standard hashing (bcrypt) • Role-based access controls limiting staff access to data on a need-to-know basis • Regular security reviews

While we take reasonable precautions, no internet transmission is entirely secure. If you suspect a security incident affecting your account, contact us immediately at privacy@unoc.co.ug.

We may update this Privacy Policy from time to time. We will notify registered users of material changes by email at least 14 days before they take effect. The effective date at the top of this page indicates when the current version was last updated.

Continued use of the Portal after the effective date constitutes acceptance of the updated policy.

For any privacy-related questions or to exercise your rights, contact our Data Protection Officer:

Email: privacy@unoc.co.ug Post: Data Protection Officer, Uganda National Oil Company Limited, Plot 15 George Street, Kampala, Uganda

If you are not satisfied with our response, you have the right to lodge a complaint with the Personal Data Protection Office of Uganda (PDPO).