Privacy Statement

Last modified: June 2026

Cubico is committed to every individual’s right to privacy and complies with the local privacy laws applicable in the various countries in which we operate.

These provide, amongst other things, that the personal information we hold about you should be managed openly and transparently; collected only where reasonably necessary for our functions and activities; used and disclosed for appropriate purposes; kept accurate, up-to-date and complete where required; protected by reasonable technical and organisational measures; and destroyed or de-identified when no longer required by law or for a legitimate business purpose.

This privacy policy (“Privacy Policy”) gives you information as to how Cubico manages personal information, including how we collect and use your personal information and the rights available to you. Please also refer to our cookie policy for information on what cookies are; what the cookies we use are for; and for options on how you can manage or delete them.

Who are we and who is responsible for your personal information?

Cubico is a leading investor in, and developer, owner and operator of, global renewable energy projects. Headquartered in the United Kingdom, we also have offices and projects around the world including in Colombia, Mexico, Uruguay, the United States, Greece, Italy, Spain, the United Kingdom and Australia.

The following privacy policy applies to all Cubico group companies, which control and make use of information collected (“Privacy Policy”). When we mention “Cubico”, “we”, “us” or “our” in this Privacy Policy, we are referring to the relevant company in the Cubico group responsible for processing your data. If you are in Australia, the entity that is responsible for your personal information is Cubico Sustainable Investments Australia Pty Ltd (ACN 624 996 078), which can be contacted directly by mail at KPMG (Sydney), ‘Tower 3 International Towers Sydney’, Level 38, 300 Barangaroo Avenue, Sydney NSW 2000.

What kinds of personal information do we collect and hold?

The information we collect and hold depends on how you or others within your organisation interact with us, and includes:

Identification data such as your name, the company you work for, date of birth, nationality, citizenship, ID or passport number, civil status, occupation or job title, signature, image (via CCTV) etc.
Contact data such as your address(es), email address and/or telephone number.
Technical data such as your IP address (a string of numbers unique to your computer that is recorded by our web server when you request any page or component on this website) and other technology related information generated in respect of or provided in the context of your access to this website. This information may be used to monitor your usage of this website.
Financial data such as your payment details including security code numbers and other associated payment or billing information.

Background and financial verification information provided by you or collected as part of our background screening, “know your client”, fraud prevention, anti-money laundering, business acceptance, project development, procurement, contracting and ongoing monitoring processes.

Transaction data such as details about payments to and from you and contractual files that we may produce as a record of our relationship with you or your organisation, including information concerning the fulfilment of contractual obligations and pre-contractual measures.
Attendance details and records where you have attended meetings or events hosted by us.
Marketing, communication preferences and related information.
Cubico may also use information submitted by you in order to consider you for a position within Cubico, should you apply to Cubico in respect of a vacancy advertised on this website (see separate Recruitment Privacy Notice) or to answer your queries should you contact us with a question.
Further business information provided in connection with a project or contract you are engaging with us on.

Sometimes we may also have access to and use personal information for individuals we are not directly engaging with. This information is managed in the same manner as any personal information we directly collect.

How do we collect personal information?

Cubico collects personal information in a number of different ways, including:

Directly from you when you supply personal information to us.
When you or your organisation engages with us.
When you or your organisation accesses and uses our website or a website managed by us or in connection with one of our projects.
When you attend a meeting or event hosted by us alone or together with one of our partners.
When you or your organisation offers services to us.
From third parties such as background screening, “know your client”, credit reference, analytics, search, fraud prevention or anti-money laundering services that we sometimes use to help us meet our legal obligations, regulators, authorities or public registers and records. This may include technical, identification, financial and contact data.

What purposes will we hold, use and disclose your personal information for and on what basis?

Generally, Cubico needs your personal information because it is necessary to:

conduct our business (including the business of associated entities);
otherwise engage with you, but only where these interests are not outweighed by your privacy interests; or
comply with legal and regulatory requirements applicable to Cubico.

Cubico may hold, use and disclose your personal information for the following purposes:

To provide or receive goods or services or otherwise engage with you as requested by you or your organisation and to perform our contractual obligations.
To manage and administer the relationship between Cubico and you or your organisation.
In accordance with any global legal, compliance or other requirements (e.g. anti-money laundering laws, counter-terrorism laws, financial checks, crime prevention or trade sanctions) and detect, prevent, investigate and respond to suspected or actual fraud, unlawful activity, cybersecurity incidents, data breaches, misuse of Cubico’s systems or premises, and other conduct that may affect Cubico, our personnel, our projects or individuals whose information we hold.
In accordance with our compliance policies and standards.
To host meetings and events.
To oversee and manage the people accessing our premises.
For insurance, legal, tax or accounting purposes.
To identify and verify contract counterparties and persons authorised to trade on behalf of you or your organisation.
To comply with any laws, regulations, court orders or to establish, defend, protect and enforce our legal rights.
To engage with you in relation to the collection and processing of your personal information as contemplated by this Privacy Policy.
For any other purposes for which your personal information was provided to us or related to or ancillary to any of the above purposes.

We will only use your personal data when applicable law allows us to and, depending on the nature and purposes of processing being carried out, our basis for processing includes:

Consent: you have given express consent for us to process your personal information for a specific purpose. Note that you have the right to withdraw your consent at any time.
Pursuing our legitimate interests or those of a third party: the processing is necessary for the purposes of our legitimate interests or those of a third party, except where such interests are overridden by your interests, fundamental rights and freedoms which require protection of personal information.
Complying with legal obligations: the processing is necessary to discharge a relevant legal or regulatory obligation to which we are subject.
Performance of a contract: the processing is necessary for the performance of a contract to which you are party or in order to take steps at your request prior to entering into a contract.

Note that we may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your data.

How do we hold personal information and keep it secure?

Cubico may hold personal information on our technology systems, those of our contractors, suppliers or agents or in paper files. Cubico is committed to ensuring that any personal information we hold is secured in accordance with Cubico’s policies and procedures and in Australia, in accordance with the Australian Privacy Principles.

We have put in place appropriate security measures to prevent your personal data from being misused, accidentally lost, or used, modified or accessed in an unauthorised way, including appropriate physical and technological security measures and cautious selection of third party service providers. These may also include access controls, security monitoring, confidentiality obligations, due diligence and contractual controls for service providers, training, physical security measures, and records management practices.

We have also put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

Who will we share your personal information with?

Cubico may share your personal information as necessary with third parties where such personal information is required by that third party to provide a service to us. This may include insurers, legal advisors, financial advisors, IT providers, background screening providers, accountants, tax advisers, auditors, building or site managers and operators, contractors, suppliers, agents, and government and regulatory bodies or third parties to whom we may choose to sell, transfer or merge parts of our business or assets. Third parties will not be allowed to use your personal information for their own purposes.

We may also share non-personal aggregate statistics (group) data about our website’s traffic patterns with partners or other parties, however we do not sell or share any information about individual users for this purpose.

Will your personal information be shared overseas?

Due to the global nature of our business, Cubico may also be required to share your personal information overseas to other members of the Cubico group or to our contractors, suppliers or agents including in the United Kingdom, Colombia, Mexico, Uruguay, the United States, Greece, Italy, Spain and Australia.

For individuals in Australia, where Cubico discloses personal information to an overseas recipient, Cubico will take reasonable steps to ensure that the overseas recipient does not breach the Australian Privacy Principles in relation to that information, unless an exception applies under applicable Australian privacy law.

Some of the countries where your personal information is shared may not have data protection laws as strict as the country you are located in. In these cases, where Cubico transfers personal information to other members of the Cubico group or third party service providers acting on Cubico’s behalf, Cubico does so, as applicable, on the basis of appropriate safeguards, contractual arrangements, internal controls or other measures intended to protect your information in a form approved for this purpose by the European Commission, UK Information Commissioner or your local data protection authority (as applicable) or otherwise in a manner which ensures a level of data protection at least as protective as that required in (as applicable) the UK, the European Economic Area and Australia. This may include:

where the recipient is established in the United States and participates in the EU-US Data Privacy Framework and its UK extension, or other multilateral or bilateral arrangement where your country is a party to such arrangement (as relevant);
for intra-group transfers, specific standard contractual terms approved for use in the UK and EU which give the transferred personal data the same protection as it has in the UK and EU;
where the recipient has signed up to a contract based on “model contractual clauses” approved by the European Commission or your local data protection authority (as relevant), or any other appropriate safeguards pursuant to the GDPR or local laws (as relevant), as well as, if necessary, supplementary measures, obliging it to protect your personal data; or
where you have provided consent to us for the transfer of your personal data to another country (where this is permitted under local law).

Do we use automated decision-making?

Cubico does not currently use computer programs or AI to make decisions, or to do things substantially and directly related to making decisions, that have a legal or similarly significant effect on individuals in connection with this Privacy Policy. If Cubico introduces this type of automated decision-making, Cubico will update this Privacy Policy to include information required by applicable privacy law, including the kinds of personal information used and the kinds of decisions made or supported by automated means.

How long will you use my personal data for?

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, tax, regulatory, accounting, reporting or other requirements.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of the data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, tax, regulatory, accounting, reporting or other requirements.

We may also retain your personal data where necessary to pursue our legitimate interests (for example, to be able to defend a Cubico company against alleged or actual claims or legal actions).

What are your rights in relation to your personal information?

Depending on the country you are located in and subject to certain exceptions and legal conditions, you have various rights in relation to your personal information.

These include:

The right to request a copy of any information that we currently hold about you or to seek a correction of such information if you consider the information is inaccurate, out of date, incomplete, irrelevant or misleading.
In some circumstances, the right to require us to delete (or stop making active use of) your personal information or restrict our use of your information, so that it can only continue subject to restrictions. Note, however, that we may not always be able to comply with your request of deletion for specific legal reasons which will be notified to you, if applicable, at the time of your request.
The right to request that personal information you have provided is sent to you in a structured, commonly used and machine-readable format and to transmit that data to another organisation. This can be done by providing details of your request to us, using the contact details provided.
The right to object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) as the legal basis for that use of your data. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your right to object.
The right to withdraw your consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent.
The right to make a complaint if you have any concerns about our management of your personal information. We will endeavour to respond to your request or complaint promptly; and
The right to request a copy of this Privacy Policy in an alternative form, and we will take reasonable steps in these circumstances to give you a copy in that form.

We will use all reasonable endeavours to ensure that the information we hold is accurate, up to date and relevant and we will be happy to correct any inaccuracies.

There may be circumstances where Cubico cannot undertake certain activities or engage with you further without access to and use of personal information. Where this occurs and you have not provided us with the required personal information or you choose to ask us to stop making use of your personal information, we will contact you to discuss further.

If you wish to do any of this or if you have any questions, comments or complaints about our Privacy Policy or our handling of your personal information, please contact the Communications Team at Cubico Sustainable Investments, 70 St Mary Axe, London, EC3A 8BE, United Kingdom or dataprivacy@cubicoinvest.com.

We will acknowledge and respond to privacy complaints within a reasonable period and may request further information from you where necessary.

You may also have a right to lodge a complaint with the relevant data protection authority, which in the UK is the UK Information Commissioner (www.ico.org.uk); in Italy, is the Garante Privacy (www.garanteprivacy.it); in Spain, is the Agencia Española de Protección de Datos (www.aepd.es); in Greece, is the Hellenic Data Protection Authority (www.dpa.gr); and in Australia, is the Office of the Australian Information Commissioner (www.oaic.gov.au). Relevant data protection regulators generally expect you to raise your complaint with Cubico first and give us a reasonable opportunity to respond before you lodge a complaint with that regulator.

Any change to this Privacy Policy will be posted here and will be effective immediately. Cubico reserves the right to update and change this Privacy Policy from time to time in order to reflect any changes to the way in which we manage your personal information or any changes to applicable legal requirements.