Privacy & Cyber-Security Policy.

01Who we are

Bcal Energy LLC ("Bcal Energy," "we," "us," or "our") is an independent California developer of behind-the-meter carbonate fuel cell power plants. We use PG&E's Share My Data program to access energy-usage data that customers authorize us to receive. You can reach us at any time at info@bcalenergy.com.

02Information we collect

Energy-usage data

With your express authorization, we receive your electric and/or gas interval usage, billing, and account information from PG&E through the Share My Data platform — and, where you choose to provide it, through Green Button "Download My Data" files.

Information you give us

When you contact us or request a site qualification, we collect the details you send, such as your name, company, email address, facility location, and load information.

Technical logs

Our website and qualification service record standard technical information — such as IP address and request times — for security, reliability, and to prevent abuse.

03How we obtain energy-usage data

We access PG&E customer data only after the customer has expressly authorized that access through PG&E's Share My Data platform or an equivalent customer-authorization form. You decide the scope and duration of the authorization, and you can revoke it at any time (see Section 8). Our handling of authorized data complies with PG&E's Customer Data Access tariff and the Share My Data Platform Terms and Conditions.

04How we use your information

We use energy-usage data solely to perform a site-specific techno-economic analysis — equipment sizing, tariff and load-shape modeling, thermal-sink assessment, incentive-eligibility screening, and feasibility analysis for a potential behind-the-meter fuel cell project at your facility. We use the contact information you provide to respond to you and to deliver that analysis. We do not use your energy-usage data for advertising or marketing.

05How we share information — and how we do not

We do not sell or share your personal information, and we do not "share" it for cross-context behavioral advertising, as those terms are defined under the CCPA. We disclose information only:

• to service providers who help us operate (for example, secure hosting), bound by confidentiality obligations and permitted to use the data only to provide services to us;
• when you ask us to, or as necessary to deliver an analysis you requested;
• to comply with applicable law, or to protect the rights, property, or safety of our customers or others.

We never disclose your PG&E energy-usage data to unrelated third parties.

06Cookies and tracking

We do not use advertising or cross-site tracking cookies on this website, and we do not use analytics or marketing-automation trackers. We use only strictly necessary cookies or local storage required to make the site function. Because we do not use cookies to collect personal information for sale or sharing, no cookie-consent banner is presented. If we ever introduce cookies that collect personal data, we will provide a consent banner and update this policy.

07Privacy and cyber-security controls

We maintain a privacy and cyber-security program with administrative, technical, and physical safeguards designed to protect your information, including:

• encryption of data in transit (TLS) and at rest;
• certificate-based (SHA-256 X.509) authentication and encryption for any data exchanged with PG&E's Share My Data platform, as the platform requires;
• role-based access controls and least-privilege access, restricted to authorized personnel who need the data to deliver your analysis;
• network and endpoint protections, logging, and monitoring;
• security diligence on the vendors and infrastructure we rely on; and
• an incident-response process for suspected security events.

No method of transmission or storage is perfectly secure, but we work continuously to protect your information and to limit access to it.

08Your California privacy rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended, gives you the following rights regarding your personal information:

• Right to Know the categories and specific pieces of personal information we have collected about you, the sources, the purposes for collecting it, and any parties to whom it is disclosed.
• Right to Delete the personal information we have collected from you, subject to legal exceptions.
• Right to Correct inaccurate personal information we maintain about you.
• Right to Opt-Out of the Sale or Sharing of your personal information. We do not sell or share your personal information, so there is nothing to opt out of — but you may contact us with any questions.
• Right to Limit the use and disclosure of sensitive personal information. We do not use or disclose sensitive personal information for purposes that require us to offer this option.
• Right to Non-Discrimination — we will not deny you services, charge you a different price, or provide a different level of service because you exercised any of these rights.

To exercise any of these rights, email info@bcalenergy.com. We will verify your request (and may ask for information to confirm your identity), respond within the timeframes required by law (generally within 45 days), and you may use an authorized agent to submit a request on your behalf.

09Data retention

We keep energy-usage data only as long as needed to perform the analysis you requested, or as required by law, after which we delete or de-identify it. You can revoke your Share My Data authorization at any time through your PG&E account or by emailing info@bcalenergy.com; revocation stops any future data transfers.

10Children's privacy

Our services are directed to businesses and institutions, not to children, and we do not knowingly collect information from children.

11Changes to this policy

We may update this policy from time to time. When we do, we will post the revised version on this page with a new effective date.

12Contact us

Questions about this policy, our cyber-security controls, or your data? Email info@bcalenergy.com. You can also read about PG&E's own data-privacy practices at PGE.com/privacy.