Privacy

As data controllers, Ithaca Energy plc, registered at 33 Cavendish Square, London, England, W1G 0PP, and its affiliates (including Ithaca Energy (UK) Limited and Ithaca (NE) E&P Limited which, together with Ithaca Energy plc, act as employing entities) (“the Company”) are committed to protecting the privacy and security of your personal data in accordance with applicable data protection laws, including the Data Protection Act 2018 and the retained version of the General Data Protection Regulation ((EU) 2016/679) (“UK GDPR”).

This notice applies to information we collect about website users, recruitment candidates, individuals who receive a job offer and progress through to onboarding, and those who choose to contact us via our website or related recruitment and onboarding platforms.  It describes how we use your personal information, the rights you have regarding the use of such data, the measures taken to protect the security of that data, and who you can contact regarding our data protection practices. 

In most instances, you can visit our website without providing any personal data to us.  However, we may collect personal data when you use our website, submit an enquiry, apply for a role, receive a job offer, or progress through to onboarding.

Some recruitment and onboarding information may be collected through third-party recruitment, and HR platforms used by the Company.

We may collect personal data directly from you, from recruitment or onboarding platforms you use, and from third parties involved in pre-employment checks, where applicable. The personal data we collect will depend on your interaction with us and may include:

• Website enquiries and contact information
  • contact details, such as your name, title, email address, telephone number and physical address;
  • information about your company/organisation and job title;
  • details of your enquiry or communication with us.
• Recruitment information
  • curriculum vitae, including education, qualifications, employment history, skills and experience;
  • recruitment and selection information, such as application responses, interview notes and assessment information;
  • identity and right-to-work information, where required as part of recruitment, job offer or onboarding processes;
• Job offers and onboarding information
  • personal details and contact information required for employment administration, such as full name, date of birth, home address, personal email address and telephone number;
  • information required to progress a job offer, such as role details, start date, contract details, work location and remuneration information;
  • pre-employment checks, where required for a role and in accordance with applicable law;
  • information required to support onboarding, such as emergency contact details and information needed to set up HR, IT and business systems;
  • payroll, tax and pension information, such as bank account details, National Insurance number, tax information and pension enrolment details;
  • benefits information required to administer standard or voluntary employee benefits;
  • health or medical information, where required to assess role-related fitness, support occupational health, make workplace adjustments, administer benefits or meet legal obligations.
• Website and technical information
  • Internet Protocol (IP) address;
  • browser type, operating system, access date and time, and website usage information.

Where we ask you to provide personal data, we will only request the information needed for the relevant purpose.  

Some of the information we collect is more sensitive, in particular, health and medical information (known as "special category data"). We only collect and use this where it is necessary for legitimate employment-related purposes. We only collect and use this information where it is necessary for legitimate employment-related purposes. For example, we may use it to assess fitness for a role, make workplace adjustments, administer benefits, meet our legal obligations, or, where relevant, with your explicit consent. 

We limit this information to what is necessary, only use it where data protection law allows, and apply appropriate safeguards to protect it. You can obtain further information by contacting our Data Protection Officer at dataprivacy@ithacaenergy.com.

In broad terms, we collect and use your personal data for one or more of the following reasons:

• for our legitimate interests, for example to ensure the security of our website, improve web services, respond to your enquiry, manage recruitment activity, assess applications, progress job offers and support onboarding;  
• to take steps at your request before entering an employment contract, for example when considering your application, progressing a job offer or preparing onboarding arrangements;  
• to perform a contract with you, where this is required to establish or manage the employment relationship;  
• to fulfil a legal or regulatory obligation in any relevant jurisdiction, for example under our obligations in relation to UK immigration laws and regulations, tax, payroll, pension auto-enrolment, employment law or statutory reporting requirements;  
• where you have given consent, for example where consent is required for optional information or participation in certain voluntary benefits.

We will use personal data only for the purposes defined below.

• Website management:  We use website and technical information to assess system performance, improve web services and website management, maintain the security of our website, and track the number of visitors to our site.

• Employment applications, job offers and onboarding:  In connection with a job application or enquiry, you may provide us with data about yourself, including your curriculum vitae, educational background, employment history, qualifications, skills and experience and evidence of your right to work in the UK.  We may use this information within the Company for the purpose of assessing your suitability for employment.

  If you are offered a role with the Company, we may collect and use additional personal data to progress your offer and support onboarding. This may include information required to prepare your contract, complete pre-employment checks, set you up on HR, payroll, IT and business systems, administer tax, pension enrolment and employee benefits, and support your introduction into the business.

  We will keep your application on file for future consideration for a period of 12 months from the date of submission unless you advise us not to do so.  If you accept an offer of employment, relevant recruitment and onboarding information may be retained as part of your employee record and handled in accordance with our employee privacy notice and applicable employee data retention requirements.

  We will keep your application on file for future consideration for a period of 12 months from the date of submission unless you advise us not to do so.  If you accept an offer of employment, relevant recruitment and onboarding information may be retained as part of your employee record and handled in accordance with our employee privacy notice and applicable employee data retention requirements.

• Media Enquiries: Where you have submitted a media enquiry, we will use your personal data to respond to your request.  Following our response to you, we may retain your contact details to allow us to contact you again in the future.  If you do not wish us to retain your data, please inform us when submitting your enquiry.  
• Investor Relations Enquiry:  Where you have submitted an investor relations enquiry, we will use your personal data to respond to your request.  Following our response to you, we may retain your contact details to allow us to contact you again in the future.  If you do not wish us to retain your data, please inform us when submitting your enquiry or unsubscribe at any time via our website.
• Web Alerts:  At your request, we will use personal data to inform you when our website has been updated with the latest press releases, financial or general reports.   Each email alert sent to you will include an unsubscribe link allowing you to stop delivery of that type of communication. If you elect to unsubscribe, you will be removed from the relevant list immediately.  Your request to remove you from the mailing list will be retained for a period of 90 days thereafter.

We may transfer your personal information collected via our website, recruitment processes or onboarding activities to countries outside of the United Kingdom where required to support the purposes described in this notice, comply with legal or regulatory obligations, or use systems and service providers that support our business operations.  

If we transfer your personal information to recipients in countries outside the United Kingdom that are not covered by UK adequacy regulations, we will ensure that an appropriate safeguard is in place as required by the UK GDPR. You can obtain further information about the safeguards we use by contacting the Data Protection Officer at dataprivacy@ithacaenergy.com. 

We collect certain data about all visitors to our website, including your browser type, browser settings and language, your operating system, the date and time you access the site and the website from which you linked to our site.   We use this information to assess system performance, improve web services and website management, maintain website security, and track the number of visitors to our site.  Please refer to our Cookie policy for further information.

Except as described below, personal information that you provide to the Company via our website, recruitment processes or onboarding activities will not be shared outside of the Company and its joint ventures.

• Disclosure to service providers: The Company contracts with other companies to provide services on our behalf, such as hosting our website, supporting recruitment and onboarding processes, administering payroll, pension and benefits arrangements, investor relations, and website analytics. We provide these companies with only those elements of personal data they need to deliver those services.  These companies and their employees are prohibited from using that personal data for any other purpose.
• Disclosures in connection with acquisitions or divestitures:  The Company may disclose any personal information held about you to third parties if we sell or buy any business or assets, in which case we may disclose your personal data to the prospective seller or buyer of such business or assets.
• Disclosure for other reasons: The Company may disclose personal data if we are under a duty to disclose or share your personal data to comply with any legal or regulatory obligation in any relevant jurisdiction. 

The Company will only retain your personal information for as long as necessary to fulfil the purposes it was collected for, including for the purposes of satisfying any relevant legal, accounting, employment, regulatory or reporting requirements.

The transmission of information via the internet is not completely secure. However, we have put in place appropriate security measures to try to prevent your personal information from being accidentally lost, used, accessed in an unauthorised way, altered or disclosed.  In addition, we limit access to your personal information to those employees, contractors and other third parties who have a business need to know. They will only process your personal information on our instructions, and they are subject to a duty of confidentiality.  

We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

Under certain circumstances, the following rights may apply in relation to the processing of your personal data.

• Request access to your personal data;
• Request correction of the personal information that we hold about you;  
• Request erasure of your personal information;
• Object to processing of your personal information;  
• Request the restriction of processing of your personal information;  
• Request the transfer of your personal information to another party;  
• Withdraw consent, where we rely on consent to process your personal information;

If you would like to exercise your privacy rights, please contact the Data Protection Officer at dataprivacy@ithacaenergy.com.  

To help protect your privacy, we will take reasonable steps to verify your identity before granting access to your information. You can help us to keep data about you accurate by notifying us of any change to your email address, phone number or mailing address.

You will not normally have to pay a fee to access your personal information or to exercise any of the other rights.  However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive.  

We do not make decisions about you based solely on automated processing (without meaningful human involvement) that produce legal effects concerning you or similarly significantly affect you. 

If you have a concern about the way we have handled your personal data, please contact the Data Protection Officer at dataprivacy@ithacaenergy.com.  If we are unable to resolve the issue to your satisfaction, you may contact the Information Commissioner’s Office via https://ico.org.uk. 

We keep our privacy notice under regular review. When changes occur, we will revise the ‘date of last review’ at the end of the notice.  

Date of last review:  August 2026