Article 1: Identification of the Data Controller This Privacy Policy outlines the data processing protocols maintained by Suncor Enegry ("the Platform", "we", "us", or "our"), with corporate headquarters located at 150 9th Avenue SW, Suite 3200, Calgary, AB T2P 3H9, Canada. As we offer digital analytical interfaces and energy sector telemetrics accessible to users globally and specifically within Australia, we act as the Data Controller in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). To ensure maximum data integrity, our data compliance team can be reached directly via [email protected].

Article 2: Categories of Personal Information Collected In compliance with the principle of data minimisation, we collect:

Identity Metrics: Full legal name, date of birth, nationality, and government-issued identification for corporate onboarding and mandatory KYC/AML verification protocols.

Financial and Operational Telemetry: Source of funds, transaction histories, and digital billing parameters.

Digital Footprint: IP addresses, hardware specifications, and granular interaction logs with our data systems and platforms.

Article 3: Legal Basis for Processing Our collection and utilisation of information are founded upon:

Contractual Necessity: Essential for establishing, maintaining, and managing user accounts or corporate relationships.

Statutory Obligations: Compliance with international anti-money laundering frameworks and applicable automated financial tracking rules.

Legitimate Business Interests: Proactive fraud prevention, system performance tuning, and technical network safety.

Explicit Consent: For tailored updates, system notifications, and non-essential analytical tracking cookies.

Article 4: Advanced Security & Sovereignty

Encryption: All data at rest is stored utilizing military-grade AES-256 cryptographic protocols.

Transmission: Secured via TLS 1.3 end-to-end encryption.

Hosting: Data is exclusively hosted on redundant, high-security server clusters with strict access boundaries to safeguard user profiles from unauthorized processing or external disruption.

Article 5: Retention and Your Rights We retain identity and transaction records for a minimum of seven (7) years following account closure to meet statutory tax and legal accountability mandates. Under the Australian Privacy Act, users residing in Australia possess clear rights to access, rectify, or request the deletion of their personal profiles. Requests should be submitted to [email protected]. You also maintain the right to escalate privacy issues to the Office of the Australian Information Commissioner (OAIC).