Privacy Policy

Last Updated: April 21, 2026

1. Introduction

Energy Vault Holdings, Inc. ("Energy Vault," "we," "us," or "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy (the "Policy") explains how we collect, use, disclose, and safeguard your information when you visit our websites, including www.energyvault.com and any subdomains we operate (collectively, the "Site"), and describes your rights regarding your personal data.

This Policy applies to all visitors, regardless of location. It addresses requirements under the European Union General Data Protection Regulation ("GDPR"), the United Kingdom General Data Protection Regulation ("UK GDPR"), the Swiss Federal Act on Data Protection ("FADP"), the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA"), Cal. Civ. Code §§1798.100 et seq., the California Invasion of Privacy Act ("CIPA"), Cal. Penal Code §§631, 632.7, and 638.51, and other applicable privacy laws.

If you do not agree with this Policy, please do not use the Site.

2. Data Controller

The data controller is:

Energy Vault Holdings, Inc., a Delaware corporation
4165 East Thousand Oaks Boulevard, Suite 100
Westlake Village, California 91362, United States
NYSE ticker: NRGV

For privacy inquiries and to exercise data-subject rights, contact us at privacy@energyvault.com or at the postal address above, attention: Privacy Office.

3. Information We Collect

3.1 Information You Provide Directly

When you submit a form on our Site (such as the Contact Us form, the Careers application form, or the Newsletter subscription form), we collect the information you provide. This may include your name, email address, phone number, company name, job title, country, and any message content.

3.2 Information Collected Automatically

When you visit our Site, we and our third-party partners automatically collect certain information through cookies, pixels, and similar tracking technologies. This includes your IP address, browser type and version, operating system, device identifiers (including unique identifiers set by cookies), pages visited, time and date of visit, referring URL, and interactions with our Site content. This collection is subject to your consent as described in Section 5.

3.3 Information From Third-Party Sources

We may receive information about you from third parties, such as business partners, advertising networks, and public sources. Where we do so, we will use that information consistent with this Policy and applicable law.

4. Tracking Technologies and Third-Party Services

Our Site uses the following tracking technologies and third-party services. This disclosure is provided in the interest of transparency and to enable informed consent. No non-essential tracking technology is activated until you have granted consent through our consent management banner.

We may also use a consent management platform ("CMP") as our third-party consent orchestrator. When a CMP is used, it captures and stores a record of your consent preferences and enforces blocking of non-essential technologies until consent is granted.

We do not knowingly deploy FullStory, LogRocket, Intercom, or Amplitude on this Site. Hotjar is present in the site-wide JavaScript namespace solely as a defensive stub that neutralizes any inadvertent Hotjar initialization; no Hotjar tracking cookies are set, no Hotjar scripts are loaded, and no Hotjar data is transmitted. If you observe any unexpected tracking technologies, please contact us at privacy@energyvault.com so we can investigate.

4.1 Named Third-Party Service Providers

Subject to your consent choices under Section 5, the following providers are engaged by Energy Vault to deliver Site functionality and related services:

(a) HubSpot, Inc. — content management, marketing automation, and forms infrastructure.
(b) Google LLC — web analytics (Google Analytics), tag orchestration (Google Tag Manager), advertising measurement (Google Ads), and advertising delivery (DoubleClick / Google Marketing Platform).
(c) Meta Platforms, Inc. — advertising measurement through the Meta Pixel and the Conversions API.
(d) LinkedIn Corporation — advertising measurement through the LinkedIn Insight Tag.
(e) Vimeo, Inc. — embedded video playback with Do-Not-Track enforcement enabled.
(f) Cloudflare, Inc. — content delivery, edge security, and denial-of-service protection; Cloudflare processes request metadata on a transit-only basis.
(g) Cybot A/S (Cookiebot) — consent management platform; Cookiebot records and enforces your consent preferences.
(h) Q4 Inc. — investor relations platform that hosts the investors.energyvault.com subdomain. Q4's own privacy and cookie practices apply when you visit that subdomain; please consult Q4's privacy notice for details.
(i) Lever, Inc. — applicant tracking system that hosts the jobs.lever.co/EnergyVault careers portal. Lever's own privacy and cookie practices apply when you visit that portal; please consult Lever's privacy notice for details.

Each provider is engaged under a data processing agreement or equivalent contractual safeguard consistent with the legal basis identified in Section 8 and the rights described in Section 10.

5. Your Consent and Choices

5.1 Consent Management

When you first visit our Site, a consent management banner presents you with three options: Accept All, Reject All, or Cookies Settings (category-level choices). No non-essential cookies or tracking technologies are activated until you make an affirmative choice. If you decline, only a preference cookie is stored to remember your choice.

5.2 Global Privacy Control

Our Site honors Global Privacy Control ("GPC") signals sent by your browser. If your browser sends a GPC signal, we treat that signal as a valid request to opt out of the sale and sharing of your personal information, and no non-essential advertising or analytics technologies are activated for your session, regardless of banner interaction.

5.3 Changing Your Preferences

You may change your cookie and tracking-technology preferences at any time by clicking "Cookie Settings" in the Site footer. Preference changes take effect immediately.

5.4 Do Not Track

Because there is no industry standard for Do Not Track browser signals, we do not respond to Do Not Track signals. We do, however, honor the Global Privacy Control signal as described in Section 5.2.

6. Legal Bases for Processing (GDPR / UK GDPR / FADP)

For visitors in the European Union, the United Kingdom, and Switzerland, our legal bases for processing personal data are:

Consent (Art. 6(1)(a) GDPR): for non-essential cookies and tracking technologies, marketing communications, and any processing that relies on your affirmative agreement.
Performance of a contract (Art. 6(1)(b) GDPR): for processing necessary to provide services you have requested or to respond to your inquiries.
Legitimate interests (Art. 6(1)(f) GDPR): for security, fraud prevention, analytics limited to aggregate Site improvement, and direct communications with existing contacts about matters within the ordinary scope of our business relationship. We have balanced our legitimate interests against your rights and consider these uses proportionate.
Legal obligation (Art. 6(1)(c) GDPR): for processing required to comply with applicable law, including responses to data-subject rights requests.

7. How We Use Your Personal Data for Marketing

With your consent, we may send you marketing communications about our products, services, events, and Company news. You may withdraw consent at any time by clicking the unsubscribe link in any marketing email, by emailing privacy@energyvault.com, or through the preference center linked in Section 5.

8. How Long We Retain Your Personal Data

We retain personal data only as long as necessary to fulfill the purposes for which it was collected, to comply with legal obligations, to resolve disputes, and to enforce our agreements. Specific retention periods are summarized below.

9. Sharing Your Personal Data

We share personal data with the following categories of recipients, under appropriate contractual and legal safeguards:

Third-party service providers: the providers named in Section 4.1 (HubSpot, Google, Meta, LinkedIn, Vimeo, Cloudflare, Cookiebot, Q4 Inc, and Lever Inc). Each acts as a processor or independent controller depending on the service.
Professional advisors: legal counsel, auditors, and consultants, subject to confidentiality obligations.
Corporate transactions: in connection with any proposed or completed merger, acquisition, financing, or sale of assets, subject to applicable confidentiality.
Legal process: where required by law, by court order, or to protect our rights, safety, and property.
Affiliates: our corporate affiliates for internal business purposes consistent with this Policy.

We do not sell personal data in exchange for monetary consideration. We do "share" personal data for cross-context behavioral advertising within the meaning of the CCPA/CPRA, and only when you have granted consent through the advertising category in our consent banner. You may opt out of sharing at any time (see Section 10).

10. Information for California Residents (CCPA/CPRA)

This Section supplements the rest of this Policy and describes your rights under the CCPA/CPRA, Cal. Civ. Code §1798.100 et seq. The anchor "#ccpa" is reserved for direct linking from the Site footer Do Not Sell or Share My Personal Information link.

10.1 Categories of Personal Information Collected

In the preceding 12 months, we have collected the following categories of personal information identified under Cal. Civ. Code §1798.140(v):

Identifiers: name, email address, postal address, phone number, IP address, unique device identifiers, cookie identifiers (including Meta _fbp, Google _ga, HubSpot __hstc and hubspotutk).
Commercial information: records of products or services considered or inquired about.
Internet or other electronic network activity: browsing history on our Site, pages visited, interactions with our Site, referral URLs, time spent on pages.
Geolocation data: approximate location derived from IP address (no precise GPS-level location).
Professional or employment-related information: company name, job title, country of employment when voluntarily provided through our Site forms.
Inferences: inferences drawn from the above to create a profile reflecting preferences and interests.

10.2 Categories of Sources

We obtain the categories listed above directly from you (when you submit a form or interact with our Site), automatically through tracking technologies described in Section 4, and from third-party data partners identified in Sections 4 and 9.

10.3 Business or Commercial Purposes for Collection

Operating and improving our Site and our Company's business
Responding to your inquiries
Delivering marketing communications to which you have consented
Measuring the effectiveness of advertising and marketing
Protecting security and preventing fraud
Complying with law and defending legal claims

10.4 Categories of Personal Information Sold or Shared

Energy Vault does not "sell" personal information for monetary consideration. We do "share" the following categories for cross-context behavioral advertising, subject to your consent:

Identifiers (advertising and cookie identifiers)
Internet or other electronic network activity (page URLs, browsing behavior)

The recipients of shared personal information are Meta Platforms, Inc.; Google LLC; and LinkedIn Corporation. Sharing occurs only after you affirmatively consent through the advertising category in our consent banner, or it does not occur at all if GPC is signaled by your browser.

10.5 Your California Privacy Rights

Right to Know (Cal. Civ. Code §1798.100, §1798.110, §1798.115): the right to request that we disclose the categories and specific pieces of personal information we have collected, the categories of sources, the business or commercial purposes, and the categories of third parties with whom we share it.
Right to Delete (Cal. Civ. Code §1798.105): the right to request deletion of personal information we have collected, subject to exceptions set forth in the statute.
Right to Correct (Cal. Civ. Code §1798.106): the right to request correction of inaccurate personal information.
Right to Opt-Out of Sale or Sharing (Cal. Civ. Code §1798.120, §1798.135): the right to opt out of our "sharing" of personal information for cross-context behavioral advertising. You may exercise this right by clicking the "Do Not Sell or Share My Personal Information" link in our Site footer, by clicking "Reject All" on our consent banner, by toggling off the advertising category in Cookie Settings, or by enabling Global Privacy Control in your browser.
Right to Limit Use of Sensitive Personal Information (Cal. Civ. Code §1798.121): Energy Vault does not use or disclose sensitive personal information for purposes that would trigger this right under the statute; accordingly, no separate opt-out is needed, but you may still submit such a request and we will honor it.
Right to Non-Discrimination (Cal. Civ. Code §1798.125): we will not discriminate against you for exercising any of these rights. We do not offer financial incentives in exchange for personal information.

10.6 How to Exercise California Rights

To submit a Right to Know, Right to Delete, Right to Correct, or Right to Limit request, email privacy@energyvault.com with the subject line "California Privacy Request" or write to us at the postal address in Section 2.

We will acknowledge receipt within 10 business days and will respond substantively within 45 calendar days (extendable by an additional 45 days with notice, per Cal. Civ. Code §1798.130(a)(2)).

We will verify your identity before honoring Right to Know, Right to Delete, or Right to Correct requests using reasonable methods such as matching information you provide to information we hold. We may need additional information to verify identity for sensitive requests.

10.7 Authorized Agents

You may designate an authorized agent to submit requests on your behalf. The agent must provide proof of authorization (such as a signed permission, a power of attorney, or similar document), and we may require that you verify your identity directly with us as permitted under Cal. Civ. Code §1798.135(c).

10.8 California "Shine the Light" Request

California Civil Code §1798.83 permits California residents to request a notice describing the categories of personal information shared with third parties for direct-marketing purposes. To make such a request, contact us at privacy@energyvault.com.

11. International Data Transfers

Energy Vault is headquartered in the United States, with offices in Switzerland, Australia, and other locations. Personal data we collect may be transferred to, stored in, and processed in countries outside your country of residence, including the United States.

For transfers of personal data from the European Economic Area, the United Kingdom, or Switzerland to third countries, we rely on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum and Swiss equivalent, as applicable), or on adequacy decisions where available. You may request a copy of the transfer mechanism applicable to your data by contacting privacy@energyvault.com.

12. Your Rights Over Your Personal Data

Where you are in a jurisdiction that grants data-subject rights, you have the following rights, which are additive to the California rights described in Section 10:

Right to access the personal data we hold about you
Right to rectification of inaccurate personal data
Right to erasure ("right to be forgotten") where the statutory grounds apply
Right to restriction of processing
Right to data portability
Right to object to processing based on legitimate interests
Right to withdraw consent, without affecting the lawfulness of processing carried out before withdrawal
Right to lodge a complaint with a supervisory authority (in the UK: the Information Commissioner's Office, ico.org.uk; in the EU: your national Data Protection Authority; in Switzerland: the Federal Data Protection and Information Commissioner)

To exercise any of these rights, email privacy@energyvault.com.

13. Children's Privacy

Our Site is not directed to children under 16, and we do not knowingly collect personal data from children under 16. If you believe that a child has provided us personal data, please contact privacy@energyvault.com and we will take steps to delete it. For California residents under 16, we do not sell or share personal information without affirmative authorization as required under Cal. Civ. Code §1798.120(c).

14. Third-Party Links

Our Site may include links to third-party websites and services (for example, our Investor Relations portal hosted on an external platform, or social-media pages). Those third parties are governed by their own privacy policies, which we encourage you to review. We are not responsible for the privacy practices of third-party websites.

15. Security

We implement technical and organizational security measures designed to protect personal data against unauthorized access, loss, alteration, or disclosure. These measures include encryption in transit, access controls, and regular review of our security controls. No method of transmission over the internet is perfectly secure; however, we are committed to maintaining industry-standard protections.

16. Changes to Our Privacy Policy

We keep our Privacy Policy under regular review. Any changes will be posted on this page with an updated "Last Updated" date. If we make significant changes that materially affect your rights, we will provide more prominent notice (for example, a Site banner or direct communication).

17. How to Contact Us

Please contact us with any questions about this Privacy Policy or the personal data we hold about you:

General inquiries: info@energyvault.com
Privacy requests (including California residents): privacy@energyvault.com
Mail: Energy Vault Holdings, Inc., Attn: Privacy Office, 4165 East Thousand Oaks Blvd, Suite 100, Westlake Village, CA 91362, United States