Privacy Policy

2. How and Why We Use Your Personal Data

3. Legal Basis for Processing (GDPR)

Under GDPR, we process your personal data based on the following legal grounds:

• Consent: For marketing communications and non-essential analytics (Article 6(1)(a))
• Contract Performance: To provide energy community services (Article 6(1)(b))
• Legal Obligation: To comply with energy regulations and tax laws (Article 6(1)(c))
• Legitimate Interests: For platform security, fraud prevention, and service improvement (Article 6(1)(f))

You may withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing before withdrawal.

4. Data Sharing and Third-Party Services

We share your personal data with trusted third-party service providers who help us operate our platform:

We may also share data when required by law, to protect our rights, or in connection with a business transaction.

5. International Data Transfers

Some of our service providers may be located outside Switzerland and the EU. When we transfer your data internationally, we ensure appropriate safeguards are in place:

• Transfers to countries with adequacy decisions from the EU Commission
• Standard Contractual Clauses (SCCs) or other appropriate safeguards for other countries
• We ensure your data receives the same level of protection as required under Swiss and EU law

6. Data Retention and Deletion

We retain your personal data only as long as necessary for the purposes outlined in this policy:

• Account data: Retained while your account is active and for 2 years after account closure
• Energy transaction data: Retained for 10 years as required by Swiss energy regulations
• Marketing communications: Until you unsubscribe or withdraw consent
• Legal compliance: As required by applicable laws and regulations

When retention periods expire, we securely delete or anonymize your personal data unless longer retention is required by law.

7. Your Rights Under GDPR

As a data subject, you have the following rights regarding your personal data:

• Right of Access: Request a copy of the personal data we hold about you
• Right to Rectification: Correct inaccurate or incomplete personal data
• Right to Erasure: Request deletion of your personal data (subject to legal retention requirements)
• Right to Restriction: Limit how we process your personal data in certain circumstances
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Object: Object to processing based on legitimate interests or for direct marketing
• Right to Lodge a Complaint: Contact the Swiss Federal Data Protection and Information Commissioner (FDPIC) or your local data protection authority

To exercise these rights, please contact us using the information provided below. We will respond within one month of receiving your request.

8. Data Security

We implement appropriate technical and organizational measures to protect your personal data:

• Encryption of data in transit and at rest
• Access controls and authentication mechanisms
• Regular security monitoring and vulnerability assessments
• Staff training on data protection and security procedures

While we implement strong security measures, no method of transmission or storage is 100% secure. We continuously review and improve our security practices.

9. Contact Information

For questions about this Privacy Policy or to exercise your data protection rights, please contact:

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will:

• Notify you of material changes via email or platform notification
• Post the updated policy on our website with a new 'Last Updated' date
• Encourage you to review this policy periodically
• Obtain your consent for material changes that affect how we process your personal data, where required by law