Privacy Policy - VoltarisOS

1. Introduction

VoltarisOS ("we", "our", or "us") is committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Virtual Power Plant platform, in compliance with the General Data Protection Regulation (GDPR) and other applicable EU data protection laws.

2. Data Controller

The data controller responsible for your personal data is VoltarisOS. For any data protection inquiries, please contact us at dpo@voltarisos.com.

3. Data We Collect

We collect the following categories of personal data:

Account Data: Email address, name, company name, and password (hashed)
Usage Data: IP address, browser type, access times, and pages viewed
Energy Data: Site configurations, device readings, and consumption patterns
Trading Data: VPP bids, market transactions, and optimization decisions
Payment Data: Processed securely via Stripe; we do not store card details

4. Legal Basis for Processing

We process your personal data based on:

Contract Performance: To provide our platform services
Legitimate Interests: Platform security, fraud prevention, and service improvement
Legal Obligations: Compliance with energy sector regulations and tax requirements
Consent: For marketing communications (withdrawable at any time)

5. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this policy. Energy data is retained for up to 5 years for regulatory compliance. Account data is retained for the duration of your account plus 30 days after deletion request.

6. Your Rights (GDPR)

You have the following rights regarding your personal data:

Right of Access: Request a copy of your personal data
Right to Rectification: Correct inaccurate or incomplete data
Right to Erasure: Request deletion of your data ("right to be forgotten")
Right to Restrict Processing: Limit how we use your data
Right to Data Portability: Receive your data in a structured format
Right to Object: Object to processing based on legitimate interests
Right to Withdraw Consent: Withdraw consent at any time

To exercise these rights, please contact us at dpo@voltarisos.com.

7. Data Sharing

We do not sell your personal data. We may share data with:

Service Providers: Stripe (payments), hosting providers (infrastructure)
Energy Market Operators: When submitting VPP bids to energy markets
Regulatory Authorities: When required by law or energy regulations

8. International Transfers

Your data is primarily stored within the European Economic Area (EEA). If we transfer data outside the EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs).

9. Security Measures

We implement technical and organizational measures to protect your data, including encryption in transit (TLS 1.3) and at rest, access controls, audit logging, and regular security assessments.

10. Contact Us

For any privacy-related questions or complaints, please contact our Data Protection Officer at dpo@voltarisos.com or write to us at VoltarisOS, Data Protection, Lisbon, Portugal.