OVERVIEW

The Pinergy cookie policy applies to anyone who visits our website. It explains what cookies are, how we collect
data from you, how we use that information and how you can control your cookies.

WHAT ARE COOKIES AND WHY DO WE USE THEM?

Like many companies, we use ‘cookie’ technology on our website. Cookies are small pieces of text which are
stored on your computer or other devices by your web browser. Each cookie will contain anonymous information
will allows them to recognise repeat users, store registration data, facilitate access to and use of the
website. Using cookies on our website allows us to understand how you use the site, so we can improve your
experience through layout, navigation, content, and relevant advertising. There are four different types of
cookies that we use:

• Strictly necessary cookies

These are essential cookies which allow you to navigate our website properly, giving you access to all the
features and functions of the site.

• Performance cookies

We use these cookies to collect information about how visitors use our site. We use this information to compile
reports and to help us improve the site. The cookies collect information in an anonymous form, including the
number of visitors, where visitors come from and the pages they visited, for example in Google Analytics.

• Functionality cookies

These cookies allow us to remember the individual choices you made while visiting our website and helps us to
enhance your user experience, for example your location settings, login details etc.

• Advertising cookies

These cookies are anonymous and they help us collect information on our advertising campaigns. This in turn
allows us to make our ads more relevant to our website users. This means you should generally only see ads
relating to your personal interests and you won’t constantly see the same ones.

Controlling Cookies

You can choose to accept or decline cookies. If you don’t want us to use cookies in your browser, you can:

• Remove cookies from your hard drive.

• Set your browser to block cookies.

• Set your browser to send you a warning notice before a cookie is stored on your computer.

But remember that you might not be able to make the most of our website (or other websites) without cookies –
some functions need cookies to work. Turning off cookies is not permanent. You can also go into your settings to
change them back so that you can use all functions of our website.

Data Protection Notice  – Promotional Referrals

 

If you provide your details to us to share with our trusted partner, we will provide your personal data to them
for the sole purpose of them contacting you about this promotional offer.

The personal data you provide

As part of this process you provide us with your name and contact details (email address or mobile phone number)
and your preferred mode of contact (email, SMS, or phone call).

How we will process your details

We will process the information you provide for the following purposes:

How our partners will process your details

Your personal data will be shared with our partners for the following purposes:

Any further processing of your personal data by our partners for their own purposes is subject to their own
terms, conditions, and data protection compliance policies.

How long we will keep your data

Pinergy will retain the detailed record of your expression of interest for 6 months for reporting purposes and
to allow us to follow up on any customer service issues arising from this promotion.

We encourage our partners to retain your data only for as long as they need it for the purpose of this
promotional activity. However, they may have other processing purposes or policies relating to the processing of
your data which may require them to keep your data for a longer period. Please check with them directly if you
have queries in respect of data retention.

Your rights in respect of your data

You retain your data protection rights in respect of this data. This includes your Right of Access to personal
data processed relating to you, your Right to Object to Processing (to Opt-Out), and other rights under GDPR.

You also have the right to complain to the Data Protection Commission (www.dataprotection.ie) in the event that
your data protection rights are infringed.

Pinergy Solar

Who We Are

Rookery Consulting Ltd t/a Solar Electric is a company limited by shares and registered in the Republic of
Ireland and is part of the group of companies of New Measured Power Limited (t/a Pinergy)

Contact Us

You can contact us at our main business address: Killanne, Rathnure, Enniscorthy, Co.Wexford, Ireland, Y21 W523.

Our Data Protection Officer is the Pinergy Data Protection Officer operating on a shared service basis. Our Data
Protection Officer can be contacted via dataprotection@pinergy.ie

Our Values

We believe that helping our customers to reduce their electricity bills by using solar will help them to
optimise their energy use, reduce waste and treat energy as a resource, not a commodity. We are also aware that
data needs to be handled securely and transparently. We believe you should own your own data and should have the
choice about who has access to your data or who you consent to view the data. Solar Electric recognises that the
protection of the personal data of our customers, through appropriate processes, controls, and discretion, is an
essential element of our brand. This Data Protection Notice explains how we collect, transfer, store, and use
your data.

As part of our ethos of continuous improvement, this Data Protection Notice and any associated policies or
procedures may be changed in the future. If we make changes, we will provide notice of any proposed changes at
least thirty (30) days before they come into effect.

What We Do

The mission of Solar Electric is…..

How Do We Obtain Your Personal Data?

When you use our products or services and apps, we collect information about you.  This information can be
manually entered by you or be collected automatically from your smartphone and/or device. Other information may
come from third parties.

Summary:

We obtain your personal data in one or more of the following ways:

• You directly provide it to us by filling forms when you enquire with us about our
  products and services; when you ask us to provide you with a product or service.
• You authorise a third party to provide it to us (example
• We automatically record it from your device, when you use our products or services.

Categories of Personal Data We Process

The specific types of personal data we process about you may vary depending on the specific product or service
you are using. Examples or descriptions of categories of data provided here are not exhaustive and are for
information purposes. Supplemental information will be provided to users for specific contexts where necessary.

 

In addition, photographs are taken of the installation location as part of site surveys and of all electrical
work completed as required by the SEAI grants processes, for safety certification of works, and for insurance
purposes. These are retained for the lifetime of the installation.

 

How Do We Use Your Data (and our Legal Basis for Processing)

Categories of Data Processors

Solar Electric makes use of several different categories of data processor to help us deliver our services.

Joint Controller Relationship

Solar Electric has entered into a Joint Controller relationship with Pinergy (www.pinergy.ie) . Under this
arrangement, Pinergy provide a range of back office and administration supports to Solar Electric. Both firms
engage in cross-sale and bundled sales activities of each other’s related products or services where it is
beneficial to our customers.

Under this Joint Controller Agreement, customer information is shared between the two organisations where
necessary for these purposes.

Categories of Recipients

Solar Electric will provide personal data to the following categories of recipient:

• To law enforcement agencies or regulatory authorities on receipt of a valid court order or where
  expressly required under legislation and only to the extent required by law.
• To third parties where necessary to comply with a court order
• In the event of a corporate sale, merger, reorganisation, sale of assets, dissolution, or other
  business-related event, your information may be transferred as part of the assets.

In addition, solar panel installations that include a MyEnergi hub will relay statistical data about energy
consumption and generation capacity to MyEnergi for reporting to you via the app or their website when you
register a user profile.

How Long Do We Keep Your Data?

Solar Electric retains identifiable data for the duration of your use of our service or use of the application
plus any retention period that may be defined by:

• Legal requirements set out in legislation or regulatory guidance in jurisdictions in which our services
  are provided
• Periods that are reasonably necessary for business and legal purposes.

We will also keep data which cannot directly or indirectly identify living individuals for analytics and
research purposes to help improve our products and services.

Keeping Your Data Safe and Secure

We place great importance on the security of all personal data associated with our customers. We have security
measures in place to attempt to protect against the loss, misuse and alteration of personal information under
our control.

Periodic reviews of our security standards are carried out and our software development process has a checkpoint
to identify and new risks when we define / develop new features.

However, with any electronic transmission and storage of data comes risks and we cannot guarantee that our
databases, or those of our third-party affiliates, will be 100% secure. There is also a risk of data being
intercepted while being transferred over the internet.

In the event of a breach of data security, Solar Electric will:

• Where we are acting as a Data Controller, we will notify without undue delay the relevant Supervisory
  Authority where we identify that there is a risk to the fundamental rights and freedoms of people using
  our applications or services
• Where we are acting as a Data Controller, and we identify a high risk to your rights and freedoms we
  will notify you of the incident without undue delay.

Cross-border Data Transfers

Third party service providers contracted by Solar hold personal data in secure data centres inside the EEA.
Where data is transferred outside the EU/EEA, such transfers are carried out on the basis of either:

• Standard Contractual Clauses, or
• An adequacy decision of the European Commission.

In addition, registering user profiles for certain applications provided by equipment providers for certain
products may necessitate transfer of your personal data to the UK or other jurisdictions outside the EU/EEA with
different data protection regimes to that which applies in Ireland or the EU.

In such cases, your registration for the app may be necessary for the provision of service to you by the
equipment provider. They may also require registration of your equipment for warranty or after-sales support
purposes.

We regularly review our providers and the basis for any transfers of personal data outside the EEA.

 

Your Rights under GDPR

Where Solar Electric is acting as a Data Controller, you have rights under EU Data Protection law.  These rights
are:

• A right of access which allows you to request a copy of your data in an intelligible form (Article 15
  GDPR)
• A right of rectification which allows you to request a correction of errors or inaccuracies in the data
  that we hold relating to you (Article 16 GDPR)
• A right to object to processing and to “opt-out” of having your data processed by us on the basis of our
  legitimate interests or a public interest basis unless we can demonstrate compelling legitimate grounds
  that over-ride your interests, rights, and freedoms. (Article 21 GDPR)
• A right to erasure in certain specified circumstances. This right does not apply where we are processing
  data for compliance with a legal obligation, for reasons of public interest in relation to public
  health, for archiving purposes for historical or scientific research, or where necessary to establish or
  defend legal claims (Article 17)
• A right to restrict processing in certain circumstances (Article 18)

Under GDPR individuals also have rights to seek compensation for infringement of their data protection rights
under the legislation.

Right to Complain to the Data Protection Commission

You have the right to file a complaint to the Data Protection Commission.

Their contact information can be found online at this link: https://dataprotection.ie/en/contact/how-contact-us

Acutrace

Who Are We?

This data protection notice provides additional information specific to Acutrace Ltd and how we process data
relating to individuals.

This should be read along side the general Data Protection Notice for all Pinergy companies.

What we do

• Acutrace provides energy consumption data analytics solutions to commercial customers
  to help them reduce costs, reduce carbon footprint, and meet reporting standards. Acutrace does not
  process data about our residential customers but may process data relating to rental properties (e.g.
  apartment buildings) owned or managed by our commercial customers.

Our purposes for processing your personal data

In general, Acutrace does not process personal data, but data we process may related to potentially identifiable
individuals if data is reported at the level of an individual address or meter point which can then be linked to
an identified or identifiable individual.

In general, we process personal data of customers or people who are identified to us as people we can contact in
relation to a customer:

Provision of Electricity Consumption Data

For commercial customers, we will process data about properties in aggregate or de-identified form to provide
energy consumption and energy efficiency statistics and reporting. This processing will, in general, not result
in the processing of identified or identifiable personal data.

Acutrace implements appropriate organisational and technical controls to ensure that data that is processed for
statistical reporting purposes is de-identified or is aggregated to mitigate against the risk of individuals
being identified from the data.

Customer Support

Acutrace will process personal data of individuals in client companies for the purposes of executing projects or
providing support on analytics services that are provided.

This data will be processed on the basis of our legitimate interest to contact customers to manage our
commercial relationship with a business customer.

Types of Personal Data Processed

Within Acutrace we process the following types of personal data.

• Customer Identity Information

Information we can use to identify you as a customer or as a person linked to a customer (e.g. a contact person
in a company who is a Commercial Customer)

This includes information like your name, your business address, your email address, or your phone number.

• Customer Electricity Consumption and Generation Data

We process data about the electricity consumption and generation for customers and prospective customers.

For prospective customers we process data about your recent and average energy consumption as part of our sales
process to help us identify the best tariffs or solutions for customers or design the most appropriate energy
system for you. This information is usually obtained from recent electricity bills you provide to us.

As part of our ongoing provision of service to customers we will process data about their consumption and
generation of electricity. This data will include volume of electricity consumed or generated at 15 or 30 minute
intervals associated to a meter point reference number.

Where do we get your personal data from?

We get your personal data from a number of sources:

• From you directly, or from someone authorised to act on your behalf

Acutrace will obtain personal data of customer contacts either directly from you or from one of the other
Pinergy companies.

• From our observations or notes during calls, review of correspondence, or customer
  visits

We will record certain data, which may include personal data, as part of calls, reviews of email or other
correspondence, or from customer site visits.

• From your use of electricity or other products and services provided by us

Your use of electricity and your use of other products or services provided by Pinergy companies will provide us
with data relating to you and your use of our products and services.

Who else do we give your data to?

Acutrace does not disclose personal data to any 3^rd parties.

In addition, the following categories of 3^rd party may receive data from us for certain purposes,
e.g. for statistical reporting or for the purposes of compliance with legal obligations. Except where it is not
possible to comply with a request without disclosing personal data, data is only provided to
3^rd parties in aggregated or anonymised or deidentified formats.

• Government Departments / Agencies
• ESB Networks
• Law Enforcement Agencies
• Researchers or Statistics Agencies

Do we transfer personal data outside the EU?

We use many computer systems and technologies to deliver services to you and to run our business. Some of these
can involve transfers of data outside the EU.

When this happens, we ensure that there is a valid legal basis in place for such transfers. Methods used include
Standard Contractual Clauses or, where necessary, relevant case by case exceptions under Article 49 of GDPR.

How long do we keep your personal data?

As the personal data that Acutrace processes relates to commercial customers and our interactions with them,
Acutrace keeps personal data of customer contacts for:

• The duration of the customer relationship plus seven years
• For seven years after we are advised a contact person has left a client organisation, after which we
  review the retention of that data.