Personal Data Protection

Otovo takes personal data protection seriously and we do what we can to provide insight into how we use and process personal data. In this privacy policy you will find information on how we collect and process your personal data through your use of Otovo’s website and/or Otovo’s application (collectively the “Platform”).

Who is the data controller?

Otovo Limited, a company registered in England with number 14031127, whose registered office is at 167-169 Great Portland street, 5th Floor, London, W1W 5PF (“Otovo”), is the data controller of the data collected through the Platform.

Purposes and legal basis for processing

All the personal data collected through the Platform may be processed on following legal basis:

• Contract: This covers carrying out our contractual duties and exercising our contractual responsibilities, as well as our need to estimate the solar potential at an address, for the purpose of entering into a contract with you regarding purchase and/or subscription of domestic solar and/or battery energy storage installation(s) (and any related installation services) (the “Agreement”).
• Consent: You have given specific consent to processing your data. Generally we rely on consent as a legal basis for processing your personal data to send emails concerning the estimated solar potential at your relevant address, and personalised communication on subsidies, product benefits, special offers and Otovo’s other products and services. You have the right to withdraw consent to us sending you this information at any time by sending an email to privacy@otovo.com.
• Legal obligation: Processing necessary to comply with our legal and regulatory obligations.
• Legitimate Interests: Processing necessary for our or a third party’s legitimate interests. Your data will not be processed on this basis if our or a third party’s interests are overridden by your own interests, rights and freedoms.

Personal data we process about you

When you check the solar potential of your roof, we collect data about your home, including but not limited to the address, and your email if you have provided your consent for this purpose. We may also ask for additional data in order to calculate an estimate of your electricity consumption for the purpose of providing adapted installations sizes. The purpose is to be able to provide an estimate for the installation of solar cells on your roof, as well as to manage your customer relationship and to complete the delivery. The email address is used to communicate with you in the form of personal follow-up, newsletters and any other communication on Otovo’s products and services that you may be interested in. If you do not wish to receive newsletters, you may opt out here.

We collect and store data about the address for which you are estimating the solar potential, including, but not limited to azimuth, slope of your roof, area and roof height, in order to make an estimate of the energy potential from solar cells on your roof, as well as a price calculation. We save this information for analysis, so that we can make calculations better in the future.

If you would like to proceed with an estimate, we will ask for your name, phone number and email address so that we can contact you to clarify any doubt and, if appropriate, send you a formal offer. All the information requested is necessary for entering into the Agreement. If you fail, or refuse, to provide this information, Otovo will not be able to enter into a contract with you.

If you accept the offer, we may send your name, telephone number and the contractual document to one of our partners for digital signatures, such as Scrive, who will act as a data processor.

In the case where this information is required, we may also ask for a personal identifying number such as your National Insurance number. If so, the purpose will be to complete applications where this information is necessary and/or to perform a credit check of you to evaluate your creditworthiness and ability to fulfil your obligations under the Agreement. Your personal ID number will be stored encrypted.

If you apply for a loan agreement, we will ask you to input data required to perform an affordability check and a creditworthiness assessment. The data we ask will include, but not be limited to marital status, employment status, number of dependents, income and expenditure numbers, and bank details.

How long will we retain your personal data?

The period that we will retain your personal data depends on the purpose for which it was obtained. If your data is used for several purposes requiring different retention periods we will apply the longest one.

Personal data processed on the basis of your consent, will be retained until you withdraw your consent, or request the erasure or objection of your data.

Personal data processed for the performance of the Agreement, will be retained during the whole relevant contractual relationship.

Personal data processed under Otovo’s legitimate interests, will be retained as long as Otovo needs to comply/achieve them.

Once these periods have ended or your request to erase your personal data has been fulfilled, we will only retain your personal data duly blocked for the periods required by law. This means they may not be processed, for any other purpose than to make it available to courts or competent public authorities, to comply with any liability arising from the processing and only during its limitation period. Once this period has expired, the data will be destroyed.

With whom can we share your personal data?

We may share your information with data processors in the field of energy consumption in order to ask for your electricity consumption for the purpose of providing adapted installations sizes.

After Otovo has planned your installation in detail, we share your contact information, address and project data with our installer.

When connecting your installation to the electrical grid, we share your contact information and information about the solar panel installation with your electrical grid owner.

Once the installation is operational and connected to the network, production data from your inverter will be shared with the manufacturer of the inverter for analysis and potential troubleshooting. The data we share may include information about your residential energy use.

The production data from the installation will also be collected by Otovo. This information is used for analysis and potential troubleshooting. The data serves as the basis for the statistics found on My Page and in the Otovo apps.

Otovo may use production data associated with addresses to improve calculation models, both internally and in collaboration with other entities in the solar power industry, and share these publically. When sharing the data, it will be rendered anonymous to the greatest extent possible, but location is an important element in the analysis of production data.

Your personal data may be shared with data processors providing services to Otovo. Otovo will ensure that all of them comply with the current data protection legislation by signing a data processing agreement pursuant to art. 28 of the General Data Protection Regulation.

We may share your personal data, including your personal ID number, with credit reference agencies. In these cases we will supply your personal information to credit reference agencies, who will give us information about you, such as your financial history. The Credit Reference Agency Information Notice (‘CRAIN’) describes how our credit reference agency, TransUnion, operates and handles personal data. The CRAIN can be found on TransUnion’s website here.

We use OpenAI to enhance our services and user experience. We may share personal data, such as name and contact information, with OpenAI for service provision and improvement. OpenAI protects your personal data and complies with data protection laws. For more details, visit their Privacy Policy.

We use Google service and Google Advertising service, notably to serve you personalised and non-personalised ads, provided that you accept targeting cookies and scripts. We may share personal data, such as name, email and phone number, with Google. This allows us to better target our ads. To learn more about how Google uses your data, please refer to Google’s Privacy & Terms site.

We may share personal data where it is otherwise allowed under the law where necessary to protect our or a third party’s legitimate interests, where required to comply with our obligations to regulators or law enforcement agencies or where we have obtained your prior consent to do so.

Otovo is committed to enhancing our services and offerings through strategic partnerships and collaborations. These initiatives may involve the limited sharing of your personal data, strictly for purposes that align with our legitimate interests and aim to enhance your experience. Below are specific use cases illustrating how and why we might share personal data:

Referral Partners: We share data with referral partners to calculate fees and improve the effectiveness of their marketing strategies. The sharing of data is exclusively limited to customers who have originated from the respective referral partner's environment. Our legitimate interest lies in ensuring fair compensation and enhancing business efficiency. This approach allows referral partners to offer tailored experiences, enriching the customer experience and providing specific benefits to new Otovo customers.

Sales Partners: Our engagement with sales partners involves sharing personal data for the following reasons:

• To fulfil Otovo's obligations under customer contracts, ensuring we meet our service commitments.
• To leverage the specialised capabilities of our sales partners in serving a wide array of customer needs, ensuring that all individuals interested in solar solutions receive the best and most suitable service.
• Customer Preference: addressing customers' preference for face-to-face engagement and direct interactions that sales partners can provide.
• Geographic Coverage: Sale partners may have strong coverage in certain areas, enhancing the accessibility of our services to a broader audience.

These activities are driven by our legitimate interest in improving service quality, business efficiency, and customer satisfaction. Please be aware that you have the right to opt out of having your information shared and processed by Otovo's partners at any time.

Chat and email

When you communicate with us via email at one of our support or sales email addresses, or the web chat feature at the website, the exchange of messages is saved so that we can best serve you over time. Both chat messages and emails are saved in Hubspot.

We currently use MailChimp for sending out our newsletter. In connection with this, your email address will be saved together with information like which product you showed interest in and what region you live in. If you opt out of the newsletter, the service will still have your email address in its system to prevent you from becoming re-enrolled. Any other data will be deleted.

These companies act as data processors.

Error Tracking

In order to be able to improve our software, we log exceptions and errors that occur on our website, and on the apps. These error events, along with data associated with the state the system was in when it failed, are collected by an external service. We currently use Sentry for this. The information is stored for 90 days.

Data Storage and Back-Up Systems

The website and Otovo apps use several Otovo services on the back end. These services run exclusively in the cloud and therefore use multiple third party systems. Servers, databases and data storage provided by Amazon and Heroku, which is a service provider on top of the Amazon platform, owned by Salesforce. We use data centres in Europe, if possible, primarily in Ireland and Germany.

Automatic SMS and emails

We use Mailgun for sending out automatic emails, and Twilio for both emails and SMS. For example, this could be information on changes regarding the installation, etc. The services store metadata for tracking and troubleshooting.

Internal communications

For internal communications we use Slack. Our back-end systems send updates to this service in connection with events related to customer behaviour. Among other things, these updates may contain name, address and contact information.

For email and file storage we use Google G Suite. See “Password Routines” below, for how we manage access to these services.

The above mentioned companies act as data processors.

Access To Sensitive Data

Where our systems handle sensitive data, these are only accessible to Otovo’s developers and other employees with a justified need for access. Encryption codes, which among other things are used for the storage of sensitive data, are only accessible to Otovo’s developers. All machines used in development, and that may have copies of data from production systems, have an encrypted file system.

All data communication with external partners is encrypted.

Password Routines

All Otovo employees are required to use two-factor authentication when logging in to Otovo’s systems, as well as password-protected telephones and devices. All external collaboration partners (installers, etc.) who have access to Otovo’s systems use personal accounts with access only to relevant parts of the system.

Your Rights

You may request us at any time for access, copy, rectification, restriction or deletion of the personal data we store about you, such request should be addressed to Otovo by written request to our business address or by email to privacy@otovo.com, providing some proof of your identity (e.g. a photocopy of your ID card or passport). Under certain circumstances you may also object to processing as well as exercise your right to data portability.

Changes To The Privacy Protection Declaration

We will keep your privacy protection declaration updated as the service offer changes. At the top of the page, you will find a date stamp for when we last updated the content. If we make any major changes that affect registered customers, you will be notified of this by email.

You have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK regulator for data protection issues ( www.ico.org.uk). Otovo has its own privacy representative who can be contacted by emailing privacy@otovo.com.