Data processing agreement

What is processed

Subject matter and purpose: storing the data you upload and computing from it the data checks, rebuilt bills, battery sizing, financial results and PDF reports you ask for.

Types of data: interval meter data, electricity bills (which can carry names, addresses, customer and connection numbers), site details such as the address, grid connection capacity and solar system, and anything else you choose to upload. Meter data can be personal data when it relates to an identifiable person, such as a sole trader or a named contact.

Data subjects: your clients and the people named in their documents.

Duration: for as long as the data stays in your account; see "At the end" below.

Our obligations

We process the data only on your documented instructions — using the app is such an instruction — unless the law requires otherwise, in which case we tell you first where the law allows it.

Everyone at Zorowatt who can access the data is bound to confidentiality, and access is limited to what running the service and support needs.

We keep the data secure: connections are encrypted (HTTPS), accounts are protected by password, passkey or e-mail sign-in with optional two-factor authentication, and backups are encrypted. [The full list of technical and organisational measures — to be attached.]

We help you answer requests from data subjects and meet your own obligations on security, breach notification and impact assessments, as far as the nature of the processing allows.

We tell you without undue delay after we become aware of a personal data breach affecting your data, with what we know about it.

We give you the information you need to show that this agreement is kept, and allow and contribute to audits by you or an auditor you mandate, with reasonable notice.

Sub-processors

You give general authorisation for the sub-processors listed in the privacy policy under "Who processes it for us". We bind each of them to the same data protection obligations, stay responsible for them, and tell you before we add or replace one, so you can object.

Where a sub-processor processes data outside the European Economic Area, it does so under the European Commission's standard contractual clauses or an equivalent safeguard.

At the end

You can delete your account at any time, and with it everything you uploaded. When you delete your account, or when the service ends, we delete the data you uploaded after 30 days (the window to restore an account deleted by mistake) unless the law requires us to keep it; it then rolls out of the backups.

Your obligations

You make sure you may share the data with us — your client agreed, or you have another legal basis — and that your instructions comply with data protection law.

Contact

Questions about this agreement, a request to sign a copy, or a breach report: [email protected].