Privacy Policy

1. LEGAL INFORMATION RELATING TO DATA PROTECTION

Cleanwatts (the “Company”) is dedicated to complying with the General Data Protection Regulation (GDPR) and the relevant Portuguese Data Protection Law (Lei n.º 58/2019). We prioritize the privacy and security of your personal data, adhering to the highest standards of protection. We understand that your trust is essential, so we will only use your personal data for clearly defined purposes and in line with your data protection rights. Your safety is our priority, and we are committed to maintaining the highest privacy standards.

However, as no method of transmission or electronic data storage is 100% secure, we count on your attention to prevent any incidents related to computer fraud, risks or any other infraction in which your information can be accessed or disclosed without our expressed authorization and for which, of course, we cannot be held responsible.

We are committed to ensuring the transparency, confidentiality and integrity of your personal data.

2. Who is responsible for the processing of your personal data

Cleanwatts, the data controller, is responsible for the processing of the personal data of its customers and / or potential customers as well as its suppliers and/or potential suppliers, whose personal data the Company collects on the legal grounds described in section 5.

This policy is intended to describe the use of your personal data by the employees of the Company and any third party the Company shares the personal data with.

Please refer to section 10 for the Company’s contacts.

3. Why do we collect your personal data

Your personal data will be collected and processed in situations and scenarios described in section 5. When you share personal data with us by establishing and/or maintaining business with us or by simply contacting us whether as part of exploring business opportunities, signing any contract, opening an on-line customer account when starting using our products or services; or otherwise (for example, if you are a job applicant, sharing your curriculum vitae, salary expectations and other person data with us) we consider that you have carefully reviewed and accepted this Privacy Policy.

For your privacy, we advise you not to include sensitive and / or confidential data in the emails you send us, such as credit card numbers.

We do not knowingly collect personal data from minors. In your capacity of legal guardian, we thank you for not allowing your children, under the age of 13, to send us their personal data.

4. For what purposes can your personal data be processed

Your personal data will be collected and otherwise processed for (i) complying with our contractual obligations, (ii) performing our legal obligations, (iii) protecting our legitimate interests, (iv) providing services to our customer (orders, transactions on paper or online (see also section 9), (v) marketing activities (communication of information about our campaigns, news and other services, Company newsletters, requests for comment on the satisfaction of our products and services), and (vi) if you are a job applicant, for our recruitment and staffing activities. Under the data protection legislation in force in Portugal and in the European Union (General Data Protection Regulation), the use of personal data must be justified under at least one legal basis for the processing of personal data, as described in section 5.

5. Legal basis for the processing of personal data

We process your personal data under the following legal basis:

When you have given us your express consent;
When processing is required to conclude a contract with you or to execute it;
When the processing is necessary for the compliance with the legal obligations to which the Company is subject;

6. What personal data can be collected

The following categories of personal data may be collected through the channels and services described in this Privacy Policy:

Data collected by the company:

Name

Company & business sector

Phone

Address

NIF (VAT ID, if applicable)

Data generated while you use our products or services

Cookies while you visit our website (please see section 9)

7. How do we keep your personal data safe

We use a variety of security measures, including encryption and authentication tools such as passwords, to help protect and maintain the security, integrity, and availability of your personal data.

Although data transmission via the internet or website cannot guarantee complete security against intrusions, the Company and its service providers and suppliers, business partners, consultants and advisors make reasonable every effort to implement and maintain physical, electronic, and procedural safeguards to protect your personal data in accordance with the applicable data protection requirements. Among others, we have implemented the following:

Restricted personal access to your personal data based on the criterion of "need to know" and only within the scope of the purposes communicated;
Only our employees, service providers, business partners, consultants and advisors whose functions and/or tasks require this and who previously bind themselves to secrecy, GDPR-compliance and confidentiality will have access to the personal data processed by the Company;
Processing only personal data that are appropriate, relevant and not excessive and for the time strictly necessary will be processed;
Transfer of data collected only in encrypted form or with password protection;
Storage of highly confidential data (such as credit card information) only in encrypted form;
Protection of information technology systems through firewalls, to prevent unauthorized access to your personal data; and
Continuous monitoring of access to information technology systems to prevent, detect and prevent the misuse of your personal data.

8. How long we keep your personal data

We store your personal data only for as long as it is necessary to fulfil the purposes for which it was collected or until you have revoked your consent, when applicable. Users may request the deletion of their data at any time, and we will respond to such requests in accordance with applicable laws.

Once the maximum period of conservation has been reached, your personal data will be irrevocably anonymized (anonymized data may be retained) or destroyed in a secure manner.

For the purposes described in this Privacy Policy, your personal data will be kept for a maximum period of 10 years from the last transaction or exchange with Cleanwatts, justified by legal obligations related to [specific reasons, e.g., tax compliance]. In the case of curricula vitae sent to us when applying for jobs posted on our website, we will retain them for a maximum term of 5 years, allowing us to consider candidates for future positions. Personal data processed for marketing purposes will be retained until you revoke your consent or request the erasure of such data. We will regularly review our data retention practices to ensure compliance with applicable regulations.

9. With whom we can share your personal data and how we keep you safe

The Company does not sell, market or transfer your personal data to third parties.

We may share your personal data with trusted third parties who assist us in managing our operations, provided they are contractually obligated to maintain confidentiality and comply with GDPR. The types of third parties include service providers, business partners, and affiliates.

Therefore the first statement does not include trusted third parties who help us manage or host our website or mobile applications by providing services to our customers, suppliers, business partners, consultants and advisors who need-to-know about the personal data processed by us, provided such third parties contractually agree to keep such data confidential to the level that guarantees GDPR-compliance.

We may also share your personal data with Cleanwatts’ group member companies.

Please note that although you may find yourself on a website of the Company, you may also be referred to third-party website links, as we may include or offer third-party products or services on our platforms. These third-party websites have their own privacy policies independent of ours. These policies are neither managed nor controlled by the Company, which therefore does not undertake any responsibility for them. However, we seek to protect you from risks even in such cases, therefore we recommend that you carefully read the terms and conditions and privacy policies of these sites before submitting any information or personal data.

10. Cleanwatts Contact Details

Email: decarbonize@cleanwatts.energy

Office: Rua Pedro Nunes, Edificio D, sala 2.07, 3030-199 Coimbra, Portugal

11. Data Protection Officer

In view of the legal obligation arising from Article 12(2)(h) of the GDPR, Cleanwatts has appointed a Data Protection Officer, who is responsible for ensuring, among other things, that the processing and protection of personal data under his/her responsibility complies with the applicable legislation and this Policy. Among other duties, they are responsible for:

Monitor compliance of data processing with applicable standards;
To act as a point of contact for clarifying issues relating to data processing;
Cooperate with the CNPD, in its capacity as supervisory authority;
Providing information and advising SPAPPE or subcontractors on their obligations in the field of privacy and data protection.

Therefore, the holders of personal data, if they so wish, can address a communication to the Data Protection Officer regarding matters related to the processing of personal data, using the following email address: dpo@cleanwatts.energy.

12. Your data protection rights

Subject to certain conditions, you may also exercise your rights of access to your personal data, rectification or erasure of such personal data, restriction of the processing or to object to the processing of your data, as well as the right to data portability.:

Your exercise of these rights is subject to certain exceptions intended to safeguard the public interest (prevention or detection of crimes) or our legitimate interest (see section 5).

If you exercise any of these rights, we will analyze your request and respond within 30 days.

If you are dissatisfied with our use of your personal data or with our response after exercising any of these rights, you have the right to submit a complaint to the supervisory authority - National Data Protection Commission - CNPD | Rua de São Bento, nº 148, 3º, 1200-821 Lisbon | Tel: +351 213928400 | Fax: +351 213976832 | e-mail: geral@cnpd.pt).

Coimbra, February 27^th, 2025