Privacy Policy

Data Controller

The data controller responsible for your personal data is:

Data We Collect

We collect personal data only when you voluntarily provide it through our contact form or direct communication. This may include:

• Full name and company name
• Email address and phone number
• Technical site details (grid connection type, available capacity, voltage level)
• Correspondence and enquiry content
• Technical data from website visits (IP address, browser type, pages visited) via cookies

We do not collect sensitive personal data (special categories under GDPR Art. 9) and do not knowingly collect data from persons under 18.

Purpose & Legal Basis

We process your personal data for the following purposes:

• Site assessment & commercial proposals — to evaluate your site and prepare a binding offer (legal basis: pre-contractual measures, Art. 6(1)(b) GDPR)
• Contract performance — to fulfil our obligations under partnership agreements (Art. 6(1)(b))
• Legitimate interests — to respond to enquiries, improve our services, and maintain business records (Art. 6(1)(f))
• Legal obligations — to comply with Estonian and EU regulatory requirements as a licensed BSP (Art. 6(1)(c))
• Consent — for marketing communications, where you have explicitly opted in (Art. 6(1)(a))

Retention

We retain personal data only for as long as necessary for the stated purpose:

• Enquiry and assessment data: up to 2 years if no contract is concluded
• Contract-related data: 7 years following contract termination (Estonian Accounting Act)
• Marketing consent records: until consent is withdrawn
• Website cookies: as specified in our Cookie Policy (typically 1–12 months)

Sharing Your Data

We do not sell personal data. We may share data with:

• Service providers — hosting, IT, and CRM vendors bound by data processing agreements
• Elering AS — Estonia's transmission system operator, as required for BSP licensing and market participation
• Nord Pool — for energy market settlement purposes
• Legal authorities — where required by applicable law or court order

All third-party processors are required to handle data in accordance with GDPR and our data processing agreements.

International Transfers

Your data is primarily processed within the European Economic Area (EEA). If any data is transferred outside the EEA (e.g., via cloud service providers), we ensure appropriate safeguards are in place — including Standard Contractual Clauses approved by the European Commission (Art. 46 GDPR).

Your Rights

Under GDPR, you have the following rights regarding your personal data:

• Access — obtain a copy of the data we hold about you
• Rectification — request correction of inaccurate data
• Erasure — request deletion, subject to legal retention obligations
• Restriction — request limited processing in certain circumstances
• Portability — receive your data in a structured, machine-readable format
• Objection — object to processing based on legitimate interests or direct marketing
• Withdraw consent — at any time, without affecting prior processing

To exercise any of these rights, contact us at info@ispenergy.eu. We will respond within 30 days. You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate (www.aki.ee).

Cookies

Our website uses cookies to ensure functionality and analyse usage. Cookie categories:

• Strictly necessary — required for the website to function; no consent required
• Analytics — help us understand how visitors use the site (e.g., visit counts, page views); require consent
• Preference — remember your settings such as language; require consent

You can manage or withdraw cookie consent at any time via your browser settings or our cookie banner.

Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction — including encrypted connections (TLS), access controls, and regular security reviews. In the event of a data breach affecting your rights, we will notify the relevant supervisory authority within 72 hours and inform affected individuals without undue delay.

Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or applicable law. The updated version will be published on this page with a revised "Last updated" date. For material changes, we will notify active partners by email.

Contact

For any questions about this Privacy Policy or your personal data, please contact us: