Data-processing addendum
Your customers' data, processed for you
When your company subscribes, it enters personal data about its own customers and staff. For that data your company decides why and how it is used; we only process it so the tool works for you. This addendum forms part of the Terms of Use.
Last updated Oct 31, 2026.
The parties and their roles
The controller is the subscribing organisation, the company that registered and pays for the service. The processor is Power & Sun (“we”). For our own records about the subscriber — its users, its plan and its invoices — we are the controller, as the privacy notice explains.
What is processed
| Whose data | The subscriber's customers and their contacts; the subscriber's own staff who use the tool. |
|---|---|
| What data | Names, job titles, email addresses, phone numbers, site addresses and locations, electricity bills and consumption, tariffs, photographs and documents uploaded, and notes of calls, meetings and site visits. |
| What we do with it | Store it, show it to the subscriber's users, calculate designs from it, and produce the proposals, reports and files they ask for. |
| For how long | While the subscription runs, and for 90 days after it ends, as set out below. |
We do not process special categories of personal data, and the subscriber should not enter any.
What we commit to
- Only on your instructions. We process the data only to provide the service as the subscriber uses it, and as these terms describe. We do not sell it, use it for advertising, or use it to train any model.
- Confidentiality. Only people who need access to run and support the service have it, and they are bound to keep it confidential.
- Security. Traffic is encrypted in transit; passwords are hashed; each organisation's records are kept apart from every other's; administrators must use two-factor sign-in; access inside an organisation follows each person's role; and backups are kept so data can be restored.
- Separation. No other subscriber can see your records. Shared equipment catalogue entries contain no personal data.
- Helping with requests. If one of your customers asks to see, correct or delete their data, the tool lets your users do it; we will help where it cannot.
- Breaches. If we become aware of a breach affecting your data, we tell your organisation's administrator without undue delay, with what we know and what we are doing about it.
- Audit. We will answer reasonable written questions about how we meet this addendum.
Sub-processors
We use these services to provide the tool. Each receives only what is described.
| Service | What it receives | When |
|---|---|---|
| Hetzner Online GmbH, Germany | All data held in the tool, stored on its servers on our behalf. | Always: it hosts the service. |
| PVGIS (European Commission) | The latitude and longitude of the site being estimated or designed. Nothing else — no name, no contact details, no account. | Always, unless another weather source is configured. No key is needed, and results are cached so a location is only ever sent once. |
| NASA POWER | Latitude and longitude only. | Only where PVGIS returns nothing for the location. |
We tell subscribers before adding a sub-processor that receives personal data, so they can object. Where a sub-processor is outside the country the data came from, we rely on the safeguards the applicable law provides for such transfers.
At the end of the subscription
The subscriber can download its records at any time. After a subscription ends or an organisation is closed we keep its data for 90 days, so it can be restored or exported on request, and then delete it, except where the law requires us to keep records such as invoices for longer. Backups are overwritten in their normal cycle.
Questions
Write to [email protected].