1. Who processes your data
The controller of your personal data is [Фирмено наименование], company ID (ЕИК) [ЕИК], registered address [Registered address], e-mail [имейл], phone [телефон] (“we”).
Data protection officer: [name and contact details, if appointed].
This policy covers the website, its forms and the TokPirate service.
2. Data we collect
- Contact and onboarding data – name, e-mail, phone, company, number and brands of inverters, chosen plan and the content of your messages.
- Account data – users, settings, minimum prices and thresholds, a log of actions in the app.
- Inverter cloud access data – usernames, passwords, API keys or tokens you provide so that we can control your plant.
- Plant telemetry – production, power, inverter and string status, events and curtailments, [location and installed capacity]. This data is generally not personal, but it can be where the plant belongs to an individual.
- Billing data – company name, company ID and VAT number, address, payment details.
- Technical data – IP address, browser type, date and time of requests in server logs.
We do not collect special categories of personal data and we do not use tracking cookies (see our Cookie policy).
3. Purposes and legal bases
We process data only for the following purposes and on the following bases under Art. 6(1) GDPR:
| Purpose | Data | Legal basis |
|---|---|---|
| Replying to a contact form enquiry | Contact data, message | Point (b) – steps prior to a contract, or point (f) – legitimate interest in replying |
| Free trial and provision of the service | Onboarding, account, cloud access, telemetry | Point (b) – performance of a contract |
| Sending schedules to your trader | Telemetry, forecasts, plant data | Point (b) – performance of a contract, on your instruction |
| Invoicing and accounting | Billing data | Point (c) – legal obligation |
| Security and abuse prevention | Technical data | Point (f) – legitimate interest |
| Product news [if sent] | Point (a) – consent, which you can withdraw at any time |
4. How long we keep data
- Enquiries that did not lead to a contract – [period] after the last correspondence.
- Account data and telemetry – for the term of the contract and [period] after it ends.
- Inverter cloud access data – until access is revoked or the contract ends; then deleted within [period].
- Accounting records – for the periods required by the Bulgarian Accountancy Act and tax legislation.
- Server logs – [period].
5. Who we share data with
- Processors that provide services to us under contract and only on our instructions: [hosting provider], [e-mail service provider], [invoicing and payment system].
- Your trader or balancing group coordinator – receives your plant’s schedules on your instruction.
- Inverter manufacturers – through their clouds, which we access on your behalf. They process data as independent controllers under their own policies.
- Public authorities – where required by law.
We do not sell personal data or use it for advertising.
6. Transfers outside the EEA
[If data is transferred outside the European Economic Area, name the recipients and the safeguard used, e.g. an adequacy decision or standard contractual clauses. If not: “We process data within the EEA.”]
7. How we protect data
We apply appropriate technical and organisational measures: encrypted connections (HTTPS), [encryption of cloud access credentials], need-to-know staff access, [backups]. In the event of a personal data breach, we notify the Bulgarian supervisory authority (CPDP, КЗЛД) and affected individuals within the deadlines set by the GDPR.
8. Your rights
You have the right to:
- access your data (Art. 15 GDPR);
- rectification (Art. 16);
- erasure (Art. 17);
- restriction of processing (Art. 18);
- data portability (Art. 20);
- object to processing based on legitimate interest (Art. 21);
- withdraw consent at any time, without affecting the lawfulness of processing before withdrawal (Art. 7(3)).
To exercise your rights, e-mail us at [имейл]. We reply without undue delay and in any event within one month of receiving the request; this may be extended in the cases set out in Art. 12(3) GDPR.
We do not take decisions based solely on automated processing that produce legal effects for you as an individual. Automated control of your plant follows rules that you set.
9. Right to complain
If you believe we process your data unlawfully, you can lodge a complaint with the Bulgarian supervisory authority, the Commission for Personal Data Protection (CPDP, КЗЛД): 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, Bulgaria, www.cpdp.bg. You may also complain to the supervisory authority in the EU country where you live or work.
We would appreciate the chance to help first – just write to us.
10. Cookies
The website does not use tracking or advertising cookies. See our Cookie policy for details.
11. Changes to this policy
We will notify you of material changes by e-mail or with a notice on the website. The date of the last update is shown at the top of this page.