Privacy Policy

This is an English translation of the Spanish version. If the versions differ, the Spanish version prevails.

Summary. Ahora Energio SLU (“Energio”) is the controller of your data (section 1). We process it to analyse your bills, compare them with offers from the retailers we work with and manage the switch you choose, almost always with your consent (section 3). We only use analytics or marketing cookies if you accept them. We keep data for the periods in section 6. You can access your data, correct it, erase it, object to its processing or withdraw your consent by writing to dpd@energio.es (section 7).

This Privacy Policy explains how Ahora Energio SLU (“Energio”) collects, processes and protects the personal data of people who visit the website, ask us for a comparison (leads), are clients, work with us as partners, use our apps or appear in the BORME as directors or shareholders of newly incorporated companies. Energio is the controller of that data under Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, the General Data Protection Regulation (GDPR), and Ley Orgánica 3/2018, de 5 de diciembre, de Protección de Datos Personales y garantía de los derechos digitales (LOPDGDD, the Spanish law on personal data protection and the guarantee of digital rights).

When Energio processes data on behalf of a client company as a processor, that relationship is governed by the framework agreement signed with that company and not by this Privacy Policy.

1. Controller

Company name: Ahora Energio SLU
NIF: B88686951
Registered office: Ronda del General Mitre, 126, 6th floor, 08021 Barcelona, Spain
Email: hola@energio.es
Telephone: +34 613 191 089
Website: energio.es
Data protection contact: dpd@energio.es

2. Personal data Energio processes

2.1. Website visitors

Technical data: IP address, browser and device type, pages visited (the full address, including its query string, which may contain ad click identifiers), referring page and the date and time of each visit.
Cookies and similar technologies: according to the categories in the Cookie Policy: necessary cookies and, only if you accept them, analytics and marketing cookies.
Your cookie decision: the option you choose in the cookie banner, its date, the page where you choose it, without its parameters or the part following “#”, and your browser’s user agent (section 3.4).

2.2. Leads (comparison requests)

Identification and contact: name, telephone number and email address.
Documents: energy bills (PDFs or images).
Business description: if you are a business, information about your activity.
Business questionnaire answers: postcode, number of electricity supplies for the business, business type (and its free-text description if you choose “Other”), approximate monthly electricity spending, the goals you have for the business and your chosen contact channel (WhatsApp or a call).
Savings questionnaire answers (households and small businesses): type of home or business, whether you know your annual consumption and, if so, the consumption you state, approximate floor area of the home or approximate monthly bill for the business, the estimated annual savings in euros shown to you and your chosen contact channel (WhatsApp or a call).
Attribution: how you came to Energio. If you have accepted analytics cookies: for each form you submit, the page, the referring page, campaign parameters (utm_*) and Google Analytics identifiers (_ga, _ga_HMRZNPDWRP and FPLC) and PostHog identifiers. If you have accepted marketing cookies, advertising identifiers, such as ad click identifiers, are also included; without that acceptance, they are removed and the recorded page addresses show them masked.
Consent: your consent status at the time of submission.
Meta ad forms: if you leave your details in a Meta ad form, we receive your first name, surnames and telephone number.

2.3. Clients

Identification: full name and NIF/NIE, or the legal entity’s NIF.
Contact: email address, telephone number and postal address.
Contracting data: nationality and bank account (IBAN).
Supply data: CUPS (the universal supply point code), supply point address, consumption data and current tariff information.
Billing: energy bills and information extracted from them (prices, consumption and periods).
Datadis consumption data: consumption history obtained with your authorisation (section 4.4).

2.4. Partners

Identification: name, NIF/NIE and address.
Contact: email address and telephone number.
Financial data: bank account for commission payments.
Activity: leads referred, confirmed offers and commissions.

2.5. Directors and shareholders of newly incorporated companies

For business-to-business (B2B) prospecting, we collect from the Boletín Oficial del Registro Mercantil (BORME, the Official Gazette of the Commercial Registry), a public source, the names and positions of sole or joint directors and sole shareholders of newly incorporated companies, together with the published registration and company details: company name, registered office, activity, share capital, and publication date and reference. We process them on the basis of our legitimate interest in that prospecting (section 3.5) and keep them for 12 months from import, unless the person becomes a lead. You can object at any time by writing to dpd@energio.es.

2.6. App users

Access and use: login credentials and records of use of Energio’s apps. Usage records are the security logs in section 6.
Browser security reports: when a page in our apps loads or executes something its Content Security Policy does not allow, your browser sends a report to PostHog. PostHog stores four addresses — the page, the blocked resource, the referring page and the source file — all without their query strings and with segments that look like identifiers masked; it also stores the violated and effective directives, the page’s policy and its enforcement mode, report type, line and column, status code, your browser’s user agent, receipt time and a random identifier for each report. The report uses no cookies or local storage and carries no identifier assigned to you, and we do not retain your IP address or the location derived from it. Your browser sends it regardless of your cookie decision.

2.7. Sources of data and mandatory data

We obtain data directly from you and also from partners who put you in contact with Energio, from Datadis (with your authorisation), from Meta ad forms you complete, from the BORME and from Apollo, which tells us which companies visit the website.

Fields marked as mandatory are needed to handle your request; if you do not provide them, we cannot prepare your offer.

3. Purposes of processing and legal basis

Your consent is freely given, specific, informed and unambiguous. You can withdraw it at any time (section 8.2) without affecting the lawfulness of processing before withdrawal. With your consent:

We analyse your bills and consumption.
We obtain your consumption data from Datadis.
We recommend energy tariffs and prepare your offers.
We manage your change of retailer (section 4.1).
We send you operational communications about the service before you enter into a contract; afterwards, on the basis in section 3.2.
We qualify and segment your request using your questionnaire answers. The contact channel you choose in each questionnaire is recorded with the request and shown to the sales team so they can respect it.
We send you commercial communications by telephone, SMS, WhatsApp and email if you tick the corresponding optional checkbox (art. 21 of Ley 34/2002, de 11 de julio, de servicios de la sociedad de la información y de comercio electrónico (LSSI, the Spanish law on information society services and electronic commerce), and, for calls, art. 66.1.b of Ley 11/2022, de 28 de junio, General de Telecomunicaciones, the Spanish General Telecommunications Law).
If you accept the “Analytics” category in the cookie banner: web and product analytics with PostHog and Google Analytics, including, when active, session recording with fields masked, and analysis of the request journey. This analysis records which form and questionnaire screens you go through, whether you submit or abandon them, the creation of your request and bill uploads, without the values of your answers: for the business questionnaire, we record only the number of supplies (grouped as 1, 2, 3, or 4 or more), the business type and how many goals you selected; in the savings questionnaire, the screen name reflects whether you choose a home or business and whether you know your consumption.
If you accept the “Marketing” category: advertising conversion measurement, audience creation and personalised advertising on Meta and LinkedIn, and Apollo’s identification of companies visiting the website (section 4.3).

Until you decide, or if you reject the “Analytics” and “Marketing” categories, we do not send PostHog, Google Analytics, Meta, LinkedIn or Apollo any data about your browsing, from either your browser or our servers, except for the event without identifiers about your decision (section 3.4), the download on the website of the Google Tag Manager container, which does not activate any tag until you accept its category (section 4.2), and, in the apps, the download of the PostHog tool (section 4.2) and browser security reports (section 2.6). If you withdraw your acceptance of “Marketing”, the LinkedIn tag may continue sending data until the page reloads (section 4.3). If you submit your request without having accepted “Analytics” — including when you contact us through the chatbot — we do not record any analytics event linked to it.

Operational communications about the service once you have entered into a contract.
Managing your account in the client app: your login credentials, so you can view and accept your offers, at your request before contracting (pre-contractual steps) and in performance of the contract afterwards.
Managing your account in the partners’ app: your login credentials, so you can manage your partnership with Energio.
Managing the relationship with partners.
Paying commissions to partners.

Compliance with tax, accounting and legal obligations.

Legal basis: compliance with the obligation to demonstrate consent (art. 6.1.c GDPR, read with arts. 5.2, 7.1 and 24 GDPR).

We record each consent decision — grant, refusal or withdrawal — and keep the record for the periods in section 6. For cookie banner decisions, we store the chosen option, its date, the page without its parameters or the part following “#”, and your browser’s user agent. In the apps, the stored page may include the identifier of a specific item, such as an offer, so the record can be linked to you.
For each cookie banner decision, including a rejection, we also send PostHog an event without any identifier assigned to you, to understand how many people accept or reject each category: your decision and the status of each category, the language, the banner version and variant, the page (on the website only) and, if present in the address, the campaign parameters utm_source, utm_medium and utm_campaign. It does not include your IP address or user agent, although it could potentially be linked to you through the date and page or a campaign parameter personalised for you. This is further processing compatible with the purpose of the consent record (art. 6.4 GDPR). If you accept “Analytics”, your decision is also recorded in PostHog as another analytics event, associated with your PostHog identifier.

Following a documented balancing test, we process data on the basis of our legitimate interest in:

security and technical diagnostics for the website and apps, using personal or pseudonymised data. This includes technical data for each website visit (section 2.1), which Framer processes on our behalf when hosting the site (section 4.2); data from requests your browser sends to our servers; and browser security reports (section 2.6);
retaining the evidence needed to establish, exercise or defend legal claims (art. 17.3.e GDPR), with restricted access and blocking where appropriate;
business-to-business prospecting using BORME data (section 2.5);
loading our tag manager, Google Tag Manager, on the website: your browser downloads its container from Google before you make a cookie decision, so Google receives your IP address and browser data, but the container does not activate any tag until you accept the corresponding category (section 4.2).

You can object to this processing under art. 21 GDPR (section 7).

3.6. Anonymised data

Aggregate metrics and irreversibly anonymised data are not personal data, so the GDPR does not apply to them.

4. Data recipients

We disclose personal data to the following recipients. We also disclose it to public authorities and courts where required by law.

4.1. Energy retailers

When you accept an offer, we disclose to your chosen retailer the data needed to manage the change of contract: your identification and contact data, nationality, bank account and supply point data. We do so only with your express consent, when you accept the offer.

4.2. Service providers (processors)

These providers process data on behalf of Energio, following our instructions and under a data processing agreement (art. 28 GDPR):

Amazon Web Services (AWS): cloud infrastructure and storage. Location: EU (Spain and Ireland).
Google Cloud: extraction of bill data and our server-side tagging server (eh.energio.es), which, among other things, sends to the Meta Conversions API the events your browser sends directly to it (section 4.3). Location: EU for bill extraction; EU / global for the tag manager. Safeguard: section 5.
Google Workspace: email, communications and internal management. Location: EU.
Google Analytics and Google Tag Manager: web analytics, only if you accept the “Analytics” category: browsing data, including the full page address with its query string, and identifiers _ga, _ga_HMRZNPDWRP and, through our server-side tagging server, FPID and FPLC. Google Tag Manager loads analytics and marketing tags in your browser for the categories you accept. Its container downloads before you decide: in that download Google receives the technical connection data (your IP address and browser), but no analytics or marketing tag is activated. Location: EU / U.S. Safeguard: section 5.
PostHog: product and marketing analytics, only if you accept “Analytics”; events without identifiers about cookie decisions (section 3.4); browser security reports (section 2.6); and technical and error logs from our systems, without your contact or identification data. On the website, your browser does not download the PostHog tool until you accept “Analytics”. In the apps, the tool and its configuration download from PostHog when you open them, before you decide, but do not record any events until you accept. Location: EU (Frankfurt, Germany).
Framer (Framer B.V., Netherlands): website hosting and publication; receives the technical data for each visit (section 2.1). Location: its services are hosted on AWS in the U.S., with additional infrastructure in Europe and Asia-Pacific. Safeguard: section 5.
Attio (Attio Ltd, United Kingdom): managing commercial relationships (CRM) with leads, clients and contacts obtained from the BORME. Location: EU; Attio Ltd is established in the United Kingdom, which has an adequacy decision (section 5).
Manychat (Manychat, Inc., U.S.): we use Manychat to manage WhatsApp conversations: the chatbot and incoming requests, including the first name, surnames and telephone number from Meta ad forms, and, when someone to whom we sent an expired link asks for it, sending a new link to their offer or the client app through WhatsApp, for which Manychat receives the telephone number and new link. Manychat stores conversations on AWS servers in Frankfurt (EU); Manychat, Inc. and its sub-processors, which provide hosting, messaging, support and error logging services, are in the U.S. (sub-processor list). Safeguard: section 5.
Holded: invoicing and accounting. Location: EU (Spain).
Slack: internal communications and operational team alerts, with internal identifiers and links, without your contact data. Location: U.S. Safeguard: section 5.
Linear: project management. Location: EU.

4.3. Advertising and business prospecting platforms

These platforms receive data only if you have accepted the “Marketing” category in the cookie banner at the time of each transmission. Routes through PostHog also require you to have accepted the “Analytics” category. If you withdraw your acceptance of “Marketing”, the page reloads to stop the LinkedIn tag. Until that reload, which normally takes less than a second, the tag may continue sending data; if your browser cannot save your decision, the page does not reload and it may continue sending data until you leave the website, reload the page or close the tab.

Meta (Meta Platforms Ireland Limited, Ireland). If you accept “Marketing”, we send Meta information about your visit through three routes:

Meta pixel, in your browser: cookie identifiers _fbp and _fbc, the click identifier fbclid, your IP address, your browser’s user agent, the full page address — including its query string, which may contain ad click identifiers — the referring page and conversion events. The pixel also stores in your browser the last external site you came from and the time of that visit.
Meta Conversions API, from your browser through our server-side tagging server (eh.energio.es), without installing cookies: only the visit and interaction events PageView (viewing a page), ViewContent (viewing a product or service), AddToCart (adding to a cart), InitiateCheckout (starting checkout), Search (searching), AddPaymentInfo (adding payment details) and AddToWishlist (saving to favourites), with each event’s identifier and time, _fbp and _fbc if present, the page and referring page addresses without their query strings or the part following “#”, your IP address, your browser’s user agent and, where applicable, commercial data (currency, amount, transaction identifier and, for each item, its identifier, quantity and price). This route never sends the Lead, Purchase or CompleteRegistration events, or your email address, first name, surnames or telephone number.
Meta Conversions API, through PostHog, when you submit a request: the conversion event, _fbp, _fbc, fbclid, your browser’s user agent and the page address with ad click identifiers masked. The configuration also provides for your email address, first name, surnames and telephone number converted into a hash (SHA-256), but these are not sent because PostHog does not associate them with your browser.

We do this to measure our campaigns’ results, create audiences and show you personalised ads on Facebook and Instagram.

Who is responsible for what with Meta. Energio and Meta are joint controllers (art. 26 GDPR) for the collection of this data and its transmission to Meta. Once Meta receives it, it processes it as an independent controller for its own purposes (for example, combining it with other data, showing ads or improving its products), under its Privacy Policy. We have accepted Meta’s Controller Addendum. The essence of that agreement is that Energio informs you of this joint processing, as this section does; Meta handles your rights of access, rectification, erasure, restriction and portability for the data it retains after transmission; and each is responsible for its own legal basis, your right to object to its own processing and the security of its part: Meta for its tools, and Energio for their installation and configuration. You can exercise your rights with either of us; if your request concerns data Meta retains, we will forward it to Meta within a maximum of seven calendar days.

LinkedIn (LinkedIn Ireland Unlimited Company, Ireland). If you accept “Marketing”, we send LinkedIn information about your visit through two routes:

LinkedIn Insight Tag, which loads in your browser through Google Tag Manager: the page address — including its query string, which may contain ad click identifiers — and referring page, your IP address (which LinkedIn truncates or converts into a hash), your browser’s user agent, visit time, random page load identifiers and LinkedIn cookies such as li_fat_id (see the Cookie Policy). With Website Actions, the tag also sends what you do on the page: the pages you visit, with their titles, the time you spend on each and your clicks, with the text, type (button, link, image…) and link of the element clicked, the address and alternative text of any image it contains and the element’s position in the page structure (the elements containing it, with their identifiers, classes and attributes). According to LinkedIn’s documentation, it also transmits when you submit a form and a user hash specific to the session.
LinkedIn Conversions API, through PostHog, when you submit a request: the li_fat_id cookie identifier and the conversion event. The configuration also provides for your email address converted into a hash (SHA-256), job title and country code, but these are not sent because PostHog does not associate them with your browser.

We do this to measure conversions from our LinkedIn campaigns, create audiences and show you personalised ads.

Who is responsible for what with LinkedIn. Energio and LinkedIn are joint controllers (art. 26 GDPR) only for the collection of this data and its transmission to LinkedIn. The essence of our relationship is that Energio decides to use these tools, informs you and asks for your consent before activating them, and LinkedIn designs the tools and decides what data they collect. From transmission onwards, LinkedIn is the sole controller of what it does with the data (associating it with your profile, creating audiences, showing ads, producing reports and improving its services), under its Privacy Policy; Energio receives only aggregate reports from LinkedIn that do not identify you. According to LinkedIn, it deletes direct identifiers within 7 days and pseudonymised data within 180 days. You can exercise your rights with Energio or LinkedIn; LinkedIn handles requests about processing after transmission, and if you send them to us, we will forward them. If you have a LinkedIn account, you can also limit this use in your LinkedIn ad settings.

Apollo (ZenLeads Inc., U.S.). If you accept “Marketing”, Apollo receives through its pixel your IP address, your browser’s user agent, the pages you visit and a pseudonymous visitor identifier (apolloAnonId), to identify which companies visit the website for business-to-business prospecting. Apollo acts as a processor for the visit events it receives and as an independent controller when matching them against its own database.

4.4. Datadis

If you authorise us, we access your consumption data through Datadis, the official platform of Spanish electricity distributors, using your NIF/NIE or the legal entity’s NIF and the CUPS. The authorisation is valid for 24 months. You can revoke it at any time by writing to datadis@energio.es, and Energio will notify Datadis within three days. Datadis processes your identification data to provide us with your consumption data; you can exercise your rights regarding that processing with Datadis at dpo@datadis.es.

4.5. Messaging platforms

WhatsApp (Meta Platforms Ireland Limited) transmits the messages you exchange with our chatbot under its own terms.

5. International transfers

Some providers process data outside the European Economic Area (EEA). These transfers rely on the following safeguards:

Attio: according to Attio’s written confirmation, its main infrastructure and customer data are hosted and processed in the EU, although Attio does not commit to a specific region. Attio Ltd is established in the United Kingdom, whose adequacy is recognised by Commission Implementing Decisions (EU) 2021/1772 and 2025/2574. Under its Privacy Policy, where providers or systems outside the United Kingdom or the EEA are involved, Attio applies, as appropriate, an adequacy decision, standard contractual clauses, the UK International Data Transfer Agreement (UK IDTA) or its Addendum (UK Addendum).
Google Analytics and Google Tag Manager: under the Google Ads Data Processing Terms, Google transfers data to the U.S. under the EU-U.S. Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795), under which Google LLC is certified, and standard contractual clauses where that framework does not apply (Google’s information on transfers).
Google Cloud: if it processes data outside the EEA, its Data Processing Addendum applies the alternative transfer solution Google has adopted or, failing that, standard contractual clauses.
Manychat: although Manychat stores conversations in the EU, Manychat, Inc. and its sub-processors may access them from the U.S. The transfer relies on the EU-U.S. Data Privacy Framework, under which Manychat, Inc. states it is certified, and, where that framework does not apply, the European Commission’s standard contractual clauses (Commission Implementing Decision (EU) 2021/914), under its Data Processing Agreement.
Framer: Framer B.V. is established in the EU, but its services are hosted in the U.S. Framer bases transfers to its sub-processors on the EU-U.S. Data Privacy Framework where they are certified or, otherwise, on standard contractual clauses (Commission Implementing Decision (EU) 2021/914).
Apollo: EU-U.S. Data Privacy Framework and standard contractual clauses, under its data processing agreement.
Slack: European Commission standard contractual clauses.
Meta and LinkedIn: for their processing as independent controllers, they may transfer data to Meta Platforms, Inc. and LinkedIn Corporation in the U.S. under the EU-U.S. Data Privacy Framework or standard contractual clauses, under their privacy policies.

You can ask us for a copy of these safeguards by writing to dpd@energio.es.

6. Retention periods

Unconverted leads: 1 year from registration.
Client data (identification, contact, bills and consumption): 2 years from the last interaction.
Accepted offers and contracting data: 6 years from acceptance of the offer (tax and legal obligations).
Partner data (identification, contact and bank account): during the relationship and for 6 years afterwards.
Partner invoices and commissions: 6 years from issue (art. 30 of the Código de Comercio, the Spanish Commercial Code).
App accounts: your login credentials, while your account is active; if you ask for its erasure, we delete them within 30 days.
Security logs: 1 year. These include the audit log of security-relevant actions in the apps, with your IP address and your browser’s user agent, and our database security logs.
BORME data: 12 months from import, unless the person becomes a lead. If you object, we delete your data and keep only what is essential to avoid contacting you again.
Attribution history and questionnaire answers: the same period as the request they belong to; they are deleted with it. The copy sent to PostHog follows the product analytics retention period.
Chatbot conversations (Manychat): the same period as the request or client data they relate to; if you never submit a request, 1 year from your last message. At the end of that period, we delete the contact and their conversations from Manychat. Copies kept by WhatsApp are subject to its own terms (section 4.5).
Product analytics (PostHog): up to 2 years in PostHog and up to 4 additional years in our internal analytics export archive; at the end of that period, we also delete earlier versions of that data from the archive. Browser security reports (section 2.6) and cookie decision events (section 3.4) follow this period.
Google Analytics: events, 2 months; user data, 14 months, a period that restarts with each new activity. These settings do not affect aggregate reports.
Technical and error logs from our systems: 30 days in our infrastructure and 14 days in PostHog’s logging service. Errors recorded as issues in PostHog follow the product analytics retention period.
Technical data from visits and requests your browser sends to our servers (section 2.1): 30 days in those servers’ logs. Data Framer receives when hosting the website follows the next item.
Technical data Framer receives when hosting the website: Framer processes it on behalf of Energio for no longer than the duration of our contract, and erases it at our request unless the law requires it to retain it.
Cookies and local storage: the period stated in the Cookie Policy, or until you delete them or withdraw your consent. Those the website cannot delete (FPID and LinkedIn cookies on its own domain) remain until they expire or you delete them yourself.
Consent decision records: a grant, for the duration of the processing it authorises and 6 years afterwards; a refusal or withdrawal, 6 years from the decision. A cookie banner decision that keeps any category requiring consent accepted (“Preferences”, “Analytics” or “Marketing”) is retained as a grant.
Datadis authorisation: valid for 24 months (section 4.4); its record is kept in the same way as consent decision records.
Data Meta and LinkedIn process as independent controllers: under their own privacy policies (section 4.3).

At the end of these periods, we securely delete the data or anonymise it for statistical purposes, unless we must block it due to a legal obligation or an ongoing claim. Our database backups are replaced within 30 days.

7. Your rights

You have the following rights regarding your personal data:

Access: to know whether we process your data and obtain a copy.
Rectification: to correct inaccurate data or complete incomplete data.
Erasure: to ask us to delete your data (the “right to be forgotten”).
Restriction: to ask us to restrict processing in certain circumstances.
Portability: to receive your data in a structured, commonly used and machine-readable format.
Objection: to object to processing based on our legitimate interest and, in all cases, to commercial communications.
Withdrawal of consent: to withdraw your consent at any time.
Not to be subject to automated decisions: not to be subject to decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (art. 22 GDPR).

Energio does not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. Even so, you can ask for a person to review any automated comparison or recommendation.

7.1. How to exercise your rights

Send your request to:

Email: dpd@energio.es
Post: Ronda del General Mitre, 126, 6th floor, 08021 Barcelona, Spain

Include:

your first name and surnames;
the right you want to exercise;
an address where we can reply.

We will ask for a copy of your identity document only where needed to verify your identity.

We will respond within one month of receiving your request. In complex cases, we may extend this by two more months; if so, we will notify you within the first month (art. 12.3 GDPR).

7.2. Complaint to the AEPD

If you believe we have not properly handled your rights, you can lodge a complaint with the Agencia Española de Protección de Datos (AEPD, the Spanish Data Protection Agency):

Website: www.aepd.es
Current contact details and address: www.aepd.es/la-agencia/donde-encontrarnos
Electronic office: sedeagpd.gob.es

Web forms: before you submit your request, a checkbox to confirm you have read this Privacy Policy and a separate checkbox for each consent: preparing your offers and, if you upload bills, processing them, which are needed to handle your request, and receiving commercial communications, which is optional.
Cookie banner: consent by category: “Necessary” (always active), “Preferences”, “Analytics” and “Marketing”. Further information in the Cookie Policy.
WhatsApp: a consent message, with options to accept or reject it, before collecting your data.

Cookies: using “Cookie configuration” on the website and in the apps.
Data processing and commercial communications: by writing to dpd@energio.es.
Datadis authorisation: by writing to datadis@energio.es (section 4.4).

Withdrawal of consent does not affect the lawfulness of processing carried out before it.

9. Minors

Energio’s services are intended for adults or emancipated minors (Terms of Use). We do not knowingly collect personal data from other minors; if we find that we have done so, we delete it without delay unless the law requires us to retain it.

10. Security measures

Energio applies appropriate technical and organisational measures to protect personal data.

10.1. Technical measures

Encryption of data at rest and in transit (TLS/HTTPS).
Role-based access controls.
Audit logging of access and operations.
Secure storage of documents, such as bills.
Encrypted backups.
Continuous security monitoring.

10.2. Organisational measures

The principle of least privilege for data access.
Staff training in data protection.
Information security policies.
Security incident response procedures.

11. Changes

We may change this Privacy Policy. If a change is substantial, we will notify you by email or through a notice on the website.

If a change affects processing based on your consent, we will ask for fresh consent where the GDPR requires it. Changes to processing that is not based on consent apply from publication or notification, provided they have a valid legal basis.