Energy Web Privacy Policy

General information

Energy Web AG, a Swiss company located at Baarerstrasse 10, 6300 Zug, Switzerland, registered under CHE-374.087.679 ("Energy Web", "we", "us") is the operator of energyweb.org and is the controller of the personal data described in this policy. Energy Web AG is a subsidiary of the Energy Web Foundation (EWF), a Swiss nonprofit foundation.

As the operator of the website, we take the protection of your personal data very seriously. We collect, process, and use your personal data in accordance with this privacy policy and in compliance with the Swiss Federal Act on Data Protection ("FADP"), the Swiss Ordinance to the Federal Act on Data Protection ("OFADP") and the General European Data Protection Regulation ("GDPR"). This privacy policy ("Privacy Policy") will inform you about the collection, processing and use of your personal data when using the website.

We have not appointed a data protection officer, as we are not required to do so. Responsibility for data protection sits with our Chief Technology Officer as owner of our information security management system.

What this policy covers

This Privacy Policy applies to energyweb.org, to our service status page at status.energyweb.org, to correspondence you send us using the contact addresses published on our website, and to the business contact records we hold about people we deal with professionally.

It does not cover Energy Web-operated registries and platforms, each of which has its own data controller and respective privacy information, nor our hosted dashboards, which are covered by a separate notice at energyweb.org/dashboards-privacy. It does not cover Energy Web Foundation, which is a separate legal entity.

An archived copy of our previous website remains temporarily available at legacy.energyweb.org while we complete our migration. It is not maintained, and any privacy or cookie information published there is out of date and superseded by this policy.

Personal data we collect visiting our website

Our website does not set any cookies. We use no analytics, no advertising technology and no tracking of any kind, so there is nothing for you to consent to or to opt out of. Our Cookie Policy at energyweb.org/cookies explains this in full.

• Security logging: Our website is hosted on Cloudflare infrastructure. To route your request and protect the site from attacks, Cloudflare processes your IP address. Where our security filtering blocks or challenges a request, a security event is recorded containing the IP address and details of the request, and is deleted after 24 hours. We keep no other logs of your visit, and we do not export this data to any other system. This is our legitimate interest in the processing of data in the sense of Art. 6 Par. 1 lit. f GDPR, and the corresponding provisions of the FADP.
• Information you give us: When you write to us, or when we deal with you professionally, we collect the personal information you provide, potentially including name, title, organization, email address, phone number and the content of your correspondence.
• Social media platforms: We link to Energy Web's presence on external platforms including X, LinkedIn, Medium, Discord and GitHub. These are ordinary links, not embedded content, and nothing loads from those platforms while you are on our website. If you click through, the operators of those platforms may record that you came from our website and may use this information. This processing lies in the responsibility of these individual platforms and occurs according to their privacy policies. Energy Web is not responsible for data collected by them. We use these platforms solely to inform our community of updates and answer user questions.

We do not operate a newsletter and we do not send marketing mailings.

When you contact us

The contact links on our website open your own email program. Nothing is submitted through our website, and we receive no information about you until your email arrives.

Enquiries sent to our published commercial address are received by members of our commercial team, and a record of your enquiry is also created in our customer relationship management system so that we can track it and respond properly. Where a colleague logs the exchange, a copy of the correspondence, including any attachments, is stored on your contact record.

We do this to respond to you, and where relevant to take steps towards a possible working relationship. Our legal basis is our legitimate interest in responding to enquiries and managing our business relationships in the sense of Art. 6 Par. 1 lit. f GDPR, or where applicable, steps taken at your request before entering a contract in the sense of Art. 6 Par. 1 lit. b GDPR.

Business contact records

We hold contact details for people we deal with professionally, including at partner organizations, customers, standards bodies and regulators. This usually consists of a name, an employer, a role, an email address and a record of our correspondence. We obtain these details either directly from you, or from your public professional profile or website.

Where we hold a recording or transcript of a call you took part in, it is stored on your contact record and kept for the same period. Participants are told before any call is recorded.

Our legal basis is our legitimate interest in maintaining professional relationships in the sense of Art. 6 Par. 1 lit. f GDPR. You can object at any time by writing to info@energyweb.org, and we will stop, keeping only a minimal record of your objection so that we do not contact you again by mistake.

Who has access to your information

We will never sell, lease, or otherwise share your personal information with unaffiliated, third-party individuals and organizations unless you have expressly consented to it or if we are legally obliged to. Your personal information will only be used across the Energy Web team to deliver services and communications, and with service providers only as necessary to deliver and improve those services and to perform the functions described above.

Our service providers process personal data on our behalf under written contracts that restrict what they may do with it. They fall into the following categories:

• Cloud hosting and infrastructure providers
• Content delivery, network and security providers
• Customer relationship management providers
• Communication and productivity providers
• Identity and access management providers
• Artificial intelligence providers, used to summarize, transcribe and search our own records
• Identity verification providers, where a service requires it

Some of these providers use automated and AI-assisted processing to summarize, transcribe or search our records. This supports our own work. It does not produce decisions about you, and we do not use it for profiling. Our contracts with these providers prohibit them from using our data to train their models.

We keep a current list of our providers and will send it to you on request to info@energyweb.org. We may also disclose information to our professional advisers, and to public authorities or courts where we are legally required to do so.

Transfer of personal data

We are entitled to transfer your personal data to third parties abroad for the purpose of data processing described in this Privacy Policy. Most of our processing takes place in Switzerland or the European Economic Area, and some of our service providers are located in other countries, including the United States.

They are obliged to protect data privacy to the same extent as us. Where personal data leaves Switzerland or the EEA, we rely on a decision by the European Commission or the Swiss Federal Council that the destination country provides adequate protection, on the provider's certification under the EU-US or Swiss-US Data Privacy Framework, or on the standard contractual clauses together with a documented assessment of the destination country's laws and of the technical and organizational measures protecting the data. We keep these assessments on file and will describe the safeguards applying to a particular provider on request.

How long we keep your information

We keep personal data only for as long as we need it:

• Security events recorded by our web application firewall are deleted after 24 hours.
• Enquiry correspondence in our mailboxes is deleted 12 months after our last exchange with you.
• Business contact records, including logged correspondence and call transcripts, are deleted 36 months after your last engagement with us.
• Records relating to a contract, and accounting records, are kept for the statutory retention period applicable to us.
• Identity verification records, where a service requires them, are kept for the retention period required by applicable anti-money-laundering law.
• Records of an objection or a request not to be contacted are kept for as long as needed to honour that request.

Data security

We use appropriate technical and organizational security measures to protect your stored personal data against manipulation, partial or complete loss, and unauthorized access by third parties. We operate an information security management system with documented policies covering access control, joiner-mover-leaver processes, operations security, supplier management and acceptable use of tools. Access to systems holding personal data is restricted to those who need it, requires multi-factor authentication, and is reviewed periodically.

Please note that any data transmitted via internet is generally not secure and absolute protection is not technically possible. If a personal data breach affecting you occurs, we will notify you and the relevant authorities where the law requires it.

If you use a website of third parties with the corresponding links given on our website, this information does not apply, and Energy Web assumes no responsibility and liability for these.

Right to confirmation and access

You have the right to obtain confirmation from Energy Web whether or not personal data concerning you is being processed.

You have the right to obtain free information from Energy Web about your personal data stored and you can request at any time access to this information, including the purpose of the processing, the data concerned, and the period for which the personal data will be stored.

Right to rectification

You have the right to obtain from Energy Web, without undue delay, the rectification of inaccurate personal data concerning you.

Right to erasure

You have the right to request from Energy Web the complete erasure of your personal data under the following circumstances:

• The personal data is no longer necessary in relation to the purposes for which they were collected or processed.
• You withdraw the consent on which the processing is based, and there is no other legal ground for it.
• You object to the processing and there are no overriding legitimate grounds for it to continue.
• The data has been unlawfully processed.
• The personal data must be erased for compliance with a legal obligation in accordance with the applicable law to which Energy Web is subject.

Right to restriction, objection and portability

You have the right to request that we restrict the processing of your personal data, and the right to object at any time to processing we carry out on the basis of our legitimate interest, including at any time to any direct marketing.

Where our processing is based on your consent or on a contract, you have the right to receive the personal data concerning you in a structured, commonly used and machine-readable format. Where we have relied on your consent, you may withdraw it at any time.

Right to complain

If you are not satisfied with how we have handled your personal data, you can lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC), or with the data protection authority of the country where you live or work.

Automated decision-making

We do not make decisions about you by automated means, and we do not carry out profiling. Our website is aimed at professional and business audiences, is not directed at children, and we do not knowingly collect information about them.

Questions

If you have questions about this Privacy Policy, please email info@energyweb.org or contact us in writing via post at Energy Web AG | Baarerstrasse 10 | 6300 Zug | Switzerland.

We review this Privacy Policy at least once a year, and whenever we change how we handle personal data. The effective date at the top of this page shows when it last changed.

Our representative in the EU according to article 27 GDPR is: