Privacy Policy

Introduction

Optim Energy ("we," "our," or "us") is committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website optimenergy.ie (the "Site") or use our energy solutions and services.

This Privacy Policy complies with the General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA/CPRA), and other applicable data protection laws worldwide.

1. Data Controller Information

2. Information We Collect

2.1 Personal Information You Provide

We collect personal information that you voluntarily provide to us when you:

• Contact & Enquiry Forms: Name, email address, phone number, company name, message content, and the subject of your enquiry
• Service Assessments: Information you provide through our assessment questionnaires, which may include property details (type, size, location), energy data, and your areas of interest. The specific fields collected are displayed within each form at the time of submission.
• Subscribe to Newsletter: Email address, communication preferences
• Use Our Services: Energy system data, usage patterns, device information

As we expand our product and service offerings, the types of information we collect may evolve. We will update this policy accordingly and notify you of material changes.

2.2 Automatically Collected Information

When you visit our Site, we automatically collect:

• Device Information: IP address, browser type, operating system, device identifiers
• Usage Data: Pages viewed, time spent on pages, navigation paths, referral sources
• Location Data: General geographic location based on IP address
• Analytics Data: Anonymous usage statistics collected via privacy-first analytics (no cookies or personal identifiers)

2.3 Energy System Data

For customers using our energy solutions, we may collect system performance data, grid optimization data, equipment status, and environmental data.

2.4 Assessment and Customer Relationship Data

When you complete an assessment questionnaire or engage with our services, we collect information to assess your needs, provide our services, maintain your service history, and send you relevant reminders. This information falls into the following categories:

The specific fields collected are displayed within each form at the time of submission.

Service Reminders

We send periodic maintenance reminders based on your equipment and service history (e.g., annual heat pump servicing). These are service-related communications sent under our legitimate interest to help you maintain your equipment. You can opt out of reminders at any time while keeping your service history.

3. How We Use Your Information

4. Analytics and Tracking

We use a privacy-first, cookie-free analytics solution to understand how visitors use our website. This helps us improve our services and user experience.

What We Collect

• Page views: Which pages are visited and for how long
• Referrer information: How visitors found our site
• Device information: Browser type, operating system, screen size (anonymized)
• Geographic location: Country/region level only (derived from IP, which is not stored)
• Custom events: Interactions like form submissions and button clicks (anonymized)

What We Do NOT Collect

• No cookies or browser storage
• No personal identifiers or IP addresses
• No cross-site tracking
• No data sold to third parties

5. How We Share Your Information

We do not sell your personal information to third parties. We may share your information in the following circumstances:

• Service Providers: Trusted third-party providers who perform services on our behalf (cloud hosting, email services). Our analytics provider is privacy-focused and does not collect personal data or share information with third parties.
• Business Partners: With your consent, energy equipment manufacturers and utility companies
• Legal Requirements: When required by law or to protect our rights, property, or safety
• Business Transfers: In the event of a merger, acquisition, or sale of assets

6. Data Processing Location and International Transfers

Your data is primarily processed and stored within the European Economic Area (EEA). Our core infrastructure and databases are hosted within EU data centres.

In some cases, your information may be transferred to and processed in countries outside the EEA (for example, where a third-party service provider operates internationally). When we transfer personal data outside the EU/EEA or UK, we implement appropriate safeguards including Standard Contractual Clauses (SCCs) and adequacy decisions to ensure your data remains protected.

7. Data Retention

We retain your personal information only for as long as necessary:

• Account Information: Duration of account plus 7 years
• Contact Form Submissions: 3 years from last contact
• Marketing Communications: Until you unsubscribe
• Energy System Data: Duration of service plus 10 years
• Analytics Data: 26 months
• Service and Customer Data: Duration of customer relationship plus 7 years (for warranty and legal purposes), or until you request deletion

8. Your Privacy Rights

GDPR Rights (EU/EEA/UK Users)

• Right to Access: Request a copy of your personal data
• Right to Rectification: Correct inaccurate or incomplete data
• Right to Erasure: Request deletion of your data ("right to be forgotten")
• Right to Restriction: Limit how we use your data
• Right to Data Portability: Receive your data in a portable format
• Right to Object: Object to processing based on legitimate interests
• Right to Withdraw Consent: Withdraw consent at any time

CCPA/CPRA Rights (California Residents)

• Right to Know: Request disclosure of data collection practices
• Right to Delete: Request deletion of personal information
• Right to Opt-Out: Opt out of the sale of personal information
• Right to Non-Discrimination: Not be discriminated against for exercising rights

9. Security Measures

We implement appropriate technical and organizational security measures:

• Encryption: Data encrypted in transit (TLS/SSL) and at rest (AES-256)
• Access Controls: Role-based access, multi-factor authentication
• Security Testing: Regular vulnerability assessments and code reviews
• Employee Training: Regular privacy and security training
• Incident Response: Data breach response and notification procedures

10. Children's Privacy

Our services are not intended for individuals under the age of 16. We do not knowingly collect personal information from children. If we discover that we have inadvertently collected information from a child, we will delete it promptly.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting a prominent notice on our Site, updating the "Last Updated" date, and sending an email notification for significant changes.

12. Contact Us

If you have questions about this Privacy Policy or wish to exercise your privacy rights:

13. Supervisory Authority

If you are located in the EU/EEA or UK and believe we have not addressed your concerns adequately, you have the right to lodge a complaint with your local data protection supervisory authority.