Privacy Policy
1. About this policy
This Privacy Policy explains how [LEGAL ENTITY: e.g. BayWa r.e. Solar Systems LLC], of [REGISTERED ADDRESS] ("BayWa r.e.", "we", "us"), handles personal information in BayWa One (the "Service"), a software platform for residential solar installer companies.
The Service is used by businesses. The people who sign in are employees and contractors of installer companies ("Users"). Homeowners do not sign in; their information is entered by the installer company they work with.
2. Our role
- For information about Users, BayWa r.e. is the business (controller): we decide how it is used to run the Service.
- For information about Homeowners that an installer company enters, the installer company is the business (controller) and BayWa r.e. is its service provider (processor). We process that information on the installer company's behalf and on its instructions, to provide the Service. A Homeowner who wants to know what is held about them, or to exercise a privacy right, should contact the installer company they work with. We help installer companies respond.
- When an installer company orders equipment from BayWa r.e. for delivery to a Homeowner's property, BayWa r.e. uses the delivery address for its own purposes as the seller: to fulfil, ship, invoice and support that order.
3. What personal information the Service holds
About Users:
- name, business email address, and the company and role they hold in the Service;
- sign-in records: when a User signs in and which account they act in;
- an audit record of significant actions, such as approvals, orders placed, statements accepted and changes to roles;
- messages a User sends us through the in-product feedback feature, with the screen it was sent from;
- the version of these documents each User has accepted, when, and for which account.
About Homeowners, as entered by the installer company:
- name, property address, phone number and email address;
- property, roof and energy-use information, such as utility usage or bills, used to design a system and estimate savings;
- design documents, plan sets, photographs and other files uploaded to a project, which may contain personal information printed on them;
- proposal, pricing and agreement information for the project;
- the information a financing provider's application requires, which is sent to that provider, and the status the provider reports back.
The Service does not collect or store Social Security numbers or dates of birth. A Homeowner who applies for financing enters them directly on the financing provider's own secure form, and they are never sent to or through the Service.
4. Why it is used
- to provide the Service: managing projects, producing designs and proposals, sending proposals and agreements, submitting financing applications, and ordering equipment, each at the direction of the installer company;
- to run User accounts: verifying sign-in, applying roles and permissions, and keeping each installer company's data separate from every other's;
- to fulfil equipment orders placed with BayWa r.e.;
- to secure the Service: detecting and investigating misuse, keeping audit records and diagnosing faults;
- to support Users and respond to feedback;
- to meet legal obligations and to establish or defend legal claims.
We do not sell personal information, and we do not share it for cross-context behavioural advertising. We do not use Homeowner information for any purpose of our own other than fulfilling the equipment orders described in section 2.
5. Who receives it
The Service is hosted on Microsoft Azure in the Central US region, and it relies on these third-party services: Microsoft Azure, Artemis, EnergyScape, LightReach (Palmetto), Sungage, BayWa r.e. NetSuite, Pacejet, DocuSign, Google Places, Clerk, Resend, Anthropic. The Sub-processor List names each one, says what it does, and says whether Homeowner information reaches it. It is generated from the same register that drives the notices inside the product, so it lists every service the product sends data to.
Most of these services receive Homeowner information only when a User presses the button that sends it, and the product says beside that button what is sent and to whom. Financing providers make their own decisions about the applications they receive and handle that information under their own privacy notices.
Where these services process data, and the contract terms in place with them: [SUB-PROCESSOR LOCATIONS AND TRANSFER TERMS]. We will give installer companies 30 days notice before adding a new service that receives Homeowner information.
Uploaded design documents are read by an artificial intelligence service (Anthropic) to extract equipment and figures. [AI PROVIDER DATA TERMS: confirm Anthropic does not train on submitted documents, and its retention period].
We may also disclose personal information where the law requires it, to protect the rights, safety or property of Users, Homeowners or BayWa r.e., or to a successor in a merger or sale of the business, under equivalent protections.
6. How long it is kept
- Customer data, including Homeowner information, is kept for as long as the installer company's account is active, and while it is active the installer company can delete a Homeowner's information at any time by asking us.
- After an account is terminated, data is available for export for 30 days and is then deleted within 90 days.
- Database backups expire on their normal cycle of 14 days.
- Equipment orders, audit records and records of accepted terms are kept for 7 years, because they are needed to answer legal, tax and contractual questions after the fact.
7. Security
We protect personal information with technical and organisational measures appropriate to its sensitivity, including:
- encryption in transit between the browser and the Service and between the Service and the services it connects to;
- storage in a managed database on Microsoft Azure, encrypted at rest;
- separation of every installer company's data from every other's, enforced in one place in the Service rather than screen by screen;
- role-based access, so each User can see and do only what their role allows;
- credentials for third-party services held only on our servers, never in a User's browser;
- audit records of significant actions, and application logs that leave out Homeowner details.
No system is perfectly secure. If a security incident affects an installer company's data, we will tell that company within 72 hours of becoming aware of it, so that it can meet its own obligations to Homeowners. Report a vulnerability to [SECURITY CONTACT EMAIL].
8. Your rights
Depending on where you live, you may have the right to know what personal information is held about you, to access, correct or delete it, to obtain a copy in a portable format, to opt out of its sale or sharing or of certain profiling, and not to be discriminated against for exercising these rights. We do not sell or share personal information or use it for profiling with legal or similarly significant effects.
- Users can exercise these rights by contacting [PRIVACY CONTACT EMAIL]. Some information, such as audit records and accepted terms, may be kept where the law allows, for example to defend legal claims.
- Homeowners should contact the installer company they work with, which controls their information in the Service. If you contact us directly, we will pass your request to that company where we can identify it, and help it respond.
We will verify a request before acting on it, and you may use an authorised agent where the law allows. If we refuse a request, we will say why, and you may appeal by replying to our answer.
10. Children
The Service is for businesses and is not directed at children. We do not knowingly collect personal information from children under 16.
11. Changes to this policy
When this policy changes, we publish the new version here with a new version identifier and effective date, and each User is asked to confirm that they have read it the next time they use the Service.
12. Contact
[LEGAL ENTITY: e.g. BayWa r.e. Solar Systems LLC], [REGISTERED ADDRESS]. Privacy questions and requests: [PRIVACY CONTACT EMAIL].