Privacy & GDPR Policy

This Privacy & GDPR Policy explains how 9D Energy Ltd (“we”, “our”, “us”) processes personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the EU GDPR, the Data Protection Act 2018, and applicable security obligations under NIS2 where relevant.

Policy

Last Updated: 01-09-2025

1. Data Controller

The data controller is:

9D Energy Ltd
Unit 19/20, Broadfields Park,
Seaview Road,
Cowes,
Isle of Wight,
PO31 7US,
United Kingdom
Company Number: 08506105

Data Protection Officer (DPO): GDPR@9de.co.uk

2. What Data We Collect

We limit personal data collection to what is strictly necessary:

Account Data: Work email addresses and associated login credentials for access to our SaaS dashboard/portal.
Device Data: Device information and telemetry, but only where devices are connected at the explicit request of a customer.
Cookies & Analytics: We use cookies, including Google Analytics, to improve service performance and understand portal and website usage.

We do not collect marketing data, and we do not sell or share personal data for advertising purposes.

3. Legal Basis for Processing

We process personal data on the following bases:

Contractual necessity – to provide access to our SaaS services and connected devices.
Legitimate interests – to maintain and improve the functionality, security, and performance of our services.
Legal obligations – to comply with statutory or regulatory requirements.
Consent – where applicable, such as for cookies requiring user approval.

4. How We Use Personal Data

To provide, maintain, and improve access to our SaaS portal.
To support customer device integration where requested.
To monitor system security, detect misuse, and prevent fraud.
To analyse service performance through cookies/analytics.
To comply with legal and regulatory obligations.

5. Data Retention

We retain personal data only as long as necessary to fulfil the purposes outlined above or to meet legal requirements. Once data is no longer required, it is securely deleted or anonymised.

6. Data Storage & Transfers

All personal data is stored and processed within the European Union using Amazon Web Services (AWS). We do not transfer data outside the UK or EU.

7. Data Security

We implement appropriate technical and organisational measures, including:

Encryption of data in transit and at rest.
Access controls and authentication.
Monitoring and auditing of system activity.
Regular security reviews in line with industry standards and NIS2 obligations.

8. Sharing of Data

We do not share personal data with third parties except:

With trusted service providers (such as AWS and analytics providers) strictly for the provision of our services.
Where required by law or regulatory authorities.

All third-party processors are bound by contractual obligations ensuring GDPR compliance.

9. Data Subject Rights

Under GDPR, you have the right to:

Access the personal data we hold about you.
Request correction of inaccurate data.
Request erasure (“right to be forgotten”).
Restrict or object to processing.
Request data portability.

To exercise these rights, contact our DPO at GDPR@9de.co.uk. We will respond in accordance with statutory timelines.

10. Cookies

We use cookies for essential site functionality and to collect anonymised usage analytics via Google Analytics. Where required, cookie consent will be requested before deployment.

11. Complaints

If you believe your data has been misused, you may contact our DPO. You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) or your local supervisory authority.

12. Updates to This Policy

We may update this Privacy & GDPR Policy from time to time to reflect changes in law, regulation, or business practices. Updated versions will be published on this website.