Privacy Policy

Any information about an identified or identifiable natural person is considered as personal data. This document describes how and why Soldera collects and uses personal data and provides information about the rights of data subjects. Soldera may use the personal data provided to it for the purposes described herein or for the purposes disclosed to the Member at the time the personal data was collected.

1. WHAT KIND OF PERSONAL DATA IS PROCESSED?
   1. To provide the Services to the Member, Soldera may process the Member's personal data based on paragraphs (b), (c) or (f) of Article 6(1) of the General Data Protection Regulation (GDPR), depending on whether the Member is a data subject. Soldera collects the following personal data from the Member:
      • Name and personal identification code of the Member or the Member's representative;
      • Contact details, e.g. the Member's e-mail address, address, and telephone number;
      • Transaction related data, including the details regarding Energy Attribute Certificates and money belonging to the Member.
2. FOR WHAT PURPOSES IS THE PERSONAL DATA PROCESSED?
   1. In the absence of personal data, it is not possible to provide the Services to the Member. Soldera uses the Member's personal data to:
      • Perform its obligations arising from the Agreement entered into with the Member;
      • Comply with applicable legal requirements;
      • Inform the Member of changes to the Services;
      • Ensure the security of the provision of the Services;
      • Manage the Services and the internal procedures;
      • Improve the Services;
      • Measure or understand the effectiveness of marketing and to organise appropriate marketing campaigns;
      • Combine information that Soldera receives from other sources with information provided by the Member. Soldera may use combined information to achieve the above purposes.
3. ON WHAT LEGAL BASIS IS PERSONAL DATA PROCESSED?
   1. To use the data described in Chapter 1, Soldera relies on the following legal bases:
      • Performance of the Agreement (Article 6(1)(b) of the GDPR). Soldera may process the Member's data to provide Services to the Member.
      • Performance of a legal obligation (Article 6(1)(c) of the GDPR). Soldera may process the Member's data if Soldera is obligated to do so by law or the Agreement.
      • Legitimate interest (Article 6(1)(f) of the GDPR). Soldera may process the Member's data if Soldera has legitimate interest to do so.
4. TO WHOM MAY PERSONAL DATA BE TRANSFERRED?
   1. Service providers. For Soldera to be able to provide the Services in the best possible way, Soldera cooperates with various service providers (including parties related to Soldera). Soldera undertakes to share the Member's personal data with such parties based on the purpose of sharing as little of the Member's personal data as possible with service providers.
   2. Legal obligations. Soldera may share the Member's personal data if Soldera is legally obligated to do so.
   3. Soldera's advisers (e.g., attorneys, auditors, accountants). Soldera has the right to share the Member's personal data with Soldera's professional advisers for the purpose of providing services to Soldera, including representing Soldera in court actions, providing legal advice, auditing services. The legal basis for the transfer of data is the legitimate interest of Soldera. In a situation where the Member has breached the Agreement or otherwise violated the rights of Soldera, the interests and rights of the Member do not outweigh the legitimate interest of Soldera.
5. HOW AND FOR HOW LONG IS PERSONAL DATA STORED?
   1. Location. To ensure the protection of the Member's data, personal data is stored in databases or databases of service providers physically located in the European Economic Area.
   2. Duration of storage. Soldera does not process the Member's personal data for longer than is necessary for the purposes for which such data are processed, including the fulfilment of the data storage obligations laid down by legal acts and for the protection of its rights to resolve a dispute arising from the Agreement or to resolve a potential dispute. As a general rule, Soldera retains the Member's personal data until the expiry of the limitation period for any potential claims arising from the Agreement (i.e. 10 years from the expiry of the Agreement), unless there is an express legal obligation provided for in legal acts to retain such personal data during a different term.
6. WHAT ARE THE MEMBER'S RIGHTS TO PERSONAL DATA?
   1. Right of access to data. The Member has the right to request access to the Member's personal data held by Soldera as the data controller.
   2. Right to rectification of data. The Member has the right to request from Soldera the rectification of the Member's personal data if they are incorrect or incomplete.
   3. Right to receive data. The Member has the right to receive the Member's personal data which the Member has provided to Soldera in a structured, commonly used, machine-readable format. The Member has the right to request that such data be transferred to another data processor if the data have been collected with the consent of the Member, according to the Agreement or automatically.
   4. Right to withdraw the consent. If processing of the Members data is based on a consent, the Member's consent is voluntary, and the Member has the right to withdraw the Member's consent at any time. In this case, it may not be possible for Soldera to continue to provide the Services and may result in a breach of the Agreement by the Member. In general, Soldera does not process personal data based on consent (as Soldera usually relies on some other legal basis).
7. COMPLAINTS
   1. If the Member has concerns about the use of personal data, enquiries or complaints may be addressed to Soldera by e-mail at support@soldera.org.
   2. If the Member feels that Soldera has not adequately addressed questions or concerns or feels that the Member's data protection rights have been violated, the Member has the right to lodge a complaint with the data protection authority in their jurisdiction or to lead supervisory authority. Contact details of the national data protection authorities are available at: https://www.edpb.europa.eu/about-edpb/about-edpb/members_en. The lead supervisory authority for Soldera is Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee).
8. APPLICABLE LAW
   1. This Privacy Policy is governed by the laws of the Republic of Estonia.