Privacy Policy of BE ENERGY PART S.L. (SOTYSOLAR)

Privacy Policy of BE ENERGY PART S.L. (SOTYSOLAR)

1. WHO IS RESPONSIBLE FOR PROCESSING YOUR DATA

SOTYSOLAR:

Contact details of the data controller

Full name: BE ENERGY PART, S.L (hereinafter SOTYSOLAR)

Registered address: Calle del Profesor Potter, 51, 2nd floor. Parque Científico y Tecnológico de Gijón 33394 (Asturias, Spain)

NIF: B52536729

Contact details of the data controller

Full name: FINREAL SOLUTIONS, S.L (hereinafter SOTYSOLAR)

Registered address: Calle del Profesor Potter, 51, 2nd floor. Parque Científico y Tecnológico de Gijón 33203 (Asturias, Spain)

NIF: B70787544

Privacy Committee contact details: You can reach us via email at: rgpd@sotysolar.es

2. SCOPE OF THE POLICY

When you access and use this website, participate in the blog, use instant messaging tools, or any other means that involve the processing of personal data, you agree to accept this Privacy Policy, as well as the provisions contained in the Legal Notice and the Cookie Policy.

At SOTYSOLAR, we provide you with information so that, before submitting your personal data, you can access the Privacy Policy and any other relevant information regarding Data Protection.

3. FUNDAMENTAL PRINCIPLES

- We will never request personal information unless it is genuinely necessary to provide the requested services.

- We will never share users' personal information with anyone, except to comply with legal obligations or with your explicit authorization.

- We will never use your personal data for any purpose other than what is stated in this Privacy Policy.

4. HOW WE USE YOUR DATA

To maintain some of our services, as well as for other purposes outlined in this Privacy Policy.

Specifically, if BE ENERGY PART, S.L. is the Data Controller, your personal data will be processed, among other things, for the following purposes:

(You can provide the rest of the purposes, and I'll translate them as well.)

PROCESSING	PURPOSE	LEGAL BASIS	RECIPIENTS	RETENTION PERIOD
Recruitment at SOTYSOLAR	Manage the reception of résumés submitted through the website and oversee the selection process.	Consent of the data subject	Data will not be shared with third parties	1 year from the receipt of the résumé
Marketing	Marketing actions with customers to promote SOTYSOLAR products. Organization of contests.	Consent of the data subject	Data will not be shared with third parties	Until the data subject exercises their right to erasure. Once exercised, the data will be duly blocked for the legally required retention period.
Account Management	Managing your registration and user preferences within the registered user area, as well as providing the services you have requested on our website.	Contract execution	Data will not be shared with third parties	For the time necessary to fulfill the contractual relationship and, in any case, during the legally required retention period.
Contact	Handling and properly managing user inquiries, comments, incidents, or suggestions through the available communication channels (phone, email, WhatsApp, etc.).	Consent	Data will not be shared with third parties	2 years from the end of the communication.
Customer Support and Quality Surveys	Managing suggestions, complaints, and inquiries regarding products and/or services purchased through our website.	Legal Obligation / Legitimate Interest	Data will not be shared with third parties	Until the contractual relationship with the customer ends. Once finalized, the data will be duly blocked for the legally required retention period, understood to be sufficient at 10 years.
Consulting	Creating a personalized study and maintaining communication with the user, as well as managing the pre-contractual process until the contract is formalized.	Consent of the data subject and, where applicable, contract execution	Data will not be shared with third parties	Until the contractual relationship with the customer ends. Once finalized, the data will be duly blocked for the legally required retention period, understood to be sufficient at 10 years.
Service Management	Managing the service contracts made through the website or other means (phone, mail, email, WhatsApp, etc.).	Contract execution	Data may be shared with entities, administrative or otherwise, that are legally authorized to request them.	Until the contractual relationship with the customer ends. Once finalized, the data will be duly blocked for the legally required retention period, understood to be sufficient at 10 years.
Contract Verification	Ensuring compliance with legally established obligations and verifying the fulfillment of contractual obligations.	Legal obligation	Competent authorities and organizations that request them.	Until the contractual relationship with the customer ends. Once finalized, the data will be duly blocked for the legally required retention period, understood to be sufficient at 10 years.
User Management and Control	Ensuring proper use of our platform, preventing illicit activities or those contrary to our policies, values, or legal regulations, which may even lead to the removal of a registered user.	Legitimate interest	Data will not be shared with third parties	For the time necessary to fulfill the contractual relationship and, in any case, during the legally required retention period.
Photovoltaic System Monitoring	Monitoring customers' photovoltaic installations and managing their production and consumption data to verify and address possible incidents, failures, or power outages.	Legitimate interest	Data will not be shared with third parties	During the legal obligation retention period, arising from any potential liabilities related to the processing of such data.

On the other hand, if FINREAL SOLUTIONS, S.L is the Data Controller, your personal data will be processed, among other purposes, for the following:

PROCESSING	PURPOSE	LEGAL BASIS	RECIPIENTS	RETENTION PERIOD
Risk Assessment and Monitoring	Evaluate the suitability for granting the requested service through an analysis of your creditworthiness. If your request is denied, you will be duly informed, and we will offer you the possibility of contracting other products or services in line with your capacity.	Execution of the contract	For risk assessment and monitoring, your identification and contact details will be consulted in the ASNEF-EQUIFAX credit information system.	Throughout the operation and, once finalized, for a period of six years.
Claims Defense and Legal Proceedings	All processed data (including recorded calls and videos) by SOTYSOLAR may be used for the formulation and defense of claims, whether judicial or extrajudicial, initiated either by this entity or by you.	Legitimate interest of SOTYSOLAR in exercising legal actions as deemed necessary and defending itself under the right to effective judicial protection.	Courts and Tribunals, public administrations, consumer representation organizations.	Data will be processed as long as the commercial/contractual relationship remains active and for the legal prescription period related to possible liabilities arising from their processing.
Debt Management	If one or more payments are not made, we will contact you (via phone, email, SMS, in-person notifications, private web notifications, or the app) to inform you of the situation. The data will be processed to notify you of the outstanding debt and to facilitate its resolution. For this purpose, we will process all identifying and contact data, personal, economic, and financial characteristics, as well as creditworthiness data and information obtained from public sources.	Execution of the contract	Data will not be shared with third parties unless a legal claim is initiated or communicated to credit information systems (e.g., ASNEF-EQUIFAX). We may delegate collection management to specialized entities that may contact you on our behalf.	Data will be retained while the debt remains unpaid.
Real-Time Monitoring	During the validity of the contract, SotySolar may remotely access the data collected and stored on the platform supporting the project. Specifically, through software designed to display energy production data, potential errors, and other system-related notifications, requiring the processing of the installed system’s geolocation data and authorized access granted by the customer to SotySolar.	Execution of the contract and consent of the data subject	Data will not be shared with third parties.	Data will be retained for the legal prescription period related to any potential liabilities arising from their processing.
Service Management and Maintenance	We will process your data to formalize, manage, and execute the contract. This includes all processes associated with your contract, including its formalization, maintenance, and termination. Specifically, we will process your data for the provision of installation and commissioning services, settlement and payment of installments, and handling inquiries related to the contract, including documentation requests (e.g., submission of insurance policies, licenses, and administrative permits). Additionally, we will use your data to inform you about contractual aspects. These notifications may be derived from legal obligations strictly related to your contract.	Execution of the contract	Data may be shared with administrative or other entities legally authorized to request it.	Throughout the operation and, once finalized, for a period of ten years.

Finally, regardless of who is responsible for the processing, your personal data will be processed, among other things, for the following activities:

PROCESSING	PURPOSE	LEGAL BASIS	RECIPIENTS	RETENTION PERIOD
Commercial Actions	Send regular communications about services, invoices, events, and news related to activities carried out by SOTYSOLAR, through any means, including electronic (phone, email, WhatsApp, etc.).	Consent	Your data may be shared with other companies within the SOTYSOLAR Group.	Until consent is revoked or objection to processing is made.
Video Surveillance Cameras	Implementation of a video surveillance system in the facilities to ensure physical security.	Legitimate interest	Law enforcement agencies	One month from the recording of the images. After this period, the images will be properly blocked for the duration necessary to comply with the statute of limitations for potential data protection infringements.
Legal Data Transfer	Data transfer to organizations and authorities whenever required in accordance with legal and regulatory provisions.	Legal obligation	Competent organizations and authorities that request it.	For as long as necessary to fulfill the contractual relationship and, in any case, during the legally required retention periods.
Inclusion in Credit Information Systems	In the event of non-payment of your installments, if there is a clear, overdue, and enforceable debt that remains unpaid without any judicial, arbitration, or administrative claim, or if a prior payment request has been made (prior notice of inclusion), the non-payment data may be communicated to databases regarding compliance or non-compliance with monetary obligations. Once your data has been reported to the system, you will receive direct communication from them informing you of the inclusion. You can exercise your rights of access, rectification, erasure, restriction, objection, and data portability by contacting SOTYSOLAR or each of the indicated systems. Any claim regarding the existence, age, and amount of the debt should be addressed to SOTYSOLAR.	Legitimate interest of the entities participating in the credit information system. The processing is subject to the provisions of Article 20 LOPDGDD.	ASNEF-EQUIFAX credit information system	Data will be retained for five years unless the debt is settled earlier.
Suppliers	Management of the commercial relationship with the Data Controller’s suppliers and exploration of potential collaborations and optimization of services.	Contract execution	Banks, Savings Banks, Rural Banks, Administration, and public organizations	Until the contractual relationship with the supplier ends. Once concluded, data will be properly blocked for the legal statute of limitations.
Human Resources, Timekeeping, and Similar	Management of the employment relationship with employees (including payroll management).	Contract execution and compliance with legal obligations	Social Security Organizations, Insurance Companies, Banks, Savings Banks, Rural Banks, and Tax Administration	Until the employment relationship with the worker ends. Once concluded, data will be properly blocked for the legal statute of limitations.
Anti-Money Laundering	We will process your data to comply with the legal obligations imposed by Law 10/2010 on the Prevention of Money Laundering and Terrorist Financing. Specifically, identifying and contact data, personal characteristics, and transactions will be processed to: (i) verify your identity by collecting your identity document (DNI or NIE) for consultation if necessary within the contract's framework and/or to comply with the legal identification obligation; (ii) verify the nature of your professional or business activity through your information and the documents provided in the fight against terrorism financing and organized crime, and money laundering prevention; (iii) identify if you are a politically exposed person or hold public responsibility and, if so, apply enhanced due diligence measures in business relationships or transactions with you.	Legal obligation (Law 10/2010 on the Prevention of Money Laundering and Terrorist Financing and its development regulations).	In case of a request or suspicious operation, to the Executive Service of the Commission for the Prevention of Money Laundering, Law Enforcement Agencies, Courts, Tribunals, and competent Administrations.	Throughout the contract's validity and, once concluded, for a period of ten years.
Fraud Prevention	Legitimate interest in preventing possible economic consequences for the company or third parties.	(Law 11/2021, transposing Directive (EU) 2016/1164)	Data may be notified to Courts, Tribunals, and Law Enforcement Agencies in compliance with the legal obligation to report suspected criminal activities.	Data will be processed as long as the commercial/contractual relationship remains active and during the legal prescription period related to potential liabilities arising from their processing.
Ethics Channel	Manage communications received through the internal information system and ensure effective investigation and appropriate action.	Legal obligation	Data may be notified to Courts, Tribunals, and Law Enforcement Agencies in compliance with the legal obligation to report suspected criminal activities.	Files will be retained for a maximum period of 10 years.

5. WHEN WILL WE REQUEST YOUR DATA

-To register you as a customer with SOTYSOLAR.

- To provide any of the services and/or products we offer.

- To address any inquiries, suggestions, complaints, etc., that you send us.

- To comply with legal obligations.

6. WHAT TYPE OF DATA DO WE COLLECT AND WHAT IS ITS SOURCE

At SOTYSOLAR, we process the minimum necessary information to carry out the purposes listed below. It is essential that this data corresponds to your current situation, so if it becomes outdated, you must notify us. In particular, we process the following categories:

Data collected directly from the Customer: These are all the data you provide directly to us through a form, required documents (insurance policies, income certificates, documents required for anti-money laundering control, etc.), data you authorize us to monitor for installation, where applicable, and any data generated as you maintain a relationship with us. The following data is processed:

- Identifying and contact details: Full name, ID/NIE, address, phone number, email address, image, voice.

- Personal characteristics data: Marital status, profession, current job, pension or unemployment, number of children, country of birth, country of residence.

- Economic and financial data: Data for bank direct debit.

- Transaction data: Contracted product, its characteristics (installments, financial conditions), validity, existence of payments or unpaid amounts.

- Sociodemographic data: Age, province, average income, family situation, gender.

- Geolocation data: Project location.

Data collected through third parties: These are all data we obtain from other entities, provided that we have legal justification for doing so.

-Solvency data: Obtained from credit information systems, specifically ASNEF-EQUIFAX.

-Data from public sources: Public records, such as the National Statistics Institute, the Commercial Registry, the Property Registry, and the Land Registry.

Inferred data: We use the results of mathematical models applied to customer data to combat fraud, deduce consumption habits, preferences, or contracting tendencies, comply with regulatory obligations, and manage operations related to their products and/or services.

In financing or installment payment operations, we will infer your payment or non-payment capacity or risk limits by applying statistical mathematical models calculated with your data.

6. YOUR DATA WILL BE COMMUNICATED TO OTHER RECIPIENTS

We guarantee that your data will only be shared with:

-Competent public bodies, Tax Agency, State Security Forces, Judges, and Courts, when required by law.

-Financial entities in the case of financing for the services provided.

-In case of suspicious activity or operational requirements, to the Executive Service of the Anti-Money Laundering Commission.

-Third parties necessary for the provision of the contracted service: transport companies, call centers, subcontracted professionals, equipment suppliers for warranty validation, equipment startup, and monitoring, etc.

Under no circumstances will your personal data be shared with third parties without your prior consent.

7. INTERNATIONAL DATA TRANSFERS

SOTYSOLAR will work with providers who may have access to your data and will process the data on behalf of SOTYSOLAR. The selection of providers follows a strict compliance verification process to ensure proper data protection control. In addition, a contract is signed in which these providers agree to implement appropriate technical and organizational measures, process personal data only according to SOTYSOLAR's documented instructions, and delete or return the data to SOTYSOLAR. SOTYSOLAR will hire third-party service providers that operate in various sectors, including, but not limited to, technology services, physical security, instant messaging, debt management entities, and call centers.

If any of the data processors are located outside the European Economic Area, SOTYSOLAR will sign Standard Contractual Clauses with them to provide adequate guarantees and ensure the protection of your data access at all times.

As the owner of your personal information, you have control over your data. This ensures that the information is accurate and truthful.

8. HOW TO EXERCISE YOUR RIGHTS

The rights you can exercise are:

-Right of Access: You can consult whether we are processing personal data that concerns you at SOTYSOLAR.

-Right of Rectification and Deletion: You can access your personal information and request the rectification or deletion of your data when it is inaccurate or when you consider that it is no longer necessary for the purposes for which it was collected.

-Right to Object: You can object to the processing of your data unless, for overriding legitimate reasons or for the exercise or defense of potential claims, we keep it properly blocked during the corresponding periods as long as legal obligations remain.

-Right to Restriction of Processing: You can request the restriction of the processing of your personal information while the accuracy or lawfulness of your data is being verified, or during the exercise or defense of potential claims or litigations.

-Right to Data Portability: You can request the portability of the data you provided to another data controller in certain circumstances.

You can exercise your rights free of charge. To exercise any of the rights listed here, you can do so by contacting SOTYSOLAR at rgpd@sotysolar.es, specifying the exercised right and attaching a copy of your ID or NIE to help locate you in our systems and validate your identity.

How to file a complaint with the Control Authority?

If a user believes there is an issue with how SOTYSOLAR is handling their data, they can direct their complaints to the Privacy Committee (rgpd@sotysolar.es) or to the relevant data protection authority, with the Spanish Data Protection Agency being the designated authority in Spain.

9. VERIFICATION OF CONTRACTOR IDENTITY

SOTYSOLAR, in compliance with its duty to guarantee the security and legitimacy of contractual relationships, reserves the right to request the CONTRACTOR to present their National Identity Document (DNI) or any other equivalent official document that allows full identification of the contract holder(s).

This measure is adopted based on the legitimate interest of the company to prevent fraud, avoid potential identity theft, and protect both the CONTRACTOR's and the company’s interests. The processing of data obtained under this provision will comply with the applicable data protection regulations, ensuring the security, confidentiality, and integrity of the provided information.

10. SECURITY

At SOTYSOLAR, we maintain the highest levels of security required by law to protect your personal data against accidental loss and unauthorized access, processing, or disclosure, taking into account the state of technology, the nature of the stored data, and the risks to which they are exposed. When we receive your data, we use strict security procedures and functions to prevent unauthorized access.

The actions described in this section, aimed at ensuring an adequate security level for the detected risks, may include, if necessary, the following measures:

1. Pseudonymization and encryption of personal data.

2. Measures to ensure the confidentiality, integrity, availability, and permanent resilience of treatment systems and services.

3. Measures to quickly restore the availability and access to personal data in case of a physical or technical incident.

4. The existence of a regular verification, evaluation, and assessment process of the effectiveness of technical and organizational measures to ensure treatment security.

5. Periodic assessment of the risk of accidental or unlawful destruction, loss, alteration, or unauthorized disclosure or access to personal data transmitted, stored, or otherwise processed.

6. Measures to ensure that anyone acting under SOTYSOLAR's authority and accessing personal data only processes such data following SOTYSOLAR's instructions.

11. CONFIDENTIALITY

The personal data that may be collected will be processed with the utmost confidentiality, and we commit to keeping it secret and ensuring its protection by adopting all necessary measures to prevent its alteration, loss, or unauthorized access, in accordance with applicable laws.

12. ACCEPTANCE AND CONSENT

The user declares that they have been informed of the personal data protection conditions and consents to the processing of their data by SOTYSOLAR in the manner and for the purposes indicated in this privacy policy.

13. CHANGES TO THE PRIVACY POLICY

SOTYSOLAR reserves the right to modify this policy to adapt it to legislative or jurisprudential developments, as well as sector practices. In such cases, SOTYSOLAR will announce the changes made on this page reasonably in advance before their implementation.

14. COMMERCIAL EMAILS

In accordance with Law 34/2002 on Information Society Services and E-commerce, SOTYSOLAR commits to not sending commercial communications without proper identification.

15. RESPONSIBILITY

The user is solely responsible for completing forms with false, inaccurate, incomplete, or outdated data.

16. COOKIES

Our website uses "cookies" to collect information about how the website is used.

We use our own and third-party cookies to allow navigation, personalize content and ads, analyze traffic, and ensure the proper functioning of your session. Additionally, we collect location data and device features. For more information about cookies, please consult our cookie policy.

Regarding third-party cookies, in particular, this website uses Google Analytics, a web analytics service provided by Google, Inc., based in the United States. For the provision of these services, Google uses cookies that collect information, including the user's IP address, which will be transmitted, processed, and stored by Google under the terms outlined here: https://policies.google.com/technologies/partner-sites and here: https://marketingplatform.google.com/about/analytics/terms/es/, including the possible transmission of such information to third parties for legal reasons or when third parties process the information on behalf of Google.

By accessing or using our website, you agree to the practices described in this policy.

-Collection of personal data:
Our website uses services provided by Google, and as a result, Google may collect certain personal data in accordance with the terms and conditions outlined in their privacy policy. We recommend reviewing Google's Privacy Policy at the following link: https://policies.google.com/technologies/partner-sites

-Use of personal data:
Google uses the information collected through our website in accordance with the terms and conditions outlined in their privacy policy. We encourage you to review the specific details about how Google uses personal data.

Updated on 19/02/2025

Privacy Policy of BE ENERGY PART S.L. (SOTYSOLAR)

Cookies from SotySolar