Privacy policy

Data controller

Richard Ward (autónomo), NIF Y3885845D, Lugar Cortijo Cañada Honda, ap. C, El Margen, 18891 Cúllar, Granada — info@enerva.dsl4.com

What data we process and why

• Account: email, name (if you provide it) and a hashed password — to create and manage your account (Art. 6.1(b) GDPR, contract performance).

• Electricity bill: if you upload a photo/PDF, scan your bill's QR code, or enter it manually, we process the CUPS supply code, contracted power, tariff, retailer, consumption, billed amounts and — when present on the bill — the supply-point holder's tax ID and name and postal code, to run your audit and find savings (Art. 6.1(b) GDPR, pre-contractual steps).

• Datadis, only with your explicit authorization: if you connect Datadis, we access your hourly consumption curve and real maximum power directly from the regulated consumption-data access point. The authorization expires (max. 2 years) and you can revoke it at any time from your Datadis account (Art. 6.1(a) GDPR, consent).

• Assisted switch (LOA authorization): if you accept an actionable recommendation (lower power, switch tariff or retailer, drop an add-on service), we store the exact authorization text you sign — with a SHA-256 fingerprint of its content — and an immutable snapshot of your prices and consumption at that moment, so the real saving can later be verified (Art. 6.1(b) GDPR).

• Payment, on the paid concierge tier once it is active: if you take up that tier, the charge is processed by Stripe Payments Europe, Ltd. as our processor; this site never stores your full card number (Art. 6.1(b) GDPR).

• Communications: we use your email for case confirmations, Datadis authorization notices and contract-monitoring alerts, once live email sending is active (Art. 6.1(b) GDPR).

• Usage analytics: we count, in aggregate and without cookies, how many times each funnel step completes (audit submitted, results viewed, recommendation shown, checkout started/completed) using first-party daily counters (day + event + a count). We do not log your IP, identity, or any per-visitor row — this is not personal data and requires no consent.

Recipients and processors

• Vercel Inc. — application hosting.

• Neon, Inc. — database.

• Datadis and your electricity distributor — only if you connect Datadis, and only with your explicit, revocable authorization.

• Stripe Payments Europe, Ltd. — payment processing, once the paid tier is active.

• Resend — transactional email delivery, once live sending is active.

• The target electricity retailer — only when submitting a switch authorization (LOA) that you have signed.

We never sell or share your data with third parties for marketing, and you will not receive unsolicited sales calls — a condition you explicitly accept before any assisted switch.

Retention periods

• Account and audits: for as long as your account stays active; you may request deletion at any time.

• Datadis authorization: up to 2 years or until you revoke it; consumption data already obtained during the authorization is kept as historical record even after it expires or is revoked.

• Switch authorizations (LOA) and switch cases: for the life of the case plus the applicable statutory tax/contractual retention period.

Your rights

You may exercise your rights of access, rectification, erasure, objection, restriction and portability by writing to info@enerva.dsl4.com or legal@dsl4.com. You may also lodge a complaint with the Spanish data protection authority (aepd.es).

International transfers

If any of our processors (e.g. Stripe) transfers data outside the European Economic Area, it does so under the European Commission's standard contractual clauses or another equivalent safeguard.