LEGAL
Privacy Policy
How we handle personal data on the Energie Software platform.
Last updated: July 2026 · Governed by Dutch law and the GDPR (AVG).
At a glance
| Data type | Purpose | Legal Basis | Retention |
|---|---|---|---|
| Account & Contact | Service delivery | Agreement | Until 30 days after account closure |
| Meter Data | Service delivery, EDSN market communication | Agreement, Legal obligation | 7 years (Dutch fiscal requirement) |
| Payment Data | Invoicing & SEPA | Agreement | 7 years (Dutch fiscal requirement) |
| Technical & Usage Data | Fraud prevention & security | Legitimate interest | Duration of the security relevance of the log |
| Analytics (GA4) | Understanding site usage, after consent | Legitimate interest, via consent | Until consent is withdrawn |
This table is a summary. The sections below set out the full detail and are authoritative.
Controller & Processor
For personal data of energy-supplier customers processed through this Platform (contract, meter, billing and payment data), Energie Software acts as data processor on behalf of the energy supplier, who is the data controller, under a data processing agreement (verwerkersovereenkomst) in accordance with the GDPR.
For personal data of its own website visitors, prospects and platform account holders (such as staff accounts and demo requests), Energie Software is the data controller.
The controlling entity is: Pinuno, Denebstraat 24, 3204 AJ Spijkenisse, Nederland · Chamber of Commerce (KvK) 59099828 · VAT (BTW) NL002441677B39.
What Data We Collect
We collect and process the following categories of personal data:
Account & Contact
Name, e-mail address, customer ID, address.
Meter Data
EAN code, meter readings, consumption history.
Payment Data
SEPA mandate, IBAN, payment history.
Technical & Usage Data
Login times, sessions, activity logs, reCAPTCHA score, error logs.
Purposes & Legal Basis
| Purpose | Legal Basis | Explanation |
|---|---|---|
| Service delivery | Agreement | Delivering energy supply and platform services under your contract. |
| Invoicing & SEPA | Agreement | Invoicing and SEPA direct debit collection. |
| EDSN market communication | Legal obligation | Meter switch and market messaging required by Dutch energy market regulation. |
| ACM reporting | Legal obligation | Regulatory reporting to the Authority for Consumers and Markets. |
| Fraud prevention & security | Legitimate interest | Detecting fraud and keeping the Platform secure. |
| Analytics (GA4) | Legitimate interest, via consent | Understanding site usage; only active after consent. |
| Newsletter | Consent | Optional marketing communications. |
Data Retention
We retain personal data for as long as necessary to fulfil the purposes for which it was collected, or as required by law. Meter and billing data is retained for 7 years in accordance with Dutch fiscal requirements. Account data is deleted within 30 days of account closure upon request.
Security
How we keep your data secure:
TLS / HTTPS
All traffic between your browser and the Platform is encrypted.
Bcrypt Password Hashing
Passwords are never stored in plain text.
Secure Sessions
Session cookies use HttpOnly, Secure and SameSite protections.
Login Rate Limiting
Repeated failed login attempts are automatically throttled.
reCAPTCHA
Google reCAPTCHA Enterprise protects public forms against automated abuse.
EU/EEA Hosting
server infrastructure located within the EU/EEA
Role-Based Access Control
Staff access is restricted by role within the back-office.
Your Rights
Under the GDPR, you have the right to:
- Access the personal data we hold about you
- Rectify inaccurate or incomplete data
- Request erasure of your data (right to be forgotten)
- Object to or restrict certain processing activities
- Receive your data in a portable, machine-readable format
- Withdraw consent at any time where processing is based on consent
We aim to respond to rights requests within one month, as required by the GDPR.
To exercise your rights, use the GDPR request form in your account settings, or contact us at info@pinuno.nl.
Data Sharing & Sub-processors
We share personal data with the following parties only where necessary:
| Party | Purpose | Data Shared |
|---|---|---|
| EDSN | Dutch energy data network for meter switch and market messaging | EAN, meter readings, switch data |
| ACM | Dutch Authority for Consumers and Markets, for regulatory compliance reporting | Aggregated compliance reporting data |
| Payment processors | for SEPA direct debit collection | IBAN, SEPA mandate, payment history |
| Hosting providers | server infrastructure located within the EU/EEA | All platform data (EU/EEA hosted) |
| Analytics (GA4) | Understanding site usage, after consent | Anonymised usage data |
We do not sell personal data to third parties.
Cookies
This Platform uses session cookies required for authentication and security. No third-party tracking or advertising cookies are used.
Google reCAPTCHA Enterprise is used on public forms and may set cookies as part of its fraud-detection service; see Google's Privacy Policy for details.
Changes to this Policy
We will announce material changes to this policy on this page and, where appropriate, by email.
Contact & Complaints
For privacy questions, contact us at info@pinuno.nl. You have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.