Legal · Privacy
Privacy Policy
1 · Who we are
The controller of your personal data is EnergySignal s.r.o., IČO 29784301, registered in the Commercial Register kept by the Municipal Court in Prague, File No. C 452338, with its registered seat at Na Folimance 2155/15, Vinohrady, 120 00 Praha 2, Czech Republic. You can reach us at info@energysignal.io for any privacy matter.
2 · What we collect and why
We keep collection narrow. Depending on how you interact with us, we process:
Contact correspondence. If you email or call us: your name, contact details, and the content of the exchange. Purpose: responding and managing the business relationship. Legal basis: our legitimate interest in communicating with our contacts and managing our business relationships, or steps taken prior to entering into a contract.
Business contacts received from partners. In the course of our brokerage business we may receive the name, role, and business contact details of counterparty personnel from our business partners and introducers. Purpose: making introductions and managing the resulting relationships. Legal basis: our legitimate interest in conducting our brokerage business. Where we receive your details from a partner in this way, we direct you to this policy when we first contact you. We do not send commercial communications to contacts received this way unless they have separately given us their prior consent; our legitimate interest in making introductions does not extend to marketing.
Sanctions and integrity screening. Before an engagement begins, and periodically during it, we screen counterparties and individuals connected with them, such as directors, beneficial owners, and authorised signatories, against applicable sanctions lists. We process the name, date of birth and nationality where available, role, and the screening result. The scope and frequency of screening are set by our internal risk assessment. Purpose: complying with sanctions law and avoiding the provision of services that are prohibited or restricted under an applicable sanctions regime. Legal basis: compliance with a legal obligation to which we are subject, under Act No. 69/2006 Sb., Act No. 1/2023 Sb., and the directly applicable sanctions regulations of the European Union.
Access requests and acceptance records. If you request model access under our Terms and Conditions of Model Access: first name, last name, email address, the terms version you accepted, a timestamp, and the IP address from which the acceptance was sent. Purpose: granting access and evidencing acceptance of the terms. Legal basis: performance of a contract and our legitimate interest in establishing, exercising, and defending legal claims.
Authenticated access data. When you sign in to a protected area: your email address and sign-in events, processed through our access-control provider. Purpose: security and ensuring each person sees only what they are authorised to see. Legal basis: our legitimate interest in network and information security, and performance of a contract.
Model feedback. If you send a note through a model's feedback panel: your name, your message, and the model settings at the time of sending, together with your verified access identity. Purpose: responding to your question and developing the engagement. Legal basis: performance of a contract and our legitimate interest in improving our services.
Consent records for commercial communications. If you opt in to receive commercial communications from us: your email address, the wording you accepted, a timestamp, and the IP address from which the opt-in was sent. Purpose: sending you the communications you asked for, and demonstrating that you consented. Legal basis: your consent. You can withdraw it at any time, using the unsubscribe link in any message or by writing to info@energysignal.io, and withdrawal does not affect the lawfulness of anything we did before it.
Accounting and tax records. Where we invoice you or you invoice us: name, business contact details, bank details, and invoice and payment records. Purpose: meeting our statutory accounting and tax obligations. Legal basis: compliance with a legal obligation to which we are subject.
Technical data. Our hosting infrastructure processes IP addresses and request logs for delivery and security. Purpose: operating and protecting the site. Legal basis: our legitimate interest in network and information security.
Providing your data with an access request is a contractual requirement, and without it we cannot grant access. Everything else you provide voluntarily.
3 · What we do not do
We do not run advertising or marketing trackers, we do not sell or share personal data for marketing, and we do not use analytics cookies. We do not make automated decisions with legal effect about you.
4 · Cookies and local storage
The public site sets no tracking cookies. Three narrow exceptions exist: a preference stored on your own device, solely at your request, to remember your dark or light theme choice (never transmitted to us); strictly necessary authentication cookies set by our access-control provider when you sign in to a protected area; and strictly necessary security cookies set by our infrastructure provider (Cloudflare) to protect the site against abuse and to distinguish automated from human traffic. Under § 89(3) of Act No. 127/2005 Sb., on electronic communications, storage that is strictly necessary or provided solely at your explicit request does not require consent, so no cookie banner is shown.
5 · Who processes data for us
We use a small number of infrastructure providers acting as processors: Cloudflare, Inc. for hosting, content delivery, access control, and storage of access and acceptance records, and Google Ireland Limited (Google Workspace) for business email. Web fonts are self-hosted: loading a page does not transmit your IP address to any third-party font provider.
Where we exchange business contact details with counterparties under a non-disclosure or brokerage agreement, each party processes that data as an independent controller. Neither acts as the other's processor.
6 · International transfers
Some of our providers are established in, or route data through, the United States. Where personal data leaves the European Economic Area, it is protected by recognised safeguards: the EU-US Data Privacy Framework where the recipient is certified under it, and standard contractual clauses otherwise or in addition. You can request a copy of the relevant safeguards at info@energysignal.io.
7 · How long we keep data
Correspondence is kept for the duration of the relationship and up to four years after our last contact, unless a longer period is needed for legal claims. Acceptance records are kept for the duration of the engagement and for the limitation periods applicable to legal claims, generally three to ten years under Czech law. Access and security logs are kept on short rotation, typically no longer than 90 days. Records we must keep under accounting and tax law are retained for the statutory periods, generally five to ten years. When data is no longer needed, it is deleted.
8 · Your rights
Under the GDPR you can request access to your data, rectification, erasure, restriction of processing, and portability, and you can object to processing based on our legitimate interests. Where we process data on the basis of your consent, you can withdraw that consent at any time, and withdrawing it does not affect the lawfulness of processing carried out beforehand.
You have the right to object at any time to the processing of your personal data for direct marketing. If you object, we will stop using your data for that purpose immediately. You can object by using the unsubscribe link in any message or by writing to info@energysignal.io.
Write to info@energysignal.io and we respond within one month; for complex requests we may extend this by a further two months and will tell you if so. You also have the right to lodge a complaint with the Czech supervisory authority, the Úřad pro ochranu osobních údajů (uoou.gov.cz), or with the supervisory authority of your habitual residence.
9 · Changes
If this policy changes, the new version is published here with an updated effective date. Material changes affecting active counterparties are notified directly.