GridLab Energy Management System
Menu

PRIVACY TERMS

AND PROCESSING OF PERSONAL DATA

1. GENERAL PROVISIONS

1.1. These Terms of Confidentiality and Personal Data Processing (hereinafter referred to as the "Terms") are a public announcement from Grid Labs Software Limited Liability Company (hereinafter referred to as the "Company") to an unspecified circle of personal data subjects who in one way or another enter into relations with the Company about the basic principles, rules and precautions when processing their personal data by the Company.

1.2. By announcing these Terms, the Company pursues the goal, in compliance with the requirements of the Constitution of Ukraine, legislation in the field of information in general and in particular the Laws of Ukraine (as amended and supplemented) "On Personal Data Protection", "On Information", "On Information Protection in Information and Telecommunications Systems" - to ensure transparency in the processing of personal data of all persons interacting with the Company and the "GridLab EMS" software complex.

1.3. These Terms describe the practices of collecting and processing personal data provided by individuals (hereinafter referred to as the "User") in connection with access to the "GridLab EMS" software package (hereinafter referred to as the "Software Package"), owned by Grid Labs Software Limited Liability Company, EDRPOU code 46270016.

1.4. These Terms are a public document and are posted on the Company's website https://gridlab.com.ua/. The Terms may be updated by the Company in the manner specified in Section 9 of these Terms.

2. DEFINITION

2.1. All definitions given in these Terms and Conditions and not described in this section have the same meaning as in the Agreement on the provision of services for access to the "GridLab EMS" software complex, concluded between the Company and the customer of the services (hereinafter referred to as the Agreement).

In these Terms, the following terms are used with the following meanings:

2.2. Personal database - a named set of organized personal data in electronic form and/or in the form of personal data files. The personal database in which the Company processes personal data is called "GridLab EMS - Clients and Users".

2.3. The owner of personal data is Grid Labs Software LLC, which lawfully receives and processes personal data provided by Users, and determines the purpose of processing personal data, establishes the composition of this data and the procedures for its processing, unless otherwise specified by law.

2.4. Consent of the personal data subject is a voluntary expression of will by an individual to grant permission for the processing of his or her personal data in accordance with the stated purpose of their processing.

2.5. Processing of personal data - any action or set of actions performed in whole or in part in an information (automated) system and/or in personal data filing systems, which are related to the collection, registration, accumulation, storage, adaptation, modification, renewal, use and dissemination (dissemination, sale, transfer), depersonalization, destruction of information about an individual.

2.6. Personal data - information or a set of information about an individual who is identified or can be specifically identified.

2.7. Personal data processor - a person who is granted the right by the personal data owner or by law to process this data on his behalf.

The company - Limited Liability Company "Grid Labs Software" (EDRPOU code 46270016, address: Ukraine, 04053, Kyiv, Kyyanivskyi Str., building 3-7, office 110 B, e-mail address: office@gridlab.com.ua) - is the controller of personal data for the purposes specified in Section 5 of these Terms and Conditions, and the controller of personal data for the personal data of authorized users of the customer of the services, which are processed on behalf of such customer in accordance with the Agreement concluded with him.

2.8. Personal data subject - an individual whose personal data is processed in accordance with these Terms.

2.9. Software package - the software package "GridLab EMS" developed by the Company, which includes server software, mobile applications (iOS and Android), web interface, API and related components.

2.10. Depersonalized data - personal data processed in such a way that it is impossible to directly or indirectly link them to a specific individual.

3. LAWFULNESS OF PROCESSING AND BASIC PRINCIPLES OF PROCESSING PERSONAL DATA

3.1. The Company processes personal data based on the Consent of the personal data subject, fulfillment of contractual obligations and legitimate interests of the Company in accordance with Article 11 of the Law of Ukraine "On Personal Data Protection".

3.2. Consent is deemed to be given after the User has signed the relevant Consent to the processing of personal data or has checked the relevant box when registering in the Software Complex or on the Company's website.

3.3. By providing Consent, the User confirms and accepts all terms and conditions specified in these Terms.

3.4. The processing of personal data by the Company is carried out on the basis of the following principles:

  • the lawfulness of the purposes and methods of processing personal data;
  • the Company's integrity as a personal data controller - is achieved by fulfilling the requirements of the legislation of Ukraine regarding the processing of personal data;
  • achieving specific, predetermined purposes of processing personal data;
  • compliance of the purposes of processing personal data with the purposes previously determined and stated when collecting personal data;
  • compliance of the list and volume of processed personal data, as well as the methods of their processing, with the stated purposes of processing;
  • the accuracy of personal data, their adequacy for the purposes of processing, the inadmissibility of processing personal data that is excessive in relation to the purposes of processing;
  • storing personal data in a form that permits identification of the personal data subject for no longer than is required for the purposes of their processing;
  • destruction or depersonalization of personal data after achieving the purposes of processing or in the event of the loss of the need to achieve them, unless otherwise provided for by the legislation of Ukraine.

3.5. The Company does not process personal data relating to racial or ethnic origin, gender identity, political, religious or philosophical beliefs, membership in political parties and trade unions, criminal convictions, as well as data relating to health, sexual life, biometric and genetic data.

3.6. The Company collects and processes personal data to fulfill its obligations and pursue legitimate interests, namely:

  • identification and verification of the User to provide access to the Software Complex;
  • conclusion and execution of agreements on the provision of access services to the Software Complex;
  • providing technical support and resolving disputes;
  • sending service messages;
  • informing Users about actions in the Software Complex, technical outages, updates and other events affecting interaction with the Software Complex;
  • compliance with the requirements of the current legislation of Ukraine;
  • increasing the productivity and functionality of the Software Complex;
  • improving the algorithms of the Software Complex based on depersonalized telemetric data.

4. COMPOSITION OF PERSONAL DATA PROCESSED BY THE COMPANY

4.1. Information about the subject of personal data reflected in transactions and information (automated) systems of the Company is personal data processed in the personal data database "GridLab EMS - Clients and Users".

4.2. The following personal data are processed in the specified database:

1) Personal and contact details of the User:

  • –surname and first name of the person;
  • –contact phone numbers;
  • –email address;
  • –position and name of the employer (for representatives of legal entities - Customers).

2) Account details in the Software Complex:

  • –login (username) in the Software Complex;
  • –a note about two-factor authentication.

3) Information about the legal entity - the Customer, provided by the User:

  • –surname, first name and patronymic of persons authorized to perform transactions on behalf of the Customer;
  • –registration number of the taxpayer registration card of the signatories of electronic documents;
  • –Customer's bank details (exclusively for non-cash payments);
  • –data on real estate and energy equipment owned by the Customer or used by it on legal grounds;
  • –terms of the contracts concluded by the Customer with the Company.

4) Technical data collected automatically:

  • During authorization and use of the Software Complex by the User, as well as in the process of communication with the User, the Company receives the following information:
  • –User's IP address;
  • –information received during communication with the Company - electronic correspondence;
  • –information about the device used to access the Software, including software and hardware data;
  • –information about the User's activity in the Software Complex - data about actions with date and time.

5) Equipment telemetry data:

  • Technical parameters of the Customer's energy equipment (power, voltage, current, temperature, system status, SoC, etc.) transmitted through the Software Complex are, as a rule, technical parameters of the equipment and do not contain personal data. If such data can be associated with a specific individual, they are processed in accordance with these Terms. Depersonalized telemetry is used by the Company for the operation of the Software Complex and training of AI models.

5. PURPOSE AND LEGAL GROUNDS FOR PROCESSING PERSONAL DATA

5.1. The Company processes personal data exclusively for lawful, clearly defined and legitimate purposes in accordance with Article 11 of the Law of Ukraine "On Personal Data Protection":

  • conclusion and performance of a contract for the provision of services - on the basis of the performance of the contract (Article 11 of the Law); identification, contact and payment data are processed;
  • providing access to the Software Complex and authenticating the User - based on the execution of the contract and the consent of the subject; account data and data on the use of the User's equipment are processed;
  • technical support and troubleshooting - based on the execution of the contract; contact data, log files and data on the use of the User's equipment are processed;
  • ensuring the security of the Software Complex and preventing unauthorized access - legal requirements; account data, IP address are processed;
  • informing about updates, technical outages and changes in functionality - based on the execution of the contract; contact details and data about the User's equipment are processed;
  • improvement of the Software Complex; only depersonalized telemetric data that does not identify a person is processed.

5.2. The Company does not process personal data for purposes incompatible with the above purposes, without notifying the Subject and/or obtaining his/her additional consent.

6. PROCEDURE FOR STORAGE AND PROTECTION OF PERSONAL DATA

6.1.Personal data is stored in the Company's databases hosted on cloud infrastructure with the following protection measures:

  • transmission channel encryption - TLS 1.2/1.3 for all external traffic, mandatory redirection to HTTPS, HSTS policy (2 years, including subdomains, preload);
  • password hashing - bcrypt with a complexity factor of 12; passwords are not stored or transmitted in the clear, and cannot be recovered;
  • encryption of individual categories of data in the database - symmetric AES-128-CBC encryption with HMAC-SHA-256 integrity control (Fernet scheme) for two-factor authentication secrets, access keys to external systems and service passwords for integrations; encryption keys are stored outside the database in environment variables with the possibility of scheduled rotation;
  • session tokens - stored exclusively as irreversible SHA-256 hashes, with a limited validity period and the possibility of remote revocation;

6.2.Personal data retention periods:

6.2.1. Contract and accounting documentation data - 3 years after the expiration of the statute of limitations or in accordance with the requirements of the Civil Code of Ukraine;

6.2.2. Account data and data on the use of the Software Complex - During the term of the agreement and for an additional 30 days after its termination;

6.2.3. Telemetry in operational access - Throughout the entire term of the contract without limitation (without depersonalization);

6.2.4. Depersonalized telemetry that does not identify a person – Indefinitely.

6.3.After the expiration of the storage period, personal data is destroyed or depersonalized in accordance with the requirements of Article 15 of the Law of Ukraine "On Personal Data Protection".

7. TRANSFER OF PERSONAL DATA TO THIRD PARTIES

7.1.The Company does not transfer personal data to third parties without the knowledge of the Subject, except in the following cases:

7.1.1.Contractors and service providers (personal data processors). The Company may engage third parties to provide cloud infrastructure, hosting, analytics, and support services (hereinafter referred to as contractors). Contractors process personal data solely on behalf of and in the interests of the Company, to the extent and for the purposes specified in the relevant agreements, in accordance with Articles 4 and 10 of the Law of Ukraine "On Personal Data Protection". The Company obliges contractors to comply with the requirements of the legislation on personal data protection.

7.1.2.Compliance with legal requirements. Personal data may be provided to government agencies upon their lawful request in accordance with the current legislation of Ukraine.

7.2.The company does not sell personal data or transfer it for use for advertising purposes by third parties.

8. COOKIES AND TRACKING TECHNOLOGIES

8.1.The Company's Website and Software may use cookies and similar technologies to:

  • ensuring the operation of the service (mandatory cookies);
  • saving User settings.

8.2.The user can manage cookie settings through the browser. Disabling mandatory cookies may affect the functionality of the Software Complex.

8.3. The site uses only technically necessary cookies, which are required for authentication, maintaining the user session, two-factor authentication and saving the selected interface language. Authentication cookies are set with the attributes HttpOnly (not available for client scripts), Secure (transmitted only over a secure HTTPS connection) and SameSite=Lax (not transmitted to third-party resources), with a validity period of up to 7 days. The company does not use analytical, advertising or marketing cookies, does not use third-party tracking systems and does not transfer data on user behavior to third parties.

9. CHANGES TO THE TERMS

9.1.The Company has the right to make changes to these Terms. Subjects will be notified of any significant changes:

  • by posting a new version of the Terms on the Company's website;
  • by sending a message to an email (if available);
  • by displaying a message in the Software Complex.

9.2.Continued use of the Software Complex after the changes come into force is considered acceptance of the new version of the Terms. If the Subject does not agree with the changes, he has the right to stop using the Software Complex and contact the Company with a request to delete personal data.

10. RIGHTS OF THE PERSONAL DATA SUBJECT

10.1. Rights of the Personal Data Subject:

  • to know about the sources of collection, location of their personal data, purpose of their processing, location or place of residence (stay) of the owner or manager of personal data or to give the appropriate instruction to obtain this information to persons authorized by him, except for cases established by law;
  • receive information about the conditions for providing access to personal data, in particular information about third parties to whom his personal data is transferred;
  • to access your personal data;
  • receive no later than thirty calendar days from the date of receipt of the request, except in cases provided for by law, a response on whether his personal data is being processed, as well as receive the content of such personal data;
  • submit a reasoned request to the personal data controller objecting to the processing of their personal data;
  • to submit a reasoned request for the modification or destruction of their personal data by any controller and processor of personal data if these data are processed unlawfully or are inaccurate;
  • to protect their personal data from unlawful processing and accidental loss, destruction, damage due to intentional concealment, failure to provide or untimely provision of such data, as well as to protect against the provision of information that is unreliable or defamatory of the honor, dignity and business reputation of an individual;
  • to file complaints about the processing of their personal data with the Commissioner or the court;
  • apply legal remedies in case of violation of personal data protection legislation;
  • to make reservations regarding the restriction of the right to process their personal data when providing consent;
  • withdraw consent to the processing of personal data;
  • know the mechanism of automatic processing of personal data;
  • to protect against automated decision-making that has legal consequences for him/her.

11. CONTACT INFORMATION AND FINAL PROVISIONS

11.1.For questions regarding the processing of personal data and the exercise of the rights of personal data subjects, please contact:

  • Person responsible for personal data protection: Director of Grid Labs Software LLC
  • Email: office@gridlab.com.ua.
  • Address: 04053, Kyiv, Kyyanivskyi Avenue, building 3-7, office 110 V.

11.2.These Terms and Conditions shall enter into force from the date of their approval by order of the Company and posting on the Company's website and shall remain in force until their new version is approved.

11.3.In the part not regulated by these Terms, the provisions of the Law of Ukraine "On Personal Data Protection" and other current legislation of Ukraine shall apply.