Privacy policy

1. Data controller

We process your personal data in accordance with the GDPR (EU 2016/679) and Spanish Organic Law 3/2018 (LOPDGDD).

• Controller: Sysefen Group 2024 S.L. (NIF B55450407)
• Address: Carrer de Joan Mascaró i Fornés, 10, 07010 Palma (Illes Balears), España
• Email: info@sysefen.com · Phone: +34 696 28 40 58
• Data protection officer (DPO): dpo@grupox3.es

2. Data we process

• Contact and quote form: name, phone, email, town, service of interest, message, language and page used.
• Online studies (solar and heat pump): property address or location, the roof outline and area you draw, home size and features, current heating system, approximate bill, property type, whether you own it and when you plan to install. The on-screen calculation stores no personal data; it is only recorded if you send us the study with your contact details. Addresses you type are looked up with the IGN CartoCiudad service and coordinates (without personal data) with the European Commission’s PVGIS.
• Phone, email or WhatsApp contact: the data and content you provide.
• Customers: data needed for the study, installation, permits and grant applications (supply address, CUPS, energy bills, land registry, tax and bank details where a grant requires them).
• Browsing: IP address and technical data logged by the server for security and, only with your consent, usage statistics (see cookie policy).

3. Purposes and legal bases

• Handling your request, contacting you, visiting the property and sending a quote — pre-contractual steps at your request (Art. 6(1)(b) GDPR).
• Recording and following up your request in our CRM — pre-contractual steps and our legitimate interest in organising our sales activity (Art. 6(1)(b) and (f)).
• If you hire us: carrying out the installation, maintenance and warranty, permits and grant applications — performance of contract and legal obligations (Art. 6(1)(b) and (c)).
• Sending customers information about similar products and services, and asking for their feedback on the installation — legitimate interest (Art. 6(1)(f) GDPR and Art. 21.2 LSSI-CE). You can object at any time.
• Website security and spam prevention — legitimate interest (Art. 6(1)(f)).
• Usage statistics with Google Analytics, only if you accept — consent (Art. 6(1)(a)), which you may withdraw at any time.

4. Retention

Requests that do not lead to a contract are kept for up to 2 years from the last contact. Customer data is kept for the duration of the relationship and afterwards for the legal periods (6 years commercial, 4 years tax) and the warranty period. Server logs are kept for up to 12 months.

5. Recipients

We do not sell or share your data. It is only disclosed where necessary:

• Public authorities (town halls, Balearic Government, Spanish Tax Agency, grant bodies) and the electricity distribution company, to legalise installations and apply for grants, if you hire us.
• Equipment manufacturers, to register warranties and enable monitoring, if you hire us.
• Processors under Art. 28 GDPR contracts: IONOS (hosting and email, EU) and Teamleader (CRM, EU).
• Cloudflare, Inc. (Cloudflare Turnstile), to protect our forms against spam and bots: it analyses technical browser signals and the IP address when a form is sent, without advertising or tracking cookies. Legal basis: legitimate interest in website security (Art. 6(1)(f) GDPR). Cloudflare participates in the EU-US Data Privacy Framework.
• Google Ireland Ltd., only if you accept analytics cookies or load the map, and Meta Platforms Ireland (WhatsApp), only if you choose to message us there.

6. International transfers

Our main providers process data within the EU. Google and Meta may transfer data to the United States under the EU-US Data Privacy Framework and the European Commission’s standard contractual clauses.

7. Your rights

You may exercise your rights of access, rectification, erasure, objection, restriction and portability, and withdraw consent, by writing to info@sysefen.com or dpo@grupox3.es. We may ask you to verify your identity. You may also lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

8. Accuracy, minors and security

Please provide accurate data. If you give us another person’s data, you confirm you have informed them and have their authorisation. Our forms are not intended for children under 14. We apply appropriate security measures, including HTTPS encryption, restricted access and storage of credentials outside the public area of the server.