Privacy Policy

1. Data controller

Enertecma S.L.(“Enertecma”, “we”, “us”), operating the EnergyData Iberia service, is the data controller responsible for processing your personal data.

• Legal name: Enertecma S.L.
• Tax ID (CIF): B-80786072
• Registered office: Calle Abetos 7, Urb. Los Berrocales, Alpedrete, Madrid 28430
• Contact: dpo@energydataiberia.com

2. Data we collect

We collect the minimum data necessary to provide the service. The data we touch differs depending on whether you use the website or the Excel add-in.

2.1 Through the website (energydataiberia.com)

• Email address — Account creation and authentication. Stored in Supabase Auth.
• Payment information — Subscription billing (processed by Stripe; we do not store card details). Stripe is the controller of payment data.
• API usage counters — Rate limiting and plan enforcement (request counts keyed by API key, not by personal identifiers).
• Cookies and analytics data — Site improvement (only with your consent). See §5.

2.2 Through the Excel add-in

The add-in is a thin client. It sends your API key (license credential) and the timestamps and parameters of your =ED.* formula calls to our API to fetch the requested market data.

It does NOT:

• Collect, transmit, or store any of your spreadsheets, models, formulas, or simulation results — those stay on your machine.
• Run telemetry, usage tracking, behavioural analytics, or feature pings.
• Read or upload any file on your computer outside of the API request payload.

The only outbound network call from the add-in is the data fetch to energydataiberia.com/api/*. This is a deliberate competitive differentiator versus other Excel add-ins that monitor usage.

3. Third-party processors

We rely on the following processors to deliver the service:

4. International transfers

Some of our processors operate outside the European Economic Area. Transfers are safeguarded by:

• The EU-US Data Privacy Framework (DPF)— verifiable for each US-based processor at www.dataprivacyframework.gov.
• Standard Contractual Clauses (SCCs)approved by the European Commission, where DPF does not apply or as a secondary safeguard, included in each processor’s Data Processing Agreement (DPA). Copies of the DPAs can be requested at dpo@energydataiberia.com.

For processors located within the EU (Hetzner — Finland), no international transfer takes place and only the standard processor agreement under GDPR Art 28 applies.

5. Cookies

We use the minimum cookies necessary for the site to function plus, with your consent, anonymous analytics cookies. No marketing cookies, no third-party trackers beyond Google Analytics.

Changing your preferences: delete the ed_consent cookie from your browser and reload to re-trigger the banner. You can also block all cookies in your browser settings, though this may break login.

6. Data retention

We retain data only as long as needed for the purpose:

7. Security

We apply industry-standard measures to protect your personal data:

• Transport encryption: all traffic to the website, API, and Excel add-in uses TLS 1.2+ (Let’s Encrypt certificates, auto-renewed).
• Authentication: passwords are hashed by Supabase Auth using industry-standard algorithms (bcrypt-like). We never see, store, or log your password in plaintext.
• Database access controls: Postgres Row-Level Security (RLS) is enabled on user-scoped tables; only authenticated users can read their own rows.
• Service-role keys: administrative database access keys are stored outside the application code (environment variables on the production server) and rotated on any security incident.
• Backups: encrypted at rest on Cloudflare R2 and during transit. Backup access is restricted to the database owner role.

If we ever experience a personal-data breach that is likely to result in a risk to your rights and freedoms, we will notify the AEPD within 72 hours and you without undue delay, in accordance with GDPR Art 33 and 34.

8. Your rights

Under the GDPR, you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate or incomplete data
• Erase your data (“right to be forgotten”)
• Port your data to another provider in a machine-readable format
• Object to processing based on legitimate interest
• Withdraw consent for analytics cookies at any time

To exercise any of these rights, email us at dpo@energydataiberia.com. We will respond within 30 days.

You also have the right to lodge a complaint with the Spanish Data Protection Agency:

• Agencia Española de Protección de Datos (AEPD)
• Address: C/ Jorge Juan 6, 28001 Madrid, Spain
• Telephone: 901 100 099 / 91 266 35 17
• Website: www.aepd.es

9. Changes to this policy

We may update this policy from time to time. Material changes will be communicated via email or a notice on the website. The “Last updated” date at the top reflects the most recent revision.

10. Contact

For any privacy-related questions, contact us at dpo@energydataiberia.com.