Privacy

Who is behind it?

GridZeno is a product from Kan-El, which is the data controller for the information described here. Contact us at kontakt@gridzeno.dk, if you have questions about your information.

Company

Kan-El

CVR number

32967574

Physical address

Ved Lunden 4, 8230 Åbyhøj

Overview

Here is the information we process, why, and how long we keep it. The sections below explain each part.

When you visit the website

IP address, time, page and browser in the server log. To keep the site secure and find errors. Deleted after 30 days.

Visit statistics

How the pages are used. Only if you say yes. Deleted after 2 years.

Your cookie choice

Your choice and when you made it. To be able to document your consent. Deleted after 3 years.

When you order

Name, contact details, address and order. To deliver what you have bought. Orders and invoices are kept for 5 years.

Your subscription

The monthly payment and an invoice for each month. Invoices are kept for 5 years.

Your account and your system

Kept until you delete the account. See Your energy data.

Home Assistant

Only if you connect it: the name your Home Assistant gives itself, whether it may only read or also control, its address on your network, and when you approved it and the dongle last saw it. Deleted as soon as it no longer has access.

Your electric car

Only if you connect it: your login to the car's app and the car's VIN, encrypted, what the car reports about its battery and charging, never where it is, and the departure times and the charge box you enter yourself. Deleted when you remove the car. The car's reports are deleted after 2 years.

When you write to us

Your message and your e-mail. To help you. Deleted 2 years after the case is closed.

Diagnostics with a support case

How your system and your dongle are doing, without name and address. Only if you send it along. Deleted when the case is resolved.

When you visit the website

Every time your browser fetches a page, our server stores your IP address, the time, the page you ask for, the page you came from, and your browser's name and version. We use it to keep the website secure and to find errors, for example if someone tries to attack it. The legal basis is our legitimate interest in running a secure website (Article 6(1)(f) of the General Data Protection Regulation). The log is deleted automatically after 30 days.

The website and GridZeno run on Kan-El's own servers in Denmark. In front of them is Cloudflare, which delivers the pages quickly and protects them against attacks. That is why all traffic to the website, including your IP address, goes through Cloudflare.

On gridzeno.com you choose your country. Cloudflare tells us which country your connection comes from, and we only use it to suggest your country at the top. We do not store it, and we never send you to a country you have not chosen yourself. If you choose a country, or change language with the flags at the top, the cookie gz_market remembers your choice for 12 months, so you go straight there next time.

Choices in the product overview and the compatibility check stay in the page's temporary memory and are not sent to us. Read more about cookies and local storage.

Visit statistics

We use Umami to see how many people visit the website, which pages are read, for how long and how far, which buttons are pressed, how far an order gets, which country the visit comes from, and which page referred the visit here. Umami sets no cookies. We do not store your IP address, and of your location we only store the country, not the region or city. A visit is recognised from a salted hash of the IP address, the browser and the website's ID. The salt changes every day, so no one can be followed from one day to the next. Of what comes after “?” in the page's address, we only store the campaign codes that begin with utm_, such as utm_source, so we can see which campaign a visit came from. Anything else, such as a payment ID from Stripe, is not included.

The statistics are only loaded once you have said yes to statistics in the cookie choice, and they stop again if you withdraw your yes under Cookie settings at the bottom of the page. The legal basis is your consent. Umami is open-source software that we run ourselves on our own server, so the information is not sent to other companies. We use it to make the website better, not for marketing, profiling or identifying individuals. We keep a visit for 2 years. After that we delete it automatically.

Your cookie choice

When you make a choice in the cookie banner or under Cookie settings, we store your choice: which categories you said yes or no to, the time, which version of the cookie choice you saw, which of our websites it happened on, and a random number that is also stored in the cookie gz_samtykke in your browser. If you change your choice, the new choice is stored under the same number. We do not store your IP address or your browser with the choice.

We do this to be able to document your consent, as Article 7(1) of the General Data Protection Regulation and the cookie rules require. The legal basis is therefore a legal obligation (Article 6(1)(c)). We keep a choice for 3 years: the 12 months it applies, and the 2 years we keep the statistics it allowed. After that we delete it automatically. If you want to know what we have stored about your choice, write to us with the number from Cookie settings.

When you order

When you go to payment, we send your name, your e-mail, your mobile number, your address, your delivery method and the parcel shop or parcel locker you may have chosen, and your choice of dongle, accessories and subscription to GridZeno. We create a GridZeno account with the username you choose when the payment is complete. You do not choose a password in the order: the first time, you log in with the number on your dongle, and we only store it as an encrypted hash. If you already have a GridZeno account with the same e-mail, you cannot order with that e-mail; write to us if you want to order another dongle for your account.

We use the information to carry out the agreement with you: the payment, the delivery, the invoice and your account. The legal basis is the agreement (Article 6(1)(b)). Without the information we cannot accept the payment, send the dongle or create your account. Invoices and accounting records are kept for 5 years from the end of the financial year, as the Danish Bookkeeping Act (bogføringsloven) requires (Article 6(1)(c)), also if you delete your account.

For this we use these suppliers:

• Stripe accepts the payment on its own payment page. Your card details go directly to Stripe and never reach us. We are told that the amount has been reserved, and we ask Stripe to charge it when we send the order. Stripe stores the card so the amount can be charged even if the order waits longer than the reservation lasts, and, if you have chosen Smart or Pro, so the first month can be charged when your dongle is connected. Stripe also processes information itself to prevent fraud and comply with legal requirements; read Stripe's privacy policy.
• Shipmondo books the shipping for us, and PostNord delivers the parcel. They get your name, mobile number, e-mail and the chosen parcel shop, or your address if you have chosen delivery to your door, so PostNord can deliver the parcel and notify you about it.
• Dinero is our accounting program. The invoices are made there, and your name, your address and your e-mail are stored with them.

Your subscription

If you have Smart or Pro, Stripe charges the subscription to the card you saved when you ordered, once a month. The first time is when your dongle is connected. For each payment we store which plan and period it covers and what you paid, and we create an invoice in Dinero. We send the first one to your e-mail, and you can download all of them in GridZeno under Profile. The invoice shows your name, your address, your e-mail, your plan, the period and the amount. Light costs nothing, so nothing is charged.

If you change plan or card, or cancel, it happens through Stripe, and the card details never reach us. The legal basis is the agreement with you (Article 6(1)(b)), and the invoices are kept for 5 years from the end of the financial year, as the Bookkeeping Act requires (point (c)), also if you cancel or delete your account.

Your account and your system

We keep your account (name, e-mail and username) until you delete it. What GridZeno stores about your system, who gets what, and for how long is set out on Your energy data.

We send you e-mails about your order and your account and messages about your system, for example if the connection to your inverter is lost. You choose which messages you get under Settings. We do not send newsletters or advertising.

When you write to us

The support button at the bottom right and the form on the support page send your message directly to GridZeno's support system, the same place where messages sent from inside the GridZeno app end up. You have to give your e-mail so we can reply to you. The support button also asks what it is about and, depending on the topic, for an order number, the dongle's ID, your inverter or your username. You can give us your phone number and choose when we may call, and we then only use it to call about your enquiry. All of this is voluntary and is stored with the message. We do not need your password, payment card details or CPR number (Danish personal identification number), so do not send them. A button that opens your own e-mail app sends nothing until you send the e-mail yourself. Your enquiry gets a case number, and you get a receipt by e-mail and an e-mail each time the case changes status. When the case is resolved, you can give us a rating from 1 to 5 and a comment if you like. The rating is stored with the case and deleted with it.

If you are logged in, you can send a diagnostic report with your message. It is switched on when the message is about an error, the control, the figures, the dongle or the setup, and you can switch it off before you send. Our server creates the report from what GridZeno already knows about your system: how the dongle, the inverter, the plan, the measurements and the prices are doing, and your choices for the control. Your browser adds its name and operating system, the screen and window size, language, time zone, theme and the page you were on. The report does not contain your name, username, e-mail or phone number, your address, the system's location or the name you have given it, the dongle's number, serial numbers, your Wi-Fi, payments or the measurements themselves. We only use it to find the error, and we delete it as soon as the case is resolved. If the case is reopened, the report does not come back, so send a new one if we need to look again. You can always see the report and download it as a file on the Support and diagnostics page in GridZeno without sending it to us.

If your enquiry is about an order or a subscription, we process it to fulfil the agreement (Article 6(1)(b)). We process other enquiries to be able to help you, which is our legitimate interest (point (f)). We delete the message 2 years after the case is closed, and the same applies to the related e-mail correspondence. An enquiry does not sign you up for any kind of marketing.

When you connect your electric car

In GridZeno you can connect your electric car under Integrations, Electric car. You choose the car's brand and log in with the e-mail and password you use in the brand's app, and we store them encrypted so GridZeno can log in to the brand for you. We only use them to fetch the status the car itself has sent to its brand: how charged the battery is, whether the car is plugged in and charging, at what power, how far it can drive, and the charge limit set in the car. From that we show when the car has charged and when you usually plug it in. The latter is not stored separately but is calculated from the car's reports each time. Most brands need the car's VIN (vehicle identification number) to respond, so we store it encrypted together with your login. We never store the car's position and never fetch its trips. We do not ask for the position; only smart's response includes it, and we do not read it. We do not wake the car to ask, except MG, whose service always asks the car itself. That is why we only fetch an MG's status every 3 hours. GridZeno does not send the car any commands.

BMW and MINI are connected through BMW CarData, BMW's own access for car owners. You create a CarData client in your BMW or MINI account and grant access on BMW's own page. We never see your password; we only store the client ID and the access BMW grants, encrypted.

You can also enter how full the car should be, when it leaves on each weekday, and which charge box you have. The departure times say something about when you are at home, so we only use them to work out when the car should charge. For each charging session we check in the system's own measurements whether it showed up in the house's consumption. That tells us whether the car charged behind the system's meter, not where the car was.

The legal basis is the agreement with you (Article 6(1)(b)): you have asked yourself to have the car included in GridZeno. If you remove the car, we delete your login, the car's reports, the charging sessions and your departure times immediately. You remove the charge box on the same page. Otherwise we delete the car's reports after 2 years and the rest when you delete your account. The car's brand gets the same as when you use the brand's app yourself, and processes it under its own privacy policy.

When you connect Home Assistant

Home Assistant talks directly to your dongle on your own network, not through GridZeno. What Home Assistant shows comes from the dongle: the measurements, the plan and, on Smart and Pro, your prices and the solar forecast, which the dongle itself has fetched from us. We do not see what Home Assistant asks the dongle. The key that the dongle and Home Assistant sign with is created by the two of them, and it is never sent over the internet. It is only in the dongle and in your Home Assistant, not with us.

When a Home Assistant asks the dongle for permission, the dongle sends us its name, its address on your network and the 6-digit code that is also shown in Home Assistant, so you can approve it under Integrations, Home Assistant. If you approve it, we store the name, whether it may only read or also control, the address and the code, when you approved it, and when the dongle last saw it. If Home Assistant controls the system, GridZeno shows what it has started.

The legal basis is the agreement with you (Article 6(1)(b)): you have asked yourself to have Home Assistant included. We delete a connection as soon as it no longer has access: when you remove it, when Home Assistant removes itself, when the dongle gets a new owner, and when you delete your account. That you approved, rejected or removed a Home Assistant, and what it was called, is recorded in the history of your dongle, which we keep for one year.

Who processes the information for us?

We do not sell your information and do not pass it on for other purposes. These suppliers process information for us, each only for their own task:

Cloudflare

Delivers and protects the website and GridZeno. Sees IP addresses and the pages that are fetched.

one.com

Our e-mail: sends e-mails from GridZeno and holds our inbox.

Stripe

Payment and the saved card. Is itself responsible for its processing against fraud and under legal requirements.

Shipmondo and PostNord

Shipping and delivery.

Dinero

Accounting and invoices.

Google Firebase

Only if you turn on push in the Android app: the phone's push address, so the message can be delivered.

Transfers to countries outside the EU

Cloudflare, Stripe and Google are American companies, and information may therefore be processed in the USA. All three are certified under the EU-U.S. Data Privacy Framework, which the European Commission has approved as a safe basis for transfers. Our other suppliers are companies in the EU.

Automated decisions

We do not make decisions about you based solely on automated processing, and we do not use your information for profiling. GridZeno controls your system automatically, but according to the choices you have made yourself, and you can always switch to manual.

The panel check can correct the panels' orientation and tilt based on what each string has produced. It is a correction of the system's information so the forecast is more accurate, not a decision about you. You are notified, and you can undo it under System.

How we protect the information

The connections to the website and GridZeno are encrypted, passwords are only stored as one-way hashes, and the database cannot be reached from the internet. If you turn on two-step login, we store the key for your authenticator app encrypted and the backup codes only as one-way hashes, and they are deleted when you turn it off. Read more about how access to your system is secured on Your energy data.

Your rights

Under the General Data Protection Regulation, you have the right:

• to access the information we have about you and get a copy of it
• to have incorrect information corrected
• to have information deleted
• to have the processing restricted
• to object to processing we carry out on the basis of our legitimate interest
• to receive your information in a common, machine-readable format (data portability)

If processing is based on your consent, you can withdraw it at any time, without affecting what happened before you withdrew it. Write to kontakt@gridzeno.dk. We reply within one month at the latest, and we may ask you to confirm your identity first.

You can download your measurements and the system's information yourself in the web app under Profile, Download your data, as a zip file with tables that open in Excel. We create the file when you ask for it and do not store it.

You can delete your account yourself in the app or the web app. See how, and what we keep afterwards.

If you are unhappy with how we process your information, you can complain to the Danish Data Protection Agency (Datatilsynet).