Renewable Labs
Request an O&M assessment

Legal

Privacy Policy

Last updated 15 October 2026 · Ελληνικά

Who we are

Renewable Labs is an energy consulting practice based in Cyprus, operated by SK Renewable Laboratory Ltd (registered in Cyprus, HE 458890), which is the controller of the personal data described here. Our address is Aigyptou 10, 1097 Nicosia, Cyprus. For questions about this policy or how we handle your data, contact us at info@renewable-labs.com.

This one policy covers everything we run:

  • This website, renewable-labs.com, with its contact form, cookies and analytics.
  • Our enquiries from the contact form, email, our LinkedIn, Facebook and Instagram ads and Messenger.
  • Our monitoring app at app.renewable-labs.com (Solar Harmony), which our customers use to follow their solar systems. See "The monitoring app" below.
  • Our sign-up link for a free solar report, where you connect your FusionSolar account. See "The sign-up link and your FusionSolar login" below.

What we collect

We collect personal data when you give it to us directly or, only if you accept it, through the advertising measurement described below. Specifically:

  • Contact form submissions. When you submit our contact form, we receive your name, email, optional company name, the message you wrote, and any service and system details you choose to add (the service you are interested in, asset type, capacity band and district). We also record the page you sent it from and, if the link you arrived on carried campaign tags (for example utm_source), those tags. If you accepted cookies, the page we record may instead be the first page of your visit, and we also record the website that linked you here (its domain only), as explained under "Cookies and analytics" below.
  • LinkedIn lead forms. When you fill in a form in one of our LinkedIn ads, LinkedIn passes us the details you submit: your name, work email, company, job title, and your answers to our questions (for example the size of your solar system in kW and where it is). LinkedIn's own privacy policy covers what LinkedIn itself collects.
  • Facebook and Instagram lead forms. When you fill in a form in one of our Facebook or Instagram ads, Meta passes us the details you submit: your name, your email and, if the form asks for them, your phone number, company and town, and your answers to our questions (for example the size of your solar system in kW). We keep them in our CRM and send you a short email to confirm that we received your request. We may also call you, or message you on WhatsApp, at the number you gave. Meta's own privacy policy covers what Meta itself collects.
  • Messages on Messenger. When you write to our Facebook page on Messenger, we receive your messages, the name Messenger shows us for your profile and, if you came from one of our ads, which ad it was. We keep them in our CRM so that we can reply to you.
  • Data for work you engage us for. Only after you sign an engagement letter, we receive the data needed for your study, such as meter or production data you share with us through the DSO portal or your monitoring system. We use it only for your study.
  • Email correspondence. When you email us at info@renewable-labs.com, we retain your message and email address for as long as needed to respond and to keep a record of our work together.
  • Anonymous traffic data. Our hosting provider (Render) keeps standard server logs (IP, user-agent, requested URL) for security and operational purposes. Cloudflare, which sits in front of our website, also processes your IP address and request details to deliver the site and protect it from attacks. We also run Cloudflare Web Analytics, a privacy-first, cookieless service that measures aggregate page views without setting cookies or identifying individual visitors, so it needs no consent. See "Cookies and analytics" below for the optional Google Analytics that runs only if you accept it.
  • Advertising measurement, only if you accept it. If you choose Accept all in the cookie banner, the Meta Pixel tells Meta which pages you viewed and that you sent the contact form, with the service you chose, so we can see whether our Facebook and Instagram ads lead to enquiries. It never sends your name, email or message. See "Cookies and analytics" below.

Why we collect it

  • To respond to your enquiry, to a message you send to our Facebook page, or to the request you sent through a LinkedIn, Facebook or Instagram form (steps you asked us to take before a possible contract).
  • To deliver the consulting services you've engaged us for.
  • To meet our legal and accounting obligations.

We do not sell or rent your personal data. The only data shared for marketing is the Meta Pixel measurement described below, and only if you accept it.

How we store it

Contact form submissions are delivered to our inbox via Web3Forms, then stored in our standard email system. The same submission is also stored in our customer relationship management (CRM) system, which runs on Supabase in the EU (Ireland), so we can follow up on your enquiry. Alongside the form, the CRM keeps your browser type and a one-way hash of your IP address, used only to block spam and abuse. When a new enquiry arrives, the CRM sends us an internal alert email through Postmark or Resend. LinkedIn form leads are downloaded from LinkedIn and kept in our email system and client records. Facebook and Instagram form leads and Messenger messages reach the same CRM directly from Meta. Server logs are retained by Render per their standard policy.

Some of this processing happens outside the European Union. Web3Forms forwards form submissions to our inbox from servers in the United States, under the European Commission's Standard Contractual Clauses in its data processing agreement. The internal alert email contains your enquiry (your name, contact details, company and message) and is sent through Postmark, which AC PM LLC runs in the United States, or through Resend, which Plus Five Five, Inc. runs in the United States. Both companies are certified under the EU-U.S. Data Privacy Framework. The same applies to the emails we send you through Postmark or Resend (see "Other services we use" below), which carry your name, your email address and the content of the email. Meta (for lead forms, Messenger and WhatsApp) and Render (for server logs) may also transfer data to the United States. Both are certified under the EU-U.S. Data Privacy Framework. Telegram also processes some data outside the European Union, as described under "Other services we use" below. For details of the safeguards or other legal basis that cover these transfers outside the European Union, write to us at info@renewable-labs.com.

We keep enquiry, message and lead details only for as long as we need them to handle your request and any work that follows, and client records for as long as the law requires for accounting purposes. You can ask us to delete your details at any time. If you ask us to delete your details, we still keep your email address on our do not email list, so that we do not add you again or email you again, unless you contact us first.

Other services we use

  • Postmark and Resend. Besides our internal alert, the emails we send you from our CRM go out through Postmark or Resend: the confirmation after a Facebook or Instagram form and our quotes when we send them by email. Where Postmark and Resend run is described under "How we store it" above.
  • WhatsApp. If you gave us a phone number, we may send you our quote or a message on WhatsApp, which Meta runs. The message carries your name and what we write to you, for example the size of your system and the price we quote. WhatsApp's own privacy policy covers what WhatsApp itself collects.
  • Telegram. We get internal alerts about new enquiries in a private Telegram chat that only we use. These enquiry alerts carry only a reference number, a link to the enquiry in our CRM and short labels such as the service, the channel, the ad, the system size range you picked or the enquiry's follow-up stage (for example "New enquiry L-1040 · O&M · Meta form"), never your name, contact details or message. If you write to us on Messenger, your messages and the name Messenger shows us for your profile may also be shown to us in that private Telegram chat so that we can reply to you. Telegram processes these alerts and messages outside the European Union. No European Commission adequacy decision covers transfers to Telegram, and Telegram does not offer standard contractual clauses for this use.
  • Google Gemini and Veo, Lovable and OpenAI. We use AI models (Google's Gemini and Veo, directly and through Lovable's AI gateway, which can also pass our requests to OpenAI models) to help us draft our own posts, images and videos. We do not send them your enquiry, your messages, your contact details or any other personal data about you.

The monitoring app

Our monitoring app at app.renewable-labs.com (Solar Harmony) is where our customers follow their solar systems. You get an account only when we invite you, as a customer or through our sign-up link.

  • Your account. Your name, your email address and the password you choose. Our database provider's sign-in service keeps the password in a scrambled (hashed) form, so we cannot see it.
  • Your plant. The details of your solar system: its name, location, size, inverters and other equipment, and the details of our contract with you.
  • Data from your inverters and meters. We read production, inverter, meter and alarm data from the online portal your system uses: Huawei FusionSolar or ZCS Azzurro. We read this data only. We never change settings in your system or in those portals. We may also add files you send us, such as production exports.
  • Alerts and emails. We use your plant data to spot faults and low production and to tell you about them. We send emails about your account and your system, such as your invitation, a password reset or "your report is ready", through Resend.
  • PDF reports. You can download reports about your system as PDF files. Your browser makes the PDF from the same data you see in the app.
  • Weather data. To work out how much your system should produce, we send your plant's location to weather and solar data services (Visual Crossing, OpenWeather, Open-Meteo and the European Commission's PVGIS). We never send them your name or contact details.
  • Security records. We keep a record of important actions in the app, such as signing in and downloading a report, with the time. Our hosting and database providers also keep technical logs, which can include your IP address and browser.

The app's data is stored in our database on Supabase in the EU (Ireland). The app itself is hosted on Render, with Cloudflare in front of it. We keep your account and plant data while you are our customer. After that, ask us and we will delete it, except records the law requires us to keep.

The sign-up link and your FusionSolar login

If you asked us for a free report on your solar system, we may email you a personal sign-up link. The link works once and expires after 7 days. It lets you create an account in our monitoring app and connect your Huawei FusionSolar account, so that we can read your system's data and prepare your report.

  • Your account. Your name, your email address and the password you choose, as described under "The monitoring app" above.
  • Your FusionSolar username and password. You type them yourself. We store them encrypted, we never show them back to you or to anyone else, and we use them only to read your plant data. We never change anything in FusionSolar.
  • What we read. Your plant details (name, size and location), your inverters and whether they are online, your production (daily and monthly energy for the last 6 months and from then on) and your current alarms.
  • Your agreement. Before you connect, you tick a box to agree that we read this data. We record that you agreed, when, and which version of the text you saw.
  • Your report. We use the data to prepare your report and, while you stay connected, to show your system in the app. We email you through Resend when the report is ready.

How long we keep it:

  • If you start connecting but do not finish, we erase the FusionSolar login you typed after 30 minutes.
  • You can press Disconnect in the app at any time. We stop reading your FusionSolar data and erase the FusionSolar password we stored. Your report and account stay, so you can connect again later.
  • If we close your sign-up, we stop reading your data but keep your login, so that you can come back. We erase it when you ask us.
  • We keep your account, report and plant data until you ask us to delete them.

To ask us to delete your data or your FusionSolar login, email info@renewable-labs.com from the address you signed up with. FusionSolar is run by Huawei. Huawei's own privacy policy covers what Huawei itself collects.

Service providers at a glance

These companies process personal data for us. Each one is described above.

  • Supabase: our database for the CRM and the monitoring app, in the EU (Ireland).
  • Render: hosting for this website and the monitoring app, and their server logs.
  • Cloudflare: sits in front of this website and the monitoring app to deliver and protect them. It processes your IP address and the details of each request (such as the page asked for and your browser) for that purpose. It also runs Cloudflare Web Analytics on this website, without cookies.
  • Google: Google Analytics on this website, only if you accept it.
  • Resend: the emails we send from the CRM and the monitoring app.
  • Postmark: the emails we send from the CRM.
  • Web3Forms: delivers the contact form to our inbox.
  • Meta, LinkedIn and Telegram: our ads, lead forms, Messenger and internal alerts.
  • Weather services: Visual Crossing, OpenWeather, Open-Meteo and PVGIS receive plant locations only.

Legal basis

  • Your consent: for connecting your FusionSolar account through the sign-up link and preparing your report, and for Google Analytics and the Meta Pixel. You can withdraw it at any time: press Disconnect in the app, use the Cookie settings button below, or email us. Withdrawing does not affect what we did before.
  • Our contract with you: for monitoring and looking after the systems of our customers, and for answering your enquiry before a possible contract.
  • Our legitimate interest: for security records and server logs, for blocking spam and abuse, and for keeping our do not email list.
  • The law: for keeping accounting records.

Your rights

Under EU/Cyprus data protection law (GDPR), you have the right to:

  • Request a copy of the personal data we hold about you.
  • Ask us to correct inaccurate data.
  • Ask us to delete your data, subject to any legal retention requirement.
  • Object to processing or withdraw consent.
  • Complain to the Commissioner for Personal Data Protection in Cyprus (dataprotection.gov.cy).

To exercise any of these rights, email info@renewable-labs.com. These rights cover all our services, including the monitoring app and the sign-up link. We reply within one month.

Cookies and analytics

Cloudflare Web Analytics runs on every page. It is cookieless and privacy-first: it records aggregate traffic without cookies and without identifying you, so it does not need your consent.

We also use Google Analytics 4, which does set cookies. It stays off until you choose Accept all or Analytics only in the cookie banner: Google's code is not even loaded before you accept, and your IP address is anonymized. Accepting turns on analytics cookies only: Consent Mode v2 keeps advertising storage and the use of your data for ads denied even after you accept, and we do not use Google Analytics for advertising or ad personalization. If you accept, we use it to understand how visitors move through the site. If you decline, no analytics cookies are set and nothing is sent to Google.

If you accept, we also keep the following in your browser for this session only: the campaign tags of the link you first arrived on (for example utm_source=facebook), the first page you landed on, and the address of the website that linked you here, if any (its domain only, for example https://www.linkedin.com, never the full page address). We send them with your enquiry so we know which post, ad or website brought you. Google Analytics then records that an enquiry was sent, without your name or email. If you decline, none of this happens, and the form carries only the page you send it from and that page's own campaign tags. If your browser sends a Global Privacy Control or Do Not Track signal, we keep none of this even if you accept.

Our fonts are stored on our own server, so loading this website sends nothing to Google Fonts. The map on our contact page comes from OpenStreetMap. When you scroll to it, your browser fetches the map from OpenStreetMap's servers, which see your IP address and browser details. OpenStreetMap's own privacy policy covers what it collects.

If you choose Accept all, we also load the Meta Pixel from Meta Platforms Ireland Limited. We use it only to measure whether our Facebook and Instagram ads lead to enquiries. It sends Meta the pages you view, a "form sent" event with the service you chose, and technical data such as your IP address and browser details. It never sends your name, email or message. Meta may link these events to your Facebook or Instagram account if you are logged in. It sets the _fbp cookie, and _fbc when you arrive from one of our ads, for up to 90 days.

For collecting and transmitting this data, we and Meta are joint controllers under Article 26 GDPR, as set out in Meta's Controller Addendum. Meta's own use of the data is covered by its policy at facebook.com/privacy/policy. Meta may transfer data to the United States under the EU-US Data Privacy Framework. The legal basis is your consent. If your browser sends a Global Privacy Control signal, the pixel never loads, even if you choose Accept all. Choosing Analytics only or Decline keeps it off.

On this page the cookie banner does not open by itself, so you can read this policy before you choose. Until you choose, Google Analytics and the Meta Pixel stay off. You can make, change or withdraw your choice at any time with the Cookie settings button below.

Changes to this policy

We will update this page when our practices change. The date at the top reflects when the policy was last revised.