Privacy Policy

1. Who we are

This Privacy Policy explains how Sunsynk Limited (Company Registration Number 08778087), trading as Sunsynk UK Ltd (“Sunsynk”, “we”, “us”, “our”), processes personal data in connection with the Sunsynk System Performance Report Service (“SSPRS”, “Service”), including the web application and related websites such as sunsynkreports.com.

Registered office: Unit 10 Edison Court, Ellice Way, Wrexham Technology Park, Wrexham, LL13 7YT, United Kingdom.

Privacy contact: privacy@sunsynk.com
Support contact: support@sunsynk.com

Data Protection Officer: We have not appointed a statutory Data Protection Officer. Privacy enquiries should be sent to privacy@sunsynk.com.

We are the controller of personal data processed for SSPRS account administration, authentication integration, report generation and storage within SSPRS, credits and billing records, support, security, audit logging, and (where applicable) analytics consent records, except where this Policy states otherwise.

2. Scope and audience

The Service enables authorised users to generate performance reports for Sunsynk-connected systems. Access is restricted (allow-listed / invitation / controlled rollout). Sign-in uses Sunsynk account credentials shared with other Sunsynk applications (for example Saver / Connect Pro) via Firebase authentication.

This Policy is drafted primarily for authorised business users (installers, partners and staff). If you use the Service as a consumer, mandatory consumer and data-protection rights that cannot be excluded will still apply.

The Service is intended for individuals aged 18 or over. We do not knowingly offer the Service to children.

3. Categories of personal data

We do not intentionally collect special category data. You must not enter special category data into the Service.

4. Sources of personal data

• You, when you create or use an account, configure tariffs, generate reports, purchase credits, or contact support.
• Your Sunsynk account / authentication providers (including Firebase) for sign-in and identity.
• Telemetry and connected systems associated with devices/sites you are authorised to access.
• Payment providers (Stripe) for payment status and references.
• Your device and browser, via cookies, SDKs and similar technologies (see our Cookie Policy).
• Our staff / administrators, when performing support, refund, security or role-management actions.
• Automated systems, including security logging and (if consented) analytics/session-replay tools.

5. Purposes and lawful bases

6. Legitimate interests: balancing summary

Where we rely on legitimate interests, our interests include securing the Service; preventing fraud and unauthorised access; maintaining auditability of admin actions; operating a B2B allow-listed reporting platform; and improving reliability. We consider the impact on individuals (including authorised users and, indirectly, end customers whose site/device data appears in reports), the sensitivity of telemetry-linked identifiers, the restricted access model, and available safeguards (access controls, logging, retention limits, and PECR consent for optional monitoring technologies). You may object to processing based on legitimate interests; we will assess objections unless an exemption applies.

7. Cookies, analytics and session replay

We use strictly necessary cookies for authentication, security and core functionality. Optional technologies are consent-gated and described in the Cookie Policy, including:

• Google Analytics 4 (GA4): usage analytics and custom events (may include device IDs, date ranges, credit/purchase metadata, Stripe session IDs, feature flags). We instruct engineering not to send email addresses, Firebase UIDs or obvious direct identifiers to GA4; residual linkable identifiers may still be personal data.
• Microsoft Clarity: session recordings, heatmaps and interaction data, which may capture on-screen content visible during your session.
• Sentry (when configured): error/diagnostics monitoring.
• PostHog (when configured): product analytics and/or product session replay.

Session replay risks: Recordings may show names, emails, customer/site identifiers, tariff inputs, report content and other on-screen information. We require technical safeguards including input masking where configured, exclusion of highly sensitive flows where practicable (authentication, payment entry, certain admin views), and access controls for staff who can view recordings. You can reject session replay while still using the Service.

Consent preferences are stored in a first-party consent record and, when you are signed in, may be synced to your account. You can change preferences via Cookie settings and, in-app, Settings → Privacy and cookies.

8. Recipients

We may disclose personal data to:

• Infrastructure and authentication providers (including Firebase / Google Cloud components).
• Stripe: payment processing.
• Analytics / monitoring vendors (if consented): Google (GA4), Microsoft (Clarity), Sentry, PostHog: as configured.
• Sunsynk staff administrators / super-administrators with elevated access for support, refunds, security and operations.
• Professional advisers under confidentiality.
• Authorities where required by law or to establish, exercise or defend legal claims.
• Successor entities in connection with a corporate transaction, subject to appropriate safeguards.

We do not sell personal data.

9. International transfers

Providers may process personal data outside the United Kingdom and/or European Economic Area, including in the United States (notably Google, Microsoft, Firebase/Google Cloud, Stripe, and potentially Sentry/PostHog if enabled).

Where a transfer is restricted under UK/EU GDPR, we rely on one or more lawful mechanisms, which may include an adequacy regulation; the EU Standard Contractual Clauses; the UK International Data Transfer Agreement and/or UK Addendum; and supplementary measures where appropriate.

We do not claim that personal data never leaves the UK.

10. Retention

11. Security

We implement appropriate technical and organisational measures designed to protect personal data, which may include encryption in transit (HTTPS), access controls, role-based admin permissions, audit logging and staff confidentiality obligations. No method of transmission or storage is completely secure. We do not guarantee absolute security.

12. Administrator access

Authorised Sunsynk administrators may search for users; view report, credit, purchase and refund history; generate or delete reports in support/operations contexts; issue refunds; and (super-administrators) manage staff roles. Admin actions are logged. By using the Service you acknowledge that such access may occur for legitimate operational, support, security and compliance purposes.

13. Your rights

Under UK GDPR (and EU GDPR where applicable), you may have the right to: access; rectification; erasure; restriction; objection; data portability; and withdrawal of consent (without affecting prior lawful processing).

To exercise rights, email privacy@sunsynk.com. We may need to verify your identity. We will respond within one month, extendable by two further months for complex requests.

Complaints: You may lodge a complaint with the UK Information Commissioner’s Office (ico.org.uk). If you are in the EEA, you may also complain to your local supervisory authority. We would appreciate the chance to address concerns first via privacy@sunsynk.com.

14. Automated processing

Report scores, flags and indicators are automated calculations based on telemetry, your selections and our methods. They support operational insight and human review. They are not intended to produce solely automated decisions that produce legal effects or similarly significant effects concerning you within the meaning of Article 22 UK/EU GDPR.

15. End-customer / site data accessed by business users

If you are an installer, partner or other business user, you must only access devices, sites and reports you are authorised to view. You are responsible for having a lawful basis and appropriate notices/authority in respect of any end-customer personal data you cause to be processed through the Service. Depending on the facts, you may be an independent controller of that end-customer data.

16. Children’s data

The Service is for adults and authorised business users only (18+). If we become aware that a child has provided personal data, we will take reasonable steps to delete it.

17. Changes

We may update this Privacy Policy. Material changes will be notified in-app and/or by email where appropriate, and may require re-acceptance of the updated version before continued use. The version number and effective date appear at the top of this Policy. Cookie preference changes are handled separately under the Cookie Policy and do not replace Privacy Policy acceptance.

18. Contact