Privacy & Cookie Policy

2.1 Where we act as controller: We are the controller for personal data that we collect for our own purposes, including: personal data about visitors to the Website (analytics, cookies, enquiries, marketing); personal data about prospective and current Clients' representatives (sales, onboarding, CRM, support, billing and account administration); personal data about Authorised Users we provision for access to the Platform (names, business email addresses, role, login credentials, authentication and audit data); personal data we are required to retain to comply with legal, regulatory and accounting obligations.

2.2 Where we act as processor: When our Clients use the Platform, they upload, generate or instruct the processing of information relating to grid connection applications, due diligence subjects, site portfolios, third parties and counterparties (“Client Data”). To the extent Client Data contains personal data, the Client is the controller and Equilibriq is the processor. In that case, our processing is governed by the data processing terms in our Master Services Agreement / Data Processing Addendum, not this Policy.

The table below summarises the categories of personal data we process as controller.

We do not generally process special category data (UK GDPR Art. 9) or criminal offence data (Art. 10) in operating the Platform.

We do not require you to provide personal data, but if you do not provide information we ask for (for example, your business email to log in), we may be unable to provide the Services.

The Platform uses analytical models, scoring rules, machine-learning and other automated processing to produce assessments, recommendations and reports relating to grid connection due diligence. These outputs are intended to support, not replace, the professional judgement of our Clients and their personnel.

We do not use the Platform to make decisions that produce legal or similarly significant effects on individuals based solely on automated processing within the meaning of Article 22 of the UK GDPR. Outputs of the Platform are reviewed and actioned by our Clients.

We may use third party large language model (“LLM”) and AI service providers to operate certain features. We contractually require these providers not to use Client Data to train their models, and we apply input filtering and access controls. Specific subprocessors are listed at https://equilibriq.com/subprocessors.

We share personal data only where it is necessary and lawful to do so, including with:

• members of the Equilibriq corporate group, where applicable;
• our personnel, contractors and professional advisers (legal, accounting, audit, insurance) under duties of confidentiality;
• our subprocessors and other service providers — e.g. cloud hosting, identity & access management, email delivery, analytics, customer support, payments, CRM, productivity tools, AI/LLM providers — each engaged under written contracts that include data protection obligations equivalent to those required under Art. 28 UK GDPR. A current list is at https://equilibriq.com/subprocessors;
• our Clients (where you are an Authorised User) to operate, secure and bill for the Services;
• public authorities, regulators, courts and law enforcement where we are required by law to do so, or where it is necessary to establish, exercise or defend legal claims;
• acquirers, investors and their advisers in connection with any actual or proposed merger, acquisition, reorganisation, sale of assets or financing event, subject to confidentiality protections;
• any other third party with your consent or on your instructions.

We do not sell personal data.

We are based in the United Kingdom and host the production Platform in the UK and/or the European Economic Area (“EEA”). Some of our subprocessors may process personal data outside the UK and EEA, including in the United States.

Safeguards:

• an adequacy decision adopted by the UK;
• the UK International Data Transfer Agreement (the “IDTA”) or the UK Addendum to the European Commission's Standard Contractual Clauses; or
• another transfer mechanism permitted by UK GDPR Articles 46–49.

You can request a copy of the relevant transfer mechanism by emailing privacy@equilibriq.com.

We retain personal data for as long as necessary for the purposes for which it was collected, taking into account applicable legal retention requirements.

After the retention period ends, we securely delete or anonymise personal data.

• Right of access — to obtain a copy of personal data we hold about you and information about how we process it.
• Right to rectification — to have inaccurate or incomplete data corrected or completed.
• Right to erasure — to ask us to delete personal data in certain circumstances.
• Right to restrict processing — to ask us to limit our use of personal data in certain circumstances.
• Right to data portability — to receive personal data you provided to us in a structured, commonly used and machine-readable format.
• Right to object — to processing carried out on the basis of our legitimate interests, including direct marketing (which we will always honour).
• Right to withdraw consent — where we rely on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
• Right not to be subject to solely automated decisions — with legal or similarly significant effects (see section 5).

To exercise any rights: email privacy@equilibriq.com. We will respond within one month.

To complain to the ICO (Registration No. ZC150215): https://ico.org.uk/concerns or 0303 123 1113.

A cookie is a small text file placed on your device when you visit a website. Under PECR, we only use cookies that are not strictly necessary with your consent. You can give, refuse, manage and withdraw consent at any time via our cookie banner.