Your data, your rights.

1. Data Controller

The data controller responsible for your personal data is:

2. Types of Data We Collect

We collect and process the following categories of personal data:

Personal Information

When you use our services or contact us, we may collect your name, email address, phone number, company name, and job title. If you create a CRM account, we also store your login credentials (encrypted) and profile information.

Usage Data

We automatically collect technical data when you interact with our platform, including your IP address, browser type, device information, pages visited, time spent on pages, and interaction patterns with our AI agents.

CRM and Business Data

If you use our CRM dashboard, the data you input — including customer details, leads, job progress, grant applications, and communications — is stored securely. This data belongs to you; we process it only to provide the service.

3. How We Use Your Data

We process your personal data for the following purposes:

• Service delivery: To provide and maintain our AI-as-a-Service platform, including CRM functionality, AI agent operations, and reporting dashboards.
• AI processing: To process your inputs through our AI agents (grant writing, permit applications, customer communications, reporting). Inputs may be sent to third-party AI providers (e.g. OpenAI) for processing. See Section 5 for details.
• Communications: To respond to your enquiries, send service updates, provide weekly reports, and deliver marketing communications (only where you have consented).
• Platform improvement: To analyse usage patterns, improve our AI agents, and enhance the user experience.
• Legal compliance: To comply with applicable laws, regulations, and legal processes.

4. Legal Basis for Processing

Under Article 6 of the General Data Protection Regulation (GDPR), we process your data based on:

• Contract (Art. 6(1)(b)): Processing necessary to provide our services under your subscription agreement.
• Consent (Art. 6(1)(a)): Where you have given explicit consent, such as for marketing communications or optional features.
• Legitimate interest (Art. 6(1)(f)): For platform improvement, fraud prevention, and security monitoring.
• Legal obligation (Art. 6(1)(c)): Where required by Irish or EU law.

5. Data Sharing

We may share your data with the following categories of third parties:

• AI providers: Inputs to our AI agents may be sent to providers such as OpenAI for processing. These providers process data under their own GDPR-compliant agreements. We do not use your data to train AI models.
• Email and communication services: We use third-party services to send transactional and marketing emails on our behalf.
• Analytics providers: We use anonymised analytics to understand platform usage and improve performance.
• Hosting and infrastructure: Your data is stored on secure cloud infrastructure within the EU/EEA.

We will never sell your personal data to third parties.

6. Data Retention

We retain your personal data only for as long as necessary:

• Active subscription data: Retained for the duration of your subscription.
• CRM business data: You retain full control. Upon cancellation, you may export your data within 30 days, after which it is securely deleted.
• Usage and analytics data: Anonymised after 24 months.
• Marketing consent records: Retained for 6 years from last interaction (as required by Irish law).
• Account data: Deleted within 90 days of account closure, unless retention is required by law.

7. Your Rights

Under GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15): Request a copy of the personal data we hold about you.
• Right to rectification (Art. 16): Request correction of inaccurate or incomplete data.
• Right to erasure (Art. 17): Request deletion of your personal data ("right to be forgotten").
• Right to data portability (Art. 20): Receive your data in a structured, machine-readable format.
• Right to object (Art. 21): Object to processing based on legitimate interests or for direct marketing.
• Right to restrict processing (Art. 18): Request that we limit how we use your data.
• Right to withdraw consent: Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, contact us at hello@renewably.ie. We will respond within 30 days as required by GDPR.

8. Cookies

Our platform uses cookies and similar tracking technologies:

• Essential cookies: Required for platform functionality, authentication, and security. These cannot be disabled.
• Analytics cookies: Help us understand how visitors use our platform. Anonymised and aggregated.
• Preference cookies: Remember your settings and preferences for a better experience.

You can manage your cookie preferences through your browser settings at any time.

9. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including encryption in transit (TLS 1.3) and at rest, access controls, regular security reviews, and secure infrastructure hosted within the EU/EEA. While no system is completely secure, we are committed to protecting your data to the highest standard.

10. Contact Us

If you have any questions about this privacy policy or how we handle your data, please contact us: