---
title: Dichiarazione sulla Privacy (UE) ‣ HexErgy APP
description: "Scopri la nostra Dichiarazione sulla Privacy UE: trasparenza e protezione dei dati personali sono la nostra priorità. Leggi come gestiamo le informazioni."
---
[](https://hexergy.it/?hsLang=en)
- [Energy Community Platform](https://hexergy.it/en/energy-community-platform)
- [Energy Community Designer](https://hexergy.it/en/energy-community-designer)
- [Energy Community Creator](https://hexergy.it/en/energy-community-creator)
- [Energy Community Manager](https://hexergy.it/en/energy-community-manager)
- [Energy Communities Marketplace](https://hexergy.it/en/energy-communitiesmarketplace)
- [About Us](https://hexergy.it/en/about-us)
- [Contact Us](https://hexergy.it/en/contact-us)
- [Partners](https://hexergy.it/en/certified-partners-program)
- [Blog](https://hexergy.it/en/blog)
-  EN
- [ ES](https://hexergy.it/es/privacy-policy-ue)
- [ IT](https://hexergy.it/it/privacy-policy-ue)
[Login](https://hexergy.app/)
[Login](https://hexergy.app/)
# Privacy Policy (UE)
### We Respect Your Privacy
*This privacy policy was last updated on 7 October 2026 and applies to citizens and legal permanent residents of the European Economic Area and Switzerland.*
This policy explains what we do with the personal data we obtain through the web app [https://hexergy.app/](https://hexergy.app/) and the HexErgy app for iOS and Android. Please read it carefully. When processing your data we comply with privacy law. Among other things, this means that:
- we state clearly why we process personal data, through this policy;
- we collect only the personal data needed for legitimate purposes;
- we ask for your explicit consent where consent is required;
- we take appropriate security measures and require the same from anyone who processes data on our behalf;
- we respect your right to access your data, have it corrected or have it deleted.
**We do not sell your personal data.** If you have questions or want to know exactly which data we hold, contact us.
### 1. Purpose, data and retention period
For each purpose we list which data we process, on what legal basis and how long we keep it (click to expand):
1.1 Account registration and management
**Data processed:**
- First and last name
- Email address
- Phone number
- Password (stored only in encrypted form)
- Language
- Profile photo, if you upload one
- If you sign in with Google, Apple or Facebook: the name, email and account identifier the provider sends us
**Legal basis:** performance of a contract (Art. 6.1.b GDPR).
**Retention:** while the account is active; after deletion, erased or anonymised within 30 days (except as stated in 1.2–1.4).
1.2 Joining an energy community and managing your supplies
**Data processed:**
- First and last name, tax code, date and town of birth, home address
- Identity document (front and back)
- For companies: company name, VAT number, ATECO code, legal representative and chamber of commerce extract
- Supply data: POD code, address, type of supply, the bill you upload and the data read from it (supplier, power, annual consumption and consumption by time band F1/F2/F3, annual cost)
- For producers and prosumers: plant data (cadastral data, power, investment)
- Documents uploaded to or generated on the platform (membership, delegations, withdrawal, acknowledgement, contracts)
**Legal basis:** performance of a contract (Art. 6.1.b); legal obligation (Art. 6.1.c) for data and documents to be sent to the GSE.
**Retention:** identity document and company extract while you are a member, then as long as the signed documents that require them; contractual and signed documents 10 years from the end of the relationship (Art. 2946 Italian Civil Code); data and documents sent to the GSE for the whole incentive period (20 years for renewable energy communities) and until the related checks are closed.
1.3 Electronic signature of documents
**Data processed:**
- The phone number we send the OTP code to by SMS
- Signatory data
- Signature log: date, time, IP address, signed document
**Legal basis:** performance of a contract (Art. 6.1.b); legal obligation (Art. 6.1.c).
**Retention:** 10 years, like the signed document.
1.4 Incentive payouts and payments
**Data processed:**
- IBAN to receive your share of the incentives
- For administrators who pay HexErgy fees: billing data. Card payments are handled by Stripe: HexErgy never receives or stores the full card number.
**Legal basis:** performance of a contract (Art. 6.1.b); legal obligation (Art. 6.1.c) for invoices and accounting.
**Retention:** IBAN until the last payout is made, then deleted; invoices and accounting records 10 years (Art. 2220 Italian Civil Code).
1.5 Automatic reading of bills and documents
**Data processed:** the bills, identity documents and company extracts you upload.
**How it works:** a HexErgy service, hosted on our AWS infrastructure in the European Union, reads the document and pre-fills the fields. You check and confirm the data before it is used. No decision with legal effects is taken solely on the basis of automated processing (Art. 22 GDPR).
**Legal basis:** performance of a contract (Art. 6.1.b).
**Retention:** as for the documents in 1.2.
1.6 Sign-in with Face ID or fingerprint
**Data processed:** your biometric data stays on your phone: HexErgy never receives or stores it. On the server we keep only an access key tied to the device, in encrypted form. The feature is optional and you turn it on.
**Legal basis:** performance of a contract, at your request (Art. 6.1.b).
**Retention:** until you turn the feature off, change your password or delete your account.
1.7 Push notifications and service emails
**Data processed:**
- Device identifier for notifications (token), platform, app version, language
- Email and phone number for service messages (membership status, documents, OTP codes)
You can choose in the app which notifications you receive.
**Legal basis:** performance of a contract (Art. 6.1.b).
**Retention:** the token until you log out, uninstall the app or delete your account.
1.8 Map and addresses
**Data processed:** the addresses you enter, converted into coordinates through Google services and your phone's operating system, to find the primary substation and nearby communities. **The app does not access your device's location.**
**Legal basis:** performance of a contract (Art. 6.1.b).
**Retention:** saved addresses follow the periods in 1.1 and 1.2.
1.9 Energy data and delegations
**Data processed:**
- Consumption and production data, including data collected by IoT devices if installed (device ID, date and time, aggregate and point values)
- Data received through the delegations you grant
**Legal basis:** consent (Art. 6.1.a) for delegations, which you can withdraw at any time; performance of a contract (Art. 6.1.b) for the community service.
**Retention:** while you are a member of the community; where needed for reporting to the GSE, as in 1.2.
1.10 Security, diagnostics and service improvement
**Data processed:**
- Access logs, date and time, IP address
- Device model and operating system
- Error (crash) reports
- Aggregate usage statistics
**Legal basis:** legitimate interest (Art. 6.1.f) in protecting accounts and the platform and fixing errors.
**Retention:** technical and security logs 12 months; error reports 90 days; backups deleted on rotation within 35 days.
1.11 Contact and newsletter
**Data processed:** name, email, phone and the message you send us through forms, email or phone.
**Legal basis:** pre-contractual measures or contract (Art. 6.1.b) to answer requests; consent (Art. 6.1.a) for the newsletter and marketing messages, which you can withdraw at any time through the link in every email.
**Retention:** as long as needed to handle the request; for the newsletter, until you withdraw consent.
### 2. Purposes of processing
We process data to:
- provide the services: registration, joining and running the energy community, managing supplies, showing production and consumption data;
- sign documents electronically and handle procedures with the GSE;
- manage delegations for access to energy data;
- pay out incentives and handle payments;
- send service messages: OTP codes, notifications, emails about the status of the community or documents;
- comply with legal and regulatory obligations;
- keep the service secure and improve it, using aggregate and pseudonymised analysis.
### 3. Cookies
Our web platform uses cookies.
### 4. Legal basis for processing
- Performance of a contract or pre-contractual measures (Art. 6.1.b GDPR)
- Legal obligation (Art. 6.1.c GDPR), for example towards the GSE and for tax obligations
- Legitimate interest of the controller (Art. 6.1.f GDPR), for IT security and diagnostics
- Consent (Art. 6.1.a GDPR), for energy-data delegations and the newsletter
The legal basis for each purpose is given in section 1.
### 5. Recipients of the data
We share data only with those who need it to provide the service or to meet a legal obligation.
| Recipient | Why | Which data | Where |
| --- | --- | --- | --- |
| GSE – Gestore dei Servizi Energetici | registering the community and granting incentives | member and supply data, documents | Italy |
| Your community's administrators | managing memberships, withdrawals and procedures | your data and your supplies' data, according to their role | EU |
| Amazon Web Services | hosting, database, document storage, sending emails | all platform data | EU (Frankfurt) |
| Twilio | sending SMS with the OTP code | phone number | USA |
| Expo | sending push notifications | device token and notification text | USA |
| Google | sign-in with Google, maps and address search, Android notifications | Google account data, addresses entered, token | EU / USA |
| Apple | sign-in with Apple, iOS notifications, address conversion | Apple account data, token, addresses entered | EU / USA |
| Meta Platforms (Facebook) | sign-in with Facebook, if you choose it | name, email and Facebook account identifier | EU (Ireland) / USA |
| Sentry | app error diagnostics | technical data about the device and the error | EU (Germany) |
| Stripe | payment of fees by administrators | billing and payment data | EU / USA |
| ClickUp | internal handling of support requests and supplier-switch requests | name, email, phone, message; for supplier switches also POD, address and bill data | USA |
| Electronic signature provider (GlobalSign certificates) | electronic signature of documents | signatory data | EU |
**We do not sell your personal data** and we do not use it for third-party advertising.
We also disclose personal information when required by law or a court order, in response to a law enforcement authority, or for an investigation into a public safety matter. If HexErgy is acquired, sold or involved in a merger, your data may be disclosed to our advisers and any prospective buyers, and passed on to the new owners. We have a data processing agreement with Google.
### 6. How data is processed and protected
Data is processed electronically on secure systems that follow the principles of privacy by design and by default. The technical and organisational measures comply with:
- **EU General Data Protection Regulation 2016/679**
- **NIS2 Directive** and measures for the security of digital services
- **ISO/IEC 27001:2022** for information security management
The measures include:
- Encryption of data at rest and in transit
- Separate databases (dev/staging/prod)
- Role-based access control (RBAC)
- Logging, auditing and traceability of operations
- Backup and disaster recovery systems
### 7. Access to data and authorised persons
Personal data is accessible only to:
- The user who owns the data
- Administrators of the relevant energy community (according to defined roles)
- Authorised HexErgy staff (e.g. IT engineers, project managers)
- Data processors (e.g. cloud providers, OTP/email messaging services)
All of them are bound by contractual confidentiality obligations.
### 8. Security
We are committed to the security of personal data. We take appropriate security measures to limit misuse of and unauthorised access to personal data. This ensures that only the people who need it have access to your data, that access is protected and that our security measures are reviewed regularly.
### 9. Data retention
We keep data only as long as needed for the purposes in section 1, unless the law requires longer periods. In summary:
| Data | How long |
| --- | --- |
| Profile and account | while the account is active; after deletion, erased or anonymised within 30 days |
| Contractual and signed documents | 10 years from the end of the relationship |
| Invoices and accounting records | 10 years |
| Data and documents sent to the GSE | for the whole incentive period (20 years for renewable energy communities) and the related checks |
| Identity document and company extract | while you are a member, then as long as the signed documents that require them |
| IBAN | until the last payout is made |
| Electronic signature log | 10 years |
| Notification tokens | until logout, uninstall or account deletion |
| Face ID device key | until the feature is turned off, the password is changed or the account is deleted |
| Technical and security logs | 12 months |
| Error reports | 90 days |
| Backups | deleted on rotation within 35 days |
| Newsletter | until consent is withdrawn |
Data and documents are stored in encrypted databases (PostgreSQL on AWS RDS) and encrypted document storage (Amazon S3, with temporary and controlled access), in the AWS Frankfurt region (EU).
### 10. Transfers outside the EU
Platform data is stored in the European Union. Some providers in section 5 (Twilio, Expo, Google, Apple, Meta, Stripe, ClickUp) may process data in the United States. In these cases we make sure that:
- valid **Standard Contractual Clauses (SCC)** are in place, or
- the provider participates in the **EU-U.S. Data Privacy Framework**.
### 11. Automated decisions
We use an automated service to read bills and documents and pre-fill the data (section 1.5). You check and confirm the data before it is used. We do not take decisions that produce legal effects or similarly significantly affect you based solely on automated processing (Art. 22 GDPR).
### 12. Deleting your account
You can delete your account:
- **in the app**: Profile → Security → Delete account;
- **without the app**: by emailing [info+privacy@hexergy.it](mailto:info+privacy@hexergy.it) from the address you signed up with, with the subject “Account deletion”. We acknowledge your request within 5 working days and complete it within 30 days, after verifying your identity.
If you are a member of an energy community or one of your supplies has already been submitted to the GSE, you first need to give notice of withdrawal from the community and the supply's exit must be completed: the app shows you what is missing. After deletion we erase or anonymise your profile data within 30 days. If you signed in with Apple, we also revoke the authorisation you gave HexErgy on your Apple ID. We keep only the documents and data the law or the GSE requires us to keep, for the periods in section 9, and do not use them for any other purpose.
### 13. Children
The HexErgy app and services are not intended for anyone under 18. We do not knowingly collect data from minors.
### 14. Analysis, statistics and anonymisation
Data may be used for statistical and system analysis **only in aggregate or pseudonymised form**, so that users cannot be identified. This supports feature development, service improvement and reporting.
### 15. Third-party websites
This privacy policy does not apply to third-party websites linked from our website. We cannot guarantee that these third parties handle your personal data reliably and securely. We recommend reading their privacy policies before using them.
### 16. Changes to this policy
HexErgy may change this policy. We will tell you about significant changes by email or with a notification in the app. We recommend checking it regularly.
### 17. DPO and reports
HexErgy has appointed Avv. **Ludovica Terenzi**, VAT 15186081004, as **Data Protection Officer (DPO)**, who can be contacted by email at [info+privacy@hexergy.it](mailto:info+privacy@hexergy.it)
### 18. Your rights
You have the right to:
- **access** your data (Art. 15);
- **rectification** of inaccurate or incomplete data (Art. 16);
- **erasure** (Art. 17), within the retention obligations in section 9;
- **restriction** of processing (Art. 18);
- **portability**: receive your data in a readable format and transfer it to another controller (Art. 20);
- **object** to processing based on legitimate interest (Art. 21);
- **withdraw consent** at any time, without affecting processing already carried out (Art. 7.3);
- **lodge a complaint** with the supervisory authority (section 19).
To exercise them, email [info+privacy@hexergy.it](mailto:info+privacy@hexergy.it) or use the form at the bottom of this page. Tell us clearly who you are: we may ask you to verify your identity, so that we do not change or delete another person's data.
**Response times:** we acknowledge your request within 5 working days and reply without undue delay, and in any case within 30 days. For complex or numerous requests this can be extended by a further 2 months: in that case we tell you within the first month and explain why (Art. 12.3 GDPR).
### 19. Filing a complaint
If you are not satisfied with how we handle the processing of your personal data (or a complaint about it), you have the right to file a complaint with the Italian data protection authority, the **Garante per la Protezione dei Dati Personali** ([www.garanteprivacy.it](https://www.garanteprivacy.it)), if you believe the processing breaches the GDPR.
### 20. Contact details
The data controller is HexErgy S.R.L., registered office at Via Francia 6A, Guglionesi, Campobasso, Molise, 86034, Italy, VAT IT01895870705.
Email: [info+privacy@hexergy.it](mailto:info+privacy@hexergy.it)
Website: [https://hexergy.it/en](https://hexergy.it/en/?hsLang=en)
### 21. Data requests
For the most common requests you can use our data request form.
[](https://hexergy.it/?hsLang=en)
info@hexergy.it
+39 348 648 8468
Via francia, 6A Guglionesi, 86034, Molise, Italy
##### Connect with us
- [Cookie Policy](https://hexergy.it/en/cookie-policy-ue)
- [Privacy Policy](https://hexergy.it/en/dichiarazione-sulla-privacy-ue)
- [Terms and Conditions](https://hexergy.it/en/terms-and-conditions)
All rights reserved. Copyright © 2024 by HexErgy S.R.L P.IVA/ VAT number 01895870705
###### Stay connected and get updates in your inbox