Privacy Policy

1. Data Controller

The Data Controller is SoLink S.r.l., responsible for the management and protection of personal data processed through the Sunnix platform.

For privacy-related requests, you can write to: info@sunnix.it.

2. Types of Data Collected

Sunnix collects only the data necessary for the operation of the service. In particular:

Data provided voluntarily:

• data entered in forms (demo requests, installers, businesses);
• content and information provided in contact requests.

Data generated by using the site:

• anonymous technical data via analytical cookies (Google Analytics);
• data necessary for the operation of simulations and configurations.

Data from external services:

• solar data and roof geometries via Google Solar API;
• technical data not attributable to the user.

Data collected through the Virtual System service:

• email address (stored in encrypted form);
• technical data of the configured system (geographic coordinates, installed power, orientation and tilt of the pitches);
• daily simulation logs (estimated production, calculated savings, weather conditions used for the calculation).

For details on methods and storage times, consult the Transparency page: sunnix.it/transparency.

3. Purposes of Processing

The collected data is used exclusively for the following purposes:

• providing photovoltaic simulations and configurations;
• managing demo requests, commercial requests, or professional interests;
• allowing users to contact installers and businesses;
• monitoring the functioning of the site via anonymous cookies;
• improving the service through aggregate and non-identifying analysis;
• sending the daily estimated production report to users subscribed to the Virtual System service;
• calculating and updating the cumulative potential savings counter for Virtual System service users.

Sunnix does not carry out profiling and does not use data for automated marketing.

4. Legal Basis

Processing takes place pursuant to Art. 6 GDPR on the following legal bases:

• execution of a service requested by the user (simulations, configurations);
• contractual fulfillment (installers, businesses);
• express consent (contact forms and Virtual System service);
• legitimate interest of the Data Controller (anonymous analysis to improve the site).

5. Methods and Retention Periods

Sunnix retains data only for the time necessary for the stated purposes.

User configurations are stored for 48 hours and then automatically deleted, unless a quote is requested, which extends the retention period until the completion of the request itself.

Solar data obtained via Google Solar API may be subject to technical caching to improve performance, without including personal information.

Data related to the Virtual System service (encrypted email and technical system data) are stored for the duration of the subscription and deleted within 30 days of cancellation. Daily simulation logs are deleted within 7 days of the virtual system cancellation.

Price observatory entries have no expiry: they are anonymous by construction — nobody can trace them back to whoever wrote them, ourselves included — and a price archive is useful precisely because it keeps past years too. The hashed IP fingerprints used for rate limiting expire within a minute instead, together with the counting window.

For more detailed information on storage times and methods, the Transparency page is available: sunnix.it/transparency

6. Data Sharing

Personal data may only be shared with third-party providers that support the operation of the service:

• email services and server infrastructure (hosting, CDN);
• providers managing payments and subscriptions (Stripe);
• anonymous analytics tools (Google Analytics);
• operational tools essential to the Sunnix platform;
• Twilio SendGrid Inc. — email delivery service for the daily report of the Virtual System service;
• Open-Meteo — weather data service (only the geographic coordinates of the system are shared, no identifying personal data);
• PVGIS — European Commission — historical solar irradiation data (only the geographic coordinates of the system are shared, no identifying personal data).
• Supabase Inc. — the managed database the whole platform rests on: it holds profiles and sessions, configurations and simulations, the Virtual Plant service data and the price observatory entries;
• Upstash Inc. — temporary storage used to limit the number of requests per IP address: the address never reaches it in the clear, only as a fingerprint hashed with a salt that stays with us, and the key expires within a minute together with the counting window;

Data is not sold or transferred for purposes other than those indicated in this policy.

7. Data Subject Rights

The user may at any time exercise the rights provided by Articles 15-22 of the GDPR, including:

• right of access to their data;
• rectification of inaccurate or incomplete data;
• erasure ('right to be forgotten');
• restriction of processing;
• data portability;
• objection to processing;
• withdrawal of consent at any time.

Users of the Virtual System service can exercise their right to cancellation at any time via the link present in every email received, or by writing to: info@sunnix.it.

8. Complaint to the Supervisory Authority

The user may lodge a complaint with the Data Protection Authority if they believe the processing violates current legislation.

9. Use of Google Analytics

Sunnix uses Google Analytics with anonymized IPs and restricted configuration, exclusively for aggregate and non-identifying analysis.

Such data does not allow the identification of users.

9b. Use of Microsoft Clarity

Sunnix uses Microsoft Clarity, a behavioral analysis tool provided by Microsoft Corporation, to understand how users interact with the site through heatmaps and anonymous session recordings.

The data collected by Microsoft Clarity is anonymous and aggregated. It does not allow user identification. For more information, consult the Microsoft privacy policy: privacy.microsoft.com.

9c. Price observatory

The price observatory collects what people declare they paid for their own system. It neither asks for nor stores name, email, phone, town, installation month or free-text fields, and the IP address is not stored alongside the entry nor in any way that could link back to it: it does not process personal data, which is why it does not appear among the categories of data listed above.

Precisely because it is anonymous, a submitted entry cannot be traced to whoever wrote it: the database holds nothing that says whose it is, and we do not know either. The link is kept only by the browser it was sent from, which remembers its identifier: from there the entry can be completed later or removed entirely, at any time. From another device this is not possible, and not by our choice: no data exists with which to recognise it. Whoever changes device or clears the browser loses that link, and the entry stays in the archive — as anonymous as it always was. This is also stated next to the submit button, before the entry is sent. What we publish are medians, ranges and individual entries, deliberately coarsened. Each entry shows the size band instead of the exact kWp, the two-year window instead of the year, the macro-area instead of the region, the rounded price per kWp, whether there was storage and the type of company. The total in euros is not published: dividing it by the price per kWp would recover the exact size of whoever filled the form in — the very thing the band exists to withhold. No combination is shown if it occurs fewer than eight times. Everything else declared — surface, site, components, brands, warranty, satisfaction — appears only in aggregate, as the middle price of a group of at least eight entries, never next to a single entry.

10. Changes to the Privacy Policy

Sunnix may update this policy for regulatory adaptations or service improvements. Changes will be published on this page indicating the update date.

11. Contacts

For requests, clarifications, or exercising privacy rights: info@sunnix.it