Privacy Policy

1. Data Controller

The Data Controller is SoLink S.r.l., with registered office at Via Bergamo 44, 23807 Merate (LC), Italy, VAT IT03727580130, responsible for the management and protection of personal data processed through the Sunnix platform.

For privacy-related requests, you can write to: info@sunnix.it

1b. Two different roles, not to be confused

Sunnix handles two categories of data in two different roles, and the difference decides who answers for what.

• The data of people who use Sunnix — visitors, account holders, subscribers: profile, email, usage, billing. Here SoLink S.r.l. is the data controller, and this policy describes what it does.
• The data of the customers of a subscribed company: a roof's address, consumption, an estimate, a proposal, a job quote with its photos, an appointment booked from its calendar, a request that came from a plant check, an uploaded document. Here the controller is the company that enters the data or receives the request, and SoLink acts as processor under Art. 28 GDPR, according to the data processing agreement the company accepts before the trial or the subscription:

sunnix.it/data-processing-agreement

It means that with those data Sunnix does only what the company asks it to do, and does not use them for itself: it does not resell them, cross-reference them or put them on any list.

When you ask for a quote from a company's link, the estimate you made — address and power, without name or contact details — appears among that company's requests, and it can open it as a system. Name, phone and email reach only the company, in the request email.

When a company's owner asks Sunnix to set it up, or when Sunnix prepares it before handing it over, a person from Sunnix works inside that account in the same role: processor, on the company's behalf. They can do so for seven days from the request, or for two weeks after handover; every change stays in a log the owner reads, and the owner closes access whenever they want. Sunnix can't touch the subscription, the people or the page's address.

When you book an appointment from a company's calendar, we save day, time, address and service; your name and phone number reach only the company, in the booking email, and we do not save them. We do not email you: your calendar reminds you, from the file you download, and from there you have the link to move or cancel.

When you use the plant check, or the panel cleaning check, on a company's link and ask it for a job, the address, the power and the check summary appear among that company's requests. Your name and contact details reach only the company, by email.

2. Types of Data Collected

Sunnix collects only the data necessary for the operation of the service. In particular:

Data provided voluntarily:

• data entered in contact forms and demo requests;
• content and information provided in contact requests.
• reports of content on company pages (sunnix.it/report): the page, the reason, the text and the email we send the receipt to. They reach us by email and are not saved in a database.

Data generated by using the site:

• anonymous technical data via analytical cookies (Google Analytics);
• data necessary for the operation of simulations and configurations.

Data from external services:

• solar data and roof geometries via Google Solar API;
• technical data not attributable to the user.

Data of those with a Sunnix Pro subscription:

• the company data the subscriber publishes: legal name, address, contacts, logo, price list;
• the people the subscriber adds to the account: name and email, so each has their own access and their own alerts;
• the estimates, proposals and signed links the subscriber creates, noting which person made them — which serves to send the alert to the right person, not to measure their performance;
• the documents a company uploads for its own product pages — datasheets, certifications, warranties: it publishes them and can delete them from its account. ⚠️ Not bills: when a company uploads one to compose a quote, the PDF is read in its browser and never reaches our servers — only the consumption figures the estimate needs remain;
• billing data, handled by Stripe: Sunnix neither sees nor stores card details. To issue the electronic invoice we collect the SDI code (or PEC), VAT number and, if the subscriber is a natural person, the tax code: these stay with Stripe alongside billing and are kept for ten years, as accounting law requires.
• for each of the company's people, the inbox for alerts, confirmed with a link; what the company does, which decides what it sees in the account; who accepted the data processing agreement, when and which version; the log of what a Sunnix person did in the account, if the company asked for it.

Data of those who activate monitoring for a system:

• the email address where alerts and the summary arrive;
• the technical data of the system: coordinates, size, orientation and tilt of the roof faces;
• the readings and the nightly comparison between expected and real production, with the weather used for the calculation.

For details on methods and storage times, consult the Transparency page: sunnix.it/transparency

3. Purposes of Processing

The collected data is used exclusively for the following purposes:

• providing photovoltaic simulations and configurations;
• managing demo requests, commercial requests, or professional interests;
• allowing users to contact installers and businesses;
• understanding how the site is used through aggregate statistics, only if you have accepted statistical cookies;
• improving the service through aggregate and non-identifying analysis;
• send subscribers the alerts they chose to receive: an estimate made by a customer on their links, a reply to a proposal, the monthly summary;
• work out every night, for those who activated monitoring, how much the system should have produced and compare it with what it did produce.
• receive and handle reports of illegal content on company pages, as required by Regulation (EU) 2022/2065.

Sunnix does not carry out profiling and does not use data for automated marketing.

4. Legal Basis

Processing takes place pursuant to Art. 6 GDPR on the following legal bases:

• execution of a service requested by the user (simulations, configurations);
• contractual fulfillment (installers, businesses);
• explicit consent: the contact form and statistical cookies, which you can withdraw at any time from the cookie button at the bottom of every page;
• the Controller's legitimate interest in security: anti-abuse limits, which count requests by a salted hash of the IP address, and technical server logs.
• compliance with a legal obligation: handling content reports (Regulation (EU) 2022/2065) and keeping billing data.

5. Methods and Retention Periods

Sunnix retains data only for the time necessary for the stated purposes.

Estimates made on the site without an account (simulations and configurations) delete themselves after 48 hours. If you save them in your account, or made them on a company's link, they stay as long as that account exists. Those made before 18 September 2026 with a request for information to Sunnix stay 24 months from creation, then delete themselves.

Answers from the weather and yield services may stay briefly in a temporary cache, so we don't ask twice: the key is the location rounded to about 100 metres, with no other data.

The data of a Sunnix Pro subscription stays for the duration of the subscription. After it ends the company can export it from the account; after twelve months without reactivation it is permanently deleted, with two warnings before that happens.

Monitoring data for a system is kept while the service is active on that system, and is deleted when the service is switched off or the account is closed: deletion is immediate, and after thirty days the data is destroyed. ⚠️ One exception: if a company closes its account, the systems that came from one of its accepted proposals — those belonging to a customer who bought them — are held for twenty-four months, so the customer can claim them into their own account using the link they already received. After those months, if nobody claims them, they are deleted like the others.

Price observatory entries have no expiry: they are anonymous by construction — nobody can trace who wrote them, ourselves included — and a price archive exists precisely because it keeps past years too. The salted hashes of IP addresses used to rate-limit requests expire with their counting window: from one minute for most limits up to one day for the strictest.

For more detailed information on storage times and methods, the Transparency page is available: sunnix.it/transparency

6. Data Sharing

Personal data may only be shared with third-party providers that support the operation of the service:

• email services and server infrastructure (hosting, CDN);
• providers managing payments and subscriptions (Stripe);
• anonymous analytics tools (Google Analytics);
• operational tools essential to the Sunnix platform;
• Twilio SendGrid Inc. — email delivery: the monitoring report, the alerts, and the proposals a company sends its customers;
• Open-Meteo — weather data service (only the geographic coordinates of the system are shared, no identifying personal data);
• PVGIS — European Commission — historical solar irradiation data (only the geographic coordinates of the system are shared, no identifying personal data).
• Supabase Inc. — the managed database, on servers in the European Union, on which the whole platform rests: profiles and sessions, configurations and simulations, system monitoring data and price observatory entries live there;
• Upstash Inc.: temporary memory on servers in the European Union, used to limit the number of requests per IP address, which never arrives in clear but as an encrypted fingerprint with a salt that stays with us, and for weather answers, with the location rounded to about 100 metres;
• Vercel Inc. — the platform the site runs on, with its functions on servers in the European Union: data passes through it to reach the browser, and remains in technical logs for the provider's retention period;
• ⚠️ Of a company's customers, Sunnix keeps a single contact: the email address a proposal was sent to, and it keeps it encrypted. That address reaches Twilio SendGrid, which delivers the message, and no other provider. Everything else — name, phone, the text of a request — never touches our database: it leaves as an email to the company's inbox and we do not save it.
• Google Ireland Ltd. and Google LLC: the map, address search and roof solar data receive the address or coordinates you type or choose; with your consent, Google Analytics receives visit statistics;
• CookieYes Limited: the cookie banner, which records the choice you make about consent.

Data is not sold or transferred for purposes other than those indicated in this policy.

No artificial intelligence service receives your data or the data of a company's customers: the energy bill is read in the browser, and the text in photos is read by a program running on your device.

6b. Transfers outside the European Union

The database, the functions of the site and the API and the temporary cache run on servers in the European Union (Supabase, Vercel and Upstash). Some providers are, however, based outside the European Union, and access from there remains possible, for support or because the law of their country requires it; others, such as Twilio (SendGrid) and Google, may also process data outside it. We use them only with one of these safeguards:

• the EU-U.S. Data Privacy Framework, in which Vercel, Twilio (SendGrid), Google and Stripe participate;
• standard contractual clauses approved by the European Commission (Decision (EU) 2021/914), in their data processing agreements, for Supabase and Upstash;
• for CookieYes, which is based in the United Kingdom, an adequacy decision of the European Commission or the standard contractual clauses of its data processing agreement.

7. Data Subject Rights

The user may at any time exercise the rights provided by Articles 15-22 of the GDPR, including:

• right of access to their data;
• rectification of inaccurate or incomplete data;
• erasure ('right to be forgotten');
• restriction of processing;
• data portability;
• objection to processing;
• withdrawal of consent at any time.

In your account, under “Subscription and alerts” (for a company it sits inside “Company”), you will find “Your data”: you can download a copy of everything we keep as JSON, and you can close your account, which deletes systems, estimates and proposals. ⚠️ The link at the bottom of monitoring emails turns the emails off and nothing else, and deletes nothing: it stops the report, it does not exercise the right to erasure. To delete your data, close the account or write to:

info@sunnix.it

8. Complaint to the Supervisory Authority

The user may lodge a complaint with the Data Protection Authority if they believe the processing violates current legislation.

9. Use of Google Analytics

Sunnix uses Google Analytics through Google Tag Manager, solely for aggregate, non-identifying analysis. Both stay off until you accept statistical cookies: before your choice, consent is denied by default, so no statistics cookies are written and no browsing data is sent.

Such data does not allow the identification of users.

On proposals, estimates, projects and pages with a code in their address, Google Tag Manager does not load at all, not even with consent: the address of those pages is a key. And the widgets a company puts on its own site show no banner and measure nothing.

9c. Price observatory

The price observatory collects what people declare they paid for their own system. It neither asks for nor stores name, email, phone, town, installation month or free-text fields, and the IP address is not stored alongside the entry nor in any way that could link back to it: it does not process personal data, which is why it does not appear among the categories of data listed above.

Precisely because it is anonymous, a submitted entry cannot be traced to whoever wrote it: the database holds nothing that says whose it is, and we do not know either. The link is kept only by the browser it was sent from, which remembers its identifier: from there the entry can be completed later or removed entirely, at any time. From another device this is not possible, and not by our choice: no data exists with which to recognise it. Whoever changes device or clears the browser loses that link, and the entry stays in the archive — as anonymous as it always was. This is also stated next to the submit button, before the entry is sent. What we publish are medians, ranges and individual entries, deliberately coarsened. Each entry shows the size band instead of the exact kWp, the two-year window instead of the year, the macro-area instead of the region, the rounded price per kWp, whether there was storage and the type of company. The total in euros is not published: dividing it by the price per kWp would recover the exact size of whoever filled the form in — the very thing the band exists to withhold. No combination is shown if it occurs fewer than eight times. Everything else declared — surface, site, components, brands, warranty, satisfaction — appears only in aggregate, as the middle price of a group of at least eight entries, never next to a single entry.

10. Changes to the Privacy Policy

Sunnix may update this policy for regulatory adaptations or service improvements. Changes will be published on this page indicating the update date.

11. Contacts

For requests, clarifications, or exercising privacy rights:

info@sunnix.it