Privacy Policy

1. Introduction

1.1 Lun Energy ApS ("Lun" "we", "our", "us") is a company working to minimise the climate footprint of homes by making the installation of heat pump systems more accessible to homeowners. We are registered as a private limited company in Denmark with Company registration number 43169459.

1.2 Lun is the data controller for the processing of your personal data on the terms set out in this policy (the "Privacy Policy").

1.3 Please read the Privacy Policy thoroughly to understand how we process your personal data.

1.4 You can always contact us by email: hello@lun.energy.

2. Processing Activities and Purposes

2.1 Submission of Offers and Delivery of Heat Pump Systems

• We process your personal data, including your name, address, email, and information about your home to deliver the relevant heat pump system that meets your property’s energy demand and is necessary for the installation.

• Our legal basis for processing your personal data follows from GDPR Article 6(1)(b) regarding processing which is necessary for the performance of the purchase contract, including pre-contractual correspondence which takes place at your request.

• Your personal data is stored for 2 years after delivery of the heat pump system on the basis of the mandatory consumer rules in Sections 72-87 of the Danish Sale of Goods Act.

• When you take the opportunity to purchase services from us, we ask you to provide your payment information. We use a secure third party to conduct transactions.

2.2 User Subscription and Ongoing Service of Heat Pump Systems

• If you subscribe as a user, we will continuously collect information from your heat pump system. The purpose is to improve our service, to optimize the system's performance, and to measure how your home's climate footprint is minimized. In addition, as the owner of a heat pump system, you are obliged to continuously carry out appropriate inspections and maintenance, cf. the Danish Executive Order No. 1977 of 27/10/2021 on the use of pressure equipment. The subscription is also intended to help you fulfil this obligation in section 2(2)(9) and Appendix 7 of the Executive Order.

• Our legal basis for processing your personal data follows from GDPR Article 6(1)(b) regarding processing which is necessary for the performance of a contract, including pre-contractual correspondence which takes place at your request.

• The information is stored for 6 months after the end of the subscription, however, personal information collected in connection with any purchase, or any additional purchase made through us will be subject to a 2-year retention period from the date of purchase, as a result of the right of complaint cf. Sections 72-87 of the Danish Sale of Goods Act.

• When you take the opportunity to purchase services from us, we ask you to provide your payment information. We use a secure third party to conduct transactions.

2.3 Other Contact

• When you communicate with us by email and phone, we process your identification information, including name, email, phone number, as well as the content of the message or call. We do this to answer your questions or otherwise take care of your inquiry.

• Our legal basis for processing your personal data is GDPR Article 6(1)(f) regarding processing based on a legitimate interest, where your interests are not overridden because we only process what is absolutely necessary to answer your inquiry. If you wish to be a customer, our basis for processing will be GDPR Article 6(1)(b) regarding processing which is necessary for the performance of a contract, including pre-contractual correspondence, which takes place at your request. This will thus be covered by section 2.2 above.

• We store the correspondence up to 6 months after the last contact.

2.4 Newsletter

• We use your email to send you marketing if you have signed up for our newsletter.

• Our legal basis for processing your personal data is GDPR Article 6(1)(a) regarding processing based on consent, cf. Section 10 of the Danish Marketing Practices Act.

• You can withdraw your consent at any time by using the unsubscribe function in each email.

• Your email will be deregistered as soon as possible after you unsubscribe from the newsletter. The consent must be renewed every 2 years, as after 1-2 reminders, we will delete your email from the subscription list.

2.5 Customer Surveys

• With your specific consent, we would like to occasionally perform customer surveys to ensure that the services we offer meet your requirements. We will do this through surveys or market research. Any feedback you give us will be used solely for the purpose of improving our services and will not be published.

• Our legal basis for processing your personal data in the context of feedback is GDPR Article 6(1)(a) regarding consent.

• You can withdraw your consent at any time by contacting us.

• Information about feedback is stored up to 5 years after receipt. To the extent possible, we store your feedback in anonymous form and have a long retention period in order to measure our own efforts over time.

2.6 Statistics

• When visiting our website, cookies are collected in the same way as elsewhere on the Internet. All information related to our use of cookies can be found in our Cookie Policy. Our basis for this processing is consent in accordance with the cookie rules.

• We record activities on your customer profile by collecting cookies about your user behavior. All information related to our use of cookies can be found in our Cookie Policy. Customer profile accuracy is used to create statistics so that we can improve our service. Our basis for processing is consent in accordance with the cookie rules.

• We also continuously perform anonymous statistics on the information we receive from all our customers' heat pump systems. The purpose is to measure the overall climate impact and monitor the positive impact our service has on the climate. The statistics are compiled solely on the basis of aggregated data. Our basis for processing the anonymous statistics is GDPR Article 6(1)(f) regarding processing based on a legitimate interest, where your interests are not overridden because we provide full anonymization.

2.7 Job Applications

• If you wish to apply for a job with us, you can send us your CV and motivated application as well as any references that we may contact. We will then process your name, email and the other information that appears on your application. All processing is confidential and takes place exclusively for recruitment purposes. Your information will not be disclosed without your consent.

• Our legal basis for processing your personal data is GDPR Article 6(1)(b) regarding processing necessary for the performance of a contract, including pre-contractual correspondence which takes place at your request.

• The retention period is 6 months after receipt in accordance with the Danish Data Protection Agency's guidelines on the retention period for job applications. If we wish to store your application for more than 6 months, we will send you an email inviting you to consent to a specific extension of the retention period.

3. Information We Collect from Third Parties

3.1 We collect information about you from yourself and from reliable public sources relating to your home and your home's energy demand. This typically involves identification information, including name, address, and information about your home.

3.2 In some cases, we may receive information about you from our subcontractors or business partners. This typically concerns your contact information, including name, email, and phone number.

4. Recipients or Categories of Recipients

4.1 When you use our services, we pass on your personal information to our subcontractors (electricians, technicians and plumbers). Our subcontractors are joint controllers when they receive your personal data – see section 5 for further information.

4.2 In addition, we use security-approved data processors who support us with IT or other services. When we use data processors, a data processing agreement has always been entered determining the subject matter and duration of the processing, the nature and purpose of the processing, the types of personal data and the categories of data subjects as well as the data controller's obligations and rights.

4.3 In rare cases, we also disclose your information to authorities or other third parties (e.g., lawyers and accountants), but only if we are obliged to do so by law or in order to protect our interests in a legal dispute.

5. Joint Data Responsibility

5.1 If Lun does not carry out all the processing described in sections 2.1, 2.2 and 2.6, it may take place in cooperation with a commercial partner your personal data is processed based on joint data responsibility. You will be notified if this is the case at the time of entering into the agreement.

5.2 The reason for the joint data responsibility in these situations is that we and the partner each comes with its own expertise to the sub-elements that are required to estimate, deliver, install, maintain, and repair your heat pump system. Typically, the processing of your personal data will be divided between the parties as follows:

• The partner sells hardware, install, repair and handles the sale, payment, warranty, and your right of complaint, including processing the personal data necessary for these purposes.

• Lun calculates usage and required performance based on your home's size, occupancy conditions, and ongoing usage information related to legal reporting and monitoring of your heat pump system. For these purposes, Lun processes the personal data necessary for these purposes, cf. sections 2.2 and 2.6.

5.3 You may request to access the relevant parts of any joint data responsibility agreement at any time. In this agreement Lun and the partner have decided on the distribution of their respective responsibilities for compliance with the obligations of the GDPR pursuant to GDPR Article 26.

6. Security

6.1 All your information is stored on secure servers in the EU.

6.2 We maintain appropriate organizational, technical and physical security measures to protect your information against accidental or unlawful destruction, loss, alteration, unauthorized disclosure of or access in accordance with the data protection rules in Denmark and the EU.

6.3 Despite our efforts to establish a secure IT environment, you should know that no information is completely secure on the Internet. You should therefore always include appropriate safety measures on your own equipment.

7. Your Rights

In accordance with GDPR you have the right of access and the rights to rectification, to erasure, to restriction of processing and to data portability. All such requests may be sent to hello@lun.energy.

7.1 If you are dissatisfied with how we process your personal data and if any inquiry to us has not led to a satisfactory result, you can file a complaint with the relevant data protection agency – in most cases, the Danish Data Protection Agency: Datatilsynet, Carl Jacobsens Vej 35, DK-2500 Valby, e-mail: dt@datatilsynet.dk.

8. Amendments

8.1 We reserve the right to change the Privacy Policy from time to time. If there are significant changes, we will inform you by email.