Privacy Policy

The Data Controller is SolarMatch S.r.l. (hereinafter "SolarMatch" or "Controller"), with registered office in Rome, Italy. Contact: hello@solarmatch.it Data Protection Officer (DPO): dpo@solarmatch.it

Personal data is processed for the following purposes: a) Providing the solar consultation service through the virtual assistant Sofia (AI), including energy consumption analysis, photovoltaic system sizing, and generation of personalised quotes. b) Connecting users with verified and qualified photovoltaic installers in the user's area. c) Service-related communications (consultation status, follow-ups, quote updates). d) Service improvement through aggregate and anonymised analysis of interactions. e) Compliance with legal and tax obligations.

Processing is based on the following legal grounds (Art. 6 GDPR): • Consent of the data subject (Art. 6.1.a): for data processing through the AI assistant Sofia and for sending promotional communications. • Performance of a contract or pre-contractual measures (Art. 6.1.b): for providing the consultation service and connecting with installers. • Legal obligation (Art. 6.1.c): for tax and regulatory compliance. • Legitimate interest of the Controller (Art. 6.1.f): for service improvement and fraud prevention.

We collect the following categories of data: a) Identification data: name, surname, email address, phone number (voluntarily provided by the user). b) Property data: address or province, property type, roof surface area, orientation and tilt, roof covering type. c) Energy data: annual consumption in kWh, average monthly bill in euros, data extracted from uploaded bills (supplier, time bands, committed power, average tariff). d) Browsing data: IP address, browser type, pages visited, session duration (via technical cookies). e) Conversation data: messages exchanged with the AI assistant Sofia, voice recordings (only if the user activates the dictation feature). We do not collect sensitive data (Art. 9 GDPR) or data relating to criminal convictions (Art. 10 GDPR).

The service uses an artificial intelligence system (Sofia) to: • Analyse energy data provided by the user and generate sizing and savings estimates. • Extract information from uploaded bills via optical character recognition (OCR). • Evaluate the user's profile to propose personalised solutions (lead scoring). Pursuant to Art. 22 GDPR, the user has the right not to be subject to decisions based solely on automated processing that produce legal or significant effects. All AI-generated proposals are indicative and subject to verification through an in-person inspection by the installer. No binding decision is made without human intervention. The user may request human intervention, express their opinion, and contest the decision by contacting the DPO.

Personal data may be shared with: • Verified partner installers: limited to data necessary for quote preparation and site inspection (name, contact details, property address, proposed system technical data). Sharing occurs only with the user's explicit consent. • Technology service providers: hosting providers (EU), transactional email services, AI provider (Anthropic, based in the USA — see section 7). • Competent authorities: when required by law. Data is not sold to third parties nor used for third-party marketing purposes.

Some data (conversation messages with Sofia) is processed through Anthropic's AI service (Claude), with servers in the United States. Transfers comply with Art. 46 GDPR, based on Standard Contractual Clauses (SCCs) approved by the European Commission and the EU-US Data Privacy Framework. Data sent to Anthropic is not used for AI model training, in accordance with the non-training policy applied to commercial APIs.

Personal data is retained for the following periods: • Consultation data (conversations, quotes): 24 months from the last interaction. • Lead contact data: 12 months if not converted into a contract with an installer. • Uploaded bills: 6 months after quote generation, then automatically deleted. • Browsing data (cookies): according to the durations specified in the Cookie Policy. • Data required for legal obligations: for the period required by applicable law. Upon expiry, data is deleted or irreversibly anonymised.

Under Articles 15-22 of the GDPR, the user has the right to: • Access (Art. 15): obtain confirmation of data processing and access their personal data. • Rectification (Art. 16): correct inaccurate or incomplete data. • Erasure (Art. 17): request deletion of their data ("right to be forgotten"). • Restriction (Art. 18): restrict processing in certain cases. • Portability (Art. 20): receive their data in a structured, machine-readable format. • Objection (Art. 21): object to processing on legitimate grounds. • Withdrawal of consent: withdraw consent at any time, without prejudice to the lawfulness of prior processing. To exercise these rights, contact: dpo@solarmatch.it The user also has the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali — www.garanteprivacy.it).

The website uses technical cookies necessary for operation and analytics cookies (in aggregate and anonymised form). For further details, please refer to the Cookie Policy accessible from the cookie banner and the site footer. We do not use third-party advertising profiling cookies.

The Controller reserves the right to amend this policy. Changes will be published on this page with the update date indicated. In the event of substantial changes, a notification will be sent via email to registered users.

For any questions regarding personal data processing: SolarMatch S.r.l. Email: hello@solarmatch.it DPO: dpo@solarmatch.it Location: Rome, Italy