Privacy Policy

Last updated: 3 August 2026

1. Who is responsible for your information

EnergyOn South Africa Pty Ltd ("EnergyOn", "we") is the responsible party under the Protection of Personal Information Act, 2013 ("POPIA") for personal information processed through the EnergyOn Sim websites and application. Contact our Information Officer at hello [at] energyon [dot] co [dot] za or +27 (0)10 596 1234.

2. What we collect

• Account information — your name, work email address, password (stored hashed), company/workspace name, role, and optional phone number.
• Billing information — plan, billing interval, invoices, and payment references. Card details are captured directly on our payment provider's secure pages; we store payment tokens only, never card numbers.
• Customer project data — the content you upload to run analyses: demand profiles, tariffs, site details and, where you include it, personal information about your customers. For that content you are the responsible party and we act as your operator/processor, handling it only on your instructions to provide the Service.
• Usage and technical data — log data (IP address, request identifiers, timestamps), device/browser information and in-app events used for security, quota metering and product improvement. This includes product-analytics events and crash reports processed on our behalf by PostHog and Sentry (both hosted in the European Union).
• Session recordings — we record how the application is used (pages visited, clicks, scrolling, navigation and the content displayed on screen) so we can support you effectively and find and fix usability problems. Recordings are processed on our behalf by PostHog (European Union). These recordings show what is on screen, including the values you enter and the reports you generate. Two exclusions apply: password fields are never recorded, and no network request or response data is captured. Card details are never recorded because they are never entered in our application — our payment provider collects them on its own page. You can turn recording off at any time — see section 8.
• Communications — messages you send via our contact form, live chat (provided by tawk.to), email, and Professional-Demo requests.

3. Why we process it (purposes and lawful basis)

• To create and administer your account and workspace, and deliver the Service (performance of a contract).
• To verify your email address, secure the platform, prevent abuse and enforce plan limits (legitimate interests / contract).
• To bill subscriptions, issue invoices and comply with tax and accounting law (contract / legal obligation).
• To respond to enquiries, demo requests and support (contract / consent).
• To send service notices (verification, billing, trial and account emails). Marketing communications, if any, are sent only with an opt-out and in accordance with POPIA and applicable law.

4. Who we share it with

We do not sell personal information. We share it only with service providers who process it on our behalf under appropriate safeguards:

• Hosting and infrastructure providers (application, database and file storage);
• Email delivery providers (verification, billing and account emails);
• Our payment gateway (card tokenisation and payment processing);
• Live-chat provider (tawk.to) when you use the chat widget;
• Product-analytics and session-recording provider (PostHog, European Union region);
• Error and performance monitoring provider (Sentry, European Union region);
• Professional advisers and authorities where required by law.

Some providers may store information outside South Africa; where that happens we ensure the recipient is subject to a law, binding corporate rules or a contract providing an adequate level of protection as required by section 72 of POPIA. Our analytics and monitoring providers are hosted in the European Union, where they are subject to the GDPR and bound by a written data-processing agreement with us.

5. Access to your workspace by our staff

Supporting you sometimes requires us to see what you see. Our support and technical staff can enter your workspace and work in it as a user of that workspace would — for example to diagnose a fault you have reported, check a calculation, or help you set something up.

We limit and record that access:

• Only EnergyOn personnel holding the platform administrator role can do it. Entry is deliberate — a staff member selects your workspace explicitly, there is no standing or automatic access — and that authorisation is re-checked on every request.
• Billing and payment actions are blocked while a staff member is in your workspace. They cannot buy, change or cancel a plan, capture a card, or move money in any way.
• Every action is logged — who, when, from which address, and in which workspace — and is marked as performed by our staff rather than by you. Entering and leaving are logged separately, including how long the access lasted.

We do this to provide and support the Service (performance of our contract with you) and to keep the platform working correctly and securely (legitimate interests). Where your workspace contains personal information about your own customers, we remain your operator for that content and access it only to provide and support the Service, never for our own purposes.

You may request a record of staff access to your workspace at any time — see section 8.

6. Security

We apply appropriate, generally accepted technical and organisational measures: encrypted transport (HTTPS), hashed passwords, httpOnly session cookies, role-based access, tenant isolation, audit logging, and the principle of least privilege. Staff access to customer workspaces is covered in section 5. No system is perfectly secure; notify us immediately of any suspected compromise. Where a data breach occurs that is notifiable under POPIA, we will notify the Information Regulator and affected data subjects as required.

7. Retention

We keep account and workspace data for as long as your account is active. After account closure we retain data only as long as needed for lawful purposes (for example financial records retained per tax law), after which it is deleted or de-identified in the ordinary course of operations. You may request export or deletion at any time (section 8).

8. Your rights under POPIA

• Request access to the personal information we hold about you;
• Request correction or deletion of inaccurate, outdated or unlawfully held information;
• Object to processing based on legitimate interests, and opt out of direct marketing;
• Turn off product analytics and session recording — in the application, under Settings. This stops both event collection and recording for your account. Error and crash reporting cannot be switched off: it is how we keep the service working and secure, and it carries no analytics profile.
• Withdraw consent where processing relies on consent;
• Complain to the Information Regulator (South Africa): inforegulator.org.za · complaints.IR [at] inforegulator [dot] org [dot] za.

To exercise any right, email hello [at] energyon [dot] co [dot] za. See also our PAIA / POPIA page for formal access requests.

9. Cookies

The application sets only two cookies, both strictly necessary: an httpOnly session cookie and a CSRF token that keep you signed in securely. The marketing site sets no tracking cookies of its own; the optional live-chat widget (tawk.to) sets its own cookies when loaded, governed by its provider's policy.

Our product analytics deliberately uses no cookies at all — it stores an anonymous identifier in your browser's local storage instead. That identifier is cleared when you sign out. Analytics and session recording are not strictly necessary, and you can switch them off at any time (section 8); we rely on our legitimate interest in securing and improving the service, in line with section 11(1)(f) of POPIA.

10. Children

The Service is a business tool and is not directed at children under 18. We do not knowingly process children's personal information.

11. Changes to this policy

We may change this policy at any time, with or without notice. Changes take effect when the updated policy is published on our website; the "Last updated" date above always reflects the current version. Where we begin processing personal information for a materially different purpose, we will notify you as POPIA requires.

12. Contact

EnergyOn South Africa Pty Ltd · Information Officer · hello [at] energyon [dot] co [dot] za · +27 (0)10 596 1234