Privacy Policy

1. Controller

Controller: Assecurit Ltd, 124 City Road, London, United Kingdom.

EnergyInfra is the trading name of the Service operated by Assecurit Ltd. For privacy requests, use the contact form or email contact@energyinfra.org.

2. What this Service does

EnergyInfra is a European renewables and energy-storage desk: a public project book, an investor member platform (including KYC and gated data rooms), and a sponsor / developer project-file room. Processing is limited to operating that Service, responding to enquiries, and meeting legal obligations.

3. Personal data we collect

Depending on how you use the Service, we may process:

• Contact and lead data — name, email, organisation, role, interests, message, phone (including callback requests), and similar fields from forms or the desk assistant.
• Investor account data — name, work email, password hash (or OAuth identity), organisation, optional “looking for” note, and later KYC fields when you request a data room (for example mobile, role title, company type, website, LEI or company registration details, last transaction information).
• Sponsor / seller data — company name, work email, password hash, address, contacts, locale preferences, and project-file content you upload or enter (documents and structured facts about your asset).
• Authentication data — session identifiers; if you use Google (or another configured provider), the provider shares basic profile data such as name and email.
• Technical / usage data — IP address, browser and device type, timestamps, and server logs needed for security, debugging and operation of the hosting platform.
• Bot-protection signals (Turnstile) — when Cloudflare Turnstile is enabled, limited client-side signals used solely to distinguish humans from bots on public forms (see section 5A).

Public project pages show commercial asset information. They do not publish private contact details of investors or the private contact fields of seller companies. Seller type (developer / owner) may appear where relevant.

4. Purposes and legal bases (GDPR Art. 6)

• Provide the Service and accounts — performance of a contract or steps prior to a contract (Art. 6(1)(b)).
• Respond to contact, callback and desk-assistant requests — legitimate interests in operating a B2B desk (Art. 6(1)(f)), or consent where we ask for it (Art. 6(1)(a)).
• Investor KYC and data-room access decisions — legitimate interests in counterparty diligence and fraud prevention (Art. 6(1)(f)); where required, legal obligation (Art. 6(1)(c)).
• Security, abuse prevention, spam / bot blocking and infrastructure logs — legitimate interests (Art. 6(1)(f)), including protecting public forms with Cloudflare Turnstile where configured.
• Marketing emails — only where permitted; for EEA/UK recipients we rely on consent or soft-opt-in rules where they apply (Art. 6(1)(a) or (f)). You can object or withdraw consent at any time.

Where we rely on legitimate interests, you may object under Art. 21 GDPR. Where we rely on consent, you may withdraw it at any time without affecting prior lawful processing.

5. Cookies and similar technologies

We use necessary cookies for authentication and session security (Auth.js / member and sponsor sessions). These are required to keep you signed in and to protect accounts.

Where Cloudflare Turnstile is enabled on public forms, Cloudflare may process strictly necessary signals (and any related cookies or similar storage used by Turnstile) solely for bot detection and abuse prevention. That processing is described in section 5A and in Cloudflare’s Turnstile Privacy Addendum.

We do not currently run third-party advertising cookies on the MVP. If we later introduce non-essential analytics or marketing cookies, we will request consent where required by the ePrivacy rules and the GDPR, and we will update this notice.

You can control cookies in your browser; blocking necessary cookies may prevent sign-in.

6. Recipients and processors

We share personal data only with:

• Hosting and database — cloud infrastructure (currently Railway / Postgres) to store and run the Service.
• Email delivery — Google Workspace SMTP (or another configured mail provider) to send transactional mail (confirmations, password resets, desk notifications).
• Sign-in providers — e.g. Google, when you choose “Continue with Google” (or other configured OAuth providers).
• Bot protection — Cloudflare, Inc., when Turnstile is enabled on public forms (see section 5A).
• AI assistance — if an AI key is configured, short conversation content from the desk assistant may be sent to that provider (e.g. Anthropic or OpenAI) to generate a reply. Do not put unnecessary sensitive data in chat.
• Professional advisers or authorities — where required by law or to establish, exercise or defend legal claims.

We do not sell personal data.

7. International transfers

Some processors may process data outside the EEA/UK (for example in the United States). Where GDPR requires it, we rely on an adequacy decision or appropriate safeguards such as the EU Standard Contractual Clauses (and UK addendum where relevant), plus supplementary measures where appropriate.

8. Retention

We keep personal data only as long as needed for the purposes above, including:

• Accounts — for the life of the account, then typically up to 24 months after closure for disputes and security, unless a longer legal retention applies.
• Leads / contact / callback records — typically up to 24 months after the last meaningful contact, unless you ask for earlier deletion and no legal hold applies.
• Sponsor project files and documents — for the life of the file relationship and a limited period afterwards for continuity and legal defence.
• Server / security logs — typically up to 24 months, longer if needed for an ongoing security investigation or legal obligation.

When retention ends we delete or anonymise data, subject to encrypted backup cycles.

9. Your rights (EEA / UK)

Subject to the GDPR / UK GDPR, you may have the right to:

• access your personal data;
• rectify inaccurate data;
• erase data (“right to be forgotten”);
• restrict processing;
• data portability;
• object to processing based on legitimate interests, and to direct marketing;
• withdraw consent where processing is based on consent;
• lodge a complaint with a supervisory authority.

In the EU you may contact your local data protection authority; in the UK, the Information Commissioner’s Office (ICO). To exercise rights with us, use the contact form or email contact@energyinfra.org. We may need to verify your identity before responding.

10. Children

The Service is a professional B2B platform and is not directed at anyone under 16. We do not knowingly collect personal data from children. If you believe a minor has provided data, contact us and we will delete it.

11. Security

We use appropriate technical and organisational measures (access controls, encrypted transport where supported, hashed passwords, least-privilege platform operator access). No method of transmission or storage is completely secure.

12. Changes

We may update this Privacy Policy. We will post the revised version on this page and update the “Last updated” date. For material changes we may also notify account holders by email or a notice in the Service.

13. Contact

Assecurit Ltd · 124 City Road, London · contact@energyinfra.org · Contact form