Privacy Policy

This policy explains which personal data Solar Client (solarclient.de) processes, for what purpose, on which legal basis, for how long, who receives it, and which rights you have. It is written for the platform as it actually works: customers publish a service request, verified solar companies submit quotes, and the two sides agree a contract between themselves. It applies to the website, the customer, company and administration panels, e-mails we send, and the mobile app (once released), which uses the same accounts and the same data.

1. Controller and contact

⟨operator name — to be completed in Settings⟩
⟨operator address — to be completed in Settings⟩
Represented by: ⟨authorised representative — to be completed in Settings⟩
Commercial register: ⟨commercial register / number — to be completed in Settings⟩ · VAT ID: ⟨VAT ID — to be completed in Settings⟩

Data protection contact: datenschutz@solarclient.de · Data protection officer: ⟨data protection officer — to be completed in Settings⟩
General support: info@solarclient.de

Supervisory authority responsible for us: ⟨competent data protection supervisory authority — to be completed in Settings⟩. You may lodge a complaint with this or any other EU supervisory authority at any time.

2. Who is responsible for what

Solar Client is a marketplace. We bring together a person who needs a solar service (the customer) and businesses that offer it (the companies). We do not carry out the work and we are not a party to the contract concluded between customer and company.

• For everything that happens on the platform (accounts, requests, matching, quotes, messages, appointments, job tracking, reviews, memberships, invoices, security and moderation) we are the controller.
• Once a customer accepts a company's quote and the contact details are released, the company becomes an independent controller for its own further processing (site visit, execution, its own invoicing and accounting). The company is bound by our provider terms to use the data only for that job, to keep it confidential and to comply with the GDPR itself.
• Customers who publish a request act for private purposes and are not controllers.

3. Which data we process, where it comes from, and why

3.1 Account (customers and companies)

Data: first and last name, e-mail address, password (stored only as a bcrypt hash), telephone, country, region, postcode, street address, preferred language, time zone, account type, status, date of terms acceptance and version accepted, two-factor setting, IP address and time of registration, last login time and IP, last activity timestamp.
Source: you, at registration and in your profile.
Purpose: providing the account, logging you in, sending service e-mails (verification code, two-factor code, password reset, notifications), locating you for matching, preventing abuse.
Legal basis: Art. 6(1)(b) GDPR (contract for use of the platform) and Art. 6(1)(f) GDPR (security, abuse prevention – our legitimate interest in running a trustworthy marketplace).

3.2 Service requests (customers)

Data: selected service and sub-service, answers to the category-specific questions (e.g. roof type, system size, number of modules, timeline, budget range), free-text description, photos and documents you upload, postcode, region, street address, approximate coordinates derived from the postcode, request reference, status and dates.
Purpose: matching the request with suitable companies and letting them quote; keeping a record of what was requested.
Legal basis: Art. 6(1)(b) GDPR.
What companies see before you accept a quote: the service details, the answers, the description, the photos, your postcode and region, and your name as initials only (unless you have switched on "show my full name" in your profile). Your street address, telephone number and e-mail are not shown at that stage.
What the company whose quote you accept sees: your full name, street address, telephone and e-mail, so that it can carry out the job. This release is logged.
Please do not write contact details into the free-text description; the platform blocks descriptions containing phone numbers or e-mail addresses to protect you.

3.3 Matching

When a request is published, the platform automatically determines which companies may see it. The criteria are: the service category and asset type the company has registered for, the company's service area (postcode prefixes or a radius around a base postcode) compared with the request postcode, whether the company holds the legally required credentials for that category in that country, whether its membership is active, and whether it has been verified and approved. Matched companies are notified. This is an automated selection of recipients; it does not produce a legal effect on you or evaluate you as a person, so Article 22 GDPR does not apply. Companies are ranked in their request list by publication date, with requests from customers who used a marketing campaign code shown first ("featured"/"priority"); no company can pay to see your request earlier.

3.4 Quotes, contracts, appointments and job tracking

Data: quote content (price, scope, conditions, validity), your decisions (shortlist, accept), the service contract generated at acceptance (a text containing your name, the job address, the company's details and the quote; stored with a hash so it cannot be changed unnoticed), your acceptance (name, timestamp, IP address), withdrawal information and, if you asked for early start, your acknowledgement, appointment dates and times, access notes you give the company, job stages and photos uploaded by the company, final amount.
Purpose: forming, documenting and performing the agreement between you and the company; evidence in case of dispute.
Legal basis: Art. 6(1)(b) GDPR; retention of the contract text under Art. 6(1)(c) and (f) GDPR (statutory retention and evidence).

3.5 Messages

Data: the text of messages between customer and company, attachments, time sent and read, the language you wrote in, and — only if a platform administrator wrote a message while accessing your account for support — a flag saying so.
Purpose: letting the two sides communicate about the request and job.
Legal basis: Art. 6(1)(b) GDPR.
Automatic translation: when the reader's language differs from the writer's, the message text is sent to DeepL SE (Cologne, Germany) for translation and the translation is cached next to the original. DeepL acts as our processor under a data processing agreement (Art. 28 GDPR), processes the text only to return the translation and does not use it to train models. Message bodies, previews and translations are stored encrypted in our database (see section 8).

3.6 Company verification (KYB)

Data: legal name, trade name, legal form, registered address, commercial register number and court, VAT and tax numbers, founding year, employee band, contact person with role, business phone, mobile phone, business e-mail, website, categories and asset types served, service areas, credentials and certificates with validity dates, uploaded documents (register extract, trade licence, insurance, certificates) with file hashes, verification results, team members (name, role, photo, e-mail, phone, panel permissions), logo, cover image, portfolio photos, catalogue files, posts and products.
Purpose: admitting only real, licensed businesses to the marketplace (Art. 30 Digital Services Act – trader traceability), showing a public company profile, running the company panel.
Legal basis: Art. 6(1)(b) GDPR (provider agreement) and Art. 6(1)(c) GDPR (DSA Art. 30). VAT numbers are checked against the European Commission's VIES service; only the VAT number and country are transmitted.
Public profile: the legal name, address, register number and business e-mail of a company are shown to logged-in users because the DSA requires traders to be identifiable. The company chooses in its profile whether phone, mobile, team, certificates, portfolio and catalogue are public, visible to followers, or private.

3.7 Memberships, payments and invoices (companies)

Data: chosen package, period, price, VAT, payment reference, bank transfer details you enter (payer name, transfer date, last four digits of the IBAN), the receipt you upload, review decision, invoice data (number, dates, amounts, VAT treatment, recipient), XRechnung/e-invoice XML, membership contract text and your electronic acceptance (name, timestamp, IP).
Purpose: selling and administering the membership, invoicing, accounting, tax compliance.
Legal basis: Art. 6(1)(b) and (c) GDPR (§ 14 UStG, §§ 146–147 AO, § 257 HGB). We do not operate card or direct-debit payments; money is transferred bank-to-bank. Your full IBAN is never stored by the platform; the receipt is kept in private storage and every administrator view of it is logged.

3.8 Reviews

Data: ratings, title and text of a review you write about a completed job, the company's reply, your initials (or full name if you chose to show it), avatar, city, date, moderation status.
Purpose: letting other customers assess companies; DSA-compliant moderation.
Legal basis: Art. 6(1)(b) and (f) GDPR. Reviews are only possible after a job tracked on the platform has been completed and are published after moderation.

3.9 Notifications, e-mail and push

Data: in-app notifications (type, short text, link, read status), your notification preferences, e-mail delivery, and — for the mobile app only — the device push token you register.
Purpose: telling you about quotes, messages, appointments, job stages, contract steps, moderation decisions and membership expiry.
Legal basis: Art. 6(1)(b) GDPR. You can switch each non-essential notification off in your notification preferences. Push messages for the mobile app are delivered through Firebase Cloud Messaging (Google Ireland Ltd.); the push token, a short title and text are transmitted. Google may process this data in the United States under the EU-US Data Privacy Framework and standard contractual clauses. If you do not register a device, no data goes to Google.

3.10 Security, logging and audit trail

Data: server access logs (IP address, time, requested page, browser identifier, response status), an application audit log recording important actions (who did what, when, from which IP and browser — for example logins, password changes, quote acceptance, payment decisions, administrator actions, data exports), rate-limiting counters, session records, e-mail verification and two-factor codes (hashed), consent records (type, version, time, IP, browser).
Purpose: keeping the platform secure, detecting and investigating abuse, proving that a consent or acceptance was given, meeting our accountability duties (Art. 5(2) GDPR).
Legal basis: Art. 6(1)(f) GDPR (security and evidence) and Art. 6(1)(c) GDPR (accountability, DSA record-keeping).

3.11 Administrator access to your account ("view as user")

For technical support and abuse investigations a platform administrator with the highest authorisation can open your account and see what you see. This is possible only with a written reason, is recorded in the audit log with the administrator's identity, time and IP, ends automatically after 60 minutes, and is technically blocked from changing your password or e-mail, deleting your account or starting a payment. Messages written during such access carry a visible "written by an administrator" flag. Your data export (section 9) lists every such access. Legal basis: Art. 6(1)(f) GDPR (support and platform integrity) and Art. 6(1)(b) GDPR where you asked for support.

3.12 Content reports and moderation (Digital Services Act)

Anyone can report content. We store the report (type and reference of the content, reason, explanation, optional e-mail of the reporter, timestamp), our decision and its reasons, and we notify the person who posted the content and — if an address was given — the reporter. Appeals against moderation decisions are stored with the same care. Legal basis: Art. 6(1)(c) GDPR (DSA Articles 16, 17, 20, 23, 24).

3.13 Printed invitation campaigns

We send invitation letters with a personal code and QR code to solar companies and property owners whose business address is publicly available. We store only the code, the campaign, and — when the code is scanned or used — the time, IP address and browser of that event, in order to measure the campaign and prevent code abuse. No address list of recipients is kept on the platform. Legal basis: Art. 6(1)(f) GDPR (direct marketing by post to businesses; you can object at any time).

3.14 Cookies

We use only cookies that are strictly necessary to run the site (session, CSRF protection, cookie choice, language, light/dark theme, and "remember me" if you select it). None of them is used for advertising, tracking or profiling, and no third-party cookies are set. Details, lifetimes and a page to change your choice at any time are in the Cookie Notice and under Cookie settings.

4. Recipients and processors

We do not sell personal data and we do not share it with advertisers. Unsplash images on the site are downloaded once and served from our own server; no request goes to Unsplash when you browse.

5. Transfers outside the EU/EEA

Platform data is stored in the EU. A transfer outside the EU happens only in two cases: (a) push notifications for the mobile app via Google (see 3.9), protected by the EU-US Data Privacy Framework and the standard contractual clauses in Google's data processing terms; (b) when a company established in Türkiye (a country without an adequacy decision) is matched with your request or wins it — in that case the transfer is necessary for the performance of the contract you request (Art. 49(1)(b) GDPR) and the company is contractually bound to GDPR-equivalent obligations. You can restrict your request to companies in your own country by choosing the country in the request.

6. How long we keep data

Deletion runs automatically every hour; the last run is visible to administrators. Backups are overwritten within 30 days.

7. What happens when you delete your account

You can delete your account yourself in your profile (password required). We then anonymise your personal data within one month: name, e-mail, phone, address, coordinates, photos, device tokens, sessions and consents-related IP data are removed or replaced by a pseudonym. Records we are legally obliged to keep (invoices, accepted contracts, reviews you wrote about a completed job) are kept in a form that no longer identifies you. The owner account of an active or pending company cannot be anonymised while the company exists, because the DSA obliges us to keep the trader's identity; transfer or close the company first, or contact us.

8. Security

• All traffic is encrypted (TLS); HTTP requests are redirected to HTTPS; HSTS is enabled.
• Passwords are stored only as bcrypt hashes; two-factor authentication by e-mail code is available to everyone and mandatory for administrators.
• Particularly sensitive fields — message texts, telephone numbers, street addresses, job addresses, access notes, payer names, contract texts — are stored encrypted at rest (AES-256-CBC with HMAC-SHA256); the key is not stored in the database or in backups.
• Photos of requests, verification documents and payment receipts are kept outside the web root and streamed only to authorised users; every administrator view of a document or receipt is logged.
• Access to customer contact details is released to a company only after acceptance of its quote and is logged.
• Every important action is written to a tamper-evident audit log; administrator access to user accounts is time-limited and logged.
• Rate limiting, honeypot fields and content security headers protect against brute force, bots and cross-site attacks.

9. Your rights

• Access and portability (Art. 15, 20): in your profile you can download all data of your account as a machine-readable JSON file at any time, without asking us.
• Rectification (Art. 16): most data can be corrected in your profile; for the rest, write to us.
• Erasure (Art. 17): delete your account in your profile (see section 7) or write to us.
• Restriction (Art. 18) and objection (Art. 21): you may object at any time to processing based on legitimate interests (for example the postal invitation campaign or security logging that is not strictly required); write to us and we will assess it.
• Withdrawal of consent (Art. 7(3)): cookie choices can be changed under Cookie settings; marketing consents in your notification preferences. Withdrawal does not affect processing before it.
• Complaint (Art. 77): with the supervisory authority named in section 1 or the authority of your habitual residence.

To exercise a right, write to datenschutz@solarclient.de from the e-mail address of your account. We answer within one month; in complex cases we may extend by two months and will tell you. Requests are logged in our data-subject-request register so that deadlines are met.

10. Children

The platform is intended for adults. We do not knowingly process data of persons under 18; if you believe a minor has registered, tell us and we will delete the account.

11. No obligation to provide data; consequences

You are not legally obliged to give us data. Without an account you can browse public pages only; without the request details a request cannot be matched; without verification documents a company cannot be admitted. Fields marked as required are needed for the contract; all others are optional.

12. Changes

We update this policy when the platform changes. The version number and date are shown at the top of the page; registered users are notified of material changes by e-mail or in-app notice at least 14 days in advance. The version you accepted is stored with your account.

Version: 1.0