e-WNDR App Privacy Policy

Last updated: 19 August 2026 1. Who is responsible for your data? e-WNDR Solar B.V. (“we”, “us”, or the “Provider”) is the data controller responsible for your personal data in connection with your use of the App and the energy management services we provide to you. Zerofy OÜ (“Zerofy”) is an independent data controller for the processing activities described in Section 5 below. Our contact details: e-WNDR Solar B.V. Laanweg 16 3208 LC Spijkenisse Zuid-Holland, Netherlands Telephone: +31 085 822 77 23 Data Protection Officer: Ace Noppen — ace.noppen@e-wndr.nl

2. What

data we collect and why We and Zerofy collect the following categories of data when you use the App: (a) Account data: your name, email address, and account credentials, collected to create and manage your account. (b) Device data: telemetry, status, configuration, control commands, and operational data from your connected Devices (solar inverters, batteries, heat pumps, EV chargers, smart meters, and similar assets), collected to operate and optimise your energy system. (c) Usage data: your interactions with the App, features accessed, settings applied, and session information, collected to improve the App and provide support. (d) Location data: approximate location or tariff-zone information, used to apply location-relevant energy pricing and optimisation. For the EV charging feature, location data (specifically, whether your vehicle is at your home premises) is collected through your vehicle's connected account and is required for smart charging decisions. Location data for EV charging cannot be disabled independently while using that feature. For other features, location data is based on your home address or postcode as entered during setup. (e) Analytics data: information about how you interact with the App — such as features used, session duration, errors, and crash reports — collected by Zerofy and by third-party analytics tools (currently Mixpanel, Inc., listed at https://zerofy.net/legal/subprocessors). This data helps us diagnose problems

and improve the App. Where analytics tools store data on your device, we rely on your consent (given at first launch) or, where the tool is strictly necessary for the App to function, on our legitimate interest in maintaining a reliable and secure service. You can opt out of non-essential analytics at any time in the App under Settings > Privacy, or by contacting us at the address in Section 1.

3. Legal

bases for processing We process your personal data on the following legal bases under GDPR: (a) Performance of contract (Article 6(1)(b)): to provide you with the App and the energy management services, including connecting and optimising your Devices. (b) Legitimate interests (Article 6(1)(f)): Zerofy has a legitimate interest in operating and continuously improving an energy management platform that delivers real-time optimisation, safety, and reliability functions to all users — which requires processing device telemetry across its fleet — and in using aggregated and pseudonymised data for service analytics and development. We and Zerofy have each balanced these interests against your rights and have documented this in a Legitimate Interests Assessment, available on request at privacy@zerofy.net. We also rely on legitimate interests to participate in grid-flexibility and aggregated energy programmes where these form part of the core service. (c) Compliance with legal obligations (Article 6(1)(c)): where required by Applicable Laws. (d) Consent (Article 6(1)(a)): where we have asked for your consent for a specific purpose, such as marketing communications. You may withdraw consent at any time.

4. How

we share your data We share your data with: (a) Zerofy OÜ, as the operator of the underlying platform. Zerofy processes data as both a data processor on our behalf (for account management and App delivery) and as an independent controller (for platform optimisation, AI/ML development, and grid-flexibility services, as described in Section 5). (b) Sub-processors engaged by Zerofy to operate the Platform. A current list of sub-processors is available at https://zerofy.net/legal/subprocessors and will be updated when new sub-processors are added. (c) Electricity network operators, flexibility aggregators, or balancing service providers, to the extent Device Data is used in grid-flexibility, ancillary-service, or similar energy market programmes. (d) Competent authorities, where required by law.

5. Zerofy

as independent controller In addition to processing your data as our processor, Zerofy processes certain data as an independent data controller for the following purposes:

(a) Optimisation and automated control: Zerofy makes and executes real-time optimisation and control decisions for your Devices, including automated dispatch, scheduling, and mode-switching. This processing is carried out on the basis of Zerofy’s legitimate interests and the performance of the service. (b) Platform improvement, AI, and machine learning: Zerofy uses Device data, usage data, and derived data to train, evaluate, and improve its forecasting, optimisation, and AI/ML models. Where Personal Data is used for this purpose, Zerofy acts as an independent controller on the basis of legitimate interests. (c) Grid-flexibility and aggregated energy programmes: Zerofy may aggregate your Device with other devices to provide flexibility, balancing, and ancillary services to electricity networks. The legal basis for this processing depends on the nature of the activity: (i) for passive network-support functions that are a necessary part of operating and optimising your energy system, Zerofy acts as an independent controller on the basis of legitimate interests; (ii) for active commercial participation in energy market programmes — where your Device is actively dispatched and you may receive a financial or other benefit in return — Zerofy relies on your consent, which is obtained through your installer or energy provider during onboarding or before activation of such features. You may withdraw your consent to such commercial programme participation at any time in the App under Settings > Energy Programmes, or by contacting us at ace.noppen@e-wndr.nl or Zerofy directly at privacy@zerofy.net. Withdrawal does not affect the basic energy management service or any processing carried out before withdrawal. Joint controller arrangement: For certain processing activities where both we and Zerofy determine the means and purposes of processing (Article 26 GDPR), we have entered into a joint controller arrangement. The essence of that arrangement is as follows: we are responsible for the End-User relationship, including collecting consents and providing this notice; Zerofy is responsible for the technical operation of the Platform and the security of the data it processes. You may exercise your data rights (see Section 7) against either of us.

6. International

transfers Zerofy is established in Estonia (EU/EEA). Where data is transferred to sub-processors outside the EU/EEA, Zerofy ensures that appropriate safeguards are in place, including Standard Contractual Clauses approved by the European Commission or adequacy decisions.

7. Your

rights Under GDPR, you have the right to: access a copy of your personal data (Article 15); rectify inaccurate data (Article 16); erase data where the legal basis no longer applies (Article 17); restrict processing in certain circumstances (Article 18); port data you have provided to another controller in a machine-readable format (Article 20); and object to processing based on legitimate interests (Article 21). Where processing is based on consent, you may withdraw consent at any time without affecting prior lawful processing. In addition, under the EU Data Act (Regulation (EU) 2023/2854), you have the right to access, port, and share the raw Device Data generated by your connected Devices. These rights and how

to exercise them are set out in Section 9.4 of this policy. To exercise your GDPR rights, contact us at the address in Section 1 or contact Zerofy at privacy@zerofy.net. You also have the right to lodge a complaint with your national data protection supervisory authority at any time.Your right to object. Where we or Zerofy process your personal data on the basis of legitimate interests (Section 3(b) above), you have the right to object at any time by contacting us at the address in Section 1 or Zerofy at privacy@zerofy.net. We will stop that processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or where the processing is necessary for the establishment, exercise, or defence of legal claims.

8. Retention

We retain your personal data for as long as your account is active and for 2 years after account closure, or for longer if required by Applicable Laws (for example, to comply with tax, energy regulation, or evidence-preservation requirements). If you would like a shorter retention period to apply, contact us at the address in Section

1. Device

data that has been anonymised or aggregated and used for AI/ML model training may be retained in that form after your account is closed; this includes trained model weights, parameters, and embeddings derived from your Device Data but not containing it in recoverable form. Zerofy is committed to reviewing, no less than annually, whether retained models continue to meet applicable anonymity standards, and to retraining or deleting models that do not. Zerofy’s retention periods for data it processes as an independent controller are set out in its applicable privacy notice at https://zerofy.net/legal/subprocessors.

9. EU

Data Act — connected product disclosure The Platform connects to your home energy devices (each a “Device”). By connecting a Device, you generate data within the meaning of Regulation (EU) 2023/2854 (the “EU Data Act”). This section sets out Zerofy’s obligations and your rights under the EU Data Act in relation to that data. 9.1 Type, format, and estimated volume of Device Data. The table below describes the data generated by each supported Device category, as required by Article 3 of the EU Data Act. Device types and data categories may be updated as new integrations are added; the current version is maintained at https://zerofy.net/legal/subprocessors. Solar inverters: power production (W, kWh), feed-in/self-consumption split, inverter status and fault codes, string-level voltage and current, operating mode. Format: JSON via manufacturer API. Estimated volume: 1–10 MB per day per device. Battery storage: state of charge (%), power in/out (W, kWh), capacity, charge/discharge status and mode, battery voltage and temperature. Format: JSON via manufacturer API. Estimated volume: 1–10 MB per day per device. Heat pumps: setpoint and measured temperature, operating mode (heating/cooling/domestic hot water (DHW)), power consumption (W, kWh), COP estimates, status and fault codes. Format: JSON via manufacturer API. Estimated volume: 0.5–5 MB per day per device. EV chargers (wallboxes): charging status, power (W, kWh per session), state of charge of connected vehicle (where available from charger), session start/end times, operating mode (immediate/scheduled/smart). Format: JSON via manufacturer API. Estimated volume: 0.5–5 MB per day per device. Smart meters: real-time and cumulative

consumption and production (W, kWh), meter point number, meter ID, phase-specific values (where available). Format: JSON. Estimated volume: 800 kB–10 MB per day per device. 9.2 Purposes of Device Data processing. Device Data is used to: provide real-time monitoring and energy optimisation in the App; issue automated control commands to your Devices; participate in grid-flexibility, balancing, and similar energy market programmes; train and improve Zerofy’s forecasting, optimisation, and AI/ML models; and comply with legal obligations. 9.3 Trade secrets. Your right of access under the EU Data Act covers the raw Device Data generated by your Devices, as described in Section 9.1. It does not extend to data that Zerofy has inferred, derived, or generated from your Device Data through its proprietary processing, including Derived Data, trained model weights, optimisation algorithm outputs, embeddings, and similar technical outputs (together, “Derived Outputs”). Derived Outputs are Zerofy’s trade secrets and intellectual property, as set out in Sections 5.8 and 5.9 of the Master Agreement, and are protected under Article 4(2) of the EU Data Act. 9.4 How to access, port, or share your Device Data. You may exercise your EU Data Act rights as follows: (a) Access and export: submit a request to us at ace.noppen@e-wndr.nl or Zerofy directly at privacy@zerofy.net. Data is provided in JSON or CSV format within 30 days of a valid request. (b) Third-party portability: to authorise a third party (such as another energy platform or service provider) to receive your Device Data, contact us at ace.noppen@e-wndr.nl or Zerofy directly at privacy@zerofy.net. Zerofy will facilitate the transfer in a commonly used machine-readable format, subject to technical feasibility and the third party meeting applicable security requirements. (c) Revocation: you may revoke any third-party access to your Device Data at any time by contacting us at ace.noppen@e-wndr.nl or Zerofy directly at privacy@zerofy.net. (d) Erasure: you may request deletion of your Device Data by closing your account or contacting us at ace.noppen@e-wndr.nl. (e) Complaints: Deletion is subject to Zerofy’s right to retain anonymised, aggregated, and derived data as set out in Section 8 of this policy and Sections 5.8–10 of the Master Agreement. If you believe your EU Data Act rights have been infringed, you may contact Zerofy at privacy@zerofy.net or lodge a complaint with the competent national authority designated under Article 37 of the EU Data Act in your country of residence.

10. Updates

to this policy We may update this privacy policy when required by changes in Applicable Laws or by updates notified by the Service Provider. We will notify you of material changes by email at least 14 days before the change takes effect. Continued use of the App after that date constitutes acceptance of the updated policy.