Comparisun Privacy Notice

Key points

• Controller: Luxa Energy LTD, Chrysanthou Mylona 1, PANAYIDES BUILDING, 2nd floor, Flat/Office 1, 3030 Limassol, Cyprus, is the controller of your personal data for Comparisun under the EU GDPR, the UK GDPR, and the Swiss revised Federal Act on Data Protection (revFADP).
• Our group also installs solar systems, as Luxa Energy, whose offers appear on Comparisun alongside offers from other installers. Section 1 explains this.
• When you place an order, the installer you choose becomes a separate controller of the order data needed to fulfil it. Section 6 explains who is responsible for what, including for Luxa Energy orders.
• We collect the information you give us in the calculator (including, if you allow it, your precise location), account and order details, and, for orders, identity and property documents such as ID, bills, and title deeds.
• We use your data to generate estimates, show you offers, process your order, measure how Comparisun is used, and, where you agree, for marketing. Ranking and estimates are automated but rule-based, not profiling that produces a legal or similarly significant effect on you (Section 4).
• You have rights to access, correct, delete, and export your data, and to object to certain uses. Section 9 explains how to exercise them. We check that a request really comes from you before we act on it.
• Country-specific sections for Switzerland and the United Kingdom are at the end.

---

1. Who we are and what we do

Luxa Energy LTD (Private company limited by shares), registered office at Chrysanthou Mylona 1, PANAYIDES BUILDING, 2nd floor, Flat/Office 1, 3030 Limassol, Cyprus, registered under HE 482253 with Registrar of Companies and Intellectual Property, Nicosia ("we", "us"), operates Comparisun, a website that lets you compare solar installation offers.

Our group also installs solar systems, as Luxa Energy. Luxa Energy's own offers are shown on Comparisun next to offers from other installers who use Raysly and have opted in to list.

Today, Luxa Energy and Luxa Energy LTD are the same legal entity. Luxa Energy LTD is the controller for both the Comparisun comparison service and any order you place with Luxa Energy. If and once Luxa Energy becomes a separate company related to Luxa Energy LTD by common ownership (rather than the operator of Comparisun itself), your order contract will be with Luxa Energy directly; Luxa Energy will be an independent controller for that order, and Luxa Energy LTD's hand-off of your enquiry to Luxa Energy will be a controller-to-controller disclosure, on the same footing as any other installer that receives a lead through Raysly. The Terms of Use (Section 3.2) and our How Comparisun works page (Section 5) describe this relationship in the same terms.

We are the controller of your personal data for the purposes described in this notice, except where Section 6 says an installer is the controller.

Privacy contact: support@comparisun.net. We have not appointed a data protection officer.

UK representative: see Section 16.

2. Scope

This notice covers personal data we process through Comparisun: the public website, the calculator, your account (if you create one), and the order process. It does not cover the separate Raysly partner-portal platform, which has its own privacy notice, or the website of any independent installer, which has its own privacy notice.

3. Personal data we collect, and why

The table below groups the personal data we collect by the flow it comes from, what we use it for, and the legal basis we rely on (Art. 6 GDPR / UK GDPR; the nearest revFADP concept is noted for Switzerland, which does not use a closed list of legal bases in the same way).

Flow	Data collected	Purpose	Legal basis
Calculator / estimator	Electricity bill amount or usage, EV ownership/plans, property type, ownership status, roof type, household size and floor area (optional), heating details (optional), your stated priorities (e.g. lowest upfront cost), address and address components, precise GPS coordinates (only if you allow location access), a roof outline you draw on a map	Generate a system-size and savings estimate; show you comparable offers	Contract (steps you ask for before entering a contract, Art. 6(1)(b)). Precise GPS location is read only after you allow it in your browser's permission prompt, and you can type an address instead
Address autocomplete & satellite imagery	Address text you type; coordinates; a satellite image of your property	Look up your address; estimate roof area and solar potential via third-party mapping and solar-data providers (Section 5)	Contract (Art. 6(1)(b))
Saving/emailing an offer	Email address (required), name (optional)	Save your offer for 30 days and email it to you on request; record the request with your IP address and browser type in a security log	Your request (Art. 6(1)(b)); security log: legitimate interest in preventing abuse (Art. 6(1)(f))
Account and login	Email address; magic-link usage; device/session metadata (IP address, user agent)	Let you log in and access your saved offers and orders; keep your account secure	Contract (Art. 6(1)(b)) / legitimate interest in account security (Art. 6(1)(f))
Order / checkout	Full name, email, phone, address, whether you are ordering as a company (company name, VAT/tax ID where applicable); the estimator data above, copied into your order; your selected system and quoted price; marketing preference	Process your order; pass the data needed to fulfil it to the installer you selected (see Section 6); send order confirmations and status updates	Contract (Art. 6(1)(b)); marketing preference is consent (Art. 6(1)(a))
Identity and property documents	National ID card or passport (Cyprus, UK, Switzerland); residence permit (non-Swiss residents in Switzerland); utility bills (up to 12 months, depending on country); proof of property ownership or a title deed; grid-connection or permit applications; building-insurance or energy-certificate documents, depending on your country	Required by the installer (or by us, for Luxa Energy orders) to design, permit, apply for subsidies for, and install your system, and to comply with the installer's own legal and regulatory obligations	Contract (Art. 6(1)(b)), limited to the documents actually needed for your order and country. Where Luxa Energy is the seller, also its own legal obligations (Art. 6(1)(c)), e.g. tax records. An installer's own legal obligations are the installer's basis, not ours.
Phone verification	Phone number; one-time code	Confirm your phone number before certain orders, where the installer requires it	Contract (Art. 6(1)(b))
Contact / question forms	Name, email, phone (optional), your message, the page/region you were on, your IP address	Respond to your enquiry	Legitimate interest in responding to enquiries you send us (Art. 6(1)(f))
Uploading a competitor's offer	The offer document you upload or forward by email; any personal data it contains, including data about the other installer's staff	Compare it against other offers for you; if you choose, show it to installers (Section 8); certain fields, after processing described in Section 8, contribute to an aggregated market-data set	Comparing it for you: your request (Art. 6(1)(b)). Showing it to installers: your consent, which you give and can withdraw per offer (Art. 6(1)(a)). Market-data set: our legitimate interest in publishing aggregated market pricing (Art. 6(1)(f)); we consider this is not overridden by your interests because both your identity and the other installer's identity are removed before the record is created (Section 8)
Analytics and product usage	Pages viewed, page title, referrer and campaign (UTM) parameters, browser language, session identifiers, device and browser information, test-variant assignments, and, where you consent, analytics cookie identifiers. When you submit a contact or question form, save an offer, register interest in a region, log in, or place an order, our product-analytics provider records that event linked to your email address (and, for orders, your name)	Understand how Comparisun is used, measure conversions and improve it	Analytics cookies and similar technologies: consent (Art. 6(1)(a)), see the Cookie Policy. Server-side events and our own page-view log: our legitimate interest in understanding how Comparisun is used and in measuring the actions you asked us to perform (Art. 6(1)(f)). These server-side events are keyed to a one-way pseudonymous identifier derived from your email address, never your raw email address, so our analytics provider cannot read it back out
Registering interest in a region	Email address and country	Tell you when Comparisun becomes available in your country; the email is currently held only in our product-analytics tool	Your request (Art. 6(1)(b)).
Live chat	Your chat messages and any name, email or phone you give	Answer your questions on offer pages	Legitimate interest in responding to you (Art. 6(1)(f))
Customer account extras	Support tickets and attachments; notification preferences; browser push-notification subscription (endpoint, keys, browser type)	Provide support and send the notifications you switch on	Contract (Art. 6(1)(b)); push notifications: your consent via the browser prompt (Art. 6(1)(a))
Security and service logs	IP address, browser type, approximate location derived from your IP (country, city), login and session records, copies of emails we send you	Keep accounts and the service secure, investigate abuse and errors, prove what we sent	Legitimate interest in security and in handling claims (Art. 6(1)(f))
Cookies and similar technologies	See our Cookie Policy	As described there	Consent, or strictly necessary (ePrivacy/PECR exemption; Art. 6(1)(f) for the related processing)

Must you give us your data? You do not have to use Comparisun. The calculator needs a bill amount or usage figure to work. To place an order, your name, email, phone and address are required, and the installer may require the documents listed above; without them the order cannot proceed. Everything else is optional.

Where your data comes from. Mostly from you. We also receive data from the installer handling your order (for example status updates), and from mapping and solar-data providers about your property (satellite imagery, roof and yield data).

We do not knowingly collect any special category of data under Art. 9 GDPR (for example, health data) through any Comparisun order flow. If a country-specific order step is ever added that could request such data (for example, a health-related accessibility accommodation), we will update this notice and identify a valid Art. 9(2) condition before collecting it.

4. Automated processing, ranking, and estimates

4.1 How offers are ranked. Comparisun ranks and sorts offers using a rule-based method (price, a warranty-based quality score, and a combined "best value" score); it does not use machine learning or make predictions about you personally to decide ranking. The full description of the ranking method, including how Luxa Energy's own offers are treated, is on our How Comparisun works page.

4.2 Estimates. The savings, cost, and IRR figures shown to you are generated by a rule-based calculation from the information you provide and third-party data sources; no automated system decides whether to offer you a contract, a price, or a subsidy — those decisions are made by the installer, or, for grants, by the relevant public authority.

4.3 No solely automated decisions with legal or similarly significant effects. We do not use your personal data to make a decision about you, without human involvement, that produces legal effects or similarly significantly affects you, within the meaning of Art. 22 GDPR. If this changes, we will update this notice and give you the information Art. 22(3) and Art. 13(2)(f)/14(2)(g) GDPR require, including your right to obtain human review.

5. Who we share your data with

5.1 Installers. When you place an order, we share the order data described in Section 3 with the installer you selected, so they can fulfil your order. See Section 6 for who is the controller of that data once shared.

5.2 Processors (service providers acting on our instructions). We use third-party service providers to run Comparisun, including for hosting and databases, file storage, email and SMS delivery, live chat, payment-related services, address lookup and mapping, satellite and solar-yield data, bot protection, error monitoring, and product analytics. You can ask us for the current list of these providers at support@comparisun.net.

5.2a AI tools for reading uploaded offers. If you upload a competitor's offer, we may use an AI text-extraction service to read the prices and products from it, after first removing email addresses, phone numbers and postcodes. This feature is switched off unless we enable it. Before we switch it on, we will update this notice to name the provider and to confirm that it acts as our processor, does not use your data to train its models, and receives data outside the EEA only under the safeguards in Section 7.

5.3 Analytics and advertising. Where you consent, we use analytics tools described in our Cookie Policy. Some of these tools are provided by companies outside the EU/UK/Switzerland; see Section 7 for how we handle that.

5.4 Authorities. We may disclose personal data to a court, regulator, tax authority, or law-enforcement body where we are legally required to.

5.5 We do not sell your personal data. We do not sell your personal data to third parties for their own marketing purposes. We share it with installers only as described in Sections 5.1, 6 and 8.

6. Who is the controller — Comparisun and the installer

This is a common source of confusion, so we set it out explicitly:

• Before you place an order: Luxa Energy LTD is the sole controller of the data you give us in the calculator, your account, and any saved offer.
• When you place an order with an installer who uses Raysly and has opted in to list: Luxa Energy LTD remains the controller of the data up to and including the point we pass it to the installer (for example, the fact that an order was placed, and the order data itself). From the point the installer receives your order, the installer is a separate, independent controller of the data needed to fulfil your order (quoting, permitting, installing, invoicing, and any subsidy application), because they decide independently how to use it for those purposes. The installer's own privacy notice governs their processing from that point. Where the installer uses our software to manage your order (for example to view your documents or send you status emails and text messages), we also keep and process that data on the installer's behalf, as its processor. Offers on Comparisun come only from Luxa Energy and from installers who use Raysly and have opted in to list, so the recipient of every order is always one of the two described here.
• When you place an order with Luxa Energy: today, Luxa Energy and Luxa Energy LTD are the same legal entity, so Luxa Energy LTD remains the controller throughout, for both the comparison service and fulfilling your order. If and once Luxa Energy becomes a separate company related to Luxa Energy LTD by common ownership, it becomes a separate, independent controller for fulfilment, in the same way as any other installer who receives a lead through Raysly, and Luxa Energy LTD's hand-off of your enquiry is a controller-to-controller disclosure.
• Analytics and hosting providers, and other processors listed in Section 5.2, act on our instructions as processors, not as separate controllers, for the purposes described in this notice.

7. International data transfers

Some of our processors are located, or process data, outside the European Economic Area, the United Kingdom, or Switzerland. Where that happens, we rely on one of the following safeguards: an adequacy decision covering the destination country; the EU Standard Contractual Clauses (and, for UK transfers, the UK International Data Transfer Addendum) together with a transfer risk assessment; or your explicit consent for a specific transfer. You can ask for a copy of the safeguards we use at support@comparisun.net.

8. Uploaded competitor offers and the anonymised market dataset

If you upload or forward us a competitor's solar offer so we can compare it, we automatically remove email addresses, phone numbers and postcodes before further processing. Other text, such as names, is not automatically removed.

Market data. A confirmed offer may contribute a record to an aggregated market-data set that contains no user identifier, only the month (not the day), and the installer's name in one-way hashed form. We use it to show market-median prices publicly and to installers, and only where at least five offers are combined.

Showing your offer to installers. You can choose to share an uploaded offer with installers. If you do, it is shown to every installer that has, or later receives, an enquiry or order from you, not just one. Those installers will know it is your offer. Depending on the option you choose, they see either only summary figures (such as price per kWp and rank) or the full document, including line items and the other installer's name. You can withdraw this at any time for the future, in your account or by contacting us at support@comparisun.net.

9. Your rights, and how we handle requests

9.1 Your rights. Subject to the conditions and exceptions in applicable law, you have the right to: access the personal data we hold about you; have inaccurate data corrected; have your data deleted; restrict or object to certain processing; receive a portable copy of data you provided to us; and withdraw consent at any time where processing is based on consent (this does not affect the lawfulness of processing before withdrawal).

9.2 Downloading your data. If you have an account, you can download a single ZIP file with a copy of the personal data we hold about you, plus any files you uploaded, directly from your account → Privacy & data — there is no emailed link and no waiting period; the archive downloads directly from the page. If you do not have an account, you can request a copy at /privacy/my-data, which verifies you by an emailed, single-use link before releasing anything. The ZIP includes a manifest listing exactly what is included and what is deliberately excluded. Never included: your password or any credential, security tokens or keys, anyone else's data, or files shared with other customers. If you use content-blind (zero-knowledge) encryption on any lead, its contents are included in the archive exactly as we store them — encrypted, and unreadable by us or by you outside the tool that holds your key. Limits: you can download up to 5 times per hour; if your archive would be larger than 500 MB, contact us at support@comparisun.net and we will prepare it directly.

9.3 Deleting your account. You can delete your account at any time from the same place, and this is never conditional on downloading your data first. Deletion is scheduled for 30 days later, and you can cancel it at any time during that window. After the 30 days, we delete your personal data from our systems, including any documents you uploaded, subject to the exceptions in 9.3a below.

9.3a Exceptions to deletion. Even after your account is deleted, we keep, anonymised where the retention purpose allows it: invoices, receipts and order financial records, for 10 years, the statutory accounting retention period we apply in every country we operate in; the evidence of what you accepted or consented to, and of the erasure itself (Section 9.6), for the same 10 years; and a minimal suppression marker so we know not to contact you again. For a short additional period, copies of your data that exist only in database backups persist until those backups are next overwritten in the ordinary rotation (Section 11). If you uploaded a document as part of an order with an installer, that document is included in your download, but it is not deleted by your own account deletion — the installer is a separate controller of that order data (Section 6). To have it deleted, contact that installer directly, or contact us at support@comparisun.net and we will forward your request to them.

9.4 Verifying it's you. To protect your data from being disclosed to, or deleted at the request of, someone impersonating you, we verify the identity of every requester before acting on a request — for example, by confirming the request from the email address linked to your account, or through the email-verified link described in 9.2 for people without an account. We aim to respond within one month, extendable by a further two months for complex requests, as GDPR/UK GDPR permit.

9.5 Your right to object. Where we rely on legitimate interests (Art. 6(1)(f)), you can object at any time on grounds relating to your particular situation, and we will stop unless we have compelling legitimate grounds or need the data for legal claims. You can object to direct marketing at any time, without giving reasons, and we will then stop using your data for that purpose.

9.6 Evidence of your acceptances. Where our Terms of Use, or a checkbox or button, ask you to accept or confirm something (for example, accepting the Terms, or authorising us to share an uploaded offer with installers), we keep a tamper-evident record of that action: which version of the document you accepted, a hash of the exact text you were shown, the date and time, and technical evidence such as a pseudonymised device/session reference. This record does not store your name or email directly; it is linked to your account through a keyed, one-way reference that cannot be reversed without our separate key. We keep this evidence for at least 10 years, because it is our proof that you agreed to what you agreed to and may be needed to defend or bring a legal claim; if you later ask us to delete your account, we delete the personal link to the record but keep the evidence itself, which by then can no longer be tied to you (GDPR Art. 17(3)(e)).

9.7 Complaints. You can also complain to a data protection authority. See Section 14 and the country sections below.

10. Children

Comparisun is intended for adults who are able to enter a contract for the purchase of a solar system. We do not knowingly collect personal data from children, and we do not ask for or verify age. If we become aware that a child has given us personal data without appropriate consent, we will delete it.

11. Retention

We keep your personal data only for as long as necessary for the purposes described in this notice, taking into account:

• Saved offers you have not turned into an order: kept for 30 days, then deleted automatically.
• Deleted accounts: deletion is scheduled 30 days after you ask for it (Section 9.3); once it runs, we delete your personal data, including uploaded documents, except for the items below.
• Backups: deleted data can remain in our database backups for up to 365 days until those backups are overwritten in the ordinary rotation; we do not restore it into live systems except to recover from an incident.
• Invoices, receipts and accounting records: kept for 10 years, the statutory accounting retention period we apply in every country we operate in, in anonymised form once no longer needed for any other purpose.
• Evidence of your acceptances and consents: kept as described in Section 9.6, in a form no longer linked to you once your account is deleted.
• Documents you upload (ID, bills, title deeds, etc.): kept for as long as needed to fulfil your order and meet the installer's (or, for Luxa Energy orders, our own) legal retention obligations, then deleted with the rest of your account data on deletion.
• Analytics data: as described in our Cookie Policy.
• Security and service logs (login and session records, copies of emails we send you, and audit records): these records do not yet have a fixed retention period. We use them only to keep the service secure and to establish or defend legal claims.

12. Security

We use technical and organisational measures appropriate to the risk, including encryption of certain data at rest and in transit, access controls, and monitoring. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

13. Change of controller / business transfer

If Luxa Energy LTD transfers all or part of the business operating Comparisun to another company — for example as part of a group reorganisation, merger, or sale — your personal data may be transferred to the new operator as part of that transaction, to the extent the new operator's continued, unchanged use of it is compatible with the purposes described in this notice.

If this happens, we (or the new operator) will tell you who the new controller is, how to contact them, and how you can exercise your rights, before the transfer where we can and in any event within one month, in line with Art. 14(3) GDPR. You can object, or delete your account, before or after the transfer. Where processing depends on your consent (for example, marketing or non-essential cookies), we will ask you to reconfirm that consent under the new controller's name rather than assume it carries over automatically.

14. Supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the country where you live, work, or where the alleged infringement occurred. Where Luxa Energy LTD has its main establishment in the EU, its lead supervisory authority is Commissioner for Personal Data Prcomotection. If Luxa Energy LTD has no establishment in the EU, there is no lead authority and you can complain to any EU supervisory authority.

15. Switzerland

If you are in Switzerland

This section applies in addition to the rest of this notice, to the extent Swiss law (the revised Federal Act on Data Protection, revFADP) applies to our processing of your personal data.

• Controller: Luxa Energy LTD, details as in Section 1.
• Swiss representative: we have not appointed a representative in Switzerland.
• Legal bases: revFADP does not use the same closed list of legal bases as the GDPR; processing must instead comply with the general principles of lawfulness, good faith, and proportionality (Art. 6 revFADP), and any processing you have not consented to must be justified by an overriding private or public interest or fit one of the statutory grounds.
• Sensitive personal data: if any of the documents you provide reveal Swiss-law "sensitive personal data" (a broader category than GDPR special categories, and which includes some administrative/criminal data), we process it only where a valid basis under Art. 6 revFADP applies, such as your explicit consent.
• International transfers: where your data is transferred outside Switzerland, we apply an adequacy finding by the Swiss Federal Council, Swiss-law-conforming standard contractual clauses, or another safeguard recognised under the revFADP.
• Supervisory authority: the Federal Data Protection and Information Commissioner (FDPIC), https://www.edoeb.admin.ch.

16. United Kingdom

If you are in the United Kingdom

This section applies in addition to the rest of this notice, to the extent UK GDPR and the Data Protection Act 2018 apply to our processing of your personal data.

• Controller: Luxa Energy LTD, details as in Section 1. Where Luxa Energy LTD has no establishment in the UK, our UK GDPR Article 27 representative is Arash Shariifi.
• Supervisory authority: the Information Commissioner's Office (ICO), https://ico.org.uk.
• PECR: cookie and similar-technology rules are additionally governed by the UK Privacy and Electronic Communications Regulations (PECR), as amended by the Data (Use and Access) Act 2025; see our Cookie Policy for detail, including which categories of cookie may no longer require consent under the UK-only exemptions introduced by that Act — a UK-only rule that does not extend to EU or Swiss visitors, and applies only where the conditions the Act sets (clear information about the purpose of the storage/access, and a simple way to opt out) are met — we treat consent as required until we have confirmed, and documented, that a specific cookie meets those conditions.

---

Document version 1.0.1, effective October 1, 2026. Applies in Cyprus, Switzerland, United Kingdom.