Last updated: 29 September 2026

Privacy Policy

1. Who we are

EnergyBase.ie is operated by JJM Advertising Limited, a company registered in Ireland (company no. 552113; VAT IE3321002WH), with its registered office in Dublin, Ireland. JJM Advertising Limited is the controller of the homeowner information described in this policy.

If you have any questions about this policy or your personal data, you can contact us at hello@energybase.ie.

2. How the estimate and quote-request service works

EnergyBase has two quote journeys. On the report-backed /quote and /quote-2 routes, completing the estimate journey saves an EnergyBase solar estimate and secure report. It does not create an installer quote request, share your details with an installer, or count as an installer lead. We send an operational email through Resend so you can reopen the report. As stated on the email step, we also use that address to send you your report and a short series of educational solar-tips emails; every one of those emails contains a working unsubscribe link, and unsubscribing never affects your report or any quote request.

You can review and edit those estimates inside the report. On /quote, you can later complete and confirm one quote request there. On /quote-2, the estimate and report are saved first, then you can review the sharing notice and confirm the request on the journey’s final step before being redirected to the report. Only the final confirmation authorises EnergyBase to select installer partners and share the stated information with them. Returning to the report or editing a confirmed request updates that same request; it does not create another request or report address.

On the direct /quote-3 route, you provide the property, system, timeframe, priority and contact details needed for a quote request, then review the sharing notice and confirm once. That first successful confirmation creates the request immediately. It does not create a saved report, report session, access or recovery link, homeowner email, or solar-tips enrolment.

On the personalised solar report tool at /system, you answer questions about your home and electricity use and may add your ESB Networks smart-meter file. That file is read and processed only in your browser; it is not uploaded to us or stored. When you ask for the report by email, we receive the report’s summary figures together with your first name, email address and Eircode, create the PDF and send it to you once through Resend. This does not create a quote request, share your details with an installer or add you to any marketing emails. To prevent misuse, each email address can make at most two report requests, including any that fail, so we keep the email address with the time, subject line (which includes the Eircode) and delivery status of each request. We also note whether the address matches an existing EnergyBase customer record. We do not keep your name, your answers, the report figures or the PDF.

The current sharing notice authorises EnergyBase to share the project and contact details in the confirmed request with up to three SEAI-registered solar installer partners selected by EnergyBase so they can contact you about solar quotes.

3. What we collect

Estimate, report and direct-request information

• Contact and property details: your name, email address, selected address, Eircode, county, Google place identifier and map coordinates; a direct request also includes your mobile number.
• Property and system inputs: electricity-bill range, panel choice, roof orientation, battery size and whether to include the SEAI grant.
• Report activity on the report-backed routes: saved estimate revisions, questions you send through the report, and timestamps showing when the report was created or changed. The direct route does not create report activity.
• Solar-tips email records on the report-backed routes: which notice version applied when your estimate was saved, your enrolment and unsubscribe state, delivery events for each email (sent, delivered, bounced, complaint), and — when you follow a link from one of those emails — a record of the email it came from, the page you visited and the time. That link measurement uses a tag in the link itself; it sets no cookie and stores nothing on your device. The direct route does not enrol you in this series.

Quote-request information

• Request details: installation timeframe, equipment or price priority, and your contact name, email address and phone number. The report-backed route may also collect whether you own the property or are authorised to arrange the work and the number of storeys; the direct route does not ask those two questions.
• Confirmation record: the sharing-notice version and text shown to you, the final action and time, request revisions, and your separate analytics-and-marketing choice at that moment.

Technical and security information

• Request metadata: referrer, timestamps and security-derived hashes used to prevent abuse and keep an audit trail. Report-backed routes also use hashes to bind a report session. IP address, user agent and Meta cookie identifiers are added to the direct route's server-side advertising event only when your optional analytics-and-marketing choice is accepted.
• Access records on the report-backed routes: hashed session, CSRF and magic-link tokens, link and session expiry times, and delivery status for operational emails and other one-time effects. The direct route creates none of these access records.
• Measurement: the Google tag loads with analytics and advertising storage denied and may send limited cookieless configuration or page pings. Optional Google Analytics, Google Ads, Meta Pixel and browser/device advertising measurement run according to the analytics-and-marketing choice described in our Cookie Policy. Separately, a confirmed report-backed request sends Meta a server-side Lead event, while a confirmed direct request sends the dedicated server-side Quote3Lead event described below.

4. Why we use the information and our legal bases

We use the information either to calculate and save the estimate and secure report requested on the report-backed routes, or to create the direct installer quote request you confirm on /quote-3. We also use it to process report questions where applicable, maintain one current version of your details, arrange confirmed installer quotes, prevent fraud, diagnose problems, enforce rate limits and prove what action was requested.

Depending on the activity, we rely on:

• Steps taken at your request and performance of the service (Article 6(1)(b)): to create the estimate and report you ask for on the report-backed routes, send their operational access emails, and process a quote request you expressly confirm on either route, and to create and email the solar report you request on /system.
• Legitimate interests (Article 6(1)(f)): to secure the service, prevent duplicate or abusive submissions, maintain reliable operational and audit records, answer report questions, understand basic service performance, measure whether our Meta advertising results in confirmed quote requests, and send the short educational solar-tips email series described above only to people who use the report-backed estimate journey — always with notice at the point of collection, an unsubscribe link in every email, and immediate suppression when you opt out. For Meta measurement without optional cookie consent, we limit each event to the confirmed request boundary and minimise the data as described in section 6. We balance these interests against your rights, including your right to object.
• Consent (Article 6(1)(a)): for optional analytics-and-marketing storage and measurement. This is separate from confirming a quote request and can be refused without losing the estimate or quote-request service.
• Legal obligations (Article 6(1)(c)): where records are needed to respond to data-protection requests or comply with applicable law.

Your final quote-request action is the instruction that authorises EnergyBase to act on that request; it is not presented as a separate marketing opt-in. The exact sharing notice shown at confirmation is retained with the request.

5. Who receives the information

• Cloudflare: hosts and protects the website and its server-side functions, and processes network and request data for delivery and security, including the Cloudflare Turnstile check that the solar report tool uses to confirm a request comes from a person.
• Supabase: stores the applicable property/system, report, request, access and audit records on our instructions.
• Resend: delivers operational report-access and recovery emails and the solar-tips email series for the report-backed routes. Resend also maintains the unsubscribe/suppression list for that series on our instructions. The series uses no open-tracking pixel and no link rewriting. The direct route does not send a homeowner email through Resend. It also delivers the PDF you request from the solar report tool on /system.
• PVGIS (European Commission Joint Research Centre): receives the property’s map coordinates and roof direction from the solar report tool to calculate expected solar output. It receives no name, contact details or meter data.
• Google Workspace: processes operational email received by our EnergyBase team, including report questions and request notifications.
• Google Maps Platform: provides address lookup and map or satellite confirmation during the estimate journey and may receive the address query, map interaction and technical request information.
• Google Analytics and Google Ads: receive measurement information according to your analytics-and-marketing choice. On the report-backed route, Google Ads may receive the conversion event and contact data for Enhanced Conversions when that choice is accepted. The direct route does not create a Google Ads conversion.
• Meta Platforms Ireland: receives optional Pixel and browser/device measurement when your analytics-and-marketing choice is accepted. A confirmed report-backed request sends one server-side Lead event; a confirmed direct request sends one server-side Quote3Lead event and does not create a Meta browser conversion. If optional consent is rejected or unset, the applicable server-side event is limited to hashed email and phone plus confirmation metadata, without Meta cookie IDs, IP address or user agent. Accepted consent allows the server-side event to include validated Meta cookie identifiers, IP address and user agent.
• Installer partners selected by EnergyBase: receive only the information covered by the sharing notice after you confirm a quote request. An installer that receives the request handles that information for its own quotation and customer-contact purposes and generally acts as an independent controller for that handling. Saving or viewing a report does not disclose information to an installer.

Cloudflare, Supabase and Resend provide core services on our instructions as processors. Google Workspace processes our business email under its business service terms. For Maps, analytics and advertising products, Google and Meta may act as processors, separate controllers or joint controllers as described in the terms that apply to the particular product and processing. We do not sell your personal data.

6. Analytics, advertising and conversion timing

Saving, opening or editing a report is not an installer-lead conversion. Only the first successful confirmation of an installer quote request creates the applicable Meta event: Lead for the report-backed journey or Quote3Lead for the direct journey.

At that confirmation boundary, EnergyBase sends Meta one server-side event for advertising measurement even if optional cookies were rejected or no banner choice was made. In those cases, the event contains normalized hashed email and phone and confirmation metadata such as the event name, time and stable deduplication identifier. It does not contain Meta cookie identifiers (_fbp or _fbc), your IP address, user agent or other device-derived advertising signals. If optional consent is accepted, validated Meta cookie identifiers, IP address and user agent may enrich the server-side event. The report-backed journey may also create consent-gated Meta browser and Google Ads conversions; the direct journey does not create a Meta browser conversion or Google Ads conversion. We rely on our legitimate interest in measuring whether our advertising leads to a genuine confirmed request for this limited server-side processing.

Saving an estimate through the report-backed journey also enrols the email address you give us in a short educational series about home solar — currently eight emails over about four weeks — as stated on the step where the address is collected. The series stops immediately when you unsubscribe (a link is in every email) or when you confirm a quote request. The emails contain no tracking pixel; when you follow a link in one, the link itself tells us which email you came from so we can see which topics are useful. Operational report-access and recovery emails are separate service emails and continue to work regardless of your email preferences. The direct journey creates no report email or solar-tips enrolment.

7. International transfers

Our primary Supabase database is configured in the European Union. Some providers or their subprocessors—including Cloudflare, Resend, Google and Meta—may process information outside Ireland or the European Economic Area. Where a restricted transfer occurs, we use the contractual and product arrangements offered for the relevant service and assess the transfer mechanism that applies, such as an adequacy decision or Standard Contractual Clauses. The applicable mechanism can vary by provider, service and processing location; we do not describe every provider interaction as remaining exclusively inside the EU.

8. Access security

This section applies to the report-backed routes. The direct route does not create a report account, session or access link.

The report is protected by an opaque, host-only __Host-eb-report session cookie that is HttpOnly, Secure and SameSite=Lax. A separate browser-readable CSRF cookie is compared with a request header and a server-side hash before report changes are accepted. Report sessions expire after roughly 30 days of inactivity, subject to an additional server-side absolute limit.

Operational access emails use a single-use magic link that expires after 15 minutes. We store a token hash rather than the usable token. The report address itself is not sufficient to authenticate a visitor.

9. Data retention

The current technical retention policy uses the following target periods:

• Unused magic links: 15 minutes.
• Inactive report sessions: 30 days.
• Abandoned estimate records: 30 days.
• Saved estimates without a quote request: 6 months after the last activity.
• Unfinished quote-request drafts: 30 days after the last activity.
• Solar-tips email delivery events and link-visit records: up to 12 months, removed on a controlled manual basis.
• Confirmed quote requests: up to 24 months after the last activity under the current documented maximum. The final period and legal basis remain under Irish privacy review.
• Solar report tool email requests: the email address and the time, subject line and delivery status of each request are kept for as long as the two-request limit applies, until you ask us to delete them.

No automated deletion schedule for real customer records is currently enabled while that review is completed. The system can identify retention candidates, but real-record deletion remains a controlled process. We handle valid erasure requests manually in the meantime and may keep limited information longer where law, a dispute or a security investigation requires it.

10. Your rights

Depending on the processing and the circumstances, the GDPR and Irish Data Protection Act 2018 give you rights including:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erase your data (the "right to be forgotten").
• Restrict how we process your data.
• Data portability — receive your data in a structured, machine-readable format.
• Object to processing based on legitimate interest.
• Withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, please contact us at hello@energybase.ie. We normally respond within one month, subject to any extension permitted by data-protection law.

You may object under Article 21 GDPR to the limited server-side Meta conversion measurement described in section 6 by emailing hello@energybase.ie with the email address or phone number used for your request. We will assess and action a valid objection without affecting your saved report or quote request.

You also have the right to lodge a complaint with the Data Protection Commission:

• Website: www.dataprotection.ie
• Email: info@dataprotection.ie
• Address: 6 Pembroke Row, Dublin 2, D02 X963, Ireland

11. Solar installer directory listings

Separately from the homeowner data described above, EnergyBase.ie publishes a directory of solar installation companies. Each listing is compiled from the publicly available SEAI register of approved solar PV companies, the company's own website, and publicly available business review data (such as Google and Trustpilot). A listing may include the company name, business contact details (which for sole traders may be a personal name and mobile number drawn from the public register), service areas, logo, year established, review data, and links to the company's website and social profiles.

Legal basis. We process this business information under legitimate interest (Article 6(1)(f)): maintaining an accurate, factual directory of SEAI-registered installers so that Irish homeowners can find and compare them. We have weighed this interest against the rights of the businesses and individuals listed, and limit the data to what is already published for a business-facing purpose.

Your rights if you are listed. If you are (or represent) a listed company, you can ask us to correct your information, or to remove your listing entirely, at any time — including where a listing contains the personal data of a sole trader. Email hello@energybase.ie with the company name and we will action correction or erasure requests promptly. You also retain the right to object to this processing under Article 21 GDPR.

12. Children

EnergyBase.ie is not directed at anyone under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at hello@energybase.ie and we will delete it promptly.

13. Cookies

We use the first-party eb_attr cookie to remember which advertising channel brought you to EnergyBase.ie and to count page views by advertising channel in aggregate. It lasts for 30 days, is read only by our server, and is never shared with another organisation.

For full details on the cookies and similar technologies we use, please see our Cookie Policy.

14. Changes to this policy

We may update this privacy policy from time to time. The "Last updated" date at the top of this page reflects the most recent version. We encourage you to review this page periodically.

15. Contact

If you have any questions about this privacy policy, please contact us:

• Email: hello@energybase.ie
• JJM Advertising Limited, Dublin, Ireland