Last updated: 8 August 2026

Privacy Policy

1. Who we are

EnergyBase.ie is operated by JJM Advertising Limited, a company registered in Ireland (company no. 552113; VAT IE3321002WH), with its registered office in Dublin, Ireland. JJM Advertising Limited is the controller of the homeowner information described in this policy.

If you have any questions about this policy or your personal data, you can contact us at hello@energybase.ie.

2. How the estimate and quote-request service works

The short estimate journey saves an EnergyBase solar estimate and secure report. It does not create an installer quote request, share your details with an installer, or count as an installer lead. We send an operational email through Resend so you can reopen the report. As stated on the email step, we also use that address to send you your report and a short series of educational solar-tips emails; every one of those emails contains a working unsubscribe link, and unsubscribing never affects your report or any quote request.

You can review and edit the estimate inside the report. If you later want installer quotes, you complete and confirm one quote request there. Before confirmation, the report shows the sharing notice that applies to that request. Only the final confirmation authorises EnergyBase to select installer partners and share the stated information with them. Returning to the report or editing a confirmed request updates that same request; it does not create another request or report address.

3. What we collect

Estimate and report information

• Contact and property details: your name, email address, selected address, Eircode, county, Google place identifier and map coordinates.
• Estimate inputs: electricity-bill range, panel choice, battery size and whether to include the SEAI grant.
• Report activity: saved estimate revisions, questions you send through the report, and timestamps showing when the report was created or changed.
• Solar-tips email records: which notice version applied when your estimate was saved, your enrolment and unsubscribe state, delivery events for each email (sent, delivered, bounced, complaint), and — when you follow a link from one of those emails — a record of the email it came from, the page you visited and the time. That link measurement uses a tag in the link itself; it sets no cookie and stores nothing on your device.

Quote-request information

• Request details: whether you own the property or are authorised to arrange the work, installation timeframe, number of storeys, equipment or price priority, and your contact name, email address and phone number.
• Confirmation record: the sharing-notice version and text shown to you, the final action and time, request revisions, and your separate analytics-and-marketing choice at that moment.

Technical and security information

• Request metadata: IP address, browser and device information, referrer, timestamps and security-derived hashes used to prevent abuse, bind a report session and keep an audit trail.
• Access records: hashed session, CSRF and magic-link tokens, link and session expiry times, and delivery status for operational emails and other one-time effects.
• Measurement: the Google tag loads with analytics and advertising storage denied and may send limited cookieless configuration or page pings. Optional Google Analytics, Google Ads, Meta Pixel and browser/device advertising measurement run according to the analytics-and-marketing choice described in our Cookie Policy. Separately, when you confirm an installer quote request, we send Meta a limited server-side Lead event as described below.

4. Why we use the information and our legal bases

We use the information to calculate and save your estimate, secure and reopen your report, process report questions, maintain one current version of your details, and—only after your final request—to arrange installer quotes. We also use limited technical records to prevent fraud, diagnose problems, enforce rate limits and prove what action was requested.

Depending on the activity, we rely on:

• Steps taken at your request and performance of the service (Article 6(1)(b)): to create the estimate and report you ask for, send operational access emails, and process a quote request you expressly confirm.
• Legitimate interests (Article 6(1)(f)): to secure the service, prevent duplicate or abusive submissions, maintain reliable operational and audit records, answer report questions, understand basic service performance, measure whether our Meta advertising results in confirmed quote requests, and send the short educational solar-tips email series described above to people who save an estimate — always with notice at the point of collection, an unsubscribe link in every email, and immediate suppression when you opt out. For Meta measurement without optional cookie consent, we limit the event to the confirmed request boundary and minimise the data as described in section 6. We balance these interests against your rights, including your right to object.
• Consent (Article 6(1)(a)): for optional analytics-and-marketing storage and measurement. This is separate from confirming a quote request and can be refused without losing the estimate or quote-request service.
• Legal obligations (Article 6(1)(c)): where records are needed to respond to data-protection requests or comply with applicable law.

Your final quote-request action is the instruction that authorises EnergyBase to act on that request; it is not presented as a separate marketing opt-in. The exact sharing notice shown at confirmation is retained with the request.

5. Who receives the information

• Cloudflare: hosts and protects the website and its server-side functions, and processes network and request data for delivery and security.
• Supabase: stores the estimate, report, request, access and audit records on our instructions.
• Resend: delivers operational report-access, recovery and request emails, and the solar-tips email series. Resend also maintains the unsubscribe/suppression list for that series on our instructions. The series uses no open-tracking pixel and no link rewriting.
• Google Workspace: processes operational email received by our EnergyBase team, including report questions and request notifications.
• Google Maps Platform: provides address lookup and map or satellite confirmation during the estimate journey and may receive the address query, map interaction and technical request information.
• Google Analytics and Google Ads: receive measurement information according to your analytics-and-marketing choice. If that choice is accepted when you confirm a quote request, Google Ads may receive the conversion event and contact data for Enhanced Conversions.
• Meta Platforms Ireland: receives optional Pixel and browser/device measurement when your analytics-and-marketing choice is accepted. When you confirm a quote request, Meta also receives one server-side Lead event for advertising measurement. If optional consent is rejected or unset, that event is limited to hashed email and phone plus confirmation metadata, without Meta cookie IDs, IP address or user agent. Accepted consent retains the existing enriched measurement.
• Installer partners selected by EnergyBase: receive only the information covered by the sharing notice after you confirm a quote request. An installer that receives the request handles that information for its own quotation and customer-contact purposes and generally acts as an independent controller for that handling. Saving or viewing a report does not disclose information to an installer.

Cloudflare, Supabase and Resend provide core services on our instructions as processors. Google Workspace processes our business email under its business service terms. For Maps, analytics and advertising products, Google and Meta may act as processors, separate controllers or joint controllers as described in the terms that apply to the particular product and processing. We do not sell your personal data.

6. Analytics, advertising and conversion timing

Saving, opening or editing a report is not an installer-lead conversion. Only the first successful confirmation of an installer quote request creates a Lead event. Meta Pixel, Meta browser events, Google Ads and optional browser/device advertising storage remain off unless your analytics-and-marketing choice is accepted.

At that confirmation boundary, EnergyBase sends Meta one server-side Lead event for advertising measurement even if optional cookies were rejected or no banner choice was made. In those cases, the event contains normalized hashed email and phone and confirmation metadata such as the event name, time and stable deduplication identifier. It does not contain Meta cookie identifiers (_fbp or _fbc), your IP address, user agent or other device-derived advertising signals. If optional consent is accepted, the existing enriched server-side and browser measurement continues. We rely on our legitimate interest in measuring whether our advertising leads to a genuine confirmed request for this limited server-side processing.

Saving an estimate also enrols the email address you give us in a short educational series about home solar — currently eight emails over about four weeks — as stated on the step where the address is collected. The series stops immediately when you unsubscribe (a link is in every email) or when you confirm a quote request. The emails contain no tracking pixel; when you follow a link in one, the link itself tells us which email you came from so we can see which topics are useful. Operational report-access and recovery emails are separate service emails and continue to work regardless of your email preferences.

7. International transfers

Our primary Supabase database is configured in the European Union. Some providers or their subprocessors—including Cloudflare, Resend, Google and Meta—may process information outside Ireland or the European Economic Area. Where a restricted transfer occurs, we use the contractual and product arrangements offered for the relevant service and assess the transfer mechanism that applies, such as an adequacy decision or Standard Contractual Clauses. The applicable mechanism can vary by provider, service and processing location; we do not describe every provider interaction as remaining exclusively inside the EU.

8. Access security

The report is protected by an opaque, host-only __Host-eb-report session cookie that is HttpOnly, Secure and SameSite=Lax. A separate browser-readable CSRF cookie is compared with a request header and a server-side hash before report changes are accepted. Report sessions expire after roughly 30 days of inactivity, subject to an additional server-side absolute limit.

Operational access emails use a single-use magic link that expires after 15 minutes. We store a token hash rather than the usable token. The report address itself is not sufficient to authenticate a visitor.

9. Data retention

The current technical retention policy uses the following target periods:

• Unused magic links: 15 minutes.
• Inactive report sessions: 30 days.
• Abandoned estimate records: 30 days.
• Saved estimates without a quote request: 6 months after the last activity.
• Unfinished quote-request drafts: 30 days after the last activity.
• Solar-tips email delivery events and link-visit records: up to 12 months, removed on a controlled manual basis.
• Confirmed quote requests: up to 24 months after the last activity under the current documented maximum. The final period and legal basis remain under Irish privacy review.

No automated deletion schedule for real customer records is currently enabled while that review is completed. The system can identify retention candidates, but real-record deletion remains a controlled process. We handle valid erasure requests manually in the meantime and may keep limited information longer where law, a dispute or a security investigation requires it.

10. Your rights

Depending on the processing and the circumstances, the GDPR and Irish Data Protection Act 2018 give you rights including:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erase your data (the "right to be forgotten").
• Restrict how we process your data.
• Data portability — receive your data in a structured, machine-readable format.
• Object to processing based on legitimate interest.
• Withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, please contact us at hello@energybase.ie. We normally respond within one month, subject to any extension permitted by data-protection law.

You may object under Article 21 GDPR to the limited server-side Meta Lead measurement described in section 6 by emailing hello@energybase.ie with the email address or phone number used for your request. We will assess and action a valid objection without affecting your saved report or quote request.

You also have the right to lodge a complaint with the Data Protection Commission:

• Website: www.dataprotection.ie
• Email: info@dataprotection.ie
• Address: 6 Pembroke Row, Dublin 2, D02 X963, Ireland

11. Solar installer directory listings

Separately from the homeowner data described above, EnergyBase.ie publishes a directory of solar installation companies. Each listing is compiled from the publicly available SEAI register of approved solar PV companies, the company's own website, and publicly available business review data (such as Google and Trustpilot). A listing may include the company name, business contact details (which for sole traders may be a personal name and mobile number drawn from the public register), service areas, logo, year established, review data, and links to the company's website and social profiles.

Legal basis. We process this business information under legitimate interest (Article 6(1)(f)): maintaining an accurate, factual directory of SEAI-registered installers so that Irish homeowners can find and compare them. We have weighed this interest against the rights of the businesses and individuals listed, and limit the data to what is already published for a business-facing purpose.

Your rights if you are listed. If you are (or represent) a listed company, you can ask us to correct your information, or to remove your listing entirely, at any time — including where a listing contains the personal data of a sole trader. Email hello@energybase.ie with the company name and we will action correction or erasure requests promptly. You also retain the right to object to this processing under Article 21 GDPR.

12. Children

EnergyBase.ie is not directed at anyone under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at hello@energybase.ie and we will delete it promptly.

13. Cookies

We use the first-party eb_attr cookie to remember which advertising channel brought you to EnergyBase.ie and to count page views by advertising channel in aggregate. It lasts for 30 days, is read only by our server, and is never shared with another organisation.

For full details on the cookies and similar technologies we use, please see our Cookie Policy.

14. Changes to this policy

We may update this privacy policy from time to time. The "Last updated" date at the top of this page reflects the most recent version. We encourage you to review this page periodically.

15. Contact

If you have any questions about this privacy policy, please contact us:

• Email: hello@energybase.ie
• JJM Advertising Limited, Dublin, Ireland