Privacy notice and data handling

This section explains terms used in the policy to help you understand the scope of processing and the roles we perform.

We collect information that supports service delivery, communication, compliance with program requirements and website functionality. The types and sources of data are described below.

When you interact with our site or request assistance, we may collect the following categories of user-provided information necessary to evaluate eligibility and communicate effectively.

• Contact details: name, email address, telephone number, and mailing address used to deliver communications and program documentation.
• Property and project information: type of property, address, current heating and electrical systems, estimated project scope and timelines to assess applicable programs.
• Documentation and identifiers: copies of invoices, quotes, utility bills or identifiers required by rebate administrators to validate eligibility.
• Payment and billing information: when you purchase services, limited payment details processed via our payment partners; we do not store full card details on our servers.
• Communications content: messages you send via email, contact forms or phone that are necessary to respond to inquiries and maintain service records.
• Consent and preferences: records of your consent choices, marketing preferences and account settings to respect your communication preferences.

Some information is collected automatically when you visit our site to maintain service operation, analyze usage and improve delivery.

• Log data: IP address, browser type and version, pages viewed, access times and referring URLs to diagnose issues and maintain site performance.
• Device and technical data: device identifiers, operating system and browser capabilities used to optimize compatibility and security.
• Cookies and tracking: analytics cookies to measure site traffic and performance, and functionality cookies to remember session preferences.
• Geolocation approximation: coarse location inferred from IP for regional routing and program relevance; precise GPS location is collected only with explicit consent and device permission.
• Usage metrics: aggregated interaction data to evaluate content effectiveness and prioritize service improvements.
• Error reports and diagnostics: data generated when errors occur to support troubleshooting and platform stability.

We share data only with trusted third parties when necessary to deliver services, comply with legal obligations, or where you have provided consent. These third parties are bound by contractual terms that limit their use of the data.

• Payment processors to complete transactions and issue invoices.
• Authorized installers, inspectors and program administrators to process rebate applications and verify eligibility when you opt into coordination services.
• Cloud hosting and analytics providers to store and process data required for service operation and performance measurement.

We use collected data for a limited set of operational and legal purposes directly tied to service delivery and site maintenance.

• To assess eligibility for federal, provincial and municipal green energy programs and prepare application materials.
• To communicate with you about service status, documentation requirements and program timelines.
• To process payments and manage billing for purchased advisory services.
• To coordinate with third-party service providers when you request installation or program administration support.
• To maintain, analyze and improve website functionality and content relevance.
• To meet legal, regulatory or audit obligations connected to incentive programs or business transactions.
• To protect the security and integrity of our services, including fraud detection and abuse prevention.
• To record and preserve consent choices and communication preferences for compliance and user control.

Where applicable, we rely on legitimate interests, contractual necessity, consent, or compliance with legal obligations to process personal data. For Canadian users, processing is aligned with consent and reasonable purposes for delivering the requested advisory services.

• Contractual necessity: processing required to provide advisory services you have requested.
• Consent: where you opt into marketing communications or precise location collection.
• Legal compliance: processing necessary to comply with regulatory or tax obligations.
• Legitimate interests: for platform security, fraud prevention and internal analytics subject to a balancing test.

Cookies are used to enable core functionality, remember preferences and collect anonymous analytics. You can manage cookie preferences through your browser or the cookie settings available on our site.

We use essential cookies for site operation, preference cookies to remember language and session choices, performance cookies for analytics, and functional cookies for features like live chat.

Essential: required for navigation and secure sessions. Performance: anonymous usage statistics. Functional: saved preferences and conveniences. Advertising: not used by default; only with explicit consent where third-party services are engaged.

Most browsers permit you to block or delete cookies through settings. Blocking cookies may affect site functionality. To change cookie preferences on our site, use the cookie settings interface available in the footer.

View our detailed cookie policy at https://getgreenwavezone.club/cookie-policy

We limit data sharing to necessary recipients and only under contractual or legal safeguards. Transfers are performed to enable specific service activities.

• Authorized service partners for application processing and installer coordination when you opt into those services.
• Payment and billing providers to process transactions and refunds.
• Regulatory or tax authorities when disclosure is required by law.
• Professional advisors such as legal or accounting firms under confidentiality terms for compliance purposes.
• Acquirers or successors in the event of a business transfer, subject to privacy-protective terms.
• Analytics and hosting providers operating under data processing agreements that restrict use to our instructions.

Some service providers we engage may operate outside Canada. When data is transferred internationally, we seek contractual safeguards and assess applicable protections to maintain a reasonable level of security and confidentiality.

Safeguards may include standard contractual clauses, restricted access controls, and provider audits. We select partners with demonstrated compliance practices and restrict transfers to what is necessary for service delivery.

We retain personal data only as long as necessary for the purposes described, or as required by applicable law or contractual obligations.

Account and service records are retained for the duration of service provision and for a reasonable period afterward for tax, audit, and dispute resolution purposes.

Communications, support tickets and application records are retained to ensure continuity of service and to document program interactions until administrative closure and any required statutory retention period expires.

Technical logs and analytics data are retained in aggregated or anonymized form for performance monitoring; certain logs may be kept for a limited operational period for security diagnostics.

When retention periods expire or you request deletion where applicable, we remove personal data from active systems and, where feasible, apply deletion across backups within a reasonable timeline consistent with operational needs.

We implement layered security measures tailored to the sensitivity of data we process. Controls include access controls, encryption in transit, secure hosting practices, regular vulnerability assessments and staff training on data handling policies. Access to personal data is restricted to authorized personnel on a need-to-know basis.

• Role-based access controls and least-privilege permissions for internal systems.
• Encryption of data in transit using TLS and encryption at rest for sensitive records where supported by hosting providers.
• Regular backups, access logging, incident response procedures and periodic security reviews.

Depending on your jurisdiction and the context of processing, you have rights related to your personal data. We provide mechanisms to exercise these rights and respond in a timely manner.

• Access, correction, deletion, rectification, objection to processing, and withdrawal of consent where applicable. To exercise rights or make inquiries, contact us using the details below.
• Right to access: You may request a copy of the personal information we hold about you and receive a clear explanation of how it is used and for what purposes.
• Right to correction: If your personal information is inaccurate or incomplete, you may request that we correct or update it in our systems.
• Right to deletion: You can request deletion of personal data we process where retention is no longer necessary, subject to legal or operational exceptions.
• Right to data portability: Where applicable, you can request a machine-readable copy of data you provided to transfer to another service provider.
• Right to restrict processing: You may request that we limit processing of your personal information while we review a dispute about accuracy or lawfulness.
• Right to object: You can object to processing based on legitimate interests or direct marketing; we will assess and respond to such requests in accordance with applicable law.
• Right to withdraw consent: If processing is based on consent, you may withdraw consent at any time; withdrawal will not affect processing prior to the withdrawal.

Although getgreenwavezone operates primarily in Canada, we align several practices with the European Union's General Data Protection Regulation (GDPR) to ensure strong data protection standards for all users. This section explains how GDPR principles influence our handling of personal data and the rights we make available to data subjects.

GDPR may apply to individuals located in the European Economic Area or to processing that targets EEA residents. Even when GDPR does not strictly apply, getgreenwavezone adopts similar safeguards where practical, including purpose limitation, data minimization, and documented legal bases for processing.

• Lawful basis: We identify and document a lawful basis for personal data processing, such as consent, performance of a contract, compliance with legal obligations, or our legitimate interests where appropriate.
• Data minimization: We collect only the personal data necessary for clearly defined purposes, and we retain it only as long as reasonably required.
• Accountability and documentation: getgreenwavezone maintains records of processing activities and implements technical and organizational measures to protect personal information.
• Data subject rights: We provide mechanisms for data subjects to exercise their rights (access, rectification, erasure, restriction, portability, objection) and respond within applicable timeframes.

If you believe your GDPR rights have been infringed in relation to our processing activities, you may lodge a complaint with the relevant supervisory authority. We also encourage you to contact us first so we can attempt to resolve your concern promptly.

To exercise any of your privacy rights, submit a written request specifying the right you wish to exercise and any relevant details to help us locate your records. Provide a copy of a government-issued ID or other information if required for identity verification. We will acknowledge receipt and provide further instructions if needed.

[email protected]

We aim to respond to verifiable rights requests within 30 days. If we require additional time due to the complexity or number of requests, we will notify you and provide an estimated response timeframe.

getgreenwavezone may send informational and promotional communications about green energy programs, updates, and relevant services where we have a lawful basis to do so. Communications will be targeted and relevant to provided preferences and interactions.

You may opt out of marketing communications at any time using the unsubscribe link in emails or by contacting our privacy team. Opting out will not affect service or transactional messages related to inquiries you have submitted.

Our services are intended for adults and organizations. We do not knowingly collect personal information from children under 16. If we become aware that we have collected personal data from a minor without appropriate consent, we will take steps to delete that information promptly.

Our website may contain links to external services and partner programs. getgreenwavezone is not responsible for the privacy practices or content of those third parties. We recommend reviewing each third party's privacy policy before sharing personal information.

We limit data sharing to necessary recipients and only under contractual or legal safeguards. Transfers are performed to enable specific service activities.

View our detailed cookie policy at https://getgreenwavezone.club/cookie-policy

We review and update our privacy practices periodically to reflect legal, technical, or operational changes. Material updates will be reflected on this page with an updated effective date. Continued use of our services after changes indicates acceptance of the revised policy.