Privacy statement

This is the privacy statement of Sobolt B.V., located at Weena 268, 3012 NJ Rotterdam, the Netherlands, and registered with the Netherlands Chamber of Commerce under number 67363571. Among other things, the organisation supports governments and financial institutions with smart software that accelerates the energy transition. We develop and provide solutions for sustainability, energy advice and home scans. More than 150 organisations rely on our applications every day. For each type of processing, this statement sets out which data we obtain, for what purpose we process it and how long it is kept. If you have any questions, you can contact us; see the bottom of this page.

When processing personal data, we comply with Dutch privacy legislation. This means that we:

• Clearly set out our purposes before we process personal data, through this privacy statement.
• Store as little personal data as possible, only the data needed for our purposes.
• Explicitly ask for consent to process personal data where consent is required, as in the case of cookies.
• Take the security measures needed to protect personal data. Wherever possible, we impose these obligations on parties that process personal data on our behalf as well.
• Respect privacy rights, such as the right to access, correct or delete the personal data we process.

Whose personal data do we process?

Sobolt processes personal data when you use our services and/or because you have provided this data to us yourself and/or to perform a task in the public interest.

• Customers (municipalities and residents) who use our services
• Suppliers and partners
• Current and future employees

Who has access to personal data?

Within Sobolt, employees have access to personal data if they need it to perform their duties. Every employee within the organisation is bound by confidentiality.

Outside the organisation, we share data with parties when this is necessary to fulfil agreements. We do our utmost to ensure this is done carefully and securely.

For what purposes do we use personal data?

Sobolt processes personal data for the following purposes:

Providing our services

We process personal data to deliver our services in the areas of sustainability, safety or quality.

• Data: name, address, email, telephone, data or images of the home, bank account number (when subsidies are paid out)
• Legal basis: performance of the agreement
• Retention period:
  • Address data is destroyed as standard within 7 years of delivery. Collected data or images can then no longer be traced to a location or address. This anonymised data is kept to improve the algorithms
  • Data required for the official energy label and/or tailored advice is kept for 15 years, in line with the statutory retention period
  • Bank account number for subsidy payments: 7 years, in line with the tax retention obligation
  • Other data: no more than 7 years after the services end

Contact about our services

To provide the best possible service, data is processed to answer questions by telephone, email and online forms.

• Data: name, address, email, telephone, content of the communication
• Legal basis: legitimate interest (service and customer relationship)
• Retention period: no more than 5 years after the last contact

Financial administration and payments

Data for processing payments and keeping the financial administration.

• Data: name, address, bank account number, invoice details
• Legal basis: performance of the agreement and legal obligation
• Retention period: 7 years, in line with the tax retention obligation

Employees (HR)

We process personal data of (future) employees to perform the employment contract.

• Data: name, address, citizen service number (BSN), bank account number, salary details, training and competencies
• Legal basis: performance of the employment contract and legal obligation
• Retention period: no more than 7 years after employment ends, in line with tax and employment-law retention obligations

Improving services and algorithms

Sobolt does not make decisions based on automated processing on matters that could have significant consequences for individuals. We do use computer algorithms to speed up and improve large-scale data analyses. The collected data cannot be traced directly to individuals.

• Data: anonymised (housing) data
• Legal basis: legitimate interest
• Address data is destroyed within 7 years of delivery

We use cookies on our websites. We distinguish between the following types of cookies:

• Functional cookies: necessary for the technical operation of the website
• Analytical cookies: Google Analytics, to analyse website visits and improve the website
• Tracking cookies: to map user behaviour, follow general trends and obtain reports

For cookies that are not strictly necessary, we ask for consent in advance through a cookie banner. You can change your preferences at any time in the cookie settings. Sobolt has no influence on the placement and use of cookies by third parties.

Legal basis: consent (for analytical and tracking cookies), legitimate interest (for functional cookies).

Sobolt only provides data to third parties when this is necessary to perform the agreement, to comply with a legal obligation or when we have a legitimate interest in doing so. We conclude a data processing agreement with parties that process data on our behalf. Data is shared with the following organisations:

• IT suppliers and service providers (Google)
• Payment service providers (Nmbrs)
• Marketing companies (HubSpot)
• Cookie service providers
• Executing partners (energy advisers and installers)

To provide its services, Sobolt may provide personal data to parties established outside the European Economic Area (EEA). Sobolt only does so if an adequate level of protection is in place for the processing of personal data.

Sobolt takes data protection seriously and takes appropriate technical and organisational measures to prevent misuse, loss, unauthorised access, unwanted disclosure and unauthorised modification:

• Security software, such as virus scanners and firewalls. This applies in particular to the virtual machines on which much of our data analysis takes place.
• TLS (formerly SSL): we send data over a secure internet connection. You can see this by ‘https’ and the padlock in the address bar.
• DKIM, SPF and DMARC are three internet standards we use to prevent users from receiving emails in our name that contain viruses, are spam or are intended to obtain personal (login) details.
• DNSSEC is an additional layer of security (on top of DNS) for translating a domain name into its associated IP address; it is provided with a digital signature.

If you have questions about the use and storage of data, you can contact Sobolt using the contact details at the bottom of this privacy statement. You have the following rights:

• Right of access: the right to see the personal data we process.
• Right to rectification: the right to have the personal data we process corrected or completed if it is inaccurate or incomplete.
• Right to object: the right to object to the processing of personal data and to direct marketing.
• Right to erasure: the right to request that personal data be deleted.
• Right to withdraw consent: if consent has been given to process personal data, the right to withdraw that consent at any time.
• Right to data portability: the right, where technically possible, to have the personal data that Sobolt processes transferred to a third party.
• Right to restriction of processing: the right, in certain cases, to request that the processing of personal data be restricted (temporarily or otherwise).

When we receive a request, Sobolt may ask for identification to make sure the request was made by the right person. Sobolt will in principle respond to a request within one month. This period may, however, be extended by one month for reasons relating to the specific privacy rights or the complexity of the request. If we extend this period, we will let you know in good time.

If there is a suspicion that a data breach has occurred in which personal data has been lost or is being processed unlawfully, Sobolt acts in accordance with the applicable laws and regulations. Where required, we report such a data breach to the supervisory authority. If the data breach is likely to pose a high risk to the rights and freedoms of the data subjects, Sobolt informs the people concerned as soon as possible. If you suspect that a data breach has occurred, please contact us promptly using the contact details in this privacy statement.

Sobolt strives to deliver its services as well as possible. If you suspect that your personal data has been processed in a way that conflicts with the General Data Protection Regulation (GDPR), please contact us. View our complaints procedure here (in Dutch). If we cannot resolve the matter together, you can file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

We reserve the right to change this privacy statement. The current version is published on the website. We advise users to check the privacy statement regularly for updates.

If you have questions about the processing of your personal data, contact us at info@sobolt.com.

Sobolt B.V.
Weena 268
3012 NJ Rotterdam
The Netherlands
+31 10 899 55 10