EnergySage™ Privacy Policy

We at EnergySage appreciate how much you value your privacy. That is why we have developed this Privacy Policy: to describe the types of information we may collect from you, how we may use that information, how we store it and the steps we take to protect it, the circumstances under which we may disclose or transfer it, and the choices you have regarding submitting and maintaining the information you provide to us. We urge you to read this Privacy Policy, and to become familiar with our privacy practices.

By visiting energysage.com or one of the affiliated pages hosted at the EnergySage domain (the “Site”), you are consenting to the practices described in this Privacy Policy. This policy does not apply to the privacy practices of companies or organizations that are not owned or controlled by EnergySage, or to people who are not employed by EnergySage. This Privacy Policy is subject to change. When we change the Privacy Policy in a material way, a notice will be posted at the Site along with the updated Privacy Policy. If you are a returning user or a regular user of the Site, we recommend that you review the Privacy Policy to be sure you are familiar with its current terms.

If you have any questions or concerns about the privacy or security of your information, please let us know.

This EnergySage Privacy Policy (“Privacy Policy” or “Policy”) informs you of important information about how EnergySage, Inc. ("EnergySage,” “we,” “us” or “our”) processes the personal data that we collect in online and offline formats, the privacy practices we undertake, the types of data we collect, how we use and secure that data, and how long we retain that data.

Please read this Policy carefully to understand our policies and practices regarding your information and how we will treat it. If you do not agree with our policies and practices, your choice is not to use our Site and/or Services (defined below).

By using our Site and Services (defined below), you expressly give your consent for the collection and use of your Personal Data (defined below) in compliance with this Privacy Policy.

This Policy may change from time to time (see UPDATES TO THIS PRIVACY POLICY). Your continued use of this Site after we make changes is deemed to be acceptance of those changes, so please check the Policy periodically for updates.

When we use the term, “Personal Data,” we mean information or data that directly or indirectly identifies, describes, relates to or is reasonably capable of being associated with or can reasonably link to a particular individual, consumer or household.

When we use the term “Service(s)” we mean to refer collectively to:

• The provision of our online tools to permit you to obtain an “Instant Estimate” of possible energy savings through our Site;

• Our online marketplace of third-party vendors of energy related goods and services (“Third-Party Vendors”) and online tools that provide price quotations for energy related services to those who purchase such tools and services (“Registered User(s)”);

• The information provided through websites owned and controlled by us, including the website at [https://www.energysage.com/ and https://news.energysage.com/] and any related mobile apps (the “Site(s)”), as well as through text messages from us; and

• Our marketing and business development activities, including any social media properties we create, and emails and text messages that we send (“Marketing Activities”).

We may collect your Personal Data through different means, when you:

• Decide to interact with us, either by providing us your information through the registration page, login page or demo page on the Site; by email; regular mail; or telephone (including mobile phone);

• Visit our Site, through automated data tracking technology;

• Become a Registered User or an authorized user or set up an account and provide us with information directly; and/or

• Authorize third parties to provide us Personal Data.

It is up to you whether you want to provide us with information or authorize third parties to provide us with information. When we ask you to provide information, you can decline and still visit the Site to learn more about us and what we do. However, if you choose not to provide information to us, we may be unable to provide you our Services. This Privacy Policy does not apply to any third-party sites that may link to or be accessible from the Sites.

We may collect the following types of Personal Data:

Types of Information You Provide to Us:

• Name, alias, physical address, email address, postal address, telephone/mobile phone numbers, communication preferences, unique personal or online identifier, account name;

• The location of the property or photographic map of a property;

• Your username and password, and possibly personal information about why you are contacting us, when you become a Registered User;

• Your property’s energy systems, the quantities of fuels consumed annually, the amount of electricity you use, the physical attributes of your property, including building type;

• Identifying number of your utility accounts or other identifying numbers that may be associated with your accounts, including account numbers, meter number, and copies of your utility bills;

• Information that you authorize third parties to release to us;

• Drivers’ license information from our Third-Party Vendors to verify identity;

• Records of your correspondence with us or third parties such as installers using our system.

If you submit any Personal Data to us relating to other people, you represent that you have the authority to do so and permit us to use the information in accordance with this Privacy Policy. By submitting Personal Data, you grant EnergySage the right to transmit, monitor, retrieve, store and use your information in connection with the operation of the Site.

Types of Information We Collect Through Technology: When you use our Site, we use technology [such as Google Analytics] to gather information on how visitors are using the Site and Services. Specifically, we use technology to gather information about the following:

• IP addresses

• Device

• Internet connection

• Browser version

• Time zone

• Operating system and platform

• Referring/exit pages

• Account access date/time stamp

• Cookie data previously stored on your device

An IP address is a number automatically assigned to your computer whenever you access the Internet. IP addresses allow computers (including mobile devices and tablets) and servers to recognize and communicate with one another. We collect IP address information so that we can properly manage our system and gather information about how our Site is being used. This includes the device type and browser you are using, location data, the pages you are viewing and your interactions on the page. Your IP address may be associated with records containing Personal Data. We collect details of visits to our Site, including the volume of traffic received, logs and the resources that you have accessed.

(Please also see our "Cookies Notice".)

Types of Information We Collect from Third Parties: Our Business Partners may submit publicly available information about you and demographic information, from third party sources to better understand your home’s suitability for energy products, and for research to improve our Services.

We only collect the information reasonably necessary to respond to inquiries about our Services, to provide you the Services, to carry out our operations, as required by law, and for the other legitimate business purposes, under applicable laws, as provided below:

• To provide you with price quotations and inform you about the Services in which you have indicated an interest or for which you've registered; Respond to your questions and requests and improve customer service; To provide you with notices about your account;

• To assist in business development and general marketing and building relationships; to create a list of actual and prospective users and Registered Users; to compile statistics regarding how the Site is used in order to improve our products and Services;

• To record your name and contact information, and other Personal Data for legitimate business purposes, so that we can provide our Services;

• To authorize and manage access to the Site;

• To perform our contract with you if you become a Registered User or authorized un-registered user; satisfy contractual necessity to conduct our operations and provide you with the services and products we offer; to perform essential business operations and to manage your account; to contact you with information that may be of interest to you;

• To improve the Site to provide you with better services, for example, we may use your personal data to improve the layout of our Site based on the click path you utilized to access certain information within the Site;

• To comply with legal obligations and professional responsibilities;

• To verify your identity or conduct internal audits or reviews; and

• To detect or prevent security incidents or other illegal activity; debug; verify or maintain quality or safety or improve or upgrade a service or device owned or controlled by us.

We do not monitor or profile visitors to our Site or collect, in any automated manner, any special categories of sensitive Personal Data about you. No automated decision-making, including profiling, is used when processing your Personal Data.

Additional Uses of Personal Data:
In addition to the uses described above, we may use your Personal Data for the following purposes if you become a Registered User. Some of these uses may, under certain circumstances be based on your consent, may be necessary to fulfill our contractual commitments to you, or are necessary to serve our legitimate interests in the following business operations:

• Providing you with newsletters, articles, alerts and announcements, and other information that we believe may be of interest to you;

• Providing you with marketing information about our Services;

• Conducting research, surveys, and similar inquiries to help us understand Registered User or authorized user needs;

• Analyzing your interactions with us and our Site, and improving our products, services, programs, and other offerings;

• Preventing, investigating, or providing notice of fraud, unlawful or criminal activity, or unauthorized access to or use of Personal Data, our Site or data systems; or to meet legal obligations; and

• Enforcing our Terms of Use, Mobile Terms of Use and other agreements.

We may disclose aggregated information that does not identify any individual (and therefore, is not deemed to be Personal Data) without restriction.

We share Personal Data with the following categories of recipients:

Third-party Vendors: Your Personal Data will only be shared with and processed by our affiliates and non-affiliated third-party service providers as permitted by law and for the purposes described in this Privacy Policy. Utilities who partner with us may contact you about our services and then obtain from us a list of their customers who engaged with a campaign that directed their customers to EnergySage. We may disclose Personal Data to certain non-affiliated specialized service providers, including professional advisors, consultants, technical service providers, researchers and other third parties, who are bound by contractual obligations to keep Personal Data confidential and use it only for the purposes for which we disclose it to them. We may disclose your Personal Data to third-party service providers to provide us with services such as Site hosting, including information technology and telephony services, and related infrastructure, customer service, e-mail delivery, text messaging services, auditing and other similar services.

Channel Partners: EnergySage enters into partnerships with third-party entities to improve and market our Services and to facilitate research in the energy field.

Corporate Affiliates: We may share your information with our corporate affiliates that are subject to this policy.

Business Transfers: When applicable, we may share your information in connection with a substantial corporate transaction, such as the sale of a Site, a merger, consolidation, asset sale, or in the unlikely event of bankruptcy.

Third-Party Advertising: We share information with third parties that either display advertising on the Site or manage our advertising on other sites and applications, including mobile devices. If you opt in to receive texts from us, we do not share your opt-in information with these third parties.

With Your Consent or at Your Direction: We may share information for any other purposes disclosed to you at the time we collect the information or pursuant to your consent or direction.

Other Legal Reasons: In addition, we may use or disclose your Personal Data as we deem necessary or appropriate: (1) under applicable law; (2) to respond to requests from public and government authorities including public and government authorities; (3) to pursue available remedies or limit damages we may sustain; (5) to protect our operations or those of any of our affiliates; (6) to protect the rights, privacy, safety or property of EnergySage, our affiliates, you and others; and (7) to enforce our terms and conditions.

We use reasonable organizational, technical and administrative measures to maintain the privacy and security of your Personal Data within our organization. Accordingly, we prevent unauthorized access by a secure firewall and use of security technologies to protect the integrity and privacy of any Personal Data you provide. Although we work hard to protect your Personal Data, EnergySage cannot guarantee the security of any information you transmit to us through online forms and applications, and you do so at your own risk. The Site is not designed to store sensitive personal information such as financial, health or educational records and you should not use the site for that purpose. Please note that email and text are considered nonencrypted (and therefore nonsecure) forms of communication, and can be accessed and viewed by others without your knowledge and permission. For that reason, to protect your privacy, please do not use email or text to communicate information that you consider confidential. Unfortunately, no data transmission or storage system can be guaranteed to be secure at all times. If you have reason to believe that your interaction with us is no longer secure, please immediately notify us in accordance with the “Contact Us” section below. We will let you know promptly if a breach occurs that may have compromised the privacy or security of your information.

We are not responsible for any outcome if you circumvent any privacy settings or security measures. You are responsible for choosing a password of appropriate strength, not sharing or reusing passwords used on other websites, and keeping your password confidential. EnergySage employees will never ask for your password.

We will retain your Personal Data for the period necessary to fulfill the purposes outlined in this Privacy Policy and in order to provide you the Services, and for as long as your account is active or as needed to provide you Services. We will also retain your information to comply with our legal obligations, to conduct audits, resolve disputes, and enforce our agreements.

This Site is only intended for individuals who are at least 18 years of age. We do not knowingly encourage or solicit visitors to this Site who are under the age of 18.

We are committed to complying with the Children’s Online Privacy Protection Act (COPPA). Our Service is not directed to children under the age of 13 and children under the age of 13 are not to use the Site or provide any information to our Service without express parental consent. We do not knowingly collect personal information from children under the age of 13. If we receive personal information that we discover was provided by a child under the age of 13, we will promptly destroy such information.

California residents under 16 years of age may have additional rights regarding the collection and sale of their personal information. Please see YOUR CALIFORNIA PRIVACY RIGHTS for more information.

EnergySage uses payment processors and does not collect financial information.

We may periodically send you relevant marketing alerts and newsletters by e-mail, in addition to our transactional e-mails that we may send to customers. To help improve our Marketing Activities, our email service provider provides us with reporting that includes data based on when you open an e-mail or click on a link included in one of these emails. Instructions on how to unsubscribe from these marketing alerts and newsletters are included in each marketing e-mail.

We may offer benefits to our customers who make referrals of our services. When we do this, we receive Personal Information about new customers directly from those interested in our services, and not from our existing customers.

If you opt-in to receive informational text messages from us, we may periodically send you texts relating to services you have requested, such as product information and appointment reminders. If you opt-in to receive promotional text messages from us, we may periodically send you texts relating to products or services we think may be of interest to you. Instructions on how to opt-out of text messaging are included in our opt-in confirmation text and every Promotional text we send.

To help us improve our Services and/or measure the effectiveness of and improve our Marketing Activities, our SMS service provider provides us with reporting that includes data about whether our message was delivered. In certain text messages, we may include links that direct you to our Site. If you click on any of these links and visit our Site, we may collect your Personal Data through automated data tracking technology. To help us measure the effectiveness of and improve our Marketing Activities, our CRM service provider may also provide us with reporting that includes data based on your visit to our Site and related Site traffic data.

For more information on our text messaging programs, please see our Mobile Terms of Use. Please also see our “Cookies Notice” below.

You have choices in how your Personal Data is used and shared. You have the right to:

• Request that EnergySage update, access, and delete your account information; and

• Choose whether you wish to receive promotional and newsletter communications.

Account Information: If you are a Registered User and have an account with us, you may update, correct, or delete your Personal Data at any time by (1) logging into your account and modifying your Personal Data, or (2) by emailing us at [email protected]. EnergySage will provide you with information about whether we hold, or process on behalf of a third party, any of your Personal Data. We will respond to your access request within 30 days.

Deactivating or Deleting Your Account: If you have a EnergySage account and wish to deactivate your account, please go to https://www.energysage.com/market/ and click “I’m done shopping” for instructions, but note that we may retain certain information, including cached or archived copies, as required by law or for legitimate business purposes.

Community Forums, Case Studies, and Blogs: Some of our Site offers publicly accessible blogs or community forums. You should be aware that any information you provide in these areas may be read, collected, and used by others. To request removal of your Personal Data from our blog or testimonials, please contact [email protected]. In some cases, we may not be able to remove your Personal Data, in which case we will let you know if we are unable to do so and why.

Certain Exceptions to Deletion Request Rights: You have the right to request that we delete any of your personal information that we collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable consumer request, we will delete (and direct our service providers to delete) your personal information from our records, unless an exception applies. We may deny your deletion request if retaining the information is necessary for us or our service provider(s) to:

• Complete the transaction for which we collected the personal information, fulfill the terms of a written warranty or product recall conducted in accordance with federal law, or otherwise perform our contract with you.

• Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.

• Debug products to identify and repair errors that impair existing intended functionality.

• Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law.

• Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 et. seq.).

• Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest.

• Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us.

• Comply with a legal obligation.

• Make other internal and lawful uses of that information that are compatible with the context in which you provided it.

Choice and Opt-Out:

• We provide you the opportunity to unsubscribe from our promotional email communications or you may contact us using the information below.

• You may opt out of personalized ads anytime by deleting your browser's cookies. For more information, please review our Cookies Notice.

• You may opt out of receiving text messages at any time by replying “STOP”. Message and data rates may apply.

Exercising Access, Data Portability and Deletion Rights: To exercise the access, data portability, and deletion rights described above, please submit a verifiable consumer request to us by emailing us at [email protected].

Verification of Your Identity: Only you, or someone legally authorized to act on your behalf, may make a verifiable consumer request related to your personal information. You may also make a verifiable consumer request on behalf of your minor child. You may make a verifiable consumer request for access or data portability twice within a 12-month period. You must:

• Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative.

• Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you.

Where you have provided consent to process personal information, you have the right to withdraw such consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal. You may do this by contacting us as set forth in the "How to Contact Us" section below.

We endeavor to respond to a verifiable consumer request within thirty (30) days of its receipt. If we require more time (up to 90 days), we will inform you of the reason and extension period in writing.

If you have an account with us, we will deliver our written response to that account. If you do not have an account with us, we will deliver our written response by mail or electronically, at your option.

Any disclosures we provide will only cover the 12-month period preceding the verifiable consumer request’s receipt. The response we provide will also explain the reasons we cannot comply with a request, if applicable. For data portability requests, we will select a format to provide your personal information that is readily usable and should allow you to transmit the information from one entity to another entity without hindrance.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

What are cookies and why are cookies used: A cookie is a piece of data that a website can send to your browser, which may then be stored on your computer as a tag that identifies your computer. While cookies are often only used to measure website usage (such as number of visitors and duration of visit) and effectiveness (such as topics visitors are most interested in) and to allow for ease of navigation or use and, as such, are not associated with any personal information, they are also used at times to personalize a known visitor's experience of a website by being associated with profile information or user preferences. Over time this information provides valuable insight to help improve the user experience.

How we use Cookies: We use cookies and related technologies (“Cookies”) to provide Services, gather information when users navigate through the Sites to enhance and personalize the experience, to understand usage patterns, and to improve our Sites, products, and Services.
Cookies on our Sites are generally divided into the following categories:

• Necessary Cookies. These cookies are necessary to provide you with our Services and to use some of their features, such as access to secure areas. Because these cookies are strictly necessary to deliver the Services, you cannot refuse them without impacting how our Services function. These cookies do not collect identifying information about you, and they do not monitor or remember any of your internet browsing on sites other than EnergySage.

• Helpful Cookies. These cookies allow us to provide you with a better experience when you use our Site. These cookies do not collect identifying information about you, and they do not monitor or remember any of your internet browsing on sites other than EnergySage.

• Analytics and Customization Cookies. These cookies collect information that is used to help us understand how our Services are being used or how effective our marketing campaigns are, or to help us customize our Services for you to enhance your experience. This data is anonymous and only used for statistical purposes, analytics cookies do not collect or share any personally identifiable information. These cookies qualify as “third-party” cookies as they are not sent directly by EnergySage.

• Web Beacons. Pages of our the Site [and our e-mails] may contain small electronic files known as web beacons (also referred to as clear gifs, pixel tags, and single-pixel gifs) that permit the EnergySage, for example, to count users who have visited those pages or [opened an email] and for other related website statistics (for example, recording the popularity of certain website content and verifying system and server integrity).

• Targeting Cookies. These record your visit to our Sites, the pages you have visited and the links you have followed to recognize you as a previous visitor and to track your activity on the Sites and other Sites you visit. These Cookies qualify as persistent cookies, because they remain on your device for us to use during a next visit to our Sites. You can delete these cookies via your browser settings. See below for further details on how you can control third-party targeting cookies.

• Google Analytics. This Site uses Google Analytics. Google Analytics uses cookies to help us to analyze how users use the Site. It counts the number of visitors and tells us things about their behavior in the aggregate – for example, we can see which user guides are most popular or see how many people visit our Sandbox. Google Analytics does not associate your IP address with any other data held by Google. You may see how Google uses data when you use this Site at www.google.com/policies/privacy/partners.

How to Control Cookies: You can review your Internet browser settings, typically under the sections "Help" or "Internet Options," to exercise choices you have for certain Cookies. If you choose to block all cookies, you may not have access to our Site, our Services will not function as intended, and you will not be able to log in. If you have blocked all cookies and wish to make full use of the features and Services we offer, we recommend enabling at least first-party cookies. Rather than blocking all cookies, you can choose to block only third-party cookies. This will allow EnergySage Services to function as intended. To learn more about the use of Cookies by Google for analytics see https://policies.google.com/technologies/cookies. To exercise choice regarding those Cookies, please see the Google Analytics Opt-out Browser Add-on at https://tools.google.com/dlpage/gaoptout. The opt-outs described above are device- and browser-specific and may not work on all devices.

1. CCPA: As of January 1, 2020, under the California Consumer Privacy Act (CCPA), California Residents have certain additional rights regarding their Personal Data. If and to the extent you are a "consumer" as defined under the CCPA and that we are a "business" as defined under CCPA, the following may apply to you:
   

   You have the right to request the following information from us by emailing us at the contact information in the section titled, HOW TO CONTACT US, and we will provide the following information to you upon verification of your identity:

   • The categories of Personal Data EnergySage collect about you;

   • The categories of sources from which your Personal Data is collected;

   • The business purpose for collecting your Personal Data;

   • The categories of third parties with whom EnergySage shares your Personal Data; and

   • The specific pieces of Personal Data EnergySage have collected about you.

   In addition, please check the following section of this Privacy Policy: TYPES OF PERSONAL DATA WE COLLECT, HOW AND WHY WE USE YOUR INFORMATION, and HOW WE SHARE AND DISCLOSE PERSONAL DATA.

   You may opt out of any marketing by us and from the disclosure of your Personal Data to third parties.

2. Personal Information Sales Opt-Out And Opt-In Rights: If you are 16 years of age or older, you have the right to direct us to not sell your personal information at any time (the “right to opt-out”). We do not sell the personal information of consumers we actually know are less than 16 years of age, unless we receive affirmative authorization (the “right to opt-in”) from either the consumer who is at least 13 but not yet 16 years of age, or the parent or guardian of a consumer less than 13 years of age. Consumers who opt-in to personal information sales may opt-out of future sales at any time.
   
   To exercise the right to opt-out, you (or your authorized representative) may submit a request to us at the contact information in the How to Contact Us section below.
   
   Once you make an opt-out request, we will wait at least twelve (12) months before asking you to reauthorize personal information sales. However, you may change your mind and opt back into personal information sales at any time by contacting us. Please see the How to Contact Us section below.
   
   You do not need to create an account with us to exercise your opt-out rights. We will only use personal information provided in an opt-out request to review and comply with the request.

3. Non-Discrimination: If you elect to exercise any of your rights under CCPA, EnergySage will not discriminate against you for exercising any of your CCPA rights. Unless otherwise permitted by the CCPA, we will not: deny you goods or services, charge you a different price or rate for our goods or services, or provide you a different level or quality of goods or services because you exercised such rights. Under the current definition of CCPA, EnergySage does not sell your Personal Data.
   

   Other than as provided above, we may offer you certain financial incentives, as permitted by the CCPA, in exchange for your giving us certain information, which incentives may result in different prices, rates, or quality levels. Any CCPA-permitted financial incentive we offer will reasonably relate to your personal information’s value and contain written terms that describe the program’s material aspects. Participation in a financial incentive program requires your prior opt in consent, which you may revoke at any time.

4. Types of Information We Have Collected in the Past Twelve (12) Months: In particular, we have collected the following categories of personal information, from Registered Users, authorized users, and visitors to our Sites, within the last twelve (12) months: name, alias, postal address, physical address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, signature address, phone numbers, browsing history, search history, information on a consumer’s interaction with a website, application, or advertisement. In addition, we collect drivers’ license information from our Third-Party Vendor installers to verify their identity.

If you are a resident of the EEA, UK or Switzerland, your personal information will be treated in a secure and confidential manner in compliance with all applicable privacy laws and regulations, including the European General Data Protection Regulation (“GDPR”). Depending on the context in which personal information is provided, EnergySage may be the data processor (“processor”) or data controller (“controller”) of your personal information. In most instances, EnergySage is a processor of personal information submitted to us. The Data Subject owns the data submitted to the Service. If the Registered User requests that EnergySage remove the personal information, we will respond to the request within 30 days.

If you have any questions or concerns regarding this Privacy Policy or our privacy practices, including the processing of your personal information, if you would like to exercise your data rights under applicable laws, or if you believe your privacy rights have been violated, please contact us as provide in the section How to Contact Us below.

Occasionally we may provide links to other sites for your convenience and information. These sites operate independently from our Sites and are not under our control. These sites may have their own privacy notices or terms of use, which you should review if you visit any sites linked through our Sites. We are not responsible for the content or use of these unrelated sites.

EnergySage may change its Privacy Policy from time to time at EnergySage's sole discretion. EnergySage encourages visitors to frequently check this page for any changes to its Privacy Policy.

If you have any queries, questions or concerns about this Privacy Policy or our Personal Data handling practices, please contact us at [email protected] or write to us at EnergySage, Inc. P.O. Box 960508 Boston, MA, 02196, or call us at 888.802.8806 (U.S. only).