This Privacy Policy explains how Green Sketch Pty Ltd (ABN 72 683 057 852), an Australian company with its registered address at 55 Rai Drive, Crestmead QLD 4132, Australia, and its affiliates operating our products and services in the European Union and the United Kingdom (together, “Green Sketch”, “we”, “us” or “our”) process the personal data of customers, installation partners, suppliers, homeowners and job applicants.

This Privacy Policy applies to our software platforms, applications, products and related services, including the GreenSketch platform available at greensketch.ai and the EnergyBrain platform available at energybrain.com, together with any associated applications, portals and services that link to or expressly refer to this Privacy Policy (collectively, the “Platforms and Services”).

Green Sketch values the protection of your privacy and takes the protection of your personal data seriously. This Privacy Policy explains in a transparent way how Green Sketch collects, uses and protects your personal data, and how we comply with applicable data protection laws, in particular the EU General Data Protection Regulation (Regulation (EU) 2016/679, the “GDPR”) and, where it applies to the processing, the UK GDPR and the UK Data Protection Act 2018 (together, “Data Protection Laws”).

Scope of this Privacy Policy

This Privacy Policy covers the processing of personal data by Green Sketch as a controller in respect of:

• our customers;
• installation partners;
• suppliers;
• homeowners and end users, in the specific situations described in the homeowners section below; and
• job applicants.

This Privacy Policy does not cover the processing of personal data of visitors to our websites and social media channels (including the use of cookies and similar technologies, website analytics, website contact forms, website newsletter sign-ups, savings calculators on the website, contact form enquiries and ordinary website interactions). That processing is addressed in the separate website privacy notice published on greensketch.ai or energybrain.com, which should be read together with this Privacy Policy.

This Privacy Policy also does not cover the processing of personal data by Green Sketch as a processor on behalf of its customers. Where customers (such as solar installers) upload personal data of homeowners or end users to the relevant platform in the course of their own installation business, Green Sketch acts as a processor for that customer and the customer remains controller. That processing is governed by the data processing agreement entered into between Green Sketch and the relevant customer and is not covered by this Privacy Policy.

What is personal data?

Under the Data Protection Laws, personal data is any information relating to an identified or identifiable natural person. This means information that either directly relates to a person or can be traced back to that person.

About us

The Green Sketch entity that determines the purposes and means of the relevant processing is the controller for that processing. In most cases, this will be Green Sketch Pty Ltd. The relevant controller for your relationship with us is normally the Green Sketch entity identified in your contract, onboarding documentation, recruitment communication or other communication through which this Privacy Policy is made available. If another affiliate of Green Sketch is your contracting party or independently determines the purposes and means of a specific processing activity, that entity may act as an independent controller. Where our affiliate act as joint controllers within the meaning of Article 26 GDPR (and Article 26 UK GDPR where applicable), we will make the essence of the joint controller arrangement available where required by applicable law.

Data Protection Officer and representatives

Green Sketch has designated privacy.eu@osw.energy as its contact point for data protection matters. If Green Sketch appoints a Data Protection Officer where required by applicable law or on a voluntary basis, the Data Protection Officer’s contact details will be published in this Privacy Policy and, where required, communicated to the relevant supervisory authority.

Green Sketch will publish the contact details of any representative in the European Union (Article 27 GDPR) or in the United Kingdom (Article 27 UK GDPR) where such representative is required to be appointed under applicable Data Protection Laws.

For which purposes do we process personal data?

We process your personal data only for carefully determined purposes. Below you will find more information about the various purposes, organised by category of data subject.

Where we ask you to provide personal data, we will indicate where the provision of such data is necessary for entering into or performing a contract, for complying with a legal obligation, or for using a specific service. If you do not provide data that is necessary for a contract or service, we may not be able to provide that service, process the relevant request or maintain the relevant business relationship.

CUSTOMERS

We process personal data of customers (such as solar installers and solar businesses), their employees, contact persons and persons engaged by them. We may also ask the customer to make this Privacy Policy available to its employees, contact persons and other persons engaged by it. A copy of this Privacy Policy is available on our website.

For the performance of our agreement

What does this purpose entail?

In order to provide the Platforms and Services to you, we process personal data. This includes day-to-day communication, providing access to the platform, processing orders for products procured through the platform, scheduling deliveries, providing customer onboarding and training, and processing the financial administration relating to your use of the platform. We can only provide our services if we process personal data for these purposes. Where you are the contracting party (for example a sole trader or other natural person), the lawful basis is the performance of the agreement we have with you (Article 6(1)(b) GDPR). Where you are an employee, contact person or other person acting on behalf of a customer, the lawful basis is our legitimate interest in the proper performance of the agreement with that customer (Article 6(1)(f) GDPR).

Which personal data do we process for this purpose?

• Name, salutation and job title;
• Phone number and email address;
• Employer, Chamber of Commerce / company registration number, VAT number;
• Address details (delivery and invoicing address);
• Account credentials (username, password, multi-factor authentication data);
• Bank account details and outcomes of credit checks;
• Order details, project details, design files, configuration and usage data of the platform;
• Confidentiality declarations; and
• Any other relevant information you provide to us during the performance of the agreement.

Maintenance, support and service

What does this purpose entail?

To deliver our services as effectively as possible, we process personal data when we provide maintenance, technical support and product service. This allows our support staff to respond to platform issues, troubleshoot, and provide updates. Where you are the contracting party (for example a sole trader or other natural person), the lawful basis is the performance of the agreement we have with you (Article 6(1)(b) GDPR). Where you use the platform or request support on behalf of a customer, the lawful basis is our legitimate interest in providing, securing and supporting the relevant platform for that customer (Article 6(1)(f) GDPR).

Which personal data do we process for this purpose?

• Contact person, phone number, address and email address;
• Account and access credentials;
• Support tickets, work logs and screenshots provided by you;
• Configuration data of the platform; and
• Any other information you share with us in the course of support.

For communication purposes, including customer service: handling questions, comments and complaints

What does this purpose entail?

Where you contact our customer service for any questions, comments or complaints, we process personal data. To answer your enquiries, we need certain personal data. The personal data we need depends on the nature of the enquiry. The lawful basis is our legitimate interest in efficiently handling questions, comments and complaints (Article 6(1)(f) GDPR).

Which personal data do we process for this purpose?

Name, address, email address, phone number, optionally job title, and any other information you share with our customer service during our contact. In some cases we make a recording of telephone conversations for quality and training purposes.

Provision of the GreenSketch application and your account

What does this purpose entail?

Green Sketch operates the relevant platform and provides accounts to enable customers to use the platform. We process personal data to enable account access, role-based permissions, team management and the design, quoting and procurement features of the platform. Where you are the contracting party (for example a sole trader or other natural person), the lawful basis is the performance of the agreement we have with you (Article 6(1)(b) GDPR). Where you use the platform on behalf of a customer, the lawful basis is our legitimate interest in providing the relevant platform to that customer (Article 6(1)(f) GDPR).

Which personal data do we process for this purpose?

Username, password and other account credentials, email, role and team membership, projects created on the platform, design files, quotations, orders, deliveries and other content uploaded to the platform by you or your team.

Product improvement, analytics and the operation of AI-supported features

What does this purpose entail?

We continuously seek to improve the Platforms and Services we provide. We analyse how the platform is used in order to optimise its performance, security and user experience, and we measure adoption of new features. The platform also includes AI-supported features such as automated rooftop detection (Roof Detect) and 3D roof visualisation, which are made available to customers as part of their use of the platform. Where possible, we use aggregated or anonymised data for product improvement. We use identifiable usage data only where this is necessary for troubleshooting, security, feature improvement or similar operational purposes. The lawful basis is our legitimate interest in improving and securing our products and services and in offering AI-supported functionality of an appropriate quality (Article 6(1)(f) GDPR).

Which personal data do we process for this purpose?

Account and platform usage data, technical data of devices used to access the platform, performance metrics, configuration of designs and projects and error logs. We do not use special category data within the meaning of Article 9 GDPR for the training of AI models.

Business relationship marketing to business contacts

What does this purpose entail?

For our business relationship marketing it is important to recognise and address our existing business contacts and to maintain those relationships. We use personal data to send product updates, service updates, event invitations and information about (similar) products and services that may be of interest to you in your professional capacity, and to measure the effectiveness of those communications (including by means of email pixels). You can object to our use of your personal data for direct marketing purposes at any time, free of charge, by using the unsubscribe link at the bottom of our marketing emails or by contacting us. Where required by applicable electronic marketing rules (such as the UK Privacy and Electronic Communications Regulations or equivalent EU rules), we will only send such communications with your consent or where another permitted basis, such as the soft opt-in for existing business relationships, applies. Where our marketing emails contain tracking pixels or similar technologies, we use them in accordance with applicable rules on electronic communications and storage/access technologies. For information about general newsletter sign-ups via our websites, please refer to the website privacy notice on greensketch.ai. The lawful basis is our legitimate interest in maintaining business relationships and offering similar products and services to existing customers and other business contacts (Article 6(1)(f) GDPR).

Which personal data do we process for this purpose?

Email address, name, employer, job title, phone number, marketing engagement data (such as opens and clicks) and email pixel data.

INSTALLATION PARTNERS

We process personal data of installation partners (and their employees, contact persons and persons engaged by them) where they perform installation, commissioning, after-sales or related field services in connection with the relevant platform or with products procured through it. Where we obtain personal data of an installation partner’s employees or contact persons indirectly (for example because they are designated by their employer), we are required to provide this information to those persons in accordance with Article 14 GDPR.

For the performance of our agreement and coordination of installation activities

What does this purpose entail?

To engage and coordinate with installation partners, we process personal data such as contact details, qualifications and certifications relevant to the installation work, scheduling and project information, work reports and access details required to perform the work. Where you are the contracting party (for example a sole trader or other natural person), the lawful basis is the performance of the agreement we have with you (Article 6(1)(b) GDPR). Where you are an employee, contact person or other person acting on behalf of an installation partner, the lawful basis is our legitimate interest in coordinating installation activities effectively (Article 6(1)(f) GDPR). Where installation site photos or work reports include information relating to homeowners or other individuals, we process such information only to the extent necessary for installation, verification, support or dispute-handling purposes.

Which personal data do we process for this purpose?

• Name, salutation, job title;
• Phone number and email address;
• Employer, Chamber of Commerce / company registration number, VAT number;
• Address details and country of operation;
• Account credentials for the platform (where access is required);
• Certifications, accreditations and licences relevant to the installation work;
• Bank account and invoicing details;
• Project details, work reports, photos of installation sites and post-installation imagery; and
• Any other relevant information you provide during the performance of the agreement.

SUPPLIERS

Where we obtain personal data of a supplier’s employees or contact persons indirectly (for example because they are designated by their employer), we are required to provide this information to those persons in accordance with Article 14 GDPR.

For processing orders and assignments (day-to-day operations), including the processing of supplier invoices and bank transactions

What does this purpose entail?

For the placement and processing of our orders and assignments with you as a supplier (the conduct of our day-to-day business), we process personal data of, for example, your contact persons. This personal data helps us to provide you with the correct information for the placement of an order or assignment, and for the financial settlement of those orders. Where you are the contracting party (for example a sole trader or other natural person), the lawful basis is the conclusion or performance of the agreement (Article 6(1)(b) GDPR). Where you are an employee, contact person or other person acting on behalf of a supplier, the lawful basis is our legitimate interest in the proper performance of the agreement with that supplier (Article 6(1)(f) GDPR).

Which personal data do we process for this purpose?

Name, salutation, job title, phone number, Chamber of Commerce / company registration number, employer, email address, address details, country, bank account details and VAT numbers, and any other relevant information that is provided during the performance of the agreement.

HOMEOWNERS AND END USERS

This section applies to homeowners and end users only in the situations set out below in which Green Sketch processes personal data as a controller outside the scope of ordinary website visits. The processing of personal data through general website interactions, including the savings calculator and contact forms on greensketch.ai, is covered by the website privacy notice on greensketch.ai. Where customers (installers) upload personal data of homeowners or end users to the relevant platform in the course of their own installation business, Green Sketch acts as a processor for that customer; that processing is governed by the data processing agreement between Green Sketch and the customer and is not covered by this Privacy Policy.

Most personal data of homeowners and end users in the situations covered by this section is obtained indirectly: from publicly available aerial imagery and address data (in the case of Leads Radar), from installers (in the case of lead-matching) or from other third-party sources. Where this is the case, we provide the information set out in this Privacy Policy in accordance with Article 14 GDPR.

Lead generation through publicly available aerial imagery (Leads Radar)

What does this purpose entail?

Leads Radar is a feature operated by Green Sketch that uses publicly available aerial imagery and address data to detect rooftop conditions and existing photovoltaic installations, in order to identify properties with the potential to benefit from a solar installation. Where Green Sketch processes such information as a controller for its own lead-generation purposes, this processing is covered by this Privacy Policy. Where Leads Radar is made available to installers as a tool within the relevant platform and is used by installers for their own prospecting activities in respect of properties they select, Green Sketch acts as a processor for that installer and the processing is not covered by this Privacy Policy. The lawful basis for Green Sketch’s own controller-level processing is our legitimate interest in lead generation and marketing of our services and the services of our installer network (Article 6(1)(f) GDPR). We rely on our legitimate interest only where we have assessed that this interest is not overridden by the interests, rights and freedoms of the homeowner, taking into account the nature of the data, its source, the limited purpose of the processing, and the homeowner’s right to object. We do not subject homeowners to fully automated decision-making with legal or similarly significant effects. Where required by applicable law, we provide this information to homeowners within the period required by Article 14 GDPR (and Article 14 UK GDPR where applicable), for example when we first contact them or before we disclose their data to an installer, unless an exemption applies.

Which personal data do we process for this purpose?

• Property address and approximate geolocation;
• Aerial / satellite imagery and rooftop characteristics derived from such imagery (such as orientation, surface area, shading and existing photovoltaic installations); and
• Lead status (such as “prospect” or “disqualified”).

Source of personal data

Publicly available aerial imagery providers and address registers.

Forwarding of homeowner leads to installers

What does this purpose entail?

Where, outside the ordinary website visitor context or following a lead collection process described in our website privacy notice, Green Sketch acts as controller for the matching and forwarding of homeowner leads to installers, we may share the lead with one or more installers in the homeowner’s region so that they can prepare a quote or proposal. Once the lead has been forwarded, the installer becomes the controller in respect of that data for the purposes of preparing a quote and contacting the homeowner. The lawful basis for our controller-level forwarding is our legitimate interest in operating an effective lead-matching network and in supporting our installer customers (Article 6(1)(f) GDPR), balanced against the homeowner’s reasonable expectations and the right to object. Where required by applicable law, we provide this information to homeowners within the period required by Article 14 GDPR (and Article 14 UK GDPR where applicable), for example when we first contact them or before we disclose their data to an installer, unless an exemption applies.

Which personal data do we process for this purpose?

Name, email address, phone number, postal address and postcode, type of property, characteristics of the property relevant to a solar installation, and any other information provided as part of the lead.

Source of personal data

The homeowner directly, or a third-party source where the homeowner has consented to onward sharing.

AI-supported lead capture and qualification

What does this purpose entail?

Green Sketch operates AI-supported tools (such as the AI marketing assistant Emily) that may interact with homeowners on our behalf or on behalf of installers in order to capture and qualify leads. Where Emily is embedded on our own websites, the processing of personal data through that interaction is covered by the website privacy notice on greensketch.ai. Where Emily is used outside the website context (for example through an installer’s landing page or QR code) and Green Sketch processes the resulting personal data as a controller, the processing is covered by this Privacy Policy. The lawful basis is our legitimate interest in lead capture and marketing of our services and the services of our installer network (Article 6(1)(f) GDPR). Where consent is required for the specific channel or functionality, we rely on your consent (Article 6(1)(a) GDPR). Where you interact with Emily, you will be informed that you are interacting with an AI system where required by Article 50 of the EU AI Act. We do not use Emily to make decisions about you that produce legal effects or similarly significant effects within the meaning of Article 22 GDPR (and Article 22 UK GDPR where applicable). You may object to processing based on our legitimate interests in accordance with applicable data protection law.

Which personal data do we process for this purpose?

Name, email address, phone number, content of your messages, lead-qualification outcome, the installer to whom your lead is forwarded (where applicable) and any other information you provide during the interaction.

Customer service and complaint handling for homeowners

What does this purpose entail?

Where you contact us as a homeowner with questions, comments or complaints in relation to a project, an installer or our services, we process personal data to respond appropriately. The lawful basis is our legitimate interest in the efficient handling of questions and complaints (Article 6(1)(f) GDPR).

Which personal data do we process for this purpose?

Name, contact details, project information and any other information you share with us during the contact.

JOB APPLICANTS

For a responsible, effective and efficient recruitment and selection process

What does this purpose entail?

For this purpose we process your contact details (such as name, address, email address and phone number), the personal data contained in your CV and your motivation letter. Optionally, we may process the following data: outcomes of any assessments you have completed (intelligence and personality), and in some cases information obtained when contacting the references you have provided. Finally, we process notes made in connection with any interviews and any salary proposals.

Your CV and motivation letter will be shared with the hiring manager and our HR staff. They will retain access until the moment the recruitment procedure ends for you. The recruitment procedure may end as a result of a rejection on the basis of your application or interview, or by the offer of an employment contract. In the latter case, the employment phase begins.

By default, this personal data is retained until two months after the closing date of the vacancy. This allows us to address any substantive questions you may have about the outcome of your application during that period. Where the application leads to an appointment, the personal data will be retained in accordance with our retention policy. The lawful basis is Green Sketch’s legitimate interest in an efficient performance of the recruitment and selection procedure (Article 6(1)(f) GDPR). Where we obtain information from references provided by you, we obtain that information indirectly and provide the required privacy information in accordance with Article 14 GDPR (and Article 14 UK GDPR where applicable).

Retention of your CV for suitable future vacancies

What does this purpose entail?

If you apply with us, it may be the case for various reasons that you are not appointed for the position you applied for. Where we still see a fit, we may, with your consent, include your data in our database so that we can contact you as soon as we have a suitable vacancy. Your personal data will then be retained until twelve months after the closing date of the original vacancy. The lawful basis is your consent (Article 6(1)(a) GDPR).

Which personal data do we process for this purpose?

Your CV, motivation letter and contact details.

Your rights

You have the right to be properly informed about what we do with your personal data and why we need your personal data. We do this by means of this Privacy Policy. In addition to the right to be transparently informed, you have the following rights:

• Right of access (if you want to know which personal data we collect about you);
• Right to rectification (we are happy to update any personal data that is no longer correct);
• Right to erasure (in some cases you can ask us to delete your personal data);
• Right to restriction of processing (in some cases you may ask us to restrict the processing of your personal data);
• Right to data portability (where you wish, we can transmit your personal data to another party or provide you with a copy of your personal data);
• Right to object (in some cases you may object to the use of your personal data, and you may always object to the use of your personal data for direct marketing purposes); and
• Right to withdraw consent at any time, where the processing is based on your consent, without affecting the lawfulness of processing prior to such withdrawal.

If you wish to exercise one of your rights, you can contact us by sending an email to privacy.eu@osw.energy. To prevent abuse, we may ask you to identify yourself adequately before we deal with your request. Circumstances may arise in which we cannot fully comply with your request. If such a circumstance occurs, we will notify you. We will respond to your request within one month, unless applicable law allows us to extend that period due to the complexity or number of requests.

With whom do we share personal data and where do we store it?

In a number of cases we share your personal data with third parties. For example, with processors that help us process your personal data. We will, however, never sell your personal data to other parties.

Processors that assist us in processing your personal data may only use your personal data on our instructions and to provide the relevant services to us. They may not use your personal data independently or pass it on.

We work with various applications to process certain data. To safeguard your privacy, we choose our suppliers carefully and these applications are bound by strict rules. Most data is stored within the European Union.

In addition, personal data may be shared with:

• Our affiliates and related companies, to the extent necessary for the purposes set out in this Privacy Policy;
• Tax authorities, our accountant, our tax advisor and our bank, where this is necessary for the financial administration or to comply with legal obligations;
• ICT service providers. In the maintenance, management and support of our systems and applications, they may have limited access to various personal data. We are always consulted in advance;
• Installers, where you are a homeowner whose lead is forwarded by us as set out in the homeowners section above;
• Bailiffs and administrators, to the extent necessary;
• Insurers, where relevant;
• (Legal) advisors. This may be in the context of a possible transaction or in the context of obtaining (legal) advice;
• Potential new shareholders and their advisors, in the context of a possible transaction; and
• A dispute resolution body and/or competent court, where necessary to defend our rights.

International transfers

For data that is processed outside the European Economic Area or the United Kingdom, we only work with parties that, in accordance with European or UK rules, provide an appropriate level of protection. Where we (or our external service providers) process your personal data outside the European Economic Area or the United Kingdom, we ensure adequate protection of your personal data, for example by using special contracts to safeguard the protection of your personal data, including the Standard Contractual Clauses approved by the European Commission and, where the UK GDPR applies, the International Data Transfer Addendum issued by the United Kingdom Information Commissioner’s Office or another applicable UK transfer mechanism, such as the UK IDTA, where used. In particular, a China-based support and development provider may receive access to certain personal data, limited to what is necessary for support and development purposes, under appropriate safeguards and a documented transfer risk assessment (also referred to as a data protection test under the UK Data (Use and Access) Act 2025). You can request more information about the safeguards in place by contacting us at privacy.eu@osw.energy.

How long do we retain your personal data?

We retain your personal data for as long as is necessary for the purpose for which we use your personal data and/or for as long as the law requires us to retain the personal data. The criteria we apply to determine the retention period are set out in the table below. Where you have an account with us, we retain your personal data for as long as your account remains active, unless you ask us to delete your personal data or your account by contacting privacy.eu@osw.energy. You can always view and/or change part of your personal data in your own account.

Specific retention periods are documented in our internal retention policy. They are derived by applying the criteria above to the relevant processing and may be longer where required by law (for example, statutory limitation periods, retention obligations under tax law or claims handling) or shorter where the data is no longer needed.

How do we protect your personal data?

Pursuant to Article 32 GDPR we are obliged to take appropriate technical and organisational measures to prevent loss of personal data or unlawful processing. The protection of your personal data is well organised by us through physical, administrative, organisational and technical measures.

Only employees who have been authorised by us have access to the personal data. They have also signed a confidentiality declaration. We thereby maintain an appropriate level of protection. We also adjust this level of protection periodically when necessary.

Our organisation is designed in such a way that we do everything we can to prevent breaches of security, a so-called personal data breach. In the event of a personal data breach, we will act in accordance with our personal data breach protocol.

Contact and complaints

If you have any questions about this Privacy Policy or wish to exercise your rights as a data subject, you can contact us at privacy.eu@osw.energy.

In case of complaints, for example about the way in which we use your personal data or how we respond to privacy-related questions, you can lodge a complaint with the data protection supervisory authority in the EU Member State or the United Kingdom in which you reside, in which you work or in which the alleged infringement of your rights took place. In the United Kingdom, the supervisory authority is the Information Commissioner’s Office.