Privacy Policy

1. INTRODUCTION

Dear User,

This Privacy Policy applies to Haier Energy Management System, which includes mobile and web applications. This privacy policy describes the privacy practices of Haier Energy Technology Co., Ltd for the processings, services and activities connected to the use of Haier Energy Management System. Haier Energy Technology Co., Ltd., (from now on, for the sake of brevity, "Haier Energy" or the "Controller") with registered office at No.57, No.17, Jiujiang Road, Tongji Street Office, Jimo District, Qingdao City, Shandong Province, is a company part of the Haier Group. As the Controller is established outside the European Union, we have appointed ReD OPEN S.r.l. as our Representative in the EU pursuant to Article 27 of the GDPR.

Haier Energy handles services and activities connected to the use of Haier Energy products and manages its connected experience via its app and web app (the platform). Haier Energy believes that the protection of personal data is a fundamental value for its business activities, and we strive to provide you with all the information that can help you protect your privacy and control the use made of your data in relation to the various services we offer you and the interactions you may have with us. In this Privacy Policy, you will find information regarding how your personal data are managed. We explain which personal data we collect and why, how we use them, if we share them with other companies, how you can exercise control over your data and the measures we enact to protect your privacy.

This policy applies to the personal data we collect when you make use of the services connected to Haier Energy products, such as Haier Inverters, Balcony kits, E-Tower HV etc. On top of that, this privacy policy covers request of assistance from our technician or interaction directly with us or with our partners which act as data processors (through the app, website or over the phone), henceforth referred to jointly as the "Services". This Notice provides information about the processing and management of your personal data.

2. ABOUT US

Haier Energy will process your personal data in compliance with Regulation (EU) 2016/679 ("GDPR" or the "Regulation") and any other applicable local regulations in force on the protection of personal data. Our contact information is provided below.

Data Controller

The Data Controller, i.e., the party taking decisions on processing methods and purposes, is Haier Energy Technology Co., Ltd., with registered office at No.57, No.17, Jiujiang Road, Tongji Street Office, Jimo District, Qingdao City, Shandong Province (China).

EU Representative

If you are an individual based in the EU, and you wish to exercise your rights under the EU General Data Protection Regulation (GDPR) or have any queries in relation to your rights or general privacy matters, please email us at gdpr-representative@redopen.it. In compliance with Article 27 of the GDPR, we have appointed ReD OPEN S.r.l. to act as our EU representative. Please ensure to include our company name (Haier Energy) in any correspondence you send to our Representative.

Data protection officer

The Data Protection Officer ("DPO") is responsible for monitoring compliance with the GDPR in relation to the processing of personal data performed by Haier Energy.

DPO email: dongxw@haier.com

General Contacts

For all other questions or for non-EU residents, the address is: nahuiprivacypolicy@haier.com.

Inquiries can also be submitted via post at the following address:

3. WHICH DATA WE PROCESS

When you use our products and services, we process some of your personal data. Information about this is provided below.

Information We Collect

When you use our Services, we may process the following personal data (i.e., data relating to identified or identifiable people):

• a) Common personal and contact information - such as Username, Email address, Family name, Family members, avatar (User's photos), Language preference, Time Zone, Location data (Country/Region, Detailed Address - Plant and Home Address) for registering and managing our products.
• b) Data relating to the products purchased - such as Device Serial Number (SN), Product Name, Type, and Model, Dongle SN, Software Versions, Registration Date, Installation Data (associated with the creation of the plant), Proof of purchase and Invoice data for basic products management and after-sales services triggered by users' request.
• c) Navigation data when you browse the website - such as your IP address, URI notation addresses, the time of your request, the method used in submitting the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response provided by the server (successful, error, etc.) and other parameters relating to the operating system and your IT environment (e.g., mobile device model, wireless connection information, operating system type and version, language, application version number, log files, mobile network information, software version number).
• d) Data acquired through the use of the apps and use of the connected appliance - such as Monitoring Data (Production, Consumption, Energy flows, Battery SOC), Device Operating Status (es. Normal, Fault, Offline), Alarm codes / Fault alerts, Wi-Fi network connection status (while connecting the device), Camera and Gallery access data (used for scanning QR codes during device onboarding or for uploading pictures when required for installation, troubleshooting or after-sales support), Bluetooth access data (strictly necessary to enable device pairing and near-end debugging during the initial setup of your connected appliance). Data is collected depending on the case: when downloading the app, activating the account, enrolling the products and connecting the app.

When you use the application as installer, we may process the following personal data:

• Common personal and contact information - such as company's name, address, postal code, contact name, contact information, installer's email address, installer's name/nickname for managing the installers.

Haier Energy adopts reasonable technical and organizational measures to minimize the amount of information that may directly or indirectly identify you. No push notifications or personalised optional services are provided to you. System alerts and device alarms are only displayed within the app interface and are not delivered as push notifications.

Information We Do Not Collect

• a) We do not collect microphone data or perform audio/video communications.
• b) We do not rely on continuous or automatic geolocation tracking. Where location-related information is used, it consists of address data (such as the plant address and, where applicable, the home address) that are manually entered by users or installers. Plant address information is necessary to configure the plant and provide connected energy services and, when the relevant features are activated, may also be used solely to enhance the user experience and enable optional app functionalities that rely on the geographic location of the system (for example, weather-based optimisation). Haier Energy does not use such data to track users' movements or for purposes unrelated to service provision or improvement.
• c) We do not process special categories of personal data, as defined under Article 9 of the GDPR.

Information From Other Sources

We may receive the information described in this Privacy Policy from other sources, such as:

• a) If you decide to use Apple or Google login systems in conjunction with Haier Energy products and/or use them to log into the Apps, we invite you to carefully consult, before using them, the privacy policies, and terms of service of each of those services.
• b) In addition, for certain products and functionalities, it may be necessary to download and use third-party applications, to access detailed information on the operation and performance of the batteries. In such cases, Haier Energy Technology Co., Ltd. and the third-party provider act as independent data controllers under the GDPR, each responsible for its own data processing activities. Consequently, users are advised to refer to the respective privacy policies of Haier Energy and of the third-party provider for complete information on how their personal data is processed in connection with these services.

4. WHY WE PROCESS YOUR DATA

Your personal data may be processed for the following purposes.

• a) to allow you to use the apps and web app, register the connected appliance and make use of the services and functions offered by its use, for assistance and maintenance purposes, to manage your profile, and thus provide the services you have requested.
• b) to respond to your request for assistance about the functioning, use and maintenance of an appliance or to respond to your questions about our products and services. If we ask you to fill out a form to send us your request, remember that the data entered in the fields marked by an asterisk are required as we would not be able to accept the request or respond to it without this information.
• c) to allow you to take advantage of any additional warranties (ours or those of third parties), receive updates on your appliance and service notices, to enable you to access information regarding registered products and obtain assistance in a more streamlined manner. If to that end we ask you to fill out a form, remember that the personal data entered in the fields marked by an asterisk are required as we would not be able to provide you the service without this information.
  (Hereinafter referred to as the "Contractual Purpose")
• d) to meet the obligations arising from current laws, regulations or EU law (e.g., tax and accounting obligations) (defined as "Legal obligation purposes").
• e) to enforce and defend the rights of Haier Energy also as part of debt collection procedures and the assignment of receivables to authorised companies, including through third parties, and to prevent and combat any fraud.
• f) for research and development activities aimed at analysing and improving the Services and/or products offered, also proceeding with the anonymisation and/or aggregation of your personal data.
• g) in the case of any corporate transactions, to perform activities functional to such transactions (including disposals, leases, transfers, mergers or corporate demergers).
• h) to transmit the personal data within the business group of which the Controller is part for administrative and accounting purposes.
  (Hereinafter referred to as the "Purposes of Legitimate Business Interest")
• i) to analyse, with the user prior consent (to be provided according to the methods pursuant to the cookie policy), the online activities on the website, by means of user tracking tools as described in the cookie policy and to improve the browsing experience.

No direct marketing nor profiling activities are carried out on these data.

5. ON WHAT BASIS WE PROCESS YOUR DATA

The processing of your personal data is necessary with reference to the Contractual Purposes given its essential nature in order to:

• perform the contract, with regard to the provision of the products and services requested in relation to the cases set forth in Section 4, letters a), b), c).
• adjust to provisions of applicable regulations, as set forth in Section 4, letter d).

If you do not provide the personal data required for the Contractual Purposes, it will not be possible to make use of the services (including assistance and other functions described above).

The processing of your personal data for Legitimate Business Interest Purposes is carried out pursuant to article 6, letter f) of the European General Data Protection Regulation 2016/679 (the "Privacy Regulation") to pursue the interest of Haier Energy which is equally balanced with your interest, as the personal data processing activity is limited to what is strictly necessary for the execution of the economic transactions described. Processing for Legitimate Business Interest is not required, and you may object to that processing with the methods set forth in this disclosure. However, if you object to that processing, your data may not be used for the Legitimate Business Interest Purposes, unless Haier Energy can demonstrate the presence of prevailing compelling legitimate grounds or for the exercise or defense of legal claims.

Finally, the processing regarding section 4, letter i) is based on your consent. You may revoke any consent provided with the methods set forth in this disclosure at any time.

6. HOW WE PROCESS YOUR DATA

We will process your data primarily using registration, extraction, analysis and archiving tools protected with systems that offer security guarantees in line with sector standards.

In particular, we will process your data using primarily IT systems and analysis tools through authorised personnel acting on a strict need-to-know basis and appropriately trained by Haier Energy and its data processors. We adopt measures aimed at guaranteeing the application of the principles of accuracy, lawfulness and transparency set forth in applicable regulations on the protection of personal data (including the General Data Protection Regulation i.e., GDPR), protecting your privacy through technical and organisational security measures that guarantee an adequate level of security to prevent the loss or unlawful or improper use of as well as unauthorised access to your data.

7. HOW LONG WE STORE YOUR DATA

We keep your personal data only for as long as it is strictly necessary to achieve the purposes for which it was collected, in line with the principles of purpose limitation and data minimization under the GDPR (Articles 5(1)(b)-(e)). The specific retention periods may vary depending on the type of data and the legal basis for processing, as explained below.

• Contractual and legal obligations (sect. 4, points a, b, c, d above): We store your personal data that are processed for the performance of a contract and to comply with accounting or legal obligations for the duration of your contractual relationship with us and up to ten (10) years afterwards. This period is necessary to comply with statutory obligations or to establish, exercise, or defend legal claims. If required by law, or in the event of legal proceedings or requests from competent authorities, your data may be stored for a longer period.
• User account and service management data (sect. 4, points a, b, c, h): We keep the data linked to your user account and service preferences for as long as your account remains active, and in any case no longer than two (2) years after your last interaction or account deactivation, unless a longer period is required by law.
• Diagnostic, security, and log data (sect. 4, points a, e, f): Technical and diagnostic logs, security records, and performance data are kept for a limited and proportionate period to ensure system integrity, service security, and troubleshooting. Specifically, System Access Logs are retained for 180 days and system backups are overwritten every 7 days. Other general diagnostic data may be retained for up to 24 months depending on the specific lifecycle of the device component.
• Data processed for legitimate business interests: we process some of your personal data for legitimate business purposes (as described in sect. 4, points e, f, g, h of this Privacy Policy). Your data will be kept only for as long as it is necessary to pursue these interests, based on a documented balancing of your legitimate interests. Retention periods are limited as follows:
  • Enforcement and defence of rights, debt collection, and fraud prevention: up to five (5) years after the end of the relevant relationship or event, to allow us to establish, exercise, or defend legal claims and comply with applicable limitation periods.
  • Research and development activities: up to three (3) years, after which your data will be anonymised or aggregated so that you can no longer be identified.
  • Corporate transactions (such as disposals, leases, transfers, mergers, or demergers): for the duration of the transaction and up to five (5) years afterwards, limited to documents required to complete or audit the transaction.
  • Intra-group administrative and accounting purposes: up to five (5) years, only for as long as necessary to meet internal administrative, tax, and audit obligations.
• Data processed on the basis of your consent: When you give your explicit consent for specific activities, we keep your data only until the relevant purpose has been achieved and never for longer than necessary. Your consent is periodically reviewed to make sure it is still appropriate for the purpose for which it was given. You can withdraw your consent at any time, without affecting the lawfulness of any processing carried out before your withdrawal.

We periodically review these periods to make sure the retention of your data remains proportionate and necessary. When the applicable retention period expires, your personal data will be securely deleted or irreversibly anonymized. If your data is processed on third-party platforms, the deletion or anonymization will be verified and documented by Haier Energy.

8. WHO WE SHARE YOUR DATA WITH

Communication and dissemination of data

For Contractual Purposes, your data may be communicated to personnel authorised by Haier Energy who have been appropriately informed and trained, or the personnel of third parties who operate on behalf of and based on instructions from Haier Energy as Data Processors, including companies that provide technical and pre/post-sale assistance. The third parties that provide services are included in the following categories: (i) the original equipment manufacturer; ii) providers of assistance and consulting services for the Company, with reference to activities in the (including but not limited to) technological, accounting, administrative, legal and insurance sectors; (iii) providers of IT and maintenance services; (iv) providers that help us with appliance assistance and repair services; (v) providers that provide our e-shop hosting services; (vi) companies of the Haier Group; (vii) parties and authorities whose right to access the data is expressly recognised by law, regulations or measures issued by the competent authorities.

Please note that, if necessary, IT assistance and maintenance may be performed in establishments based outside the EEA, in this case safeguards are in place to guarantee the best possible protection.

For the Legitimate Business Interest Purposes, the data may be communicated to the following categories of recipients: (i) third-party providers of assistance and consulting services for Haier Energy with reference to activities in the (for example but not limited to) technological, accounting, administrative, legal and insurance sectors; (ii) companies of the Haier Group; (iii) potential purchasers of Haier Energy and entities resulting from the merger or any other form of transformation regarding Haier Energy; (iv) the competent authorities.

Furthermore, to activate and take advantage of you warranty your data may be communicated to the following categories of recipients: (i) third parties responsible for the processing of personal data; (ii) companies of the Haier Group.

To obtain more information on the data processors working on behalf of Haier Energy you may write to the office of Haier Energy for the attention of the Data Controller.

If you use a Google or Apple login or digital assistants and digital platforms in conjunction with Haier Energy products, your personal data may be shared with the providers of such services. In such cases, these providers will act as autonomous data controllers and will operate in accordance with the provisions set out in their privacy policies and terms of service, which we invite you to consult.

Lastly, Haier Energy as part of the Haier Group may transmit your data within its business group for administrative and accounting purposes. The legal basis legitimising the processing of data for this purpose is that described in art. 6, par. 1, letter f) of Regulation (EU) no. 679/2016, or as the processing is necessary to pursue a legitimate interest of the data controller in the circulation of data for administrative purposes within its business group.

International transfers

Haier Energy Technology Co., Ltd. is the controller of your personal data and is established in China, with its registered office at No. 57, No. 17 Jiujiang Road, Tongji Street Office, Jimo District, Qingdao City, Shandong Province.

Although our company is based outside the European Economic Area (EEA), the processing of your personal data is subject to the EU General Data Protection Regulation (GDPR), as we offer services to users located in the EEA.

Your personal data is primarily processed and stored on servers located within the EEA to ensure a high level of protection. In some cases, however, your data may be accessed or processed by service providers acting on our behalf or by other Haier Group companies located in countries outside the EEA, for example to provide technical maintenance, customer support, or IT infrastructure services from China. Whenever we engage such third-party providers or share data within the Haier Group, we make sure that they are bound by contractual agreements that guarantee a level of data protection consistent with EU standards. These agreements include, where appropriate, the European Commission's Standard Contractual Clauses (SCCs) and additional technical and organizational safeguards such as encryption, pseudonymization, and restricted access controls. We also perform risk assessments and periodic audits to verify that these processors and partners continue to comply with our data protection requirements.

Haier Energy has also appointed a representative in the European Union, in accordance with Article 27 GDPR, whom you can contact for any matter relating to the processing of your personal data.

9. THE RIGHTS YOU ARE AFFORDED BY LAW AND HOW YOU MAY EXERCISE THEM

Under the EU General Data Protection Regulation (GDPR), you have several rights regarding the way your personal data is processed. You can exercise these rights at any time and free of charge by contacting us or our EU representative using the details provided below. Haier Energy will take all reasonable steps to facilitate the exercise of your rights and respond to your request without undue delay. Information about this is provided below.

Your rights as Data Subject

You have the right to:

• Access your data: to receive confirmation as to whether we process your personal data, obtain a copy of it, and receive information on how they are used (Art. 15 GDPR).
• Rectify your data: to correct or update any inaccurate or incomplete personal data (Art. 16 GDPR).
• Erase your data: to request deletion of your personal data in the cases provided for by law, for example when the data are no longer necessary for the purposes for which they were collected, or if you withdraw your consent (Art. 17 GDPR).
• Restrict processing: to request that processing be limited in certain circumstances (Art. 18 GDPR).
• Withdraw your consent: when we process your data based on consent, you can withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal. You can manage or withdraw consent directly from your mobile.
• Data portability: to receive your personal data in a structured, commonly used, and machine-readable format and transmit them to another controller, where technically feasible (Art. 20 GDPR).
• Object to processing: to object at any time to processing carried out for legitimate interests, or for direct marketing purposes (Art. 21 GDPR).

You may expressly prohibit the exercise of certain rights listed above by those entitled by sending a written statement to the Company at the email address provided below. The statement may be revoked or modified later on using the same procedures.

In general, please note that some of these rights may be subject to legal or regulatory obligations that require us to retain certain data for a defined period (for example, for tax or contractual purposes).

If you are an individual based in the EU, and you wish to exercise your rights under the EU General Data Protection Regulation (GDPR), please email us at gdpr-representative@redopen.it. We have appointed ReD OPEN S.r.l. to act as our EU representative. Please ensure to include our company name (Haier Energy) in any correspondence you send to our Representative. For all other questions or for non-EU residents, the address is: nahuiprivacypolicy@haier.com. We will respond to your request regarding your personal data rights within one month. For complex or numerous requests, it may take us up to a maximum of three months to provide a full response. If an extension is needed, we will notify you of the reasons within the first month.

In contacting us, please make sure to include your name, email address, postal address and/or telephone number(s) to be sure that we can properly manage your request.

If you believe that your data has not been processed in compliance with the regulation or there are objections with regard to their use, you may submit a complaint to the Supervisory Authority of the Member State in which you reside or work or the place where the alleged violation took place.

Additional information - Links - Minors

For the individual services offered by Haier Energy we invite you to consult the individual privacy policies for all of the details relating to the processing of your data.

Please note that when you access the Website section devoted to product registration and the acquisition after-sales activities on your appliance and you complete the form, your personal data may be processed by partner organizations operating in the field of maintenance and customer care. For more information on the processing activities carried out by our partner organizations, we invite you to view their specific privacy policy.

The app and the products are not intended for minors. If you are a minor, you cannot register as a user on the app or otherwise provide us with your personal data. If we realize that we have inadvertently obtained the personal data of a minor, we will immediately erase them.