Privacy Policy

Last updated: 18 June 2026 · Applies to voltnir.io and portal.voltnir.io

This policy explains what personal data we process when you visit our website or use the Voltnir customer portal, why we process it, who we share it with, how long we keep it, and how you can exercise your rights. We keep it deliberately plain. Voltnir is a business-to-business product, and we collect only what we need to provide it.

1 · Who we are

The data controller responsible for your personal data is:

• Voltnir B.V.
• Registered office: [ registered office address ]
• Chamber of Commerce (KvK): [ KvK number ]
• Contact for privacy matters: contact@voltnir.io

Voltnir B.V. is established in the Netherlands. We have not appointed a statutory Data Protection Officer, as we are not required to; privacy questions are handled by the contact above.

2 · What we collect & why

We collect personal data that you provide directly (when you register, manage your account, license the software, or contact support) and a limited amount that is generated automatically when you use the portal (such as security logs). We do not buy personal data, build advertising profiles, or track you across other websites.

Category	What it includes	Why we process it
Account & identity	Email address, password (stored only as a salted hash, so we never see it), company name, contact name, job role, and country.	To create and secure your account, authenticate you, and provide the portal.
Billing & company	VAT number, company registration number, and billing address; invoice records (amount, currency, status).	To issue licences and invoices and to meet our accounting and tax obligations.
Licensing	Licence keys, the legal entity a licence is issued to, licence type and environment, and the EPEX SPOT market identifiers (account/user IDs) tied to your entitlements.	To issue, sign, and manage the software licences you hold.
Security & audit logs	A record of security- and account-relevant events (sign-in, password and email changes, licence reveals and downloads, etc.), each stored with your IP address and a timestamp.	To keep the service secure, detect and investigate abuse, and maintain an auditable record. We deliberately redact passwords, tokens, and keys from these logs.
Support	The subject and body of support tickets and any files you attach, plus our replies.	To answer your questions and provide support. Please don't include sensitive personal data in a ticket; it isn't needed.
Technical	The strictly-necessary cookies described in section 4, and standard server logs.	To keep you signed in, protect forms against cross-site request forgery, and operate the site securely.

3 · Legal bases

Under the GDPR we rely on the following legal bases (Article 6):

• Performance of a contract: to provide your account, the portal, and the licences you take out (account, licensing, billing, and support data).
• Legal obligation: to retain invoices and accounting records for the period required by Dutch and EU law.
• Legitimate interests: to keep the service and our customers secure and to prevent abuse (security and audit logs). We have weighed these interests against your rights and use the minimum data necessary.
• Consent: where we ever ask for it explicitly. We do not currently use any cookies or tracking that require consent (see section 4).

We do not carry out automated decision-making or profiling that produces legal or similarly significant effects (Article 22).

4 · Cookies

We use only strictly-necessary cookies: the kind that, under the ePrivacy rules, do not require a consent banner because the service cannot function without them. We do not use advertising or tracking cookies. For website statistics we use a privacy-friendly, cookieless analytics tool (see section 5) that sets no cookies and collects no personal data, so it too needs no consent banner. We host our own fonts; apart from that analytics tool, loading a page sends your data to no third party.

Cookie	Purpose	Lifetime
VOLTNIR_SESSION	Keeps you signed in during a visit and protects forms.	Until you close your browser.
REMEMBERME	Set only if you tick “remember me” at sign-in, so you stay signed in between visits.	30 days.
CSRF token	Protects forms against cross-site request forgery.	Per session / request.

5 · Who we share your data with

We do not sell your personal data and we do not share it for anyone else's marketing. We share it only with the service providers that help us run Voltnir, each acting as our processor under a data-processing agreement, and only as far as needed:

• Hosting: our servers are operated by [ hosting provider, EU location ], who host the application and database on our behalf.
• Email delivery: transactional emails (verification, password reset, email-change confirmations, and support notifications) are sent through [ email / SMTP provider ]. These emails go only to your own address (or, for an email change, to the old and new addresses).
• Website analytics: we use Simple Analytics (Simple Analytics B.V., Amsterdam, the Netherlands) to measure aggregate traffic to our public website. It is cookieless, collects no personal data and no cross-site identifiers, does not track you across other sites, and stores its data in the EU. It runs only on our marketing site, not inside the portal.
• Internal operations: when an account is created or a licence is issued or extended, a short internal notification (your email, company, and country) may be sent to our own team tooling at [ internal team tool, e.g. Slack ] so we can support you. This is disabled if not configured.

We may also disclose data where we are legally required to (for example, in response to a valid request from a competent authority), or to establish, exercise, or defend legal claims.

6 · International transfers

We host and process your data within the European Union / European Economic Area. Where a processor we use is located outside the EEA (for example [ name any non-EEA processor, e.g. email provider ]), that transfer is protected by an adequacy decision or by the European Commission's Standard Contractual Clauses. If none of our processors are outside the EEA, this section does not apply.

7 · How long we keep your data

We keep personal data only for as long as we need it for the purposes above:

• Account, licensing & support data: for as long as your account is active, and then deleted or anonymised within [ retention period, e.g. 90 days ] of account closure, unless we must keep it longer by law.
• Invoices & accounting records: retained for 7 years, as Dutch tax law requires.
• Security & audit logs: retained for [ retention period, e.g. 12–24 months ], after which they are deleted, except where an ongoing security or legal matter requires us to keep them.

8 · Your rights

Under the GDPR you have the right to:

• Access: get a copy of the personal data we hold about you.
• Rectification: correct data that is inaccurate or incomplete (much of it you can edit yourself in the portal).
• Erasure: ask us to delete your data, where we have no overriding obligation to keep it.
• Restriction: ask us to limit how we use your data.
• Portability: receive the data you gave us in a structured, machine-readable format.
• Objection: object to processing we carry out on the basis of legitimate interests.
• Withdraw consent: where we rely on consent, withdraw it at any time, without affecting earlier processing.

To exercise any of these, email contact@voltnir.io. We will respond within one month. You also have the right to lodge a complaint with the Dutch data protection authority, the Autoriteit Persoonsgegevens, or with the supervisory authority in your country of residence.

9 · How we protect your data

Security is built into the product. Among other measures: passwords are stored only as strong salted hashes; all traffic is served over HTTPS with HSTS; the site enforces a strict Content-Security-Policy that permits only our own resources and our cookieless analytics provider; access to the portal is gated and role-based; and security-relevant events are audit-logged with secrets redacted. No system is perfectly secure, but we work to protect your data in line with the GDPR's “appropriate technical and organisational measures”.

10 · Children

Voltnir is a professional product for businesses and is not directed at children. We do not knowingly collect personal data from anyone under 16.

11 · Changes to this policy

We may update this policy from time to time. When we make a material change we will update the “last updated” date above and, where appropriate, notify you. The current version is always available at this page.

12 · Contact

Questions about this policy or your personal data? Email contact@voltnir.io or write to Voltnir B.V. at the address in section 1.