Privacy Policy

Version 2026-11 · effective 5 November 2026

1. Who processes the data

The data controller is [COMPANY NAME], company ID [ID], registered at [ADDRESS] ("BATRIX", "we"). Contact: batrix.info@gmail.com.

2. What data we collect

• Sign-up: first name, last name, email, mobile phone and password. The password is stored only as a one-way hash (Argon2id).
• Orders: delivery address, recipient and, optionally, invoice details.
• Technical data: IP address, browser and device type, sign-in times, account actions (security log).
• SmartBox device data: readings from the battery or inverter (voltages, currents, power, temperatures, state of charge, alarms) and connection times.

3. Purposes and legal basis

• Creating and maintaining your account, providing the service, fulfilling orders — performance of a contract (Art. 6(1)(b) GDPR).
• Accounting and invoicing — legal obligation (Art. 6(1)(c)).
• Account security, abuse prevention, new-device sign-in alerts — legitimate interest (Art. 6(1)(f)).

We do not sell data, use it for advertising or profile you.

4. Cookies

We use strictly necessary cookies only: one for your session after sign-in and one to recognise a device you have signed in from before. We have no analytics or advertising cookies, so we do not ask for consent to them.

5. Who we share data with

• Hetzner Online GmbH — server hosting (data centre in Finland, EU).
• Google — sending service emails (confirmation, new password, alerts) via Gmail.
• Stripe — card payments, once payments are introduced. Card data never passes through our servers.
• Courier company — name, phone and delivery address for an order.

When we check whether a new password has appeared in a public data breach ("Have I Been Pwned"), we send only the first 5 characters of its hash, never the password itself.

6. Google user data

BATRIX does not access data from users' Google accounts. The Gmail API is used only to send emails from our own address batrix.info@gmail.com, with send-only permission (no reading of mail).

7. How long we keep data

• Account and device data — for as long as the account exists.
• Security log (IP, sign-ins) — up to 12 months.
• Invoices and accounting records — as long as the law requires.

8. Your rights

You have the right of access, rectification, erasure, restriction, portability and objection. You can change your details in your account or write to us. You may lodge a complaint with the Bulgarian Commission for Personal Data Protection (www.cpdp.bg).

9. Security

Connections are encrypted only (TLS). Passwords are stored as hashes, access to data is role-based, and every staff action is logged.

10. Changes

We will notify you by email and at your next sign-in about significant changes.