WattWise AI – Data Processing Agreement (GDPR / UK GDPR Art. 28)

Version 5 November 2026. Part of the WattWise AI Service terms (section 7). Applies from the start of installer white-label (phase 2) or any other paid service where the Client is the controller and we process personal data on the Client's instructions.

Controller (Client): [CLIENT LEGAL NAME], [REGISTERED ADDRESS], contact [NAME, EMAIL].

Processor (we): Joao Jorge, CX Postal 556, 8550-152 Marmelete, Portugal, teamaijj@mail.grokbot.com.

1. Subject and duration. We process data only to provide WattWise AI reports for the Client's customers (white-label energy usage / solar summary reports from figures the Client or its customers supply). The agreement lasts for the contract plus the deletion period in clause 9.
2. Data. Electricity usage and cost figures, optional solar generated/exported kWh, site or customer labels the Client chooses to include, and contact details needed to deliver the report. Personal data may include names, emails, addresses or meter identifiers if the Client sends them. Data subjects: the Client's customers and, where named, site contacts. No special-category data (Art. 9), no patient or clinical data, no HR, salary or disciplinary files, no card or bank data, no passwords. The Client minimises and removes such content before sending. Prefer kWh and cost totals; blur names, addresses and CPE/MPAN where possible.
3. Instructions. We process only on the Client's documented written instructions (this agreement and emails), including on transfers. We tell the Client if an instruction seems unlawful, or if the law requires other processing (unless the law forbids telling).
4. Confidentiality. Anyone we allow to process the data is bound by confidentiality.
5. Security (Art. 32). Encryption in transit and at rest where available, MFA and least-privilege access, an access log, no copies on personal devices or in chat tools beyond what is needed to prepare the report, and no use of the data to train AI models.
6. Sub-processors. The Client authorises those in Annex A. We give notice by email at least 14 days before any addition or change; the Client may object and, if we cannot meet the objection, end the contract without penalty. We impose the same data protection duties on each sub-processor and remain responsible for them.
7. Data-subject rights. We help the Client, as far as possible, to answer requests (access, erasure etc.) and pass on any request we receive without delay.
8. Breaches. We notify the Client without undue delay and in any case within 24 hours of becoming aware of a personal data breach, with the facts known, so the Client can meet its Art. 33 duty. We also help with Art. 32–36 duties as needed.
9. Deletion. Within 30 days after the contract ends (or within 14 days after a free pilot ends) we delete the uploads, working files and all copies we hold for that Client, and confirm this by email. The Client can ask us to delete a customer's file earlier at any time.
10. Audit. On request we give the Client the information needed to show compliance with Art. 28 and allow reasonable audits, with reasonable notice.
11. Transfers. No transfer outside the EU/UK unless covered by an adequacy decision, EU SCCs, the UK IDTA or Addendum, or DPF certification.
12. Law. Portuguese law applies; courts of the Comarca de Lisboa. Mandatory UK GDPR duties still apply to UK clients. Mandatory consumer protections are not affected where a data subject is a consumer dealing with the Client.

Annex A – Sub-processors

Note: the public browser demo calculates on the user's device and does not send figures to these sub-processors. Annex A covers the hosted site and any paid / white-label processing path.