Privacy policy

Last updated: 18 August 2026

Article 1 - Purpose of this Privacy Notice

This Notice explains when and why MyGrid bv ("MyGrid", "we", "our") processes your personal data, with whom we share it, how long we keep it, and what rights you have regarding the processing of your personal data.

MyGrid acts as a data controller when processing the personal data of customers, prospects, and website users:

MyGrid bv
Cantersteen 12
1000 Brussels
Belgium
VAT number: BE0789.838.534
https://www.mygrid.energy
e-mail: hello@mygrid.energy

We process your data in compliance with the General Data Protection Regulation (GDPR) and relevant national data protection laws.

When you use our website, this Privacy Notice and our terms of use apply. Other terms are excluded unless explicitly agreed in writing. Your use of our site, platform, and content implies acceptance of this Notice. If you do not agree, you should stop using the site and platform.

Article 2 - When Does This Notice Apply?

This Notice applies when:

You visit our website or social media pages (LinkedIn, Instagram, Facebook)
You communicate with us via email, phone, or mail
You sign up for our newsletter or promotional content
You represent a customer or supplier
You attend a webinar, fair, or event
You apply for a job with us
We deliver, repair, or maintain a home battery at your location
You use our digital platform or the MyGrid App to manage your home battery

Article 3 - Data We Collect, Purpose, Sharing, and Retention

Website visits

When you visit our website, we process your IP address, browser type and version, operating system, referring page, pages viewed, and the date and time of your visit. We do this to make the website function correctly, to protect it against misuse, and to understand how it is used.

Our website uses two categories of cookies. Strictly necessary cookies keep your session active and protect against cross-site request forgery; these cannot be disabled and do not require your consent. Analytics cookies help us understand how the website is used; these are placed only after you consent through our cookie banner. You can change or withdraw your cookie preferences at any time.

Legal basis: legitimate interest (security and correct functioning) and consent (analytics).
Retention: website log data is retained for 12 months. Cookie lifetimes are set out in our cookie banner.

Social Media

When you interact with our pages on LinkedIn, Instagram or Facebook, we may see your public profile information, your comments, messages and reactions. The platform itself also processes your data as a controller under its own privacy policy, over which we have no control.

Legal basis: legitimate interest (communicating with our audience).
Retention: for as long as the interaction remains relevant, and in any case no longer than 2 years after your last interaction.

Article 4 – Communication via Email, Phone, or Mail

We collect your email address, phone number, conversation content, metadata, and postal details depending on the communication method. These are necessary for responding to you.

Legal basis: legitimate interest, or the performance of a contract where you are a customer.

Sharing: with our IT and communication service providers.
Retention: 2 years.

Article 5 - Newsletters and Promotional Emails

We collect your name and email address to send you communications, based on your consent or on our legitimate interest where you are an existing customer. Every message contains an unsubscribe link.

Sharing: with our email service providers.
Retention: until you withdraw your consent or object.

Article 6 - Customer or Supplier Representation

We collect your contact and organisational details in order to conclude and perform contracts and to run our business operations.

Legal basis: performance of a contract and legitimate interest.
Sharing: with parties necessary to the relationship, such as IT providers, accountants and legal advisors.
Retention: up to 10 years.

Article 7 - Event and Webinar Participation

We collect your contact details and interaction records in order to manage your participation and to follow up afterwards. Where photographs or video recordings are made, we will ask for your consent where required.

Legal basis: legitimate interest, and consent for media.

Sharing: internally, and publicly where you have consented to the use of media.
Retention: for as long as the participation remains relevant, and no longer than 2 years thereafter.

Article 8 - Job Applications

We collect your CV data and other job-related information in order to manage the hiring process.

Legal basis: steps taken at your request prior to entering into a contract, and consent for talent pool inclusion.
Retention: unsuccessful applications are retained for 1 year; talent pool entries for up to 2 years, with your consent.

Article 9 - Home Battery Delivery and Repair

We collect your identity, contact details, installation location, and device-specific technical data in order to deliver, install, maintain and repair your home battery.

Legal basis: performance of the service agreement, and legal obligation where safety or product legislation applies.
Sharing: with our installers and service partners, and with logistics providers.
Retention: up to 10 years.

Article 10 - Use of Digital Platform

This article covers everything relating to your connected home battery: the data it generates, how that data is secured, where it is stored, and the strictly limited circumstances in which technical data is shared with our manufacturer.

10.1 What we process

Account data, such as your login credentials and account settings
Energy consumption and production data from your home battery, solar panels, or smart meter
Data from your energy provider, such as contracts, tariffs, or meter readings
Device metadata, such as serial number, hardware revision, firmware version, app version, mobile operating system, and usage logs

10.2 Purposes and legal basis

We process this data:

To give you access to the platform and the app, and to keep both secure
To display and manage your real-time energy usage
To optimise the charging and discharging of your battery
To enable energy transactions with third parties (e.g. grid services, VPP)
For app performance analytics and error tracking

Legal basis: contractual necessity (when using platform and app services); legitimate interest (platform maintenance, improvement and security); and consent where required, for example for provider linking or push notifications.

10.3 Security of your device and your data

MyGrid secures your data in hardware as well as in software.

Security at chip level. Every MyGrid home battery is fitted with its own cryptographic identity during manufacturing, at chip level, using Secure Boot firmware. The keys are generated inside the secure element of the chip and cannot be extracted from it. The device verifies the signature of every firmware image before it runs, so unsigned or tampered firmware will not execute. Firmware updates are signed by MyGrid and verified by the device before installation, and anti-rollback protection prevents a device from being downgraded to an older, vulnerable version.

Operational data held on the device is encrypted with keys bound to that device's secure element. Data written by one device cannot be read on another. In practical terms, physical access to a battery does not yield readable personal data.

Storage in the European Union. Data transmitted by your device and by the MyGrid App is stored in the MyGrid Cloud, hosted within the European Union.

Access controls. Access to personal data in the MyGrid Cloud is limited to authorised MyGrid personnel on a need-to-know basis, subject to role-based access control, multi-factor authentication, and audit logging.

10.4 Who we share this data with

With your chosen energy provider(s), where you have enabled that integration
With IT infrastructure providers, for example for platform and app hosting and analytics
Never sold, and never shared for marketing without your explicit consent

Where you enable an integration with an energy provider or participate in flexibility or VPP services, operational data relating to your installation is exchanged with that party in order to deliver the service. This exchange takes place only with parties you have chosen, and never with our hardware manufacturer.

10.5 Sharing anonymised device data with our manufacturer

Our home batteries are produced by a manufacturing partner located in China. To honour warranty claims and to investigate hardware defects, MyGrid shares a strictly limited set of anonymised technical device data with that partner.

What is shared:

Hardware revision and firmware version
Fault and error codes, and the technical conditions recorded at the moment of the fault
Component-level diagnostic readings such as cell temperature, voltage and cycle count
Failure rates and defect statistics across production batches

What is never shared. MyGrid does not share any personal data with the manufacturer. The manufacturer never receives:

Your name, email address, telephone number, postal address or billing details
Your account identifiers or login credentials
Your installation address, coordinates, or any other location data
Consumption or production patterns that can be attributed to an identifiable customer or household
Data from your energy provider, your contracts, tariffs or meter readings
Any live or real-time data. The manufacturer has no connection to your battery, no remote access to it, and no access to the MyGrid Cloud or the MyGrid App. Data is compiled by MyGrid and transferred as periodic, historical extracts only.

The link between a transferred record and the original device is retained solely within the MyGrid Cloud in the European Union and is never disclosed to the manufacturer.

Because this data does not identify any individual and cannot be re-identified by the recipient, it is not personal data within the meaning of the GDPR. Our manufacturing partner is nonetheless bound by a written agreement prohibiting any attempt at re-identification and restricting use of the data to warranty handling and defect analysis.

10.6 Retention

Account, platform and app data is retained for the duration of your contract with MyGrid and up to 10 years thereafter, unless legal obligations require otherwise. Anonymised warranty and reliability data is retained indefinitely, as it is no longer personal data.

10.bis - Data Processing via the MyGrid App

When you use the MyGrid mobile app, we process additional data to enable smart energy services and platform functionality.

This includes:

Energy consumption and generation data from your home battery, solar panels, or digital meter
Data from your energy provider, such as contract details, rates, or meter readings
Device metadata, such as app version, mobile operating system, and usage logs

Purposes:

Displaying and managing your real-time energy consumption
Optimizing the charging and discharging of your battery
Enabling energy exchanges with third parties (e.g., grid services, VPP)
App analysis and troubleshooting

Legal bases:

Necessary for the performance of the contract
Legitimate interest (maintenance and improvement of the platform)
Consent (when required, e.g., for linking with an energy provider or push notifications)

Data sharing:

With your chosen energy provider(s), when you activate the connection
With IT service providers (e.g., hosting and app analytics)
Never sold or shared for marketing purposes without your explicit consent

Retention period:
Data from the app is retained for the duration of your contract with MyGrid and for up to 10 years thereafter, unless legal obligations require a longer retention period.

Article 11 - General Purposes

In addition to the purposes described above, we process personal data for:

Analytics and statistics: for internal reporting
Legal compliance: for obligations and official requests
Mergers/acquisitions: for transactional purposes
Legal defense: for disputes or litigation

Article 12 - International Data Transfers

Personal data. Your personal data is processed and stored within the European Economic Area. We do not store personal data outside the EEA. Where a processor requires access from outside the EEA for support purposes, that access is governed by the European Commission's Standard Contractual Clauses, together with supplementary technical measures including encryption in transit and at rest and full access logging.

Anonymised data. As described in Article 10.5, anonymised technical device data is shared with our manufacturing partner in China for warranty and defect analysis. This data contains no personal data and cannot be traced back to you, and therefore falls outside the scope of the GDPR's transfer rules. No personal data and no live data is transferred to the manufacturer under any circumstances.

Article 13 - Your Rights

You have rights to:
Access your data
Rectify or erase inaccurate data
Restrict processing in specific cases
Object to processing
Data portability
Withdraw your consent at any time, where processing is based on consent. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

MyGrid does not carry out solely automated decision-making that produces legal or similarly significant effects for you.

Anonymised device data shared with our manufacturing partner can no longer be linked to you, and therefore cannot be accessed, corrected or erased at an individual level.

To exercise your rights, email: privacy@mygrid.energy. We may request identification for verification. We respond within one month, as required by Article 12(3) GDPR. If unsatisfied, you can contact the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit, Drukpersstraat 35, 1000 Brussels, www.gegevensbeschermingsautoriteit.be).

Article 14 - Data Breaches

If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Belgian Data Protection Authority within 72 hours of becoming aware of it, in accordance with Article 33 GDPR. Where the breach is likely to result in a high risk to you, we will inform you directly and without undue delay.

Article 15 - Applicable Law and Jurisdiction

Belgian law applies. Disputes are handled by the courts of Leuven.

Article 16 - Changes to This Notice

We may update this Notice and will inform you via our website. Updates will be made available in all supported languages once translated. Where consent is involved, we will request renewed consent before applying changes.