Privacy policy

1. Who we are

Suncast provides solar design, system modelling and proposal software to solar installation businesses.

Suncast is currently operated as an unregistered business in South Africa under the trading name Suncast.

Legal operator: Nicolas Pasco-Marx
Business/service address: Kragga Kamma Rd, Lorraine, Gqeberha, 6070, South Africa
Privacy contact: suncastsupport@gmail.com

For purposes of the Protection of Personal Information Act, 2013 ("POPIA"), Suncast is the responsible party where we determine why and how personal information is processed.

When a solar installer enters information about its own customers into Suncast, the installer will generally be the responsible party for that customer information and Suncast will process the information as an operator on the installer's behalf.

2. Information we collect

We collect personal information that is reasonably necessary to operate Suncast.

Account information

When you create or use a Suncast account, we may collect:

• your full name;
• work email address;
• mobile number;
• login and authentication information;
• profile photograph;
• company name and province;
• your role within a company;
• your marketing preferences; and
• information relating to invitations to, and membership of, a Suncast company account.

Password authentication is handled by our authentication provider. Suncast does not store passwords in readable form.

Company information

Companies may provide information used for account management and proposal branding, including:

• company name;
• registration and VAT numbers;
• business address;
• contact details;
• website;
• company logo; and
• branding preferences.

Pilot applications

When you apply to participate in the Suncast pilot, we may collect your:

• full name;
• company;
• email address;
• phone number;
• website;
• province;
• approximate number of installations per month;
• plan of interest;
• application message; and
• consent preferences.

Customer and solar project information

Solar installers may enter information about their customers and projects into Suncast. This may include:

• customer name;
• email address and phone number;
• residential or project address;
• city and province;
• site coordinates;
• monthly electricity bill amount;
• average electricity consumption;
• customer and project notes;
• solar roof designs;
• equipment selections;
• system sizes and production estimates;
• equipment costs and proposal prices; and
• other information required to prepare a solar proposal.

A customer's name is generally required to create a customer record. Other customer information may be optional depending on the feature being used.

Suncast may introduce features allowing installers to upload additional project materials, such as electricity bills, site photographs, financing documentation or other documents. Where such features are introduced, this policy will apply to information uploaded through them and will be updated where necessary.

Users must not upload ID numbers, banking information, health information, information about children, special personal information or other sensitive information unless it is genuinely necessary and lawful to do so.

Shared proposals

Where an installer shares a Suncast proposal with a customer, we may process information relating to that proposal, including:

• whether and when the proposal was opened;
• the number of times it was opened;
• whether the customer accepted or declined it;
• the customer's typed name; and
• any note submitted with the customer's response.

Customers do not need to create a Suncast account to view a proposal shared with them.

Technical and security information

Our service providers may automatically process technical information when you use Suncast, including:

• IP addresses;
• browser and device information;
• login sessions;
• authentication events;
• password-change events;
• security and system logs; and
• information required to operate and secure the service.

We do not currently use this information for advertising profiling.

Communications

If you contact Suncast by email, telephone or WhatsApp, we process the information you provide so that we can respond to you and maintain appropriate business records.

3. Why we process personal information

We use personal information where reasonably necessary to:

• create and manage Suncast accounts;
• manage companies and team members;
• review and administer pilot applications;
• provide solar design and proposal functionality;
• generate solar production, savings and payback calculations;
• create and share customer proposals;
• allow customers to accept or decline proposals;
• provide customer support;
• communicate with users;
• protect Suncast against unauthorised access, abuse and security threats;
• troubleshoot and improve the service;
• manage subscriptions and payments when paid plans are introduced;
• comply with legal, regulatory, accounting and tax obligations;
• enforce our agreements and protect our legal rights; and
• send marketing communications where permitted by law.

Depending on the circumstances, processing may be based on consent, performance of an agreement, compliance with law, the legitimate interests of Suncast or another person, or another lawful ground permitted by POPIA.

4. Information provided by solar installers

Solar installers control the customer information they enter into Suncast.

Installers are responsible for ensuring that they:

• have a lawful basis for collecting and using their customers' personal information;
• provide any privacy notices required by law;
• only enter information that is reasonably necessary;
• keep the information accurate where reasonably possible; and
• comply with POPIA and other applicable law.

Suncast does not currently use installer customer or project data to train artificial-intelligence models.

We also do not sell installer customer data.

5. Solar and mapping services

Certain Suncast design features depend on third-party mapping and solar-data services.

OpenStreetMap / Nominatim: An address entered into the design search function is sent to Nominatim to locate the site. These requests are currently made through Suncast's server. Customer names and contact details are not intentionally sent with the request.

PVGIS: Site coordinates and technical system information such as roof angle, direction and system losses may be sent to the European Commission's PVGIS service to obtain solar-production information. Suncast may store the resulting production data with the project.

Esri: Satellite imagery is loaded from Esri in the user's browser. This means Esri may receive technical information such as the user's IP address, browser information and the geographical area being viewed.

6. Service providers

We use third parties to help operate Suncast. These may include providers of:

• database hosting and authentication;
• cloud storage;
• website hosting;
• transactional email;
• mapping and geographical information;
• solar-resource information;
• customer communications;
• payment processing;
• professional services; and
• authorised development and technical support.

Current material providers include Supabase, Netlify, OpenStreetMap/Nominatim, PVGIS, Esri, Google/Gmail and, when a user chooses to contact us through it, WhatsApp/Meta.

Supabase currently hosts Suncast's database, authentication and file storage in its London, United Kingdom region.

We may also disclose information where reasonably necessary to employees, contractors, accountants, auditors, lawyers, professional advisers, regulators, law-enforcement authorities or parties involved in a legitimate sale, investment, merger or restructuring of Suncast.

Service providers may only receive information reasonably necessary for the function they perform.

7. International transfers

Some of Suncast's service providers operate or process information outside South Africa, including in the United Kingdom, European Union and United States.

Where personal information is transferred outside South Africa, we take reasonable steps to ensure that the transfer is permitted under POPIA, including where the recipient is subject to appropriate data-protection laws, contractual protections or other safeguards recognised by applicable law.

8. Payments

Suncast is currently available to approved pilot users without charge.

When paid subscriptions are introduced, payment information may be processed by a third-party payment provider.

Suncast does not intend to store full payment-card numbers or card security codes. Payment providers will process payment information according to their own privacy and security obligations.

9. Marketing

Suncast may send product updates, promotional emails or WhatsApp marketing where you have consented or where another lawful basis permits the communication.

Where we ask for marketing consent, it will be separate from communications that are necessary to provide the service.

You may withdraw your consent or opt out of marketing communications at any time using the unsubscribe or opt-out method provided in the communication, in your account settings, or by contacting us.

We currently do not plan to use SMS for marketing.

Opting out of marketing will not stop necessary account, security, billing or service communications.

10. Cookies and local storage

Suncast currently uses essential browser storage required to provide the service, including:

• authentication/session information;
• functionality relating to whether you remain signed in; and
• local browser storage used to remember interface preferences such as light or dark mode.

Suncast does not currently use advertising or behavioural-marketing cookies and does not currently use third-party website analytics cookies.

If this changes, we will update our notices and obtain consent where required.

11. How long we keep information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, or where longer retention is authorised or required by law.

In general:

• account, company, customer and project information is retained while the relevant Suncast account exists;
• deleted projects are removed from the active database together with their associated project information, although separate customer records may remain until deleted;
• unsuccessful or abandoned pilot applications may generally be retained for up to 12 months after the application is concluded;
• support and business correspondence may generally be retained for up to 3 years after the matter is resolved, where reasonably necessary;
• marketing contact information may be retained until consent is withdrawn or the information is no longer required;
• security and technical records may be retained for as long as reasonably necessary for security, fraud prevention and service operation; and
• accounting, payment, tax, contractual and legal records may be retained for any period required or permitted by law.

When information is no longer required or authorised to be retained, we will delete, destroy or de-identify it as soon as reasonably practicable.

12. Security

We take reasonable technical and organisational measures intended to protect personal information against loss, unauthorised access, interference, alteration, disclosure or destruction.

Current measures include:

• HTTPS encryption for data transmitted to Suncast;
• authentication and access controls;
• database Row Level Security designed to prevent companies from accessing one another's information;
• provider-managed encryption at rest where available;
• restricted administrative access; and
• security and authentication logging.

No internet-based system can be guaranteed to be completely secure.

If we become aware of a security compromise involving personal information, we will investigate it and make notifications to affected persons and the Information Regulator where required by POPIA.

13. Profile photographs and company logos

Users may optionally upload profile photographs and company logos.

These files may be delivered through storage URLs so that they can be displayed within Suncast and on relevant proposals or company interfaces. Users should therefore not upload images they consider confidential.

14. Your rights

Subject to POPIA and other applicable law, you may have the right to:

• ask whether Suncast holds personal information about you;
• request access to that information;
• request correction or updating of inaccurate information;
• request deletion or destruction of information where appropriate;
• object to certain processing;
• withdraw consent where processing depends on consent;
• object to direct marketing; and
• lodge a complaint with the Information Regulator of South Africa.

Requests can be sent to suncastsupport@gmail.com.

We may need to verify your identity before acting on a privacy request.

If your information was entered into Suncast by a solar installer, that installer is generally responsible for deciding how its customer information is handled. You may therefore wish to contact the installer first. If you contact Suncast directly, we may refer or coordinate the request with the relevant installer where appropriate.

15. Account deletion

Suncast users can delete their own account at any time in their account settings, or request deletion by emailing suncastsupport@gmail.com.

When a company account is closed, Suncast will normally delete or de-identify the associated users, customers, projects, proposals and uploaded files when they are no longer required, subject to any legal, contractual, security or dispute-related retention requirements.

16. Providing information is generally voluntary

Providing personal information to Suncast is generally voluntary.

Certain information is necessary to create an account, operate a company workspace, create customer records or use particular features. If required information is not provided, we may be unable to provide the relevant account, service or feature.

17. Children

Suncast is a business-to-business service and is not intended for use by children.

We do not knowingly request personal information about children. Users must not intentionally enter children's personal information into Suncast unless doing so is lawful and genuinely necessary.

If we discover that children's information has been entered without an appropriate lawful basis, we may restrict or delete it.

18. Automated calculations

Suncast automatically performs calculations relating to matters such as solar production, system sizing, savings, payback periods and proposal pricing based on information entered by installers.

These calculations are decision-support tools. Suncast does not make legally binding or similarly significant automated decisions about homeowners. Installers are responsible for reviewing designs, calculations and proposals before sending them to customers.

19. Sale or restructuring of Suncast

If Suncast is sold, merged, reorganised, financed or transferred to another operator, personal information may form part of that transaction where reasonably necessary and lawful.

Any recipient will remain subject to applicable data-protection obligations.

20. Changes to this policy

We may update this Privacy Policy when Suncast's services, providers, legal obligations or data-processing activities change.

The latest version will be published through Suncast and the "Last updated" date will be changed accordingly.

Where a change materially affects how we use personal information, we may provide additional notice where appropriate.

21. Contact us

Questions, objections, access requests, correction requests and deletion requests can be sent to:

Suncast
Legal operator: Nicolas Pasco-Marx
Business/service address: Kragga Kamma Rd, Lorraine, Gqeberha, 6070, South Africa
Email: suncastsupport@gmail.com

You also have the right to lodge a complaint with the Information Regulator of South Africa.