Sunnova Privacy Policy

Last Updated: 19 January 2024

Sunnova Energy Corporation and its affiliates (“Sunnova Group,” “we,” “us,” “our”) value your privacy. This Privacy Policy describes how we collect, use, and disclose your personal Information and how to exercise any rights you may have with respect to this information. It governs information we collect through Sunnova Group websites, interactive services, email programs and mobile device applications (collectively, the “Websites” or “Sites”) and information we collect from you or third parties through any other means to provide our services or perform other business activities (collectively, “Services”).

Please read this Privacy Policy, which is part of our website Terms of Use, before using our Websites and/or Services. By accessing or using our Websites and/or Services, you agree to our use of your Personal Information consistent with the Terms of Use and this Privacy Policy, as they may be amended from time to time, subject to your rights described below.

If you provide information to us or we collect Personal Information about you in connection with a financial transaction (potential or complete), your nonpublic personal information may also be governed by federal, state, and territorial financial privacy laws, such as the Gramm-Leach-Bliley Act, and the financial privacy notices provided pursuant to those laws. In the event of a conflict or inconsistency between this Privacy Policy and a financial privacy law or notice, the applicable financial privacy law or notice governs.

This Privacy Policy does not apply to Personal Information Sunnova Group collects from or about its job applicants, employees, or contractors. For information about Sunnova Group’s privacy practices regarding Personal Information from or about job applicants, employees, or contractors, please read the Sunnova Employee and Contractor Privacy Notice.

If you have questions about our Privacy Policy, please email us at [email protected]

TABLE OF CONTENTS

Information We Collect
How We Collect Information
Third-Party Data Sources
Cookies and Interest-Based Advertising
How We Use and Disclose the Information We Collect
Data Security
Children's Privacy
Additional California Consumer Rights
Contact Us

INFORMATION WE COLLECT

We collect information that personally identifies, relates to, describes, or is capable of being associated with you (“Personal Information”), including:

Identifiers such as name, signature, social security number, driver’s license number, mailing address, garaging address, email addresses, phone numbers, fax numbers, and Sunnova Group account credentials;
Characteristics of protected classifications under California or federal law such as age and gender;
Other demographic information such as any co-owners or co-tenants of your home, and what languages you speak;
Commercial information such as payment card or bank account information, your utility company and services your utility company provides, past and present energy generation and usage (including use generated by appliances and devices), pool and utility settings, dwelling age, size and type, whether you rent or own your home, details about appliances and other energy-related equipment used in the home or building, mapping information, details about the home or building’s structure for system design, data regarding solar irradiance, product interest and purchase history, financial account status and balance, and information about solar-related equipment in your home, including make, model, serial number, and location in your home, the energy it generates (including power, voltage, current, frequency and flow rates), its settings, schedules, alerts, system installation and roof diagrams;
Internet or other electronic network activity information such as browsing/search history, IP address, and data collected by cookies and similar technologies;
Geolocation data such as geographic location indicators from mobile, web, and product that are approximate and/or which are not used to locate a particular individual;
Audio, electronic, visual, thermal, olfactory, or similar information such as call recordings, chat transcripts, testimonials, photos and satellite imagery of your home or building, and pictures or videos you upload to or send through the Website or by using our Services;
Biometric Information such as a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry used to identify an individual. Our biometric disclosure is found here;
Professional or employment-related information such as employer, job title, and income;
Education information such as education level; and
Inferences drawn from other Personal Information or data that relate to your preferences, interests, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes, such as credit reports or credit scores.

Some of the Personal Information listed above may be considered Sensitive Personal Information under relevant laws. Depending on your state of residence, this may include social security number, driver’s license and other identification card information, biometric information, and your Sunnova Group account credentials. Each type of Sensitive Personal Information may overlap with a category of Personal Information listed above. Additionally, some of the Personal Information listed above may be considered “personal information” as defined in Cal. Civ. Code § 1798.80(e).

The type of Personal Information we collect about you may vary based on how you use the Site and/or Services and your relationship with us.

Usage Data and Sites Activity

We automatically collect information in connection with the actions you take on the Sites (“Usage Data”). For example, each time you use the Sites, we automatically collect the type of web browser you use, the type of device you use, your operating system and version, your IP address, the pages you view, referring and exit pages, the date and time of your visit, and the number of clicks to, from, and within the Sites, and the duration of your visits to the Sites. If the data we automatically collect is capable of being associated with you, directly or indirectly, we treat it as Personal Information under the categories of Identifiers or Internet or other electronic network information, as appropriate. If this information is not capable of being individually associated with you, we treat it as Usage Data.

Communication Recordings

We may record calls and retain the content of text messages, chat transcripts, or other written/electronic communications between you and us. By communicating with us, you consent to our recording and retention of communications.

HOW WE COLLECT INFORMATION

From You and Your Equipment

We may ask you to provide us with Personal Information when you communicate with us online or offline, including events, surveys, and marketing or promotional programs. You are not required to provide us your Personal Information; however, if you choose not to provide the requested information, you may not be able to use some or all of the features of the Sites or Services or we may not be able to fulfill your requested interaction. We may also capture Personal Information when you contact us or through your equipment or through other means such as phone or email.

Third-Party Data Sources

We may collect Personal Information from third-party data sources such as marketing agencies, lead generators, other Sunnova Group customers, fulfillment and account servicing companies, (including sales and/or installation dealers), equipment manufacturers, credit bureaus and/or reporting agencies, analytics firms, map and/or satellite imagery providers, public records, and government agencies

Cookies and Other Automated Tools

We use cookies (a small text file placed on your computer to identify your computer and browser) and other automated tools such as pixels to track your interaction with our Sites and to improve the experience of the Sites and Services, such as saving your preferences from visit to visit to present you with a customized version of the Websites. Many web browsers are initially set up to accept cookies. You can reset your web browser to refuse all cookies or to indicate when a cookie is being sent. However, certain features of our Sites may not work if you delete or disable cookies.

We use the following types of cookies:

Strictly Necessary: These cookies are essential to operate the Sites and provide you with services you have requested. They cannot be switched off.
Functional: These cookies enable certain features or non-essential functionality on our Sites. For example, we might use these cookies to recognize you and remember your preferences or settings when you return to our Sites so we can provide you with a more personalized experience.
Targeting Cookies: These cookies allow us and third parties to learn more about you, including your use of our Sites and other websites, and to advertise products/services that might interest you as further indicated below.
Performance Cookies: These cookies help us and third parties understand how our Sites is working and who is visiting our Sites.

We and third parties also use tools that enable us to track certain aspects of a user’s visit to our Sites. This technology helps us better manage content on our Sites by informing us what content is effective, how consumers engage with our Sites, and how consumers arrive at and/or depart from our Sites. The software typically uses two methods to track user activity: (1) “tracking pixels” and (2) “clear gifs.” Tracking pixels are pieces of executable code that are embedded in a web page that track usage activity including which pages are viewed, when they are viewed, and how long the pages are viewed. Clear gifs are tiny graphics with unique identifiers which are embedded in web pages and email messages that track whether a user views a web page or email message. User activity information may be associated with additional information about a user’s session and Personal Information, if provided by the user.

You can opt-out of certain types of cookies and other tracking tools by managing your preferences through our Sites (e.g., by clicking the cookie icon at the bottom of the homepage).

If you arrive at our Sites by “clicking through” from another website, then certain information about you that you provided to that other website, such as the terms you searched that led you to our Sites, may be transmitted to us and we may use it. You should review the privacy policy of any website from which you reached our Sites to determine what information the operator collects and how it uses such information. We may retain information about you provided to us by other websites and will use it in accordance with this Privacy Policy. Such information may be associated with other Usage Data or Personal Information.

Interest-Based Advertising

We may work with third-party advertisers, search providers, and ad networks (“Advertisers”) to learn more about you and show you ads or other content that we believe would be relevant to you. Advertisers may collect and use information about your use of our Sites or Services as well as other websites and services. These companies may use cookies and other online tracking technologies to collect and use your information. We and/or Advertisers may also append other data to the data collected by Advertisers to create an interest profile of individual users. Our Privacy Policy does not cover any use by an Advertiser of information that they may collect from you. Advertisements may be shown via our Sites or on third-party websites. If you want to limit interest-based advertising, please visit the Digital Advertising Alliance (DAA) Consumer Choice Page. The DAA website allows you to opt-out of one or more interest-based advertising networks. Opt-outs are device and browser specific; therefore, you will need to set your opt-out preferences for each device and browser. Deleting browser cookies can remove your opt-out preferences; however, the DAA offers browser extensions that help preserve the opt-out preferences you set on the DAA's Consumer Choice Page. Please note that opt-outs only apply to interest-based advertising. You may still receive other types of online advertising. Your device or browser may also provide features to further limit interest-based advertising or online tracking by Advertisers.

Information from Advertisements

If you arrive at our Sites via an advertisement (e.g., banner ad), we may collect information regarding the advertisement with which you interacted and your interactions (e.g., item clicked, date and time).

Social Media Widgets

The Sites may include social media features, such as the Facebook, YouTube, Pinterest, LinkedIn, Instagram, and Twitter widgets. These features may collect information about your IP address and the pages you visit on our Sites as well as other Personal Information. A cookie may be set to ensure that a feature properly functions. These features and social media features are governed by the privacy policies of the companies that provide them and you should review the relevant privacy policies before interacting with the social media features.

HOW WE USE AND DISCLOSE THE INFORMATION WE COLLECT

We use Personal Information for business purposes, such as:

Account creation, fulfillment, servicing, and customer support: to process applications, create customer accounts, allow customers to create online accounts and profiles, provide goods or services, keep customers informed about the status of their services, respond to questions and addressing customers concerns, deliver updates, upgrades and product improvement information.
Marketing and market research: to send communications and offers for our or third parties’ products and services, including offers based on consumers’ interests, personal and business characteristics and location; perform analytics for market and consumer research, trend analysis, financial analysis, and anonymization of personal information.
Collection and credit reporting: to collect on outstanding balances, repossess collateral and update credit reporting agencies.
Surveys, promotional events, contests: to administer surveys, polls, sweepstakes, contests, loyalty programs and other promotional events and contests.
Other company communications: to provide consumers with information that may be of interest such as company newsletters, announcements, reminders, and technical service bulletins.
Website use and analytics: to provide you with access to and use of our Website and Services; analyze consumers’ use of our websites, including the use of third-party web analytics services, which may utilize automated technologies to collect data (such as email and IP addresses).
Eligibility and Pricing: to determine if consumers are eligible for certain products, services or offers and the pricing related to such offers.
Product research: to conduct research and analysis for maintaining, protecting, and developing services, increase and maintain the safety of our products and services, and prevent misuse.
Business operations: to evaluate, develop, and improve business operations, products and services offered; business administration and other normal business activities.
Compliance: to comply with applicable legal requirements, industry standards, contractual obligations, our policies, and take actions that we deem necessary to preserve and enforce our rights and the rights of others.
Information security and fraud prevention: to operate information security and anti-fraud programs.
Energy programs: to conduct or participate in demand response or other energy use and/or efficiency programs, including load control.
Renewable energy credit and wholesale market registries: to certify, register, sell, trade or otherwise monetize environmental attributes, renewable energy credits, green credits, and other tradeable energy or environmental related commodities produced by or associated with the photovoltaic solar systems.

We use Sensitive Personal Information as follows:

Government Identifiers (social security numbers, driver’s licenses, and other government identification cards) – to provide the Services, service accounts, collect on accounts, and as otherwise required by law.
Sunnova Group account credentials – to permit access to customers’ online accounts and operate information security and anti-fraud programs.
Biometric information – to confirm your identity as part of our anti-fraud programs.

We may also use Personal Information and/or Sensitive Personal Information as described to you at the point of collection or as otherwise required or permitted by applicable laws. We only use Sensitive Personal Information related to California residents for purposes permitted by California Consumer Privacy Act regulations (11 CCR 7000 et seq.).

Service Providers

We may provide your Personal Information without notice to other businesses (“Service Providers”) to provide services to us or to you on our behalf. Categories of service providers we use may include but are not limited to:

Fulfillment and account servicing vendors, which help us provide products, services and information to you, service your account or benefits, collect survey responses and support our e-commerce services;
Payment processors, which help us to accept and process the payments for our products and services to you;
Consumer/credit report services, which help us understand consumer’s eligibility and qualification for certain financing options;
Marketing and communications vendors, which help us market our products/services to you, provide space for us or dealers to market our products/services to you, or conduct promotions, events, surveys. and other outreach campaigns;
Research and development vendors, which help us develop and improve our products and services;
IT and network administration vendors, which provide services such as data storage and management, website hosting, and data security;
Professional service firms, which provide accounting, legal and other professional services;
General service providers, which help us with day-to-day business operations such as office support services, courier services, facilities management, and document destruction;
Energy management providers, which help us facilitate, register, and implement demand response and/or other energy management programs by reserving or discharging power from storage devices, and managing load control; and
Renewable energy credit and wholesale market registries, which require the sharing of certain Personal Information to register, certify, sell, trade, or otherwise monetize environmental attributes, renewable energy credits, green credits, and other tradeable energy or environmental related commodities produced by or associated with the photovoltaic solar systems.

Each Service Provider is expected to use reasonable security measures appropriate to the nature of the information involved to protect your Personal Information from unauthorized access, use, or disclosure. Service Providers are prohibited from using Personal Information that we provide to them other than as specified by us.

In the past twelve months we disclosed or made available each category of Personal Information that we collect (listed above) to Service Providers.

Third-Party Sale or Sharing

Except where prohibited by law, we may sell or share (for targeted or cross-context behavioral advertising purposes) your Personal Information with other companies who do not provide services to us (“Third Parties”).

In the past twelve months, we sold and/or shared Personal Information (except Sensitive Personal Information) as follows:

Industry associations and advocacy groups: we sold identifiers, commercial information, and other demographic information to allow these associations and groups to provide consumers with information that may be of interest.
Advertising, social media, and analytics companies: we sold and/or shared Identifiers and Internet or other electronic network activity information for the purposes described above. These companies may use your Personal Information for additional purposes outlined in their privacy policies.
Providers, sponsors, and facilitators of demand response programs: we disclosed (in a manner that may qualify as a sale in certain jurisdictions) Identifiers and Commercial Information.

We reserve the right to sell or share Personal Information with other third parties in the future, subject to applicable laws. We do not knowingly sell or share the Personal Information of consumers under 18 years of age.

Other Third-Party Disclosures

We may occasionally disclose your Personal Information with Third Parties, for purposes such as:

To comply with applicable laws;
To respond to compulsory process or law enforcement requests;
To protect the rights, property or safety of our customers or prospective customers, the public, the Sunnova Group or any third party;
If we reorganize or transfer various assets and lines of business. Notwithstanding anything to the contrary stated herein or on our Websites, we reserve the right to disclose or transfer any information we collect in connection with any proposed or actual purchase, sale, lease, merger, foreclosure, liquidation, amalgamation or any other type of acquisition, disposal, transfer, conveyance or financing of all or any portion of the Sunnova Group or its assets.
For additional purposes with your consent where such consent is required by law.

In the past twelve months, we may have disclosed each category of Personal Information for the purposes listed above.

Biometric Information Retention Schedule

In circumstances where Sunnova Group retains Biometric Information, we will permanently destroy an individual’s Biometric Data within six (6) months of when the initial purpose for collecting or obtaining such Biometric Data has been satisfied, such as:

You revoke your consent contained in the Biometric Notice;
You have not contacted Sunnova Group or used our Services for a 30-month period;
Your contract with Sunnova has expired and you are no longer a Sunnova customer; or
Sunnova Group no longer uses the Biometric Information.

If any Sunnova Group’s Service Providers require access to Biometric Data in order to fulfill the purpose of collecting such information, we will request that they follow the above destruction schedule.

Links and Other Websites

Our Sites may contain links to third party websites, including social media platforms. Please be aware that if you access these links, you will be leaving our site. We encourage users to read the privacy policies of those sites, as we are not responsible for their content, links, or privacy procedures.

OTHER IMPORTANT PRIVACY PROVISIONS

Legal Compliance, Business Transfers and Other Disclosures

Notwithstanding anything to the contrary stated herein or on our Website, we may occasionally release information about users of our Website when we deem such release appropriate to comply with law, respond to compulsory process or law enforcement requests, or protect the rights, property or safety of our customers or prospective customers, the public, the Sunnova Group or any third party. Over time, we may reorganize or transfer various assets and lines of business. Notwithstanding anything to the contrary stated herein or on our Website, we reserve the right to disclose or transfer any information we collect in connection with any proposed or actual purchase, sale, lease, merger, foreclosure, liquidation, amalgamation or any other type of acquisition, disposal, transfer, conveyance or financing of all or any portion of the Sunnova Group.

DATA SECURITY

The Sunnova Group uses commercially reasonable technical and organizational procedures to protect the Personal Information that we collect from you against loss, theft and misuse, as well as unauthorized access, disclosure, alteration and destruction. We have developed and implemented and continue to maintain and monitor written information security procedures applicable to all records containing Personal Information. Our security procedures are appropriate to the size, scope and type of our business, the resources available to us, the amount of stored data and the need for security and confidentiality of the personal information we store. Our servers are scanned on a regular basis for known vulnerabilities in order to make your visit to our Sites as safe as commercially practicable. We make use of industry standard tools and practices to protect against malware exposure.

No security system is impenetrable. We cannot guarantee the security of our databases or the security during transmission to us of the information you supply over the Internet. You can help us by taking precautions to protect your Personal Information when you are on the Internet. Change your passwords often using a long combination of letters, numbers and special characters and make sure to use a secure, modern, updated web browser. For the purposes set out in this Privacy Policy, Personal Information may be transferred to, processed, stored and accessed by us, our affiliates and Third Parties in the United States and in other jurisdictions where we or they operate. Courts and other authorities in these jurisdictions may, in certain circumstances, be entitled to access your Personal Information. By using the Website, you consent to this transfer, processing, storage and access of your Personal Information in and/or outside of the jurisdiction in which you reside.

CHILDREN'S PRIVACY

The Sunnova Group cares about protecting the privacy of children. We will not market to, knowingly collect, sell, or share Personal Information of children we have actual knowledge are under 16. If a child under 16 submits Personal Information to us and we learn that the Personal Information is the information of a child under 16, we will take reasonable steps to delete the information as soon as possible. If you are under 16, please do not register for any of our services or provide us any information about yourself (such as your name, email address or phone number).

ADDITIONAL CALIFORNIA CONSUMER RIGHTS

If you are a resident of California, you may have additional rights to access and control your Personal Information. Exemptions may apply, particularly if you have or had a financial account with us. Consumer privacy rights for California consumers include:

Right to Opt-Out from the Sale or Sharing of Personal Information

You have the right to direct us not to sell or share (for cross-context behavioral advertising) your Personal Information to Third Parties. We will process requests within 15 business days, subject to any applicable exceptions and extensions permitted by law. Our Sites also recognize and process Global Privacy Control (GPC) signals. If we are able to reasonably associate a GPC signal with an identifiable consumer, we treat it as a request to opt-out of the sale or sharing of that consumer’s Personal Information as if the consumer made the request using a method below. If we are not able to reasonably associate a GPC signal with an identifiable consumer, we treat it as a request to opt-out of the sale or sharing of that user’s Personal Information collected while the signal is present. While the signal is present, we will also disable any third-party cookies or other third-party tracking tools present on the Sites.

Right to Know

You have the right to request twice per 12-month period that we provide you (i) the categories or specific pieces of Personal Information we collected about you; (ii) the categories of sources from which your Personal Information was collected; (iii) the business or commercial purpose for which we collected your Personal Information; and (iv) the categories of Third Parties with whom we sold, shared, or disclosed your Personal Information, including the categories of Personal Information sold, share, or disclosed to each and the purposes for doing so.

We will not provide specific pieces of Personal Information in response to a request unless you expressly request them.

Right to Delete

You have the right to request that we delete any Personal Information we have collected about you. Please understand that we are not required to honor a deletion request if a legal exemption applies such as if we need the information to complete a requested or reasonably anticipated transaction, prevent security incidents or fraud, enable internal uses that are reasonably aligned with your expectations, or comply with legal obligations.

Right to Correct

You have the right to request that we correct inaccurate Personal Information we maintain about you. After you make a request, we will provide instructions for you to provide us with optional documentation to support your request and we will consider it. We may decline to correct your Personal Information if a legal exemption applies, your request is fraudulent or abusive, or if we determine, based on the totality of the circumstances, that your Personal Information is most likely accurate. We may decide to delete your allegedly inaccurate Personal Information instead of correcting it.

If you wish to update your contact information or other Personal Information rather than disputing its accuracy, please make the changes directly in your account.

Submitting a Request

If you are a California resident and would like to exercise your rights under the California Consumer Privacy Act, you may submit a request through our online California Consumer Privacy Act request form. You may also submit a request by phone by contacting us at 1-866-786-6682. After you submit your request, we may contact you to obtain additional information necessary to verify your identity. For example, we may require you to verify certain information in our files or submit a signed declaration under penalty of perjury verifying your identity. We will not process Right to Know, Deletion, or Correction requests without verifying your identity, so please respond promptly. If you do not timely respond to our requests for information, we may deny your request.

We will process requests to opt-out of sales and sharing (for cross-context behavioral advertising purposes) within 15 business days of receipt and verified Right to Know, Deletion and Correction requests within 45 calendar days of receipt, subject to any applicable exemptions and extensions permitted by law. If you request specific Personal Information and that information creates a high risk of potential harm from disclosure to an unauthorized person, we will withhold that information and replace it with a category identifier. For example, if we withhold a social security number, we will inform you that we have a social security number on file. We will give you the option to choose between mail and electronic delivery. We will retain a copy of your Deletion request for at least two years as required by law.

Authorized Agent

If you are an authorized agent submitting a request for a California resident, you must provide a copy of a lawful power of attorney or written authorization from the consumer (along with proof of your identity). If you make a request as an authorized agent, you will receive additional instructions from us after submitting the request. We may contact you or the consumer on whose behalf you claim to act to verify your authorization.

Non-Discrimination Notice

We will not discriminate against any consumer for exercising their privacy rights under law or this Privacy Policy.

Do Not Track

Do Not Track is a web browser privacy preference that causes the web browser to broadcast a signal to websites requesting that a user’s activity not be tracked. Currently, our Website and Services do not respond to “do not track” signals.

Energy Usage Data

Additionally, pursuant to California Civil Code Section 1798.98, if you are a customer of an electrical or gas corporation operating for profit in California or of a local publicly owned electric utility, we cannot disclose information we obtain about your energy usage without your consent.

ADDITIONAL PUERTO RICO CONSUMER RIGHTS

If you are resident in Puerto Rico, the following additional disclosures relate to your interactions with us. If you are not resident in Puerto Rico, the following disclosures do not apply to you.

As it applies to Puerto Rico customers, our policy shall be construed to be consistent with the principles for data privacy and the smart grid in the DataGuard Energy Data Privacy Program Voluntary Code of Conduct (DataGuard_VCC_Concepts_and_Principles_2015_01_08_FINAL%20(1)). To the extent any provision of this policy is finally determined by the Puerto Rico Energy Bureau, or by a court of competent jurisdiction, to be not consistent with the DataGuard Energy Data Privacy Program Voluntary Code of Conduct as applied to a Puerto Rico consumer, the DataGuard Energy Data Privacy Program Voluntary Code of Conduct will be deemed to apply and the inconsistent terms of this Policy shall be treated as void as applied to Puerto Rico consumers.

We do not sell the private or personal customer information of Puerto Rico customers to any third parties. In addition, we will not disclose to or share with affiliates, subsidiaries, or any other third party, private or proprietary Puerto Rico customer information to market services or product offerings to a Puerto Rico retail electric customer who does not already subscribe to that service or product.

Notwithstanding the foregoing, we may share private or personal Puerto Rico customer information with our Demand Response (DR) vendors, verifiers, and evaluators, provided that such data sharing is limited to that which is necessary for effectively operating our DR program or programs or the verification or evaluation of such programs. We may disclose private or proprietary Puerto Rico customer information to a third party with which we have a contract where such contract is directly related to conduct of our business and the services being provided, provided that the contract prohibits the third party from further disclosing or selling any private or proprietary Puerto Rico customer information obtained from us to a party that is not us and not a party to the contract with us. We may also collect and release Puerto Rico retail electric customer information in aggregate form if the aggregated information allows no specific customer to be identified

ADDITIONAL EUROPEAN DATA SUBJECT RIGHTS

If you are resident in the European Economic Area (the EEA), Switzerland, or the United Kingdom, the following additional disclosures relate to your interactions with us. If you are not resident in the EEA, Switzerland or the United Kingdom, the following disclosures do not apply to you.

Data Controller

The controllers of your Personal Information are Sunnova Energy B.V. a company subject to the laws of Amsterdam with a registration number of 7353308 and Sunnova Energy GmbH a company subject to the laws of Germany with a registration number of 72/2023P.

Lawful Bases for Processing

We use Personal Information in connection with our business operations when the law allows us to as described below. We will use/process Personal Information for the purposes outlined in this section. Our processing of your Personal Information may require disclosing it to Service Providers or Third Parties in order to accomplish the stated purpose.

Purpose of Processing	Personal Information Processed	Lawful Basis
Perform our contract with you such as using your information to deliver, or communicate with you regarding, the Sites and/or Services, processing invoices and payments, and supporting and improving the Sites and Services provided to you. This type of processing includes day-to-day business functions that support performance of our contract and/or provision of the Sites and Services such as accounting, collections, credit reporting, and customer/technical support.	Identifiers Protected classification characteristics Other demographic information Commercial information Internet or other electronic network activity Geolocation data Audio, electronic, visual, thermal, olfactory, or similar information Professional/employment information Education Inferences Personal information as described in Cal. Civ. Code § 1798.80(e)	Processing necessary for performance of a contract or to take steps at the request of the data subject prior to entering into a contract.
Negotiate a potential contract with you such as communicating with you regarding the potential contract, verifying payment methods, verifying your identity, and communicating with you and any third party involved in the negotiations. This type of processing includes communicating with you in response to a request for information made by you or a third party on your behalf.	Identifiers Protected classification characteristics Other demographic information Commercial information Internet or other electronic network activity Geolocation data Audio, electronic, visual, thermal, olfactory, or similar information Professional/employment information Inferences Personal information as described in Cal. Civ. Code § 1798.80(e)	Processing necessary for performance of a contract or to take steps at the request of the data subject prior to entering into a contract.
Obtain, analyze, and respond to feedback regarding products and services such as by sending surveys or engaging focus groups.	Identifiers Protected classification characteristics Other demographic information Commercial information Internet or other electronic network activity Geolocation data Audio, electronic, visual, thermal, olfactory, or similar information Professional/employment information Inferences Personal information as described in Cal. Civ. Code § 1798.80(e)	Legitimate Interest in correcting errors in and improving our Sites and Services.
Direct marketing of our Sites or Services to you such as by communicating with you through email, telephone calls, text messages, social media direct messages, facsimiles, or postal mail, or by use of targeted advertising.	Identifiers Protected classification characteristics Other demographic information Commercial information Internet or other electronic network activity Geolocation data Audio, electronic, visual, thermal, olfactory, or similar information Professional/employment information Inferences Personal information as described in Cal. Civ. Code § 1798.80(e)	Consent Legitimate Interest in operating and furthering our business
Direct marketing of third-party goods or services to you such as by communicating with you through email, telephone calls, text messages, social media direct messages, facsimiles, or postal mail, or by use of targeted advertising.	Identifiers Protected classification characteristics Other demographic information Commercial information Internet or other electronic network activity Geolocation data Audio, electronic, visual, thermal, olfactory, or similar information Professional/employment information Inferences Personal information as described in Cal. Civ. Code § 1798.80(e)	Consent
Sale of Personal Information to Third Parties for those Third Parties to use in connection with marketing, advertising, and other business purposes as determined by the Third Parties.	Identifiers Protected classification characteristics Other demographic information Commercial information Internet or other electronic network activity Geolocation data Audio, electronic, visual, thermal, olfactory, or similar information Professional/employment information Inferences Personal information as described in Cal. Civ. Code § 1798.80(e)	Consent
Development and implementation of general advertising to the public.	Identifiers Protected classification characteristics Other demographic information Commercial information Internet or other electronic network activity Geolocation data Audio, electronic, visual, thermal, olfactory, or similar information Professional/employment information Inferences Personal information as described in Cal. Civ. Code § 1798.80(e)	Legitimate Interest in marketing and advertising our Sites and Services to the public and developing brand awareness.
Research and development of new Sites and Services generally or enhancements to existing Sites and Services, including analysis of use of the Sites and Services by our customers.	Identifiers Protected classification characteristics Other demographic information Commercial information Internet or other electronic network activity Geolocation data Audio, electronic, visual, thermal, olfactory, or similar information Professional/employment information Inferences Personal information as described in Cal. Civ. Code § 1798.80(e)	Legitimate Interest in correcting errors in and improving our Sites and services.
Comply with legal obligations we are under such as responding to lawful requests for information, complying with data protection regulations, and preventing violations of laws and regulations.	Identifiers Protected classification characteristics Other demographic information Commercial information Internet or other electronic network activity Geolocation data Audio, electronic, visual, thermal, olfactory, or similar information Professional/employment information Inferences Personal information as described in Cal. Civ. Code § 1798.80(e)	Compliance with our legal obligations
Establish, exercise, and/or defend our legal rights or the legal rights of third parties in any legal proceeding or otherwise.	Identifiers Protected classification characteristics Other demographic information Commercial information Internet or other electronic network activity Geolocation data Audio, electronic, visual, thermal, olfactory, or similar information Professional/employment information Inferences Personal information as described in Cal. Civ. Code § 1798.80(e)	Legitimate Interest in protecting our legal rights and the legal rights of others.
Prevent fraud, theft, or violations of our security or the security of third parties.	Identifiers Protected classification characteristics Other demographic information Commercial information Internet or other electronic network activity Geolocation data Audio, electronic, visual, thermal, olfactory, or similar information Professional/employment information Inferences Personal information as described in Cal. Civ. Code § 1798.80(e)	Legitimate Interest in preventing harm to ourselves and others from malicious activity.
Obtain advice from professional advisers such as lawyers, financial planners, accountants, insurance brokers, and consultants.	Identifiers Protected classification characteristics Other demographic information Commercial information Internet or other electronic network activity Geolocation data Audio, electronic, visual, thermal, olfactory, or similar information Professional/employment information Inferences Personal information as described in Cal. Civ. Code § 1798.80(e)	Legitimate Interest in operating our business in a sound and responsible manner.

We also will obtain your consent prior to using, or permitting third parties to use, cookies and other automated tracking tools such as clear gifs and tracking pixels on our Sites or in connection with our Services for any purposes that are not strictly necessary for Site or Service operation. For further details, please see our cookie policy.

“Legitimate Interest” means the interests of our business in conducting and managing our business to enable us to give you the best Sites and Services possible and protect our reasonable business concerns. We make sure to consider and balance any potential impact on you (positive and negative) with your rights under applicable law before we process Personal Information for our Legitimate Interest. We do not process Personal Information for our Legitimate Interests if we determine that our interests are overridden by the impact on your rights (unless we have consent or the processing is otherwise permitted by law). If you would like more information about how we assess our Legitimate Interests, you may contact us.

If the lawful basis for processing your Personal Information is consent, we will obtain consent from you prior to processing your Personal Information for the purpose for which consent is required and you may revoke your consent at any time by contacting us using the contact information below.

Profiling and Automated Decision-Making

We do not engage in profiling or automated decision-making that produces legal or similarly significant effects.

Change of purpose

We will only use your Personal Information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us.

If we need to use your Personal Information for an unrelated purpose after we have acquired your Personal Information, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your Personal Information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

International Transfers

Your Personal Information may be processed in the EEA and the United States of America.

Whenever we transfer your Personal Information out of the EEA we ensure that we have your consent and/or adequate safeguards are in place as required by applicable data protection law by either (i) transferring your Personal Information to countries that have been deemed to provide an adequate level of protection for Personal Information by the European Commission or (ii) using standard contractual clauses approved by the European Commission which give Personal Information a similar amount of protection as it has in Europe, including additional safeguards as needed. Please contact us if you want further information on the specific mechanism used by us when transferring your Personal Information out of the EEA.

One mechanism by which we transfer your Personal Information is through our participation in the EU-US Data Privacy Framework (EU-US DPF), and, as such, adhere to the EU-US DPF Principles. More information on the EU-US DPF, including the EU-US DPF Principles, is available at the EU-US DPF website.

As a participating entity, we are subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission.

As part of our participation in the EU-US DPF, we have designated the International Centre for Dispute Resolution-American Arbitration Association (ICDR-AAA) as an independent dispute resolution body to address complaints and provide appropriate recourse for individuals with unresolved complaints that fall under the EU-US DPF Principles.

The contact Information for the ICDR-AAA can be found here.

Under certain circumstances, individuals may invoke binding arbitration under the EU-US DPF. More information on this right can be found here and here. [MB1][MB2][MB3]

Data Subject Rights

You have rights under data protection laws in relation to your Personal Information. You have the right to:

Request access to your Personal Information (commonly known as a “data subject access request”). This enables you to receive a copy of the Personal Information we hold about you and to check that we are lawfully processing it.

Request correction of the Personal Information that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.

Request erasure of your Personal Information. This enables you to ask us to delete or remove Personal Information when there is no legally valid reason for us continuing to process it. You also have the right to ask us to delete or remove your Personal Information when you have successfully exercised your right to object to processing (see below), when we may have processed your information unlawfully, or when we are required to erase your Personal Information to comply with local law. However, please note that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, following your request.

Object to processing of your Personal Information when we are relying on a Legitimate Interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it infringes your fundamental rights and freedoms. You also have the right to object when we are processing your Personal Information for marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.

Request restriction of processing of your Personal Information. This enables you to ask us to suspend the processing of your Personal Information in the following scenarios:

If you want us to establish the data’s accuracy.
When our use of the data is unlawful, but you do not want us to erase it.
When you need us to hold the data even if we no longer require it as you need it to establish, exercise, or defend legal claims.
You have objected to our use of your data, but we need to verify whether we have overriding legitimate grounds to use it.

Request the transfer of your Personal Information to you or to a third party. We will provide to you, or a third party you have chosen, your Personal Information in a structured, commonly used, machine-readable format. Please note that this right only applies to Personal Information that you provided to us.

Withdraw consent at any time when we are relying on consent to process your Personal Information. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent.

If you wish to exercise any of the rights set out above, please contact us at:

Email address: [email protected]

No fee is usually required

You will not have to pay a fee to access your Personal Information or to exercise any of the other rights. However, we may charge a reasonable fee if your request is clearly unfounded, repetitive, or excessive. Alternatively, we could refuse to comply with your request in these circumstances.

What we may need from you

We may need to request specific information from you to help us confirm your identity and ensure your right to access your Personal Information (or to exercise any of your other rights). This is a security measure to ensure that Personal Information is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

Time limit to respond

We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

Complaints or Concerns

You have the right to make a complaint at any time to the supervisory authority for data protection issues in the country in which you are located. We would, however, appreciate the chance to deal with your concerns before you approach the supervisory authority.

CHANGES TO OUR PRIVACY POLICY

The terms and conditions of this version of Privacy Policy came into effect on the effective date listed at the top of the Privacy Policy. Sunnova Group reserves the right to revise, amend or modify this policy at any time and in any manner. Your use of our Websites and Services after such changes are implemented constitutes your acknowledgement and acceptance of those changes. Please consult this privacy statement prior to every use for any changes. Unless otherwise noted, all changes will be effective when posted.

EXCLUSIONS

This Privacy Policy does not govern the collection use or sharing of data by Third Parties or websites that may be linked to a Sunnova Group Website; nor does it govern any information that may be collected by a Third Party in connection with a product or service altered by a Third Party even if you request information regarding such product or service on a Sunnova Group Website.

CONTACTING US

If there are any questions regarding this Privacy Policy you may contact us using the information below:
www.sunnova.com

20 Greenway Plaza, Suite 540
Houston, Texas 77046
United States
[email protected]
1-866-786-6682