Enphase Legal Notices & Policies

Privacy Policy

We have updated our Privacy Policy, effective January 1, 2023

This “Privacy Policy” describes the privacy practices of Enphase Energy, Inc. and our subsidiaries and affiliates (collectively, “Enphase”, “we”, “us”, or “our”) in connection with

• the enphase.com, installers.enphase.com, estimator.enphaseenergy.com, community.enphase.com, service.enphaseenergy.com, store.enphase.com, start.enphase.com, solargraf.com, app.solargraf.com, roofgraf.com, app.roofgraf.com, solarleadfactory.com, understandsolar.com, understandsolar.org, yourchoicesolar.com, solarpower-pro.com, clippercreek.com, store.clippercreek.com, 365pronto.com, platform.365pronto.com, and greencom-networks.com websites;

• the Enphase web-based application called the Enphase App, MyEnlighten, my.enphase.com, and enlighten.enphaseenergy.com;

• the Enphase mobile applications (including the Enphase App, MyEnlighten, Enlighten Manager and Installer Toolkit);

• our application programming interface (“API”) developer website (developer.enphase.com); and

• any other website or mobile application that we own or control and which posts or links to this Privacy Policy.

Collectively, we refer to the above-listed items as the “Service.” This Privacy Policy describes the rights and choices available to individuals with respect to their information. We use the reference to “Customer” to describe anyone who purchases Enphase products or services, has registered for an online account with us for the use of any portion of the Service (each, an “Enphase Account”) or has visited our websites or mobile applications. If you do not agree with our policies and practices, it is your choice to not use the Service. Enphase may provide additional or supplemental privacy policies to individuals for specific products or services that we offer at the time we collect personal information. These supplemental privacy policies will govern how we may process the information in the context of the specific product or service.

We provide important information for United States residents below.

We provide important information for individuals located in the European Economic Area and United Kingdom (collectively, “Europe” or “European”) below.

We provide important information for Australian and New Zealand users below.

We provide important information for Mexico users below.

Table of contents

• Personal information we collect

• How we use your personal information

• How we share your personal information

• Your choices

• Other sites, mobile applications, and services

• Security practices

• International data transfers

• Children

• Changes to this Privacy Policy

• How to contact us

• Regional specific privacy information

  • United States

  • European Economic Area

  • Australia and New Zealand

  • Mexico

Personal information we collect

Information you provide to us. Personal information you provide to us through the Service or otherwise may include:

• Business and personal contact information, such as your first and last name, email and physical addresses, phone number, professional title, and company name.

• Content you choose to upload to the service, such as text, images, audio, video, and digital signatures, along with the metadata associated with the files you upload.

• Profile information, such as your username and password that you may set to establish an online account with us, your account name, account number, Enphase system identification number, photograph, interests, and preferences.

• Registration information, such as information that may be related to a service, an account or an event for which you register.

• Feedback or correspondence, such as information you provide when you contact us with questions, feedback, or otherwise correspond with us online.

• Demographic information, such as your street address, city, state, country of residence, and postal code.

• Energy information, such as your energy production, electric bill, solar installation contract, energy consumption, battery settings and usage history, other load consumption or production, and other information relating to any of your energy resources.

• Site information, such as information related to your solar installation including roof type, house size, device configuration settings, appliance usage, microinverter details, system configuration settings, electrical circuit breaker and panel details, permit information, and photographs.

• Financial information, such as your electric bill. Information provided to make a purchase such as payment card information, financial account number, and billing information is never collected or stored by Enphase, but is provided directly to third-party payment processors such as Stripe, Authorize.net, and Paypal (depending on the site). Information provided for a financing application on our websites such as social security number, income information, and other financial and personal information is similarly not collected or stored by Enphase, but is provided directly to third-party lending partners. Enphase may receive an indication of the results of such application from the lending partners (e.g., amount of loan and identity of financial institution).

• Transaction information, such as information about your billing address, payments to and from you, customer number, and other details of products or services you have purchased from us.

• Usage information, such as information about how you use the Service and interact with us, including information associated with any meter identifier (make, model and serial number) or augmented revenue grade meter data (such as cumulative counter ending values as of the end of the month), output information, efficiency and other technical variables, content you upload to the websites or otherwise submit to us, and information you provide when you use any interactive features of the Service.

• Marketing information, such as your preferences for receiving communications about our activities, events, and publications, and details about how you engage with our communications. We also may conduct user surveys, and research and analysis about your use of, or interest in, our products and services.

• Other information that we may collect which is not specifically listed here but which we will use in accordance with this Privacy Policy or as otherwise disclosed at the time of collection.

Information we collect through our products. The IQ Gateway (either as a stand-alone product or part of an IQ Combiner) is the networking hub that connects Enphase hardware (such as microinverters, IQ Batteries, and IQ System Controllers) of an Enphase Energy System suite to our monitoring and management software. Once the IQ Gateway is connected to the internet, it begins reporting your energy production, consumption, and site information to us and will continue to do so as long as it is online.

Information we obtain from social media platforms. We may maintain pages for Enphase on social media platforms, such as Facebook, LinkedIn, Twitter, Google, YouTube, Instagram, and other third party platforms. When you visit or interact with our pages on those platforms, the platform provider’s privacy policy will apply to your interactions and their collection, use and processing of your personal information. You or the platforms may provide us with information through the platform, and we will treat such information in accordance with this Privacy Policy.

Information we obtain from other third parties. We may receive personal information about you from third-party sources. For example, a business partner, such as a solar energy system installer, a grid services aggregator, or a utility, may share your contact and energy-related information with us if you have expressed interest in learning specifically about our products or services, or the types of products or services we offer. Similarly, a business partner may share profile or registration information if they assist you in setting up an Enphase Account. We may obtain your personal information (including the categories listed above under “Information you Provide to Us”) from other third parties, such as marketing partners, publicly-available sources, existing Enphase customers, and data providers. In certain circumstances, Enphase collects your personal information from your installer at your direction. These third parties’ privacy policies govern their sharing of information with Enphase and their other processing, so we advise you to contact the third parties for further information.

Cookies and other information collected by automated means. We, our service providers, and our business partners may automatically log information about you, your computer or mobile device, and activity occurring on or through the Service. The information that may be collected automatically includes your computer or mobile device operating system type and version number, manufacturer and model, device identifier (such as the Google Advertising ID or Apple IDFA for Advertising), browser type, screen resolution, IP address, the website you visited before navigating to our website, general location information such as city, state or geographic area; and information about your use of and actions on the Service, such as pages or screens you viewed, how long you spent on a page or screen, navigation paths between pages or screens, information about your activity on a page or screen, access times, and length of access. Our service providers and business partners may collect this type of information over time and across third-party websites and mobile applications. If it is an Enphase advertising partner that has collected your personal information, its privacy policy will govern its use of that information. For more information on how we use your information, as collected in the manner described in this paragraph, please see the section below titled "To display advertisements."

On our webpages, this information is collected using cookies, browser web storage (also known as locally stored objects, or “LSOs”), web beacons, and similar technologies. Our emails may also contain web beacons. In our mobile application, we may collect this information directly or through our use of third-party software development kits (“SDKs”). SDKs may enable third parties to collect information directly from our mobile application.

Additionally, see our Cookie Policy for more information.

Referrals. Users of the Service may have the opportunity to refer other individuals to us. If you are an existing user, you may only submit a referral to us if you have permission to provide the referral’s contact information to us so that we may contact them.

How we use your personal information

We may use your personal information for the following purposes and as otherwise described in this Privacy Policy or at the time of collection:

To operate our business. We may use your personal information to:

• provide, operate and improve our business, including to provide the services that you request (including the Service);

• provide information about our products and services;

• establish and maintain your user profile on the Service;

• enable security features of the Service, such as by sending you security codes via email or text, and remembering devices from which you have previously logged into the Service;

• facilitate social features of the Service, such as providing chat or messaging functionality;

• communicate with you about the Service, including by sending you notices about your system’s energy consumption and production, announcements, updates, security alerts, support, service-related matters, and administrative messages;

• communicate with you about events, programs or contests in which you participate;

• understand your needs and interests, and personalize your experience with the Service and our communications;

• provide customer support and maintenance for the Service; and

• respond to your requests, questions and feedback.

For research and development. We analyze your use of the Service (including your personal information such as demographics) to improve the Service, to develop new products and services, and to market and promote our business.

To send marketing and promotional communications. We may send Enphase-related marketing communications as permitted by law. Recipients of our marketing communications will have the ability to opt-out of our marketing and promotional communications as described in the Opt-out of Marketing Communications section below.

To display advertisements. We may work with advertising partners to display advertisements on the Service or elsewhere online. Our third-party advertising partners (e.g. Google Ads, Google Analytics, Facebook, and others) may automatically collect information about you when you use the Service through methods such as cookies and other tracking technologies (as further described below). Such third-party advertisers may use such information about you to display advertisements on the Service or elsewhere online, and such advertising may be targeted to you based on your use of the Service or your activity elsewhere online. To learn more about your choices in connection with advertisements delivered to you by our third-party advertising partners, please see the section below titled “Targeted online advertising.”

Targeted online advertising includes displaying advertisements on social media through programs offered by partners like Facebook Lookalike Audience. Facebook Lookalike Audience enables us to target users of Facebook who “look like” our existing or prospective customers. A lookalike audience uses an existing custom/tailored audience group as a "seed," which may include identifiers that we provide them like your email, or online identifiers automatically collected by them like your usage information or device data. To this end and as permitted by law, we may transfer your contact data to Facebook, so that an audience of similar users is built on that basis by Facebook. Lookalike audiences help reach people who are similar to you for purposes such as customer acquisition, site registration and brand awareness. We do not provide data subject to the GDPR for Facebook Lookalike Audience.

To comply with law. We use your personal information as we believe necessary or appropriate to comply with applicable laws, lawful requests, and legal process, such as to respond to subpoenas or requests from government authorities.

For protection of rights, fraud prevention, and safety. We may use your personal information and disclose it to law enforcement, government authorities, and private parties as we believe necessary or appropriate to: (a) protect our, your or others’ rights, privacy, safety or property (including by making and defending legal claims); (b) enforce the terms and conditions that govern the Service; and (c) protect, investigate and deter against fraudulent, harmful, unauthorized, unethical or illegal activity.

With your consent. In certain circumstances, we may specifically ask for you to consent to the collection, use or sharing of your personal information, such as when required by law or in connection with a specific offering in which you have elected to participate.

To create anonymous, aggregated, or de-identified data. We may create anonymous, aggregated or de-identified data from your personal information and other individuals whose personal information we collect. We make personal information into anonymous, aggregated or de-identified data by removing information that makes the data personally identifiable to you. We may use this anonymous, aggregated or de-identified data and share it with third parties for our lawful business purposes, including to analyze and improve the Service and promote our business.

How we share your personal information

We share your personal information as described below with the following entities.

With your consent. We may share your personal information with your consent or as otherwise instructed by you.

To fulfill your request. In order to carry out our obligation or contract to you, or fulfill your request, we may need to share your personal information. For example, if you order a product then we need to share your contact information with our shipping partner; if you wish to get a quote from an installer then we will need to provide them your information; or if you wish to enroll in a Grid Services program then we may need to provide your contact and system information with a utility and/or aggregator.

Affiliates. We may share your personal information with our corporate parent, subsidiaries, and affiliates, for purposes consistent with this Privacy Policy.

Service providers. We may share your personal information with third party companies and individuals that provide services on our behalf or help us operate our business (such as payment processors, customer support, hosting, analytics, email delivery, marketing, database management, as well as permit and rebate application preparation and submission services.)

Third-party energy providers. At your direction, we may share or instruct our service providers to share your personal information with third-party energy provider partners or enable third-party energy provider partners to collect information directly via our Service. For example, if you wish to sign up with a third-party energy provider (such as a utility company or an energy aggregator) or submit an application to a utility or governmental authority, we may share your information with such provider. This may include, without limitation, your name, email address, system location information, meter identifier information, and augmented revenue grade meter data.

Installers and energy partners. We may share your information with installers or other energy partners for purposes of introducing you; facilitating a transaction; monitoring, financing, and servicing your Enphase product; customer service; and/or other purposes. This may include your name and contact information, unique site ID, IP address, system components and identification numbers, production information, and consumption information. Other energy partners may include, for example, solar renewable energy certificate (“SREC”) reporting services, third-party owners if you finance your system through a lease or power purchase agreement, or system maintainers.

Developers using our API. We may share your personal information and performance data about your system with developers via our API. This sharing of information is done upon your written consent. 

Social media networks and advertisers. Subject to your marketing preferences, we share information with social media networks, such as Facebook, and advertisers to present our ads to you on other platforms. For example, we may share with Facebook actions that you take on our website such as your visits to our website, your interactions on our website, use of Facebook tools such as Facebook Connect, and information collected from cookies or similar technologies including the Facebook pixel. This allows us to measure the effectiveness of our advertising, improve our marketing practices, and helps us deliver more relevant advertising to you (including on social media such as Facebook): for this activity, we are a joint data controller with Facebook. This means that we have to provide you with this notice, but you should contact Facebook if you wish to exercise your data protection rights. Further information, including how Facebook enables you to exercise your data protection rights, and subsequently processes your information as independent data controller can be found in Facebook's Data Policy.

Other users of the service and the public. We may provide functionality that enables you to disclose personal information to other users of the Service or the public to exchange ideas and information or otherwise communicate. For instance, you may be able to submit information through the Enphase Developer Website or Enphase Community forum, and you may choose to display your name, username, and a link to your user profile along with the content you submit. We do not control how other users or third parties use any personal information that you make available to other users or the public.

Professional advisors. We may disclose your personal information to professional advisors, such as lawyers, bankers, auditors and insurers, where necessary in the course of the professional services that they render to us.

Governmental authorities and private parties. We may share your personal information in connection with protection of rights, fraud prevention and safety, as described above.

Business transfers. We may sell, transfer, or otherwise share some or all of our business or assets, including your personal information, in connection with a business transaction (or potential business transaction) such as a corporate divestiture, merger, consolidation, acquisition, reorganization or sale of assets, or in the event of bankruptcy or dissolution.

Your choices

In this section, we describe the rights and choices available to all users. Users who are located in the United States, the European Economic Area, Australia & New Zealand, and Mexico can find additional information about their rights below.

Access or update your information. If you have registered for an Enphase Account, you may review and update certain personal information in your account profile by logging into the Enphase Account.

Opt-out of marketing communications. You may opt out of marketing-related emails by following the opt-out or unsubscribe instructions at the bottom of the email, and by contacting us at our privacy office as indicated below, and, if you have an Enphase Account, by adjusting your preferences in the settings section for both mobile and web applications. If you receive marketing text messages from us, you may opt out of receiving further marketing text messages from us by replying STOP to our marketing message. Even if you opt-out of receiving marketing communications from us you may continue to receive service-related and other non-marketing communications.

Cookies and browser web storage. We may allow service providers and other third parties to use cookies and similar technologies to track your browsing activity over time and across the Service and third party websites. For more details, see our Cookie Policy. You may block or enable certain cookies and other similar tracking technologies using the third-party provided cookie management platform that may display the first time you visit each site, and is available in the footer of our sites.

Privacy settings. We may make available certain privacy settings on the Service, such as options to control how and whether we share your data with installers. If available, you may exercise these controls using the settings section in both mobile and web applications.

Targeted online advertising. Some of the business partners that may collect information about users’ activities on or through the Service may be members of organizations or programs that provide choices to individuals regarding the use of their browsing behavior or mobile application usage for purposes of targeted advertising. Users may opt out of receiving targeted advertising on websites through members of the Network Advertising Initiative by clicking here or the Digital Advertising Alliance by clicking here. European users may opt out of receiving targeted advertising on websites through members of the European Interactive Digital Advertising Alliance by clicking here, selecting the user’s country, and then clicking “Choices” (or similarly titled link). Users of our mobile applications may opt out of receiving targeted advertising in mobile apps through participating members of the Digital Advertising Alliance by installing the AppChoices mobile applications, available here, and selecting the user’s choices. Please note that we also may work with companies that offer their own opt-out mechanisms and these companies may not participate in the opt-out mechanisms that we reference and link above.

If you choose to opt-out of targeted advertisements, you will still see advertisements online but they may not be relevant to you. Even if you do choose to opt out, not all companies that serve online behavioral advertising are included in the opt-out mechanisms provided above, so you may still receive some cookies and tailored advertisements from companies that are not listed.

Do not track. Some Internet browsers may be configured to send “Do Not Track” signals to the online services that you visit. We currently do not respond to “Do Not Track” or similar signals. To find out more about “Do Not Track,” please visit http://www.allaboutdnt.com.

Choosing not to share your personal information. Where we are required by law to collect your personal information and you do not provide it or you ask us to delete it, we may not be able to provide the Service to you. Additionally, we may not be able to provide you with the Service or the quality of the Service may be affected if (1) you do not provide personal information when requested (2) you withdraw consent previously given or (3) you later ask to delete it. We will tell you what information you must provide to receive the Service by designating it as required at the time of collection or through other appropriate means.

Other sites, mobile applications, and services

The Service may contain links to other websites, mobile applications, and other online services operated by third parties. These links are not an endorsement of, or representation that we are affiliated with, any third party. In addition, our content may be included on web pages or in mobile applications or online services that are not associated with us. We do not control third party websites, mobile applications or online services, and we are not responsible for their actions. Other websites and services follow different rules regarding the collection, use and sharing of your personal information. We encourage you to read the privacy policies of the other websites and mobile applications and online services you use.

Security practices

The security of your personal information is important to us. We employ a number of organizational, technical and physical safeguards designed to protect the personal information we collect. However, security risk is inherent in all internet and information technologies and we cannot guarantee the security of your personal information.

Retention

We retain personal information for as long as necessary to fulfill the purposes for which we collected it, including for the purposes of satisfying any legal, accounting, or reporting requirements, to establish or defend legal claims, or for fraud prevention purposes.

To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means, and the applicable legal requirements.

When we no longer require the personal information we have collected about you, we will either delete or anonymize it or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible. If we anonymize your personal information (so that it can no longer be associated with you), we may use this information indefinitely without further notice to you.

International data transfers

We are headquartered in the United States and may have service providers in other countries. Accordingly, your personal information may be transferred to the United States, or other locations outside of your state, province, or country, where privacy laws may not be as protective as those in your state, province, or country. European Union users should read the important information provided below about transfer of personal information outside of the European Union.

Children

The Service is not directed to, and we do not knowingly collect personal information from, anyone under the age of 18. If a parent or guardian becomes aware that his or her child has provided us with information without their consent, he or she should contact us. We will delete such information from our files as soon as reasonably practicable. We encourage parents with concerns to contact us.

Changes to this Privacy Policy

We reserve the right to modify this Privacy Policy at any time. If we make material changes to this Privacy Policy, we will notify you by updating the date of this Privacy Policy and posting it on the Service. We may, and if required by law will, also provide notification of changes to this Privacy Policy using additional methods that we believe are reasonably likely to reach you, such as via e-mail (if you have an Enphase Account where we have your contact information).

Any modifications to this Privacy Policy will be effective upon our posting the new terms and/or upon implementation of the new changes on the Service (or as otherwise indicated at the time of posting). In all cases, your continued use of the Service after the posting or effective date as stated in the notification of any modified Privacy Policy indicates your acceptance of the terms of the modified Privacy Policy.

How to contact us

You may direct any questions or comments about this Policy or our privacy practices to our privacy office and your communication will be handled by our privacy team (including what is sometimes referred to as a Grievance Officer, Data Protection Officer, or Privacy Officer). Our privacy office may be contacted by:

• Clicking on the Privacy link, Settings/Do Not Sell My Personal Information link, or SecurePrivacy trust badge at the bottom of any website;

• Emailing privacy@enphaseenergy.com; or

• Calling us toll free at 1-877-797-4743 and selecting option 3;

• Sending postal mail to:
  Enphase Energy, Inc.
  Attn: Legal – Privacy
  47281 Bayside Pkwy
  Fremont, CA 94538

Important information for United States residents

This section applies only to United States residents. It describes how we collect, use and share Personal Information of United States residents in operating our business, and their rights with respect to that Personal Information. For purposes of this section, “Personal Information” has the broadest interpretation of that term or any analogous term in any of the California Privacy Rights Act, Virginia Consumer Data Protection Act, Colorado Privacy Act, Utah Consumer Privacy Act, and Connecticut Data Privacy Act.

Your privacy rights. Depending on your state of residence, you may have the rights listed below. However, these rights are not absolute, and in certain cases we may decline your request as permitted by law.

• Information. You can request the following information about how we have collected and used your Personal Information during the past 12 months:

  • The categories of Personal Information that we have collected.

  • The categories of sources from which we collected Personal Information.

  • The business or commercial purpose for collecting and/or selling Personal Information.

  • The categories of third parties with whom we share Personal Information.

  • Whether we have disclosed your Personal Information for a business purpose, and if so, the categories of Personal Information received by each category of third-party recipient.

  • Whether we’ve sold your Personal Information, and if so, the categories of Personal Information received by each category of third-party recipient.

• Access/data portability. You can request a copy of the Personal Information that we have collected about you during the past 12 months, including in a format that is easily understandable and, to the extent technically feasible, in a structured, commonly used, machine-readable format.

• Deletion. You can ask us to delete the Personal Information that we have collected from you.

• Opt-out of sales. In conducting the Service, we do not “sell” your Personal Information in the traditional sense of transferring Personal Information in return “for monetary or other valuable consideration" without your specific consent or instruction. We may share identifying information and performance data about your system to developers using our API, or to users of the Enphase App, upon your written consent. Because your consent and actions in relation to those developers/users are a deliberate interaction directing us to provide this information to the developer/user we do not consider this sharing a “sale,” but because we are not always privy to the consent that you provide the developer/user or the nature of those interactions, in some cases our transfer of data may be classified as a “sale” under law. We also may provide your personal information to installers or their partners for the purpose of introducing that installer or partner to you, but only when you consent or instruct us to do so. Additionally, in certain circumstances, for example when the installer of your existing system is no longer available, we will pass on your contact information and site information to a follow-on installer to service your system at your direction. You may nonetheless submit a request to opt-out. In addition, if you direct us not to sell your Personal Information, we will consider it a request pursuant to California’s “Shine the Light” law to stop sharing your personal information covered by that law with third parties for their direct marketing purposes.

• Opt-out of sharing. We use certain advertising services that help deliver an improved advertising experience to you, such as providing interest-based ads to you. We allow these services to collect information from our website users (specifically, online identifiers and browsing activity) and they use this data to serve interest-based ads to you. You may submit a request to opt-out of such sharing.

• Correction. You may request that we update or correct inaccuracies in your Personal Information.

• Appeal. If we decline to take action on your data subject request for any reason, we will provide you a written statement of the reasons why; you are entitled to an appeal by contacting us with information relevant to the issue, or by contacting your state Attorney General or other privacy protection agency, which may take up the matter depending on your state of residence.

• Nondiscrimination. You are entitled to exercise the rights described above free from discrimination in the form of legally prohibited increases in the price or decreases in the quality of our Service.

How to exercise your rights

You may exercise your privacy rights by any of the methods listed in the “How to Contact Us” section above.

We reserve the right to confirm your residence to process your requests and will need to confirm your identity to process your requests to exercise your information, access/data portability, or deletion rights. We generally seek to validate your request without collecting any additional personal information and seek to rely for example on information we already have in our possession -- the email address from which you sent the request and/or a recent months’ energy usage. Consistent with law, you may designate an authorized agent to make a request on your behalf. To designate an authorized agent to make a request on your behalf, you must provide a valid power of attorney, the requester’s valid government-issued identification, and the authorized agent’s valid government-issued identification. We cannot process your request if you do not provide us with sufficient detail to allow us to understand and respond to it.

Personal information that we collect, use and share

The chart below summarizes our relevant data practices during the 12 months preceding the effective date of this Privacy Policy. Categories in the chart refer to the categories described above in the general section of this Privacy Policy.

Important information for European Economic Area residents

The information provided in this section applies only to individuals in the European Economic Area.

Personal information. References to “Personal Data” in this Privacy Policy are defined as “personal data” governed by European data protection legislation.

Controller and representative. Enphase is the controller of your Personal Data covered by this Privacy Policy for purposes of European data protection legislation.

Our representative in Europe is: Enphase Energy NL B.V., located at Het Zuiderkruis 65, 5215 MV ‘s -Hertogenbosch, The Hague, The Netherlands.

Legal bases for processing. We use your Personal Data only as permitted by law. Our legal bases for processing the Personal Data described in this Privacy Policy are described in the table below.

Use for new purposes. We may use your Personal Data for reasons not described in this Privacy Policy where permitted by law and the reason is compatible with the purpose for which we collected it. If we need to use your Personal Data for an unrelated purpose, we will notify you and explain the applicable legal basis.

Sensitive Personal Information. We ask that you not provide us with any sensitive Personal Data (e.g., information related to racial or ethnic origin, political opinions, religion or other beliefs, health, biometrics or genetic characteristics, criminal background or trade union membership) on or through the Service, or otherwise.

If you provide us with any sensitive personal information when you use the Service, you must consent to our processing and use of such sensitive Personal Data in accordance with this Privacy Policy. If you do not consent to our processing and use of such sensitive Personal Data, you must not submit such sensitive Personal Data through our Service.

Your rights

European data protection laws give you certain rights regarding your Personal Data . If you are located within the European Union, you may ask us to take the following actions in relation to your Personal Data that we hold:

• Access. Provide you with information about our processing of your Personal Data and give you access to your Personal Data.

• Correct. Update or correct inaccuracies in your Personal Data.

• Delete. Delete your Personal Data.

• Transfer. Transfer a machine-readable copy of your Personal Data to you or a third party of your choice.

• Restrict. Restrict the processing of your Personal Data

• Object. Object to our reliance on our legitimate interests as the basis of our processing of your Personal Data that impacts your rights.

• Instruction. Define instructions for the management of your Personal Data after your death.

• Withdraw your consent. You can withdraw your consent at any time. The withdrawal of consent is only effective for the future, i.e., the withdrawal shall not affect the lawfulness of processing on the basis of consent before its withdrawal.

You may exercise your privacy rights by any of the methods listed in the “How to Contact Us” section above. We may request specific information from you to help us confirm your identity and process your request.

Applicable law may require or permit us to decline your request. If we decline your request, we will tell you why, subject to legal restrictions. If you would like to submit a complaint about our use of your personal information or our response to your requests regarding your Personal Data, you may contact us or submit a complaint to the data protection regulator in your jurisdiction. You can find your data protection regulator here.

If we serve as a processor for a controller in the European Economic Area processing your Personal Data, then you may contact us for a list of sub-processors on whom we rely and share your Personal Data.

Cross-border data transfer

If we transfer your personal information out of Europe to a country not deemed by the European Commission to provide an adequate level of Personal Data protection, the transfer will be performed:

• We rely on standard contractual clauses which have been entered into between our European entities as data exporters and other group companies as data importers

• Rarely, if at all, we rely on Pursuant to GDPR Article 49 derogations, including the consent of the individual to whom the Personal Data pertains, as necessary for the performance of a contract, or for compelling legitimate interests upon confirmation that such legitimate interests are not overridden by your interests or rights and freedoms

• We may in the future rely on other permitted bases as allowable by applicable European requirements

• You may contact us if you want further information on the specific mechanism used by us when transferring your Personal Data out of Europe, for identification of data importers and their identity/contact details, or for other information related to our data transfer mechanisms

Important information for Australian and New Zealand users

The information provided in this “Notice to Australian and New Zealand Users” section applies only to individuals in Australia and New Zealand. This notice supplements and must be read in conjunction with our Privacy Policy.

Personal information. References to “personal information” in this Privacy Policy have the same meaning as in the Privacy Act 1988 (Cth) or Privacy Act 2020 (NZ) (as applicable) (collectively the “Privacy Laws”) and include any information about an identifiable individual.

Sensitive information. We ask that you not provide us with any “sensitive information.” Examples of sensitive information include (without limitation, and by way of example only) information about an individual’s racial or ethnic origin, political opinions, religious beliefs or affiliation, sexual orientation, criminal record or health information.

If you do provide us with sensitive information, it will be used and disclosed by us only for the purposes for which it was provided, or a directly related secondary purpose, unless you agree otherwise or for other specific reasons such as if the use or disclosure of this information is required by law.

Anonymity and pseudonyms. You have a right to use a pseudonym or to remain anonymous in your dealings with us and/or the Service. However, if you do not provide us with the personal information that we request, our ability to provide you with access to the Service or to handle your enquiry, request, complaint or other communication may be diminished.

Cross border disclosure. Any personal information which you provide to us may be transferred to, stored by or disclosed to an overseas recipient in order to provide the Service and our products to you (this includes storage of data on servers which are located overseas). The recipient may be in a jurisdiction that does not offer similar protections to the Privacy Laws. You expressly authorise us to disclose your personal information to overseas recipients for such purposes.

In order to protect your personal information, we take care to work with service providers and third parties who we consider maintain acceptable privacy and data security standards and compliance. In addition, we will take reasonable steps to ensure that the recipient does not breach Privacy Laws when handling your personal information.

Managing personal information. You may:

• request access to your personal information that we hold, subject to any limitations at law; and

• request us to correct information about you that you believe is inaccurate, incomplete or out of date,

• by writing to us at the contact details below.

• If you are located in New Zealand, you may also contact us by submitting a request through the ‘AboutMe’ tool offered by the Office of the Privacy Commissioner for New Zealand accessible via the following link https://www.privacy.org.nz/tools/aboutme-request-my-info-tool/.

We may require you to verify your identity before giving you access to, or correcting, your personal information.

We will respond to requests within a reasonable period after the request is made. There is no charge to make a request, however we may charge a reasonable fee to cover the administrative costs of retrieving your personal information.

In certain circumstances, we may refuse, or be unable, to correct or provide you with access to your personal information. In these circumstances, we will write to you to explain the reasons why this is the case.

Data breach. Where an unauthorised disclosure of, access to or loss of, personal information has occurred, we will act in accordance with our plan for responding to such an incident. If we determine that a reportable data breach has occurred in accordance with the Privacy Laws, we will report it to (as applicable):

• the Office of the Australian Information Commissioner; and/or

• the Office of the New Zealand Privacy Commissioner,

and any other entity or person, including affected individual(s), if required under Privacy Laws or other governing rules.

Queries. If you have a question or wish to make a complaint regarding how we handle your personal information, you may contact us using the details below. We will respond within a reasonable time and will use best endeavours to investigate and resolve the issue. This may involve requesting further information from you. If we need additional time, we will notify you of this (and reasons for the delay) and seek to agree a reasonable revised timeframe with you.

If we cannot resolve a complaint related to your personal information, you may direct your complaint to:

• the Office of the Australian Information Commissioner as detailed on https://www.oaic.gov.au/privacy/privacy-complaints/; or

• to the Office of the Privacy Commissioner for New Zealand as detailed on https://privacy.org.nz/your-rights/making-a-complaint/.

Contact details. We can be contacted and you may exercise your privacy rights by any of the methods listed in the “How to Contact Us” section above.

For more information about privacy issues in Australia and New Zealand, please visit www.oaic.gov.au or www.privacy.org.nz.

Important information for Mexico users

According to Mexican legislation, you have the right to Access your personal data, request the correction or update of your personal data (Rectification); request that we delete your personal data in situations where this is possible (Cancellation); oppose the processing of your personal data for voluntary purposes or under other legitimate grounds (Opposition) (“ARCO Rights”). Likewise, you may limit the use and disclosure of your personal data or revoke the consent you have provided us for the processing of your personal data without retroactive effects.

The individual concerned can exercise these rights by contacting Enphase via the “How To Contact Us” section above.