How we handle your data
1. Data controller
Voltira v/Zoran Knezic, CVR 38539019, Ålborggade 6, 3rd floor right, 8000 Aarhus C, Denmark, email kontakt@voltira.dk is the data controller for personal data processed on voltira.dk ("Voltira", "we").
2. What we process
- Free check without an account: the file you upload (and any stamdata), your type of home and the answer the calculation gives. If you check an offer (homes): the battery's size, the price and what the seller promised, as you type them in — deleted with the free answer after 48 hours; the file is sent again from your browser and deleted as soon as the calculation is done. To limit misuse we store an anonymous code of your IP address (a one-way code made with our own key — the IP address itself is not stored).
- Purchase: the email from the payment, amount, time, your choice to have the report delivered immediately, the metering point ID of the file you bought the report for (so you can recalculate) and a fingerprint (hash) of the file. We never see card details — Stripe handles them.
- Account: email, name, an encrypted (hashed) version of your password — never the password itself — and the time of your last login.
- Files you upload: your consumption from eloverblik.dk (metering point ID, timestamps, kWh) and optionally stamdata (e.g. address, grid company, connection capacity).
- Data from Eloverblik by power of attorney (if you choose it instead of uploading): with MitID you give Voltira access to your meters in Eloverblik. When you ask us to, we fetch the consumption (and any production) for about the last two years and the master data for the meters you gave access to — the same information as in a file you download yourself. The data goes straight on to your browser and is then handled exactly like an uploaded file; we keep no copy of what we fetched. The power of attorney lasts 3 months, and you can withdraw it at any time on eloverblik.dk. Basis: your request (Art. 6(1)(b)).
- Information you enter: e.g. customer category, grid company, connection, postcode, battery size and price.
- Your report: the results of the calculation, which may include some details from stamdata (e.g. address and grid company).
- In your own browser (not with us): after a free check your file is kept in your browser, so you can recalculate after a purchase without uploading it again. It is cleared automatically after 14 days, the next time you use the site, and you can always delete it by clearing your browser's data for voltira.dk.
- Technical logs: IP address and time of requests, for operations and security.
- Visit statistics without cookies: when you view one of our pages, we count the visit under an anonymous code computed from the IP address and browser type together with a random key that changes every day and is then deleted. The IP address itself is not stored, and the code cannot be traced back to you or linked across days. We also store which website you came from (domain only) and the number of logins.
- Anonymous calculation statistics: for each calculation we store one line of categories and ranges — e.g. home or business, price area, tariff category, yearly consumption in a range (e.g. 4,000–6,000 kWh), whether there are solar panels, where the grid connection came from, and which answer the calculation gave — and, for the free answer, whether it led to a purchase. The line holds no metering point ID, name, address, CVR, IP address, your file or your hour-by-hour consumption, and it cannot be traced back to you. We use it to check and improve the calculation's assumptions (legitimate interest, Art. 6(1)(f)).
3. Purposes and legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Providing the service: the free check, the report after purchase, recalculations and your account | Contract, Art. 6(1)(b) |
| Payment and emails about your purchase (link to the report, welcome, password reset) | Contract, Art. 6(1)(b) |
| Bookkeeping of purchases | Legal obligation (Danish Bookkeeping Act), Art. 6(1)(c) |
| Security, operations and preventing misuse (e.g. login attempts, limits on calculations, bot check) | Legitimate interest, Art. 6(1)(f) |
| Anonymous visit statistics: how many visit the site and how many go on to a report | Legitimate interest, Art. 6(1)(f) |
| Businesses: keeping the consumption (without metering point ID, name, address or CVR) to test and improve the model — only if you tick the box (in the battery calculation or the climate report); you can always ask us to delete it later | Consent, Art. 6(1)(a) (for companies this is normally not personal data) |
| Households: only if you tick the box — keeping your consumption to test and improve the model | Consent, Art. 6(1)(a) |
4. How long we keep data
- Uploaded files are deleted as soon as the calculation is done (normally within minutes).
- Free answers that aren't bought are deleted after 48 hours — together with the anonymous IP code.
- Reports are kept as long as you have an account and deleted no later than 30 days after the account is closed.
- Purchase records are kept for 5 years, as the Danish Bookkeeping Act requires.
- The file in your browser is cleared after 14 days (see section 2).
- Research data (only with consent — households and businesses alike): the consumption series (time + kWh), any solar surplus sold to the grid, anonymised context (zone, grid company, category, connection, period) and the result we calculated (so we can later check it against reality) are kept — without metering point ID, name, address or CVR — for at most 3 years, or until you opt out / withdraw consent. The data is pseudonymised: it can only be linked to you through an internal ID, which we use to delete it if you ask. In the climate report without a login we show a reference number you can send us to have the data deleted.
- Account details are kept until the account is closed. Backups are kept for 30 days. Logs for at most 30 days. Visit statistics for about 13 months.
5. Who we share data with
We never sell data or share it with others for their own purposes. We use these providers:
- one.com (data centres in the EU) runs the server as a data processor on our behalf.
- Stripe (Stripe Payments Europe, Ireland) handles the payment on its own page and sends the receipt. Card details go directly to Stripe. Stripe is itself a controller for parts of the processing (e.g. fraud prevention and legal requirements) — see Stripe's privacy policy.
- Brevo (France, EU) sends our emails (link to the report, welcome, password reset) as a data processor. Open tracking is anonymised, and links in emails are not rewritten.
- Cloudflare Turnstile is the bot check on the free-check page. Cloudflare receives technical information about your browser and your IP address to tell people from bots — not for advertising.
Stripe and Cloudflare are part of US groups, so data may be transferred to the USA. This happens under the EU-US Data Privacy Framework and/or the European Commission's standard contractual clauses. Market prices and tariffs come from public sources (Energinet / Energi Data Service, DataHub), and the solar calculation asks the EU's PVGIS about the sun at your postcode — neither involves disclosing your data. Apart from the bot check, the site uses no third-party fonts, scripts or analytics.
6. Cookies
We set only one cookie: a necessary login cookie that keeps you logged in (up to 14 days). The bot check and Stripe's payment page may use their own necessary cookies for security. No tracking or advertising cookies and no third-party analytics — our visit statistics (see section 2) work without cookies. That's why there is no cookie banner. In your browser we also keep your choice of language and light/dark theme and, after a free check, your file (see section 2).
7. Your rights
You have the right of access, rectification, erasure, restriction, data portability and to object. You can opt out of, or withdraw consent to, research data at any time; this does not affect processing before the withdrawal. Write to kontakt@voltira.dk; we reply within 30 days. You can complain to the Danish Data Protection Agency, Datatilsynet (datatilsynet.dk).
8. Security
All traffic is encrypted (HTTPS). Passwords are stored only as hashes. The server accepts key-based logins only, has a firewall and automatic security updates. Each user can see only their own reports.
9. Changes
If we make material changes we will update this page and the date above and notify registered users.