We're software. We don't sell your data. We only access the device APIs needed to operate your home flexibility. This page lays out exactly what we collect, why, and how to remove it.
This Privacy Policy explains how Exegy Data Limited, trading as Driving Green ("we", "us", "our"), collects, uses and protects personal data when you visit drivinggreen.com (the "Site"). It complies with the EU General Data Protection Regulation 2016/679 ("GDPR"), the Irish Data Protection Act 2018 and Irish e-Privacy regulations (S.I. 336/2011).
The data controller for personal data collected through this Site is:
“Driving Green” is the trading name under which Exegy Data Limited markets and (on launch) will operate its Virtual Power Plant service. Wherever this Policy refers to “Driving Green” it means Exegy Data Limited acting under that trading name.
You provide personal data when you fill in a form on the Site. The specific fields depend on which form you complete:
The Site uses a small number of cookies and local-storage entries. None are used for cross-site tracking. See section 9 ("Cookies") for the full breakdown.
| What we do | Legal basis (GDPR Art. 6) |
|---|---|
| Generate your personalised Energy Score and store the result so you can refer back to it. | Performance of a contract / pre-contractual measures (Art. 6(1)(b)). |
| Add you to the Virtual Power Plant waitlist and notify you when rollout reaches your area or device. | Performance of pre-contractual measures at your request (Art. 6(1)(b)). |
| Send you the launch-readiness announcement and, where relevant, follow-up emails about the service you signed up for. | Legitimate interests (Art. 6(1)(f)) — keeping people who actively requested onboarding informed. For any unrelated marketing email we will ask for your consent (Art. 6(1)(a)). |
| Respond to partner enquiries you submit. | Legitimate interests (Art. 6(1)(f)) — handling a request you sent us. |
| Improve the Site, debug errors, and aggregate anonymous trends from poll responses. | Legitimate interests (Art. 6(1)(f)). |
| Detect and prevent fraud, abuse and security incidents. | Legitimate interests (Art. 6(1)(f)) and legal obligation (Art. 6(1)(c)). |
| Comply with legal, tax and accounting obligations. | Legal obligation (Art. 6(1)(c)). |
We do not sell your personal data, and we do not use it for automated decision-making that produces a legal effect on you.
We share personal data only with the specific service providers we need to operate the Site. Each is bound by a written Data Processing Agreement and may only process your data on our documented instructions.
| Processor | What they do for us | Region |
|---|---|---|
| Cloudflare, Inc. | Hosting, edge CDN, serverless functions and the SQL database (D1) where your form submissions are stored. Privacy policy. | EU region for stored data; global edge. |
| Webflow, Inc. | Content management system that publishes the marketing pages. Privacy policy. | US (SCCs apply). |
| Google Ireland Limited | Corporate email (Google Workspace) used when we reply to your enquiry or send you the launch announcement. | EU. |
| MailerLite / MailerSend | Transactional and announcement email delivery. Privacy policy. | EU (SCCs apply where relevant). |
We do not currently run third-party advertising or analytics pixels (e.g. Meta Pixel, Google Analytics 4) on the Site. If we add them in future, we will only fire them after you give consent through the cookie banner.
Cloudflare, Webflow, Google and MailerLite are international companies. Where personal data is transferred outside the European Economic Area (for example to the United States) the transfer is protected by appropriate safeguards, namely the EU–US Data Privacy Framework where the recipient is certified, and otherwise the European Commission's Standard Contractual Clauses. You may request a copy of those safeguards by contacting us at product@drivinggreen.com.
| Category | Retention |
|---|---|
| Energy Score submissions | 36 months from submission, then deleted automatically. If you become an active customer, retained for the customer relationship plus 7 years for legal/tax compliance. |
| Waitlist entries | 24 months from submission, then deleted automatically if you have not become an active customer. |
| Partner enquiries | 24 months from the last interaction. |
| Poll responses (anonymous) | Indefinitely in aggregate form; no personal identifiers attached. |
| Email correspondence | 3 years from the last message, then deleted unless retention is required by law. |
| Accounting records (invoices, payments) | 7 years (Section 886 Taxes Consolidation Act 1997). |
| Right | What it means | GDPR Art. |
|---|---|---|
| Access | Get a copy of the personal data we hold about you. | 15 |
| Rectify | Correct anything inaccurate or incomplete. | 16 |
| Erase | “Right to be forgotten” where the lawful basis no longer applies. | 17 |
| Restrict | Pause processing in certain circumstances. | 18 |
| Portability | Receive your data in a portable, machine-readable format. | 20 |
| Object | Object to processing based on legitimate interests, including direct marketing. | 21 |
| Withdraw consent | Withdraw anytime where processing is based on consent. | 7(3) |
| Complain | Lodge a complaint with the Irish supervisory authority (see section 11). | 77 |
To exercise any right above, email product@drivinggreen.com. We will respond within one month of receiving your request, as required by Article 12 GDPR. We may ask you to confirm your identity before acting on the request.
We use industry-standard technical and organisational measures to protect personal data, including: HTTPS encryption for all traffic, strong-random password protection on the internal admin dashboard, HTTP Basic Authentication with a 32-byte cryptographic password and a 30-minute idle timeout, server-side validation of every form submission, prepared SQL statements (to prevent injection), strict Content-Security-Policy headers, the use of Sub-Resource Integrity (SRI) hashes for every external script the Site loads, and daily off-site backups of the database. No system is perfectly secure; if a breach occurs we will notify the Data Protection Commission within 72 hours where required and affected individuals where there is a high risk to their rights.
| Category | Used today? | Purpose |
|---|---|---|
| Strictly necessary | Yes | Cookie-consent record, anti-bot detection (_cfuvid set by Cloudflare). Required for the Site to work; cannot be disabled. |
| Analytics | No (off by default) | If turned on in future: anonymous usage stats (no IP, no fingerprinting). Loaded only after you give consent. |
| Marketing | No (off by default) | If turned on in future: Meta Pixel, GA4 conversion measurement. Loaded only after you give consent. |
You can change your choice anytime by clicking Cookie settings in the footer of any page.
The Site is not directed at children under 18. We do not knowingly collect personal data from anyone under 16 (the Irish "digital age of consent" set by section 31 of the Data Protection Act 2018). If you become aware that a minor has provided us with personal data, please contact us and we will delete it.
If you are unhappy with how we have handled your personal data, please contact us first at product@drivinggreen.com — we will do our best to resolve the issue. You also have the right at any time to lodge a complaint with the Irish supervisory authority:
We may update this Privacy Policy from time to time. The "Last updated" date at the top of the page tells you when the policy was last revised. If we make material changes that affect how we use existing personal data, we will notify affected users by email before the change takes effect.
For any question about this Policy or how we handle your personal data, email product@drivinggreen.com or write to Exegy Data Limited (trading as Driving Green) at 18 Foxwood Drive, Rochestown, Cork, T12 YN5N, Ireland.
.png)