Privacy Policy
Last updated: 15 September 2026
This policy explains how Plug and Play Energy SLU processes personal data obtained through pnp.energy, its forms, customer area, online shop, events, training sessions and communications concerning its products and services.
1. Data controller
Plug and Play Energy SLU · Tax ID B02968386
C. Moble, 4A (Número 30), 46469 Beniparrell (Valencia), Spain
· +34 960 43 11 53 · https://pnp.energy
2. Data we process
Depending on our relationship, we may process identification and contact details; professional and company data; account data; information about enquiries, quotations, orders, payments, invoicing, deliveries, warranties and support; event registrations; communications; and browsing, device, IP address, preference and online identifier data. Please do not provide special-category data unless strictly necessary and expressly requested.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Handle enquiries, support and quotation requests. | Pre-contractual steps or management of your request (Art. 6(1)(b) GDPR). |
| Manage accounts, orders, deliveries, returns, warranties and the business relationship. | Performance of a contract (Art. 6(1)(b) GDPR). |
| Invoicing, accounting, tax duties and official requests. | Compliance with legal obligations (Art. 6(1)(c) GDPR). |
| Manage registrations and attendance at events or training. | Performance of the requested registration (Art. 6(1)(b) GDPR). |
| Security, fraud prevention and defence of legal claims. | Legitimate interests (Art. 6(1)(f) GDPR). |
| Requested marketing communications. | Consent (Art. 6(1)(a) GDPR). |
| Inform customers about similar products or services of our own. | Legitimate interest in direct marketing and the applicable Spanish e-commerce law exception, always with a right to object or unsubscribe. |
| Analytics, campaign attribution and advertising using non-essential technologies. | Consent (Art. 6(1)(a) GDPR and Art. 22.2 LSSI). |
You may withdraw consent at any time without affecting the lawfulness of prior processing.
4. Source and required data
Data mainly comes from the data subject, their company or representative, website forms and transactions, and communications with us. Required fields are necessary to process a request or provide a service. Data must be accurate, current and provided with proper authority.
5. Recipients
Where necessary and legally justified, data may be disclosed to public authorities; banks and payment providers; carriers; manufacturers and technical services; advisers, auditors and insurers; and technology, hosting, email, CRM, analytics and marketing providers acting as processors. We do not sell personal data.
6. International transfers
Some providers may process data outside the European Economic Area. We will rely on an adequacy decision, Standard Contractual Clauses or another valid safeguard. Google and LinkedIn should only be activated in line with cookie preferences. See the privacy policies of Google and LinkedIn.
7. Retention
- Enquiries without a contract: up to 12 months after closure, unless needed for liability purposes.
- Customers, orders and contracts: for the relationship and subsequent statutory periods.
- Business and tax records: for statutory periods, generally six and four years respectively, without prejudice to longer periods.
- Warranties and claims: while handled and for the relevant limitation periods.
- Events: while managed and up to 12 months afterwards, unless another relationship or legal basis applies.
- Marketing: until consent is withdrawn or you unsubscribe.
- Cookies: for the period stated in the Cookie Policy or until consent is withdrawn.
8. Your rights
You may exercise your rights of access, rectification, erasure, objection, restriction and portability, and withdraw consent, by writing to or the address above. State the right requested and provide only the information needed to verify your identity. You may also complain to the Spanish Data Protection Agency or your local supervisory authority.
9. Children, automated decisions and security
The website is intended for professionals and businesses, not children. We do not make decisions producing legal or similarly significant effects based solely on automated processing unless expressly stated in a specific case. We apply appropriate technical and organisational security measures.
10. Cookies and updates
Non-essential cookies should only be enabled with consent. Review and change your preferences in the Cookie Policy. We may update this policy when processing activities or the law change.