Lumo Privacy Policy

1. Who we are

Lumo Energy Limited ("Lumo", "we", "us") is the controller of your personal data. We are registered in England and Wales under number 14958748, and our registered office is 39 Aberdeen Avenue, Cambridge, CB2 8DL. We are registered with the Information Commissioner's Office under number ZC258980.

For any question about your data, or to exercise your rights, email hello@lumoenergy.co.uk. We have not appointed a data protection officer.

2. What we collect

Account details.

Your email address and, if you sign up with Google, the name on your Google account. Your password is held by our sign-in provider in a form we cannot read.

Your home.

Your postcode, the approximate location it resolves to, your electricity grid region and a name you give your home.

Your solar and battery system.

Details of your solar panels, battery, inverter and how they are set up, for example their size, make and model, the direction and angle of your panels, and how much they are expected to generate. These come from you, from your devices, or from our own calculations using your system's data.

Your devices.

When you connect a device, we receive information about it: make, model, battery capacity and operating limits, and a continuous record of how it runs. That record includes your battery's charge level and charging and discharging, your solar generation, how much electricity your home uses, and how much you import from and export to the grid, typically at intervals of a few minutes. We never receive your device manufacturer password.

Your tariff.

The tariff and rates you tell us about, or that we look up for you from your supplier's published prices.

How we run your system.

The schedules we plan, the instructions we send to your battery, the results of control tests, and your savings and reward calculations.

Flexibility and rewards.

If you join Lumo Grid Rewards ("Grid Rewards"): your meter point numbers (the reference numbers for your home's electricity import and export, which you or your installer give us), your battery's confirmed size and reward band, the days on which your battery was active, and the rewards you have earned and been paid. You give your bank details through a secure link from our payment provider, Stripe, which holds them and pays your reward into your bank account. We do not store your bank details.

Referral.

If you arrived through an installer's link, a reference to that installer.

Support and communications.

Messages you send us, and a record of the service emails we send you.

Technical data.

Our servers record your IP address and browser type each time the app contacts them, in logs we use to keep the service running and secure. When something goes wrong in the app, we may also receive an error report that can include your browser and device type and a masked recording of the screen, with all text hidden and images blocked, leading up to the error.

Acceptance records.

Which version of our Terms of Service and this policy you have accepted or read, when, and the browser you used.

How you use the app.

Which screens and features you use, and how you move through the app. We use this to see how the app is used and to improve it. We do not use it to advertise to you.

We do not knowingly collect special category data, such as health data. Detailed household energy data can reveal patterns about when a home is occupied, and we protect it accordingly.

3. Where your data comes from

Most of it comes from you. We also receive:

• device information and readings from your device manufacturer, through our device connectivity provider, once you connect a device;
• your name from Google, if you sign up with Google;
• published tariff prices from energy suppliers;
• a referral reference from your installer, if you signed up through their link, and any details about you that you agreed they could pass to us;
• the results of the flexibility your battery provided, and your meter's registration status, from our trading partner, if you join Grid Rewards; and
• confirmation of your reward payments from our payment provider, Stripe.

4. What you need to give us

To use Lumo you need to give us an email address and connect at least one supported device. We need your postcode and tariff to forecast your solar and work out your savings; without them, parts of the service will not work. Grid Rewards needs your meter point number and, to pay you, your bank details, which you give to our payment provider. Everything else is optional.

5. Why we use it, and our lawful basis

To provide the service you signed up for (performance of our contract with you): creating your account, connecting and controlling your devices, forecasting, planning your battery schedule, showing you your energy use and savings, and paying rewards.

To sell your battery's flexibility and pay your reward, if you join Grid Rewards (performance of our contract with you): registering your home with our trading partner and sharing your meter point numbers and the baseline and deviation data that show how much flexibility your battery provided, so that the flexibility your battery provides can be sold and settled.

To keep the service working and secure (our legitimate interests in running a reliable and safe service): monitoring errors, investigating problems, preventing fraud and misuse, and keeping records of what instructions we sent and why.

To pay your installer for referring you (our legitimate interests in running our installer referral scheme): telling the installer whose link you signed up through that you have signed up, whether you have joined Grid Rewards and your battery size band, so that we can pay them a referral payment.

To let your installer look after your system (our legitimate interests, and your installer's, in keeping your system working well): sharing your system's status and performance with the installer whose link you signed up through. You can object at any time, and we will stop.

To improve Lumo (our legitimate interests in developing our service): analysing how the service performs, including the accuracy of our forecasts and control, and training and testing the models we use to forecast and run batteries, using combined data wherever we can.

To see how the app is used (our legitimate interests in improving the service): storing a small amount of information in your browser and collecting statistics about how the app is used. You can switch this off in the app at any time, and we will stop. We do not use this information to advertise to you.

To keep in touch (performance of our contract, or our legitimate interests): service emails about your account, your devices and your rewards, including reminders to finish setting up.

Marketing (your consent): we will only send you marketing emails if you have agreed to receive them. You can withdraw your agreement at any time using the link in each email or in the app.

To meet legal obligations (legal obligation): keeping financial records of reward payments, and responding to lawful requests.

To show what you agreed to (our legitimate interests in being able to evidence our agreement with you): keeping a record of the terms you accepted.

Combined data. We combine data from many homes into totals, for example the pooled volume of flexibility we sell each half hour, forecast accuracy and performance statistics. Totals that cannot identify you are not personal data, and we may use and share them.

6. Automated decisions

Lumo decides automatically when to charge and discharge your battery, within the limits you set. These decisions run your equipment; you can see them in the app and switch Lumo Tariff Optimisation off at any time.

Your Grid Rewards band is set automatically from your battery's confirmed size, and your reward is worked out automatically from your annual rate and the days your battery was active, as explained in the Grid Rewards Terms. Because this affects how much we pay you, we treat it as a significant decision made by automated means. Whether your battery is eligible for Grid Rewards is decided through the electricity market's registration process, which our trading partner carries out, and we will always contact you before ending your Grid Rewards because your battery was not active on enough days.

For that decision, and any other decision we make about you, you can:

• ask us for information about how it was made;
• tell us why you think it is wrong;
• ask for a person at Lumo to review it; and
• challenge the outcome.

Email hello@lumoenergy.co.uk to do any of these.

7. Who we share it with

We do not sell your personal data. We share it only as needed with:

• Providers that run our systems for us: cloud hosting and databases, sign-in, email delivery, customer support and account management, error monitoring, software development support, and the AI tools our staff use to investigate and fix problems. They act only on our instructions, under contract, and are based in the UK, the European Economic Area or the United States.

Enode, our device connectivity provider, based in Norway, which links your devices to Lumo using the access you give through your manufacturer's app, and passes our instructions to them. It acts on our instructions, except for the connection screen it runs, where it is responsible for its own processing under its own privacy notice.

Stripe, our payment provider, which collects your bank details and pays your rewards into your bank account. Stripe also carries out its own checks, for example to prevent fraud and meet its legal duties, and is responsible for that processing under its own privacy notice.

Our trading partner, if you join Grid Rewards: the trading partner that sells your battery's flexibility on our behalf, based in the UK. It is a registered party to the electricity market's settlement rules, trades your battery's flexibility through its own registered units and is responsible for its own processing of your data under those rules. We send our trading partner your meter point numbers and the baseline and deviation data that show how much flexibility your battery provided, which our trading partner submits to Exelon, the operator of the electricity market's settlement system. Our trading partner can also see your home's electricity settlement data, to the extent its role under those rules allows.

Forecasting and location services, in the UK and the European Economic Area, which receive your postcode or approximate location and your solar panel details, but never your name or contact details.

Usage statistics. We collect these statistics ourselves, or we use a provider to collect them for us. If we use a provider, we use one whose terms allow it to use the information only to produce those statistics for us. That provider may be Google, in the United States. The information is not used for advertising.

Your installer, that you have signed up, whether you have joined Grid Rewards and your battery size band, so that we can pay them a referral payment; and whether your system is connected and how it is performing, including its health, solar generation and battery use, so that they can look after your system. Our agreement with your installer allows it to use this information only for those purposes. You can ask us to stop sharing performance information at any time by emailing hello@lumoenergy.co.uk.

Professional advisers, regulators and law enforcement, where the law requires it or to protect our rights.

Investors and buyers: if we raise investment, or sell or reorganise all or part of our business, prospective investors, buyers and their advisers under strict confidentiality, and any buyer, who must continue to protect your data in line with this policy.

If you would like the names of the organisations we share your data with, email hello@lumoenergy.co.uk and we will tell you.

8. International transfers

Our databases are hosted in the European Union. Some of our providers, including those for sign-in, email delivery, customer relationship management, usage statistics, error monitoring, payments and AI tools, process data in the United States.

For transfers to the European Economic Area we rely on UK adequacy regulations. For the United States we rely on the UK Extension to the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses. Email us for a copy of the safeguards that apply to your data.

9. How long we keep it

• Account and device details: while your account is open, and deleted within 90 days after it closes, including from our analytics copies, and from our backups as they are overwritten in the normal cycle, during which we will not use it.
• Detailed device and energy data (other than the flexibility and settlement records below): 24 months (or 90 days after your account closes, if sooner), after which we keep only totals that no longer identify you.
• App usage statistics: the detailed record for 90 days, and daily totals for 13 months. We delete the detailed record within 90 days if you switch this off or close your account.
• Flexibility and settlement records, including the baseline and deviation data we send our trading partner: six years after the period they relate to.
• Reward and payment records: six years after the end of the financial year they relate to, as required for tax and accounting.
• Acceptance records: while your account is open and for six years after it closes, in case of a dispute.
• Error reports: 90 days.
• Server logs, including IP addresses: 30 days.
• Support messages: two years after the conversation ends.

10. Your rights

You have the right to:

• ask for a copy of the personal data we hold about you;
• ask us to correct data that is wrong;
• ask us to delete your data, where we no longer need it;
• object to processing based on our legitimate interests, and to object at any time to marketing;
• ask us to restrict how we use your data;
• ask for data you gave us in a portable format;
• withdraw consent, where we rely on it; and
• the protections for automated decisions described in section 6.

Email hello@lumoenergy.co.uk to use any of these rights. We will respond within one month, or tell you within that month if we need up to two more months because your request is complex. Some rights have limits: for example, we must keep reward payment records even if you ask us to delete your account.

If you are unhappy with how we handle your data, you can complain to us by emailing hello@lumoenergy.co.uk. We will acknowledge your complaint within 30 days, look into it, keep you updated and tell you the outcome. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

11. Security

Your data is encrypted in transit and at rest. Access is limited to Lumo staff who need it, using individual accounts, and the providers in section 7 under a contract for the purposes of this policy. We never store your device manufacturer passwords. No system is completely secure, and if a breach affects you we will tell you as the law requires.

12. Other people in your home, and children

Your home's energy data reflects the routines of everyone who lives there. Please let the people you live with know that you use Lumo, and point them to this policy.

Lumo is for adults. You must be 18 or over to have an account, and we do not knowingly collect data about children.

13. Cookies and device storage

The app stores a small amount of information in your browser: to keep you signed in, to remember your progress through signup, to remember which messages you have already seen, and to detect and record errors so we can fix them. This storage is strictly necessary for the service you asked for, or to detect faults in it, and does not need your consent.

We also store a small amount of information in your browser, which may be in a cookie, to collect statistics about how you use the app, so that we can improve it. This is separate from the storage described above. You can switch it off in the app at any time, free of charge. If you do, we stop collecting these statistics. The app works in the same way either way. We do not use this information to advertise to you.

If you arrive through an installer's link, the app keeps that installer's reference in your browser until you finish signing up, or for up to 60 days, so that the installer is credited for referring you.

The app does not use advertising or cross-site tracking. Our website has its own cookie policy.

14. Changes to this policy

We will update this policy when what we do changes. Each version is dated. If a change is significant, we will tell you in the app before it takes effect and ask you to confirm you have read it.