SEMT (Sustainable Energy Management Technology) B.V. – Energy Butler
Version 2026-09-03. Last updated 3 September 2026. This version replaces the undated policy previously published at energy-butler.eu/privacy-policy/.
Dutch and EU law applies.
About us
This privacy policy applies to SEMT (Sustainable Energy Management Technology) B.V., a private limited company (besloten vennootschap) registered in the Netherlands. We develop and operate Energy Butler, a software-based energy-management and optimisation service for businesses, and we install and support the equipment it runs on.
| Legal name | SEMT (Sustainable Energy Management Technology) B.V. |
|---|---|
| Trade names | SEMT, Energy Butler |
| KVK number | 97705640 |
| Establishment number | 000062912844 |
| Address | Nieuwe Gracht 3, 2011 NB Haarlem, Netherlands |
| Privacy contact | office@semt.work |
| Entity type | Besloten Vennootschap (B.V.) |
We are the controller for the personal data described in this policy. We have not appointed a data protection officer, because the nature and scale of our processing do not require one; all privacy questions and requests go to office@semt.work.
1. Introduction
SEMT B.V. (“we”, “us”, “our”) follows a data-minimisation approach: we collect only the personal data needed to provide our services, we keep it no longer than the periods stated in section 6, and we never sell it.
This policy covers:
- our website energy-butler.eu, including the contact form;
- our sales, contracting and support relationship with business customers;
- the Energy Butler platform: the customer app at app.energy-butler.eu, the operator back office at manager.energy-butler.eu, wall displays (kiosk mode) and the Energy Butler edge device installed at a site.
It explains what data we process, why, with whom we share it, how long we keep it and what rights you have, in accordance with the General Data Protection Regulation (GDPR) and the Dutch implementation act (UAVG).
2. Whose data we process
- Business contacts: people who contact us, request a quotation or act for a customer in a contract.
- Platform users: people with an Energy Butler account, whether they registered themselves, were invited by their organisation or were set up by our staff during onboarding.
- Site occupants: the Energy Butler measures and controls the energy installation of a site. Where a site is a home or a small premises, its energy readings can be associated with the people who live or work there. We treat site energy data with the same care as account data for that reason.
3. What personal data we collect
Depending on your relationship with us, this may include:
Contact and account data
- name, e-mail address, telephone number, business address, job title and company name;
- account credentials (passwords are stored only in hashed form by our identity service, never in readable form), language preference, notification preferences and the e-mail address or channel address you choose for alerts;
- sign-in sessions: when a session was opened and last used, and the browser type, so that you can see and end your own sessions.
Contract and billing data
- the legal name and address of the buyer an invoice is addressed to, VAT number, subscription plan, term and renewal settings, invoices and payment status;
- payments are handled by our payment provider. We receive and store only the payment reference, mandate reference and payment outcome. We never receive or store card numbers or bank account details.
Site and installation data
- site name, address and geographic coordinates, installation details, connected device types and their configuration;
- credentials for device vendor accounts or local device interfaces that you provide so the Energy Butler can read from and control your equipment. These are stored encrypted and are only used for that purpose.
Energy data
- readings from meters, inverters, batteries and other connected equipment, at intervals down to a few seconds while the site is live;
- the aggregates, forecasts, optimisation plans and control commands we derive from those readings;
- a log of commands sent to your equipment and of who requested them.
Platform operation data
- an audit trail of administrative actions (for example a role change, a subscription change or an erasure), recording who did what and when by identifier only, never the content of personal fields;
- technical logs of the platform and of the edge device, which may contain IP addresses and device identifiers.
Website data
- contact form submissions: name, e-mail address, telephone number, company name, quantity of interest and your message;
- your cookie consent choice.
We do not collect special categories of personal data and we do not build marketing profiles.
4. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Answering enquiries, preparing quotations, concluding and performing contracts, installation and after-sales support | Contract, or steps before a contract (art. 6(1)(b) GDPR) |
| Providing the platform: accounts, sign-in, the customer app, alerts and service e-mails | Contract (art. 6(1)(b)) |
| Reading and controlling your energy installation, producing forecasts, plans and savings figures | Contract (art. 6(1)(b)) |
| Invoicing, payment collection and dunning | Contract (art. 6(1)(b)) and legal obligation (art. 6(1)(c)) |
| Bookkeeping and tax records | Legal obligation (art. 6(1)(c)), Dutch fiscal law |
| Security: authentication, access control, audit trail, abuse and fraud prevention, incident response | Legitimate interest (art. 6(1)(f)) in keeping the platform and your installation safe |
| Processing the personal data of a business customer’s staff who use the platform | Legitimate interest (art. 6(1)(f)) in performing our contract with their employer |
| Optional website cookies, if any are introduced | Consent (art. 6(1)(a)), which you can withdraw at any time |
Automated optimisation controls equipment, not people. We make no decisions about you based solely on automated processing that produce legal effects or similarly significant effects for you (art. 22 GDPR).
Our services are not directed at children. We do not knowingly process the personal data of anyone under 16.
5. Sharing personal data
We do not sell personal data and do not share it for commercial purposes. Data is shared only where necessary, with the following categories of recipients, each bound by a data processing agreement or by law:
Processors acting on our instructions
- TransIP B.V. (Netherlands): hosting of the platform and delivery of our service e-mails.
- Signet B.V. (Netherlands): hosting of the website.
- Mollie B.V. (Netherlands): payment processing. Mollie receives the name and e-mail address of the paying customer and the payment amount.
- CookieYes Limited (United Kingdom, covered by the EU adequacy decision): the cookie consent banner on our website and the record of your choice.
Independent services we exchange data with
- Device manufacturers whose cloud or local interfaces we connect to with the credentials you provide (for example the vendors of your inverter, battery or meter). They process your data under their own terms.
- Weather forecast services receive the coordinates of your site, without any identity, to produce solar forecasts.
- An address geocoding service receives the address you enter during onboarding to resolve its coordinates.
- Energy market price sources receive no personal data.
Others
- Professional advisers such as accountants or legal advisers, bound by confidentiality.
- Authorities, only when required by law.
All hosting and storage is in the Netherlands. Where data is transferred outside the European Economic Area, we rely on an adequacy decision or on Standard Contractual Clauses.
6. Retention periods
We keep personal data only as long as needed for the purpose, or as long as the law requires. The periods below are the maximums we apply.
| Data | Retention |
|---|---|
| Account data | For the life of the account. When an account is erased on request, the person’s identifiers are anonymised immediately; the account record itself remains as an anonymous placeholder because other records refer to it. |
| Sign-in sessions | Until you sign out, or 30 days after last use. |
| Contracts, invoices, payment references and billing correspondence | 7 years after the financial year concerned (Dutch fiscal law). These survive an erasure request under art. 17(3)(b) GDPR. |
| Raw energy readings | 1 month. |
| Hourly energy aggregates | 1 year. |
| Daily energy figures and savings history | 5 years, or until the site is deleted. |
| Optimisation plans, commands, device diagnostics and update records | 30 to 90 days. |
| Audit trail | For as long as we operate the platform. It holds identifiers and field names only, never personal values, so an erasure leaves nothing personal in it. |
| Technical and security logs | 30 days. |
| Database backups | 14 days on the production host and 30 days off-site. Data erased from the platform disappears from every backup within 30 days. |
| Contact form submissions and pre-contract correspondence | 12 months after the last contact, unless a contract follows. |
| Cookie consent record | 13 months. |
A site that is archived or deleted at your request has its energy data removed at that moment, except for the daily figures needed to substantiate invoices already issued.
7. Cookies
Website. Our website uses only functional cookies that are strictly necessary for it to operate, plus the cookie consent banner’s own cookie that remembers your choice. We do not place tracking or marketing cookies. Should we introduce optional cookies, they will be placed only after your explicit consent, which you can change at any time via the banner.
Platform. The customer app and the back office set strictly necessary cookies only: your sign-in session, your language choice, interface state such as a collapsed menu, and a short-lived authorisation cookie for live updates. There are no analytics or advertising cookies in the platform.
The website loads no third-party resources other than the cookie consent script.
8. Security
We implement appropriate technical and organisational measures, including:
- encrypted connections (TLS) everywhere, and mutual certificate authentication between an edge device and the platform;
- device vendor credentials encrypted at rest;
- role-based access control with least privilege, separate customer and operator applications, and an append-only audit trail;
- invoices, payment records and erasure records that cannot be altered once written;
- nightly backups with restore verification, hosted in the Netherlands;
- intrusion detection on our production systems.
If a personal data breach poses a risk to your rights and freedoms, we will notify the Autoriteit Persoonsgegevens within 72 hours of becoming aware of it and inform affected individuals where required.
9. Your rights
Under the GDPR you have the right to:
- access: obtain a copy of the personal data we hold about you;
- rectification: have inaccurate data corrected;
- erasure: have your data deleted, subject to the legal exceptions in section 6;
- restriction: have us limit how we process your data;
- portability: receive the data you provided in a machine-readable form;
- object: object to processing based on our legitimate interests;
- withdraw consent: where processing is based on consent, at any time, without affecting the lawfulness of processing before withdrawal.
How to exercise them
- Platform users can download a copy of their personal data from the account settings of the customer app at any time.
- Every other request goes to office@semt.work or to our postal address in section 12. We will confirm your identity, and we will respond within one month. Where a request is complex we may extend this by two further months and will tell you why.
- If you use the platform through your employer, your employer may also hold data about you; direct requests concerning that data to your employer.
You also have the right to lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens, at autoriteitpersoonsgegevens.nl.
10. Business customers and data processing agreements
For account, contract and platform-operation data, SEMT is the controller. Where a business customer requires SEMT to process personal data on its behalf and under its instructions, a data processing agreement under art. 28 GDPR is available on request from office@semt.work.
11. Updates to this policy
We may update this policy. Each version carries a version number and the date it was last updated, and the current version is always available at energy-butler.eu/privacy-policy/. Where a change materially affects platform users, we announce it in the app or by e-mail at least 30 days before it takes effect. When you create an account or activate a subscription, we record which version you were shown.
12. Contact
For questions, requests or complaints about this policy or our data processing:
SEMT (Sustainable Energy Management Technology) B.V.
Nieuwe Gracht 3, 2011 NB Haarlem, Netherlands
office@semt.work