Privacy policy

This is a translation for convenience. The German version (Datenschutzerklärung) is legally binding.

This privacy policy applies to the website sunandcharge.app and to the use of the JEVis energy monitoring software (JEVis Control Center, web service and related services) that we operate at this address.

1. Controller

Sun and Charge Germany GmbH
Blohmstr. 31
21079 Hamburg
Germany

Managing director: Nils Heinrich
E-mail: info@sunandcharge.com

2. Hosting

The website and the JEVis server run on a cloud server of

Hetzner Online GmbH
Industriestr. 25
91710 Gunzenhausen
Germany

The server is located in a data centre within the European Union. Hetzner processes the data on our behalf under a data processing agreement according to Art. 28 GDPR. More information: https://www.hetzner.com/legal/privacy-policy.

3. Visiting the website and server log files

When you visit the website or download the JEVis launcher or installer, the server processes technically necessary data, in particular the IP address, date and time of access, the requested page or file, browser type and version, and operating system.

The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest is the secure and reliable provision of the website and the software. The data is only kept as long as necessary for error analysis and defence against attacks and is then deleted.

4. SSL/TLS encryption

The website and the connections of the JEVis software to the server are SSL/TLS encrypted. You can recognise an encrypted connection by “https://” in the address bar of your browser.

5. Cookies and tracking

This website does not use cookies, analytics or tracking services, or third-party content. Fonts are loaded from our own server.

6. Use of JEVis

To use JEVis you need a user account that we or your company create for you. We process:

• Account data: user name, first and last name, e-mail address, groups and permissions.
• Login data: your password is stored only as a hash (Argon2id). If two-factor authentication is enabled, its secret is stored encrypted.
• Sessions: after login the software receives an access token. If you choose “stay signed in”, an additional token is stored on your device, valid for 30 days by default. For each token we store the time of last use and the IP address and client identifier (user agent) of the login, so that you and we can recognise and end active sessions. Tokens are stored only as hashes.
• Protection against misuse: failed login attempts are counted. After several failed attempts the account is locked temporarily; failed attempts per IP address are kept in memory for a few minutes.
• Activity log: logins (with the software version) and changes to objects and data are logged with your user account. Entries older than one year are deleted automatically.
• API keys: API keys can be created for services and interfaces. They are stored only as hashes.

The processing is necessary for the performance of the contract with you or your company (Art. 6 (1) (b) GDPR) and is based on our legitimate interest in secure operation (Art. 6 (1) (f) GDPR).

Sign-in with Microsoft: if your company uses sign-in via Microsoft Entra ID, you are redirected to Microsoft for login. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Microsoft transmits your display name and group memberships to us, which are used to match your JEVis user account. Processing may also take place outside the EU; for this Microsoft relies among other things on the EU-US Data Privacy Framework. More information: https://privacy.microsoft.com/en-gb/privacystatement.

Metering and energy data: we process the metering, energy and master data stored in JEVis on behalf of our customers. The respective contract and, where applicable, the data processing agreement with your company apply.

7. Contact

If you contact us by e-mail, we process your details to handle your request. If the request concerns the initiation or performance of a contract, the legal basis is Art. 6 (1) (b) GDPR, otherwise Art. 6 (1) (f) GDPR.

8. Storage period

Unless a specific storage period is stated in this privacy policy, we keep personal data only as long as necessary for the respective purpose. Account data is deleted after the end of use or of the contract. Where statutory retention obligations apply, the data is kept for their duration and then deleted.

9. Your rights

Subject to the legal requirements you have in particular the following rights:

• right of access according to Art. 15 GDPR
• right to rectification according to Art. 16 GDPR
• right to erasure according to Art. 17 GDPR
• right to restriction of processing according to Art. 18 GDPR
• right to data portability according to Art. 20 GDPR
• right to object according to Art. 21 GDPR
• right to withdraw consent according to Art. 7 (3) GDPR

To exercise your rights, please contact info@sunandcharge.com.

10. Right to lodge a complaint

According to Art. 77 GDPR you have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes the GDPR. The authority responsible for us is the Hamburg Commissioner for Data Protection and Freedom of Information (https://datenschutz-hamburg.de/).

11. Changes to this privacy policy

We update this privacy policy when the data processing, the software or the legal requirements change.

As of: October 2026