Privacy policy

Last updated: 28 July 2026

This Privacy Notice explains how Vidis GmbH processes personal data when you visit the UK-facing Sunpura website at https://sunpuraenergy.co.uk, submit an enquiry, contact product support or otherwise communicate with us.

This Notice primarily applies to the website and its information and enquiry functions. The Sunpura app, connected energy systems and other digital products may have separate privacy notices made available within the relevant service.

1. Who is responsible for your personal data?

The controller responsible for the processing described in this Notice is:

Vidis GmbH
Wilhelm-Iwan-Ring 9
21035 Hamburg
Germany
Telephone: +49 40 2190 713 10
Email: contact@sunpuraenergy.com

“Sunpura” is the brand and website name used on the UK-facing pages. Vidis GmbH operates those pages and is the controller for the processing described below.

2. What personal data do we process?

The data we process depends on how you interact with the website and with us.

2.1 Website and technical data

When you visit the website, technical information may be processed to deliver the pages securely and reliably. This may include:

• IP address;
• date and time of access;
• pages and files requested;
• referring URL;
• browser type, browser version and operating system;
• device, language, country and time-zone settings;
• technical identifiers, session information and security events;
• information required to diagnose errors and protect the website against misuse.

2.2 Enquiry and contact data

When you submit an enquiry or contact us, we may process:

• your name and preferred form of address;
• email address and telephone number;
• country or general location, where relevant to your enquiry;
• the products, systems or accessories you are interested in;
• the content of your message and any attachments;
• your preferred language and method of contact;
• our correspondence and internal handling notes.

2.3 Product support and technical-service data

If you contact us about a Sunpura product that you obtained through another market, reseller or sales channel, we may process:

• product name, model and serial number;
• invoice, order reference or proof of purchase, where required;
• description of the issue;
• photographs, videos, error codes and status indicators;
• app, system or device information that you choose to provide;
• repair, replacement, collection or return information;
• correspondence, call notes and case status.

We only request technical information that is reasonably necessary to understand and handle the enquiry. Do not send passwords, full bank credentials or unrelated sensitive information.

2.4 Newsletter and marketing preferences

If a newsletter or other marketing sign-up is made available and you choose to subscribe, we may process your email address, subscription date, consent record, preferences, engagement information and opt-out status.

Marketing messages are sent only where permitted by applicable law. You can unsubscribe at any time using the link in the message or by contacting us.

2.5 Reviews, testimonials and submitted content

If you send us a review, testimonial, photograph or video, we process that content to review and respond to your submission. We publish personal content only where we have an appropriate legal basis and, where required, your specific permission.

2.6 Future order and payment data

The UK-facing website does not currently accept orders or payments.

If UK online sales are enabled in the future, or if a separate distance-sales contract is validly concluded outside the website, we may process order, delivery, invoice, payment, cancellation, return, refund and customer-service information. Before accepting such an order, we will provide the required contractual and privacy information and update this Notice where necessary.

The payment method currently envisaged for any future UK sales is bank transfer. If that method is introduced, we may process the account-holder name, sending bank, account information shown on our statement, payment amount, booking date, payment reference and refund status. We do not currently collect credit-card or debit-card numbers through the UK-facing website.

3. Where do we obtain personal data?

We obtain personal data:

• directly from you, when you contact us, submit an enquiry, request support or provide content;
• automatically through the website, through essential server logs, security systems and strictly necessary technologies;
• from Shopify and its service providers, where required to host and secure the website;
• from a reseller, delivery provider or service partner, where necessary to investigate a product-support request and where the disclosure is lawful;
• from banks or logistics providers, only if a separate transaction or service arrangement is validly entered into.

4. Why do we use personal data?

Processing activity	Purpose	Lawful basis
Website delivery and security	Displaying the website, managing sessions, correcting errors and protecting the website against fraud, attacks and misuse.	Our legitimate interests in operating a secure and reliable website.
Product and compatibility enquiries	Responding to questions about products, compatibility, planned availability and technical requirements.	Steps taken at your request before a possible contract and our legitimate interests in responding to enquiries.
Product support	Diagnosing product issues, providing guidance and coordinating service where applicable.	Contract where we owe the service; legal obligation where statutory rights apply; otherwise our legitimate interests in customer support and product quality.
Newsletter or marketing	Sending requested updates and measuring communication performance.	Consent where required by the UK GDPR and the Privacy and Electronic Communications Regulations (“PECR”).
Reviews and testimonials	Reviewing, moderating and, where authorised, publishing submitted content.	Consent for agreed publication; legitimate interests for moderation and legal defence.
Legal compliance and claims	Complying with legal duties and establishing, exercising or defending legal claims.	Legal obligation and legitimate interests.

Where we rely on legitimate interests, those interests include operating a secure informational website, responding efficiently to genuine enquiries, preventing misuse, improving product support and protecting our legal rights.

5. Cookies and similar technologies

The UK-facing website currently uses technologies that are strictly necessary to provide, secure and maintain the website, remember essential settings and record your privacy choice.

Non-essential analytics, advertising, behavioural profiling and remarketing technologies are not currently activated for visitors to the UK-facing version of the website.

If non-essential technologies are introduced in the future, they will not be used before any consent required under PECR and the UK GDPR has been obtained. We will update this Notice and the Cookie Policy before activating them.

You can review the available categories and change your choices through the permanent “Cookie preferences” link in the footer.

For further details, see our Cookie Policy.

6. Shopify

The website is hosted and provided through Shopify. The EMEA contracting entity is generally:

Shopify International Limited
2nd Floor, Victoria Buildings
1–2 Haddington Road
Dublin 4, D04 XN32
Ireland

Shopify processes personal data on our behalf to host, secure and technically operate the website and the functions that we enable. For this processing, Vidis GmbH is the controller and Shopify acts as a processor.

Shopify may also process certain information for its own purposes, as explained in the Shopify Consumer Privacy Policy. Requests relating to processing for which Shopify is independently responsible may also be submitted through the Shopify Privacy Portal.

6.1 Shopify Network Intelligence

Shopify Network Intelligence and other enhanced Shopify advertising or cross-merchant personalisation features are not currently enabled for visitors to the UK-facing version of the website.

If these functions are enabled in the future, we will first update the relevant privacy and cookie information, assess whether additional UK compliance measures are required and obtain consent where applicable.

7. Google Tag Manager

Google Tag Manager may be used as a technical tag-management tool. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

For the UK-facing version, Google Tag Manager must not be used to activate analytics, advertising, remarketing or other non-essential tags. Any such tags must remain disabled unless and until the applicable consent and UK compliance requirements have been implemented.

8. Who receives personal data?

We disclose personal data only where this is necessary and lawful. Recipients may include:

• Shopify and its subprocessors;
• IT, hosting, security, email, communications and support providers;
• repair, technical-support and service providers where needed to handle a genuine product-support request;
• professional advisers, including lawyers, tax advisers, accountants, insurers and auditors;
• courts, regulators and public authorities where disclosure is legally required;
• authorised staff and service providers within our operating organisation where access is necessary for their role;
• banks, carriers or logistics providers only where a separate transaction or service arrangement is validly entered into.

Service providers acting only on our instructions are contractually bound to protect personal data. Other recipients may act as independent controllers where they determine their own purposes and means.

We do not sell personal data.

9. International transfers

Vidis GmbH is established in Germany. Personal data relating to the UK-facing website may therefore be processed in Germany and elsewhere in the European Economic Area.

Shopify and other technology providers may process personal data in additional countries. Where the UK GDPR rules on restricted transfers apply and the destination is not covered by UK adequacy regulations, an appropriate safeguard is used, such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, binding corporate rules or another permitted transfer mechanism.

10. How long do we keep personal data?

We keep personal data only for as long as necessary for the relevant purpose. We then delete or anonymise it unless legal retention duties, evidence requirements or ongoing claims require longer retention.

Data category	Retention approach
Technical and security data	For as long as required to operate and secure the website, investigate errors and respond to security incidents.
General enquiries	Until the enquiry is completed and afterwards only for as long as needed for evidence, limitation periods or legal defence.
Support and technical-service information	During the handling of the request and afterwards until relevant warranty, limitation and evidence periods expire.
Marketing consent and objections	For as long as needed to provide the requested communication and demonstrate compliance with your consent or objection.
Submitted reviews and content	Until the content is deleted, consent is withdrawn where applicable or the publication purpose ends, unless a lawful reason requires longer retention.
Future transaction records	If a separate contract is concluded, transaction, accounting and payment records will be kept for the periods required by applicable tax, accounting and legal rules.

11. Do you have to provide personal data?

You do not have to provide information simply to browse the public pages of the website, other than technical data required to deliver and secure them.

We need certain information to answer a specific enquiry or provide product support. If you do not provide that information, we may be unable to handle the request.

Providing information for marketing or other optional purposes is voluntary.

12. Automated decision-making

We do not make decisions based solely on automated processing that produce legal effects or similarly significant effects for visitors to the UK-facing website.

Automated security signals may be used to identify suspicious traffic for human or technical review.

13. Your data-protection rights

Subject to applicable conditions and exemptions, you may have the right to:

• be informed about how your personal data is used;
• request access to your personal data;
• request correction of inaccurate or incomplete data;
• request erasure of personal data;
• request restriction of processing;
• receive or transfer certain data in a portable format;
• object to processing based on legitimate interests;
• object at any time to direct marketing;
• withdraw consent for future processing;
• complain to the Information Commissioner’s Office.

To exercise your rights, email contact@sunpuraenergy.com. We may request proportionate evidence of identity to prevent unauthorised disclosure.

14. Withdrawing consent and changing preferences

You may withdraw consent at any time for future processing. This does not affect processing carried out before withdrawal.

You can change cookie choices through “Cookie preferences” in the footer. Marketing messages, if offered, will also include an unsubscribe mechanism.

15. Complaints

You may raise a concern with us using the contact details below. You may also complain to the UK supervisory authority:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
United Kingdom
Website: https://ico.org.uk/make-a-complaint/

16. Security

We use technical and organisational measures appropriate to the risks, including encrypted transmission, role-based access, multi-factor authentication where appropriate, logging, access controls, backups and confidentiality obligations.

No electronic system is completely risk-free. Please use only the designated contact channels when sending information that may be sensitive.

17. Children

The website is not directed at children. We do not knowingly collect personal data from children who cannot lawfully provide the information or valid consent. A parent or guardian may contact us if they believe a child has provided personal data unlawfully.

18. External websites and social media

The website may contain links to external websites, video platforms, social networks or other services. When you open an external link, the relevant provider processes information under its own responsibility and privacy notice.

19. If UK sales are introduced

Before enabling a UK basket, checkout, payment function or regular email-order process, Vidis GmbH will review and update this Privacy Notice and the related Cookie Policy, Terms and Conditions, shipping information and cancellation information.

The review will include whether a UK representative must be appointed under Article 27 of the UK GDPR, which service providers and international-transfer safeguards apply, and which order, payment, delivery and return data will be processed.

20. Changes to this Notice

We may update this Notice when the website, Shopify configuration, service providers, processing activities or legal requirements change. The current version is published on this page.

21. Contact

Vidis GmbH
Wilhelm-Iwan-Ring 9
21035 Hamburg
Germany
Email: contact@sunpuraenergy.com
Telephone: +49 40 2190 713 10

For product-service and technical-support enquiries, contact service@sunpuraenergy.com.