Privacy Policy

Last updated: 29 September 2026

1. Who we are

AYA BV, with registered office at Ninovesteenweg 198, 9320 Aalst, Belgium, registered with the Crossroads Bank for Enterprises under company number 0817.805.218, is the controller of the personal data described in this policy.

As controller, we decide why and how your personal data is processed. For any question about this policy or about your personal data, write to info@aya.energy or by post to the address above.

2. What this policy covers

This policy applies to our website www.aya.energy, to the forms, newsletters, market updates, webinars and downloads offered through it, and to the personal data we process about contact persons at clients, prospects, partners and suppliers, and about job applicants, in the course of our energy advisory, energy management and energy solutions services.

Our clients are companies. Most of the data we handle is company data. This policy covers the part that relates to people: contact persons, and company data that can be linked to a person, for example the energy data of a sole trader.

This policy does not cover websites of other organisations that we link to. See section 14.

3. What personal data we collect

3.1 Data you give us

• Contact and identification data: name, job title, company, email address, telephone number.
• The content of the messages, requests and questions you send us.
• Registration data for newsletters, market updates, events, webinars and downloads.
• Contract, project and correspondence data if you are a contact person at a client, partner or supplier.
• Site and energy data if you are a client: connection point numbers (EAN), meter and consumption data, energy contracts and energy invoices.
• Application data if you apply for a job with us: CV, cover letter and related correspondence.

You are never obliged to give us personal data. Where we need data to enter into or perform a contract, or to answer your request, we tell you. Without that data we may not be able to help you.

3.2 Data we collect automatically

• Technical data: IP address, browser and device type, operating system, language settings.
• Usage data: pages viewed, time on page, the website that referred you, campaign parameters, links clicked.
• Email engagement data: whether a newsletter or market update was opened and which links were clicked.

Most website data is collected with cookies and similar technologies, and only with your consent where the law requires it. See section 6.

3.3 Data we receive from other sources

• Business contact data from Apollo.io, a business contact database, and from public sources such as company websites and the Crossroads Bank for Enterprises. We use this to keep our records accurate and our contacts relevant.
• Information about which company visits our website, through the Apollo.io website tracker, only if you accept marketing cookies.
• Energy data from your grid operator, energy supplier or metering service provider, where you authorise us to access it for our services.

We do not deliberately collect special categories of personal data, such as data about health, political opinions or religious beliefs. Please do not send us such data.

4. Why we use your personal data, and on what basis

We process personal data only where the GDPR gives us a legal basis. The table sets out each purpose, the data involved, the legal basis and how long we keep the data.

Purpose	Data	Legal basis	Retention
Answering questions and contact forms	Name, company, job title, email, phone, content of your message	Art. 6(1)(b) GDPR: steps before a contract, at your request. Art. 6(1)(f) GDPR: our legitimate interest in answering business questions.	2 years after the last contact
Delivering our services and managing the client relationship	Contact details, contracts and correspondence, site and energy data (EAN, meter and consumption data, energy contracts), invoicing data	Art. 6(1)(b) GDPR: performance of the contract. Art. 6(1)(c) GDPR: legal obligations for invoicing and bookkeeping.	Duration of the contract, then 10 years (Belgian accounting law and the limitation period for contract claims)
Newsletters and market updates	Name, company, email, opens and clicks	Subscribers: Art. 6(1)(a) GDPR, consent. Contacts at existing clients: Art. 6(1)(f) GDPR, our legitimate interest in informing clients about similar services, with the right to object in every email.	Until you unsubscribe or withdraw your consent
Events, webinars and downloads	Name, company, job title, email, registration and attendance data	Art. 6(1)(b) GDPR: to provide what you registered for. Art. 6(1)(f) GDPR: our legitimate interest in following up with participants.	2 years after the event or download
Business development	Business contact data, company and role, history of our contacts	Art. 6(1)(f) GDPR: our legitimate interest in contacting companies that may benefit from our services, by phone, on professional networks or at events. For email, see section 5.	2 years after the last contact
Website analytics and marketing cookies	IP address, device and browser data, pages viewed, referring website, campaign parameters, company recognition	Art. 6(1)(a) GDPR: consent through the cookie banner.	Analytics data: 14 months. Cookies: see our Cookie Policy
Recruitment	CV, cover letter, contact details, application correspondence	Art. 6(1)(b) GDPR: steps before an employment contract, at your request. Talent pool: Art. 6(1)(a) GDPR, consent.	6 months after the procedure ends. Talent pool: 2 years, with your consent
Security and legal claims	Server and access logs, correspondence relevant to a claim	Art. 6(1)(f) GDPR: our legitimate interest in protecting our systems and defending our rights. Art. 6(1)(c) GDPR where the law requires it.	Logs: 12 months. Claims: until settled, plus the legal limitation period

Where we rely on our legitimate interest, we have balanced that interest against your rights and interests. You can ask us for more information about this balance at any time.

5. Marketing communications

We send newsletters and market updates by email to people who subscribed, and to contact persons at our existing clients about services similar to the ones they use.

We do not send marketing emails to people who are not our clients and who have not subscribed.

Every marketing email contains an unsubscribe link. You can also ask us to stop by writing to info@aya.energy. Unsubscribing does not affect the service and contract messages we need to send you.

6. Cookies and similar technologies

Cookies are small files that a website stores on your device. Some are needed to make the website work. Others help us understand how the website is used or support our marketing.

Before you make a choice in the cookie banner, we only use strictly necessary cookies. Analytics, marketing and functional cookies are only used after you give consent.

Category	What it does	Basis
Strictly necessary	Keeps the website secure and working, and remembers your cookie choice.	No consent required
Analytics	Shows which pages are used and how visitors arrive, so we can improve the website. Google Analytics, through Google Tag Manager.	Consent
Marketing	Links website visits to forms you submit (HubSpot) and recognises the company behind a visit (Apollo.io).	Consent
Functional	Remembers preferences, such as a form you already filled in.	Consent

Our Cookie Policy lists every cookie with its name, provider, purpose and storage period. You can change or withdraw your choice at any time through the cookie settings on our website, or by deleting cookies in your browser. If you block cookies, parts of the website may not work as intended.

7. Who we share your personal data with

We do not sell your personal data and we do not make it public. We share it only where needed, with:

• Service providers that process personal data on our behalf under a written data processing agreement. The main ones are listed below.
• Professional advisers such as accountants, auditors and lawyers, where needed for their work for us.
• Public authorities, courts or regulators, where the law requires us to disclose data.
• A buyer or successor, in case of a reorganisation, merger or transfer of our business.

Our main service providers are:

Provider	Used for	Location of processing
HubSpot	CRM, marketing automation, website forms and cookie banner	EU data centre; access from the United States possible
Mailchimp (Intuit)	Newsletters and market updates	United States
Google (Analytics, Tag Manager)	Website analytics and tag management	EU and United States
Apollo.io	Business contact data and recognition of companies visiting our website	United States
Microsoft 365	Email, documents and internal collaboration	EU and United States
Odoo	Invoicing and bookkeeping	EU
Website hosting provider	Hosting of www.aya.energy	See section 9
Webinar and event registration tools	Webinars and event registrations	Depends on the tool; see section 9

8. How long we keep your personal data

We keep personal data only as long as we need it for the purpose for which we collected it, or as long as the law requires. The retention periods are in the table in section 4. When a period ends, we delete the data or make it anonymous so that it can no longer be linked to you.

9. Transfers outside the European Economic Area

Some of our service providers are established outside the European Economic Area (EEA), or can access data from outside it. In that case we transfer personal data only with a safeguard under Chapter V of the GDPR: an adequacy decision of the European Commission (including the EU-US Data Privacy Framework for certified companies), or the Standard Contractual Clauses of the European Commission, with additional measures where needed.

You can ask us for a copy of the safeguard that applies to a specific transfer by writing to info@aya.energy.

10. How we protect your personal data

We take appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, disclosure and alteration. These include access only for staff who need the data for their work, encrypted connections, secured systems with backups, and confidentiality obligations for our staff and service providers.

If a personal data breach occurs, we report it to the Data Protection Authority, unless the breach is unlikely to create a risk for you. If the breach is likely to create a high risk for you, we also inform you directly. We do this in line with Articles 33 and 34 GDPR.

11. Your rights

Under the GDPR you have the following rights:

Right	What it means
Access	Ask us whether we process your personal data, and receive a copy of it.
Rectification	Ask us to correct personal data that is inaccurate or incomplete.
Erasure	Ask us to delete your personal data where one of the grounds in Article 17 GDPR applies, for example when we no longer need it or when you withdraw your consent.
Restriction	Ask us to keep your data but stop using it for a time: while we check whether the data is accurate, while we assess your objection, if the processing is unlawful but you do not want the data deleted, or if we no longer need the data but you need it for a legal claim.
Objection	Object to processing based on our legitimate interest, and to direct marketing. See section 12.
Portability	Receive the personal data you gave us, which we process on the basis of your consent or a contract, in a structured and machine-readable format, and have it sent to another controller where technically possible.
Withdraw consent	Withdraw your consent at any time. This does not affect processing that took place before the withdrawal.
Complaint	Lodge a complaint with a data protection authority.

To exercise any of these rights, write to info@aya.energy. We answer within one month. If your request is complex or we receive many requests, we can extend this by two months, and we will tell you. We may ask for information to confirm your identity before we act.

If you are not satisfied with how we handle your personal data, you can lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit), Drukpersstraat 35, 1000 Brussels, contact@apd-gba.be, www.dataprotectionauthority.be. You can also complain to the authority in the country where you live or work.

12. Your right to object

You can object at any time, for reasons related to your situation, to processing that we base on our legitimate interest. We then stop, unless we have compelling legitimate grounds that override your interests, or we need the data for a legal claim.

You can object at any time to the use of your data for direct marketing. We then stop without exception.

To object, write to info@aya.energy, or use the unsubscribe link in any marketing email. Objecting never affects your right to use our services.

13. Automated decisions

We do not take decisions about you based solely on automated processing that produce legal effects for you or affect you in a similarly significant way.

14. Links to other websites

Our website contains links to websites of other organisations. We do not control those websites and are not responsible for their content or for how they handle personal data. Please read the privacy policy of each website you visit.

15. Changes to this policy

We update this policy when our services or the applicable rules change. The version on our website is always the current one. The date at the top shows when it was last changed. We will point out significant changes on our website and, where appropriate, by email.

16. Contact

AYA BV

Ninovesteenweg 198, 9320 Aalst, Belgium

Company number: 0817.805.218

Email: info@aya.energy