Privacy policy

The data controller is Weber Energy Partners (CVR 45856488), a Danish sole proprietorship owned by Oscar Weber, which operates Symbolon. Address: Langemosevej 30, 2880 Bagsværd, Denmark. Questions about this policy, or about your data: contact@symbolon.energy.

Symbolon is a business-to-business platform. The personal data we handle belongs to people acting for companies: users with an account, business contacts we reach out to about PPAs, and anyone who visits the site.

• Account users: name, work email, phone (optional), company name, country, industry and a short company description. The listings you create, and the message you write when you express interest in a listing.
• Business contacts: name, job title, company, work email or phone where available, the public LinkedIn profile address, headline and location, notes on our conversations, and a record of what we sent and when.
• Booking a call: your name, work email, company, the time you chose and anything you write about what you would like to talk about.
• The contact form: your name, email, company (optional) and message. They go by email straight to Oscar Weber’s inbox and are not stored on the site; the email stays in the inbox like other business correspondence.
• The coverage check: hourly consumption data you load is worked on in your own browser and is not sent to us. If you choose to save your profile on a demand listing, we store the shape of your year (how your consumption is spread over the hours, not the meter readings) with that listing, to score matches and offers. Other companies only see how well their offer covers you, never your hourly data, and you can remove it again. An electricity bill you upload is read by an AI to find your annual consumption and price area, and is not stored.
• Everyone who visits: our server logs the IP address, time, requested page and browser type of each request. We also count how many people visit each page, ourselves and without cookies: your IP address and browser type are turned into a one-way code with a key that changes every day, and the address itself is not kept. We also note which country the address belongs to, looked up in a list on our own server, and keep only how many visitors each country had. We use no other analytics and no tracking — see the cookie policy.
• Passwords are handled by our login provider Supabase — we never see or store them ourselves.

If we contact you without you having signed up, we found your name and role on LinkedIn (including LinkedIn Sales Navigator), your company's website or public company registers. We only look for people whose role is plausibly related to buying or selling electricity.

• Running your account and the marketplace — matching listings, showing public listings to other users, and writing to you about your account. Basis: the contract you enter into when you create an account (GDPR art. 6(1)(b)).
• Introducing buyers and sellers. When you express interest in a listing, or someone expresses interest in yours, the broker passes your name and contact details to the other side so the two companies can talk. This is the service you signed up for (art. 6(1)(b)). Nobody sees the other side's identity on the platform itself.
• Holding the call you booked — sending you the invitation and meeting you at the agreed time. Basis: steps you ask us to take before a possible agreement (art. 6(1)(b)).
• Contacting businesses about PPAs — our legitimate interest in offering a relevant business service to people whose job it concerns (art. 6(1)(f)). You can object at any time, and we will stop.
• Security — server logs are kept to detect and stop abuse and attacks. Basis: our legitimate interest in keeping the platform and its data safe (art. 6(1)(f)).
• Visitor numbers — counting visits tells us which pages are useful. Basis: our legitimate interest in improving the platform (art. 6(1)(f)). The count cannot be used to recognise you from one day to the next.

Matching on the platform only ranks listings by how well their terms fit. It makes no decision about you that has legal or similarly significant effects.

We do not sell personal data or pass it on for anyone else's marketing. Besides the introductions described above, data is handled by these providers on our behalf:

• Hostinger — the server that runs the platform and its database, in Frankfurt, Germany.
• Supabase — login, and the emails that confirm your account and reset your password.
• Google — our email and calendar (Google Workspace), which send the booking invitation, and Google Meet, where the call takes place.
• Anthropic — the AI (Claude) that reads an electricity bill, if you choose to upload one for the coverage check. The bill is sent to Anthropic to be read and we do not keep it. Anthropic does not use it to train its models and deletes it within 30 days.
• GitHub — stores a nightly backup of the database. The backup is encrypted on our server before it is sent, so GitHub cannot read it.

Supabase, Google, GitHub and Anthropic are US companies. Where data may be accessed from outside the EU/EEA, the transfer relies on the EU–US Data Privacy Framework or the European Commission's standard contractual clauses. LinkedIn is its own data controller for messages we exchange there.

• Accounts: for as long as the account is open. When you delete it, your name, email and phone are erased straight away. If you were the last user from your company, the company name, company description and the text of its listings and messages are erased too, and its listings are taken off the marketplace. What remains — such as that a listing for 10 years of baseload once existed — can no longer be tied to you, and is kept only as statistics.
• Business contacts who never become customers: deleted 12 months after our last contact, unless a conversation is still going. If you ask us not to contact you, we keep only your LinkedIn profile address or email, and only so we can make sure we never contact you again.
• Booked calls: deleted from the platform 90 days after the call. The invitation and any emails stay in our mailbox and calendar like other business correspondence.
• Server logs: overwritten automatically once they reach a fixed size — normally within a few weeks, sooner when traffic is high.
• Visitor numbers: the daily codes are deleted when the day is over, together with their key, and the codes are never included in backups. What remains is how many visitors and views each page had per day, and how many visitors came from each country.
• Backups: deleted after 90 days at the latest. Data you have had erased can therefore live on in an encrypted backup for up to 90 days. Should we ever have to restore one, we erase it again before the platform goes back online.

If you ask for the Nordic PPA Barometer by email, we store your email address, the time you asked, and the time you confirmed by pressing the button in our confirmation mail. Nothing is sent before you confirm, and an unconfirmed request is deleted after 7 days. Basis: your consent. You get one mail per quarter, each with an unsubscribe link; unsubscribing deletes your address at once. We do not record where you opened the mails or the page from.

You have the right to access the data we hold about you, to have it corrected or erased, to restrict our use of it, to receive it in a machine-readable format, and to object to our use of it — including an unconditional right to object to being contacted for marketing. We answer within one month.

You can delete your account yourself under My profile. For everything else, write to contact@symbolon.energy.

You may also complain to the data protection authority in your own country — in Denmark Datatilsynet (datatilsynet.dk), in Norway Datatilsynet (datatilsynet.no), in Sweden IMY (imy.se) and in Finland the Data Protection Ombudsman (tietosuoja.fi).

All traffic is encrypted (HTTPS). Other users never see who is behind a listing. Access to the database is limited to the broker, and backups are encrypted before they leave the server.