Legal

Privacy Policy

How Agentic Solar handles personal data on this website, for clients and in outreach, and what rights you have.

Last updated: 30 October 2026

This policy explains which personal data we process, why we do it, on which legal basis, who else receives it and how long we keep it. It covers people who visit this website, fill in our questionnaire, schedule a call or write to us, our clients and their staff, and the business contacts we write to when we run outreach for our clients. If you received an email from us, our outreach notice gives you the short version of that part.

Who is responsible

The controller under the General Data Protection Regulation (GDPR) is Agentic Solar, Vienna, Austria ("we", "us").

For anything about your personal data, write to nikon.mazur@agentic-solar.com.

Visiting this website

Hosting

This website is hosted by Vercel Inc., USA. When you open a page, your browser sends technical data to Vercel's servers: your IP address, the date and time of the request, the page you asked for, the page you came from, and your browser and operating system. Vercel needs this data to deliver the pages and to protect the site against attacks and abuse, and it keeps these logs only for a short time. Vercel processes this data on our behalf. The legal basis is our legitimate interest in a secure website that works (Art. 6(1)(f) GDPR). More in Vercel's privacy policy.

Fonts

The fonts on this website (Instrument Serif, Inter and JetBrains Mono) are loaded from Google Fonts at fonts.googleapis.com and fonts.gstatic.com, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. To deliver the font files, your browser connects to Google's servers, which receive your IP address and browser details. Google Fonts does not set cookies. The legal basis is our legitimate interest in showing the website the same way on every device (Art. 6(1)(f) GDPR).

Google Analytics

We use Google Analytics 4, a web analytics service of Google Ireland Limited, to understand how visitors use the website. It records which pages are viewed, how visitors move through the site and interact with it (for example scrolling and clicks on links), the device, browser and screen size used, and the approximate location at country and city level. When someone sends our questionnaire, Google Analytics records that it was sent together with the answer choices, but never the name, email address, company or website. According to Google, Google Analytics 4 does not store IP addresses. We do not use Google Analytics to identify you and we do not combine this data with other data about you.

Google Analytics uses cookies, which are listed in our cookie policy. The legal basis is your consent (Art. 6(1)(a) GDPR and § 165(3) of the Austrian Telecommunications Act 2021, TKG 2021). You can withdraw your consent at any time with effect for the future, as described in the cookie policy. Google keeps the event data linked to these cookies for at most 14 months. Data may be transferred to Google LLC in the USA, see "Transfers outside the EU" below. More in Google's privacy policy.

Videos

Our explainer video and case study videos are hosted by Wistia, Inc., USA. The Wistia player loads when you scroll close to a video. Wistia then receives your IP address and browser details and records how the video is played, for example whether it was started and how much of it was watched, which shows us whether the videos are useful. The Wistia player may store information in your browser for this. The legal basis is our legitimate interest in showing our videos and learning whether they help visitors (Art. 6(1)(f) GDPR) and, where information that is not strictly needed to play the video is stored in your browser, your consent (Art. 6(1)(a) GDPR and § 165(3) TKG 2021). More in Wistia's privacy policy.

Booking a call with Calendly

We use Calendly, a scheduling service of Calendly LLC, USA, to book calls. When you choose to schedule a call, this website sends you to our booking page on calendly.com. When you book, Calendly processes your name, your email address, the time you pick and anything you enter in the booking form, together with technical data such as your IP address, and sends the booking to us. If you come from our questionnaire, the link to Calendly already contains your name, your email address and your answer choices, so that you do not have to type them again and we see your answers next to your booking. We use this data to hold and prepare the call. The legal basis is taking steps at your request before a possible contract (Art. 6(1)(b) GDPR) and our legitimate interest in organising calls efficiently (Art. 6(1)(f) GDPR). Calendly sets its own cookies, see the cookie policy. More in Calendly's privacy policy.

Our questionnaire

Our short questionnaire at /fit asks what your company does, its revenue band, how many finished projects you can reference, which customers you want meetings with, your region, how many extra meetings your team can take and when you want to start, plus your name, email address, company and, if you want, your website. When you send it, a function on our Vercel hosting passes your answers to an automation workflow built with n8n, which emails them to our two founders, and the website then takes you to our booking page on Calendly as described above. We use your answers to check whether we can help you and to prepare the call. The legal basis is taking steps at your request before a possible contract (Art. 6(1)(b) GDPR) and our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). The n8n workflow runs on a virtual server that we rent from Hostinger [placeholder: server location of the n8n instance].

Visitor statistics

If you click Okay in the cookie notice, our website records which pages you open, which videos you play, how long you stay, the page that sent you to us, your browser and device type, your IP address and the approximate location that follows from it. A random visitor number is stored in your browser so that several visits can be seen together. If you also fill in the questionnaire, we can connect these visits with your answers. We use this to understand which companies are interested and to prepare better first calls. The data is processed by our hosting provider Vercel and stored in our own systems, and we keep it for at most 12 months. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time on our cookies page.

Writing to us

When you email us, we process your email address, your name and whatever you write to us, so that we can answer. The legal basis is taking steps at your request before a possible contract (Art. 6(1)(b) GDPR) or our legitimate interest in answering messages (Art. 6(1)(f) GDPR). Our mailboxes are hosted with Google Workspace (Google Ireland Limited).

Clients and their staff

When you work with us, we process the names, roles and business contact details of the people at your company we deal with, the details of our agreement, your target criteria, service area, offer and references, the email texts you approve, the meetings we book for you and the information needed for invoicing and payment. We use this data to deliver the service, to bill it and to keep our records. The legal basis is the performance of our contract (Art. 6(1)(b) GDPR), our legal obligations under tax and company law (Art. 6(1)(c) GDPR) and, for contact persons at your company, our legitimate interest in working with you smoothly (Art. 6(1)(f) GDPR).

How we split responsibility for prospect data with our clients is set out in our terms of business.

Business contacts we write to

For our clients, who are solar companies such as installers, roofers, developers, manufacturers, distributors and energy companies, we find decision makers at businesses that fit the client's criteria and write to them by email. This section explains how that works. The outreach notice says the same in shorter form.

Where the data comes from

We collect business contact data from public company websites, including their legal notices, contact and team pages, from public professional profiles on LinkedIn, from business data providers and from public company registers. Where it matters for the offer, we also use public data about a company's buildings, such as roof area and solar potential estimated from aerial imagery with services such as Google Maps Platform. Clients may also give us lists of businesses they do not want contacted, for example their existing customers.

Which data

We process your name, job title and role, the company you work for, your business email address, where available your business phone number and the address of your LinkedIn profile, information about your company such as industry, size, locations, projects and news, data about its buildings where relevant, the emails we send you, your replies, and whether you opted out or booked a meeting.

What we do with it

  • We check whether your company fits the criteria our client gave us and whether you are the right person to talk to.
  • We write a personal business email about the client's offer and may send a small number of follow ups. The emails are sent from separate sending domains that we set up and run for outreach, either in our name or in the name of the solar company we work for.
  • We read and answer replies. Some answers are written by an AI language model that we run within facts and limits set by us and our client, and our founders are notified about these conversations and can step in at any point.
  • If you ask for it, we send you a sample, for example an overview of roofs or leads around you.
  • If you want to talk, we check your interest against the client's criteria, book a meeting into the client's calendar, may ask you a few short questions before the call, and pass your details and answers to the client.

We do not sell personal data.

Legal basis

The legal basis is our legitimate interest and that of our clients in offering relevant products and services to businesses (Art. 6(1)(f) GDPR; recital 47 GDPR recognises direct marketing as a possible legitimate interest). We think this interest outweighs your interests because we only use business contact data, we only write to people whose role makes our client's offer relevant to them, we keep the number of emails small, and you can stop all contact at any time with a short reply. We inform you about this processing under Art. 14 GDPR with this policy and the outreach notice.

Your right to object

You can object to the use of your data for this outreach at any time, without giving a reason (Art. 21(2) GDPR). Reply to any of our emails, for example with "remove", or write to nikon.mazur@agentic-solar.com. We then stop contacting you, delete your data and keep only your email address on a block list so that none of our campaigns contacts you again.

How long we keep it

We keep prospect data while the campaign it belongs to is running. If you do not reply, or if a conversation ends without a meeting, we delete your data at the latest 12 months after the last contact. If a meeting is booked, the client receives your details and from then on handles them as its own controller. We keep the record that the meeting took place for as long as we need it to bill the meeting and for as long as tax law requires, which is seven years in Austria. If you opt out, we keep only your email address on our block list, for as long as we run outreach, so that you are not contacted again.

Who receives data

We share personal data only where it is needed for the purposes above. Recipients are:

  • Hosting providers for this website, its functions and our CRM, such as Vercel.
  • Google, for Google Analytics, Google Fonts, Google Workspace mailboxes and Google Maps Platform.
  • Wistia for videos and Calendly for bookings.
  • Hostinger, which provides the server for our n8n automation workflows.
  • For outreach: an email sending platform (such as Smartlead), mailbox providers for our sending domains, data enrichment providers (such as Apollo and Clay), AI language model providers (such as Anthropic) and the CRM in which we manage leads, conversations and bookings.
  • Our clients, who receive the details of people who agreed to a meeting with them.
  • Accountants, tax advisers and lawyers bound to confidentiality, and authorities and courts where the law requires it.

Service providers that process personal data on our behalf do so under a data processing agreement and only on our instructions (Art. 28 GDPR).

Transfers outside the EU

Several of our providers are based in the USA or use servers there, including Vercel, Google LLC, Wistia, Calendly and several of the outreach tools listed above. Where a provider is certified under the EU US Data Privacy Framework, the transfer relies on the adequacy decision of the European Commission of 10 July 2023 (Art. 45 GDPR). Where it is not, we rely on the Standard Contractual Clauses adopted by the European Commission (Art. 46(2)(c) GDPR). If you agree to meet a client that is based outside the EU, we pass your details to that client because you asked for the meeting (Art. 49(1)(b) GDPR).

How long we keep data

  • Hosting logs: a short time, as set by Vercel.
  • Google Analytics event data: at most 14 months. The cookies themselves expire after two years at the latest.
  • Enquiries, questionnaire answers and bookings: while we are in contact. If we do not start working together, we delete them at the latest 12 months after the last contact.
  • Client data: for the duration of our agreement and afterwards for as long as we may need it for legal claims. Invoices and accounting records: seven years, as required by § 132 of the Austrian Federal Fiscal Code (BAO) and § 212 UGB.
  • Prospect data: as described in "How long we keep it" above.

Your rights

You have the right to:

  • get a copy of the personal data we hold about you and information about how we use it (Art. 15 GDPR);
  • have incorrect data corrected (Art. 16 GDPR);
  • have your data deleted (Art. 17 GDPR);
  • have the processing restricted (Art. 18 GDPR);
  • receive data you gave us in a common, machine readable format where we process it on the basis of consent or a contract (Art. 20 GDPR);
  • object to processing based on our legitimate interest for reasons arising from your particular situation, and to direct marketing at any time without giving reasons (Art. 21 GDPR);
  • withdraw a consent at any time with effect for the future (Art. 7(3) GDPR).

To use these rights, write to nikon.mazur@agentic-solar.com. We answer within one month. If we need to confirm who you are before we hand out data, we will ask.

You also have the right to lodge a complaint with a data protection supervisory authority. In Austria this is the Österreichische Datenschutzbehörde, Barichgasse 40 to 42, 1030 Vienna, dsb@dsb.gv.at, www.dsb.gv.at. You can also turn to the authority in the EU country where you live or work.

AI and automated decisions

We use AI language models to help research companies, write emails and answer replies. We also sort companies by how well they fit a client's criteria. None of this leads to decisions that have legal effects on you or affect you in a similarly significant way, so Art. 22 GDPR does not apply. If you prefer to talk to a person, say so in your reply and one of our founders will answer.

Do you have to give us data?

You do not have to give us any personal data. Without your name and email address we cannot schedule a call with you or answer your questionnaire, and without the data needed for the contract we cannot work together.

Security

We protect personal data with technical and organisational measures that fit the risk, such as encrypted connections, access limited to the people who need it, and providers that commit to the same standards.

Changes

We update this policy when our services or the law change. The current version is always on this page with the date of the last update.

Related pages