Privacy Policy

AC Energy (Pty) Ltd (‘we’, ‘us’, ‘our’) is a company incorporated under the laws of the Republic of South Africa. We provide AI-powered lead qualification and sales automation services to solar installation businesses located in the United Kingdom.

Because we process personal data of individuals located in the United Kingdom, we are subject to the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, in addition to South Africa’s Protection of Personal Information Act 4 of 2013 (POPIA).

We collect and process the following categories of personal data on behalf of our clients (UK solar companies):

• Identity Data (full name, title) — Lead identification
• Contact Data (email, phone, postal address) — Communication and booking
• Property Data (postcode, roof type, ownership status) — Solar suitability assessment
• Financial Data (electricity bill, energy usage) — Quote generation
• Technical Data (IP address, browser type) — Security and fraud prevention
• Conversation Data (AI qualification chat transcripts) — Service delivery and quality assurance
• Appointment Data (booked dates, times, calendar records) — Scheduling management

• Legitimate Interests (Article 6(1)(f)): Processing lead data to provide our contracted services to solar companies.
• Contract Performance (Article 6(1)(b)): Processing necessary to fulfil our service agreements with our business clients.
• Legal Obligation (Article 6(1)(c)): Where processing is required to comply with applicable UK or South African law.
• Consent (Article 6(1)(a)): Where our client’s lead capture form has obtained explicit consent from the data subject prior to submission.

AC Energy designs, builds and manages the automation system on behalf of the Client. All lead and customer data generated through the system is processed by AC Energy strictly in accordance with the Client’s instructions and the terms of the signed Service Agreement.

4.1 AI Lead Qualification — Anthropic Claude API

Lead qualification conversations are processed using the Anthropic commercial API (Claude AI) — not the Claude.ai consumer product. Under Anthropic’s commercial API terms:

• Inputs and outputs are automatically deleted from Anthropic’s backend within 7 days of processing
• API data is never used to train Anthropic’s AI models under any circumstances
• Anthropic operates as a sub-processor strictly for the purpose of generating AI qualification responses, under a Data Processing Agreement consistent with UK GDPR Article 28

4.2 Automation and Workflow Management

The lead qualification, booking and CRM automation workflows are built and maintained by AC Energy inside the Client’s own designated accounts and systems. All data processed through these workflows is handled under the authority and instructions of the Client as Data Controller, and AC Energy as Data Processor.

The Client (UK solar company) is the Data Controller — they determine the purpose and means of processing. AC Energy is the Data Processor — we act only on the Client’s documented instructions. This relationship is governed in full by the Data Processing Agreement attached to every Client Service Agreement.

AC Energy retains access to and processes Client data for the duration of the active Service Agreement. Upon termination or expiry of the Agreement, AC Energy’s access to Client systems and data is revoked and all Client data held by AC Energy is securely deleted or returned within 30 days, as specified in the Data Processing Agreement.

Retention periods during the active contract:

• Qualified lead records: Duration of contract, plus 24 months — Client CRM continuity and service delivery
• Rejected lead records: Duration of contract, plus 3 months — Audit and dispute resolution
• AI conversation transcripts (at Anthropic): 7 days from processing, auto-deleted — Anthropic commercial API policy, never used for training
• AI conversation transcripts (Client copy): Duration of contract, plus 12 months — Quality assurance and performance reporting
• Invoice and quote records: 7 years from date of issue — UK tax and statutory legal requirement

When a Service Agreement ends, AC Energy’s processing authority ceases immediately. All personal data held by AC Energy is returned to the Client or securely deleted within 30 days of the termination date, and written confirmation of deletion is provided.

AC Energy is incorporated in South Africa. Our clients are businesses operating in the United Kingdom. Data processed under our service agreements travels between the United Kingdom and South Africa.

South Africa does not currently hold UK adequacy status under UK GDPR. All transfers of personal data from the UK to South Africa are conducted under appropriate legal safeguards including:

• Execution of a UK International Data Transfer Agreement (IDTA) with each Client, prior to any data being processed
• Encryption of all data in transit using TLS 1.2 or higher
• Encryption of all data at rest using AES-256
• Strict access controls limiting data access to named, authorised AC Energy personnel only
• Regular security assessments aligned with the ICO’s transfer risk assessment guidance

Anthropic (Claude AI) operates as a sub-processor based in the United States. All data transferred to Anthropic for AI processing is governed by Anthropic’s commercial Data Processing Agreement and the automatic 7-day deletion policy described in Section 4.1. Your leads’ data moves between the United Kingdom and South Africa, and passes briefly through Anthropic’s servers for AI qualification — where it is deleted within 7 days and never used to train any AI model.

• Right to be informed — about how your data is collected and used
• Right of access — to a copy of your personal data held by us
• Right to rectification — of any inaccurate or incomplete data
• Right to erasure — (‘right to be forgotten’) where processing is no longer necessary
• Right to restriction — of processing in certain circumstances
• Right to data portability — to receive your data in a structured, machine-readable format
• Right to object — to processing based on legitimate interests
• Rights related to automated decision-making — including the right to human review of automated qualification decisions

To exercise any of the above rights, contact us at: acenergy@apexcommoditiesafrica.com. We will respond within 30 days.

• All data in transit encrypted using TLS 1.2 or higher
• All data at rest encrypted using AES-256
• API keys and credentials stored in encrypted, named credential vaults — never in plain text
• Access to personal data restricted to named, authorised AC Energy personnel on a strict need-to-know basis
• Regular security reviews of all automation workflows and integrations
• Documented incident response plan with 72-hour personal data breach notification capability, in line with UK GDPR Article 33

AC Energy may update this Privacy Policy from time to time to reflect changes in our services, technology or legal obligations. The current version is always published at this URL. Where a change materially affects the rights of data subjects, we will notify existing Clients directly by email before the change takes effect.

For all data protection queries, requests or concerns:

Email: acenergy@apexcommoditiesafrica.com
Company: AC Energy (Pty) Ltd, Republic of South Africa

UK data subjects may lodge a complaint with the Information Commissioner’s Office (ICO):
Website: ico.org.uk | Telephone: 0303 123 1113

South African data subjects may contact the Information Regulator:
Website: inforegulator.org.za