Privacy Policy

Last updated: 3rd November 2025

Orklys will never share or sell your data.

Orklys ApS ("Orklys", "we", "us", "our") respects your privacy and is committed to protecting your personal data. This privacy policy explains how we collect, use, disclose, and store your information when you use our platform at www.orklys.com ("the Platform").

1. Orklys is the data controller for the processing of your personal data as described in this policy. You can contact us at habla@orklys.com with any questions.

2. What personal data we collect

When you register or use our platform, we collect the following information:

Identity information: first name, last name, username.

Contact information: email address

Account status information: account creation date, activity status, onboarding progress.

Community-related information: details about your membership in energy communities and organizations.

Transaction records: details about your shareholdings and related activities on the platform, as required by law.

AI Platform Data: When you use our AI features, we may collect the prompts you provide, the content you upload for analysis, and the feedback you give on the AI's output.

We do not collect sensitive personal data (e.g., health, political views) through the platform.

3. Why we process your data

We process your data for the following purposes and under the following legal bases:

3.1. To provide the platform and services (Art. 6(1)(b) GDPR – fulfillment of a contract).

• Creation and management of your user account.
• Facilitating investments in renewable energy communities.
• Linking your identity to the shares you purchase.
• Providing responses and features through our AI platform.

3.2. To comply with legal obligations (Art. 6(1)(c) GDPR).

• Maintaining shareholder registers in accordance with Danish company law.
• Providing records to relevant authorities where required.
• Fulfilling tax and accounting obligations.

3.3. To improve and secure the platform (Art. 6(1)(f) GDPR – legitimate interest).

• Monitoring system usage to prevent fraud or abuse.
• Improving user experience.
• Analyzing AI Platform Data (as defined in Section 2) to improve the accuracy, relevance, and performance of our AI models and features. All data used for improvement is processed internally.

3.4. For marketing and communication (where you have consented – Art. 6(1)(a) GDPR).

• Sending newsletters and updates about new energy communities.
• Providing information about platform improvements.

You can withdraw consent for marketing at any time by clicking the unsubscribe link in our emails or by contacting us.

4. Who we share your data with

We may share your personal data with:

4.1. Energy community organizations

When you invest in a community, we share your name and contact details with that organization as required for shareholder registration.

4.2. Service providers

We use trusted third-party service providers to operate the platform, including:

• Clerk.com: for user authentication and account management
• Vercel: for hosting and platform infrastructure
• Cloudflare: for content delivery and security

These providers only process your data on our behalf and under strict contractual obligations.

4.3. Legal authorities

We may disclose your data if required by law or to protect our rights and safety.

4.4. Our AI Platform and Your Data

We are committed to data privacy in our AI features. We process the AI Platform Data you provide to generate responses and improve our services.

We do not sell your personal data or your AI Platform Data.

We do not share your personal data or AI Platform Data with any third-party AI providers, including OpenAI, for the purpose of training their models.

5. International data transfers

Some of our service providers may process your data outside the EU/EEA. When this happens, we ensure appropriate safeguards are in place, such as:

• Standard Contractual Clauses approved by the European Commission
• Adequacy decisions
• Other legally recognized transfer mechanisms

6. How long we keep your data

We retain your personal data only as long as necessary for the purposes described in this policy:

• Account data: Until you delete your account, plus 30 days
• Transaction records: 5 years after the transaction (legal requirement)
• Marketing communications: Until you unsubscribe or delete your account
• AI Platform Data: Retained only as long as necessary to provide a good service and for internal platform improvement, after which it is anonymized or deleted.

7. Your rights

Under GDPR, you have the following rights:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request deletion of your data (with certain limitations)
• Restriction: Limit how we process your data
• Portability: Receive your data in a structured format
• Object: Object to processing based on legitimate interests
• Withdraw consent: Where processing is based on consent

To exercise these rights, contact us at habla@orklys.com.

8. Data security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. This includes:

• Encryption of data in transit and at rest
• Regular security assessments
• Access controls and authentication measures
• Staff training on data protection

9. Cookies and tracking

Our platform uses essential cookies for functionality. We do not use tracking cookies or analytics without your consent. For more information, see our Cookie Policy.

10. Changes to this policy

We may update this privacy policy from time to time. When we make significant changes, we will notify you via email or through the platform. The "last updated" date at the top indicates when changes were made.

11. Contact us

If you have questions about this privacy policy or how we handle your data, contact us at:

Orklys ApS
Email: habla@orklys.com
Address: Refshalevej 96, 1432 København K, Denmark

You also have the right to lodge a complaint with the Danish Data Protection Agency (Datatilsynet) if you believe we have not handled your data properly.