1. Who We Are (Controller of Your Data)

KW Energy Inc. ("KW Energy," "we," "us," "our") is an Ontario-incorporated company at 2425 Matheson Blvd E, 8th Floor, Mississauga, ON L4W 5K4. We are licensed by the Electrical Safety Authority (ESA) and an approved HRSP (Home Renovation Savings Program) installer. We are the data controller responsible for your personal information under the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial laws.

Our designated Privacy Officer can be reached at privacy@kwnrg.com or (613) 909-4835 ext. 2.

2. Information We Collect

2.1 Information You Provide

• Identifiers: Full name, email, phone, postal/install address
• Property Information: Roof type/age, square footage, electrical panel specs, hydro/gas bills, photos of your home for AI audit
• Financial Information (only if applying for financing): Annual income, employment, SIN (encrypted, only forwarded to your selected lender — Mosaic, GoodLeap, Financeit, etc.)
• Contract Information: Signed agreements, e-signatures, proof of identity for HRSP applications
• Communications: Emails, SMS, call recordings (with notice), support tickets

2.2 Information Collected Automatically

• Device/Usage: IP address, browser, OS, pages viewed, clicks, calculator inputs (anonymized after 26 months)
• Cookies & Pixels: See our Cookie Policy for details and opt-out controls
• System Production Data: Once installed, your solar inverter (Enphase/SolarEdge) transmits production readings to us for monitoring and warranty support

2.3 Information From Third Parties

• Utility: Hydro One/Toronto Hydro/etc. — net-metering and PTO confirmations (with your written authorization on the interconnection application)
• Credit bureaus: Soft-pull pre-qualification only with consent
• Property records: Public MPAC roof/property data
• Referrals: Name and email of the person who referred you

3. Purposes and Legal Basis (PIPEDA Principle 2)

We collect, use, and disclose your personal information only for the purposes identified below. Where required, we obtain your express consent at the point of collection.

4. Who We Share Information With

5. Cross-Border Data Transfers

Your data is primarily stored on Canadian servers. Some service providers (e.g., Stripe, Google Analytics) may process limited data in the U.S. or EU. Where this occurs, we use Standard Contractual Clauses and ensure protections equivalent to PIPEDA. By using our services, you acknowledge that your information may be subject to the laws of jurisdictions where our processors operate, including lawful access by foreign authorities.

6. Your Rights Under PIPEDA & Quebec Law 25

Email privacy@kwnrg.com with subject "Data Rights Request" — we respond within 30 days at no charge.

7. Retention Schedule

• Quote/lead data: 3 years from last interaction (then deleted/anonymized)
• Signed contracts & invoices: 7 years (CRA tax requirement)
• HRSP rebate records: 7 years (program audit requirement)
• Warranty & monitoring data: Length of warranty (typically 25 years for panels)
• Marketing consent records: 3 years after withdrawal (CASL audit trail)
• Call recordings: 12 months (quality assurance)

8. Security (PIPEDA Principle 7)

• TLS 1.3 in transit, AES-256 at rest
• Role-based access controls, mandatory MFA for admins
• Quarterly penetration tests and annual SOC-2-aligned audits
• Documented incident response plan — breach notification within 72 hours per PIPEDA Mandatory Breach Reporting
• Employee confidentiality agreements and annual privacy training

9. Automated Decisions & AI

We use AI tools (e.g., AI Home Audit, AI Pipeline Coach, AI Proposal Assistant) to generate estimates and suggestions. No final decision affecting you (financing approval, contract terms) is made solely by automation — a human reviews every contract. You have the right to request human review of any AI-assisted decision.

10. Children's Privacy

Our services are for adults aged 18+ (age of majority in Ontario). We do not knowingly collect data from minors. Parents/guardians who believe a minor has provided info should contact us for immediate deletion.

11. Changes to This Policy

Material changes are notified by email at least 30 days in advance and via a banner on the site. The "Effective" date above always shows the current version.

12. Contact & Complaints