Last updated: 30 September 2026
At WISE. Energy, we help companies take control of their energy. Doing that well means handling data carefully and keeping our systems secure. This policy explains what personal data we collect when you visitwww.owise.energy, contact us, book a demo, use Wise.Brain or work with us, whywe do it, how long we keep it, how we protect it and what rights you have. It is based on the EU General Data Protection Regulation 2016/679("GDPR"), the Belgian Act of 30 July 2018 on the protection ofnatural persons with regard to the processing of personal data, the Belgian Actof 13 June 2005 on electronic communications (cookies), and the Belgian Act of26 April 2024 establishing a framework for the cybersecurity of network andinformation systems of general interest for public security (the "NIS2Law"), which transposes Directive (EU) 2022/2555 ("NIS2").
1. Who we are
The controller of your personal data is:Wise Energy SRL (trading as "WISE.Energy") Registered office: Sollenberg 36, 1654Beersel (Huizingen), BelgiumCompany number (CBE): 0787.503.903 – VAT: BE0787.503.903 Office: Botanic Tower (BeClimate Hub),Boulevard Saint-Lazare 4/10, 1210 Brussels, BelgiumPrivacy and security contact: privacy@wisenergy.coWe are not legally required to appoint a Data Protection Officer.Privacy and security questions are handled directly by our management at theaddresses above.
2. Scope and status of this policy
This policy is an information notice within the meaning of Articles13 and 14 GDPR. It does not create any contractual right or obligation,commitment, warranty or service level beyond what the law requires. For our clients and partners, the processing of data in connection with our services is governed by our General Terms and Conditions of Sale, theapplicable quotation and, where relevant, the data processing agreement (together, the "Contract"). In the event of any inconsistency, the Contract prevails over this policy. This policy is available in English. Translations may be providedfor convenience; the English version prevails.
3. Whose data we process·
- Visitors of our websitewww.owise.energy ;
- People who contact us, book ademo, download a case study or subscribe to our communications or register toan event ;
- Contact persons at our clients, prospects, EPC/installer partners and suppliers ;
- Users of the Wise.Brainplatform (wisebrain.co) ;·
- Job applicants.
Our services are intended exclusively for businesses andprofessionals. We do not knowingly collect data from children under 13.
Where we do not collect your data directly from you, we obtain itfrom your employer or organisation (for example when it is our client, prospect, partner or supplier and gives us your details as its contact person), from our EPC/installer partners, or from publicly available professionalsources such as company websites, LinkedIn or the Crossroads Bank forEnterprises.
4. What we process, why, and on which legal basis
We do not process special categories of data (health, religion,etc.) and do not make decisions about you based solely on automated processingthat produce legal or similarly significant effects. Wise.Brain's algorithmsoptimise energy installations, not people.
Where we rely on legitimate interest, we have balanced our interestagainst your rights. You can ask us for more information about this balance.
Data marked as mandatory in our forms is needed to handle yourrequest or to enter into a contract with you; without it, we may not be able todo so. Other information is optional.
Our marketing e-mails may contain technologies that measure whetherthey are opened and which links are clicked. We only use these technologieswhere you have consented to them, and you can withdraw your consent at any timevia the link in each e-mail.
5. When we act on behalf of our clients
When a client uses Wise.Brain to manage the energy of its site, somedata processed in the platform may relate to that client's staff, tenants, visitors or EV drivers. For that data, the client is the controller and we actas its processor, on its documented instructions and under a data processingagreement (GDPR art. 28).
The client remains solely responsible for having a lawful basis forthat data, for informing the persons concerned and for answering theirrequests. Requests we receive about such data will be forwarded to the clientconcerned; we will assist the client as required by the Contract and the GDPR.
6. Anonymised and aggregated data
We may anonymise or aggregate data (for example energy consumptionprofiles, equipment performance, flexibility results) so that it no longeridentifies any person. Such data is not personal data. We may use it, includingafter the end of a contract, to develop, train and improve our algorithms,produce benchmarks, statistics and market studies, and secure our services. Anonymised and aggregated data, and the models and know-how derived from it,belong to Wise Energy, subject to the Contract. Where we process data on behalfof a client (section 5), we only anonymise and use it for these purposes to theextent the Contract allows it.
7. Who receives your data
We never sell your personal data. We only share it, on aneed-to-know basis, with:
- Our service providers acting asprocessors, bound by contract to confidentiality and security. These include inparticular: Webflow (website hosting), Google Workspace (e-mail, calendar andoffice tools), Calendly (demo scheduling), Odoo (CRM and ERP), CRM and e-mailmarketing tools such as HubSpot, cloud infrastructure providers hostingWise.Brain, and IT, cybersecurity and monitoring service providers;
- Our EPC/installer partners,technicians and subcontractors, when needed to carry out a project on yoursite;
- Our accountants, legaladvisors, auditors and insurers;
- Grid operators, energysuppliers or flexibility service providers, where required for a service youhave ordered (e.g. grid flexibility);
- The Centre for CybersecurityBelgium (CCB), its national CSIRT (CERT.be) or other competent cybersecurityauthorities, and clients subject to NIS2, where needed to report, manage orremediate a security incident or vulnerability;
- Police, judicial or otherpublic authorities, courts or regulators, where required by law or needed toprotect our rights, our systems or other people;
- A buyer or successor in theevent of a merger, acquisition or transfer of business, under equivalentprotection.
The current list of our main processors is available on request atprivacy@wisenergy.co.
8. Transfers outside the European Economic Area
We aim to keep your data in the EEA. Some of our providers (forexample Webflow, Calendly, Google or HubSpot) are based in, or may access datafrom, the United States or other countries outside the EEA. In that case, thetransfer is covered by an adequacy decision of the European Commission (such asthe EU-US Data Privacy Framework for certified companies) or by the EuropeanCommission's Standard Contractual Clauses, with additional measures whereneeded. You may ask us for a copy of the relevant safeguards.
9. Cookies
Our website uses cookies and similar technologies. Under Belgianlaw, we only place non-essential cookies (analytics, marketing, social mediaand embedded third-party content) after you have given your consent through ourcookie banner. Until you consent, only strictly necessary cookies are used. Youcan withdraw or change your consent at any time via the "Cookies"link at the bottom of each page, and refuse cookies as easily as you accept them.
The detailed list of cookies, their provider and their exactduration is shown in the cookie banner. Your cookie choices are kept for up to12 months, after which we ask you again. You can also block or delete cookiesin your browser settings; some parts of the website may then not work properly.
10. How long we keep your data
We may keep data longer where required by law, requested by acompetent authority, or needed to establish, exercise or defend legal claims.Anonymised data may be kept without time limit (section 6).
11. Security and cybersecurity (NIS2)
11.1. WhyNIS2 matters for us
Wise.Brain connects to energy installations (solar, batteries, EVcharging, flexibility and demand response) that belong to the energy sectorcovered by NIS2, and many of our clients and partners are themselves subject tothe NIS2 Law. Whether or not the NIS2 Law applies to Wise Energy directly, weuse the cybersecurity risk-management measures of Article 21 NIS2 and theCyberFundamentals framework of the Centre for Cybersecurity Belgium (CCB) asour reference, and we support our clients in meeting their own supply-chainsecurity obligations.
11.2. Ourmeasures
Proportionately to our size and to the risks involved, our securityapproach covers:
- Risk analysis and informationsecurity policies, reviewed regularly;
- Incident handling, with loggingand monitoring of our systems;
- Business continuity, includingbackups and recovery procedures;
- Supply-chain security:selection and contractual control of our hosting providers, subcontractors andequipment suppliers;
- Security in the development andmaintenance of our systems, including vulnerability handling and updates;
- Basic cyber hygiene andsecurity awareness for our team;
- Encrypted connections(HTTPS/TLS);
- Access control on aneed-to-know basis, with multi-factor authentication where available;
- Secured remote connections toclient installations, under the conditions set in the Contract.
11.3.Incidents
If a personal data breach is likely to result in a risk to you, wewill notify the Belgian Data Protection Authority within 72 hours of becomingaware of it and, where the law requires, inform you without undue delay. Wherethe NIS2 Law applies to us, significant incidents are reported to the CCBwithin the legal deadlines (early warning within 24 hours, incidentnotification within 72 hours and a final report within one month). Where we actas supplier or processor of a client subject to NIS2, we inform that client inaccordance with the Contract so that it can meet its own reporting obligations.
To protect the security and integrity of our services, other clientsand the electricity grid, we may temporarily restrict, suspend or isolate anaccount, a connection or an installation in the event of a suspected incidentor abuse, for as long as necessary.
11.4. Noabsolute security
No system connected to the internet is completely secure. While weapply measures appropriate to the risk, we cannot guarantee that unauthorisedaccess, loss or alteration of data will never occur, in particular where itresults from systems, networks, equipment or credentials outside our control.
12. Reporting a vulnerability
If you believe you have found a security vulnerability in ourwebsite or in Wise.Brain, please report it to privacy@wisenergy.co with thesubject "Security", with enough detail for us to reproduce it. We askyou to act in good faith: do not access, modify or delete data beyond what isstrictly necessary to demonstrate the vulnerability, do not disrupt ourservices or the installations connected to them, do not use social engineeringor physical attacks, and keep the vulnerability confidential until we have fixedit.
Research carried out outside these rules, or outside the conditionsof the Belgian legal framework for coordinated vulnerability disclosure aspublished by the CCB, is not authorised. Never test or interfere with energyinstallations, batteries, charging stations or grid-connected equipment: thismay create physical safety risks.
13. Your rights
You have the right to:
- Access your data and receive acopy;
- Rectify inaccurate orincomplete data;
- Erase your data ("right tobe forgotten"), unless we must or may keep it by law;
- Restrict processing in certaincases;
- Object to processing based onour legitimate interest, and at any time, without giving reasons, to directmarketing;
- Data portability for data youprovided on the basis of consent or contract;
- Withdraw your consent at anytime, without affecting processing carried out before.
To exercise your rights, e-mail privacy@wisenergy.co or write to usat our registered office (section 1). To protect your data, we will verify youridentity before acting on a request. We answer within one month; this can beextended by two months for complex or numerous requests, in which case we willtell you why.
Exercising your rights is free of charge. However, where a requestis manifestly unfounded or excessive, in particular because of its repetitivecharacter, we may charge a reasonable fee or refuse to act on it (art. 12(5)GDPR). A copy of your data may not adversely affect the rights of others,including our trade secrets, intellectual property and the security of oursystems (art. 15(4) GDPR). Some rights may also be limited where the law allowsit, for example during a security investigation.
14. Complaints
If you believe we are not handling your data correctly, pleasecontact us first — we would rather fix it. You also have the right to lodge acomplaint with the Belgian Data Protection Authority:
Autorité de protection des données /Gegevensbeschermingsautoriteit
Rue de la Presse 35, 1000 Brussels
+32 (0)2 274 48 00 – contact@apd-gba.be –www.dataprotectionauthority.be
If you live or work in another EU country, you may also contact thesupervisory authority there.
15. Links to other websites
Our website links to third-party sites and services (LinkedIn,Instagram, Calendly, Google Calendar, the Wise.Brain login page, partnerwebsites). Those sites have their own privacy policies, and we are notresponsible for how they process data.
16. Changes to this policy
We may update this policy at any time to reflect changes in ourservices, our security measures or the law. The version published on ourwebsite is the one in force; the date at the top shows the latest version. Ifthe changes are significant, we will let you know through the website or bye-mail.
17. Contact
Any question about this policy, your data or the security of ourservices? Write to privacy@wisenergy.co — a real person will answer.