Who is responsible for your data
The controller for the processing described in this policy, within the meaning of Art. 4(7) GDPR, is:
- Controller
- Safety Tax Free GmbH
Zeppelinstr. 33
85748 Garching
Germany - info@sunenergyxt.tz
- Telephone
- +49 89 9265 8520
SunEnergyXT is a registered trademark of Safety Tax Free GmbH and is the name under which this website and the Founders Programme are operated.
Hosting and server logs
This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. When you open a page, your browser necessarily transmits technical data to Vercel's servers, which is recorded in server log files:
- your IP address
- the date and time of the request
- the page or file requested
- the referring page, if any
- your browser and operating system version
This data is required to deliver the website and to keep it secure and stable. The legal basis is Art. 6(1)(f) GDPR: our legitimate interest in operating a functioning, secure website. Log data is not merged with other sources and is not used to identify you.
Retention: log data is kept for 24 hours and is then deleted automatically.
A data processing agreement under Art. 28 GDPR is in place with Vercel through Vercel's Data Processing Addendum, which forms part of our customer agreement.
Fonts and external content
This website makes no requests to third-party servers when you view it. The typefaces Manrope and JetBrains Mono are stored on our own servers and delivered from the same domain as the rest of the page. Your IP address is therefore not disclosed to any font provider.
There are no embedded maps, videos, social media widgets, comment systems or advertising networks on this site. All images and the hero video are served from our own domain.
What you submit, and why
The Founders Programme application form is the only place on this site where you provide personal data. Submitting it is entirely voluntary; you can also reach us by email or WhatsApp instead.
Data you must provide
Without these the form cannot be submitted, because we cannot assess a site or reply to you without them:
- your name
- your organisation or site name
- the region of the site
- your email address
- your telephone or WhatsApp number
Data you may optionally provide
These describe the site rather than you, and help us size a system before we contact you. All of them can be left blank:
- segment, town or area
- current power source, typical outage hours per day, generator size in kVA
- average monthly electricity consumption in kWh
- installation area and roof type
- primary goal, required battery coverage, planned expansions
- any free-text message you add
Purpose and legal basis
- Assessing your application and contacting you about it: Art. 6(1)(b) GDPR, steps taken at your request prior to entering into a contract, together with the consent you give via the checkbox under Art. 6(1)(a) GDPR.
- Spam protection: the form contains a hidden field that is invisible to you and to screen readers. If it is filled in, the submission is discarded and nothing is stored. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in preventing automated abuse.
You may withdraw your consent at any time with effect for the future, by writing to info@sunenergyxt.tz. Withdrawal does not affect the lawfulness of processing carried out before it.
Who receives your data
When you submit the form, the data is passed to the following service providers, each acting as a processor on our instructions:
- Notion
- Notion Labs, Inc., USA. Stores your application as the primary record.
- Slack
- Slack Technologies, LLC (Salesforce), USA. Posts a notification containing your submitted details to our internal channel.
- Resend
- Resend, Inc., USA. Sends the same details to us by email.
- Vercel
- Vercel Inc., USA. Runs the function that processes the submission.
Data processing agreements under Art. 28 GDPR apply to each of these providers through their standard data processing terms, which form part of the agreement we have with them.
Our local partner
Your application is also shared with AEROVOLT Tanzania Limited, our local delivery and service partner, so that a site assessment can be arranged. AEROVOLT Tanzania Limited does not act on our instructions. It decides for itself how it uses the data it receives and is therefore a separate controller within the meaning of Art. 4(7) GDPR; its handling of your data is governed by its own privacy information, not by this policy. The disclosure is covered by the consent you give when submitting the form.
Beyond this, we do not sell your data and we do not pass it to anyone else for their own purposes.
Transfers outside the EU
Submitting the form involves transferring your data to countries outside the European Union.
Notion, Slack, Resend and Vercel are established in the United States. Transfers to them are safeguarded by the Standard Contractual Clauses adopted by the European Commission, which form part of each provider's data processing terms.
AEROVOLT Tanzania Limited is established in Tanzania, for which the European Commission has not issued an adequacy decision. That transfer is based on your explicit consent under Art. 49(1)(a) GDPR, given when you submit the form.
You have the right to obtain a copy of the safeguards in place. Write to info@sunenergyxt.tz.
How long we keep it
We keep your application for as long as it is needed for the purpose it was submitted for, and delete it once that purpose no longer applies and no statutory retention period requires otherwise.
- Applications that do not lead to a project: twelve months from our last contact with you, then deleted
- Applications that lead to a project: for the duration of the business relationship, then in accordance with the statutory retention periods under §257 HGB and §147 AO (six and ten years respectively)
- Server log files: 24 hours
What you can require of us
In relation to the data we hold about you, you have the right to:
- Access (Art. 15): confirmation of whether we process your data, and a copy of it
- Rectification (Art. 16): correction of inaccurate data and completion of incomplete data
- Erasure (Art. 17): deletion, where no legal obligation requires us to keep it
- Restriction (Art. 18): limitation of processing in the cases listed there
- Portability (Art. 20): receipt of the data you gave us in a structured, machine-readable format
- Objection (Art. 21): objection to processing based on our legitimate interests
- Withdrawal of consent (Art. 7(3)): at any time, with effect for the future
To exercise any of these, write to info@sunenergyxt.tz. We will respond within one month.
You also have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your residence, place of work, or the place of the alleged infringement (Art. 77 GDPR). The authority competent for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany.
What this site does not do
This website sets no cookies and uses no tracking. There is no analytics, no tracking pixel, no advertising network, no profiling and no automated decision-making within the meaning of Art. 22 GDPR.
Because nothing is stored on or read from your device beyond what is strictly necessary to deliver the page, no consent banner under §25 TDDDG is required.
Your browser may store the fonts and images of this site in its ordinary cache. That is a browser function, not a measurement carried out by us, and you can clear it at any time in your browser settings.
Changes to this policy
We will update this policy when the processing it describes changes, for example if a service provider is added or replaced. The version in force is always the one published here.
Last updated: 26 July 2026