Knowledge / Terms Personal data

    Privacy and cookies

    Data collected by ReneWave, purposes, tools, recipients, retention, client rights, cookies and Law 09-08 / CNDP formalities.

    Last updated
    5 September 2026
    Status
    Public version
    Policy version
    2026-09-05

    Applies to

    • Visitors, prospects, clients, store users, quote requesters and after-sales requesters
    • Data sent via forms, WhatsApp, email, calls, files, photos, invoices and monitoring
    • Data used for quotes, study, installation, support, warranty, maintenance, invoicing and consented marketing

    Does not apply to

    • Data handled directly by a third-party platform under its own client account, where ReneWave does not determine the purposes

    Personal data about professional contacts, employees and site representatives remains protected. A B2B contract may add project-specific safeguards; it does not remove rights under Law 09-08.

    Quick summary
    • Technical data is necessary to study, install, maintain and defend after-sales files.
    • Some data may be shared with a manufacturer or authorised after-sales network where necessary.
    • Required operational processing is separate from optional marketing consent and non-essential cookies.
    01

    Categories of data

    • Identity, contact details, company, site address, contact’s role and communication preferences.
    • Electricity bills, consumption history, power ratings, usage, goals and project constraints.
    • Photos, videos, plans, visit notes, reports, reservations, documents provided and the site’s initial condition.
    • Technical data: sizing, measurements, serial numbers, alerts, monitoring screenshots, after-sales history.
    • Account, cart, quote request, delivery, invoicing, payment and sales-tracking data where those functions are active.
    • Email, phone, WhatsApp, form, newsletter, cookie, analytics and site-interaction exchanges where those functions are active.
    02

    Controller, required fields and legal grounds

    ReneWave S.A.R.L., at the registered office stated in the Legal Notice, determines why and how personal data is used for the activities covered by this policy. Privacy requests may be sent to [email protected].

    Fields marked as required are limited to what ReneWave needs to answer a request, secure an account, prepare a quote, perform a contract, deliver a product, issue an invoice or handle support. If required information is not provided, ReneWave may be unable to complete that specific action. Optional fields may be left blank.

    Processing needed to answer a requested quote or perform a contract relies on that pre-contractual or contractual need. Accounting, tax, safety and legal records rely on applicable obligations. Security, dispute prevention and proportionate service improvement may rely on ReneWave’s legitimate interests where they do not override individual rights. Newsletter and unrelated electronic marketing use separate consent or another basis expressly allowed by Law 09-08.

    03

    Purposes of processing

    Project and quote

    • Understand the site, size a solution, draw up a quote and prepare the technical reservations.
    • Check compatibility between equipment, usage, roof constraints, grid and the client’s goals.

    Execution and support

    • Organise delivery, installation, commissioning, support, maintenance and complaints.
    • Document interventions, reservations, photos, serial numbers and technical histories.

    Administration and improvement

    • Manage invoicing, accounting obligations, dispute prevention, service quality and site statistics.
    • Send marketing communications only where the applicable basis or consent allows.
    04

    Tools and recipients

    The active operating environment may include the website host, Supabase for account and request data, email and WhatsApp communications, Google Drive or Docs for controlled project documents, Airtable and Make for authorised workflow administration, support tools, and manufacturer or inverter monitoring portals used for the relevant project.

    Only the data needed for a stated task is shared with authorised ReneWave personnel, contracted technical providers, manufacturers or authorised after-sales networks, accountants, professional advisors, qualified subcontractors or authorities where necessary or legally required.

    Processors are instructed not to reuse ReneWave client data for unrelated marketing. Access, confidentiality, security and deletion or return obligations are addressed in the applicable provider arrangement.

    05

    AI advisor and information you share

    When you use the AI advisor, your messages and the conversation context needed to answer are processed through the Lovable AI gateway and the selected model provider. The site also uses the gateway for embeddings used to retrieve relevant technical information. Supabase supports the site’s account, request and conversation functions.

    Only share information needed for your question. Do not enter card details, passwords, identity-document copies or unrelated confidential information in the advisor. Use the project or support channel for documents that require controlled handling. The advisor provides preliminary information, not a final engineering decision or binding offer.

    These providers may process data outside Morocco. The applicable recipients, processing locations and transfer formalities must be assessed for the actual service configuration; this notice does not claim that an unverified CNDP authorisation has been obtained. You can instead contact ReneWave by email without using the AI advisor.

    06

    Monitoring, photos and technical data

    Photos, invoices, measurements, alerts, screenshots, inverter portals and supervision data can be essential to diagnose a fault, defend a warranty or understand performance.

    When the client gives access to a monitoring portal, ReneWave uses that access for diagnosis, follow-up, maintenance or warranty, within the agreed scope.

    Permission to document a project for engineering or support is not permission to publish identifiable site photos as marketing. ReneWave seeks separate permission for promotional use involving identifiable people or private-site information. Declining promotional use does not prevent the requested service. Unnecessary faces, addresses and identifying details should be removed from any approved publication.

    07

    Cookies and audience measurement

    The current site uses strictly necessary browser storage or cookies for functions such as authentication, security, cart continuity and interface preferences. Refusing these may prevent the requested function from working.

    No advertising pixel or non-essential audience-measurement cookie is treated as active merely because this policy mentions the possibility. If ReneWave later activates one, it must be listed by name, purpose, provider and duration and blocked until the required choice has been recorded.

    08

    Retention

    Unconverted quote requests

    Rule
    Active follow-up for up to 24 months after the last meaningful contact.
    Handling
    Delete or anonymise after that period unless a dispute, legal duty or renewed request requires retention.
    Note
    A shorter period is used when the request is clearly abandoned and no proof is needed.

    Contractual documents and invoices

    Rule
    Kept per accounting, tax, contractual-proof and rights-defence obligations.
    Handling
    Secure archiving with limited access.
    Note
    The statutory retention period is recorded in ReneWave’s processing register and applied by document class.

    After-sales files, photos and monitoring

    Rule
    Active for the applicable support or warranty period, then restricted for the relevant legal limitation period.
    Handling
    Keep only the evidence needed to identify the site, equipment, intervention and outcome.
    Note
    Monitoring access is removed when the agreed purpose ends, unless a current support file requires it.

    Newsletter and marketing

    Rule
    Kept until consent is withdrawn, the person objects or the address becomes inactive.
    Handling
    Stop marketing promptly and retain only a minimal suppression record where needed to respect the choice.
    Note
    Every marketing email provides a valid, no-cost opt-out route.
    09

    Rights and request handling

    Under Law 09-08, a person may request access to their data, correction of inaccurate or incomplete data, objection on legitimate grounds and erasure or blocking where processing is not compliant. Marketing objection is available without charge.

    Requests should be sent to [email protected] with only the identity evidence reasonably needed to prevent unauthorised disclosure. ReneWave handles access requests without undue delay and completes required rectification free of charge within the ten-clear-day period stated by Article 8.

    If ReneWave cannot fully grant a request because a legal retention duty, another person’s rights or a legitimate proof requirement applies, it explains the reason and limits continued use to that justified purpose. Manifestly repetitive or abusive access requests are assessed under the procedure provided by Law 09-08.

    • Name and contact details of the requester.
    • Reasonable proof of identity.
    • The precise purpose of the request: access, rectification, objection, deletion.
    • The account, quote, invoice, site or file concerned if available.
    10

    Security and transfers outside Morocco

    ReneWave applies role-based access, authentication, controlled sharing, backups where appropriate and reasonable organisational safeguards to protect project, account and after-sales data. Providers receive only the access needed for their task.

    Where a provider or monitoring platform stores or accesses personal data outside Morocco, the transfer requires a documented country, recipient, purpose and safeguard, together with the CNDP formality applicable to the underlying processing. This applies to existing quote and support tools as well as any future paid checkout.

    No website can promise absolute security. ReneWave nevertheless investigates suspected incidents, limits access, preserves relevant evidence and makes any notice required by applicable law or a competent authority.

    These pages set out ReneWave’s public rules. For a specific case, the handling depends on the quote, contract, invoice, diagnosis, available evidence and applicable law.

    ReneWave markRENEWAVE

    Energy systems, held to standard.