Privacy Policy of LlumGas

Version: 1.0

Last Updated: October 23, 2026

Scope: Website, applications, and associated services accessible at https://llumgas.cat

Data Controller Identification
Data Protection Principles
Personal Data Processed, Purposes, and Legal Bases
Use of Google API Data (Google API Services User Data Policy)
Service Providers, Data Processors, and International Transfers
Security Measures and Technical Safeguards
Data Retention Periods
Data Subject Rights (GDPR)
Protection of Minors
Policy Amendments and Updates
Contact Channels

1. Data Controller Identification

In compliance with the General Data Protection Regulation (EU 2016/679, "GDPR") and applicable privacy and data protection regulations within the European Union, users are informed that the data controller responsible for the processing of personal data collected through this service is:

Entity / Legal Name: Energy Digital Services LLC
Brand and Operated Service: LlumGas (llumgas.cat), a service operated by Energy Digital Services LLC
Legal Form: Limited liability company (LLC) incorporated in the State of New Mexico, United States, on 16/06/2026
Registration Identification: New Mexico Secretary of State, Business ID 0008110302 (File #3252316)
Official Address: 99 Wall Street #2485, New York, NY 10005, United States
General Inquiries: contacto@llumgas.cat
Privacy and GDPR Contact: privacidad@llumgas.cat
Customer Support: soporte@llumgas.cat
Privacy Officer: Responsable de Privacidad de Energy Digital Services LLC
Official Website: https://llumgas.cat

2. Data Protection Principles

In processing users' personal data, Energy Digital Services LLC strictly adheres to the core principles set forth in Article 5 of the GDPR:

Lawfulness, fairness, and transparency: Personal data is processed lawfully, fairly, and transparently in relation to the data subject.
Purpose limitation: Personal data is collected only for specified, explicit, and legitimate energy consultancy and contract management purposes.
Data minimization: Processing is strictly limited to data adequate, relevant, and necessary for the services provided.
Accuracy: Every reasonable step is taken to ensure inaccurate data is erased or rectified without delay.
Storage limitation: Data is kept in a form which permits identification of data subjects for no longer than is necessary.
Integrity and confidentiality: Appropriate technical and organizational security measures are enforced against unauthorized or unlawful processing, accidental loss, or destruction.
Accountability: Energy Digital Services LLC is responsible for and capable of demonstrating compliance with all aforementioned principles.

3. Personal Data Processed, Purposes, and Legal Bases

Data Category	Primary Purposes	Legal Basis (GDPR)	Retention Period
Identification and contact details (name, phone number, email address, physical address)	Responding to advisory inquiries, preparing customized energy studies, and managing communications across Mataró and the Maresme area.	Performance of pre-contractual steps or contractual service relationship (Art. 6.1.b GDPR).	Duration of service provision and statutory limitation periods.
Energy supply and billing data (CUPS code, contracted power, historical kWh consumption, current utility provider, invoice amounts)	Analyzing electricity and gas bills, calculating potential savings (up to 40%), optimizing contracted power, and executing provider switching upon request.	Performance of service contract / explicit consent of the data subject (Art. 6.1.a and 6.1.b GDPR).	Duration of active relationship, plus up to 5 years for legal and fiscal compliance obligations.
Technical and connection metadata (IP address, device identifiers, system access logs)	Maintaining platform security, preventing fraudulent activity or cyberattacks, and verifying server integrity.	Legitimate interests of the controller in ensuring IT system security (Art. 6.1.f GDPR).	Maximum 12 months in secure logging archives.
Google API integrations data (OAuth, Business Profile, Places)	Verifying business physical locations, presenting verified public reviews, and managing energy commercial profile listings.	Explicit consent granted during the OAuth authentication flow (Art. 6.1.a GDPR).	Until consent is revoked or disconnection is initiated by the user.

4. Use of Google API Data (Google API Services User Data Policy)

LlumGas incorporates features that interact with Google APIs (including Google OAuth, Google Business Profile API, and Google Places API) solely to enable secure sign-in, verify local business profiles, and display localized review data to users.

Google Limited Use Statement

Energy Digital Services LLC strictly adheres to the Google API Services User Data Policy. In accordance with Google's requirements:

LlumGas's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.

Under this obligation:

No unauthorized transfer: Data received from Google APIs will never be transferred to third parties unless strictly necessary to provide or improve features authorized by the user or as required by law.
Prohibition of advertising use: Google user data is never used or transferred for serving advertisements, retargeting, or data brokering.
No general AI model training: No data obtained via Google APIs will be used to train generalized artificial intelligence (AI), machine learning models, or large language models (LLMs).
Restricted human review: Human personnel do not inspect Google user data unless: (a) the user has given affirmative agreement for troubleshooting; (b) it is required for security audits; or (c) it is mandated by legal process.

5. Service Providers, Data Processors, and International Transfers

Energy Digital Services LLC engages trusted technological vendors to maintain system operations. Each vendor operates under a binding Data Processing Agreement pursuant to Article 28 of the GDPR:

Cloud Hosting & Infrastructure: High-security data centers with ISO/IEC 27001 and SOC 2 certifications located in the European Union and international availability zones.
Messaging & Communication: Telecommunication service providers (such as WhatsApp / Meta Platforms) utilized strictly to deliver personalized assessments upon user request.
International Data Transfers: Because Energy Digital Services LLC is incorporated in the United States, international transfers of personal data to the US are conducted under the EU-U.S. Data Privacy Framework or governed by Standard Contractual Clauses (SCCs) approved by the European Commission.

6. Security Measures and Technical Safeguards

Energy Digital Services LLC maintains robust technical and organizational protections:

End-to-end transport layer security (TLS 1.3 / HTTPS) encryption for all web communications.
Strong encryption for sensitive data at rest using industry-standard AES-256 ciphers.
Strict role-based access controls based on the principle of least privilege.
Continuous vulnerability monitoring and automated data backups.

7. Data Retention Periods

Personal data is retained only for the duration strictly necessary to fulfill the intended purposes:

General billing consultations and informal savings calculations that do not result in a contract are retained for a maximum of 12 months for follow-up support, unless deletion is requested sooner.
Contractual and switching documentation is retained throughout the active service relationship and subsequently kept securely blocked for statutory limitation periods (up to 5 years under applicable civil and commercial laws).
Google integration tokens and data are immediately wiped upon user disconnection.

Under the GDPR, individuals have comprehensive rights regarding their personal data processed by Energy Digital Services LLC:

Right of Access: Obtain confirmation and copies of personal data undergoing processing.
Right to Rectification: Request rectification of inaccurate or incomplete personal records.
Right to Erasure ("Right to be Forgotten"): Request permanent deletion when data is no longer necessary.
Right to Restriction of Processing: Request restriction of processing under legally specified conditions.
Right to Data Portability: Receive personal data in a structured, commonly used, and machine-readable format.
Right to Object: Object to processing based on legitimate interests.
Right to Withdraw Consent: Revoke previously granted consent at any time without retroactive detriment.

To exercise any of these rights, submit a written request to:

Email: privacidad@llumgas.cat

(Subject line: "GDPR Rights Request", with verification of the applicant's identity).

Data subjects also have the right to lodge a complaint with a supervisory authority, including the Spanish Data Protection Agency (AEPD, https://www.aepd.es).

9. Protection of Minors

LlumGas services are strictly intended for individuals aged 18 and older who possess the legal capacity to enter into binding utility contracts. We do not knowingly solicit or collect personal data from minors.

10. Policy Amendments and Updates

Energy Digital Services LLC reserves the right to modify this Privacy Policy to reflect evolving legal, regulatory, or technical standards. The current version will always remain accessible at https://llumgas.cat/en/privacy.

11. Contact Channels

For inquiries regarding this policy or personal data management:

Corporate Entity: Energy Digital Services LLC
Registered Address: 99 Wall Street #2485, New York, NY 10005, United States
Business Registration: New Mexico Secretary of State, Business ID 0008110302 (File #3252316)
General Inquiries: contacto@llumgas.cat
Privacy & GDPR Desk: privacidad@llumgas.cat
Technical Support: soporte@llumgas.cat
Privacy Officer: Responsable de Privacidad de Energy Digital Services LLC