How we handle your information.

01Who we are

Terawatt (Pty) Ltd is a South African private company, registration number 2018/000000/07, registered in Pretoria. We design, build and operate megawatt-scale solar, battery storage and energy-management systems for industrial and commercial customers across South Africa.

For the purposes of POPIA we are the "responsible party" — the entity that decides why and how personal information is processed.

02What we collect

We only collect what we need to do the work. The categories below are exhaustive — if it's not on this list, we don't collect it.

When you submit a form on this website

• Your name and company.
• Your work email and (optionally) phone number.
• The topic you selected — Solar, Peak, EnergyCloud, Tender, Press, etc.
• The brief or message you typed.

When you upload an electricity bill

• The bill file itself (PDF, image or CSV).
• Metadata extracted from it: account number, supply point, kWh consumption, tariff schedule.
• Your email so we can return the analysis.

If you become a Terawatt customer

• Telemetry from the equipment we install and operate on your site — performance data, energy flows, alarms. This is technical operating data; it does not include any personal information of your staff unless you explicitly grant us access to an HR or attendance system, which we don't request.
• Engineer-of-record contact details for site access and incident handling.

Automatically (by the website)

• Server access logs (IP address, browser, referring page) retained for 30 days for security.
• Analytics events if you do not opt out of cookies — see section 08.

03Why and how

We process information for one of the following lawful grounds under POPIA:

• To do what you asked. If you uploaded a bill and asked for an analysis, we process the bill to write the analysis. If you booked a call, we process your details to confirm the booking.
• To meet a contract. If you are a customer, we process telemetry from your installation to operate the equipment and produce the monthly performance report.
• To meet a legal obligation. Tax records, NERSA compliance records and customer documents retained as required by SA law.
• Legitimate interest. Sending occasional engineering notes to engineers and operators who opted in. Defending or pursuing a legal claim, where applicable.

We do not sell or rent personal information to anyone. Ever.

04Who sees it

Inside Terawatt, your information is accessible to the engineering team handling your enquiry or project, the operations team if you become a customer, and the finance team for invoicing. Every staff member has a confidentiality clause in their employment contract.

Outside Terawatt, we use a small number of sub-processors to operate the business. Each is bound by a written data-processing agreement.

• Website hosting. This website and the bill-analysis service run on infrastructure inside South Africa.
• Customer relationship management. Enquiries, contact details and uploaded bills are stored in GoHighLevel, which processes and stores data outside South Africa.
• Email delivery. Transactional email (confirmations, reports) is delivered via Amazon Simple Email Service, which processes it outside South Africa. Our staff mailboxes are on Microsoft 365.
• Advertising and analytics. Google and Meta receive website usage data as described in section 02.
• Calendar booking. If you book a 30-minute call, the booking calendar is operated by our scheduling tool. The data shared is limited to: your name, email, and chosen time.
• Accounting. Invoicing data flows to our accounting platform under a written agreement.

We will share your information with the South African Revenue Service, NERSA or a court of competent jurisdiction if compelled by law. We will not share it for any other purpose without your consent.

05How long we keep it

We keep information for as long as we have a reason to and no longer.

• Unsuccessful enquiries. Deleted after 24 months, or sooner on request.
• Bill uploads and analyses. Kept for 24 months so we can re-run the analysis against new tariff schedules if requested. Deleted sooner on request.
• Customer records. Kept for the duration of the operating contract plus the legally-required retention period — generally 5 years after termination for tax and engineering-record purposes.
• Newsletter subscribers. Kept until you unsubscribe.
• Server access logs. 30 days.

06Where it lives

This website and the bill-analysis service run on infrastructure physically located inside the Republic of South Africa.

Some information does leave the country, and we would rather say so plainly than bury it. Your contact details and any bill you upload are stored in our CRM, GoHighLevel, which processes data outside South Africa. Transactional email goes through Amazon Simple Email Service, and our staff mailboxes are on Microsoft 365. Website usage data reaches Google and Meta through the tags described in section 02.

POPIA permits these transfers where the recipient is bound by rules providing an adequate level of protection, or where the transfer is necessary to perform a contract with you. Each of these providers operates under its own data-processing terms. If you would prefer your information not to be handled this way, email us at the address in section 10 and we will deal with your enquiry by phone and delete the record afterwards.

07Your rights

POPIA gives you the following rights over personal information we hold about you. You can exercise any of them by emailing us at the address in section 10.

• Access. We will tell you what information we hold and where we got it.
• Correction. We will correct anything that is inaccurate.
• Deletion. We will delete information we no longer need to keep.
• Object. You can object to processing where it is based on legitimate interest.
• Opt out of direct marketing. You can unsubscribe from any communication we send.
• Complain. You can complain to the Information Regulator — see section 11.

We will respond to a written request within 30 days. There is no charge for the first request; subsequent requests within a 12-month period may attract a reasonable administration fee.

08Cookies and analytics

The site uses two categories of cookies:

• Strictly necessary. Session, security, dismissed-banner state. We do not need your consent to set these — they are required for the site to function.
• Analytics. Google Analytics 4, loaded through Google Tag Manager, counts page views, scroll depth and CTA clicks. It sets cookies in your browser and Google processes the data on our behalf. You can block it with your browser’s cookie settings or an ad blocker.
• Advertising. We run a Meta (Facebook) pixel and Google Ads conversion tracking. These tell us which advert or page brought you here, and they allow Meta and Google to show you our adverts again elsewhere. Both set cookies.

We do not currently show a cookie banner. If you would rather none of this ran, block cookies for this site in your browser or use an ad blocker — nothing on the site breaks without them. You can also email us and we will delete anything we hold about you.

09Cross-border transfers

As stated in section 06, we do not transfer personal information across borders for processing. If this ever changes — for example if a sub-processor is forced to operate outside SA — we will update this policy and notify subscribers by email at least 30 days in advance.

10Contact us

11Complaints

If you are unhappy with how we have responded to a request, you have the right to lodge a complaint with the South African Information Regulator:

12Changes to this policy

We will update this page when our practice changes. The "Last updated" date at the top of the page reflects the most recent change. Material changes (new sub-processors, new categories of information collected, changes to retention periods) will be notified by email to subscribers and existing customers at least 30 days before they take effect.

You can always see prior versions of this policy in our git history. We never quietly rewrite the past.