Privacy Policy

What is de NordEnergie’ role in your privacy ?

The privacy policy (hereafter the “Privacy Policy”) governs the manner according to which NordEnergie S. A., société luxembourgeoise ayant son siège social à Place de l'Hôtel de Ville, L-9087 Ettelbruck, GRAND-DUCHÉ DE LUXEMBOURG, inscrite au Registre de Commerce et des Sociétés du Luxembourg sous le numéro B139347 (ci-après « NordEnergie ») belonging to the Encevo Group, collect, use, process and/or communicate personal data of natural persons (such as “Prospect”, “Customer” or “User”) in relation to the supply of energy and/or the usage of its websites, mobile applications, and digital services (together designated the “Services”).

The supply of energy includes additional energy related services like the access and management to the customer portal, the customer account, the organization of commercial and marketing operations and the management of Users’ and Customers’ feedback.

Within the framework of the Privacy Policy, NordEnergie acts as data controller (“Data Controller”). The Privacy Policy aims to provide transparency about your personal information either collected directly from you or throughout our interactions with you. Some information may also come from publicly available sources. We share information with service providers (“Data Processors”) in relation to our supply activities and/or with third parties like supervisory authority to comply with legal and regulatory obligations but also to prevent fraud and to handle in the best manner Customer’s requests, complaints and any possible disputes.

We inform you that we recently updated our Privacy Policy concerning the concept of legitimate interests, the type of data collected, for which purposes and on which legal basis (cf. the Schedule below) and concerning the retention periods.

Our commitment to comply with data protection Law

NordEnergie acknowledges and undertakes to comply with the national laws and regulations applicable to the protection of personal data (the “Law”), including but not limited to the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the “GDPR”).

Your points of contact

As Data Controller, NordEnergie considers the protection of your personal data to be of great importance and has appointed a data protection officer (hereafter the “DPO”) that you can contact for any questions you may have.  The main role of our DPO is to ensure that personal data of our employees, Prospects, Customers and Users are processed by NordEnergie or by our Data Processors in compliance with the Law and the GDPR.

For any questions about the processing of your personal data carried out by NordEnergie, please feel free to contact our customer service centre or the DPO at the following addresses:

  • by post:

NordEnergie S.A.
Place de l'Hôtel de Ville
L-9087 Ettelbruck (Luxembourg)

How to stay involved in the treatment of your personal data ?

We invite you to read this Privacy Policy. If you are already a Customer of de NordEnergie, please also check the contracts between us because they may contain further details on how we collect and process your data.

Whatever is the method used to collect personal data, either directly from you or from third parties, please note that we will use these personal data only for the specific reason for which it was provided to us.

By contracting with us or by using the Services, you acknowledge and accept the treatment of your personal data in accordance with the Privacy Policy.

When and how we collect data ?

As from your first interaction with us or with third parties, personal data are collected through various digital channels (by email, by navigating on our web sites or through social media) and also by correspondence in writing (letter, messages) or verbally (during a physical meeting or by telephone). The Privacy Policy is applicable regardless of the communication channel or the method used to collect your data.

The Schedule below provides more details about the type of data we collect, for which purposes and the legal basis on which we process your personal data.

What are our “legal bases” for processing your data ?

In the framework of our activities, we collect and process several types of personal data depending on the offers and services you have subscribed to and the forms you have filled-in on our websites. This processing is based on one of the following legal bases:

Contract

We process your personal data within the extent it is necessary to execute the contract you have entered with us and/or for the needs of the pre-contractual relationships.

Consent

We process your data on the basis of a clear and explicit consent (by ticking the box or clicking) that you have given to us for a specific purpose.

You can change your mind! If you have previously given your consent to the processing of your personal data, you may freely withdraw this consent at any time by contacting us by e-mail at mail@nordenergie.lu.

If you withdraw your consent, and if we do not have another legal basis for processing your information, then we will stop processing your personal data. If we have another legal basis for processing your information, we will limit our processing to what is strictly necessary with regard to the purpose of the concerned treatment.

Legitimate interests

In the following cases, we process your data on the basis of our legitimate interests within the limits of what you can reasonably expect in the interactions with us and as long as there is no other legal basis for such processing. Our legitimate interests are:

  • gaining insights from your energy needs and consumption,
  • delivering, developing, and improving de NordEnergie’ products and services,
  • enabling us to enhance, customise or improve the User’s experience,
  • enhancing data security.

In each case, we ensure to find a balance between your rights and our legitimate interests. For more information about such balancing, you can contact us by email at the following address : dpo@nordenergie.lu

Law

We process your personal data in accordance with the Law, relevant government instructions and energy sector industry practices as applied by the Courts and supervisory authorities.

How and why we process your data?

In the schedule below, you will find the detail of (i) the categories of personal data that we collect, (ii) the purposes for which we process such data, (iii) the legal basis associated with each purpose.

When collecting information, we indicate which information is mandatory or necessary for the conclusion of the contract. Failure to provide such information will prevent us from entering into a contract with you. Optional information is indicated as “optional”.

Context Type of personal data 1 Purposes of the processing Legal basis
Browsing on our websites and using our digital spaces
  • None : Your IP address is anonymized before it arrives on our server
  • For statistics purposes on the usage of our websites and digital spaces, to improve user’s experience and obtain activity indicators
  • General Terms of Use
  • Cookies
  • To improve our websites design, content and usage
  • Cookies Policy
  • - Based on the consent (Opt-in) given by the user
Request an offer/ Enter into an energy supply contract
  • Customer Name data
  • Customer Communication data
  • Customer Contract data
  • Point of Delivery data
  • To identify you and check your personal information
  • To determine your category of customer (i.e., final client or active client as defined by regulation in force )
  • To elaborate and propose a commercial offer
  • To conclude a supply agreement through a signature process
  • To create a customer account in our systems and provide access to your profile and data
  • To communicate with the grid network operator (MarketCommunication), technical partners and sub-contractors (counting operator) and regulatory authority during the supply period
  • General Terms of Use
  • Privacy Policy
  • Performance of a contract
  • Performance of a contract (mandate given by you)
  • Legal obligations as defined by the regulator (ILR or competent authority)
  • Customer Name data
  • Customer Communication data
  • To provide you with an access to our customer portal (optional)
  • Legitimate interests
  • Housing data (characteristics and electrical equipment)
  • To assess average future consumption to propose the best (future) product fit.
  • To be able to provide more precise energy consumption insights to the customer
  • Based on your Opt-in (Consent)
Execution of the energy supply contract
  • Customer Name data
  • Customer Communication data
  • Customer Contract data
  • Point of Delivery data
  • Metering data
  • Invoicing data
  • Financial data
  • To establish energy consumption forecast enabling energy purchase and volumes nomination
  • To supply energy to the Point of Delivery
  • To put energy consumption data at your disposal
  • To issue invoices on a regular basis for energy consumed (electricity/natural gas)
  • To collect payment by manual means (transfer, credit card or cash) or by automatic electronic transfer (SEPA)
  • To perform dunning activities with bailiff and escalation processes in accordance with regulations
  • To manage pre-litigation and litigation with customers, third parties, local authority(ies), administration (etc.) in case of an administrative or judicial proceedings
  • To prevent and fight against fraud and corruption
  • Performance of a contract
  • Legitimate interests (economic and commercial)
  • Legitimate interests (enforcing our rights and defending our interests)
  • Legal obligations
Exchange and communication with our services
  • Customer Name data
  • Customer Communication data
  • Customer Contract data
  • To personalize communication with you and facilitate the execution of the contract
  • To improve the user’s experience on our digital spaces
  • To improve the quality of our answers and services, internal process and management of requests by the Customer Service Center (CSC)
  • To respond to your requests and manage the exercise of your rights as data subjects
  • To improve the training of our CSC agents
  • To realize satisfaction surveys
  • Legitimate interests (economic and commercial)
  • Legitimate interests (to provide a quality service and internal training to our CSC agents)
  • Legal obligations
  • Legitimate interests (economic and commercial)
Commercial activities
  • Customer Name data
  • Customer Communication data
  • Marketing operations as authorized by regulations (excluding notably operations by email or SMS which necessitates consent)
  • Marketing operations based on your consent:
    • Invitation to conference or events organized by Enovos
    • To receive newsletters, information, update, special offers or promotional offers on our products and services
    • To receive information on our new products/services
    • To receive electronic offers from our technical and commercial partners (craftsmen, installers, insurers, banks, and electronic vehicle rental companies).
    • To provide advice on energy efficiency measures.
  • Legitimate interests (economic and commercial)
  • Consent (Opt-in)

[1] The details of each category of data (Customer Name Data, Customer Communication Data, Point of Delivery Data, etc.) are defined by Encevo Group internal policies.

[2] According to the Electricity Law dated June 9th, 2023, an active client is an end-customer or a group of end-customers acting jointly, which consumes, or stores electricity produced on its/their premises, or which sells its/their self-produced electricity and/or participates in flexibility or energy efficiency programs provided such activities are not its main commercial or professional activity.

What about really sensitive data?

We don’t collect any sensitive data as defined by the RGPD (like racial or ethnic origin, political opinions, religious/philosophical beliefs, trade union membership, genetic data, biometric data, health data, data about your sexual life or orientation, and offences or alleged offences).

What are your privacy rights?

You have personal rights regarding your data that you can exercise in accordance with the Law and the GDPR, including a right of access, right to correct, right to erasure, a right to restrict a treatment, right to oppose (right to be forgotten), and a portability right.

If you want to exercise or get more explanation about any of these rights, please contact the Data Protection Officer at the following address: dpo@nordenergie.lu. We will answer you within a reasonable delay, not exceeding one month as from the date of your request.

Such right can be exercised to the extent it does not adversely affect the rights and freedoms of others. Under certain circumstances, some rights such as the right to be forgotten or the portability right can be exercised subject to conditions, for example, they shall not prevent the execution of ongoing contracts or prevent us from complying with our obligations or obstructing any possible legal proceedings.

In such cases, we will provide you with any further explanation which might be relevant to you.

  1. You have the right to access to the information we hold about you. Please refer to the Schedule above. You can ask us whether your personal data is being processed or not and request further details about the processing of your data.
  2. You have the right to request an update, an addition or a correction of any personal data which is inaccurate, incomplete or wrong. Please inform us about any update or inaccuracy you may have noticed by sending an email at mail@nordenergie.lu.
  3. You can request the erasure of your personal data under certain circumstances. This right may be subject to limitations as mentioned above.
  4. You can ask the restriction of processing of your personal data under certain circumstances. This right means that the treatment we operate on your personal data is limited, so that we can retain some data, but we cannot not use or process them for any other purpose(s).
  5. You have the right to object to the processing of personal data (“right to be forgotten”). This means that you can request us to stop using your personal data, notably for direct marketing purposes. We will do so as long as such data are no longer necessary for the provisions of services.
  6. You have the right to ask for the portability of your personal data carried out by automated means. You can request to receive directly your personal data in a structured commonly used and machine-readable format. The data will be given in MS Excel format directly to you so that you can transmit it to another controller and/or where technically feasible, your personal data will be transmitted directly to another controller.
    Such right can be exercised to the extent it does not adversely affect the rights and freedoms of others. In such case, we will provide you with any further explanation which might be relevant to you.
  7. You have the right to lodge a complaint with the relevant supervisory authority, i.e. the “Commission Nationale de Protection des Données (“CNPD”).

We provide several channels to exercise your rights so that you can choose the more convenient to you.

For any questions/concerns, please contact us at the following addresses so that you have a chance to address your request in the best delay :

  • by post:

NordEnergie S.A.
à l'attention du DPO,
Place de l'Hôtel de Ville
L-9087 Ettelbruck (Luxembourg)

How we secure the data we collect?

NordEnergie has implemented appropriate physical, technical and organizational security measures to protect your personal data against unauthorised access, alteration, disclosure, theft, destruction or other accidental or unlawful forms of processing in accordance with the Law, GDPR and generally accepted standards of technology and operational security.

We have set-up internal security policies and we require our Data Processors to comply with the Law and GDPR. They are bound by contractual obligations related to confidentiality, processing and security measures to prevent unauthorised access, use, theft, destruction and disclosure of personal data.

Security issues being a general matter concerning everyone, we advise you to remain vigilant and take any useful or necessary precaution to guarantee the confidentiality of your password and your access code to the customer account.

How do we store and transfer your personal data?

Your personal data are stored with the European Union either by our organization or by our service providers (Data Processors).

In the event a transfer of personal data outside the European Union or outside the European Economic Area (EEA) is contemplated, such transfer will only take place provided the appropriate safeguards provided by articles 44 to 47 of the GDPR are in place, i.e. :

How long do we retain your data?

NordEnergie takes all reasonable measures to ensure that your personal data are processed for the minimum period of time necessary for the purposes set out in this Privacy Policy. The criteria to determine the duration during which we retain your personal data in connection with the Services are as follows:

  • as long as we maintain a contractual relationship with you (e.g., where you are a beneficiary of our Services, or you are lawfully included in our mailing list and you have not unsubscribed);
  • as long as your personal data are necessary in connection with the lawful purposes set out in this Privacy Policy, for which we have a valid legal basis;
  • until the end of the calendar year following the end of the limitation period under applicable laws.

The main retention periods are the following (for Luxembourg):

  • For prospects: up to 3 years from the date of collection or from our last contact,
  • For clients of electricity/gas supply:
    • contractual and commercial communications: 10 years form the end of the contract,
    • Payment and invoicing information: 10 years from the closure of the relevant financial year to comply the laws and regulations,
  • For Users of websites : up to 3 years from the data collection,
  • For cookies, please consult our Cookies Policy.

Despite these retention periods, your data may be archived with restricted access for a further period for limited reasons as permitted by law (default payment, warranty, disputes, etc.). NordEnergie undertakes to delete or to anonymise your personal data upon expiry of the retention period as described above.

To whom your data are shared ?

We communicate some data to our technical partners, such as the network operator and to authorized third parties like state authorities, including the authority responsible for regulating the energy markets (ILR), where necessary and in compliance with the Law.

We share personal data with Data Processors within the limit of what is necessary for the performance of the services entrusted to them. In accordance with the terms of the contracts, Data Processors process data in compliance with GDPR on the basis of our instructions in relation to defined purposes and ensure to implement appropriate technical and organisational security measures.

We use the following categories of recipients to provide Services (a list of contracting entities can be shared upon request) :

  • affiliated companies within the Encevo Group for intra-group services (accounting, finance, legal, IT, etc.),
  • Database, sales administration and market interaction software providers,
  • Credit reference and fraud prevention agencies to assess your ability to make payments, credit decisions, identity checks, fraud and money laundering prevention and account management. Credit reference agencies will record the search on your credit file whether or not your application has been successful. (There is no automated decision making based on that research).
  • Credit insurers,
  • Survey provider and market research,
  • IT/Cloud service providers,
  • Payment/debt collection agencies,
  • Regulated social office,
  • Print service providers,
  • Facilities’ service providers,
  • Subsidies’ energy agencies,
  • Third party auditors, where applicable, to meet legal and regulatory obligations.

The data may be transmitted to third parties where this is required or expressly authorised by the Law, to enforce a provision of the law, or further to a judicial/regulatory decision if such disclosure is necessary in the context of an investigation or a legal proceeding and to protect the rights and interests, properties, safety and security of de NordEnergie, our clients or other persons.

Changes to this Privacy Policy

The Privacy Policy will be updated regularly to consider legal, regulatory and operational changes. In case of important changes (e.g.: type of data collected, how we use it or for which purposes), we will highlight such change at the top of the Policy. You are invited to read the Privacy Policy regularly to be informed about its evolution and modifications. The continued use of the Services following the posting of any changes to this Privacy Policy will be deemed as an acceptance of those changes.

Version 2.0 of 12 October 2023

New customer?

You are not yet an NordEnergie customer but you would like to take out a contract? Follow this link.

Already a customer?

Are you already an NordEnergie customer? Take all the necessary steps in your customer area.

New customer?

You are not yet an NordEnergie customer but you would like to take out a contract? Follow this link.

Already a customer?

Are you already an NordEnergie customer? Take all the necessary steps in your customer area.

You are a individual? Find an answer to your needs:
SEE OUR OFFERS FOR INDIVIDUALS

How can I find out about my consumption?

If you have a my.enovos.lu account, you can consult the evolution and details of your consumption at any time by going to the “Consumption” tab of the customer portal.

If you do not have an account and you receive your bills in paper format, you will find information on your consumption on the second page, and on the third page the historical evolution of your consumption. This trend is also shown on the statement of account that you receive in paper format once a year.