Home›Data Processing Agreement
Data Processing Agreement
The DPA governs how Helios handles the personal data an installer organization entrusts to it. It applies to Helios Pro only — solar system owners are covered by the customer privacy policy.
Who the parties are
Under GDPR Article 28, your installer company is the controller of your end customers’ personal data, and Helios Energy Management Solutions (Alamanas 50, Dali, Nicosia 2547, Cyprus) is the processor acting on your instructions. The DPA is the contract that makes that lawful. Without one in place, neither party may process that data.
How it is entered into
The DPA is incorporated into the Helios Pro Terms of Service. You accept it during signup, via a separate checkbox from the Terms and Privacy Policy, and that acceptance is recorded with a timestamp and the policy version in your organization’s consent ledger — visible to your admins under Settings → Organization & Privacy.
If your organization requires a signed counterpart rather than click-through acceptance, email privacy@helios-energy.app and we will provide one.
What the DPA covers
- Subject matter and duration — processing lasts for the life of your subscription, plus the retention windows set out in the privacy policy.
- Instructions — Helios processes your end-customer data only to operate the platform for you, and on your documented instructions.
- Confidentiality — staff with access are bound by confidentiality obligations.
- Security — the technical and organisational measures Helios applies, including encryption in transit and at rest, tenant isolation, and audit logging.
- Sub-processors — the parties Helios engages, listed in Annex III below, with 30 days’ notice before the list changes.
- Data subject rights — how Helios assists you in answering access, rectification, erasure and portability requests.
- Breach notification — how and how quickly Helios notifies you of a personal data breach.
- Deletion and return — what happens to the data when the subscription ends.
- Audit — your rights to information demonstrating compliance.
- International transfers — the safeguards applied where a sub-processor operates outside the EEA, as recorded in Annex III.
Annexes and history
- Annex III — sub-processor register, published and maintained under the DPA
- Change history — material changes to this agreement over time
Contact
For anything concerning this agreement, a signed counterpart, or a data protection question:
Email: privacy@helios-energy.app
Helios Energy Management Solutions, Alamanas 50, Dali, Nicosia 2547, Cyprus