ECO-ESS

Last updated: March 2026

1. Who We Are

ECO-ESS is a product of OMNI Heat & Power Ltd ("we", "us", "our"). We provide automatic transfer switch (ATS) monitoring equipment and notification services for domestic and commercial customers in the United Kingdom.

Data Controller: OMNI Heat & Power Ltd
Contact: privacy@eco-ess.co.uk

2. What Data We Collect

Data	Purpose
Email address	Account login, email notifications, password reset
Password (bcrypt-hashed)	Account authentication
Name (optional)	Display in the portal
Shelly device ID	Link your ATS device to your account
Site/location label	Identify your property in notifications
FCM push token	Deliver push notifications to your browser/device
Notification preferences	Respect your push/email on/off choices
ATS event data	Grid power status changes (on/off, timestamps)

3. Why We Process Your Data

We process your data under the following lawful bases (UK GDPR):

• Contract performance (Art. 6(1)(b)): Providing the ATS monitoring and notification service you signed up for.
• Legitimate interest (Art. 6(1)(f)): System security, fraud prevention, service improvement.
• Consent (Art. 6(1)(a)): Sending push and email notifications. You can withdraw consent at any time via your dashboard.

4. Third-Party Processors

We use the following third-party services to deliver notifications:

Service	Provider	Purpose	Data Shared
Firebase Cloud Messaging	Google LLC	Push notification delivery	FCM token, notification content
Resend	Resend Inc.	Email delivery	Email address, notification content
Managed PostgreSQL	DigitalOcean LLC	Database hosting	All account and device data
App Platform	DigitalOcean LLC	Web hosting	None (static site)

All processors are bound by data processing agreements and comply with UK GDPR requirements. Data may be transferred outside the UK where processors maintain adequate safeguards (Standard Contractual Clauses).

5. Data Retention

• Account data: Retained until you delete your account.
• FCM tokens: Automatically pruned after 30 days of inactivity.
• Password reset tokens: Expire after 1 hour, cleaned up periodically.
• ATS event data: Not stored long-term. Events are processed in real-time and forwarded as notifications.

6. Your Rights

Under UK GDPR, you have the right to:

• Access your data — view it in your dashboard or contact us.
• Rectification — update your details via the dashboard.
• Erasure — delete your account from the dashboard (removes all data).
• Restrict processing — disable notifications per-device in your dashboard.
• Data portability — contact us for an export of your data.
• Object — contact us to object to processing.
• Withdraw consent — toggle notifications off at any time.

To exercise any of these rights, email privacy@eco-ess.co.uk.

7. Security

• Passwords are hashed using bcrypt (never stored in plain text).
• All connections use HTTPS/TLS encryption.
• API access is authenticated with JWT tokens.
• Push notifications are delivered only to authenticated, per-user FCM tokens (not public topics).
• Database access is restricted to cloud functions with SSL-encrypted connections.

8. Cookies

This portal uses localStorage (not cookies) to store your authentication tokens. We do not use tracking cookies, analytics, or third-party advertising.

9. Children

This service is not intended for children under 16. We do not knowingly collect data from children.

10. Changes

We may update this policy. Material changes will be communicated via the portal or email. Continued use of the service after changes constitutes acceptance.

11. Complaints

If you are not satisfied with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO).