Skip to main content

Privacy Notice

BESSview, operated by Birdview Energy

As of: October 2026

This Privacy Notice explains which personal data we process when you visit the BESSview website (www.bessview.de, www.bessview.nl, bessview.com), the BESSview documentation site (docs.bessview.de) and the BESSview application (the "Platform"; website, documentation and Platform together the "Website"), for which purposes we do so, and which rights you have.

1. Data Controller

The controller for the processing of personal data within the meaning of Art. 4 No. 7 GDPR is:

Birdview Energy B.V.

IJsbaanpad 2

1076 CV Amsterdam

Netherlands

Chamber of Commerce (KvK) number: 96662387

E-mail: info@birdviewenergy.ai

If you have any questions regarding the processing of your personal data, or wish to exercise your rights, you can contact us at the details provided above. We have not appointed a Data Protection Officer; the address above is also the contact point for data protection matters.

2. What Personal Data Do We Process About You

We process personal data that you provide to us, and a limited amount of technical data that your browser transmits automatically when you use the Website. Personal data is any information that can be used to identify a person, either alone or in combination with other data, such as your name or e-mail address. Information that does not allow conclusions to be drawn about a person's identity (anonymous data) does not constitute personal data.

The Platform is a business tool for simulating battery energy storage projects. Most of the data you enter into it (site locations, battery parameters, market scenarios, production profiles, cost items, simulation results) relates to projects and companies, not to natural persons. Where such content nevertheless contains personal data, for example a contact name typed into a description, it is processed as described in Section 3.3.

3. For What Purpose Do We Process Your Data and on What Legal Basis?

Which personal data we process, for which purposes and on which legal basis depends on the services and functions you use. The following sections describe the processing in detail.

3.1. Technical Provision of the Website

3.1.1. Hosting

The Website and the Platform, including the database in which your account and project data are stored, are hosted on servers rented from STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. The servers are located in data centers in Germany (European Union). STRATO acts as our processor and does not use your data for its own purposes.

We do not use a content delivery network or a third-party web security service in front of the Website.

Personal data is processed in this context to protect our legitimate interest in the smooth and secure provision of the Website and the functions, services and content provided on it. The legal basis is Art. 6(1)(f) GDPR.

3.1.2. Automated Collection of Log Data and Server Log Files

When you access the Website, your browser automatically transmits technical log data. We process this data to establish a working connection to the Website and store it in log files to ensure the security and stability of the Website and to investigate errors and misuse.

The log data include: the IP address of the requesting device, date and time of access, the URL of the requested resource, the website from which the access was made (referrer URL), the browser used and, if applicable, the operating system of your device. The Platform itself logs only failed requests and errors, not successful page views.

Log files are overwritten on a rolling basis and are typically kept no longer than 30 days.

The processing of your data for the above purposes is carried out to protect our legitimate interest in the security and functionality of the Website. The legal basis is Art. 6(1)(f) GDPR.

3.1.3. Cookies and Similar Technologies

The Platform uses only technically necessary cookies. We do not use analytics, tracking or marketing cookies, and we do not use a cookie consent tool, because no consent is required for technically necessary cookies.

Cookies are small text files that are stored on your device when you visit the Website. The Platform sets the following cookies:

  • A session cookie that keeps you logged in after you have signed in. It is valid for 30 days and is renewed while you keep using the Platform. It is deleted when you log out.
  • A short-lived two-factor challenge cookie that is set between entering your password and entering your second-factor code, if you have enabled two-factor authentication. It expires after a few minutes.

In addition, the Platform may store interface preferences (for example the selected theme or the state of a panel) in your browser's local storage. This information stays on your device and is not transmitted to us.

The legal basis for technically necessary cookies and browser storage is Art. 6(1)(f) GDPR in conjunction with Article 11.7a of the Dutch Telecommunications Act (Telecommunicatiewet), which exempts strictly necessary storage from the consent requirement.

You can configure your browser to reject cookies and delete cookies that have already been stored. Without the session cookie you cannot stay logged in to the Platform.

3.2. Registration and User Account

You can register on the Platform and create a user account. Registration is also possible by accepting an invitation that an administrator of your organization sends to your e-mail address.

During registration we process the data required to create a personal user account: first name, last name, business e-mail address, password and the name of your company (which becomes your organization on the Platform). Your password is stored only as a salted hash (argon2id); we cannot read it. After registration we send a verification e-mail to confirm that you control the e-mail address.

If you are our contractual partner yourself, the processing is necessary for the initiation and performance of the contract with you; the legal basis is Art. 6(1)(b) GDPR. If you are not our direct contractual partner but a contact person or employee of our contractual partner (your organization), we process your personal data to the extent necessary for the performance of the contract, based on our legitimate interest in performing the contract with your organization. In this case the legal basis is Art. 6(1)(f) GDPR.

3.3. Use of the Platform

After successful creation of your user account you can log in and access the functions of the Platform. Logging in is done via a protected login, optionally with two-factor authentication.

In the course of using the Platform we process the following data in addition to your registration data:

  • Login and session data: e-mail address, time of login, session identifier, time of last activity.
  • Two-factor authentication data (only if you enable it): the secret used to generate one-time codes, stored in encrypted form, and your recovery codes, stored as hashes.
  • API tokens that you create to access the Platform programmatically, stored as hashes.
  • Audit log: the Platform records security-relevant and account-changing actions (for example login, logout, account lock, creation, change, run or deletion of a simulation, template or location) together with the acting user's name, the organization, the affected object, the time and the IP address from which the action was performed. The audit log helps organization administrators and us to trace changes and detect misuse. Audit log entries are deleted automatically after 42 days.
  • Project data you enter or upload: locations (name, coordinates, country, technical site parameters), production profiles, market scenarios and price files, battery and grid configurations, cost items and templates, simulation settings and results, comparison sets and notes. This data belongs to your organization and is visible to the other members of your organization.
  • Usage state: which version of the release notes and which onboarding steps you have already seen, so that we do not show them again.

The legal basis is Art. 6(1)(b) GDPR if you are our contractual partner, and otherwise Art. 6(1)(f) GDPR based on our legitimate interest in performing the contract with your organization, as described in Section 3.2.

3.4. Billing and Payment

In connection with billing we process the data required for invoicing, in particular: organization name, billing contact e-mail address, selected plan or credit package, billing period, amount and payment status.

Payments are processed by Mollie B.V., Keizersgracht 126, 1015 CW Amsterdam, Netherlands. When you start a purchase, we create a customer record at Mollie containing your organization name and contact e-mail address, and you complete the payment on Mollie's checkout page, which may be displayed inside the Platform. Mollie processes your payment details (for example card or bank account data) under its own responsibility; we never receive or store full payment credentials. We store Mollie's customer and payment identifiers to match payments to your organization.

The legal basis for processing is the performance of the contract pursuant to Art. 6(1)(b) GDPR, provided that you are our contractual partner. If you are a contact person of our contractual partner, the legal basis is Art. 6(1)(f) GDPR, based on our legitimate interest in performing the contract with your organization. The retention of invoicing data is additionally required by law (Section 4).

3.5. Transactional E-mail

We send e-mails that are necessary for operating your account: e-mail address verification, password reset, organization invitations and similar service messages. We do not send newsletters or marketing e-mails.

These e-mails are sent via the mail servers of Strato GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany, which acts as our processor. Strato receives the recipient address and the content of the e-mail for the purpose of delivery.

The legal basis is Art. 6(1)(b) GDPR, or Art. 6(1)(f) GDPR based on our legitimate interest in operating the account securely, as described in Section 3.2.

3.6. AI Assistant (Optional)

The Platform contains an optional assistant that can answer questions about your sites, scenarios and simulations and can run simulations on your behalf. The assistant is switched off by default and is enabled per organization at the request of the organization.

When you use the assistant, the messages you type, the conversation history of the current session and the project data the assistant retrieves to answer you (for example your locations, saved simulations, scenario names, cost items and results) are transmitted to Anthropic, PBC, 548 Market St, San Francisco, CA 94104, USA, which operates the language model that generates the answers. Anthropic acts as our processor under a data processing agreement. According to Anthropic's commercial terms, data submitted through its API is not used to train its models and is retained only for a limited period for abuse prevention.

If you do not want your data to be transmitted to Anthropic, do not use the assistant. Your organization's administrator can also ask us to disable it for your organization.

The legal basis is Art. 6(1)(b) GDPR if you are our contractual partner, and otherwise Art. 6(1)(f) GDPR based on our legitimate interest in providing the functions requested by your organization. For the transfer to the USA see Section 6.

3.7. Map Display

When you create or edit a location, the Platform shows an interactive map. The map tiles are loaded from the OpenStreetMap tile server tile.openstreetmap.de, operated by FOSSGIS e.V., Germany. To load the tiles, your browser transmits your IP address and the map area you are viewing to that server. No cookies are set by the tile server.

The legal basis is Art. 6(1)(f) GDPR, based on our legitimate interest in displaying a map for selecting site locations without operating our own tile infrastructure.

3.8. Security and Abuse Prevention

We process personal data to protect the Platform, our users and the integrity of your data against unauthorized access and misuse. For this purpose we process in particular:

  • IP address and browser information;
  • login and session data, including failed login attempts;
  • the audit log described in Section 3.3.

Specifically, we limit the number of login, password reset and verification attempts per IP address and per e-mail address within a given time window, and we may lock an account after repeated failed attempts. We do not create behavioral profiles for this purpose.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in preventing and investigating unauthorized access, protecting against financial damage and ensuring the security and integrity of our services and our users' data.

3.9. Contact

If you contact us by e-mail or through the contact details provided on the Website, we process your data to handle the inquiry. The data processed includes your contact details (name, company, e-mail address, telephone number if provided) and any further information you provide in your message, including attachments.

If you are our (potential) contractual partner yourself, the legal basis is Art. 6(1)(b) GDPR. If you are a contact person of our (potential) contractual partner, the legal basis is Art. 6(1)(f) GDPR, based on our legitimate interest in initiating or performing a contract with your organization.

3.10. Defense Against Legal Claims

Where necessary, we process your personal data to the extent required to exercise legal claims or to defend against claims. This processing is based on our legitimate interest in the effective exercise or defense of rights; the legal basis is Art. 6(1)(f) GDPR.

3.11. Anonymized Usage Data

We may anonymize usage-related data for the purpose of improving and developing the Platform, for example to see which functions are used and how simulations perform. Anonymized data can no longer be linked to you. The processing of personal data for the purpose of anonymization is carried out to safeguard our legitimate interest in improving and developing the Website; the legal basis is Art. 6(1)(f) GDPR.

4. How Long Do We Store Your Data?

We process your personal data only for as long as necessary for the respective purpose:

  • Account data (Section 3.2 and 3.3) for as long as your user account exists. When your account is deleted, your personal data is deleted; project data remains available to your organization unless the organization is deleted as well.
  • Sessions expire 30 days after last use or when you log out.
  • Audit log entries are deleted after 42 days.
  • Server log files are overwritten on a rolling basis, typically within 30 days.
  • Assistant conversations are kept for the duration of your session on the Platform; Anthropic's retention is described in Section 3.6.

In addition, we are subject to statutory retention obligations. Under Dutch tax and commercial law (Article 52 of the General Tax Act and Article 2:10 of the Civil Code) invoices, payment records and related business correspondence must be retained for seven years. Data may also be retained for the duration of the statutory limitation periods for legal claims, which under the Dutch Civil Code are generally five years and in exceptional cases up to twenty years.

5. To Whom Do We Disclose Your Data?

We use external service providers as processors (Art. 4 No. 8 GDPR). They process personal data on our behalf and according to our instructions, and we share your personal data with them only to the extent necessary. In addition, some recipients are themselves controllers within the meaning of Art. 4 No. 7 GDPR.

Specifically, we share your personal data with the following recipients:

  • STRATO GmbH (Germany) as hosting provider for the Website, the Platform, its database and backups, and as e-mail delivery provider for transactional e-mails;
  • Mollie B.V. (Netherlands) as payment service provider, which also acts as an independent controller for the payment transaction itself;
  • Anthropic, PBC (USA) as provider of the language model behind the optional AI assistant, only if your organization has enabled the assistant and you use it;
  • FOSSGIS e.V. (Germany) as operator of the map tile server, which receives your IP address when the map is displayed;
  • the other members of your organization on the Platform, who can see your name and e-mail address and the project data you create;
  • authorities, to the extent a legal obligation exists.

6. Is Data Transferred to a Third Country?

Our hosting, database, e-mail and payment providers are located in the European Union, and your account and project data are stored in Germany.

Personal data is transferred to a country outside the EU/EEA (a so-called third country) only in connection with the optional AI assistant (Section 3.6): the messages and project data processed by the assistant are transmitted to Anthropic, PBC in the USA. This transfer takes place in compliance with applicable data protection law, on the basis of the standard contractual clauses adopted by the EU Commission (Art. 46(2)(c) GDPR), which form part of our data processing agreement with Anthropic, and, where applicable, an adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR).

7. From Which Sources Do Your Data Originate?

We process personal data that you provide to us directly (during registration, when using the Platform, when paying or when contacting us), that an administrator of your organization provides when inviting you, or that we collect automatically in connection with your use of the Website (technical log data, audit log).

8. Are You Obliged to Provide Your Data?

You are neither legally nor contractually obliged to provide us with personal data. Excluded from this are the data required for registration and login on the Platform (name, e-mail address, password). Without this data we cannot create a user account or provide the Platform to you.

When using the Website, your browser also automatically transmits technical log data (Section 3.1.2). Without this technical data it is not possible to access the Website.

Otherwise, you are only asked to provide the data necessary for the functions you use. Without this data the corresponding function may not be available or may be limited.

9. Is There Automated Decision-Making Including Profiling Pursuant to Art. 22 GDPR?

Automated decision-making including profiling pursuant to Art. 22 GDPR does not take place. The simulation results produced by the Platform relate to energy storage projects, not to natural persons, and have no legal or similarly significant effect on you.

10. What Are Your Rights?

With regard to the processing of your personal data, you have the right of access (Art. 15 GDPR), the right to rectification (Art. 16 GDPR), the right to erasure (Art. 17 GDPR), the right to restriction of processing (Art. 18 GDPR) and the right to data portability (Art. 20 GDPR).

You may revoke any consent you have given to the processing of your data pursuant to Art. 7(3) GDPR at any time with effect for the future.

You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The supervisory authority responsible for us is the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, Postbus 93374, 2509 AJ Den Haag, www.autoriteitpersoonsgegevens.nl). You may also contact the supervisory authority of your habitual residence or place of work.

Where we base the processing of your personal data on a legitimate interest pursuant to Art. 6(1)(f) GDPR, you may object to the processing:

Special Information About Your Right to Object in Accordance with Art. 21 GDPR

You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you on the basis of Art. 6(1)(f) GDPR (processing based on a balancing of interests); this includes profiling based on those provisions (Art. 4 No. 4 GDPR). Should you object to the processing, we will stop processing personal data concerning you, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defense of legal claims.

We do not process your personal data for direct marketing purposes.

The objection is not subject to any particular form. Ideally, it should be sent by e-mail to the contact details provided in Section 1.

To exercise the aforementioned rights, you can contact us via the contact details provided in Section 1. You can change your name, e-mail address and password yourself in the profile settings of the Platform.

11. Changes to this Privacy Notice

We reserve the right to update this Privacy Notice from time to time to reflect changes in legal requirements or in our data processing practices. Amendments take effect upon publication on the Website.

As of: October 2026