Privacy Policy

STG Nations is an independent engineering practice providing technical advisory for utility-scale solar, battery storage and data centre power infrastructure. We are a US practice working with commercial clients across the European Union, primarily in Romania and Bulgaria, under a cross-border services agreement. Enquiries and project data are received and handled in Romania. We do not sell to consumers.

For anything in this policy, write to info@stg-nations.com. A person reads that address.

We collect only what a technical enquiry needs. There is no profiling, no automated decision-making and no sale of data to anyone.

• Name, company, business email, phone \u2014 from the contact form, brief download, AI Energy request or direct email. Used to answer your enquiry, prepare a quote and deliver the work. Legal basis: Art. 6(1)(b), steps prior to a contract.
• Project parameters you enter (capacity, site, tariff assumptions) \u2014 from the calculator and AI Energy form. Used to produce the assessment you asked for. Legal basis: Art. 6(1)(b).
• Email address for the market brief \u2014 from the subscription form. Used to send the brief you subscribed to. Legal basis: Art. 6(1)(a), consent.
• Correspondence and project files \u2014 by email and shared documents. Used to perform the engagement. Legal basis: Art. 6(1)(b).

We do not request special category data under Art. 9. Please do not send it.

• Enquiries that do not become an engagement \u2014 12 months, then deleted.
• Project and client records, invoices and accounting documents \u2014 5 years, counted from 1 July of the year following the reporting financial year, under Romanian Accounting Law no. 82/1991 as amended by Law no. 36/2023.
• Market brief subscribers \u2014 until you unsubscribe, plus 30 days.

We use a small number of service providers, each under a data processing agreement:

• Vercel \u2014 website hosting and delivery
• Sanity \u2014 content management, stores published site content
• IONOS \u2014 business email
• A CRM system, if and when one is introduced \u2014 this policy will be updated first

We do not sell, rent or trade personal data. We disclose it to authorities only where law compels us, and we will tell you if that happens unless we are legally barred from doing so.

Personal data you send us is received and processed in Romania, inside the European Economic Area. It is not routinely transferred outside it.

Some of the service providers in section 4 operate infrastructure that may process data outside the EEA. Where that happens, the transfer is covered by the Standard Contractual Clauses adopted by the European Commission (Implementing Decision (EU) 2021/914), concluded as part of our data processing agreement with each provider. Supplementary measures: encryption in transit and at rest, access limited to the engineer working on your project, and no onward transfer beyond the processors listed. You may request a copy of the safeguards at info@stg-nations.com.

Data is received and handled in Romania, a member state of the European Union, so the GDPR applies to us directly. Article 27, which requires controllers outside the Union to appoint a representative within it, does not apply.

Under the GDPR you may ask us to:

• Access the personal data we hold about you (Art. 15)
• Correct anything inaccurate or incomplete (Art. 16)
• Erase it (Art. 17)
• Restrict how we use it (Art. 18)
• Receive it in a portable format or have it sent to another controller (Art. 20)
• Object to processing based on our legitimate interests (Art. 21)
• Withdraw consent at any time, where consent is the basis \u2014 this does not affect processing already carried out (Art. 7(3))

Write to info@stg-nations.com. We respond within one month, as Art. 12(3) requires, and we do not charge for it. We may ask you to confirm your identity before acting on a request.

If you believe we have handled your data wrongly, tell us first \u2014 we would rather fix it. You also have the right to complain to a supervisory authority in the EU member state where you live, work, or where the issue arose:

• Romania \u2014 ANSPDCP, Autoritatea Nationala de Supraveghere a Prelucrarii Datelor cu Caracter Personal, Bucharest, dataprotection.ro
• Bulgaria \u2014 CPDP, Commission for Personal Data Protection, Sofia, cpdp.bg

We use no analytics cookies and no tracking of any kind. We do not profile visitors, we do not build audiences, and we run no advertising pixels. The only cookies this site sets are strictly necessary ones: they remember your language choice and keep forms working. Because nothing here tracks you, no consent banner is required and none is shown.

If that ever changes, it will change the honest way: a consent banner first, cookies only after you accept, and this section rewritten before anything is switched on.

Access to client data is limited to the engineer working on the engagement. Data is encrypted in transit and at rest with our processors. We do not keep client project files on personal devices. If a breach occurs that is likely to result in a risk to your rights, we notify the competent supervisory authority within 72 hours as Art. 33 requires, and we notify you directly where Art. 34 applies.

We update this page when what we do changes. The date at the top is the date of the current version. Material changes affecting how we use data you already gave us will be notified by email where we hold your address.