Privacy

D3 IoT Limited

Effective Date: 21/10/2026
Last Updated: 21/10/2026

1. Introduction

D3 IoT Limited (“D3”, “we”, “us”, or “our”) is committed to protecting and respecting your privacy.

This Privacy Policy explains how we collect, use, process, store, and protect personal data when you:

• Visit our website

• Contact us directly

• Use the D3 Cloud platform

• Engage with our smart metering, IoT, billing, or ESG reporting services

• Interact with our software, integrations, or associated systems

We are committed to handling personal data lawfully, fairly, securely, and transparently in accordance with:

• The UK General Data Protection Regulation (“UK GDPR”)

• The Data Protection Act 2018

• The Privacy and Electronic Communications Regulations (“PECR”)

• Any other applicable data protection legislation

By accessing our website or using our services, you acknowledge the practices described within this Privacy Policy.

2. Who We Are

D3 IoT Limited is a UK-based smart energy, IoT, and property technology company delivering cloud-based software, smart metering infrastructure, automated billing systems, and ESG data solutions for the commercial real estate sector.

For the purposes of applicable data protection legislation, D3 IoT Limited may act either as:

• A Data Controller, or

• A Data Processor

depending on the nature of the services being provided and the contractual relationship with our clients.

Contact Details

D3 IoT Limited
1 Hardman Street, Spinningfields, Manchester, Greater Manchester, United Kingdom, M3 3HF

info@d3iot.co.uk

www.d3iot.co.uk

3. Definitions

“Website”

Refers to the D3 website and associated web pages.

“Services”

Refers to D3’s products and services including:

• D3 Cloud platform

• Smart metering systems

• IoT infrastructure

• Automated tenant billing

• ESG reporting services

• Building integrations and associated technology services

“Personal Data”

Any information relating to an identified or identifiable individual.

“Operational Data”

Building, utility, environmental, system, and performance data generated through smart meters, IoT devices, or building systems that does not itself identify an individual.

4. Information We Collect

We may collect and process the following categories of information.

A. Personal Information

This may include:

• Name

• Company name

• Job title

• Email address

• Telephone number

• Postal address

• Account login credentials

• Tenant billing contact details (where applicable)

B. Technical Information

Including:

• IP address

• Browser type and version

• Device information

• Operating system

• Website usage data

• Access timestamps

• Referring URLs

• Cookie and analytics data

C. Service & Platform Data

Where users interact with D3 Cloud or related services, we may process:

• Platform access logs

• Meter identifiers

• Utility consumption data

• System performance data

• Building and property data

• Environmental monitoring data

• Integration and API data

The majority of data processed by D3 relates to operational building and utility information rather than personal data.

D. Communications

Including:

• Contact form submissions

• Email correspondence

• Technical support requests

• Marketing preferences

• Business enquiries

5. How We Collect Information

We may collect information through:

• Website forms

• Cookies and analytics tools

• Direct communications

• Platform user accounts

• Smart metering and IoT infrastructure

• Building system integrations

• APIs and third-party software integrations

• Client onboarding processes

6. How We Use Information

We use information to:

• Provide and support our services

• Deliver D3 Cloud functionality

• Respond to enquiries and support requests

• Operate smart metering and billing services

• Generate ESG and energy reporting insights

• Improve website and platform performance

• Monitor service reliability and security

• Maintain system integrity and operational resilience

• Comply with legal and regulatory obligations

• Communicate relevant business information

• Send marketing communications where permitted by law

7. Lawful Basis for Processing

We process personal data under one or more of the following lawful bases:

Legitimate Interests

To operate, maintain, secure, and improve our services and business operations.

Contractual Necessity

Where processing is necessary to fulfil contractual obligations or provide requested services.

Legal Obligation

Where processing is necessary to comply with applicable laws or regulatory requirements.

Consent

Where required for marketing communications or non-essential cookies.

8. Smart Metering, ESG & Operational Data

D3 primarily processes operational building, utility, and environmental data generated through smart meters, IoT devices, and building systems.

This may include:

• Electricity consumption data

• Gas and water usage data

• Environmental monitoring data

• Building system performance information

• ESG reporting datasets

Such information is generally processed for:

• Energy monitoring

• Automated billing

• Operational optimisation

• ESG reporting

• Performance analytics

• System automation

Where tenant billing or user platform access is provided, limited personal data may also be processed in connection with those services.

9. Data Sharing

We may share information with trusted third parties where necessary to deliver our services or operate our business, including:

• Cloud hosting providers

• Software and analytics providers

• ESG reporting platforms

• Property management system integrations

• Technical contractors and consultants

• Professional advisers

• Regulatory authorities where legally required

D3 does not sell, rent, or commercially trade personal data to third parties.

All third-party service providers are expected to maintain appropriate confidentiality, privacy, and security standards.

10. International Data Transfers

Where personal data is transferred outside the United Kingdom, D3 will ensure appropriate safeguards are in place in accordance with UK GDPR requirements.

These safeguards may include:

• UK adequacy regulations

• International Data Transfer Agreements (IDTAs)

• Standard contractual clauses

• Appropriate technical and organisational protections

11. Data Security

D3 implements appropriate technical and organisational measures designed to protect personal data and operational data from unauthorised access, disclosure, misuse, alteration, or loss.

Security measures may include:

• Secure cloud infrastructure

• Encryption technologies

• Role-based access controls

• User authentication procedures

• Network monitoring and logging

• Firewall and endpoint protection

• Secure API and integration controls

• System redundancy and resilience measures

• Regular software maintenance and updates

D3 maintains commercially reasonable measures designed to protect platform integrity, system availability, and client data confidentiality.

D3 may monitor platform activity, access logs, and system performance information for operational integrity, troubleshooting, service improvement, and cybersecurity purposes.

While we take appropriate precautions, no internet-based system can be guaranteed to be completely secure.

12. Data Retention

We retain personal data only for as long as reasonably necessary to fulfil the purposes for which it was collected, including:

• Service delivery

• Contractual obligations

• Legal and regulatory compliance

• Security monitoring

• Dispute resolution

• Business record keeping

Retention periods may vary depending on the nature of the data and applicable legal obligations.

Upon termination of services, client data may be retained in accordance with contractual obligations, legal requirements, and D3’s internal retention policies.

13. Your Rights

Under UK GDPR, you may have rights including:

• The right to access personal data

• The right to correct inaccurate information

• The right to request erasure

• The right to restrict processing

• The right to object to processing

• The right to data portability

• The right to withdraw consent where applicable

Requests relating to personal data may be submitted using the contact details below.

14. Marketing Communications

Where permitted by law, D3 may send business updates, marketing communications, or information relating to our services.

You may opt out of marketing communications at any time by:

• Using the unsubscribe link within communications, or

• Contacting us directly

15. Cookies & Analytics

Our website may use cookies and similar technologies to:

• Improve website functionality

• Analyse website traffic

• Monitor performance and usage

• Enhance user experience

• Support marketing and analytics activities

Non-essential cookies will only be deployed subject to user consent where required by applicable law.

Further information can be found within our Cookie Policy.

16. Third-Party Websites & Integrations

Our website or services may contain links to third-party websites, software platforms, or integrations.

D3 is not responsible for the privacy practices, security, or content of third-party services.

Users should review the privacy policies of external providers before interacting with their platforms.

17. AI Agent Connections

D3 Cloud allows a customer to connect a third-party AI assistant or agent platform — for example ChatGPT or Claude — to their own D3 Cloud account, so that it can answer questions using the data that account can already see. This section explains what that means for personal data.

What triggers a disclosure

Nothing is disclosed to an AI provider unless a person signs in to an existing D3 Cloud account and expressly approves a connection. Approval requires that account's normal authentication, including multi-factor authentication where it is enabled. D3 does not create connections on a customer's behalf.

What is disclosed

A connected agent receives only data within the permissions of the account that approved it, and only within the categories approved at the point of connection. Permissions are resolved on every request rather than stored at approval, so a connection cannot outlast or exceed the access of the person who created it.

Depending on those permissions, this may include building, meter and consumption data, energy contract and supplier invoice information, and — for client administrators — tenant billing information such as customer names, references, invoices, payments and balances.

D3 does not disclose payment instrument details through this route to any connection at any permission level: not card numbers or any part of them, card types or expiry dates, bank sort codes or account numbers, direct debit mandate references, or payment provider customer identifiers. A connected agent may be told that a direct debit or card is held on file, and nothing about it.

Roles and responsibilities

Where D3 acts as a Data Processor for a customer — which is typically the case for tenant billing information — approving a connection is an instruction from that customer to disclose data to a third-party provider the customer has chosen.

The customer remains the Data Controller for that disclosure and is responsible for having a lawful basis for it, for ensuring their own privacy information accounts for it, and for assessing whether it requires a data protection impact assessment.

D3 acts on the instruction and limits the disclosure to the approved account's permissions and categories. D3 does not decide the purposes for which the third-party provider processes the data.

Third-party AI providers

The AI provider is a separate organisation operating independently of D3. Once data has been disclosed to them, D3 has no control over what they do with it, whether they retain it and for how long, whether they use it to train or improve their models, or where in the world they process it.

Customers should review the provider's own privacy and data handling terms before connecting an agent, and should satisfy themselves that those terms are appropriate for the data the connection will reach. Section 10 (International Data Transfers) applies to any transfer D3 makes, but cannot extend to the provider's own subsequent processing.

Logging and retention

Every request made by a connected agent is recorded, including which connection made it, what was asked for, and whether it was answered or refused. These records are retained for security, audit and support purposes under section 12 (Data Retention), and are available to the customer.

Withdrawing a connection

A customer may view every agent connected to their account and withdraw any of them at any time from within D3 Cloud. Withdrawal takes effect immediately and no further requests from that agent are answered. Withdrawal does not affect data already disclosed to the provider, which is subject to that provider's own retention practices.

18. Changes to This Privacy Policy

D3 reserves the right to amend or update this Privacy Policy at any time to reflect:

• Changes in legal requirements

• Operational changes

• Platform updates

• Service enhancements

Updated versions will be published on this page with the revised effective date.

19. Contact Us

If you have any questions regarding this Privacy Policy or how your information is handled, please contact:

D3 IoT Limited
1 Hardman Street, Spinningfields, Manchester, Greater Manchester, United Kingdom, M3 3HF

info@d3iot.co.uk

www.d3iot.co.uk

20. Complaints

If you are dissatisfied with how we process your personal data, you have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO).

Information Commissioner's Office (ICO)

21. Governing Law

This Privacy Policy shall be governed by and construed in accordance with the laws of England and Wales.