SMA Monitoring API Integration — Data Privacy

Application: Fallprotec intranet · Operator: Fallprotec SA · Last updated: April 2026

1. Data Controller

Fallprotec SA
2-4 rue Gustave Loosé, 8346 Grass, Luxembourg
Email: mw@fallprotec.com

2. Data accessed via the SMA Monitoring API

The Fallprotec intranet retrieves the following categories of data from SMA Sunny Portal via the SMA Monitoring API:

• PV plant master data (plant name, location, AC power rating)
• Device data (inverter identification, model, configuration)
• Measurement data (energy production, power output, time series)
• Event logs related to PV plant operation

This data relates to PV plants owned and operated by Fallprotec SA and does not contain personal data of natural persons in the ordinary course of operation.

3. Purpose of processing

• Internal monitoring of on-site renewable energy generation.
• ISO 14001 environmental performance reporting.
• Employee information and awareness regarding renewable energy use at Fallprotec sites.

4. Legal basis

Processing is based on Article 6(1)(f) GDPR (legitimate interest of Fallprotec SA in monitoring its own infrastructure for environmental compliance and operational purposes).

5. Storage and processing location

Data retrieved via the SMA Monitoring API is stored on Fallprotec's internal infrastructure, located in Luxembourg, and is not transferred to third parties or processed outside the European Union.

6. Retention

Data is retained for as long as the SMA Monitoring API integration is active and the system owner's authorization remains valid. Upon revocation of authorization or termination of the SMA Monitoring API contract, data retrieved from SMA will be handled in accordance with §7.9 of the SMA Monitoring API contract.

7. Authorization and revocation

Authorization to access SMA plant data is granted by the SMA system owner via the SMA OAuth 2.0 Authorization Code Grant flow. The system owner may revoke this authorization at any time via SMA Sunny Portal, which immediately terminates the Application's access.

8. Rights of data subjects

Where personal data is processed, data subjects have the rights of access, rectification, erasure, restriction of processing, data portability, and objection under Articles 15–22 GDPR. Requests can be addressed to the contact below.

9. Contact

For questions or requests concerning data processing in connection with the SMA Monitoring API integration, contact: mw@fallprotec.com.