Privacy Policy

1) What this policy covers

The Consumer Data Right (CDR) lets you choose who can access certain energy data about you, often called Open Energy. With your explicit consent, we can securely receive CDR data from your data holder, for example your energy retailer or distributor.

This policy sets out how Metering Solutions Australia (TradePilot Pty Ltd) (“we”, “us”, “our”) collects, uses, stores and discloses CDR data that you choose to share with us, so you remain in control.

For how we handle personal information outside the CDR system, see our general Privacy Policy at meteringaus.com.au/privacy.

2) What CDR data we may collect

If you enable features that require CDR data, and only with your consent, we may receive:

• Customer details – name (individual or organisation), addresses and contact information.
• Service point and usage – NMI (National Meter Identifier), metering identifiers, interval reads, consumption and generation data.
• Distributed Energy Resources (DER) – make, model and capacity of solar PV, batteries, inverters and related assets.
• Energy account information – account numbers, plan or contract details and concessions.
• Invoices and billing – invoice periods, issue and due dates, tariffs and charges, once-off fees, payments and payment methods.

We request only what is needed for the features you turn on.

3) Why we use your CDR data

With your consent, we use your CDR data to:

• Visualise and explain your energy use with tailored insights to optimise consumption and generation.
• Compare energy plans that may better match your actual usage.
• Model solar and storage opportunities, for example if or when a battery, solar upgrade or efficient hot-water system could make sense.

4) Who we disclose your CDR data to

We do not sell your CDR data. We do not disclose your CDR data to third parties unless:

• You explicitly request us to, for example to share insights with your installer or advisor.
• Disclosure is required or permitted by law or regulation, for example by a regulator or court order.
• We use trusted service providers who operate our systems, such as secure cloud infrastructure. Where service providers are involved, they are bound by contract and technical safeguards and must only use data to provide services to us.

5) Where and how we store your CDR data

We develop and maintain our own software to work with CDR energy data. All CDR data is stored and processed on Amazon Web Services (AWS) infrastructure located in Australia.

We apply layered security controls, role-based access, encryption in transit and at rest, secure development practices and ongoing monitoring.

6) Granting, duration and managing your consent

• You will be asked to provide consent whenever you enable a feature that needs CDR data.
• Consent lasts for a maximum of 12 months and then expires automatically unless you renew it.
• You can withdraw consent at any time via your Metering Solutions Australia dashboard or via your data holder.

7) If consent is withdrawn or expires

• When your consent expires or you withdraw it, all personally identifiable CDR data is deleted from our systems, subject to legal retention requirements.
• We will notify you in advance of expiry and invite you to renew. If you do not renew, affected features will be disabled.
• If you later re-consent, some historic data may be unavailable, which can limit the accuracy or completeness of insights.

8) If your subscription ends or isn’t renewed

If your Metering Solutions Australia subscription ends, we will automatically revoke your CDR consent or consents and delete your CDR-derived data 30 days after the end date, subject to legal retention requirements.

9) Notifications and handling of data breaches

If a data breach occurs that involves your CDR data, we will notify you as soon as practicable so you can take steps to reduce any risk. We will:

• Contain the breach.
• Investigate the incident and reduce any risk of harm.
• Notify the regulator where an eligible data breach is identified under the Notifiable Data Breaches scheme.
• Review and improve our processes, policies and controls to help prevent recurrence.

10) Your rights and how to make a complaint

If you have concerns about how your CDR data or personal information is handled, please contact us:

Please include your name, contact details, site name and/or site ID, and details of your complaint.

We will acknowledge your complaint promptly, assess whether it can be resolved immediately, investigate where needed, and propose an outcome. If resolution takes longer than 5 business days, we will send you a progress update with an expected timeframe.

You may also contact the Office of the Australian Information Commissioner (OAIC) after first raising the issue with us. Australian law generally allows us 30 days to respond:

11) Your choices and controls

• View or update your preferences and manage CDR consents in your dashboard.
• Withdraw consent at any time.
• Request access to or deletion of personal information we hold outside the CDR system via our Privacy Policy process.

12) Updates to this policy

We may update this policy to reflect operational, legal or regulatory changes. When we do, we will post the new version at meteringaus.com.au/privacy and update the effective date above.

Material changes will be communicated via reasonable notices, for example in-app or by email.

13) Definitions (plain English)

CDR data

Energy-sector data covered by Australia’s Consumer Data Right that you authorise to be shared.

Data holder

The organisation that holds your CDR data, for example your energy retailer.

DER

Distributed Energy Resources such as solar PV systems, batteries and inverters.

De-identified

Data that cannot reasonably identify you because direct and indirect identifiers are removed or transformed.