Kyoto Group As Privacy Policy

1. Introduction and Scope

This Privacy Policy describes how Kyoto Group AS (from now on "we," "us," or "Kyoto Group"), including its subsidiaries, collects, uses, processes, and protects personal data in connection with our thermal storage solutions business, including our Heatcube products and services. This policy applies to all personal data we process, including data from customers, prospects, suppliers, business partners, website visitors, and other stakeholders across our operations in jurisdictions subject to GDPR and equivalent European data protection laws. This policy does not apply to personal data of employees of Kyoto Group or its subsidiaries, including employees employed through an employer of record or job applicants, which is governed by a separate employee privacy notice and employment policies.

Kyoto Group AS is the data controller for the company's processing of personal data. Where we act as a data processor for our customers, separate data processing terms govern our obligations.

2. Categories of Personal Data We Process

We process the following categories of personal data in connection with our business operations:

2.1 Customer and Prospect Information

We collect contact details, company information, and technical and operational requirements when you inquire about or use our Heatcube thermal storage solutions. This may include information about facility location, operating hours, heat demand and characteristics, grid connection details, energy prices, and other costs related to heat production or supply, as well as site constraints. We also process contract terms and performance data from the Heatcube system to ensure optimal design, operation and service delivery. Much of the technical, operational, and facility information we collect relates to companies, sites, and industrial processes rather than individuals. However, where this information is provided by, associated with, or linked to an identifiable contact person, we treat the relevant contact details and related responses as personal data.

2.2 Supplier and Business Partner Data

We collect contact information and company details from our suppliers, installation and maintenance partners, and other business partners. We also maintain performance records and technical specifications to ensure quality standards and compliance with our agreements.

2.3 Technical and Operational Data

Our Heatcube installations generate performance data, maintenance records, and safety compliance information. This data helps us optimize your thermal storage system and provide ongoing support.

2.4 Website and Communication Data

When you visit our website or contact us, we collect information you provide through contact forms, newsletter subscriptions, and event registrations. We also collect web analytics data to improve your experience on our site.

2.5 Sales and Marketing Prospecting

We may collect and use business contact information for sales and marketing purposes. This may include names, job titles, business email addresses, business phone numbers, company names, business locations, professional profile information, areas of responsibility, event attendance, interaction history, lead status, and information about potential interest in Heatcube or other Kyoto products and services.

We use this information to identify relevant business contacts, understand whether Heatcube may be relevant to your company, manage sales outreach, maintain CRM records, and measure the effectiveness of our sales and marketing activities.

We may also use CRM, analytics, and sales tools to help our sales team organize business contact information, prioritize business opportunities, and tailor follow-up. These tools support our sales team’s review and do not make legally binding or similarly significant decisions about individuals.

2.6 Sources of Personal Data

We may collect personal data directly from you when you contact us, complete a form or questionnaire, subscribe to communications, register for an event, meet with us, enter into a contract with us, or otherwise interact with Kyoto.
We may also receive business contact information from other sources, including your company, colleagues or other referrals, public professional sources, company websites, LinkedIn and other professional networks, events and conferences, CRM and sales tools, sales intelligence providers, business partners, and publicly available sources.

Where we receive personal data from sources other than you, we use it for the purposes described in this Privacy Policy, including business development, sales outreach, customer relationship management, supplier management, and related administrative purposes.

3. Legal Bases for Processing

We process personal data based on the following legal bases:

  • Consent - Where you have given us permission for a specific purpose, including subscribing to newsletters, event updates, market insights, or other marketing communications. You may withdraw consent at any time.

  • Contract Performance - To fulfill our agreements with you.

  • Legal Compliance - To meet our legal and regulatory obligations.

  • Legitimate Interest - For our business operations, customer and supplier relationship management, B2B sales outreach, relevant marketing to business contacts, website security analytics, and service improvement, where our interests are not overridden by your privacy rights. You may object to direct marketing at anytime.    

4. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, or protect our legitimate business interests. Our retention periods are determined based on:

  • Business relationship duration and nature

  • Applicable legal and regulatory requirements

  • Contractual obligations and warranty periods

  • Legitimate business needs for records and documentation

  • Data subject requests and consent withdrawal

We periodically review our data holdings and delete personal data when retention is no longer justified. You may contact us to request information about retention periods applicable to your specific data.

5. International Data Transfers

As a company operating across the European Economic Area and the United Kingdom, we may transfer personal data between our offices and operations. All such transfers are conducted in accordance with applicable data protection laws.

For any transfers outside the EEA, we ensure appropriate safeguards are in place, including:

  • Standard Contractual Clauses approved by the European Commission

  • Adequacy decisions where applicable

  • Other legally recognized transfer mechanisms under the GDPR

6. Specific Processing Activities

6.1 Newsletter, Event Updates, and B2B Marketing Communications.

You may choose to subscribe to Kyoto newsletters, event updates, market insights, and other marketing communications. Where you subscribe, we process your email address, company name, and related communication preferences to send you the communications you requested. The legal basis for this processing is consent, and you may withdraw your consent at any time by using the unsubscribe link in our emails or contacting us.

We may also send B2B sales and marketing communications to business contacts where we believe the communication is relevant to the recipient’s role, company, or business interests. This may include information about Heatcube, Kyoto products and services, events, and energy-market insights. The legal basis for this processing is our legitimate interest in developing business relationships and marketing relevant industrial energy solutions to business contacts, subject to your right to opt out.

You may opt out of marketing communications at any time by using the unsubscribe link in our emails or contacting us at privacy@kyotogroup.no. If you opt out, we will stop sending you marketing communications and may retain limited information necessary to respect your opt-out preference.

We use HubSpot to manage newsletters, event updates, B2B marketing communications, and related unsubscribe preferences.

6.2 Web Analytics and Cookies.

Our website uses cookies, pixels, and similar technologies. Cookies are small text files stored on your device when you visit a website. We use cookies mainly to operate our website, improve and analyze your experience, remember preferences, support website functionality, and, where you consent, support marketing, advertising, conversion tracking, and personalization.

When you first visit our website, you will be presented with a cookie banner that allows you to accept or reject non-essential cookies by category. You can change your cookie preferences at any time through the cookie banner or cookie settings, or by adjusting your browser settings. Blocking some types of cookies may affect your experience on the website and limit some services we are able to provide.

Necessary Cookies: These cookies are necessary for the website to function and cannot be switched off in our systems. They are usually set in response to actions you take, such as setting privacy preferences, logging in, filling in forms, or using website security features.

Analytics Cookies: If you consent to analytics cookies, we use them to understand how visitors engage with our website. This may include information such as page visits, session duration, referring websites, device and browser type, and general interaction with website content.

Advertisement Cookies: If you consent to advertisement cookies, we may use cookies, pixels, and similar technologies to make Kyoto ads more relevant and useful. This may include showing Kyoto advertisements on other websites and social media platforms, selecting ads based on what may be relevant to you, improving reporting on ad campaign performance, avoiding showing the same advertisement repeatedly, and measuring whether visitors who clicked on our ads later contacted us, submitted a form, or took other actions on our website.

Functionality Cookies: If you consent to functionality cookies, we may use them to personalize and optimize your website experience, remember preferences, support chat functionality, or remember previous interactions with our website.

Conversion Tracking and Personalization: If you consent to relevant cookies and later submit a form, we may use tools such as HubSpot to associate your form submission with prior interactions on our website. This helps us understand how visitors engage with our content, measure marketing effectiveness, and tailor follow-up where relevant.

We use tools such as Google Analytics and HubSpot for website analytics, conversion tracking, personalization, and marketing measurement. Google LLC and HubSpot, Inc. are certified under the EU-U.S. Data Privacy Framework and related UK and Swiss extensions. You can verify certification status at www.dataprivacyframework.gov/list. Information collected by Google Analytics is subject to Google’s Privacy Policy. Information collected by HubSpot is subject to HubSpot’s Privacy Policy.

We rely on your consent for non-essential cookies. You may withdraw consent at any time by changing your cookie preferences or contacting us at privacy@kyotogroup.no.

Cookie retention periods vary depending on the cookie and provider. More detailed information about the cookies used on our website, including provider, purpose, category, and retention period, is available in our cookie banner or cookie settings.

Our web servers also log certain technical information for security and operational purposes, including IP address, time of access, website address, HTTP status, number of bytes sent, HTTP referrer, and user agent. These server logs are retained for 15 days and then deleted.

6.3 Search.

We may use aggregate search and website interaction data to improve website content and navigation.

6.4 Social Media Presence.

Kyoto maintains pages and content on social media platforms, including LinkedIn and YouTube. If you interact with Kyoto through those platforms, the relevant platform may process information about your interaction in accordance with its own privacy policy. This may include information about your profile, engagement with our content, and use of the platform.

For more information, please see:

6.5 Events, Webinars and Training.

When you register for a Kyoto event, webinar, training session, or similar activity, we may collect information such as your name, organization, job title, business email address, business phone number, address, attendance preferences, and invoice reference where relevant.

We use this information to manage registration, communicate with participants, organize event logistics, provide materials, manage attendance, process applicable payments, and follow up about the event. Where appropriate, we may share limited participant information, such as name, organization, and job title, with other participants to support networking. If you do not want your details included on a participant list, you can tell us during registration or contact us. We may share registration information with service providers that help us deliver the event.

6.6 Contact Us.

If you contact us through our website, we may collect your name, email address, company name, country, and the information you include in your message so we can respond to your enquiry. We process this information to respond to your enquiry and, where relevant, to take steps before entering into a contract with you. The legal basis is our legitimate interest in responding to business enquiries and, where applicable, pre-contractual steps.

7. Data Sharing

We may share personal data with the following categories of recipients where necessary for the purposes described in this Privacy Policy:

  • Kyoto Group companies: For business operations, administration, customer support, sales, finance, and governance.
  • Service providers: Vendors and processors who provide services such as hosting, IT, CRM, analytics, marketing, event management, payment processing, accounting, installation, maintenance, support, and professional services.
  • Finance, audit, and governance recipients: Auditors, accountants, banks, insurers, investors, potential investors, board advisers, and other professional advisers, where reasonably necessary for finance, audit, governance, financing, reporting, or transaction purposes.
  • Authorities and legal recipients: Public authorities, regulators, courts, counterparties, or advisers where required by law or necessary to protect our rights.
  • Transaction parties: Potential buyers, investors, lenders, or advisers in connection with a merger, acquisition, financing, restructuring, or sale of assets, subject to appropriate confidentiality and data protection protections.

8. Security

We periodically evaluate the security of all key systems used for handling personal data and review and update our security measures as appropriate. Our security measures are of a technical and organizational nature and include:

  • Technical Safeguards: Encryption of data in transit where appropriate, access controls, authentication measures, network security measures, backups, and regular security updates.
  • Organizational Measures: Staff training, data protection policies, incident response procedures, and security assessments.
  • Heatcube System Security: Protected access controls and secure transmission of performance data from Heatcube installations.
  • Vendor Management: Data processing agreements with suppliers and partners where necessary that require satisfactory information security standards.

9. Your Rights Under GDPR

Under GDPR and applicable data protection laws, you have the following rights:

  • Right of Access: You have the right to request information about personal data we process about you.
  • Right to Rectification: You have the right to request correction of inaccurate or incomplete personal data.
  • Right to Erasure: You have the right to request deletion of personal data in certain circumstances.
  • Right to Restrict Processing: You have the right to request limitation of processing in specific situations.
  • Right to Data Portability: You have the right to receive personal data in a structured, machine-readable format.
  • Right to Object: You have the right to object to processing based on legitimate interests or for direct marketing.
  • Right to Withdraw Consent: You have the right to withdraw consent where processing is based on consent.
  • Right Related to Automated Decision-Making: You have the right not to be subject to decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you, except where permitted by law. Kyoto does not use solely automated processing to make decisions that produce legal or similarly significant effects about individuals.

Please note that some rights may be limited where we have legal obligations to retain data or where processing is necessary for contract performance. We will respond to requests within one month and may request additional information to verify your identity.

If you're unhappy with how we handle your personal information, you can file a complaint with your local data protection authority. We'd appreciate the chance to resolve any concerns directly first - just contact us at privacy@kyotogroup.no.

10. Changes to the Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will post the updated policy on our website and update the effective date. Where required, we will provide additional notice.

11. Contact Information

For inquiries regarding this privacy policy or to exercise your data protection rights, please contact us at:

Email: privacy@kyotogroup.no
Address: Kyoto Group AS, Skøyen Atrium, 9th floor, Askekroken 11, 0277 Oslo, Norway

Last updated: 29 June 2026