CDR Policy

1. Overview

This policy describes how EnerLogic Pty Ltd (ABN 37 682 984 318) accesses, uses, and protects consumer energy data under the Consumer Data Right (CDR) framework established by the Australian Government under the Competition and Consumer Act 2010 (Cth), Part IVD.

2. What data we access

When you authorise a CDR data connection, EnerLogic requests read-only access to the following energy data from your electricity distributor:

• National Metering Identifier (NMI) — the unique identifier for your electricity connection point.
• Interval usage data — 30-minute electricity consumption reads, typically covering the most recent 24 months. This includes both import (grid to home) and export (home to grid, e.g. solar) channels.
• Tariff information — the tariff type and rate structure applied to your connection (e.g. time-of-use, flat rate, demand).
• Basic account details — your supply address and account status as held by your distributor.

We do not access your billing or payment information, bank details, personal identity documents, or any data beyond the energy-specific scope you authorise.

3. Purpose of data collection

We use your CDR energy data solely to:

• Benchmark retailer plans — re-price your actual usage against published market offers to identify cheaper alternatives.
• Size solar and battery systems — model generation, self-consumption, and export based on your real consumption patterns and roof characteristics.
• Optimise load scheduling — infer appliance-level loads (hot water, EV, pool pump) from your interval data to recommend time-shifting.
• Model gas-to-electric transitions — estimate the electricity load impact of replacing gas appliances.
• Generate your personalised plan — produce the EnerLogic report with savings estimates, capex figures, and payback timelines.

4. Consent

Your CDR data is only accessed after you provide explicit, informed consent through our CDR consent flow. This consent:

• Is specific — limited to the data types and purposes listed above.
• Has a defined duration — 12 months by default, which you can shorten or extend.
• Is revocable — you can withdraw consent at any time through your EnerLogic account settings, or by contacting us directly.
• Is audited — we maintain a full consent audit trail including scope, duration, timestamps, and status changes, as required by CDR rules.

When you authorise CDR access, you are redirected to your electricity distributor's CDR portal to confirm the connection. Your credentials are never shared with or visible to EnerLogic.

5. Data handling

5.1 Storage

All CDR data is stored on servers located in Australia, encrypted at rest (AES-256) and in transit (TLS 1.3). Access is restricted to authorised systems and personnel on a strict need-to-know basis. Raw interval data is stored only as long as required by your active consent.

5.2 Retention

CDR data is retained for the duration of your consent period. When consent expires or is revoked, your raw CDR data is deleted within 30 days. Aggregated, de-identified analysis results (e.g. your saved report) may be retained for your ongoing access unless you request deletion.

5.3 No selling or sharing

Your CDR data is never sold to third parties. It is never shared with advertisers, data brokers, or any party outside the specific purposes you authorised. The only circumstance in which data may be shared with a third party is when you explicitly choose to proceed with an installer and consent to sharing relevant plan details with them.

6. Security

EnerLogic implements security measures aligned with the CDR data security requirements, including:

• Encryption at rest and in transit for all CDR data.
• Server-side API keys — CDR credentials and external service keys (e.g. Google Solar) are stored server-side only and never exposed to client-side code.
• Access controls — role-based access with audit logging for all CDR data access.
• Regular security reviews — aligned with the CDR compliance requirements.

7. Your rights

Under the CDR framework and Australian privacy law, you have the right to:

• View your consent — see what data access you have authorised and its status.
• Revoke consent — withdraw your authorisation at any time, after which we will cease accessing your data and delete raw CDR data within 30 days.
• Request data deletion — ask us to delete all personal and CDR data we hold about you.
• Access your data — request a copy of the CDR data we hold.
• Lodge a complaint — if you believe your CDR data has been mishandled, you can contact us first, then escalate to the Office of the Australian Information Commissioner (OAIC).

8. Changes to this policy

We may update this CDR policy from time to time to reflect changes in CDR rules or our data practices. Material changes will be notified via email to your registered address. The "last updated" date at the top of this page indicates when the most recent revision was published.

9. Contact

For CDR-related inquiries, data access requests, or to revoke consent, contact us at:

• Email:  
• Post: Privacy Officer, EnerLogic Pty Ltd, Sydney NSW, Australia