Privacy policy

General

As the operator of this website and as a company, we come into contact with your personal data – that is, all data that says something about you and can be used to identify you. In this privacy policy we explain how, for what purpose and on what legal basis we process your data.

The controller responsible for data processing on this website and in our company is:

StromWert Erneuerbare Energien GmbH, Mühlenstraße 8a, 14167 Berlin, DE, represented by Jan Gerstein. Email: gerstein@stromwert.gmbh, phone: +49 160 96606063.

General information

SSL/TLS encryption

Whenever you enter data on websites, place online orders or send emails over the internet, you must always expect that unauthorised third parties may access your data. Complete protection against such access does not exist. However, we do everything we can to protect your data as well as possible and to close security gaps as far as we are able.

An important protection mechanism is the SSL/TLS encryption of our website, which ensures that data you transmit to us cannot be read by third parties. You can recognise the encryption by the padlock icon in front of the web address in your browser and by the fact that our address begins with https:// rather than http://.

How long do we store your data?

In some places in this privacy policy we tell you how long we, or the companies that process your data on our behalf, store your data. Where no such information is given, we store your data until the purpose of the processing no longer applies, you object to the processing or you withdraw your consent to it.

In the event of an objection or withdrawal, we may nevertheless continue to process your data if at least one of the following conditions applies:

• We have compelling legitimate grounds for continuing the processing which override your interests, rights and freedoms (only in the case of an objection to the processing; if the objection is directed against direct marketing, we cannot put forward legitimate grounds).
• The processing is necessary to establish, exercise or defend legal claims (does not apply if your objection is directed against direct marketing).
• We are legally obliged to retain your data. In this case we delete your data as soon as the condition(s) cease(s) to apply.

Data transfers outside the EU

With our service providers, support and subcontractor access may in particular take place from countries outside the EU. Transfers require the conditions of Art. 44 et seq. GDPR to be met, for example an applicable adequacy decision for an appropriately certified recipient or agreed standard contractual clauses with the necessary supplementary measures. An EU server region alone does not rule out such access. You can obtain information about the safeguards that apply to your data at the contact address given above.

Objection to data processing

Withdrawal of your consent to data processing

Many data processing operations are based on your consent. You give it, for example, by ticking the relevant box in online forms before submitting them, or by accepting certain cookies when you visit our website.

You can withdraw your consent at any time without giving reasons (Art. 7(3) GDPR). From the time of withdrawal we may no longer process your data. The only exception: we are legally obliged to retain the data for a certain period. Such retention periods exist in particular under tax and commercial law.

Right to lodge a complaint with the competent supervisory authority

If you believe that we are in breach of the General Data Protection Regulation (GDPR), you have the right under Art. 77 GDPR to lodge a complaint with a supervisory authority. You may contact a supervisory authority in the member state of your habitual residence, your place of work or the place of the alleged infringement. The right to lodge a complaint exists alongside administrative or judicial remedies.

Right to data portability

Data that we process automatically on the basis of your consent or in performance of a contract must be handed over to you or to a third party in a common machine-readable format if you request it. We can only transfer the data to another controller insofar as this is technically possible.

Right of access, erasure and rectification

Under Art. 15 GDPR you have the right to obtain information free of charge about which personal data we have stored about you, where the data comes from, to whom we transmit it and for what purpose it is stored. If the data is incorrect, you have a right to rectification (Art. 16 GDPR); under the conditions of Art. 17 GDPR you may demand that we erase the data.

Right to restriction of processing

In certain situations you can require us under Art. 18 GDPR to restrict the processing of your data. Apart from storage, the data may then only be processed as follows:

• with your consent
• for the establishment, exercise or defence of legal claims
• to protect the rights of another natural or legal person
• for reasons of important public interest of the European Union or of a member state

The right to restriction of processing applies in the following situations:

• You have contested the accuracy of your personal data stored by us and we need time to verify it. In this case the right applies for the duration of the verification.
• The processing of your personal data is unlawful or was unlawful in the past. In this case the right applies as an alternative to erasure of the data.
• We no longer need your personal data, but you need it to exercise, defend or establish legal claims. In this case the right applies as an alternative to erasure of the data.
• You have lodged an objection under Art. 21(1) GDPR and your interests and ours now have to be weighed against each other. In this case the right applies as long as the outcome of this assessment has not yet been determined.

Data collection on this website

Hosting and server log files

The website is operated by Vercel Inc. (USA); the server functions run in the Frankfurt am Main region. Server log files record all requests and accesses to our website and record error messages. They also include personal data, in particular your IP address. The data is transmitted automatically by your browser to our provider. The files contain the following data:

• browser type and version
• operating system used
• referrer URL
• host name of the accessing computer
• time of the server request
• IP address (anonymised where applicable)

We do not combine this data with other data, but use it only to deliver the site, find errors and protect the site against misuse. We have a legitimate interest in our website running without errors. The data processing is therefore lawful under Art. 6(1) lit. f GDPR. Further information: Vercel privacy policy

Cookies

We do not use any analytics or advertising tools on the public pages. We only set cookies where they are technically necessary, for example for logging in to the customer portal and for the “Trust this browser” function you choose. The legal basis is our legitimate interest in a functioning website under Art. 6(1) lit. f GDPR in conjunction with Section 25(2) of the German Telecommunications Digital Services Data Protection Act (TDDDG).

You can influence how your browser handles cookies via its settings.

Contact by email or phone

If you contact us by email or phone, we process your details and the documents you send us (for example your load profile or electricity bill) in order to answer your enquiry and prepare a quotation. The legal basis is Art. 6(1) lit. b GDPR (pre-contractual measures), otherwise our legitimate interest in handling your enquiry under Art. 6(1) lit. f GDPR. We delete the data once the enquiry has been dealt with and no statutory retention obligations prevent this.

We run our email mailbox on Google Workspace (Gmail) provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google processes emails and attachments on our behalf (Art. 28 GDPR). Where data reaches the USA or other third countries, this is based on the EU-US Data Privacy Framework (Art. 45 GDPR) or on the European Commission’s standard contractual clauses (Art. 46(2) lit. c GDPR). Emails that prepare, conclude, perform or reverse a transaction are commercial and business letters; we retain them for the statutory period under Section 257 of the German Commercial Code (HGB) and Section 147 of the German Fiscal Code (AO) and delete them afterwards.

Booking a call

For an initial call we process your name, company, email address, phone number, topic, the selected type of call (phone or video), the selected time slot and an optional note. The information is used solely to organise, confirm and prepare your enquiry. The legal basis is Art. 6(1) lit. b GDPR; for enquiries on behalf of a company, Art. 6(1) lit. f GDPR with the interest of handling the business enquiry.

Availability is checked on our server against Google Calendar. Other visitors only receive free time slots, not names or the content of existing appointments. Booked calls are kept in our Google Calendar and in the management’s iCloud calendar. The service providers are Google Ireland Limited and Apple Distribution International Ltd. The enquiry is stored in our customer management system OB1 at Supabase. We send the booking confirmation via Resend, Inc. These providers process the necessary contact and appointment data; the calendars are not shared publicly.

If you choose “Video (Google Meet)”, we automatically create a Google Meet video conference for the appointment in our Google Calendar. We show you the link after booking and include it in the booking confirmation. The section “Audio and video conferences” applies to the call itself. If you choose “Phone”, we call you on the number you provided; no video conference is created in that case.

To prevent misuse we briefly use a check value of the IP address that changes daily and is not stored in plain text. No consent to marketing is required for the call. Optional notes should not contain special categories of personal data. Once the enquiry has been completed, we delete the information as soon as there are no longer any contractual or statutory reasons for retention. You can let us know about changes or cancellations by replying to the confirmation.

Further information: Google privacy policy, Apple privacy policy, Supabase privacy policy, Resend privacy policy.

Customer portal and login

The existing StromWert customer portal uses Supabase Auth. When you log in with email and password, we process contact details, the credentials required for secure login and session data. Passwords are not stored in plain text. Customer data, systems and documents are only released after being assigned to the respective customer. The legal basis is Art. 6(1) lit. b GDPR and, for protecting access, Art. 6(1) lit. f GDPR.

If you log in with Google or Apple, you are only forwarded to the provider after pressing the respective login button. We receive the user ID required for login and, where transmitted by the provider, your email address and profile name. We do not receive your password with the provider. The alternative login with email and password remains available. Enabling a login provider does not in itself grant access to customer data.

Supabase processes the portal data in the EU region of Ireland. Necessary session cookies enable access; if you choose “Trust this browser for 30 days”, the session can last correspondingly longer. Optionally set-up second factors remain in effect; customers are not required to set up a second factor.

Audio and video conferences

We use Microsoft Teams (Microsoft Corp., USA). The tool collects conference data, technical data and, where applicable, communication content in order to enable meetings. Storage on our systems lasts until the purpose no longer applies or deletion is requested. The legal basis is Art. 6(1) lit. b GDPR (pre-contractual measures) or lit. f GDPR (legitimate interest in efficient communication). Where data is transferred to the USA, this is based on the EU-US Data Privacy Framework, under which Microsoft is certified (adequacy decision under Art. 45 GDPR), and additionally on the European Commission’s standard contractual clauses (Art. 46(2) lit. c GDPR).

We also use Google Meet as part of Google Workspace provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google processes the data on our behalf (Art. 28 GDPR). This includes the details you use to join the conference (such as name and email address), appointment and participation data (start, end, participants), technical data such as IP address and device information, and audio, video and shared screen content during the call. We do not record calls. A browser is sufficient to take part; a Google account is not required. The legal basis is Art. 6(1) lit. b GDPR (pre-contractual measures and performance of a contract) or lit. f GDPR (legitimate interest in efficient communication). Where data reaches the USA or other third countries, this is based on the EU-US Data Privacy Framework (Art. 45 GDPR) or on the European Commission’s standard contractual clauses (Art. 46(2) lit. c GDPR). Further information: Google privacy policy.

Use of AI

We evaluate enquiries, messages and documents you send us (for example load profiles, electricity bills, system data, plans and contracts) with the help of AI and use it to prepare answers, designs and quotations. Part of this evaluation, such as reading invoices and scans, runs on AI models on our own computers; your data does not leave our systems in that case.

When our team works on your enquiry, for example when reviewing documents, preparing quotations and answers or researching publicly available information, we additionally use the AI model Claude provided by Anthropic Ireland, Limited (Ireland). Your details, messages and documents may be transmitted to Anthropic in the process. Anthropic stores inputs and outputs for up to 30 days and does not use them to train its models for our account; under Anthropic’s terms, content flagged for a safety review is an exception. Anthropic may also process data in the USA; this is based on the European Commission’s standard contractual clauses (Art. 46(2) lit. c GDPR). The legal basis is Art. 6(1) lit. b GDPR and, for research and otherwise, our legitimate interest in handling your enquiry quickly and carefully (Art. 6(1) lit. f GDPR). Anthropic’s privacy policy also applies.

Whether and on what terms you receive a quotation is decided by a person: our management reviews and approves every quotation before you receive it. No decision based solely on automated processing within the meaning of Art. 22 GDPR takes place.

Data processing on social media

We maintain profiles on Facebook (Meta Platforms Ireland Limited) and LinkedIn (LinkedIn Ireland Unlimited Company). The operators collect extensive data on the user behaviour of our visitors on these platforms in accordance with their own policies. As the page operator, we are jointly responsible with the social network for the data collected when the profile page is visited. The legal basis for our provision of the pages is our legitimate interest in a comprehensive presence on the internet under Art. 6(1) lit. f GDPR.