1) Information on the Collection of Personal Data and Contact Details of the Controller

1.1

We are pleased that you are visiting our website and thank you for your interest. In the following, we inform you about the processing of your personal data when using our website. Personal data means any information relating to an identified or identifiable natural person.

1.2

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

EC Bioenergie GmbH & Co. KG
Englerstraße 4
69126 Heidelberg
Germany

Telephone: +49 (0)6221 364950
E-mail: info@bioenergie-heidelberg.de

The controller is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data.

1.3

The controller has appointed a Data Protection Officer, who can be contacted as follows:

Tobias Walter
Englerstraße 4
69126 Heidelberg
Germany

Telephone: +49 (0)6221 364950

E-mail: datenschutz@bioenergie-heidelberg.de

1.4

For security reasons and to protect the transmission of personal data and other confidential content (e.g. orders or enquiries sent to the controller), this website uses SSL or TLS encryption.

You can recognise an encrypted connection by the "https://" address prefix and the padlock symbol displayed in your browser's address bar.

 

2) Data Collection When Visiting Our Website

When you use our website for information purposes only, i.e. if you do not register or otherwise provide us with information, we only collect the data that your browser automatically transmits to our server (so-called server log files).

When you access our website, we collect the following information, which is technically necessary for us to display the website correctly:

  • Website visited
  • Date and time of access
  • Amount of data transferred (in bytes)
  • Source/referring website
  • Browser used
  • Operating system used
  • IP address used (where applicable in anonymised form)

The processing is carried out in accordance with Article 6(1)(f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website.

The collected data will not be disclosed or used for any other purpose. However, we reserve the right to review the server log files retrospectively if there are concrete indications of unlawful use.

 

3) Content Delivery Network (CDN)

3.1 Cloudflare

Our website uses a Content Delivery Network ("CDN") provided by the technology service provider:

Cloudflare Inc.
101 Townsend Street
San Francisco, CA 94107
USA

A Content Delivery Network is an online service that delivers large media files such as graphics, website content or scripts through a network of geographically distributed servers connected via the Internet.

Using Cloudflare's CDN helps us optimise the loading speed of our website.

Processing is carried out pursuant to Article 6(1)(f) GDPR on the basis of our legitimate interest in the secure, efficient and reliable provision of our website and in improving its stability and functionality.

We have concluded a Data Processing Agreement (DPA) with Cloudflare, under which Cloudflare undertakes to protect the data of our website visitors and not to disclose it to third parties.

For transfers of personal data from the European Union to the United States, Cloudflare relies on the European Commission's Standard Contractual Clauses (SCCs) to ensure an adequate level of data protection.

Further information is available in Cloudflare's Privacy Policy:

https://www.cloudflare.com/privacypolicy/

3.2 Google Cloud CDN

Our website also uses the Content Delivery Network ("CDN") provided by

Google Ireland Limited
Gordon House
4 Barrow Street
Dublin D04 E5W5
Ireland

A Content Delivery Network enables the rapid delivery of large media files such as graphics, website content and scripts through a distributed server infrastructure.

Using Google's CDN improves the loading speed and overall performance of our website.

Processing is carried out in accordance with Article 6(1)(f) GDPR on the basis of our legitimate interest in ensuring the secure and efficient provision and optimisation of our website.

Further information on Google's privacy practices is available at:

https://policies.google.com/privacy

 

4) Cookies

To make visiting our website attractive and to enable the use of certain functions, we use cookies on various pages.

Cookies are small text files that are stored on your device.

Some of the cookies we use are deleted automatically after the end of your browser session, i.e. when you close your browser (session cookies). Other cookies remain stored on your device and enable us or our partner companies (third-party cookies) to recognise your browser the next time you visit our website (persistent cookies).

Where cookies are used, they collect and process certain user information, such as browser information, location data and IP address information, to the extent required.

Persistent cookies are deleted automatically after a predefined period, which may vary depending on the individual cookie.

Where personal data is processed by individual cookies used by us, such processing is carried out either pursuant to Article 6(1)(b) GDPR for the performance of a contract or pursuant to Article 6(1)(f) GDPR on the basis of our legitimate interest in ensuring the best possible functionality of our website and providing a user-friendly and efficient website experience.

In some cases, we work with advertising partners who help us make our online offering more attractive to you. In such cases, cookies from partner companies (third-party cookies) may also be stored on your device during your visit.

Where we cooperate with such advertising partners, you will be informed separately about the use of these cookies and the scope of the information collected in the relevant sections below.

Please note that you can configure your browser to notify you whenever cookies are set and decide individually whether to accept them or to reject cookies altogether or in specific cases.

Each browser manages cookie settings differently. Details can be found in the help menu of your browser.

Instructions for the most common browsers are available here:

Please note that if you choose not to accept cookies, the functionality of our website may be limited.

5) Contacting Us

5.1 Contact Form and E-mail

When you contact us (e.g. via the contact form or by e-mail), personal data is collected.

The data collected when using a contact form is evident from the respective form.

This data is stored and used exclusively for the purpose of responding to your enquiry and for the associated technical administration.

The legal basis for processing this data is our legitimate interest in responding to your enquiry in accordance with Article 6(1)(f) GDPR.

If your enquiry is aimed at concluding a contract, the additional legal basis for processing is Article 6(1)(b) GDPR.

Your data will be deleted once your enquiry has been fully processed, provided that the circumstances indicate that the matter has been conclusively resolved and there are no statutory retention obligations preventing deletion.

 

5.2 WhatsApp Business

Visitors to our website have the option of contacting us via the messaging service WhatsApp Business, provided by:

WhatsApp Ireland Limited
4 Grand Canal Square
Grand Canal Harbour
Dublin 2
Ireland

For this purpose, we use the WhatsApp Business application.

If you contact us via WhatsApp in connection with a specific business transaction (for example, an order you have placed), we store and process the mobile phone number you use for WhatsApp and—where provided—your first and last name in accordance with Article 6(1)(b) GDPR in order to process and respond to your enquiry.

On the same legal basis, we may ask you via WhatsApp to provide additional information (such as your order number, customer number, address or e-mail address) so that we can assign your enquiry to a specific transaction.

If you contact us via WhatsApp with general enquiries (for example regarding our products, services, availability or website), we store and process your mobile phone number and—where provided—your name pursuant to Article 6(1)(f) GDPR on the basis of our legitimate interest in providing the requested information efficiently and promptly.

Your data will be used exclusively for communicating with you via WhatsApp and will not be disclosed to third parties.

Please note that WhatsApp Business has access to the address book stored on the mobile device used by us and automatically transmits telephone numbers stored in the address book to servers operated by its parent company, Meta Platforms Inc., in the United States.

For the operation of our WhatsApp Business account, we use a dedicated mobile device whose address book contains only the WhatsApp contact details of users who have contacted us via WhatsApp.

This ensures that every person whose WhatsApp contact details are stored in our address book has already consented, by accepting the WhatsApp Terms of Service upon first use of the application, to the transmission of their WhatsApp telephone number from the address books of their chat contacts pursuant to Article 6(1)(a) GDPR.

Accordingly, no data relating to persons who do not use WhatsApp and/or have not contacted us via WhatsApp is transferred.

For information on the purpose and scope of data collection, further processing and use of data by WhatsApp, as well as your rights and privacy settings, please refer to WhatsApp's Privacy Policy:

https://www.whatsapp.com/legal/privacy-policy

 

6) Use of Customer Data for Direct Marketing

6.1 Subscription to Our E-mail Newsletter

If you subscribe to our e-mail newsletter, we will regularly send you information about our products and services.

The only mandatory information required for subscribing to the newsletter is your e-mail address.

Providing additional information is voluntary and is used solely to address you personally.

We use the double opt-in procedure for newsletter registration.

This means that we will only send you our newsletter after you have expressly confirmed your consent by clicking the confirmation link contained in a verification e-mail.

By activating the confirmation link, you consent to the processing of your personal data pursuant to Article 6(1)(a) GDPR.

When subscribing to the newsletter, we also store the IP address recorded by your Internet Service Provider (ISP) together with the date and time of registration in order to trace any possible misuse of your e-mail address at a later date.

The data collected for newsletter registration is used exclusively for sending the newsletter.

You may unsubscribe at any time using the unsubscribe link included in every newsletter or by contacting the controller named above.

Once you unsubscribe, your e-mail address will be removed from our mailing list immediately unless you have expressly consented to further use of your data or we are legally entitled to process your data beyond this scope.

 

6.2 Newsletter for Existing Customers

If you have provided us with your e-mail address when purchasing goods or services, we reserve the right to send you information by e-mail about products or services similar to those you have previously purchased.

Under Section 7 (3) of the German Act Against Unfair Competition (UWG), separate consent is not required for this purpose.

Processing is therefore based on our legitimate interest in personalised direct marketing pursuant to Article 6(1)(f) GDPR.

If you objected to the use of your e-mail address for this purpose at the time it was collected, no such communications will be sent.

You may object to the use of your e-mail address for marketing purposes at any time with effect for the future by contacting the controller specified above.

Other than the transmission costs according to your basic tariff, no additional costs will be incurred.

Upon receipt of your objection, the use of your e-mail address for advertising purposes will cease immediately.

 

6.3 Newsletter Distribution via Mailchimp

Our newsletters are distributed via the technical service provider

The Rocket Science Group LLC d/b/a Mailchimp
675 Ponce de Leon Avenue NE
Suite 5000
Atlanta, GA 30308
USA

The data you provide when subscribing to the newsletter is transferred to Mailchimp.

This processing is carried out pursuant to Article 6(1)(f) GDPR based on our legitimate interest in using an effective, secure and user-friendly newsletter system.

Mailchimp may store your data on servers located in the United States.

Mailchimp uses this information to send newsletters on our behalf and to perform statistical analyses.

For evaluation purposes, newsletters contain web beacons (tracking pixels), enabling us to determine whether a newsletter has been opened and which links have been clicked.

This allows anonymous statistical evaluation of newsletter campaigns.

In addition, Mailchimp processes recipient-specific information such as e-mail address, access time, IP address, browser type and operating system in order to create campaign statistics and improve our marketing communications.

To safeguard transfers of personal data to the United States, we have entered into a Data Processing Agreement incorporating the European Commission's Standard Contractual Clauses.

Further information is available at:

https://mailchimp.com/legal/privacy/

 

7) Review Reminder

We use your e-mail address to send you a one-time reminder inviting you to review your order using our review system, provided that you have expressly consented to this during or after placing your order pursuant to Article 6(1)(a) GDPR.

You may withdraw your consent at any time by contacting the controller.

 

8) Social Media: Videos

YouTube Videos

This website uses the YouTube embedding function provided by Google Ireland Limited, Gordon House, 4 Barrow Street, Dublin D04 E5W5, Ireland.

Enhanced Privacy Mode is enabled.

According to YouTube, no information about visitors is stored unless they actively play a video.

When embedded YouTube videos are played, YouTube uses cookies to collect information about user behaviour.

These cookies are used, among other things, to generate video statistics, improve usability and prevent misuse.

If you are logged into your Google account, your data will be associated directly with your account when you click a video.

If you do not wish this association to occur, you must log out of your Google account before activating the video.

Google stores your information as usage profiles and evaluates it for purposes including personalised advertising, market research and the needs-based design of its services.

You have the right to object to the creation of these user profiles by contacting Google.

The use of YouTube may also result in the transfer of personal data to servers operated by Google LLC in the United States.

Further information is available in:

  • YouTube Terms of Service
  • Google's Privacy Policy

Where legally required, processing takes place only after obtaining your consent pursuant to Article 6(1)(a) GDPR.

You may withdraw your consent at any time by changing your preferences in the Cookie Consent Tool provided on our website.

9) Online Marketing

Google Ads Conversion Tracking

This website uses the online advertising programme Google Ads and, as part of Google Ads, the conversion tracking service provided by:

Google Ireland Limited
Gordon House
4 Barrow Street
Dublin D04 E5W5
Ireland

We use Google Ads to promote our products and services on external websites by means of advertisements. This enables us to determine the success of individual advertising campaigns based on campaign data.

Our objective is to display advertising that is relevant to you, make our website more attractive and ensure a fair calculation of advertising costs.

The conversion tracking cookie is set when a user clicks on a Google Ads advertisement. Cookies are small text files stored on your device.

These cookies generally expire after 30 days and are not used for personal identification.

If a user visits specific pages on this website while the cookie is still valid, Google and we can recognise that the user clicked on the advertisement and was redirected to our website.

Each Google Ads customer receives a different cookie. Consequently, cookies cannot be tracked across the websites of different Google Ads customers.

The information collected via the conversion cookie is used to compile conversion statistics for Google Ads customers who have opted to use conversion tracking.

Customers receive information about the total number of users who clicked on their advertisement and were redirected to a page tagged for conversion tracking. However, they do not receive information that personally identifies users.

When using Google Ads, personal data may also be transferred to servers operated by Google LLC in the United States.

Further information is available at:

https://policies.google.com/technologies/partner-sites

Where legally required, all processing described above is carried out only with your explicit consent pursuant to Article 6(1)(a) GDPR.

You may withdraw your consent at any time via the Cookie Consent Tool provided on our website.

You may also permanently disable Google Ads Conversion Tracking by downloading and installing Google's browser plug-in:

https://www.google.com/settings/ads/plugin

Further information is available in Google's Privacy Policy:

https://policies.google.com/privacy

 

10) Web Analytics Services

10.1 Google (Universal) Analytics

This website uses Google (Universal) Analytics, a web analytics service provided by Google Ireland Limited.

Google Analytics uses cookies that enable an analysis of your use of our website.

The information generated by these cookies (including the shortened IP address) is generally transmitted to and stored on Google's servers and may also be transferred to servers operated by Google LLC in the United States.

This website uses Google Analytics exclusively with the "_anonymizeIp()" extension.

This ensures that your IP address is anonymised by truncation within the European Union or other EEA member states before any further processing takes place.

Only in exceptional cases will the full IP address be transmitted to a Google server in the United States and shortened there.

Google processes this information on our behalf to evaluate your use of the website, compile reports on website activity and provide additional services relating to website usage.

Google Analytics also enables the creation of demographic reports based on age, gender and interests derived from interest-based advertising and third-party information.

These demographic reports do not allow individual users to be identified.

Processing is carried out only with your consent pursuant to Article 6(1)(a) GDPR.

You may withdraw your consent at any time via the Cookie Consent Tool.

We have concluded a Data Processing Agreement with Google to ensure the protection of personal data.

Further information is available at:

https://policies.google.com/privacy

 

10.2 Google Analytics 4

This website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited.

Google Analytics 4 uses cookies to analyse how visitors use our website.

Information generated by these cookies—including your IP address, which is automatically shortened before processing—is generally transferred to Google's servers.

The automatic anonymisation of IP addresses ensures that the information collected cannot be directly linked to an individual.

Google uses this information on our behalf to evaluate website usage, compile reports on website activity and provide additional services relating to website and internet usage.

The shortened IP address transmitted through Google Analytics 4 is never merged with other Google data.

Data collected through Google Analytics 4 is retained for two months before being deleted.

Google Analytics 4 also provides demographic reporting based on users' age, gender and interests.

These reports are created using interest-based advertising and third-party information and cannot be attributed to any individual.

Processing takes place only after your explicit consent pursuant to Article 6(1)(a) GDPR.

You may withdraw your consent at any time using the Cookie Consent Tool.

We have entered into a Data Processing Agreement with Google.

For transfers of personal data outside the European Economic Area, Google relies on the European Commission's Standard Contractual Clauses.

Further information is available at:

https://policies.google.com/privacy

 

11) Retargeting / Remarketing

Google Ads Remarketing

This website uses Google Ads Remarketing.

This service enables us to display personalised advertisements within Google Search and on third-party websites based on your previous visits to our website.

Google uses cookies containing a pseudonymous identifier to display interest-based advertising.

Processing is based on our legitimate interest in the optimal marketing of our website pursuant to Article 6(1)(f) GDPR.

Additional processing only takes place where you have consented to Google linking your browsing history with your Google account and using information from your Google account to personalise advertisements.

If you are logged into Google while visiting our website, Google may combine your Google Analytics data with your Google account to create audience lists for cross-device remarketing.

Personal data may also be transferred to Google LLC servers located in the United States.

Further information is available at:

https://policies.google.com/technologies/partner-sites

You may permanently object to the use of Google Remarketing cookies by downloading Google's browser plug-in.

Where legally required, processing takes place only after obtaining your consent pursuant to Article 6(1)(a) GDPR.

 

12) Tools and Miscellaneous

12.1 FontAwesome

This website uses FontAwesome web fonts provided by Fonticons Inc.

When a page is loaded, your browser establishes a connection to FontAwesome's servers to download the required fonts.

This may involve the transfer of your IP address to servers in the United States.

Processing takes place only after your consent pursuant to Article 6(1)(a) GDPR.

Further information is available at:

https://fontawesome.com/privacy

 

Google Web Fonts

This website uses Google Web Fonts provided by Google Ireland Limited.

When visiting our website, your browser downloads the required fonts from Google's servers.

During this process, your IP address may be transmitted to Google.

Processing takes place only after obtaining your consent pursuant to Article 6(1)(a) GDPR.

If your browser does not support web fonts, a standard font installed on your computer will be used instead.

Further information is available at:

https://developers.google.com/fonts/faq

https://policies.google.com/privacy

 

12.2 Applications by E-mail

Vacancies are published in a dedicated section of our website.

Applicants may submit their applications by e-mail using the contact address provided.

Participation in the recruitment process requires applicants to provide all personal data necessary for a comprehensive assessment of their application.

This includes, in particular:

  • Name
  • Address
  • Contact details
  • Qualification documents
  • Supporting documentation relevant to the advertised position

Where required, applicants may also provide special categories of personal data, such as health information, where necessary for compliance with employment and social security legislation.

The legal basis for processing is Article 6(1)(b) GDPR in conjunction with Section 26 German Federal Data Protection Act (BDSG).

Special categories of personal data are processed pursuant to Article 9 GDPR where required by employment law.

If an application is unsuccessful or withdrawn, all application documents and related correspondence will be deleted no later than six months after completion of the recruitment process.

If employment is offered, the applicant's data will continue to be processed for the purposes of the employment relationship.

 

12.3 Google Maps

This website uses Google Maps (API) provided by Google Ireland Limited.

Google Maps enables the display of interactive maps and geographical information.

When pages containing Google Maps are accessed, information about your use of our website—including your IP address—may be transmitted to Google servers, including servers in the United States.

Google may create user profiles for purposes including personalised advertising and market research.

If you do not wish your Google account to be associated with your visit, please log out of your Google account before using Google Maps.

Where legally required, processing takes place only with your consent pursuant to Article 6(1)(a) GDPR.

Further information is available in Google's Privacy Policy.

 

12.4 Microsoft Teams

We use Microsoft Teams, a service provided by Microsoft Corporation, for online meetings, video conferences and webinars.

Depending on your participation, the following personal data may be processed:

  • Name
  • E-mail address
  • Telephone number (optional)
  • Meeting subject
  • IP address
  • Device information
  • Chat messages
  • Audio recordings
  • Video recordings
  • Shared content

Where processing is necessary for the performance of a contract or pre-contractual measures, the legal basis is Article 6(1)(b) GDPR.

Where you have provided your consent, processing is based on Article 6(1)(a) GDPR.

In all other cases, processing is based on our legitimate interest pursuant to Article 6(1)(f) GDPR in conducting online meetings efficiently.

Further information is available in Microsoft's Privacy Statement:

https://privacy.microsoft.com/privacy-statement

13) Rights of the Data Subject

13.1 Your Rights

Under the applicable data protection legislation, you have the following rights with regard to the processing of your personal data by the controller:

  • Right of access pursuant to Article 15 GDPR
  • Right to rectification pursuant to Article 16 GDPR
  • Right to erasure ("right to be forgotten") pursuant to Article 17 GDPR
  • Right to restriction of processing pursuant to Article 18 GDPR
  • Right to notification pursuant to Article 19 GDPR
  • Right to data portability pursuant to Article 20 GDPR
  • Right to withdraw consent pursuant to Article 7(3) GDPR
  • Right to lodge a complaint with a supervisory authority pursuant to Article 77 GDPR

 

13.2 Right to Object

Where we process your personal data on the basis of our legitimate interests following a balancing of interests, you have the right to object at any time, on grounds relating to your particular situation, to such processing with effect for the future.

If you exercise your right to object, we will cease processing the personal data concerned.

However, we reserve the right to continue processing where we can demonstrate compelling legitimate grounds for the processing that override your interests, fundamental rights and freedoms, or where the processing serves the establishment, exercise or defence of legal claims.

Where your personal data is processed for the purposes of direct marketing, you have the right to object at any time to the processing of your personal data for such marketing purposes.

If you exercise your right to object, we will cease processing your personal data for direct marketing purposes immediately.

 

14) Retention Period of Personal Data

The retention period for personal data depends on the respective legal basis for processing, the purpose of processing and, where applicable, the relevant statutory retention periods (for example, retention periods under commercial or tax legislation).

Where personal data is processed on the basis of your explicit consent pursuant to Article 6(1)(a) GDPR, such data will be retained until you withdraw your consent.

Where statutory retention periods apply to data processed for the performance of a contract or pre-contractual measures pursuant to Article 6(1)(b) GDPR, such data will be routinely deleted after the applicable retention periods have expired, provided that it is no longer required for the fulfilment or initiation of the contract and that we no longer have a legitimate interest in its continued storage.

Where personal data is processed on the basis of our legitimate interests pursuant to Article 6(1)(f) GDPR, such data will be retained until you exercise your right to object pursuant to Article 21(1) GDPR, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or where the processing serves the establishment, exercise or defence of legal claims.

Where personal data is processed for the purposes of direct marketing pursuant to Article 6(1)(f) GDPR, such data will be retained until you exercise your right to object pursuant to Article 21(2) GDPR.

Unless otherwise specified in this Privacy Policy with regard to particular processing activities, stored personal data will otherwise be deleted when it is no longer necessary for the purposes for which it was collected or otherwise processed.

 

Version: March 1, 2022