Datenschutzerklärung

2. Controller

enerbeat GmbH

Email:info@enerbeat.com
Phone:+49 160 4416795

3. Data Protection Officer

A data protection officer has not currently been appointed. If we are legally required to appoint a data protection officer in the future, or if we voluntarily appoint one, we will add the relevant details here.

4. Legal Bases for Processing

We process personal data in particular on the basis of the following legal grounds:

• Article 6(1)(a) GDPR, where you have given your consent.
• Article 6(1)(b) GDPR, where processing is necessary for the performance of pre-contractual measures or for the performance of a contract.
• Article 6(1)(c) GDPR, where we are legally obliged to process data.
• Article 6(1)(f) GDPR, where processing is necessary for the purposes of legitimate interests and no overriding interests of the data subject prevail.

For access to information stored on end devices or the storage of information on end devices, we also comply with the requirements of the German Telecommunications Digital Services Data Protection Act (TDDDG). We generally use non-essential cookies and comparable technologies only after obtaining your consent.

5. Hosting, CDN and Security Services – Cloudflare

Our website is operated using services provided by Cloudflare Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare provides, in particular, content delivery, DNS, security, performance and protection functions.

In this context, the following data in particular may be processed:

• IP address
• Date and time of access
• Accessed URLs and technical requests
• HTTP headers, browser and device information
• Connection and security events
• Information for the prevention of abusive or harmful requests

The purposes of processing are the secure, stable and fast provision of the website, the prevention of attacks, the detection of abuse and the technical optimization of our online offering. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in the secure and efficient operation of our website.

Where Cloudflare processes personal data on our behalf, this is done on the basis of a data processing agreement. Processing in third countries, in particular in the USA, cannot be excluded. According to Cloudflare, appropriate transfer mechanisms are used. Please also refer to Cloudflare's privacy notices in their current version.

6. Server Log Files

When our website is accessed, technically necessary access data is processed. This includes, in particular, IP address, date and time, requested resource, referrer URL, browser type, operating system and status codes. Processing takes place for the technical provision of the website, error analysis, security and abuse detection on the basis of Article 6(1)(f) GDPR.

7. Cookies, Consent Management and Cookie Settings

Our website uses cookies and comparable technologies. Cookies that are strictly necessary for the operation of the website (essential cookies) are set without your consent on the basis of § 25(2) No. 2 TDDDG. All other cookies and comparable technologies, in particular for analytics and embedded external content, are used only with your prior consent pursuant to Article 6(1)(a) GDPR and § 25(1) TDDDG.

• Essential — required for the basic operation of the website, in particular for storing your consent decision. These cannot be disabled.
• Analytics — help us understand how the website is used and improve it. When you give consent, we activate Google Analytics 4 (see section 8).
• External media — allow embedded third-party content such as YouTube videos to be loaded. When you give consent, embedded content is requested directly from the third-party provider, which transfers data to that provider (see section 15).

On your first visit, a consent dialog appears in which you can accept all categories, reject all non-essential categories, or choose individually. You can change or withdraw your decision at any time via the “Cookie Settings” link in the footer. The withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal.

We record your decision in a first-party cookie named “eb_consent” (lifetime up to 365 days, Path=/, SameSite=Lax). The cookie stores only your category choices and no personal identifiers. Storing this cookie is necessary to honour your decision and is based on § 25(2) No. 2 TDDDG.

8. Google Analytics 4Planned

This section describes a planned feature. It is not yet active on this website.

We use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics helps us understand how visitors use our website. In this context, the following data in particular may be processed:

• Shortened or otherwise processed IP address
• Usage and interaction data
• Device and browser information
• Approximate location information
• Referrer information
• Event data, such as page views or clicks

Processing takes place only on the basis of your consent pursuant to Article 6(1)(a) GDPR. Access to your end device or the storage of information also takes place only after consent in accordance with the relevant requirements of the TDDDG.

Google may also process data outside the European Union. Please refer to Google's privacy notices in their current version. You can withdraw your consent at any time via our cookie settings.

9. Cloudflare AnalyticsPlanned

This section describes a planned feature. It is not yet active on this website.

We use Cloudflare Analytics for statistical evaluation and technical optimization of our website. Usage, performance and technical access data may be processed in this context.

Where Cloudflare Analytics does not exclusively process technically necessary, aggregated and non-personal information, its use is based only on your consent pursuant to Article 6(1)(a) GDPR and the requirements of the TDDDG.

10. Contact by Email

If you contact us by email, we process your email address, your message and any other information you provide. The purpose is to process your request. The legal basis is Article 6(1)(b) GDPR where your request is related to a contract or pre-contractual measures, and otherwise Article 6(1)(f) GDPR.

11. Contact Form

Our contact form is provided directly on our website. Submissions are transmitted to a serverless function operated for us by Cloudflare and are then forwarded as an email via the Microsoft Graph API to a mailbox hosted in Microsoft 365 (Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland).

When using the form, we process in particular:

• Name
• Email address
• Company details, where provided
• Selected topic
• Content of the message
• Technical metadata, where generated during transmission (such as IP address and timestamp at the Cloudflare edge)

The purpose is to process your request. The legal basis is Article 6(1)(b) GDPR for contract-related requests and Article 6(1)(f) GDPR for general requests. Cloudflare and Microsoft act as our processors on the basis of separate data processing agreements. Processing in third countries cannot be excluded; appropriate transfer mechanisms are used where required.

12. Appointment Booking – Microsoft Bookings Planned

This section describes a planned feature. It is not yet active on this website.

We use Microsoft Bookings for appointment bookings, in particular for demos, consultations or initial meetings. In this context, name, email address, telephone number, company, desired appointment, booking content and other voluntarily provided information may be processed.

The purpose is the planning and execution of appointments. The legal basis is Article 6(1)(b) GDPR where the booking relates to pre-contractual or contractual purposes, and otherwise Article 6(1)(f) GDPR.

13. Newsletter – MailchimpPlanned

This section describes a planned feature. It is not yet active on this website.

We use Mailchimp, a service provided by Intuit Inc. or the respective company responsible for the service, to send our newsletter.

We generally use a double opt-in procedure for newsletter registration. In this context, we process in particular:

• Email address
• Name, where provided
• Time of registration
• Time of confirmation
• IP address at registration and confirmation
• Opening and click data, where activated

The purpose is to send information about our products, services, technical content, company news and similar topics. The legal basis is your consent pursuant to Article 6(1)(a) GDPR. You can withdraw your consent at any time via the unsubscribe link in the newsletter or by sending us a message.

Processing in third countries, in particular in the USA, cannot be excluded. Please also refer to Mailchimp's privacy notices in their current version.

14. Payment Providers – Stripe and PayPalPlanned

This section describes a planned feature. It is not yet active on this website.

If you purchase paid services, hardware or subscriptions via our website, payment data may be processed by external payment service providers.

14.1 Stripe

We use Stripe for payment processing. The provider is Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland, as well as affiliated Stripe companies.

The following data in particular may be processed:

• Name
• Billing and contact details
• Payment data
• Transaction data
• Fraud prevention and risk data

The purposes are payment processing, invoicing, fraud prevention and compliance with legal obligations. The legal bases are Article 6(1)(b) GDPR, Article 6(1)(c) GDPR and Article 6(1)(f) GDPR.

14.2 PayPal

We use PayPal as a payment service provider. The provider is PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg.

If you select PayPal, payment and transaction data will be transmitted to PayPal or processed by PayPal. The purpose is payment processing. The legal basis is Article 6(1)(b) GDPR.

15. YouTube Videos

We may embed videos from YouTube. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

To minimise data transfer until consent is given, our embed component does not load any YouTube resources by default. Only after you give consent for external media via our cookie settings is the video iframe loaded — and we use the privacy-friendlier domain youtube-nocookie.com. When the iframe is loaded after consent, personal data may be transmitted to Google, in particular IP address, device information, usage data and information about the video played. The legal basis is Article 6(1)(a) GDPR.

16. Social Media Links

Our website contains a link to our LinkedIn profile. If you click on this link, you leave our website. The respective platform operator is responsible for the processing of personal data on that platform.

17. Customer Account and SaaS PlatformPlanned

This section describes a planned feature. It is not yet active on this website.

If you create a customer account or use our SaaS platform, we process in particular:

• Master data, such as name, company, role and email address
• Login and account data
• Contract and billing data
• Usage and log data
• API access and security data
• Energy, system, measurement, sensor, control or building data provided by the customer

The purposes of processing are the provision of the platform, authentication, contract performance, support, billing, abuse and security prevention, technical improvement and compliance with legal obligations.

The legal bases are in particular Article 6(1)(b) GDPR, Article 6(1)(c) GDPR and Article 6(1)(f) GDPR. Where we process personal data on behalf of a business customer, this is done on the basis of a separate data processing agreement pursuant to Article 28 GDPR.

18. Storage Period

We store personal data only for as long as this is necessary for the respective purposes or as long as statutory retention periods apply. Contract and billing data may be stored for longer due to commercial and tax law requirements. Data from inquiries will be deleted once the inquiry has been finally processed and no statutory retention obligations prevent deletion.

19. Recipients and Processors

We use technical service providers, hosting, cloud, communication, analytics, newsletter, appointment booking and payment service providers. These providers receive personal data only to the extent necessary for the respective purposes. Where legally required, we conclude data processing agreements.

20. Transfers to Third Countries

Some of the service providers we use may process personal data outside the European Union or the European Economic Area. In these cases, we ensure appropriate safeguards where required by law, such as adequacy decisions, standard contractual clauses or other permitted transfer mechanisms.

21. Your Rights

Subject to the statutory requirements, you have the following rights:

• Right of access
• Right to rectification
• Right to erasure
• Right to restriction of processing
• Right to data portability
• Right to object to processing based on Article 6(1)(e) or Article 6(1)(f) GDPR
• Right to withdraw consent given with effect for the future
• Right to lodge a complaint with a data protection supervisory authority

22. Right to Lodge a Complaint with a Supervisory Authority

You have the right to lodge a complaint with a data protection supervisory authority. The competent authority may in particular be the data protection supervisory authority of the federal state in which we have our registered office or in which you have your habitual residence.

23. Changes to this Privacy Policy

We may amend this Privacy Policy if our website, our services, the providers we use or legal requirements change.