Privacy Policy

1. General information and mandatory information

Data protection

The operators of this website and its pages take the protection of your personal data very seriously. Hence, we handle your personal data as confidential information and in compliance with the statutory data protection regulations and this Data Protection Declaration.

Whenever you use this website, a variety of personal information will be collected. Personal data comprises data that can be used to personally identify you. This Data Protection Declaration explains which data we collect as well as the purposes we use this data for. It also explains how, and for which purpose the information is collected.

We herewith advise you that the transmission of data via the Internet (i.e. through e-mail communications) may be prone to security gaps. It is not possible to completely protect data against third party access.

Information about the responsible party (referred to as the “controller” in the GDPR)

The contact data of our data processing controller is

myStrom AG
c/o tiko Energy Solutions AG
Pflanzschulstrasse 7
8004 Zürich
Schweiz

The controller is the natural person or legal entity that single-handedly or jointly with others makes decisions as to the purposes of and resources for the processing of personal data (e.g. names, e-mail addresses, etc.).

Storage period

Unless a specific storage period is specified in this privacy policy, your personal data will remain with us until the purpose for the processing of data no longer applies. If you make a legitimate request for deletion or revoke your consent to the processing of data, your data will be deleted insofar as we have no other legally permissible reasons for storing your personal data (e.g., tax or commercial retention periods); in the latter case, the data will be deleted after these reasons no longer apply.

General information on the legal basis for the processing of data on this website

If you have consented to the processing of data, we will process your personal data on the basis of Art. 6 Para. 1 (a) of the GDPR, or Art. 9 Para. 2 (a) of the GDPR, if special data categories according to Art. 9 Para. 1 of the GDPR are processed. In the event of express consent to have personal data sent to third countries, then the processing of data will also be based on Art. 49 Para. 1 (a) of the GDPR. If you have consented to the storage of cookies or to accessing information on your end device (e.g., via device fingerprinting), then the processing of data will also be carried out on the basis of Section 25 (1) of the Telecommunication Telemedia Data Protection Act (TTDSG). Consent is revocable at any time. If your data is required to fulfil the contract or to carry out pre-contractual measures, then we process your data on the basis of Art. 6 Para. 1 (b) of the GDPR. Furthermore, we process your data if it is required to fulfil a legal obligation on the basis of Art. 6 Para. 1 (c) of the GDPR. The processing of data can also be based on our legitimate interest according to Art. 6 Para. 1 (f) of the GDPR. The following paragraphs of this privacy policy provide information on the relevant legal bases in each individual case.

Note on transferring data to the USA and other third countries

Among other things, we use tools from companies based in the USA or other third countries that are not secure under data protection laws. When these tools are active, your personal data can be transferred to these third countries and processed there. We would like to point out that in these countries, no level of data protection comparable to that in the EU can be guaranteed. For example, US companies are obliged to hand over personal data to security authorities without you as a data subject being able to take legal action against this. As such, it cannot be ruled out that US authorities (for example, intelligence services) process, evaluate and permanently store your data located on US servers for surveillance purposes. We have no influence over these processing activities.

Revocation of your consent to the processing of data

A wide range of data processing transactions are possible only subject to your express consent. You can also revoke at any time any consent you have already given us. This shall be without prejudice to the lawfulness of any data collection that occurred prior to your revocation.

RIGHT TO OBJECT TO THE COLLECTION OF DATA IN SPECIAL CASES; RIGHT TO OBJECT TO DIRECT ADVERTISING (ART. 21 GDPR)

IN THE EVENT THAT DATA ARE PROCESSED ON THE BASIS OF ART. 6 SECT. 1 LIT. E OR F GDPR, YOU HAVE THE RIGHT TO AT ANY TIME OBJECT TO THE PROCESSING OF YOUR PERSONAL DATA BASED ON GROUNDS ARISING FROM YOUR UNIQUE SITUATION. THIS ALSO APPLIES TO ANY PROFILING BASED ON THESE PROVISIONS. TO DETERMINE THE LEGAL BASIS, ON WHICH ANY PROCESSING OF DATA IS BASED, PLEASE CONSULT THIS DATA PROTECTION DECLARATION. IF YOU LOG AN OBJECTION, WE WILL NO LONGER PROCESS YOUR AFFECTED PERSONAL DATA, UNLESS WE ARE IN A POSITION TO PRESENT COMPELLING PROTECTION WORTHY GROUNDS FOR THE PROCESSING OF YOUR DATA, THAT OUTWEIGH YOUR INTERESTS, RIGHTS AND FREEDOMS OR IF THE PURPOSE OF THE PROCESSING IS THE CLAIMING, EXERCISING OR DEFENCE OF LEGAL ENTITLEMENTS (OBJECTION PURSUANT TO ART. 21 SECT. 1 GDPR).

IF YOUR PERSONAL DATA IS BEING PROCESSED IN ORDER TO ENGAGE IN DIRECT ADVERTISING, YOU HAVE THE RIGHT TO AT ANY TIME OBJECT TO THE PROCESSING OF YOUR AFFECTED PERSONAL DATA FOR THE PURPOSES OF SUCH ADVERTISING. THIS ALSO APPLIES TO PROFILING TO THE EXTENT THAT IT IS AFFILIATED WITH SUCH DIRECT ADVERTISING. IF YOU OBJECT, YOUR PERSONAL DATA WILL SUBSEQUENTLY NO LONGER BE USED FOR DIRECT ADVERTISING PURPOSES (OBJECTION PURSUANT TO ART. 21 SECT. 2 GDPR).

Right to log a complaint with the competent supervisory agency

In the event of violations of the GDPR, data subjects are entitled to log a complaint with a supervisory agency, in particular in the member state where they usually maintain their domicile, place of work or at the place where the alleged violation occurred. The right to log a complaint is in effect regardless of any other administrative or court proceedings available as legal recourses.

Right to data portability

You have the right to demand that we hand over any data we automatically process on the basis of your consent or in order to fulfil a contract be handed over to you or a third party in a commonly used, machine readable format. If you should demand the direct transfer of the data to another controller, this will be done only if it is technically feasible.

SSL and TLS encryption

This site uses SSL or TLS encryption for security reasons and for the protection of the transmission of confidential content, such as the enquiries you send to us as the site operator. You can recognise an encrypted connection in your browser’s address line when it changes from “http://” to “https://” and the lock icon is displayed in your browser’s address bar.

If SSL or TLS encryption is activated, the data you transfer to us cannot be read by third parties.

Encrypted payments on this website

If you enter into a contract which obliges you to send us your payment information (e.g., your account number for direct debits), we will require this data in order to process your payment.

Payment transactions using common means of payment (Visa/MasterCard, direct debits) are only made via encrypted SSL or TLS connections. You can recognise an encrypted connection in your browser’s address line when it changes from “http://” to “https://” and the lock icon is displayed in your browser’s address bar.

In encrypted communication, any payment details you submit to us cannot be read by third parties.

Information about, blockage, rectification and eradication of data

Within the scope of the applicable statutory provisions, you have the right to at any time demand information about your archived personal data, their source and recipients as well as the purpose of the processing of your data. You may also have a right to have your data rectified, blocked or eradicated. If you have questions about this subject matter or any other questions about personal data, please do not hesitate to contact us at any time at the address provided in section “Information Required by Law.”

Right to demand processing restrictions

You have the right to demand the imposition of restrictions as far as the processing of your personal data is concerned. To do so, you may contact us at any time at the address provided in section “Information Required by Law.” The right to demand restriction of processing applies in the following cases:

• In the event that you should dispute the correctness of your data archived by us, we will usually need some time to verify this claim. During the time that this investigation is ongoing, you have the right to demand that we restrict the processing of your personal data.
• If the processing of your personal data was/is conducted in an unlawful manner, you have the option to demand the restriction of the processing of your data in lieu of demanding the eradication of this data.
• If we do not need your personal data any longer and you need it to exercise, defend or claim legal entitlements, you have the right to demand the restriction of the processing of your personal data instead of its eradication.
• If you have raised an objection pursuant to Art. 21 Sect. 1 GDPR, your rights and our rights will have to be weighed against each other. As long as it has not been determined whose interests prevail, you have the right to demand a restriction of the processing of your personal data.

If you have restricted the processing of your personal data, these data – with the exception of their archiving – may be processed only subject to your consent or to claim, exercise or defend legal entitlements or to protect the rights of other natural persons or legal entities or for important public interest reasons cited by the European Union or a member state of the EU.

 

2. Recording of data on our website

Cookies

Our websites use so-called cookies. Cookies are small text files and do not cause any damage to your device. They are stored either temporarily for the duration of a session (session cookies) or permanently (permanent cookies) on your device. Session cookies are automatically deleted after your visit. Permanent cookies remain stored on your device until you delete them yourself or your web browser automatically deletes them.

In some cases, cookies from third-party companies can also be stored on your device when you enter our website (third-party cookies). These enable us or you to use certain third-party services (e.g., cookies for processing payment services).

Cookies perform various different functions. Many cookies are necessary for technical reasons, as certain website functions cannot work without them (for example, the shopping cart function or the display of videos). Other cookies are used to evaluate user behaviour or to display advertising.

Cookies that are necessary to carry out the electronic communication process or to provide certain functions that you have requested (e.g., for the shopping basket function) or to enhance the website (e.g., cookies to measure web audience) (necessary cookies) are stored on the basis of Art. 6 Para. 1 (f) of the GDPR, unless another legal basis is specified. The website operator has a legitimate interest in storing necessary cookies to ensure the fault-free and optimised provision of its services. If consent to the storage of cookies and comparable recognition technology has been requested, processing takes place exclusively on the basis of this consent (Art. 6 Para. 1 (a) of the GDPR and Section 25 (1) of the Telecommunication Telemedia Data Protection Act (TTDSG); consent is revocable at any time.

You can configure your browser to inform you about the use of cookies so that you can accept or reject cookies on an individual basis, to automatically accept cookies under certain conditions or always reject them, and to automatically delete cookies when you close your browser. Disabling cookies may limit your ability to use some of the functions of this website.

In the event that third party cookies are used or if cookies are used for analytical purposes, we will separately notify you in conjunction with this privacy policy and, if applicable, ask for your consent.

Server log files

The provider of this website and its pages automatically collects and stores information in so-called server log files, which your browser communicates to us automatically. The information comprises:

• The type and version of browser used
• The used operating system
• Referrer URL
• The hostname of the accessing computer
• The time of the server inquiry
• The IP address

This data is not merged with other data sources.

This data is recorded on the basis of Art. 6 Sect. 1 lit. f GDPR. The operator of the website has a legitimate interest in the technically error free depiction and the optimization of the operator’s website. In order to achieve this, server log files must be recorded.

Contact form

If you submit inquiries to us via our contact form, the information provided in the contact form as well as any contact information provided therein will be stored by us in order to handle your inquiry and in the event that we have further questions. We will not share this information without your consent.

This data is processed on the basis of Art. 6 Para. 1 (b) of the GDPR, insofar as your request is related to the performance of a contract or is necessary for the performance of pre-contractual measures. In all other cases, the processing is based on our legitimate interest in the effective handling of requests addressed to us (Art. 6 Para. 1 (f) of the GDPR) or your consent (Art. 6 Para. 1 (a) of the GDPR) if this was requested; consent is revocable at any time.

The information you have entered into the contact form shall remain with us until you ask us to eradicate the data, revoke your consent to the archiving of data or if the purpose for which the information is being archived no longer exists (e.g. after we have concluded our response to your inquiry). This shall be without prejudice to any mandatory legal provisions – in particular retention periods.

Enquiry by email, phone, or fax

If you contact us by e-mail, your request, including all resulting personal data (name, request) will be stored and processed by us for the purpose of processing your request. We do not pass these data on without your consent.

This data is processed on the basis of Art. 6 Para. 1 (b) of the GDPR, insofar as your request is related to the performance of a contract or is necessary for the performance of pre-contractual measures. In all other cases, the processing is based on our legitimate interest in the effective handling of requests addressed to us (Art. 6 Para. 1 (f) of the GDPR) or your consent (Art. 6 Para. 1 (a) of the GDPR) if this was requested; consent is revocable at any time.

The data sent by you to us via contact requests remain with us until you request us to delete, revoke your consent to the storage or the purpose for the data storage lapses (e.g. after completion of your request). Mandatory statutory provisions – in particular statutory retention periods – remain unaffected.

Registration on this website or via APP

You have the option to register on our website or via APP to be able to use additional website functions. We shall use the data you enter only for the purpose of using the respective offer or service you have registered for. The required information we request at the time of registration must be entered in full. Otherwise we shall reject the registration.

To notify you of any important changes to the scope of our portfolio or in the event of technical modifications, we shall use the e-mail address provided during the registration process.

We shall process the data entered during the registration process on the basis of your consent (Art. 6 Sect. 1 lit. a GDPR).

The data recorded during the registration process shall be stored by us as long as you are registered on our website. Subsequently, such data shall be deleted. This shall be without prejudice to mandatory statutory retention obligations.

Registration with Facebook Connect

Instead of registering directly on our website, you also have the option to register using Facebook Connect. The provider of this service is Facebook Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. According to Facebook, the data collected will also be transferred to the USA and other third countries.

If you decide to register via Facebook Connect and click on the “Login with Facebook” / “Connect with Facebook” button, you will be automatically connected to the Facebook platform. There, you can log in using your username and password. As a result, your Facebook profile will be linked to our website or our services. This link gives us access to the data you have archived with Facebook. These data comprise primarily the following:

• Facebook name
• Facebook profile photo and cover photo
• Facebook cover photo
• E-mail address archived with Facebook
• Facebook-ID
• Facebook friends lists
• Facebook Likes (“Likes” information)
• Date of birth
• Gender
• Country

The registration via Facebook Connect and the affiliated data processing transactions are implemented on the basis of your consent (Art. 6 Sect. 1 lit. a GDPR). You may revoke this consent at any time, which shall affect all future transactions thereafter.

Insofar as personal data is collected on our website and forwarded to Facebook using the tool described here, we and Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland are jointly responsible for this processing of data (Art. 26 of the GDPR). Joint responsibility is limited to collecting the data and passing it on to Facebook. Processing by Facebook after forwarding is not part of the joint responsibility. Our joint obligations have been set out in a joint processing agreement. The wording of the agreement can be found at: https://www.facebook.com/legal/controller_addendum. According to this agreement, we are responsible for issuing data protection information when using the Facebook tool and for implementing the tool on our website in a secure manner and in accordance with data protection laws. Facebook is responsible for the data security of Facebook products. You can assert your rights (e.g., requests for information) regarding the data processed on Facebook directly on Facebook. If you assert the rights of data subjects with us, we are obliged to forward them to Facebook.

Transfer of data to the USA is based on the standard contractual clauses of the EU Commission. You can find details here: https://www.facebook.com/legal/EU_data_transfer_addendum, https://de-de.facebook.com/help/566994660333381 und https://www.facebook.com/policy.php.

For more information, see Facebook’s terms of use and privacy policy. You can find them at: https://de-de.facebook.com/about/privacy/ und https://de-de.facebook.com/legal/terms/.

Processing of data (customer and contract data)

We collect, process and use personal data only to the extent necessary for the establishment, content organization or change of the legal relationship (data inventory). These actions are taken on the basis of Art. 6 Sect. 1 lit. b GDPR, which permits the processing of data for the fulfilment of a contract or pre-contractual actions. We collect, process and use personal data concerning the use of our website (usage data) only to the extent that this is necessary to make it possible for users to utilize the services and to bill for them.

The collected customer data shall be eradicated upon completion of the order or the termination of the business relationship. This shall be without prejudice to any statutory retention mandates.

Data transfer upon closing of contracts for online stores, retailers and the shipment of merchandise

We share personal data with third parties only if this is necessary in conjunction with the handling of the contract; for instance, with companies entrusted with the shipment of goods or the financial institution tasked with the processing of payments. Any further transfer of data shall not occur or shall only occur if you have expressly consented to the transfer. Any sharing of your data with third parties in the absence of your express consent, for instance for advertising purposes, shall not occur.

The basis for the processing of data is Art. 6 Sect. 1 lit. b GDPR, which permits the processing of data for the fulfillment of a contract or for pre-contractual actions.

Data transfer upon closing of contracts for services and digital content

We share personal data with third parties only if this is necessary in conjunction with the handling of the contract; for instance, with the financial institution tasked with the processing of payments.

Any further transfer of data shall not occur or shall only occur if you have expressly consented to the transfer. Any sharing of your data with third parties in the absence of your express consent, for instance for advertising purposes, shall not occur.

The basis for the processing of data is Art. 6 Sect. 1 lit. b GDPR, which permits the processing of data for the fulfilment of a contract or for pre-contractual actions.

Payment services

We include payment services from third party companies on our website. If you purchase something from us, your payment data (e.g., name, payment amount, account details, credit card number) will be processed by the payment service provider for processing the payment. The respective contract and data protection provisions of the respective provider apply to these transactions. The payment service providers are used on the basis of Art. 6 Para. 1 (b) of the GDPR (contract execution) and in the interest of a payment process that is as smooth, convenient and secure as possible (Art. 6 Para. 1 (f) of the GDPR). If your consent is requested for certain actions, Art. 6 Para. 1 (a) of the GDPR is the legal basis for the processing of data; consent is revocable at any time for the future.

We use the following payment services/payment service providers on this website:

Datatrans (payments by MasterCard and Visa)
The payment service provider is Datatrans AG, Kreuzbühlstrasse 26, CH-8008 Zurich, Switzerland (hereinafter referred to as “Datatrans”).
If you choose to pay via MasterCard or Visa, the payment details you enter will be transmitted to Datatrans.

The transmission of your data to PayPal is carried out in accordance with Art. 6 Para. 1 (a) of the GDPR (Consent) and Art. 6 Para. 1 (b) of the GDPR (Processing for contract fulfilment purposes). You have the option to revoke your consent to the processing of data at any time. Revocation does not affect the effectiveness of historical data processing operations.

PayPal
The provider of the payment service is PayPal (Europe) S.à.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (hereinafter referred to as “PayPal”).
If you select payment via PayPal, the payment data you provide will be transmitted to PayPal.

The transmission of your data to PayPal is carried out in accordance with Art. 6 Para. 1 (a) of the GDPR (Consent) and Art. 6 Para. 1 (b) of the GDPR (Processing for contract fulfilment purposes). You have the option to revoke your consent to the processing of data at any time. Revocation does not affect the effectiveness of historical data processing operations.

Google RECAPTCHA

We use “Google reCAPTCHA” (hereinafter referred to as “reCAPTCHA”) on this website. The provider is Google Ireland Limited (hereinafter referred to as “Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

reCAPTCHA is used to check whether the data entered on this website (such as on a contact form) has been entered by a human or by an automated program. To do this, reCAPTCHA analyses the behaviour of the website visitor based on various characteristics. This analysis starts automatically as soon as visitors access the website. For the analysis, reCAPTCHA evaluates various information (e.g., IP address, how long the visitor remains on the website, or mouse movements made by the user). The data collected during the analysis will be forwarded to Google.

reCAPTCHA analyses take place entirely in the background. Website visitors are not advised that such an analysis is taking place.

The data is stored and analysed on the basis of Art. 6 1 (f) of the GDPR. The website owner has a legitimate interest in protecting their web offers from abusive automated spying and spam. If a corresponding consent has been requested, processing takes place exclusively on the basis of Art. 6 Para. 1 (a) of the GDPR and Section 25 1 of the Telecommunication Telemedia Data Protection Act (TTDSG), insofar as the consent includes the storage of cookies or access to information in the user’s end device (e.g., device fingerprinting) within the meaning of the Telecommunication Telemedia Data Protection Act (TTDSG). Consent is revocable at any time.

For further information on Google reCAPTCHA, please refer to Google’s privacy policy and the Google terms of use at the following links: https://policies.google.com/privacy?hl=de and https://policies.google.com/terms?hl=de.

 

3. Analysis tools and advertising

Google Tag Manager

We use the Google Tag Manager. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

The Google Tag Manager is a tool that we can use to integrate tracking or statistical tools and other technologies on our website. The Google Tag Manager itself does not create any user profiles, does not save any cookies and does not carry out any independent analyses. It serves only for the administration and display of the tools integrated through it. However, the Google Tag Manager records your IP address, which can also be transmitted to Google’s parent company in the United States.

The Google Tag Manager is used on the basis of Art. 6 Para. 1 (f) of the GDPR. The website operator has a legitimate interest in the quick and easy integration and management of various tools on its website. If a corresponding consent has been requested, processing takes place exclusively on the basis of Art. 6 Para. 1 (a) of the GDPR and Section 25 1 of the Telecommunication Telemedia Data Protection Act (TTDSG), insofar as the consent includes the storage of cookies or access to information in the user’s end device (e.g., device fingerprinting) within the meaning of the Telecommunication Telemedia Data Protection Act (TTDSG). Consent is revocable at any time.

Google Analytics

This website uses Google Analytics, a web analysis service. The provider is Google Ireland Limited (hereinafter referred to as “Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics enables the website operator to analyse the behaviour of website visitors. Here the website operator receives various usage data, such as page views, length of stay, operating systems used and origin of the user. This data is summarised in a user ID and assigned to the respective end device of the website visitor.

Google Analytics uses technologies that enable the user to be recognised for the purpose of analysing user behaviour (e.g., cookies or device fingerprinting). The information collected by Google about the use of this website is usually transmitted to a Google server in the USA and stored there.

The use of the analysis tool is based on Art. 6 1 (f) of the GDPR. The website operator has a legitimate interest in analysing user behaviour in order to optimise both its website and its advertising. If a corresponding consent has been requested, processing takes place exclusively on the basis of Art. 6 Para. 1 (a) of the GDPR and Section 25 1 of the Telecommunication Telemedia Data Protection Act (TTDSG), insofar as the consent includes the storage of cookies or access to information in the user’s end device (e.g., device fingerprinting) within the meaning of the Telecommunication Telemedia Data Protection Act (TTDSG). Consent is revocable at any time.

Transfer of data to the USA is based on the standard contractual clauses of the EU Commission. You can find details here: https://privacy.google.com/businesses/controllerterms/mccs/.

Browser plug-in

You can prevent Google from collecting and processing your data by downloading and installing the browser plug-in available under the following link: https://tools.google.com/dlpage/gaoptout?hl=de.

For more information about how Google Analytics handles user data, see Google’s privacy policy: https://support.google.com/analytics/answer/6004245?hl=de.

IP anonymization

On this website, we have activated the IP anonymization function. As a result, your IP address will be abbreviated by Google within the member states of the European Union or in other states that have ratified the Convention on the European Economic Area prior to its transmission to the United States. The full IP address will be transmitted to one of Google’s servers in the United States and abbreviated there only in exceptional cases. On behalf of the operator of this website, Google shall use this information to analyse your use of this website to generate reports on website activities and to render other services to the operator of this website that are related to the use of the website and the Internet. The IP address transmitted in conjunction with Google Analytics from your browser shall not be merged with other data in Google’s possession.

Objection to the recording of data

You have the option to prevent the recording of your data by Google Analytics by clicking on the following link. This will result in the placement of an opt out cookie, which prevents the recording of your data during future visits to this website: Google Analytics deactivation.

For more information about the handling of user data by Google Analytics, please consult Google’s Data Privacy Declaration: https://support.google.com/analytics/answer/6004245.

Contract data processing

We have executed a contract data processing agreement with Google and are implementing the stringent provisions of the German data protection agencies to the fullest when using Google Analytics.

Demographic parameters provided by Google Analytics

This website uses the function “demographic parameters” provided by Google Analytics. It makes it possible to generate reports providing information on the age, gender and interests of website visitors. The sources of this information are interest-related advertising by Google as well as visitor data obtained from third party providers. This data cannot be allocated to a specific individual. You have the option to deactivate this function at any time by making pertinent settings changes for advertising in your Google account or you can generally prohibit the recording of your data by Google Analytics as explained in section “Objection to the recording of data.”

Archiving period

Data on the user or incident level stored by Google linked to cookies, user IDs or advertising IDs (e.g. DoubleClick cookies, Android advertising ID) will be anonymized or deleted after 14 month. For details please click the following link: https://support.google.com/analytics/answer/7667196

 

4. Newsletter

Newsletter data

If you would like to receive our newsletter, we require a valid email address as well as information which allows us to verify that you are the owner of the email address provided and that you agree to receive this newsletter. No additional data is collected or is only collected on a voluntary basis. We use newsletter service providers to process the newsletter. They are described in the following section.

The processing of the information entered into the newsletter subscription form shall occur exclusively on the basis of your consent (Art. 6 Sect. 1 lit. a GDPR). You may revoke the consent you have given to the archiving of data, the e-mail address and the use of this information for the sending of the newsletter at any time, for instance by clicking on the “Unsubscribe” link in the newsletter. This shall be without prejudice to the lawfulness of any data processing transactions that have taken place to date.

The data you archive with us for the purpose of the newsletter subscription shall be archived by us until you unsubscribe from the newsletter. Once you cancel your subscription to the newsletter, the data shall be deleted. This shall not affect data we have been archiving for other purposes.

MailChimp

This website uses the services of MailChimp to send out its newsletters. The provider is the Rocket Science Group LLC, 675 Ponce De Leon Ave NE, Suite 5000, Atlanta, GA 30308, USA.

Among other things, MailChimp is a service that can be deployed to organise and analyse the sending of newsletters. Whenever you enter data for the purpose of subscribing to a newsletter (e.g. your e-mail address), the information is stored on MailChimp servers in the United States.

MailChimp is in possession of a certification that is in compliance with the “EU-US-Privacy-Shield.” The “Privacy-Shield” is a compact between the European Union (EU) and the United States of America (USA) that aims to warrant the compliance with European data protection standards in the United States.

With the assistance of the MailChimp tool, we can analyse the performance of our newsletter campaigns. If you open an e-mail that has been sent through the MailChimp tool, a file that has been integrated into the e-mail (a so-called web-beacon) connects to MailChimp’s servers in the United States. As a result, it can be determined whether a newsletter message has been opened and which links the recipient possibly clicked on. Technical information is also recorded at that time (e.g. the time of access, the IP address, type of browser and operating system). This information cannot be allocated to the respective newsletter recipient. Their sole purpose is the performance of statistical analyses of newsletter campaigns. The results of such analyses can be used to tailor future newsletters to the interests of their recipients more effectively.

If you do not want your usage of the newsletter to be analysed by MailChimp, you will have to unsubscribe from the newsletter. We provide a link to do this in every newsletter we send.

The data is processed based on your consent (Art. 6 Sect. 1 lit. a GDPR).  You may revoke any consent you have given at any time by unsubscribing from the newsletter. This shall be without prejudice to the lawfulness of any data processing transactions that have taken place prior to your revocation.

The data you archive with us for the purpose of the newsletter subscription shall be archived by us until you unsubscribe from the newsletter. Once you cancel your subscription to the newsletter, the data shall be deleted from our servers as well as those of MailChimp. This shall not affect data we have been archiving for other purposes.

Transfer of data to the USA is based on the standard contractual clauses of the EU Commission. You can find details here: https://mailchimp.com/eu-us-data-transfer-statement/ und https://mailchimp.com/legal/data-processing-addendum/#Annex_C_-_Standard_Contractual_Clauses.

After you have unsubscribed from the newsletter distribution list, your email address may be saved in a blacklist either with us or the newsletter service provider if this is necessary to prevent future mailings. The data from the blacklist is used solely for this purpose and is not combined with other data. This serves both your interest and our interest in complying with the legal requirements for sending newsletters (legitimate interest in accordance with Art. 6 Para. 1 (f) of the GDPR). The storage in the blacklist is not limited in time. You may object to the storage if your interests outweigh our legitimate interests.

For details, see MailChimp’s privacy policy at: https://mailchimp.com/legal/terms/.

Execution of a contract data processing agreement

We have concluded a data processing agreement (DPA) with the aforementioned provider. This is a contract prescribed by data protection laws, which ensures that they only process the personal data of our website visitors in accordance with our instructions and in compliance with the GDPR.

 

5. Data processing in connection with the use of myStrom software applications

Collection of general personal data

If you use and register our software applications, personal data will be collected.

The collection of this data takes place for the implementation of the user agreement between us and the software users (Art. 6 para. 1 clause 1 letter b GDPR). With regard to voluntary information, data processing is also carried out on the basis of Art. 6 para. 1 clause 1 letter f GDPR. We have a legitimate interest in collecting voluntary information from our users.

Data collection and storage in the context of software use

If you use myStrom’s software applications, usage data is collected. This data will be deleted if the customer deletes their myStrom account, and is otherwise kept for a maximum of 60 weeks.

Remote access for the purpose of software maintenance

For the purpose of control, configuration, updating and similar, myStrom is entitled to access the customer’s infrastructure used for the service provision and to view, modify, update, delete or otherwise control existing technical data or software (hereinafter referred to as “software maintenance”). Via remote access, myStrom gets an insight into the customer’s technical data, which is directly related to the configuration of myStrom’s hardware, software and services.

No storage or other processing of the personal data beyond the inspection takes place.

The legal basis for the processing of data is Art. 6 Para. 1 (b) of the GDPR and Section 25 Para. 2 No. 2 of the Telecommunication Telemedia Data Protection Act (TTDSG), since software maintenance is required to fulfil the contract and is based on a service that is expressly requested by the customer. Furthermore, data processing is based on Art. 6 Para. 1 (f) of the GDPR as the maintenance of software services is a legitimate interest of myStrom.

Connection to third-party devices via an API

myStrom’s app offers its customers the option of connecting to third-party devices in their households via an interface (API) in order to control the third-party devices via myStrom’s app. With this connection, no personal data is transmitted to the provider of the third-party device.

From a contractual point of view, myStrom only owes the transmission of data that is required to control the third-party devices. Under data protection law, myStrom is therefore responsible for the data transmission process that takes place via the API. For all the processing of data that takes place after the transmission process has been completed, the respective provider is solely responsible for the transferred data. Here, it is about the transferring of data from one independent controller to another independent controller (controller to controller). You can find details in the privacy policy of the third-party provider.

The personal data via the API is based on Art. 6 Para. 1 (b) of the GDPR.

Alarms, emergency notifications and warnings in the app

The customer can activate alarm functions within the app. To do so, the customer stores their telephone number and, if they wish, a second telephone number (of a trusted person).
If the software registers a specific event (e.g. activation of devices in an empty apartment), a call is made to the stored telephone number or another predefined action is triggered.
Data are processed in accordance with Art. 6 (1) b GDPR (Performance of the Contract).

The data of the contact person are processed on the basis of the consent of the trusted person (Art. 6 (1) a GDPR); the trusted person may revoke this consent at any time.

The telephone numbers can be deleted independently by the customer at any time. In addition, any trusted person may at any time request the deletion of their data from the provider of the myStrom app.

The telephone numbers are used exclusively for the call alarms.

The data will be deleted if the app is uninstalled or the customer or the trusted person requests deletion of the data. In addition, the operator of the app may delete the telephone numbers if they are factually incorrect or contain an unauthorised number (e.g. an inadmissible value-added number).

Access rights of mobile Apps

If you install our mobile apps, they require access rights. The legal basis for access is your consent, which you gave during installation (Art. 6 Para. 1 (a) of the GDPR).

 

6. Designation of a data protection officer as mandated by law (GDPR contact)

VGS Datenschutzpartner UG
Am Kaiserkai 69
20457 Hamburg
Germany
info@datenschutzpartner.eu