PRIVACY

General notes

Detailed information on how we handle personal data in certain processing situations is available as a PDF by clicking on the following links:

• For applicants and employees (PDF)
• For business contacts (PDF)

1. Overview

Data protection is of paramount importance to GRIPS Energy GmbH. The use of our website is possible without any indication of personal data, however if a data subject wants to engage with us, processing of personal data could become necessary. If the processing of personal data is necessary and there is no statutory basis for such processing, we obtain consent from the data subject.

• General Information

The processing of personal data, such as the name, address, email address or telephone number of a data subject shall always be in line with the General Data Protection Regulation (GDPR) and in accordance with the country-specific data protection regulations applicable to GRIPS Energy GmbH. In this privacy policy, GRIPS Energy GmbH would like to set out the nature, scope, and purpose of the personal data we collect, use and process. Furthermore, data subjects are informed, by means of this policy, of the rights to which they are entitled.

As the controller, GRIPS Energy GmbH has implemented numerous technical and organisational measures to ensure the most complete protection of personal data processed through this website. However, internet-based data transmissions may in principle have security gaps, so absolute protection may not be guaranteed. For this reason, every data subject is free to transfer personal data to us via alternative means, for example, telephone.

Definitions

This privacy policy is based on the terms used by the European legislation for the adoption of the General Data Protection Regulation (GDPR). Our privacy policy is intended to be legible and understandable for the general public, as well as our customers and business partners. To ensure this, we would firstly like to first explain the terminology used:

1. Personal Data – any information relating to an identified or identifiable natural person (“data subject”). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person
2. Data Subject – any identified or identifiable natural person, whose personal data is processed by the controller
3. Controller or controller responsible for the processing – the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law
4. Processing – any operation or set of operations which is performed on personal data or on sets of personal data, whether by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction
5. Restriction of processing – the marking of stored personal data with the aim of limiting their processing in the future
6. Profiling – any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements
7. Pseudonymisation – the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are no attributed to an identified or identifiable natural person
8. Processor – natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller
9. Recipient – a natural or legal person, public authority, agency, or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of those data by those public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing
10. Third party – a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data
11. Consent – any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which they, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to themselves

Name and address of the controller

The Controller for the purposes of the General Data Protection Regulation (GDPR), other data protection laws applicable in Member States of the European Union and other provisions related to data protection is:

GRIPS Energy GmbH

Ella-Barowksy Str. 11-12

10829 Berlin

Deutschland

Telephone: +49 30 5770067-0

Email: privacy@grips-energy.com

In this privacy policy, we, GRIPS Energy GmbH, are the controller and you are the data subject.

• Recording of Data on this website

The data we collect on this website is primarily used to enhance your browsing experience.

What information do we collect?

The GRIPS Energy GmbH website collects primarily analytical information – namely the way users browse this website. The information relates to browser types and versions used, the operating system used by the accessing system, the date and time of accessing our website and any other similar data and information that may be used.

When using this general data and information, GRIPS Energy GmbH does not draw any conclusions about the data subject. Rather, this information is needed to deliver the content of our website correctly, optimise the content of our website as well as its advertisement, ensure the long-term viability of our information technology systems and website technology, and provide law enforcement authorities with the information necessary for criminal prosecution in case of a cyber-attack.

GRIPS Energy GmbH analyses anonymously collected data and information statistically, with the aim of increasing the data protection and data security of our enterprise, and to ensure an optimal level of protection for the personal data we process. The anonymous data of the server log files are stored separately from all personal data provided by a data subject.

When a data subject uses our online form or grievances and feedback page to contact us, in this situation, we collect information relating to their personal identification, namely their name, email address, phone number and this personal data is automatically stored. This personal data is transmitted on a voluntary basis by a data subject to the data controller and is only stored for the purpose of processing or contacting the data subject. There is no transfer of this personal data to third parties.

How do we use the data?

GRIPS Energy GmbH collects a data subject’s data so that we can understand how to improve our website and enhance the browsing experience. In addition, the data is used for our own analytics in order to understand where the people come from and to understand the target audience.

If a data subject uses our online form or grievance and feedback contact page, we use this data to contact the data subject regarding the query, complaint, or feedback they have made.

What are your rights?

You have the right to receive information about the source, recipients, and purposes of your archived personal data at any time without having to pay a fee for such disclosures. You also have the right to demand that your data are rectified or eradicated. If you have consented to data processing, you have the option to revoke this consent at any time, which shall affect all future data processing. Moreover, you have the right to demand that the processing of your data be restricted under certain circumstances. Furthermore, you have the right to log a complaint with the competent supervising agency. You may at any time contact us regarding your rights.

Right of confirmation

The data subject has the right to obtain information and confirmation as to whether personal data concerning themselves is being processed. If a data subject wishes to avail themselves of this right of confirmation, they may, at any time, contact GRIPS Energy GmbH (as the controller).

Right of access

The data subject has the right to obtain free information about their personal data stored at any time and a copy of this information from the controller.

In particular, the data subject can request access to the following information:

• The purposes of the processing;
• The categories of personal data concerned;
• The recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;
• Where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
• The existence of the right to request from the controller rectification or erasure of personal data, or restriction of processing of personal data concerning the data subject, or to object to such processing;
• The existence of the right to lodge a complaint with a supervisory authority;
• Where the personal data is not collected from the data subject, any available information as to the source; and
• The existence of automated decision-making, including profiling, referred to in Art 22(1) and (4) of the GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing for the data subject.

Furthermore, the data subject shall have a right to obtain information as to whether personal data has been transferred to a third country or to an international organisation. Where this is the case, the data subject shall have the right to be informed of the appropriate safeguards relating to the transfer.

If a data subject wishes to avail themselves of this right of access, they may at any time contact the controller, GRIPS Energy GmbH.

Right to rectification

The data subject has the right to have any inaccurate personal data concerning themselves rectified by the controller. In addition, the data subject has the right to have incomplete personal data completed. This is to be done by the controller without undue delay.

If a data subject wishes to exercise this right to rectification, they may at any time contact the controller, GRIPS Energy GmbH.

Right to erasure

The data subject has the right to have their personal data erased by the controller. The controller also has the obligation to erase personal data without where one of the following applies:

• The personal data is no longer necessary in relation to the purpose for which it was collected or otherwise processed;
• The data subject withdraws consent to which the processing is based according to Art 6(1)(a) of the GDPR or Art 9(2)(a) of the GDPR and where there is no other legal basis for the processing;
• The data subject object to the processing pursuant to Art 21(1) of the GDPR and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Art 21(2) of the GDPR;
• The personal data has been unlawfully processed;
• The personal data must be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject; or
• The personal data has been collected in relation to the offer of information society services referred to in Art 8(1) GDPR.

If one of the above reasons applies, and a data subject wishes to request the erasure of personal data stored by GRIPS Energy GmbH, they may, at any time, contact us. GRIPS Energy GmbH shall promptly ensure that the erasure request is complied with immediately.

Where the controller has made personal data public and is obliged, pursuant to Art 17(1) of the GDPR, to erase the personal data, the controller shall take all reasonable steps (in consideration of available technology and the cost of implementation) to inform other controllers processing the personal data that the data subject has requested erasure by such controllers of any links to or copy or replication of, this personal data as far as processing is not required. GRIPS Energy GmbH will arrange the necessary measures in individual cases.

The exception to the right to erasure applies where the processing is necessary:

• To exercise the right to freedom of expression and information;
• For compliance with a legal obligation which requires processing under Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
• For reasons of public interest in the area of public health pursuant to Art 9 (2)(h) and (i), and Art 9 (3) of the GDPR;
• For archiving purposes in the public interest, scientific or historical research purposes or statistical purposes pursuant to Art 89 (1) of the GDPR, where the right to erasure is likely to render impossible or seriously prejudice the achievement of the purposes of such processing; or
• For the assertion, exercise or defence of legal claims.

Furthermore, the right to deletion does not exist if the personal data must be stored by the controller due to statutory retention obligations and periods. In such a case, the personal data will be blocked instead of deleted.

Right of restriction of processing

The data subject has the right to demand the imposition of restrictions as far as the processing of their personal data is concerned. The right to demand restriction of processing applies in the following cases:

• The accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data;
• The processing is unlawful, and the data subject opposes the erasure of the personal data and requests instead the restriction of their use instead;
• The controller no longer needs the personal data for the purposes of the processing, but they are required to do so by the data subject for the establishment, exercise, or defence of legal claims; or
• The data subject has objected to processing pursuant to Art 21(1) of the GDPR pending the verification whether the legitimate grounds of the controller override those of the data subject.

If one of the above conditions is met and a data subject wishes to request the restriction of the processing of personal data stored by the controller, they may at any time contact the controller, GRIPS Energy GmbH, who will arrange the restriction of the processing.

Right to data portability

Each data subject has the right to receive the personal data concerning themselves, which was provided to the controller. This data is to be provided in a structured, commonly used, and machine-readable format.

In exercising their right to data portability pursuant to Art 20(1) of the GDPR, the data subject shall have the right to have personal data transmitted directly from one controller to another, where technically feasible and when doing so does not adversely affect the rights and freedoms of others.

To assert the right to data portability, the data subject may at any time contact the controller, GRIPS Energy GmbH.

Right to object

The data subject has the right to object (at any time) to the processing of their personal data on grounds relating to their particular situation when data is being processed based on Art 6(1)(e) or (f) of the GDPR. This also applies to profiling based on these provisions.

To determine the legal basis on which any processing of data is based, please consult the rest of this Privacy Policy.

If a data subject logs an objection, the controller will no longer process the affected personal data unless there are compelling protection worthy grounds for the processing of the data in question, that outweigh the interests, rights and freedoms of the data subject or if the purpose of the processing is the claiming, exercising or defence of legal entitlements (an objection pursuant to Art 21(1) GDPR).

If the controller processes personal data for direct marketing purposes, the data subject shall have the right to object at any time to processing personal data concerning themselves for such marketing. This applies to profiling to the extent that it is related to such direct marketing. If the data subject objects to GRIPS Energy GmbH processing for direct marketing purposes, GRIPS Energy GmbH will no longer process the personal data for these purposes.

To exercise the right to object, the data subject may contact the controller, GRIPS Energy GmbH. The data subject is also free in the context of the use of information society services, and notwithstanding Directive 2002/58/EC, to use their right to object by automated means using technical specifications.

Right to withdraw data protection consent

Each data subject shall have the right granted by the European legislator to withdraw their consent to the processing of their personal data at any time.

If the data subject wishes to exercise the right to withdraw the consent, they may, at any time, contact the controller, GRIPS Energy GmbH.

Right to log a complaint

In the event of violations of the GDPR, the data subject is entitled to log a complaint with a supervisory agency, in the member state where they maintain their domicile, place of work or at the place where the alleged violation occurred. The right to log a complaint is in effect regardless of any other administrative or court proceedings available as legal recourses.

How long is the data stored?

The data controller shall process and store the personal data of the data subject only for the period necessary to achieve the purpose of storage or as far as this is granted by the European legislator or other legislators in laws or regulations to which the controller is subject to.

If the storage purpose is not applicable, or if a storage period prescribed by the European legislator or another competent legislator expires, the personal data are routinely blocked or erased in accordance with legal requirements.

• Recording of data on this website

Cookies

GRIPS Energy GmbH internet pages use cookies which are text files that are stored in a computer system via an internet browser. Many internet sites and servers use cookies, and many cookies contain a “cookie-ID”. A cookie-ID is a unique identifier of the cookie and consists of a character string through which internet pages and servers can be assigned to the specific internet browser in which the cookie was stored. This allows visited internet sites and servers to differentiate the individual browser of the data subject from other internet browsers that contain other cookies. A specific internet browser can be recognised and identified using the unique cookie ID. By using cookies, GRIPS Energy GmbH can provide the users of this website with more user-friendly services that would not be possible without the cookie setting.

In addition, the information on our website can be optimised with the user in mind. Cookies allow us to recognise our website users, and this makes it easier for users to utilise our website. The data subject may, at any time, prevent the setting of cookies through our website by means of a corresponding setting of the internet browser used, and may thus permanently deny the setting of cookies. Furthermore, already set cookies may be deleted at any time via an internet browser or other software programs and this can be done on all popular internet browsers. If the data subject deactivates the setting of cookies in the internet browser used, not all functions of our website may be entirely usable.

You can also find out how to disable cookies in the main browsers by following the links below:

• Mozilla Firefox: https://support.mozilla.org/de/kb/cookies-erlauben-und-ablehnen  
• Chrome Browser: https://support.google.com/accounts/answer/61416?hl=de  
• Internet Explorer: https://support.microsoft.com/de-de/help/17442/windows-internet-explorer-delete-manage-cookies
• Safari: https://support.apple.com/kb/PH17191?LOCALE=DE_DE&VIEWLOCALE=EN_US

Contact form

If you submit inquiries to us via our contact form, the information provided in the contact form as well as any contact information provided therein will be stored by us so that we can handle your inquiry, and in the event that we have further questions. We will not share this information without your consent.

The processing of this type of data is based on Art. 6(1)(b) GDPR, if your request is related to the execution of a contract or if it is necessary to carry out pre-contractual measures. In all other cases the processing is based on our legitimate interest in the effective processing of the requests addressed to us (Art. 6(1)(f) GDPR) or on your agreement (Art. 6(1)(a) GDPR) if this has been requested; the consent can be revoked at any time.

The information you have entered into the contact form shall remain with us until you ask us to delete the data, you revoke your consent to the archiving of data or if the purpose for which the information is being archived no longer exists (e.g., after we have concluded our response to your inquiry). This shall be without prejudice to any mandatory legal provisions, in particular retention periods.

Request by e-mail or telephone

If you contact us by e-mail or telephone, your request, including all resulting personal data (name, request) will be stored and processed by us for the purpose of processing your request. We do not pass this data on without your consent.

This type of data is processed on the basis of Art. 6(1)(b) GDPR if your inquiry is related to the fulfillment of a contract or is required for the performance of pre-contractual measures. In all other cases, the data are processed on the basis of our legitimate interest in the effective handling of inquiries submitted to us (Art. 6(1)(f) GDPR) or on the basis of your consent (Art. 6(1)(a) GDPR) if it has been obtained; the consent can be revoked at any time.

The data sent by you to us via contact requests remain with us until you request us to delete, revoke your consent to the storage or the purpose for the data storage lapses (e.g. after completion of your request). Mandatory statutory provisions – in particular statutory retention periods – remain unaffected.

SSL and/or TLS encryption

For security reasons and to protect the transmission of confidential content, such as inquiries you submit to us as the website operator, this website uses either an SSL or a TLS encryption program. You can recognize an encrypted connection by checking whether the address line of the browser switches from “http://” to “https://” and by the appearance of the lock icon in the browser line.

If the SSL or TLS encryption is activated, data you transmit to us cannot be read by third parties.

• Analysis tools

On this website, GRIPS Energy GmbH has integrated the component of Google Analytics (with the anonymizer function). Google Analytics is a web analytics service which collect, gathers, and analysises data about the behaviour of visitors to websites. A web analysis service collects, inter alia, data about the website from which a person has come (the so-called referrer), which sub-pages were visited, or how often and for what duration a sub-page was viewed. Web analytics are mainly used for the optimization of a website and in order to carry out a cost-benefit analysis of Internet advertising.

The operator of the Google Analytics component is Google Ireland Limited, Gordon House, Barrow Street, Dublin, D04 E5W5, Ireland.

For the web analytics through Google Analytics the controller uses the application « _gat. _anonymizeIp ». By means of this application the IP address of the Internet connection of the data subject is abridged by Google and anonymised when accessing our websites from a Member State of the European Union or another Contracting State to the Agreement on the European Economic Area.

The purpose of the Google Analytics component is to analyse the traffic on our website. Google uses the collected data and information, inter alia, to evaluate the use of our website and to provide online reports, which show the activities on our websites, and to provide other services concerning the use of our website for us.

Google Analytics places a cookie on the information technology system of the data subject. The definition of cookies is explained above. With the setting of the cookie, Google is enabled to analyse the use of our website. With each call-up to one of the individual pages of this website, which is operated by the controller and into which a Google Analytics component is integrated, the Internet browser on the information technology system of the data subject will automatically submit data through the Google Analytics component and Google gains knowledge of information, such as the browser type and operating system of the data subject, which serves Google, inter alia, to understand the origin of visitors and clicks, and subsequently optimise browsing for the data subject.

The cookie is used to store personal information, such as the access time and the frequency of visits of our website by the data subject. With each visit to our Internet site, such data will be transmitted to Google and stored by Google in the United States of America. Google may pass this data collected through the technical procedure to third parties.

The data subject may, as stated above, prevent the setting of cookies through our website at any time by means of a corresponding adjustment of the web browser used and thus permanently deny the setting of cookies. Such an adjustment to the Internet browser used would also prevent Google Analytics from setting a cookie on the information technology system of the data subject. In addition, cookies already in use by Google Analytics may be deleted at any time via a web browser or other software programs.

In addition, the data subject has the possibility of objecting to a collection of data that are generated by Google Analytics, which is related to the use of this website, as well as the processing of this data by Google and the chance to preclude any such. For this purpose, the data subject must download a browser add-on under the link https://tools.google.com/dlpage/gaoptout and install it. This browser add-on tells Google Analytics through a JavaScript, that any data and information about the visits of Internet pages may not be transmitted to Google Analytics. The installation of the browser add-ons is considered an objection by Google. If the information technology system of the data subject is later deleted, formatted, or newly installed, then the data subject must reinstall the browser add-ons to disable Google Analytics. If the browser add-on was uninstalled by the data subject or any other person who is attributable to their sphere of competence, or is disabled, it is possible to execute the reinstallation or reactivation of the browser add-ons.

Further information and the applicable data protection provisions of Google may be retrieved under https://www.google.com/intl/en/policies/privacy/  and under http://www.google.com/analytics/terms/us.html . Google Analytics is further explained under the following Link https://www.google.com/analytics/ .

• Plug-ins and other links

YouTube

Our website embeds videos of the website YouTube. The website operator is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

We use YouTube in the expanded data protection mode. According to YouTube, this mode ensures that YouTube does not store any information about visitors to this website before they watch the video. Nevertheless, even if using expanded data protection mode, it does not necessarily mean that data will not be shared with YouTube partners. For instance, regardless of whether you are watching a video, YouTube will always establish a connection with the Google Marketing Network.

As soon as you start to play a YouTube video on this website, a connection to YouTube’s servers will be established. As a result, the YouTube server will be notified which of our pages you have visited. If you are logged into your YouTube account while you visit our site, you enable YouTube to directly allocate your browsing patterns to your personal profile. You have the option to prevent this by logging out of your YouTube account.

Furthermore, after you have started to play a video, YouTube will be able to place various cookies on your device or comparable technologies for recognition (e.g. device fingerprinting). In this way YouTube will be able to obtain information about this website’s visitors. Among other things, this information will be used to generate video statistics with the aim of improving the user friendliness of the site and to prevent attempts to commit fraud.

Under certain circumstances, additional data processing transactions may be triggered after you have started to play a YouTube video, which are beyond our control.

The use of YouTube is based on our interest in presenting our online content in an appealing manner. Pursuant to Art. 6(1)(f) of the GDPR, this is a legitimate interest. If appropriate consent has been obtained, the processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR and § 25 (1) TTDSG, insofar the consent includes the storage of cookies or the access to information in the user’s end device (e.g., device fingerprinting) within the meaning of the TTDSG. This consent can be revoked at any time.

For more information on how YouTube handles user data, please consult the YouTube Data Privacy Policy under: https://policies.google.com/privacy?hl=en .

YouTube is certified in accordance with the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the US, which is intended to ensure compliance with European data protection standards for data processing in the US. Every company certified under the DPF is obliged to comply with these data protection standards. For more information, please contact the provider under the following link: https://www.dataprivacyframework.gov/s/participant-search/participant-detail?contact=true&id=a2zt000000001L5AAI&status=Active

LinkedIn

We have a LinkedIn profile, and our website contains a link to this profile. The provider is the LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. LinkedIn uses advertising cookies.

If you want to disable LinkedIn advertising cookies, please use the following link: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.

Data transmission to the US is based on the Standard Contractual Clauses (SCC) of the European Commission. Details can be found here: https://www.linkedin.com/legal/l/dpa and https://www.linkedin.com/legal/l/eu-sccs.

For details on how they handle your personal information, please refer to LinkedIn’s privacy policy: https://www.linkedin.com/legal/privacy-policy.

X (formerly known as Twitter)

We use the short message service X, and our website contains a link to our X page. The provider is Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland.

You can customize your X privacy settings in your user account. Click on the following link and log in: https://twitter.com/personalization .

Data transmission to the US is based on the Standard Contractual Clauses (SCC) of the European Commission. Details can be found here: https://gdpr.twitter.com/en/controller-to-controller-transfers.html .

For details, see the X Privacy Policy: https://twitter.com/en/privacy .

• Changes to this data protection notice

We always keep this data protection notice up to date. Therefore, we reserve the right to change it from time to time and to update any changes in the collection, processing, or use of your personal data. The current version of the data protection notice is always available under “Privacy Policy” within this website.

This Policy is dated 07.02.2024