sun-X GmbH
An der Erdinger Straße 27
D-85447 Fraunberg
Tel.: +49 81 22 55 37 98 – 70
Email: datenschutz@sun-x.energy
Managing Directors: Pascal Liebold & Claudia Grote-Liebold
Commercial Register Number: HRB 256501 Munich District Court
We consider it our primary responsibility to maintain the confidentiality of the personal data you provide and to protect it from unauthorized access. Therefore, we exercise utmost care and apply state-of-the-art security standards to ensure maximum protection of your personal data.
As a private company, we are subject to the provisions of the European General Data Protection Regulation (GDPR) and the regulations of the Federal Data Protection Act (BDSG). We have implemented technical and organizational measures to ensure that data protection regulations are observed by both us and our external service providers.
The legislator requires that personal data be processed lawfully, in good faith, and in a manner that is transparent to the data subject (“lawfulness, processing in good faith, transparency”). To ensure this, we inform you about the individual legal definitions that are also used in this privacy policy:
“Personal data” means any information relating to an identified or identifiable natural person (hereinafter “data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
“Processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
“Restriction of processing” means the marking of stored personal data with the aim of limiting their processing in the future.
“Profiling” means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location or movements.
“Pseudonymization” means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organizational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.
“Filing system” means any structured set of personal data which are accessible according to specific criteria, whether centralized, decentralized or dispersed on a functional or geographical basis.
“Controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.
“Processor” means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
“Recipient” means a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of those data by those public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing.
“Third party” means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorized to process personal data.
“Consent” of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.
The processing of personal data is only lawful if there is a legal basis for the processing. According to Article 6(1)(a)-(f) GDPR, the legal basis for processing may in particular be:
a) The data subject has given consent to the processing of his or her personal data for one or more specific purposes;
b) Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
c) Processing is necessary for compliance with a legal obligation to which the controller is subject;
d) Processing is necessary in order to protect the vital interests of the data subject or of another natural person;
e) Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
f) Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
(1) In the following, we provide information about the collection of personal data when using our website. Personal data includes, for example, name, address, email addresses, user behavior.
(2) If you contact us via email or through a contact form, the data you provide, as well as your consent to process this data according to our privacy policy, will be stored by us to answer your questions. We delete the data collected in this context once storage is no longer necessary, or we restrict processing if there are statutory retention obligations. The stored data includes:
(3) When registering in the Suncloud through the click path with offer recipient data, the information you provide, as well as your consent to process this data according to our privacy policy, will be stored by us. We also store the non-personal pre-contractual data you enter about your PV system(s), their location, and similar details. We delete the data collected in this context once storage is no longer necessary or upon your request. Alternatively, processing will be restricted if there are statutory retention obligations. The stored personal data includes:
(4) With the use of and login to Suncloud, we also store any changes to your personal and non-personal data, insofar as you communicate these to us directly via the website or otherwise (e.g., via email). Additionally, you have the option to add further non-personal details about your PV system, which are also stored. We delete all data collected in this context once storage is no longer necessary or upon your request. Alternatively, processing will be restricted if there are statutory retention obligations.
When using the website for informational purposes only, i.e., if you do not register or otherwise transmit information to us, we only collect the personal data that your browser transmits to our server. If you wish to view our website, we collect the following data, which is technically necessary for us to display our website to you and to ensure stability and security (the legal basis is Art. 6(1)(f) GDPR):
On this website, data is collected and stored for marketing purposes and for the identification of company prospects using technologies from WebProspector GmbH (www.webprospector.de). The WebProspector technology performs an address determination based on this data, but only in cases where it can ensure that the visitor is a company and not an individual person. The WebProspector technology may receive additional characteristics, such as movement data, about the visit and in some cases uses cookies. Cookies are small text files that are stored locally in the cache of the site visitor’s internet browser. The cookies enable the recognition of the internet browser. You can object to the data collection and storage by WebProspector for this website at any time with effect for the future. To do this, please click on: https://exclusion.unified-tracking.com/exclusion?cid=8bced9d54fe888d17f8075d84b9613a1.
(1) In addition to the purely informational use of our website, we offer various services that you can use if interested. For this, you generally need to provide additional personal data that we use to provide the respective service and to which the aforementioned principles for data processing apply.
(2) We sometimes use external service providers to process your data. These have been carefully selected and commissioned by us, are bound by our instructions, and are regularly monitored.
(3) Furthermore, we may share your personal data with third parties if participation in promotions, contests, contract conclusions, or similar services are offered by us together with partners. You will receive more information about this when providing your personal data or in the description of the offer below.
(4) If our service providers or partners are based in a state outside the European Economic Area (EEA), we will inform you about the consequences of this circumstance in the description of the offer.
Our offer is primarily directed at adults. Persons under 18 years of age should not transmit any personal data to us without the consent of their parents or guardians.
If the processing of personal data is based on consent given, you have the right to revoke this consent at any time. The revocation of consent does not affect the lawfulness of processing based on consent before its revocation.
You can contact us at any time to exercise your right of revocation.
You have the right to request confirmation from the controller as to whether we are processing personal data concerning you. You can request confirmation at any time using the contact details provided above.
If personal data is processed, you can request information about this personal data and about the following information at any time:
The purposes of processing;
The categories of personal data being processed;
The recipients or categories of recipients to whom the personal data has been or will be disclosed, in particular recipients in third countries or international organizations;
If possible, the planned duration for which the personal data will be stored, or, if this is not possible, the criteria for determining this duration;
The existence of a right to rectification or erasure of personal data concerning you or to restriction of processing by the controller or a right to object to such processing;
The existence of a right to lodge a complaint with a supervisory authority;
If the personal data is not collected from the data subject, all available information about the source of the data;
The existence of automated decision-making, including profiling, pursuant to Article 22(1) and (4) GDPR and, at least in these cases, meaningful information about the logic involved as well as the significance and the envisaged consequences of such processing for the data subject.
If personal data is transferred to a third country or to an international organization, you have the right to be informed of the appropriate safeguards pursuant to Article 46 GDPR relating to the transfer. We provide a copy of the personal data undergoing processing. For any further copies requested by you, we may charge a reasonable fee based on administrative costs. If you submit the request electronically, the information shall be provided in a commonly used electronic format, unless otherwise specified. The right to obtain a copy under paragraph 3 shall not adversely affect the rights and freedoms of others.
You have the right to obtain from us without undue delay the rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing, you have the right to have incomplete personal data completed, including by means of providing a supplementary statement.
You have the right to obtain from the controller the erasure of personal data concerning you without undue delay, and we are obligated to erase personal data without undue delay where one of the following grounds applies:
The personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed.
The data subject withdraws consent on which the processing is based according to Article 6(1)(a) or Article 9(2)(a) GDPR, and there is no other legal ground for the processing.
The data subject objects to the processing pursuant to Article 21(1) GDPR and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2) GDPR.
The personal data has been unlawfully processed.
The personal data has to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject.
The personal data has been collected in relation to the offer of information society services referred to in Article 8(1) GDPR.
Where the controller has made the personal data public and is obliged pursuant to paragraph 1 to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data.
The right to erasure (“right to be forgotten”) shall not apply to the extent that processing is necessary:
For exercising the right of freedom of expression and information;
For compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
For reasons of public interest in the area of public health in accordance with Article 9(2)(h) and (i) as well as Article 9(3) GDPR;
For archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) GDPR in so far as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of that processing; or
For the establishment, exercise or defense of legal claims.
You have the right to request from us the restriction of processing of your personal data if one of the following conditions applies:
The accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data;
The processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
The controller no longer needs the personal data for the purposes of processing, but they are required by the data subject for the establishment, exercise, or defense of legal claims; or
The data subject has objected to processing pursuant to Article 21(1) GDPR pending the verification of whether the legitimate grounds of the controller override those of the data subject.
Where processing has been restricted under the conditions mentioned above, such personal data shall, with the exception of storage, only be processed with the data subject’s consent or for the establishment, exercise, or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.
To exercise the right to restriction of processing, the data subject may contact us at any time using the contact details provided above.
You have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used, and machine-readable format, and you have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where:
The processing is based on consent pursuant to Article 6(1)(a) or Article 9(2)(a) or on a contract pursuant to Article 6(1)(b) GDPR; and
The processing is carried out by automated means.
In exercising your right to data portability pursuant to paragraph 1, you have the right to have the personal data transmitted directly from one controller to another, where technically feasible. The exercise of the right to data portability shall be without prejudice to the right to erasure (“right to be forgotten”). That right shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on Article 6(1)(e) or (f) GDPR, including profiling based on those provisions. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the data subject or for the establishment, exercise, or defense of legal claims.
Where personal data are processed for direct marketing purposes, you have the right to object at any time to processing of personal data concerning you for such marketing, which includes profiling to the extent that it is related to such direct marketing. If you object to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.
In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, you may exercise your right to object by automated means using technical specifications.
Where personal data are processed for scientific or historical research purposes or statistical purposes pursuant to Article 89(1), you have the right to object, on grounds relating to your particular situation, to processing of personal data concerning you, unless the processing is necessary for the performance of a task carried out for reasons of public interest.
You may exercise the right to object at any time by contacting the respective controller.
You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. This shall not apply if the decision:
Is necessary for entering into, or performance of, a contract between the data subject and the controller;
Is authorized by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests; or
Is based on the data subject’s explicit consent.
The controller shall implement suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express their point of view, and to contest the decision.
The data subject may exercise this right at any time by contacting the respective controller.
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement if you consider that the processing of personal data relating to you infringes this Regulation.
Without prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint with a supervisory authority pursuant to Article 77 GDPR, you have the right to an effective judicial remedy where you consider that your rights under this Regulation have been infringed as a result of the processing of your personal data in non-compliance with this Regulation.
(1) This website uses Google Analytics, a web analytics service provided by Google Inc. (“Google”). Google Analytics uses “cookies,” which are text files placed on your computer to help the website analyze how users use the site. The information generated by the cookie about your use of this website is usually transmitted to and stored by Google on servers in the United States. In case of activation of IP anonymization on this website, your IP address will be truncated within the area of Member States of the European Union or in other contracting states to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and truncated there. On behalf of the operator of this website, Google will use this information for the purpose of evaluating your use of the website, compiling reports on website activity, and providing other services relating to website activity and internet usage to the website operator.
(2) The IP address transmitted by your browser as part of Google Analytics will not be merged with other data from Google.
(3) You can prevent the storage of cookies by adjusting your browser software accordingly; however, we point out that in this case, you may not be able to use all functions of this website to their full extent. You can also prevent the collection of data generated by the cookie and related to your use of the website (including your IP address) by Google as well as the processing of this data by Google by downloading and installing the browser plug-in available at the following link: http://tools.google.com/dlpage/gaoptout?hl=de.
(4) This website uses Google Analytics with the extension “_anonymizeIp().” As a result, IP addresses are truncated before further processing, so a direct connection to a person can be ruled out. Thus, if the data collected about you is attributable to a person, this is immediately excluded, and the personal data is thereby immediately deleted.
(5) We use Google Analytics to analyze and regularly improve the use of our website. With the statistics obtained, we can improve our offer and make it more interesting for you as a user. For the exceptional cases in which personal data is transferred to the USA, Google has submitted to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework. The legal basis for the use of Google Analytics is Art. 6(1)(f) GDPR.
(6) Third-party provider information: Google Dublin, Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, Fax: +353 (1) 436 1001.
Terms of use: http://www.google.com/analytics/terms/de.html,
Overview on data privacy: http://www.google.com/intl/de/analytics/learn/privacy.html,
Data privacy declaration: http://www.google.de/intl/de/policies/privacy.
(7) This website also uses Google Analytics for cross-device analysis of visitor flows, which is conducted via a User ID. You can deactivate the cross-device analysis of your usage in your customer account under “My Data,” “Personal Data.”
(8) Alternatively, you can prevent Google Analytics from collecting data about you within this website by clicking on “Click here to opt-out.” By clicking on the above link, you download an “opt-out cookie.” Your browser must therefore allow the storage of cookies for this purpose. If you regularly delete your cookies, you will need to click on the link again each time you visit this website.
Use of Social Media Plugins
(1) We currently use the following social media plugins: Facebook. We use the so-called two-click solution. This means that when you visit our page, no personal data is initially passed on to the plugin providers. You can recognize the provider of the plugin by the marking on the box above its initial letter or logo. We give you the opportunity to communicate directly with the plugin provider via the button. Only if you click on the marked field and thereby activate it does the plugin provider receive the information that you have accessed the corresponding website of our online offering. In addition, the data mentioned in § 3 of this declaration will be transmitted. According to the respective providers, in Germany, the IP address is anonymized immediately after collection in the case of Facebook and Xing. By activating the plugin, personal data is transferred from you to the respective plugin provider and stored there (in the case of US providers, in the USA). Since the plugin provider collects data primarily via cookies, we recommend that you delete all cookies via your browser’s security settings before clicking on the grayed-out box.
(2) We have no influence on the collected data and data processing operations, nor are we aware of the full extent of data collection, the purposes of processing, or the storage periods. We also have no information regarding the deletion of the collected data by the plugin provider.
(3) The plugin provider stores the data collected about you as user profiles and uses these for purposes of advertising, market research, and/or the needs-based design of its website. Such an evaluation takes place in particular (even for users who are not logged in) for the display of needs-based advertising and to inform other users of the social network about your activities on our website. You have the right to object to the creation of these user profiles, whereby you must contact the respective plugin provider to exercise this right. Through the plugins, we offer you the possibility to interact with social networks and other users, so that we can improve our offer and make it more interesting for you as a user. The legal basis for the use of plugins is Art. 6(1)(f) GDPR.
(4) The data transfer occurs regardless of whether you have an account with the plugin provider and are logged in there. If you are logged in with the plugin provider, your data collected by us will be directly assigned to your existing account with the plugin provider. If you press the activated button and, for example, link the page, the plugin provider also stores this information in your user account and shares it publicly with your contacts. We recommend that you log out regularly after using a social network, but especially before activating the button, as this way you can avoid an assignment to your profile with the plugin provider.
(5) Further information on the purpose and scope of data collection and its processing by the plugin provider can be found in the privacy policies of these providers as communicated below. There you will also receive further information about your respective rights and setting options to protect your privacy.
(6) Addresses of the respective plugin providers and URLs with their privacy notices:
Facebook Inc., 1601 S California Ave, Palo Alto, California 94304, USA; http://www.facebook.com/policy.php;
Further information on data collection: http://www.facebook.com/help/186325668085084, http://www.facebook.com/about/privacy/your-info-on-other#applications sowie http://www.facebook.com/about/privacy/your-info#everyoneinfo. Facebook hat sich dem EU-US-Privacy-Shield unterworfen, https://www.privacyshield.gov/EU-US-Framework.
