Evergy Engineering GmbH
T +49 89 189 289 30
F +49 89 189 289 89
Dipl. Ing. Jens Langenbrinck
Dipl. Ing. Thorsten Nogge
Dipl. Ing. Marc Böhnke
Court of Registration: Munich
Certificate of Registration: 151 104
Types of Data Processed
- Data inventory (e.g. personal data, names or addresses)
- Contact details (e.g. email, telephone numbers)
- Content data (e.g. text inputs, photographs, videos)
- Usage data (e.g. websites visited, interest in content, times of access)
- (Meta) communication data (e.g. device information, IP addresses)
Categories of Data Subjects
Why we Process Data
We process your personal data for the following purposes:
- To provide our online offering, and its features and content
- To answer client requests and communicate with users
- Security procedures
- To assess the reach of our website/Marketing
“Personal data” means any information relating to an identified or identifiable natural person (hereinafter referred to as “data subject”). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
“Processing” means any operation or set of operations which is performed on personal data or on sets of personal data whether or not by automated means. The term is far-reaching and encompasses virtually all data handling.
“Pseudonymisation” means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.
“Profiling” means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.
“Controller” describes the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
“Processor” means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
Applicable Legal Basis
- The legal basis for obtaining consents is Article 6 (1) a and Article 7 GDPR.
- The legal basis for processing for the performance of our services and contractual measures as well as answering requests is Article 6 (1) b GDPR.
- The legal basis for processing that is necessary for compliance with our legal obligations is Article 6 (1) c GDPR.
- In the event that processing is necessary in order to protect the vital interests of the data subject or of another natural person, Article 6 (1) d GDPR serves as the legal basis.
- The legal basis for processing that is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller is Article 6 (1) e GDPR.
- The legal basis for processing that is necessary for the purposes of protecting our legitimate interests is Article 6 (1) f GDPR.
- Processing data for a purpose other than that for which the personal data have been collected is determined by the requirements of Article 6 (4) GDPR.
- The processing of special categories of personal data (pursuant to Article 9 (1) GDPR) is determined by the requirements of Article 9 (2) GDPR.
In accordance with legal requirements, we take suitable technical and organisational measures to ensure a level of protection that is appropriate to the corresponding risk and that takes into account the state of the art, implementation costs and the nature, scope, circumstances and purposes of processing, as well as the various probabilities of occurrence and severity of the risk to the rights and freedoms of natural persons.
These procedures include, in particular, safeguarding the confidentiality, integrity and availability of data by controlling physical access to the data, as well as online access, entry, transfer, availability and data separation. We have also established procedures that ensure the administration of the rights of data subjects, deletion of data and response to threats to data. We also take the security of personal data into account when we develop or select hardware, software or processes by the use of technology design and default privacy settings that are in keeping with the principal of data protection.
Working with Processors, Joint Controllers and Third Parties
If, as part of our processing, we disclose data to other persons and companies (processors, joint controllers or third parties), transmit data to them or otherwise grant them access to data, this will only be done on the basis of a legal authorisation (e.g. if a transfer of data to third parties, such as payment service providers, is necessary for the performance of a contract) that users have consented to, a legal obligation that provides for this or on the basis of our legitimate interests (e.g. when using agents, web hosting services, etc.).
If we disclose, transmit or otherwise grant access to other companies in our group of companies, this is done as a legitimate interest, particularly for administration purposes, and beyond that on the basis of one of the legal requirements.
Transfers to Third Countries
If we process data in a third country (that is, a country outside the EU, the EEA or the Swiss Confederation), or in the context of the use of third-party services, or the disclosure or transmission of data to other persons or companies, this would only take place to fulfil our precontractual obligations, on the basis of your consent, on the basis of a legal obligation or on the basis of our legitimate interests. Subject to having legal or contractual authorisations, we only process data in a third country if legal requirements have been fulfilled. For example, this could be processing that is done on the basis of special guarantees, such as the official adoption of a data protection level that complies with the EU (e.g. adoption of the “Privacy Shield” for the USA) or compliance with officially recognised special contractual obligations.
Rights of Data Subjects
You have the right to request confirmation as to whether or not personal data concerning you are being processed, and where that is the case, you have the right to request further information about the data and a copy of the data in accordance with the legal requirements.
Under applicable data protection law, you have the right to request the completion of the data related to you or the rectification of inaccurate personal data concerning you.
Under applicable data protection law, you have the right to demand that data concerning you be deleted immediately, or alternatively to demand the restriction of processing regarding your personal data.
Under applicable data protection law, you have the right to request that you receive the personal data which you actively provided us, and further the right to request that it be transmitted to other controllers.
You also have the right, in accordance with legal requirements, to lodge a complaint with the competent supervisory authority.
Withdrawal of Consent
You have the right to withdraw your consents at any time with future effect.
Right to Object
You may object to the future processing of data concerning you at any time in accordance with the legal requirements. The objection may be made specifically against the processing of data for direct advertising purposes.
Cookies and the Right to Object to Direct Advertising
“Cookies” are small files that are stored on users’ end devices. Various types of information can be stored within the cookies. A cookie is primarily used to store information about a user (that is, the device on which the cookie is stored) during or after the user’s visit to an online offering. Temporary cookies, also known as “session cookies” or “transient cookies”, describe cookies that are deleted after a user leaves an online offering and ends his browser session. Temporary cookies can store, for example, the contents of a virtual shopping basket or a login status. Cookies are referred to as “permanent” or “persistent”, if they are still stored even after the browser session has ended. For example, a login status can be saved until the user’s next visit a few days later. These cookies can store the specific interests of users and are used for collecting information on website usage or marketing purposes. Cookies are referred to as a “third-party cookies” when they are used by providers other than the controller that operates the online offering (in the case that only the Controller’s cookies are used, these cookies are referred to as “first-party cookies”).
Deletion of Data
How the data are processed will be restricted, unless the data are not deleted because they are necessary for other and legally permissible purposes. This means that the data will be blocked and not processed for other purposes. This applies, for example, to data that must be retained for commercial or tax reasons.
When contacting us (e.g. using our contact form, by e-mail, telephone or via social media), the users’ details are used to process and handle the contact request in accordance with Article 6 (1) b (within the scope contractual/ precontractual relations) and Article 6 (1) f (other requests) of the GDPR. Users’ information may be stored in a Customer Relationship Management System (“CRM System”) or similar contact platform.
We will delete the requests if they are no longer required. The necessity to keep requests is reviewed every two years and statutory archiving periods shall also apply.
Hosting and E-mails
The hosting services we use provide us with the following services: infrastructure and platform services, computing capacity, storage and database services, e-mail distribution, security services and technical maintenance services that we use for the purpose of operating this online offering.
In doing so, we or our hosting services process the inventory data, contact details, content data, contract data, usage data, meta and communication data of clients, interested parties and visitors based on our legitimate interests for efficient and secure provision of this online offering in accordance with Article 6 (1) f GDPR in conjunction with Article 28 GDPR (completion of a processing contract).
Collection of Access Data and Log Files
On the basis of our legitimate interests within the meaning of Article 6 (1) f GDPR, we collect data about every access to the server on which this service is located (known as server log files) through our hosting services. Access data includes the name of the website retrieved, file, date and time of retrieval, amount of data transferred, notification of successful retrieval, browser type plus version, the user’s operating system, referrer URL (the previously visited page), IP address and the requesting providers.
For security reasons (e.g. to investigate acts of abuse or fraud) log file information is stored for a maximum period of 7 days and then deleted. Data that are required for further retention for evidentiary purposes are exempt from deletion pending a final resolution of the respective incident.
Google is certified under the Privacy Shield Agreement which guarantees compliance with data protection laws applicable in the European Union.
Google will use this information on our behalf to evaluate the users’ use of our online offering, to compile reports on the activities within this online offering, and to provide us with additional services connected to the use of this online offering and the internet. Pseudonymous user profiles can be created from the data that are processed.
We only use Google Analytics with IP anonymization enabled. This ensures that for users within Member States of the EU or in other contracting parties to the EEA, Google will truncate their IP addresses before transmitting them. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and truncated there.
The IP address transmitted by the users’ browser will not be merged with other Google data. Users can prevent the storage of cookies by adjusting a corresponding setting in their browser software; users can also prevent Google from collecting and processing the data created by the cookie and data related to their use of the online offering, by downloading and installing the browser plugin available under the following link.
The personal data of the users will be deleted or anonymised after 14 months.
Use of Third-party Services and Technology
Within our online offering, we engage third-party service providers to provide their technology and services, such as videos or fonts (hereinafter referred to as “content”). This is done on the basis of our legitimate interests (i.e. interest in the analysis, optimisation and economic operation of our online offering within the meaning of Art 6 (1) f GDPR).
This can only be achieved if third-party providers of this content have access to the user’s IP address as they cannot send the content to the user’s browser without the IP address. The IP address is therefore required for the display of this content. We make every effort to use content from service providers that use the IP address exclusively for the purposes of delivering the content. Third-party service providers can also use what is known as pixel tags (invisible graphics, also known as “web beacons”) for statistical or marketing purposes. The pixel tags allow information to be analysed such as visitor traffic to the pages of this website. The pseudonymised information can also be stored in cookies on the user’s end device and include, among other things, technical information about the browser and operating system, referring websites, visiting time, additional information about the use of our online offering and that can also be linked with similar information from other sources.