I. Name and address of the controller
The protection of your personal data is of particular concern to us. In the following, we will inform you about what data is collected when you use our website, for what purposes it is used and how we guarantee the protection of your data. Personal data is data that relates to an identified or identifiable person. We process your data exclusively on the basis of the statutory provisions (GDPR, BSDG) and only insofar as this is permitted by law or you have consented to the processing.
The controller within the meaning of the GDPR is the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. In our case, this is:
Sunfire AG
Gasanstaltstraße 2
01237 Dresden
Tel.: +49 351 896797-0
E-Mail: info@sunfire.de
Website: www.sunfire.de
II. Name and address of the data protection officer
If you have any questions about data protection or data security, please contact our data protection officer, Dr. Niels Hilgenstock:
by e-mail at datenschutzbeauftragter@sunfire.de or
by post at Sunfire AG, Data Protection Officer: Dr. Niels Hilgenstock, Gasanstaltstraße 2, 01237 Dresden.
III. General Information on Data Processing
1. Security of Your Data
We take appropriate technical and organizational security measures to protect your personal data against accidental or intentional manipulation, loss, destruction, or unauthorized access. These measures are intended to ensure the confidentiality and integrity of your data as well as the availability and resilience of systems and services during the processing of your data over time. Our security measures include, among others, firewalls, encryption, access control systems, and regular security updates. All information that you enter online is technically encrypted and transmitted only afterward. As a result, this information cannot be viewed by unauthorized third parties at any time. Our data processing and security measures are continuously improved in line with technological developments. Our employees are contractually bound to confidentiality and to comply with the requirements of the GDPR.
2. Scope of Processing Personal Data
We process personal data of our users only to the extent necessary to provide a functional website as well as our content and services. The processing of personal data of our users takes place only with the user’s consent unless consent is not possible for factual reasons or is not required for legal reasons, e.g., in the case of a legitimate interest under Art. 6 para. 1 lit. f GDPR.
3. Legal Basis for Processing Personal Data
a) Where we obtain consent from the data subject for processing operations involving personal data, Art. 6 para. 1 lit. a GDPR serves as the legal basis.
b) In the case of processing operations that are necessary for the performance of a contract to which the data subject is a party, Art. 6 para. 1 lit. b GDPR serves as the legal basis. This also applies to processing operations necessary to carry out pre-contractual measures.
c) Where processing of personal data is necessary to fulfill a legal obligation to which our company is subject, Art. 6 para. 1 lit. c GDPR serves as the legal basis.
d) In cases where the processing is necessary to protect the vital interests of the data subject or another natural person, Art. 6 para. 1 lit. d GDPR serves as the legal basis.
e) Where processing is necessary to safeguard a legitimate interest of our company or a third party and the interests, fundamental rights, and freedoms of the data subject do not override this interest, Art. 6 para. 1 lit. f GDPR serves as the legal basis for the processing.
4. Data Deletion and Storage Duration
The personal data of the data subject will be deleted or blocked as soon as the purpose of processing ceases. Storage may continue beyond this if provided for by European or national legislators in EU regulations, laws, or other provisions to which the data controller is subject. Blocking or deletion of the data also takes place when a storage period prescribed by the mentioned standards expires, unless further storage of the data is required for the conclusion or fulfillment of a contract. The specified storage periods can be extended accordingly if, in individual cases, a longer legal or contractual retention period applies, especially when the data is processed for multiple purposes.
5. What Are Mandatory Fields?
If certain data fields are marked as mandatory fields and/or with an asterisk (*), the provision of this data is either legally or contractually required, or we need this data for the conclusion of a contract, the desired service, or the stated purpose. The decision to provide the data is, of course, at your discretion, even in the case of mandatory fields. Failure to provide such data may mean that we are unable to fulfill a contract or provide the desired service or achieve the stated purpose.
IV. Individual Areas, Services, and Functionalities of the Website
1. Contact Form and Email Contact
a) Description and Scope of Data Processing If you have any questions or requests, we are happy to assist you. To facilitate communication between you and us, a contact form is available on our website that can be used for electronic communication. If a user takes advantage of this option, the data entered in the input mask will be transmitted to us and stored.
This data includes:
At the time the message is sent, technical information is also stored to prevent misuse and ensure the security of our IT systems. This concerns the following data:
The specification of address and telecommunication data marked as mandatory in our contact/notification forms is required to process and respond to your inquiry. The voluntary provision of further data makes it easier for us to process your inquiry.
During the submission process, your consent to the processing of the data will be obtained, and reference will be made to this data protection declaration.
Alternatively, it is possible to contact us via the email address(es) provided. In this case, the user’s personal data transmitted with the email will be stored.
Your data will be used exclusively for processing the conversation. There is no unauthorized transfer of data to third parties.
Storage Duration:
The data from your inquiry will be stored after responding to the inquiry in case of further questions, provided they are not commercial or business letters, which we store for at least six or ten years.
b) Legal Basis for Data Processing The legal basis for processing the data is the user’s consent in accordance with Art. 6 para. 1 lit. a GDPR. The legal basis for processing the data transmitted in the course of sending an email is Art. 6 para. 1 lit. f GDPR. If the email contact aims at the conclusion of a contract, the additional legal basis for processing is Art. 6 para. 1 lit. b GDPR.
c) Purpose of Data Processing The processing of personal data from the input mask is solely for processing the contact request. In the case of contact via email, this also constitutes the required legitimate interest in processing the data. The other personal data processed during the submission process serves to prevent misuse of the contact form and ensure the security of our IT systems.
d) Duration of Storage The data will be deleted as soon as they are no longer necessary for achieving the purpose for which they were collected, or if a user requests deletion. For personal data from the input mask of the contact form and those sent by email, this is the case when the respective conversation with the user has ended. The conversation is considered ended when the circumstances indicate that the relevant matter has been conclusively clarified. The personal data collected during the submission process will be deleted at the latest after a period of fourteen days. In the context of commercial and business letters, the statutory retention periods are observed.
e) Right to Objection and Elimination The user has the option to revoke their consent to process personal data at any time. If the user contacts us via email, they can object to the storage of their personal data at any time. In such a case, the conversation cannot be continued. Details on revocation and objection can be found in Section VII.
2. Salesforce Integration a) Description and Scope of Data Processing We use the CRM system Salesforce to manage inquiries efficiently and optimize our customer communication. If you contact us via our contact form or other forms, your data will be transmitted to Salesforce via an API and processed there in accordance with European data protection standards.
In the course of this transmission, the following data categories can be collected and processed:
In addition, specific information about application cases related to hydrogen and electrolysis projects can be collected, such as:
The data processing is carried out for processing your inquiry and maintaining customer relationships. The legal basis for this is Art. 6 para. 1 lit. b GDPR (contract fulfillment or pre-contractual measures) as well as our legitimate interest in accordance with Art. 6 para. 1 lit. f GDPR to enable efficient and structured customer communication.
c) Storage Duration Your data will only be stored in Salesforce as long as necessary and for a maximum of 24 months, unless you have agreed to a longer storage period, or legal retention periods require longer storage. After this period, the data will be deleted unless further communication takes place.
d) Right to Objection and Elimination You have the right to object to the processing of your data and request deletion at any time. Please contact the contact points provided in this data protection declaration. We will ensure that your data is deleted both in our system and in Salesforce, unless legal retention periods apply.
3. Application Procedure and Applicant Management System
a) Description and Scope of Data Processing
As part of the application process, we process the personal data you have provided to assess your suitability for the position (or possibly other open positions in our company) and to carry out the application process, e.g., first name, last name, name suffixes, nationality, contact details such as private address, (mobile) phone number, email address. This may also include special categories of personal data, such as health data, if this is necessary to fulfill legal requirements. Your personal data is generally collected directly from you. In addition, we may have received data from third parties (e.g., recruitment agencies).
b) Processing by the Applicant Management System (Softgarden)
We use the applicant management system Softgarden, which is integrated into our applicant portal via an API. Your application data is transmitted to Softgarden via this API and processed there in accordance with European data protection standards. Softgarden supports us in managing and processing your applications. Data processing by Softgarden takes place based on a data processing agreement in accordance with Art. 28 GDPR, which includes, in particular, compliance with strict technical and organizational security measures.
c) Purpose and Legal Basis of Data Processing
The processing of your data is primarily for the purpose of establishing a possible employment relationship with you (Art. 6 para. 1 lit. b GDPR in conjunction with § 26 para. 1 BDSG). In cases where we process special categories of personal data (e.g., health data), this is done to exercise our rights or fulfill legal obligations under labor law (Art. 9 para. 2 lit. b GDPR in conjunction with § 26 para. 3 BDSG). Where we have obtained consent from you (e.g., for inclusion in our applicant pool), processing is based on Art. 6 para. 1 lit. a GDPR. In addition, we may process your data on the basis of Art. 6 para. 1 lit. f GDPR, provided this is necessary to protect legitimate interests (e.g., to defend against legal claims).
d) Recipients of the Data
Your application data will be reviewed by the HR department after your application has been received and only forwarded to those employees involved in the application process. In addition, we use various service providers, such as IT providers, who have access within the scope of maintenance work. We have concluded data processing agreements with these service providers, which include appropriate technical and organizational data security measures. If necessary, we may also transfer your data to external recipients, e.g., authorities or insurance carriers, if this is required to fulfill legal obligations.
c) Duration of Storage
Your application data will be stored after the application process is completed as follows:
d) Right to Objection and Elimination If you wish for your data to be deleted, you can inform us at any time. We will ensure that your data is deleted both in our system and in Softgarden unless legal retention periods prevent this. An objection may mean that the application process cannot be continued.
V. Provision of the Website and Creation of Logfiles
a) Description and Scope of Data
Processing Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing computer. The following data is collected:
b) Legal Basis for Data Processing The legal basis for the temporary storage of data and log files is Art. 6 para. 1 lit. f GDPR.
c) Purpose of Data Processing The temporary storage of the IP address by the system is necessary to enable the delivery of the website to the user’s computer. For this purpose, the user’s IP address must be stored for the duration of the session. Storage in log files is carried out to ensure the functionality of the website. In addition, the data serves us to optimize the website and ensure the security of our IT systems. An evaluation of the data for marketing purposes does not take place in this context. These purposes also constitute our legitimate interest in data processing under Art. 6 para. 1 lit. f GDPR.
d) Duration of Storage
The data will be deleted as soon as they are no longer necessary for achieving the purpose for which they were collected. In the case of data collection for the provision of the website, this is the case when the respective session ends. In the case of storage of data in log files, this is the case after a maximum of fourteen days. Further storage is possible. In this case, the users’ IP addresses are deleted or anonymized so that it is no longer possible to assign the calling client.
e) Right to Objection and Elimination
The collection of data for the provision of the website and the storage of data in log files is absolutely necessary for the operation of the website. There is therefore no possibility of objection on the part of the user.
VI. Use of Cookies a) Description and Scope of Data Processing We use cookies to make our website more user-friendly. Some elements of our internet page require that the calling browser can be identified even after a page change. The following data is stored and transmitted in the cookies:
The user data collected in this way is pseudonymized by technical measures. Therefore, it is no longer possible to assign the data to the calling user. The data is not stored together with other personal data of the users. When accessing our website, users are informed about the use of cookies for analysis purposes via an info banner and referred to this privacy policy. In this context, there is also a reference to how the storage of cookies can be prevented in the browser settings.
b) Legal Basis for Data Processing The legal basis for processing personal data using cookies is Art. 6 para. 1 lit. f GDPR.
c) Purpose of Data Processing The purpose of using technically necessary cookies is to simplify the use of our website for users. Some functions of our internet page cannot be offered without the use of cookies. For these, it is necessary that the browser is recognized even after a page change. We need cookies for the following applications:
The user data collected by technically necessary cookies is not used to create user profiles. These purposes also constitute our legitimate interest in processing personal data under Art. 6 para. 1 lit. f GDPR.
d) Duration of Storage, Right to Objection, and Elimination Cookies are stored on the user’s computer and transmitted to our site by the user. Therefore, you as a user also have full control over the use of cookies. By changing the settings in your internet browser, you can deactivate or restrict the transmission of cookies. Cookies that have already been stored can be deleted at any time. This can also be done automatically. If cookies are deactivated for our website, it may no longer be possible to use all functions of the website in full.
You can generally reject cookies via the settings of your web browser. You can set your web browser to notify you when cookies are set or to generally reject or restrict the setting of cookies. If you deactivate or restrict cookies using your web browser, various functions on our website may no longer be available to you. You can also delete cookies stored by your web browser at any time, even automatically. You can find information about these possibilities for the most commonly used browsers via the following links:
Explorer: https://support.microsoft.com/de-de/help/17442/windows-internet-explorer-delete-manage-cookies Firefox: http://support.mozilla.org/de/kb/cookies-informationen-websites-auf-ihrem-computer Google Chrome: http://support.google.com/chrome/bin/answer.py?hl=de&answer=95647 Safari: https://support.apple.com/kb/PH21411?locale=de_DE Opera: http://help.opera.com/Linux/12.10/de/cookies.html
If you have not made or do not make any deviating settings, cookies that enable and ensure the required technical functions will remain on your device until the browser is closed, while other cookies may remain on your device for a longer period.
VII. Google Analytics (Web Tracking) a) Description and Scope of Data Processing This website uses Google Analytics, a web analytics service provided by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”). Google Analytics uses cookies that are stored on your computer and enable an analysis of your use of the website. The information generated by the cookies about your use of this website is usually transmitted to a Google server in the USA and stored there. By activating IP anonymization on our website, your IP address will, however, be shortened by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area and thus anonymized, meaning that personal data will be deleted immediately. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and shortened there. Google has submitted to the EU Privacy Shield (certificate retrievable at: https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI). The EU Privacy Shield can be used as a basis for the transfer of personal data from Europe to such U.S. companies that are certified under the Privacy Shield, following a decision by the EU Commission. On our behalf, Google will use this information to evaluate your use of the website, to compile reports on website activities, and to provide us with other services related to website and internet use.
b) Legal Basis and Purpose of Data Processing
The use of Google Analytics is carried out with legitimate interest in accordance with Art. 6 para. 1 lit. f GDPR. The purpose of processing personal data is to compile statistics on the origin of visitors, their duration of stay on individual pages, and the use of search engines. The creation of these statistics serves to better monitor the success of the website and to tailor advertising measures accordingly, which are essential for refinancing the website. To market this website, a statistical evaluation that ensures comparability with other market participants is essential. Our legitimate interest arises from the economic usability of the insights gained from the statistics and the market value of our website, even in direct comparison with third-party websites, which can be determined based on the statistics.
c) Duration of Storage
The data collected is stored permanently.
d) Right to Objection and Elimination
You can prevent the collection of the data generated by the cookie and related to your use of the website (including your shortened IP address) and the processing of this data by Google by downloading and installing the browser plugin available at the following link: http://tools.google.com/dlpage/gaoptout?hl=de. You can also prevent the collection of your data by Google Analytics by clicking on the following link. In this case, an opt-out cookie will be set, which prevents the collection of your data on future visits to this website: Deactivate Google Analytics.
VIII. Third-Party Plug-Ins/Widgets (Social Media) 1. Embedding YouTube Videos YouTube videos are embedded on our website, which are stored on YouTube (responsible party is Google Inc., Amphitheatre Parkway, Mountain View, CA 94043, USA) but can be played directly on our website. To protect your privacy, you must first activate the videos on our pages. If you activate or play the videos, cookies may be stored or read on your device by YouTube or DoubleClick, and data may be transmitted to YouTube or DoubleClick (USA, Google), such as your IP address and cookie ID, the specific address of the page called up on our website, system date and time of the call, your browser identification. For information on the purpose and scope of data collection and processing by YouTube or DoubleClick, please refer to the information provided by Google: https://www.google.de/intl/de/policies/privacy/. If you do not want YouTube or DoubleClick to collect data about you through the use of our website, do not activate the videos. Data transmission takes place after the video is activated, regardless of whether you have a user account with YouTube or Google through which you are logged in or whether there is no user account for you. If you are logged in, this data can be directly assigned to your account. If you want to avoid this, you must log out before activating the video.
2. Links to Other Websites
This privacy policy applies only to Sunfire’s online offerings and not to third-party websites and applications. Sunfire online offerings may contain links to websites and applications of third parties that may be of interest to you. Sunfire is not responsible for the collection, processing, and use of your data in connection with websites or applications not operated by Sunfire, nor for their content.
3. Sending Newsletters via Newsletter2Go
If you wish to receive the newsletter offered on the website, we need your email address and information that allows us to verify that you are the owner of the specified email address and agree to receive the newsletter. To ensure consent-based newsletter distribution, we use the so-called double opt-in procedure. In the course of this process, the potential recipient is included in a distribution list. Subsequently, the user receives a confirmation email to confirm the registration in a legally secure manner. Only if the confirmation takes place will the address be actively included in the distribution list. We use this data exclusively for sending the requested information and offers. Newsletter2Go is used as newsletter software. Your data is transmitted to the Newsletter2Go GmbH in this context. Newsletter2Go is prohibited from selling your data and using it for purposes other than sending newsletters. Newsletter2Go is a German, certified provider selected based on the requirements of the GDPR and the Federal Data Protection Act. Further information can be found here: https://www.newsletter2go.de/informationen-newsletter-empfaenger/ You can revoke your consent to the storage of data, the email address, as well as its use for sending the newsletter at any time, for example, via the “unsubscribe” link in the newsletter.
IX. Information on Processing Your Personal Data (Customer/Prospective Customer)
a) Description and Scope of Data Processing
The categories of personal data processed include first name, last name, name suffixes, position, department, business address, (mobile) phone number, business website, and email address. Your personal data is generally collected directly from you in the context of contract initiation. Within our company, only the persons and departments who need your personal data to fulfill contractual and legal obligations or who are entrusted with fulfilling purpose-bound tasks will receive your data. We also use different service providers to fulfill our contractual and legal obligations and purpose-bound tasks. These can include:
Are you obliged to provide your data? In the context of contract processing, you must provide the personal data necessary for establishing and carrying out the contractual relationship and fulfilling the associated contractual obligations or that we are legally obliged to collect. Without this data, we will not be able to carry out the contract with you.
b) Legal Basis and Purpose of Data Processing Primarily, data processing serves to initiate or carry out contracts. The primary legal basis for this is Art. 6 para. 1 lit. b GDPR. In addition, our legitimate interests under Art. 6 para. 1 lit. f GDPR, as well as your separate consents in accordance with Artt. 6 para. 1 lit. a, 7 GDPR, may be used as legal permission provisions. This includes, in particular, marketing measures. Should we wish to process your personal data for a purpose not mentioned above, we will inform you beforehand.
c) Duration of Storage
We delete your personal data as soon as it is no longer required for the aforementioned purposes. After the contractual relationship has ended, your personal data will be stored as long as we are legally obliged to do so. This results regularly from legal proof and retention obligations regulated, among other things, in the German Commercial Code and the Tax Code. The storage periods amount to up to ten years. In addition, it may happen that personal data is kept for the time during which claims can be asserted against us (legal limitation period of three or up to thirty years).
d) Right of Objection
You have the right to object to the processing of your personal data for direct marketing purposes without giving reasons. If we process your data to protect legitimate interests, you can object to this processing for reasons arising from your particular situation. We will then no longer process your personal data unless we can demonstrate compelling legitimate reasons for the processing that outweigh your interests, rights, and freedoms, or the processing serves to assert, exercise, or defend legal claims.
X. Information on Processing Your Personal Data (Applicants)
a) Description and Scope of Data Processing
b) Purpose and Legal Basis of Data Processing
The processing of data primarily serves to establish an employment relationship. The primary legal basis for this is Art. 6 para. 1 b) GDPR in conjunction with § 26 para. 1 BDSG. In addition, your separate consents in accordance with Art. 6 para. 1 a), 7 GDPR may be used as a legal permission provision. If necessary, we also process your data based on Art. 6 para. 1 f) GDPR to protect legitimate interests of us or third parties (e.g., authorities). Our legitimate interest lies, in particular, in asserting or defending claims. Insofar as special categories of personal data are processed in accordance with Art. 9 para. 1 GDPR, this is done within the application process to exercise rights or fulfill legal obligations under labor law, social security law, and social protection (e.g., recording disabilities for additional leave and determining the disability levy). This is based on Art. 9 para. 2 b) GDPR in conjunction with § 26 para. 3 BDSG. In addition, processing health data may be required to assess your ability to work in accordance with Art. 9 para. 2 h) GDPR in conjunction with § 22 para. 1 BDSG. In addition, the processing of special categories of personal data may be based on consent under Art. 9 para. 2 a) GDPR in conjunction with § 26 para. 2 BDSG. Should we wish to process your personal data for a purpose not mentioned above, we will inform you beforehand.
c) Duration of Storage
We delete your personal data as soon as it is no longer required for the aforementioned purposes. In the case of a rejection, your personal data will be stored for the time in which claims can be asserted against us (maximum 6 months). If you have consented to the further storage of your personal data, we will include your data in our applicant pool. There, the data will be deleted after two years unless further communication with you has taken place. Should you have been offered a position as part of the application process, the data from the applicant data system will be transferred to our personnel information system.
d) Right of Objection and Elimination
You have the right to object to the processing of your personal data without giving reasons. If we process your data to protect legitimate interests, you can object to this processing for reasons arising from your particular situation. We will then no longer process your personal data unless we can demonstrate compelling legitimate reasons for the processing that outweigh your interests, rights, and freedoms, or the processing serves to assert, exercise, or defend legal claims.
XI. Your Rights as a Data Subject 1.
Right to Information If you have any questions about the processing of your personal data by us, we will, of course, be happy to provide you with information about the data concerning you.
2. Right to Rectification, Erasure, Right to Restrict Processing, and Right to Data Portability
You also have the right to rectification, erasure, restriction of processing, and objection to processing under the legal requirements. You have the right to receive the personal data concerning you, which you have provided to the controller, in a structured, commonly used, and machine-readable format under the legal requirements.
3. Your Contact Person
Please contact our Data Protection Officer in all these cases (see Section II. above) using the communication addresses provided there.
4. Right to Complain to a Competent Data Protection Supervisory Authority Finally, you have the right to complain to a competent data protection supervisory authority. Saxon Data Protection and Transparency Officer Address:
Devrientstraße 5 01067 Dresden Postal address: PO Box 11 01 32 01330 Dresden Phone: 0351/85471–101 Fax: 0351/85471–109 Email: saechsdsb@slt.sachsen.de Website: http://www.datenschutz.sachsen.de
5. Right to Object
You have the right to object at any time, for reasons arising from your particular situation, to the processing of your personal data carried out based on Art. 6 para. 1 lit. e or f GDPR, including profiling based on these provisions. The controller will no longer process your personal data unless they can demonstrate compelling legitimate reasons for the processing that outweigh your interests, rights, and freedoms, or the processing serves to assert, exercise, or defend legal claims. If your personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for such marketing; this also applies to profiling, insofar as it is related to such direct marketing. If you object to processing for direct marketing purposes, your personal data will no longer be processed for these purposes. You have the option of exercising your right to object in connection with the use of information society services – notwithstanding Directive 2002/58/EC – by means of automated procedures using technical specifications.
6. Right to Withdraw Data Protection Consent Declaration
You have the right to revoke your data protection consent declaration at any time. The revocation of consent does not affect the lawfulness of processing based on consent before its withdrawal.
7. Advertising Blacklist
After your objection to the processing of your personal data for advertising purposes or the withdrawal of your consent, we are required under data protection regulations to record the data required for this purpose (name, address, email address) in our internal advertising blacklist and to store it permanently – for this purpose only – and to use it to match it against our future advertising files. This ensures that your objection to advertising or the withdrawal of your consent is permanently observed.
8. Automated Decision-Making in Individual Cases, Including Profiling
You have the right not to be subject to a decision based solely on automated processing – including profiling – that produces legal effects concerning you or similarly significantly affects you.
9. Changes to the Purposes of Processing
Should we change the purposes of processing over time, we will inform you in advance through an update to this privacy notice.
10. Changes to the Privacy Notice
From time to time, it may be necessary to adjust the content of this privacy notice for data collected in the future. We, therefore, reserve the right to change this notice at any time. We will also publish the amended version of the privacy notice in this place. When you visit us again, you should read the privacy notice again.
