Privacy.

This policy describes which personal data is processed when you visit group-ecc.com and when you send us an enquiry through our contact forms. Applications and personal invitation links have their own notices, which we refer to further below. Processing is based on the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and the German Telecommunications Digital Services Data Protection Act (TDDDG).

This website is hosted by Vercel Inc. (USA). When you visit it, Vercel records technically necessary data: IP address, date and time, the address requested, status code and browser identifier. Our application runs in the Frankfurt region; static content is served by Vercel from the nearest data centre of its global network.

When you submit a form, we also store your IP address in our own database as the key of a rate limiter that prevents mass submissions. An entry is valid for at most one hour and is deleted automatically no later than one hour after it expires. We do not use it for any other purpose.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is stable operation protected against abuse.

Retention period: Vercel deletes the logs automatically after 30 days at the latest.

So that we can fix technical errors quickly, we use Sentry from Functional Software, Inc. (USA; data is stored in the EU, Frankfurt). If an error occurs, your browser transmits the error message, the affected page, technical details about the browser, language and time zone, and the last steps before the error, such as page changes and clicked elements. On our server we additionally record loading times for about one in ten requests. We do not send IP addresses, form contents or access keys contained in addresses. Sentry deletes the data after 90 days at the latest.

Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in a website that works without errors. Access to your browser is strictly necessary for this and therefore permitted without consent (Section 25(2) no. 2 TDDDG).

On the contact page we embed a Google Maps map using a two-click solution. At first only a placeholder is shown; there is no connection to Google. Only when you click “Load map” does your browser load the map from Google. Data, including your IP address, is then transmitted to Google, and Google may set cookies.

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google processes the data under its own responsibility and may transfer it to Google LLC in the USA, which is certified under the EU-US Data Privacy Framework.

Legal basis: Your consent given by clicking “Load map” (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). It applies to the respective page view.

Our forms are protected against automated submissions by Cloudflare Turnstile. When a form is opened, your browser loads a script from challenges.cloudflare.com; your IP address and technical characteristics of your browser are transmitted to Cloudflare and analysed there to tell humans from machines. As a rule, you do not have to solve a puzzle.

Provider: Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Cloudflare processes the data on our behalf to protect our forms and, in addition, under its own responsibility to improve its bot detection. Turnstile does not set cookies. We do not store the result of the check.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in protecting our forms and mailboxes against mass abuse. Access to your browser is strictly necessary to protect the form (Section 25(2) no. 2 TDDDG).

When you write to us using the “General enquiry” or “Project enquiry” forms, we process your details (name, company, email, phone, location, description) to answer your enquiry, to prepare an offer for a project enquiry, and to document the further business relationship. Your enquiry reaches us by email, and you receive a confirmation of receipt. AI services help us handle it, for example in pre-sorting and summarising. Decisions are always made by people.

Legal basis: Art. 6(1)(b) GDPR for answering and preparing an offer. For documentation in our systems and AI-assisted handling, Art. 6(1)(f) GDPR: our legitimate interest in handling enquiries reliably and promptly and in keeping business relationships traceable.

Recipients: our service providers for hosting, database, email and AI-assisted handling, listed in the section “Service providers and third countries”.

Retention period: Once the matter is closed and no order has resulted from it, we delete your enquiry 36 months after receipt. If an order results, we keep it as a business record until the statutory retention periods have expired, usually six to ten years. We keep your contact details in our customer directory for as long as a business relationship exists or is being established, or until you object.

Required information: For a general enquiry we need your name, email address and message; for a project enquiry also your company, service area, industry and a description of the project. Without these details we cannot process the enquiry. All other details are voluntary. There is no legal or contractual obligation to provide us with data.

Requesting a demonstration: On the “Software” page you can request a demonstration of ecc OS. For this we process your name, company, email address, optionally your plant or project, and three preferred dates in order to arrange an appointment with you (Art. 6(1)(b) GDPR). Your request reaches us by email and you receive an acknowledgement. If we confirm a date, we create it as an online meeting in our Microsoft 365 calendar; you receive the invitation from Microsoft at the address you provided. We delete the request itself from our system 60 days after receipt; the appointment remains in our calendar.

If you have received a personal invitation from us to maintain a profile with us, separate privacy information applies. We link to it in the invitation; it is permanently available at group-ecc.com/network/datenschutz (in German), even if your link has expired.

If you sign a contract via a link we send you, we process, in addition to the contract data, your signature, the time of signing, your IP address and your browser identifier. These details prove who signed and when. We send you the signed version by email.

Legal basis: Art. 6(1)(b) GDPR (performance of the contract) and Art. 6(1)(f) GDPR for the evidence data: our legitimate interest in being able to prove a declaration made electronically. Retention period: for the duration of the contractual relationship and then until the statutory retention periods have expired, usually six to ten years.

We do not make automated individual decisions within the meaning of Art. 22 GDPR; enquiries are always decided on by people. We check form submissions for spam automatically and do not store submissions that are obviously automated.

We protect your data with technical and organisational measures under Art. 32 GDPR: connections and stored data are encrypted, and only authorised persons can access internal systems after signing in. We keep backup copies of our database for at most six months; until then, deleted data may still be contained in them.