Privacy Policy

Below you will find the information required under Articles 13 and 14 of the General Data Protection Regulation (‘GDPR’) regarding the processing of your personal data when you visit (hereinafter referred to as “you” or “your”) of our websites www.kostal-solar-electric.com, piko-solar-portal.com, kostal-solaportal.com, www.kostal-plenticore.com, shop.kostal-solar-electric.com, kostal.clickmeeting.com, repowering.kostal-solar-electric.com, plan.kostal-solar-electric.com and service.kostal-solar.electric.com (hereinafter referred to as the ‘website’) by KOSTAL Solar Electric GmbH (hereinafter referred to as ‘we’ or ‘us’).

 

A. Data controller and data protection officer

KOSTAL Solar Electric GmbH, Hanferstr. 6, 79108 Freiburg i. Br., info-solar@kostal.com, telephone: +49 761 47744-100.

Data Protection Officer for the KOSTAL Group, An der Bellmerei 10, 58513 Lüdenscheid, datenschutz@kostal.com.

 

B. Information on the processing of personal data

Below you will find information on the processing of your personal data for the purposes set out in more detail there, as well as, amongst other things, the legal basis for the processing. Where the balancing of interests is stated as the legal basis for processing, you may request further information on this balancing of interests from us using the contact details provided in Section A. 

 

I. Use of the website 

1. Informational use of the website

When you visit our website, we process the IP address of your device for technical reasons, i.e. to enable the website to be displayed at all. 

Furthermore, to protect our IT infrastructure, we process the IP address of your device, the type and version of the web browser you are using, information about your device’s operating system, information on the pages you have accessed, the previously visited page (referrer URL), as well as the date and time of the visit, and store this information in so-called log files. Without you providing this information, we cannot make the content of the website available to you.

The legal basis for this processing is the balancing of interests (Article 6(1), first sentence, point (f) of the GDPR). Our legitimate interest lies in providing the website content accessed by the user and in protecting the IT infrastructure used to operate the website, in particular to identify, rectify and document, for evidential purposes, any disruptions (e.g. DDoS attacks).

The recipient of this data is our hosting provider, Microsoft Azure, which acts as a data processor on our behalf. Another recipient is PSV NEO GmbH, which also acts as a data processor and is responsible for the development, maintenance and upkeep of the website. 

We generally store this personal data in the log files for thirty (30) days. In the event of a security-related incident (e.g. an attack), we will retain the log files for a longer period until the security-related incident has been resolved and fully investigated. 

 

2. Typo3

To provide this website, we use the Typo3 web content management system, which provides analytics functions for evaluating browsing behaviour. To this end, information generated by cookies regarding the use of this website is collected and stored in a database on a server belonging to a service provider contracted by us. The data collected is anonymised by technical measures (e.g. by deleting the last digits of the IP address), including the anonymised IP address (anonymisation is achieved by deleting the last digit).

The legal basis for the use of Typo3 is the balancing of interests under Article 6(1), first sentence, point (f) of the GDPR. Our legitimate interest is the provision of the website content accessed by the user, as well as the protection of the IT infrastructure used to provide the website.

You can prevent the installation of cookies by adjusting the settings in your browser software accordingly. This is described in Section D.II. However, we would like to point out that this may mean that you are unable to make full use of all the functions of this website.

The recipient of this data is our hosting provider, Microsoft Azure, which acts as a data processor on our behalf. 

We generally store this personal data in the log files for thirty (30) days. In the event of a security-related incident (e.g. an attack), we will also retain the log files until the security-related incident has been resolved and fully investigated.

 

3. Usercentrics

We use the Usercentrics Consent Manager to manage your consents, any withdrawals of consent and objections to the use of cookies.

Data processing in this context is carried out to manage users’ decisions regarding cookies (consent, withdrawal, opt-out) and to ensure the security of the application.

In doing so, the IP address of your device, the type and version of the web browser you are using, information about your device’s operating system, information on the pages accessed, the previously visited page (referrer URL), and the date and time of access are processed. In addition, the user’s decision regarding individual cookies or groups of cookies is stored at the time the decision is made and during the last visit.

The legal basis for the processing is the balancing of interests (Article 6(1)(f) of the GDPR). Our legitimate interest here lies in the simple and reliable management of cookies.

The recipient of the data is Usercentrics GmbH, which acts on our behalf as our data processor.

We store the data for a period of 6 months. The withdrawal of previously given consent is retained for three years (accountability). Server log data is anonymised prior to storage.

Please note that it is not possible to use the website without the transmission of personal data, such as the IP address. No automated decision-making takes place regarding consent to the use of cookies.

 

II. Use of the contact form / Handling enquiries from prospective and existing customers

If you contact us via our contact form, by telephone, at a trade fair or by any other means regarding an enquiry, we will process your contact details and the details of your enquiry for the purpose of dealing with your enquiry. This data typically includes your name, the company details of any organisation you may work for, your role within the organisation, the nature of your enquiry, address details and telephone numbers, as well as any arrangements made with you. You are not obliged to provide this data. However, without this data, we cannot deal with your enquiry properly. Fields that are mandatory for using the contact form are marked with an asterisk (*). 

If you are a prospective customer or an existing customer, the legal basis for the processing is the implementation of pre-contractual measures at your request or the performance of a contract with you (Article 6(1), first sentence, point (b) of the GDPR). In addition, the legal basis for this processing is the balancing of interests (Article 6(1), first sentence, point (f) of the GDPR). This also applies if you are acting not on your own behalf but – for example, as an employee – on behalf of a legal entity. In this case, our legitimate interest lies in processing the enquiry you have submitted. 

The recipient of this data is PSV NEO GmbH, which acts as our data processor and is commissioned with the development, maintenance and upkeep of the website. Another recipient of this data is Leopold Kostal GmbH & Co. KG, which, as our data processor, operates the customer relationship management system (CRM system) on our behalf, as well as CAS Software AG, which, as a data processor, is responsible for maintaining the CRM system.

We store this data for the duration of the processing of your enquiry and thereafter for the duration of the statutory retention periods (Section 257 of the German Commercial Code (HGB) and Section 147 of the German Fiscal Code (AO)). This is currently six (6) years for commercial correspondence and ten (10) years for supporting documents, in each case from the end of the calendar year in which the commercial correspondence was received or sent, or in which the accounting document was created. The legal basis for this extended retention is compliance with our legal obligation (Article 6(1), first sentence, point (c) of the GDPR).

 

III. Job vacancies

You will also find links to job vacancies on the website. These links lead to an external website, which is subject to its own privacy policy. You can find this here.

 

IV. Surveys and competitions

If you take part in one of our surveys, we use your data for market and opinion research. We generally analyse the data in an anonymised form for internal purposes. In the exceptional cases where surveys are not analysed anonymously, the data is collected exclusively with your consent. The GDPR does not apply to anonymous surveys, and in the exceptional cases where personal data is analysed, the legal basis is the aforementioned consent pursuant to Article 6(1), first sentence, point (a) of the GDPR. 

In the context of prize draws and promotions, such as gift campaigns, we use your data for the purpose of running the prize draw and notifying winners, or for carrying out the promotion. Where applicable, you will find detailed information in the terms and conditions for the relevant prize draw. The legal basis for processing is the prize draw contract or the contract for participation in the promotion in accordance with Article 6(1), first sentence, point (b) of the GDPR.

We store this data for the duration of the processing of your enquiry and, thereafter, where necessary, for the duration of the statutory retention periods (Section 257 of the German Commercial Code (HGB) and Section 147 of the German Fiscal Code (AO)). This currently amounts to six (6) years for commercial correspondence and ten (10) years for supporting documents, in each case from the end of the calendar year in which the commercial correspondence was received or sent, or in which the accounting document was created. The legal basis for this further retention is compliance with our legal obligation (Article 6(1), first sentence, point (c) of the GDPR).

Your personal data will not be disclosed to third parties for purposes other than those listed below. 

We will only disclose your personal data to third parties if: 

• you have given your explicit consent in accordance with Article 6(1), first sentence, point (a) of the GDPR, 
• the disclosure is necessary pursuant to Article 6(1), first sentence, point (f) of the GDPR for the establishment, exercise or defence of legal claims, and there is no reason to believe that you have an overriding legitimate interest in the non-disclosure of your data, 
• where there is a legal obligation to disclose the data in accordance with Article 6(1), first sentence, point (c) of the GDPR, or 
• this is permitted by law and necessary, in accordance with Article 6(1), first sentence, point (b) of the GDPR, for the performance of contractual relationships with you.

Some of the data processing may be carried out by our service providers. In addition to the service providers mentioned in this privacy policy, these may include, in particular, marketing agencies and consultancy firms, data centres that host our website and databases, and IT service providers that maintain our systems. Data may also be transferred within our group of companies. Where we transfer data to our service providers, they may use the data solely for the purpose of fulfilling their tasks. We have carefully selected and commissioned these service providers. They are contractually bound by our instructions, have appropriate technical and organisational measures in place to protect the rights of data subjects, and are subject to regular monitoring by us. 

Furthermore, data may be disclosed in connection with requests from public authorities, court orders and legal proceedings where this is necessary for the pursuit or enforcement of legal rights.

a) Email marketing service providers

We use the service provider Inxmail GmbH, Wentzingerstr. 17, 79106 Freiburg to carry out our email marketing. To this end, we pass on your master data (name, address, email address and, where applicable, company, target group, telephone number, website) as well as your registration details (IP address, permission, date of registration) to them. The legal basis for this is Article 6(1)(f) of the GDPR, based on our legitimate interest in the efficient implementation of product advertising and customer communication, the provision of information and working materials, lead generation and lead qualification. Further information can be found in the privacy policy of Inxmail GmbH (https://www.inxmail.de/datenschutz

b) Website marketing service providers

We use the services of the provider Marketing PSV NEO GMBH, Martinshardt 5, 57074 Siegen, to provide our website and its associated functions. To this end, it is sometimes necessary to pass on your personal details and usage data to them. The legal basis for this is Article 6(1)(f) of the GDPR, based on our legitimate interest in providing an appealing and useful website to represent our company, promote our products and provide customer information. Further information on data protection can be found in the privacy policy of PSV NEO GmbH (https://psv-neo.de/datenschutz/) (https://psv-neo.de/datenschutz/)

 

V. Registering for the webinar

KOSTAL Solar Electric GmbH operates the Online Academy at the web address https://kostal.clickmeeting.com/. The website is used to organise and run webinars on the products of KOSTAL Solar Electric GmbH. If you register for one of the webinars via this web address, we will process your contact details and other information for the purpose of running the webinar.

This data typically includes your name, the name of the company you may work for, your role within the company, the title of the webinar, address details and telephone numbers, as well as any arrangements made with you. You are not obliged to provide this data. However, without this data, we cannot guarantee your participation in the webinar. Fields that are mandatory for using the contact form are marked with an asterisk (*).

The recipient of this data is Clickmeeting, which acts as our data processor and is responsible for the development, maintenance and support of the website. The recipients of this data are Leopold Kostal GmbH & Co. KG, which, as our data processor, operates the customer relationship management system (CRM system) on our behalf, and CAS Software AG, which, as a data processor, is commissioned to maintain the CRM system.

We store this data for the purpose of organising the webinar and thereafter for the duration of the statutory retention periods (Section 257 of the German Commercial Code (HGB) and Section 147 of the German Fiscal Code (AO)). This currently amounts to six (6) years for commercial correspondence and ten (10) years for supporting documents, in each case from the end of the calendar year in which the commercial correspondence was received or sent, or in which the accounting document was created. The legal basis for this extended retention is compliance with our legal obligation (Article 6(1), first sentence, point (c) of the GDPR).

 

VI. Analysis of behaviour on the website using

1. Analysis of website behaviour using Google Analytics

If you have given your consent to this, we use the web analytics technology ‘Google Analytics’ to record and analyse usage behaviour on our website by means of cookies (see Section D). Google Analytics is a service provided by Google LLC (‘Google’), which is based in the USA. The personal data collected using this cookie includes your IP address, as well as information about the sub-pages you have visited, the duration of your visit, the website from which you accessed our website, and the page you visit after leaving our website. There is no obligation to provide this data. If you do not provide this data, we will be unable to measure our website audience. 

The processing serves to optimise the website by analysing your usage behaviour on our site. For example, based on the frequency with which sub-pages are accessed, we can identify which content is of particular interest to visitors to our site and which content, for instance, might need to be positioned differently in order to attract visitors’ attention.

It is technically necessary for your full IP address to be transmitted to Google. However, we have implemented what is known as IP anonymisation. This means that your address is truncated immediately after being transmitted to Google, our data processor, and is not stored by Google. It is therefore no longer possible to trace the data back to the user of the device. In the event that personal data is transferred to the USA, we have entered into standard contractual clauses with Google.

On the basis of this truncated IP address and the information contained in the cookies, Google compiles the aforementioned analysis of usage behaviour on our website on our behalf. As a general rule, it is not possible for us to identify you as an individual from these usage profiles. We do not know which pseudonym has been assigned to you. Consequently, we are generally unable to identify, on the basis of the Google Analytics usage profiles, which specific actions you have carried out on the website. 

The legal basis for this processing – including the setting and reading of cookies – is your separate consent (Article 6(1), first sentence, point (a) of the GDPR). You can withdraw this consent by deleting the cookies. This is described in Section D.II. 

The data described in this Section B.VI. may be transferred to Google in the USA; in this case, we have entered into standard contractual clauses with Google. Under EU data protection law, the USA is not considered a safe third country. Please note that US companies are obliged to disclose personal data to security authorities, and you, as the data subject, would have no legal recourse against this.

We have no influence over this processing activity, and it cannot be ruled out that US authorities (e.g. intelligence services) may process, analyse and permanently store your data held on US servers for surveillance purposes. 

Further information on this can be found in the Google Analytics privacy policy: https://support.google.com/analytics/answer/6004245?hl=de.

We store the usage profiles for twenty-six (26) months.

 

2. Google Analytics 4

Provided you have given your consent, the website uses the web analytics service Google Analytics 4, which is provided to users in Europe, the Middle East and Africa (EMEA) by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and for all other users by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (‘Google’). We integrate Google Analytics 4 via Google Tag Manager. If you have not consented to the use of these analytics tools, your data will not be collected via Google Analytics 4.

Google Analytics 4 uses JavaScript and pixels to read information from your device, as well as cookies to store information on your device. This is used to analyse your usage behaviour and to improve our website. The access data is aggregated by Google on our behalf into pseudonymous usage profiles and transferred to a Google server in the USA. We will process the information obtained to evaluate your use of the website and to compile reports on website activity.

As part of this analysis, Google Analytics 4 also uses artificial intelligence, such as machine learning, to automatically analyse and enrich the data. For example, Google Analytics 4 models conversions where there is insufficient data available to optimise the analysis and reports. You can find further information on this in the relevant Google documentation. Data analysis is carried out automatically using artificial intelligence or on the basis of specific, individually defined criteria. You can find more information on this in the relevant Google documentation.

The data collected as part of the usage analysis by Google Analytics 4 is enriched with data from Google Search Console and linked to data from Google Ads, in particular to measure the success of our advertising campaigns (so-called ‘conversions’).

Data processed: Google Analytics 4 may process the following data:

• IP address;
• User ID and device ID;
• Referrer URL (previously visited page);
• pages visited (date, time, URL, title, duration of visit);
• files downloaded;
• links clicked to other websites;
• Achievement of specific goals (conversions);
• technical information (operating system; browser type, version and language; device type, make, model and resolution);
• approximate location (country, region and, where applicable, city, based on an anonymised IP address).

Privacy settings: We have configured the following privacy settings in Google Analytics 4:

• IP address anonymisation;
• advertising functionality disabled;
• personalised advertising disabled;
• remarketing disabled;
• Retention period of 2 months (and no reset of the retention period upon new activity);
• Cross-device and cross-site tracking disabled (Google Signals);
• data sharing disabled (in particular Google products and services, benchmarking, technical support, Account Specialist).

We have entered into a data processing agreement with Google Ireland Limited for the use of Google Analytics 4. In the event that personal data is transferred from Google Ireland Limited to the USA, Google Ireland Limited and Google LLC have entered into standard contractual clauses (Implementing Decision (EU) 2021/914, Module 3) in accordance with Article 46(2)(c) of the GDPR. In addition, we also obtain your explicit consent for the transfer of your data to third countries in accordance with Article 49(1)(a) of the GDPR.

Further information on Google Analytics 4 can be found in Google’s privacy policy and in the Google Analytics privacy notice. Further information on the cookies used by Google Analytics 4 can also be found in Google’s documentation.

 

3. Google DoubleClick (Floodlight)

This website uses Google DoubleClick cookies (Floodlight). DoubleClick is a service provided to users in the European Economic Area and Switzerland by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and to all other users by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (collectively ‘Google’). Cookies are small text files stored in a user’s browser. These are used to analyse the use of this website. The data collected is analysed solely for statistical purposes and in anonymised form. In the process, a pseudonymous identification number (ID) is assigned to your browser. DoubleClick cookies do not contain any personal data. As a general rule, it is not possible for us to draw any conclusions about you as an individual from these usage profiles. We do not know which pseudonym has been assigned to you. Consequently, we are generally unable to identify, on the basis of Google DoubleClick’s usage profiles, which specific actions you have carried out on the website.

The legal basis for this processing – including the setting and reading of cookies – is your separate consent (Article 6(1)(a) of the GDPR). You may withdraw this consent by deleting the cookies. This is described in Section D.II. 

You can prevent the use of DoubleClick cookies by downloading and installing the browser plug-in available via the following link under the heading ‘DoubleClick Opt-out Extension’. Alternatively, you can disable DoubleClick cookies on the Digital Advertising website via the following link (http://optout.aboutads.info/?c=2&lang=EN).

The data described in this section B.VI. may be transferred to Google in the USA; in this event, we have entered into standard contractual clauses with Google. Under EU data protection law, the USA is not considered a safe third country. Please note that US companies are obliged to disclose personal data to security authorities, and you, as the data subject, would not be able to take legal action against this. Further information on this can be found in Google’s Privacy Policy: https://policies.google.com/?hl=de.

 

4. Google Ads Conversion Tracking and Ads Remarketing (formerly AdWords)

This website uses the ‘Google Ads’ service, which is provided to users in the European Economic Area and Switzerland by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and to all other users by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (collectively ‘Google’).

With Google Ads, customer actions defined by us (such as clicking on an advert, page views and downloads) are recorded and analysed using ‘Google Ads Conversion Tracking’. We use ‘Google Ads Remarketing’ to display personalised advertising messages for our products on Google’s partner websites.

The adverts are delivered by Google via so-called ‘ad servers’. To this end, we use ad server cookies, which enable us to measure certain performance metrics, such as the display of adverts or clicks by users. If you access our website via a Google advert, Google Ads will store a cookie on your device. 

These cookies usually expire after 30 days and are not intended to identify you personally. The analysis data associated with this cookie usually includes the unique cookie ID, the number of ad impressions per placement (frequency), the last impression (relevant for post-view conversions) and opt-out information (indicating that the user no longer wishes to be targeted). 

The cookies enable Google to recognise your web browser. If a user visits specific pages on an Ads client’s website and the cookie stored on their computer has not yet expired, Google and the client can recognise that the user clicked on the advert and was redirected to that page. Each Ads client is assigned a different cookie. Cookies cannot therefore be tracked across the websites of Ads clients. 

We do not collect any personal data in this context and, like Google, we only receive statistical reports which enable us to identify which advertising measures are effective. We do not receive any further data; in particular, we are unable to identify the user. 

It is technically necessary for your browser to automatically establish a direct connection with Google’s server. We have no influence over the scope or further use of the data collected by Google through the use of this tool. 

To the best of our knowledge, through the integration of Ads Conversion, Google receives the information that you have accessed the relevant section of our website or clicked on one of our adverts. If you are registered with a Google service, Google may associate the visit with your account. Even if you are not registered with Google or have not logged in, it is possible that the provider may obtain and store your IP address.

The legal basis for this processing – including the setting and reading of cookies – is your separate consent (Article 6(1), first sentence, point (a) of the GDPR). You can prevent participation in this tracking process in various ways: a) by adjusting the settings in your browser software; in particular, blocking third-party cookies means that you will not receive adverts from third-party providers; b) by installing the plug-in provided by Google via the following link: https://www.google.com/settings/ads/plugin; c) by disabling interest-based adverts from providers participating in the ‘About Ads’ self-regulatory campaign via the link http://www.aboutads.info/choices, although this setting will be reset; d) by permanently disabling this feature in your Firefox, Internet Explorer or Google Chrome browsers via the link http://www.google.com/settings/ads/plugin, e) by adjusting your cookie settings accordingly. You can withdraw any consent you have given by deleting the cookies. This is described in Section D.II

The data described in this Section B.VI. may be transferred to Google in the USA; in this case, we have entered into standard contractual clauses with Google. Under EU data protection law, the USA is not considered a safe third country. Please note that US companies are obliged to disclose personal data to security authorities without you, as the data subject, being able to take legal action against this.

We have no influence over this processing activity, and it cannot be ruled out that US authorities (e.g. intelligence services) may process your data stored on US servers for surveillance purposes.

Further information on this can be found in Google’s Privacy Policy: https://policies.google.com/privacy.

 

5. Meta Pixel (formerly Facebook Pixel)

This website uses the ‘Meta Pixel’ service provided by the social network Facebook, which is operated by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, for users outside the US and Canada, and by Meta Platforms Inc., 1601 Willow Road, Menlo Park, California 94025, USA (collectively ‘Facebook’). 

We use Meta Pixel to place and manage targeted adverts for our products and services on the Meta social media platforms Facebook and Instagram, and to measure how successful these adverts are (‘conversion tracking’). 

Meta Custom Audience also enables audience remarketing. It cannot be ruled out that the data generated in this context may be transferred by Meta Platforms to a server in the USA for analysis and stored there. 

To this end, Meta Platforms processes data collected by the service via JavaScript, cookies and other technologies on our website. This includes, in particular: 

• HTTP header information, such as details about the browser used (e.g. user agent, language); 
• Information on events such as ‘page views’, other object properties, and buttons clicked by website visitors;
• Online identifiers such as IP addresses and, where provided, Facebook Business-related identifiers or device IDs (such as advertising IDs for mobile operating systems), as well as information on the status of the deactivation/restriction of ad tracking, as well as information about the web browser used, the page’s location, the files accessed, and the referral link indicating which page you came from to reach ours.

Using the JavaScript code, cookies can then be stored on your device and various pieces of information can be read from your device and from the cookies stored there. This enables us to recognise website visitors and the devices they use on a pseudonymous basis. Further information on the cookies set can be found in Section D.

The legal basis for this data processing is consent to be given separately by you in accordance with Article 6(1)(a) of the GDPR. Your consent is voluntary and may be freely withdrawn at any time with effect for the future. 

Access to and storage of information on the device is then carried out on the basis of the implementing legislation of the ePrivacy Directive in the EU Member States; in Germany, this is in accordance with Section 25(1) of the TTDSG. The transfer of your data to the USA and other third countries takes place on the basis of your explicit consent in accordance with Article 49(1)(a) of the GDPR.

The data collected in this context may be transferred by Meta to a server in the USA for analysis and stored there. In the event that personal data is transferred to the USA, we have entered into standard contractual clauses

We have no influence over this processing activity and it cannot be ruled out that US authorities (e.g. intelligence services) may process your data stored on US servers for surveillance purposes.

If you have your own user account on Meta Platforms (Facebook or Instagram) and have authorised Meta Platforms to do so via your account’s privacy settings, Facebook or Instagram may also link the information collected during your visit to our site to your user account and use it for targeted advertising. You can view and change the privacy settings for your Facebook profile at any time: m.facebook.com/privacy/touch/basic/.

You can prevent data collected outside of Instagram from being linked to the display of personalised adverts on Instagram via the following link: https://de-de.facebook.com/help/instagram/2885653514995517?locale=de_DE.

Unless you consent to the use of Meta Pixel, Meta Platforms will only display general adverts that are not selected on the basis of information collected about you on this website.

Further information on this, in particular regarding joint responsibility and contact details, can be found in Meta Platforms’ privacy policy, specifically relating to the social networks Facebook and Instagram: https://www.facebook.com/about/privacy/.

 

6. LinkedIn Pixel (Insight Tag)

This website uses the LinkedIn Insight Tag. The provider of this service is LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland.

The LinkedIn Insight Tag enables us to obtain information about visitors to our website. If a website visitor is registered with LinkedIn, we can, amongst other things, analyse key professional data (e.g. career level, company size, country, location, sector and job title) relating to our website visitors, thereby enabling us to better tailor our site to the respective target groups. Furthermore, with the help of LinkedIn Insight Tags, we can measure whether visitors to our website make a purchase or take any other action (conversion tracking). Conversion tracking can also be carried out across devices (e.g. from a PC to a tablet). LinkedIn Insight Tag also offers a retargeting function, which enables us to display targeted adverts to our website visitors outside the website; according to LinkedIn, this does not involve the identification of the person receiving the advert.

LinkedIn itself also collects so-called log files (URL, referrer URL, IP address, device and browser properties, and time of access). IP addresses are truncated or (if used to reach LinkedIn members across devices) hashed (pseudonymised). LinkedIn members’ direct identifiers are deleted by LinkedIn after seven days. The remaining pseudonymised data is then deleted within 180 days.

As the website operator, we are unable to link the data collected by LinkedIn to specific individuals. LinkedIn will store the personal data collected from website visitors on its servers in the USA and use it for its own advertising purposes. For further details, please refer to LinkedIn’s privacy policy at www.linkedin.com/legal/privacy-policy.

The use of the LinkedIn plugin is based on your consent in accordance with Article 6(1)(a) of the GDPR; this consent may be withdrawn at any time. Access to and storage of information on the end device is based on the implementing legislation of the ePrivacy Directive in EU Member States; in Germany, this is in accordance with Section 25(1) of the TTDSG. The transfer of your data to the USA and other third countries is based on your explicit consent in accordance with Article 49(1)(a) of the GDPR.

Data transfers to the USA are based on the EU Commission’s Standard Contractual Clauses. Further details can be found here: https://www.linkedin.com/legal/l/dpa and https://www.linkedin.com/legal/l/eu-sccs.

You can object to the analysis of your usage behaviour and targeted advertising by LinkedIn via the following link: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.

Furthermore, LinkedIn members can control the use of their personal data for advertising purposes in their account settings. To prevent LinkedIn from linking data collected on our website to your LinkedIn account, you must log out of your LinkedIn account before visiting our website.

We have entered into a data processing agreement (DPA) with the aforementioned provider. This is a contract required under data protection law, which ensures that the provider processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR.

 

VII. Subscription to the email newsletter

If you subscribe to our newsletter, we will process your name, email address, your selected customer group, company name, street address, house number, postcode, town or city and the country you are from for the purpose of sending you the newsletter. The legal basis for this processing is the double opt-in consent you have given (Article 6(1)(a) of the GDPR). You are not obliged to provide this data. Without this data, we will be unable to include you in future newsletter mailings.

Upon receipt of your newsletter subscription, the recipient of this personal data is our service provider, Inxmail GmbH, which acts as our data processor. The data is stored by Leopold Kostal GmbH & Co. KG.

The legal basis for this processing is the balancing of interests. The legitimate interest we pursue in this context is our interest in optimising our newsletter (Article 6(1), first sentence, point (f) of the GDPR). 

 

VIII. Use of the email newsletter

If you have subscribed to our newsletter, we process your name and your email address for the purpose of sending you the newsletter. The legal basis for this processing is the consent you have given (Article 6(1), first sentence, point (a) of the GDPR). You are not obliged to provide this data. However, without this data, we cannot send you the newsletter. 

The recipient of this personal data is our service provider, Inxmail GmbH, which acts as a data processor commissioned to send out the newsletter. 

We will store this data until you withdraw your consent or otherwise unsubscribe from the newsletter, and in order to safeguard our legitimate interest in providing evidence of the original granting of consent and compliance with your withdrawal, based on the balancing of interests (Article 6(1), first sentence, point (f) of the GDPR) for a period of 3 years from receipt of your withdrawal. 

In addition, we record the newsletter open rate in order to better understand our subscribers’ interest in the newsletter and to optimise it, and we store this data in aggregated form. The legal basis for this processing is the balancing of interests. The legitimate interest we pursue in this context is our interest in optimising our newsletter (Article 6(1), first sentence, point (f) of the GDPR). 

 

IX. Use of the shop functions

In our online shop at shop.kostal-solar-electric.com, we offer you two options for completing your purchase: creating a customer account or placing an order as a guest. With both options, we store the data required for order and payment processing (mandatory fields are marked with an *), such as your name, address, email address, company name, telephone number, VAT number, billing and delivery addresses, as well as payment details. We also store the user’s IP address and the date and time of the visit. If you have consented to the use of Google Maps, your address will be automatically completed via the link to Google Maps. 

The European Commission’s VIES database is integrated via an API. This enables the electronic validation of VAT numbers of economic operators registered in the European Union for cross-border transactions involving goods or services. You can find the privacy policy here: https://ec.europa.eu/info/privacy-policy_de. If you choose to create a customer account, you will have the advantage of being able to view your order history and manage your personal details. Furthermore, your details, including your login details, will be stored for future orders. 

If you choose to place an order as a guest, you will need to re-enter your payment and online shop details with every order. 

The recipient of this personal data is our service provider, KonVis Visionäre Konzepte GbR, which acts as a data processor and provides hosting services for the online shop. The data is stored by Leopold Kostal GmbH & Co. KG.

For the purpose of processing the order, the data will be passed on to Volksbank and Raiffeisenkassen as payment service providers, to PayPal, and, in the case of payment by credit card, also to the credit card companies, each acting as a separate data controller.

If an inverter is registered in the shop in order to obtain an extended warranty period for certain products, we will store the serial number, performance class, commissioning date, installed capacity, street, house number, postcode, town and country in the customer account created previously. We also store the date and time of registration.

We collect this data to process your enquiries regarding the conclusion of a contract and to fulfil the contract (Article 6(1)(b) of the GDPR). The data will be stored until you withdraw your consent and thereby deactivate your customer account, and to safeguard our legitimate interest in proving that consent was originally given and that your withdrawal has been taken into account, based on a balancing of interests (Article 6(1), first sentence, point (f) of the GDPR) for a period of 3 years from receipt of your withdrawal. Furthermore, the contractual data (invoicing and payment details) will be retained for 10 years after the conclusion of the contract in accordance with the applicable statutory retention obligations (Section 147 of the German Fiscal Code (AO), Section 257 of the German Commercial Code (HGB)) (Article 6(1)(c) of the GDPR). 

 

X. KOSTAL Solar Portal (https://www.kostal-solar-portal.com)

1) Google Fonts

The KOSTAL Solar Portal website (https://www.kostal-solar-portal.com) uses the Google Fonts service, provided you have given your consent. For users from the European Economic Area and Switzerland, this service is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and for all other users by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (collectively ‘Google’).

When you visit the website, your browser downloads the necessary fonts so that text can be displayed correctly and in accordance with the specified web design. To enable the download, your browser must establish a connection to Google’s servers. It cannot be ruled out that the Google server to which the connection is established is located in the USA. Google thereby receives the information that our website has been accessed via your IP address. According to Google, such accesses are processed separately from other Google services that require user authentication. No merging with other data takes place. No cookies are stored.

Google Fonts is used to ensure a consistent presentation of our online presence and to guarantee the intended web design through the maintenance-free and efficient use of fonts, whilst also taking into account any licence restrictions regarding their local integration. . It cannot be ruled out that the Google server to which the connection is established is located in the USA.

The legal basis for this processing is your consent in accordance with Article 6(1)(a) of the GDPR. Access to and storage of information on the end device then takes place in accordance with Section 25(1) of the TTDSG. The transfer of your data to the USA and other third countries is based on your explicit consent in accordance with Article 49(1)(a) of the GDPR. 

Further information on the use of Google Fonts can be found in Google’s FAQs (https://developers.google.com/fonts/faq) and in Google’s privacy policy: https://policies.google.com/privacy. 

 

2) Registration on the KOSTAL Solar Portal (https://www.kostal-solar-portal.com)

By registering on the KOSTAL Solar Portal (https://www.kostal-solar-portal.com), you can ensure convenient, reliable and free monitoring of your PV system and your inverter’s performance data worldwide. To ensure the results are transmitted satisfactorily via the portal, you must provide your registration details (surname, first name, email address, country, language, company name, KOSTAL customer number) as well as your inverter details (item no., serial number) and information about the system (name, owner, description, location, postcode, time zone, installation, feed-in tariff, electricity procurement costs, data transmission, events, yields, consumption and voltages). The legal basis for the processing is the consent you have given (Article 6(1)(a) of the GDPR). There is no obligation to provide the data; however, if you do not, you will not be able to use the portal. 

If you provide the data in order to use the remote support service, the data will be stored for the purpose of carrying out pre-contractual measures (Article 6(1)(b) of the GDPR). The recipient of the data will then be a third party authorised by you (e.g. an installer) acting as a separate data controller.

Furthermore, provided you give your consent, we will store your email address for the purpose of carrying out marketing activities; the legal basis here is also the consent you have given (Art. 6(1)(a) GDPR). 

We store the company information and, where necessary, verify the details you have provided. The legal basis here is also the consent you have given (Article 6(1)(a) of the GDPR).

The data is stored until you withdraw your consent and thereby deactivate your registration, and to safeguard our legitimate interest in providing evidence of the original granting of consent and of compliance with your withdrawal, based on the balancing of interests (Article 6(1), first sentence, (f) of the GDPR) for a period of 3 years from receipt of your withdrawal. Data relating to inverters, log data and the system are retained in anonymised form for a period of 10 years.

In addition, we store the user’s IP address and the date and time of access. The legitimate interest we pursue in doing so is our interest in optimising our web portal (Article 6(1), first sentence, point (f) of the GDPR). This data is stored for a maximum of 2 weeks after login to enable us to resolve any security-related incidents in the server log files. 

To calculate the projected system yields, the Solar Portal also uses the API of the weather service ‘AccuWeather’. For this purpose, the city, country and postcode of the system, if provided, are transmitted to the service. Accuweather returns the weather data available for the location, on the basis of which the estimated system yields are calculated. 

We use a weather API to provide our users with up-to-date weather information. When using the weather API, the system’s location data is transmitted to Accuweather. 

The legal basis for this processing is the overriding interest in enabling the user to access the service they have requested for monitoring, controlling and optimising their system (Article 6(1)(f) of the GDPR).

 The recipient of this personal data is our service provider, adesso SE, which acts as a data processor and provides hosting services for the KOSTAL Solar Portal. The data is stored by Leopold Kostal GmbH & Co. KG and in Microsoft Azure, both of which act as data processors on our behalf.

 

XI. Customer Bonus Scheme

If we have promised to grant you a bonus upon achieving certain turnover figures, we process your contact details, agreements regarding bonuses and information about the transactions you have carried out with us and the turnover generated thereby, in order to verify whether the targets have been met and to grant the bonus. The legal basis for the processing is the performance of the contract with you (Article 6(1), first sentence, point (b) of the GDPR). If we have concluded the bonus agreement not with you but with a company you represent, the legal basis for the processing of your personal data in this context is the balancing of interests (Article 6(1), first sentence, point (f) of the GDPR). The legitimate interest we pursue in this regard is the fulfilment of the bonus agreement with the company. The provision of this data is necessary for the conclusion and implementation of the bonus agreement; without this data, we cannot verify the achievement of targets and eligibility for the bonus. 

The recipient of the sales information is Leopold Kostal GmbH & Co. KG, which, as a joint controller with us, operates the KOSTAL Group’s Enterprise Resource Planning (ERP) system. The legal basis for this transfer is the balancing of interests. Our legitimate interest lies in the use of a central ERP system of the KOSTAL Group to efficiently manage our internal processes (Article 6(1), first sentence, point (f) of the GDPR). Leopold Kostal GmbH & Co. KG is responsible for the security and operation of the ERP system. Furthermore, both we and Leopold Kostal GmbH & Co. KG are responsible for ensuring compliance with the data subjects’ rights set out in Section C. You may exercise these rights both against Leopold Kostal GmbH & Co. KG and against us at the address specified in Section A.

We store this data until the bonus agreement has been fulfilled and thereafter for the duration of the applicable statutory retention periods (Section 257 of the German Commercial Code (HGB) and Section 147 of the German Fiscal Code (AO)). This is currently 6 years for commercial correspondence and 10 years for supporting documents, in each case from the end of the calendar year in which the commercial correspondence was received or sent, or in which the accounting document was created. The legal basis for this continued retention is compliance with our legal obligation (Article 6(1), first sentence, point (c) of the GDPR).

 

XII. Registration for the use of the PARAKO software

The use of our PARAKO software or passwords for the direct configuration of inverters requires a special password. By requiring a password, we ensure that the software is used only by registered electrical engineering firms and that the technical safety of the inverters is thus guaranteed during their installation and operation. If you wish to use our access facilities, you must therefore first register with us so that we can verify whether you are using them on behalf of a specialist electrical engineering firm. To this end, we collect your company name, address, telephone number, email address, your position within the company, name, as well as the place, date and signature via the form provided. The provision of this data is necessary to complete the registration. 

The legal basis for this processing is the performance of a contract (Article 6(1), first sentence, point (b) of the GDPR). In addition, the legal basis for the processing is the balancing of interests (Article 6(1), first sentence, point (f) of the GDPR). This also applies if you are acting not on your own behalf but – for example, as an employee – on behalf of the company registering. The legitimate interest lies, on the one hand, in our own interest and that of the users of our inverters in ensuring the safety of the inverters during installation and operation, and, on the other hand, in our interest in having a direct point of contact for enquiries with the installer of our inverters.

We store this data for the duration of the verification of a registration and thereafter for the duration of the applicable statutory retention periods (Section 257 of the German Commercial Code (HGB)). For commercial correspondence, this is currently six years, in each case from the end of the calendar year in which the correspondence was received or sent. The legal basis for this further retention is compliance with our legal obligation (Article 6(1), first sentence, point (c) of the GDPR).

 

XIII. Handover and commissioning of KOSTAL inverter system components

If, as an installer, you hand over KOSTAL inverter system components to your end customers and commission them at their premises, you must provide the end customer with a completed handover report and supply us with a copy of this report. In addition to your details in the checklist contained therein regarding the commissioning measures carried out, these handover reports also contain your contact details and those of the end customer at whose premises the installation is taking place. You are not obliged to provide this data. However, without this data, we cannot verify that the necessary commissioning measures have been carried out and recommend you as an installer.

The legal basis for this processing is the balancing of interests (Article 6(1), first sentence, point (f) of the GDPR). Our legitimate interest lies in documenting any irregularities during commissioning so that, if necessary, we can determine the cause of any system malfunctions, and to improve our cooperation with you in connection with the installation.

We store this data for the duration of the systems’ warranty period. This is usually two years from the date of purchase. If you purchase an extended warranty, the retention period will be extended by at least the duration of the extended warranty. 

 

XIV. Warranty processing and registration for the service platform

If you contact us regarding a fault or defect in one of our products – for example, to make a warranty claim or to obtain assistance with troubleshooting – we will process your details regarding the product, the troubleshooting steps you have taken, and your contact details(company name, name, address, email, telephone/fax number, mobile number). You may generally contact us for these purposes by email, telephone, post, fax or via a form on our website.

You are not obliged to provide this data. However, without this data, we cannot assess your warranty claim or assist you with troubleshooting. To register in the service area, you must provide the relevant login details. 

We process this data for the purposes of handling your warranty claim or assisting you with troubleshooting.

The legal basis for this processing, in the case of warranty claims, is the performance of a contract (Article 6(1), first sentence, point (b) of the GDPR). This is also the legal basis for the processing of login details for the website. If we have not concluded the contract for the device subject to the complaint with you, but with a company you represent, the legal basis is the balancing of interests (Article 6(1), first sentence, point (f) of the GDPR). The processing is then carried out to safeguard that company’s interest in the handling of warranty claims, as well as to safeguard our interest in fulfilling our contractual warranty obligations. 

The recipient of the data is Leopold Kostal GmbH & Co. KG, which, as a joint controller with us, operates the OTRS ticketing system and the KOSTAL Group’s ERP system. The legal basis for this transfer is the balancing of interests. Our legitimate interest lies in the use of a central ERP system of the KOSTAL Group for the efficient handling of our internal processes (Article 6(1), first sentence, point (f) of the GDPR). Leopold Kostal GmbH & Co. KG is responsible for the security and operation of the ERP system. Furthermore, both we and Leopold Kostal GmbH & Co. KG are responsible for ensuring compliance with the data subjects’ rights set out in Section C. You may exercise these rights by contacting either Leopold Kostal GmbH & Co. KG or us at the address given in Section A. If the device you have complained about needs to be replaced, we will also pass on your contact details and information about your device to KOSTAL Industrie Elektrik GmbH, which is commissioned to dispatch a replacement device, and, if necessary, to an installer if repair or installation work is required at your premises.

We store this personal data for the duration of the warranty or support case and thereafter for the duration of the applicable statutory retention periods (Section 257 of the German Commercial Code (HGB) and Section 147 of the German Fiscal Code (AO)). This currently amounts to 6 years for commercial correspondence and 10 years for supporting documents, in each case from the end of the calendar year in which the commercial correspondence was received or sent, or in which the accounting document was created. The legal basis for this continued retention is compliance with our legal obligation (Article 6(1), first sentence, point (c) of the GDPR). 

 

XV. Inclusion in the list of certified installation companies / specialist partners

If you wish to register with us as a certified installation company / specialist partner, we will process your contact details for the purpose of carrying out the registration and publish your contact details in the list of certified installation companies / specialist partners on our website. The provision of this data is a prerequisite for certification. 

The legal basis for this processing is the consent you have given (Article 6(1), first sentence, point (a) of the GDPR).

As we publish the contact details provided on a webpage we have created for this purpose, they are accessible to anyone with internet access. The data may therefore also be viewed by individuals in countries outside the European Economic Area with data protection standards that differ from those in Europe. 

We store this personal data until you withdraw your consent, but for no longer than the duration of your participation in the programme for certified installation companies / specialist partners and, where applicable, the subsequent period required by statutory retention obligations (Section 257 of the German Commercial Code (HGB)). This is currently six years for commercial correspondence, in each case from the end of the calendar year in which the correspondence was received or sent. The legal basis for this further retention is compliance with our legal obligation (Article 6(1), first sentence, point (c) of the GDPR). Online presence on social media

 

XVI. Presence on social media

We maintain an online presence on social media platforms. We use these platforms to inform our customers and prospective clients about our products and services, and also to communicate with users on these platforms. As a rule, users’ data is used by the social media platforms for market research and advertising purposes. Please note that user data may also be transferred outside the EEA in this context. We have no influence over this processing activity. This data is normally stored using cookies. On the basis of these user profiles, advertisements are then displayed, for example, within the social media platforms as well as on third-party websites.

As part of the operation of our online platforms, we may have access to information, such as statistics on the use of our online platforms, provided by the social media platforms. These statistics are aggregated and may include, in particular, demographic information and data on interaction with our online platforms and the posts and content shared via them. Please refer to the list below for details and links to the data from the social networks to which we, as operators of the online platforms, have access.

The legal basis for the processing is the balancing of interests (Article 6(1), first sentence, point (f) of the GDPR). The legitimate interest lies in effective communication with users and the analysis of user behaviour. In addition, the legal basis is Article 6(1), first sentence, point (b) of the GDPR, as we maintain contact with our customers via these platforms and, where applicable, carry out pre-contractual measures with prospective customers.

For the legal basis of data processing carried out by the social networks on their own responsibility, please refer to the privacy policy of the respective social network. Information regarding stored data and the exercise of user rights can be obtained or asserted directly with the service provider. The links below also provide further information on the respective data processing activities and the options for objecting.

• Instagram (Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland): Privacy Policy: https://help.instagram.com/519522125107875; 
• Google/YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland): Privacy Policy: https://policies.google.com/privacy; Opt-out: https://www.google.com/settings/ads;
• LinkedIn (LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland): Operation of the LinkedIn company page under joint responsibility based on an agreement on the joint processing of personal data (the so-called Page Insights Joint Controller Addendum): legal.linkedin.com/pages-joint-controller-addendum; Information on the Page Insights data processed and on how to contact us in the event of data protection enquiries: legal.linkedin.com/pages-joint-controller-addendum; Privacy policy: https://www.linkedin.com/legal/privacy-policy; Opt-out: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out;
• Facebook (Agreement on joint responsibility for the processing of personal data (https://de-de.facebook.com/legal/technology_terms)

Opt-out (https://www.facebook.com/ads/preferences/?entry_product=ad_settings_screen)

 

XVII. KOSTAL Solar Plan

The KOSTAL Solar Plan software (https://plan.kostal-solar-electric.com) is accessed via an SSO-protected interface. If you wish to use the software, you must register via the KOSTAL Solar Terminal. To this end, we collect your company name, address, telephone number, email address, your position within the company, name, as well as the place and date of registration using the form provided. The provision of this data is necessary to complete the registration. The legal basis for this processing is the performance of a contract (Article 6(1), first sentence, point (b) of the GDPR). We process the data in order to enable you to use the KOSTAL Solar Plan software. We store this data for the duration of the registration verification process and thereafter for the duration of the applicable statutory retention periods (Section 257 of the German Commercial Code (HGB)). For commercial correspondence, this is currently 6 years, in each case from the end of the calendar year in which the correspondence was received or sent. The legal basis for this further retention is compliance with our legal obligation (Article 6(1), first sentence, point (c) of the GDPR). 

 

XVIII. KOSTAL Solar Repower Check

With the KOSTAL Solar Repower Check (https://repowering.kostal-solar-electric.com), KOSTAL offers the option to select an existing inverter from a database and receive a recommendation and alternative for a KOSTAL inverter. 

If desired, further information can be requested via a contact form, for which your surname, first name and email address are collected for the purpose of contacting you. Further information on data processing when using the contact form can be found above under section B II.