Legal

Privacy Policy

As of October 2025

We (Sunzenith GmbH, “Sunzenith”, “we”) care about protecting your personal data. This policy explains what we collect when you visit our website sunzeith.com, sunzenith.de (the “Website”), use our Solar Calculator, contact us, or subscribe to our newsletter.
We process personal data in accordance with the EU General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG), and the Telecommunications-Telemedia Data Protection Act for Digital Services (TDDDG).

1. Controller

Sunzenith GmbH
Berger Straße 175
60385 Frankfurt am Main, Deutschland
<--Tel.: [123456789]!-->
E-Mail: info@sunzenith.com

2. Purposes, Data, Legal Bases

  • Website provision / security (server logs, troubleshooting) — Art. 6(1)(f) GDPR.
  • Cookies & similar technologies — consent for non-essential tools per Sec. 25(1) TDDDG + Art. 6(1)(a) GDPR; strictly necessary per Sec. 25(2) TDDDG.
  • Contact & communications / support — Art. 6(1)(b)/(f) GDPR; Art. 6(1)(a) if consented.
  • Solar Calculator & offers — Art. 6(1)(b); (f) for process optimisation.
  • On-site services (survey, installation, commissioning) — Art. 6(1)(b)/(f); (a) for optional imagery beyond necessity.
  • Newsletter / direct marketing — Art. 6(1)(a) GDPR or Sec. 7 UWG (existing customers).
  • Warranty handling & product registration (non-Sunzenith products) — recipients: manufacturers/distributors/service partners; Art. 6(1)(b)/(f); (a) if registration at your request.

3. Data Sources

  • Provided by you: contact form, Solar Calculator, newsletter signup, support.
  • Automatically collected: server logs, technical usage data, cookies/similar tech.
  • From third parties: processors (hosting, email, CRM, analytics, CDN), and where applicable manufacturers/distributors (warranty/registration).

4. Contact Forms & Communications

  • Purpose: handling requests, pre-contractual steps, quality assurance.
  • Data: name, contact details, content, timestamps/metadata, ticket ID if any.
  • Legal bases: Art. 6(1)(b) (contract/pre-contract), Art. 6(1)(f) (general communications); with consent Art. 6(1)(a).
  • Retention: until completion; longer where statutory duties apply (e.g., warranty/tax).

5. Solar Calculator

  • Purpose: calculating your solar potential and preparing an offer.
  • Data (as provided): address/location, roof type/orientation/area, electricity consumption, household size, ownership status, optionally photos (roof/meter cabinet), contact details.
  • Legal bases: Art. 6(1)(b) GDPR (pre-contractual steps); Art. 6(1)(f) GDPR (process optimization). You may object to direct marketing at any time (see Section 18).
  • Retention: until the offer process is finished and as required by law.

6. Newsletter & Direct Marketing (Double-Opt-In)

  • Signup: double opt-in; logging of signup/confirmation (time, IP/hash).
  • Content: product/service updates, promotions, events.
  • Legal bases: Art. 6(1)(a) GDPR or Sec. 7 UWG (existing customers under legal conditions).
  • Opt-out: anytime via unsubscribe link or by contacting us.
  • ESP (if used): [email service provider] as processor (Art. 28 GDPR).

7. Recipients / Processors

We use hosting, IT, communications, email, CDN, analytics and service providers (Art. 28 GDPR). A named list is available on request.

8. International Transfers

Outside the EEA only with adequacy decision or appropriate safeguards (e.g., EU Standard Contractual Clauses). For the U.S., preferably EU-US Data Privacy Framework; otherwise, SCCs plus additional measures.

9. Retention

We delete/anonymize personal data once the purpose ceases or legal duties end. Server logs typically up to 7 days; requests/support until completion and for any applicable warranty/guarantee periods; contract/project records & accounting under commercial/tax law generally 6/8/10 years (e.g., business correspondence 6 yrs; vouchers/invoices 8 yrs; books/inventories/financial statements 10 yrs). Statutory limitation periods also apply.

10. Your Rights

Access, rectification, erasure, restriction, portability, objection (Art. 21), withdrawal of consent (Art. 7(3)).
Complaint: You may lodge a complaint with a supervisory authority.
For Hessen: Hessian DPA, Gustav-Stresemann-Ring 1, 65189 Wiesbaden; +49 611 1408-0; poststelle@datenschutz.hessen.de.

11. Necessity / Automated Decisions

Some data are necessary for contracts/requests; without them we may be unable to proceed. No automated decision-making/profiling unless stated otherwise.

12. Changes to this Policy

We will update this policy when laws, our processes, or services change. The current version is always available on our Website.

13. Security & TLS

We apply state-of-the-art TOMs and TLS encryption.

14. Cookie Settings

Change/withdraw consent anytime via [Cookie settings]. Our CMP stores a pseudonymous consent ID, timestamp and preferences; recognized consent management services (Sec. 26 TDDDG) may be supported.

15. Anti-Spam & Security Services (e.g., CAPTCHA)

To prevent misuse/spam we may use reCAPTCHA/hCaptcha. Legal basis: consent (Sec. 25(1) TDDDG, Art. 6(1)(a) GDPR); if strictly necessary and server-side, Art. 6(1)(f) GDPR. Details in Cookie settings.

16. Hosting & Content Delivery Network (CDN)

  • External hosting: [host, seat].
  • CDN (if used): [provider, seat].
    Purpose/legal basis: efficient & secure delivery, load balancing, abuse prevention; Art. 6(1)(f) GDPR; where contractual, Art. 6(1)(b); for non-essential device access Sec. 25(1) TDDDG (consent).

17. Embedded Content & Third-Party Services

We may embed maps (Google Maps/OpenStreetMap), videos (YouTube/Vimeo), fonts or CDNs. Technical usage data will be transmitted to the provider. Legal basis: consent (unless technically required). International transfers per section 3. Tip: serve Google Fonts locally when possible.

18. Social Media Pages (Joint Controllership)

We operate pages (e.g., Facebook/Instagram/LinkedIn/Xing). For Page-Insights, we and the platform may be joint controllers (Art. 26 GDPR). Primary responsibility lies with the platform. You may exercise your rights with us or the platform. Platforms process data usage for their own purposes (profiling/marketing).

19. Use by Minors

Our services target users aged 16+. Minors should not submit personal data without guardian consent.

20. Applications/Recruiting

  • Purpose: hiring process/employment.
  • Legal bases: Sec. 26 BDSG, Art. 6(1)(b) GDPR; special categories Art. 9(2).
  • Retention: typically, 6 months after rejection; talent pool only with consent.
  • Recipients: HR/recruiting tools as processors.

21. Monitoring & Operations

Optional plant monitoring: device/serial numbers, measurement/event data, operating states; possibly via manufacturer portals. Legal bases: Art. 6(1)(b) GDPR (contract) or Art. 6(1)(a) (consent). Opt-out possible (function scope may reduce).

22. Quick Access

  • Open/change cookie settings: [CMP link]
  • DPO contact: [DPO email]
  • General contact/support: [contact form link]