Privacy Policy

Overview

Batteriepasswerk is a software-as-a-service platform for issuing digital battery passports under EU Regulation 2023/1542. We only process data that is necessary to operate the website, deliver the agreed service and meet our legal obligations.

All processing takes place on servers within the European Union. Personal data is in principle not transferred to third countries; where this is unavoidable, it is explicitly disclosed in this policy.

Controller under the GDPR

For privacy-related enquiries please contact compliance@batteriepasswerk.com. An external data protection officer is not legally required; the address above reaches our compliance function directly.

Data collected when visiting the website

When you visit our website your browser automatically sends information to our EU host which is stored temporarily in a server log file:

• IP address of the requesting device (truncated after 7 days)
• Date, time and time zone of the request
• Name and URL of the requested file, HTTP status code and data volume
• Browser type, version, operating system and language
• Referrer URL, if transmitted by the browser

Legal basis is Article 6 (1) (f) GDPR. Our legitimate interest is stable operation, security against attacks and diagnosing technical faults. Log data is deleted or fully anonymised within 30 days.

Contacting us

When you contact us by e-mail, phone or via a form, we process your input (name, company, contact data, content of the enquiry) for the purpose of handling your request. Legal basis is Article 6 (1) (b) GDPR for pre-contractual enquiries, and Article 6 (1) (f) GDPR otherwise.

Your enquiry is deleted as soon as it has been fully handled and no statutory retention obligations (e.g. §§ 257 HGB, 147 AO) apply.

Registration and user account

Using the platform requires a user account. We process e-mail address, name, company, role and a hashed password. Legal basis is Article 6 (1) (b) GDPR. If you use single sign-on (e.g. Microsoft Entra), only the identifier provided by the identity provider is stored.

Payment processing

For paid plans, payments are processed by specialised EU-based payment service providers. Only the data necessary for the payment is transmitted to the respective provider. We do not store full card or bank account data. Invoice data is retained for ten years (§ 147 AO).

Hosting and EU data location

Hosting, databases, object storage and backups are operated in data centres within the European Union. We select hosting providers based on ISO 27001 certification, encryption in transit (TLS 1.2+) and encryption at rest (AES-256).

Processors

Data processing agreements pursuant to Article 28 GDPR are in place with all providers processing personal data on our behalf. A current and complete list of our processors - including purpose and location - is available on request.

Cookies and similar technologies

We use strictly necessary cookies (e.g. session ID, language preference, security tokens). These do not require consent under § 25 (2) (2) TDDDG. Analytics and marketing cookies are set only after separate consent.

Google tag and Consent Mode v2

The Google tag is present on every page using advanced consent mode. Before your decision,analytics_storage, ad_storage, ad_user_data and ad_personalization are set to “denied”. No optional Google cookies are read or written. Google may receive reduced, cookieless consent and measurement signals, including technical request data such as IP address, browser information, page URL and timestamp. Advertising identifiers are redacted. The legal basis is our legitimate interest under Art. 6 (1) (f) GDPR in data-minimised performance measurement and proving consent controls. Data may be transferred to the USA; Google LLC is certified under the EU-U.S. Data Privacy Framework.

We manage these tags through Google Tag Manager (Google Ireland Ltd.). Tag Manager itself stores no information on your device and collects no usage data; your IP address is transmitted to Google when the script loads. It passes the consent settings described above on to every tag it manages.

Google Analytics 4 (cookies with consent only)

If you explicitly consent via our banner (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG), we set analytics_storage to “granted” and use Google Analytics 4, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, for reach statistics. Analytics cookies may only be set after that point. You can withdraw consent at any time in the cookie settings; the cookies are then deleted and analytics_storage is denied again.

Google Ads Conversion Tracking (cookies with consent only)

With your separate marketing consent, we set ad_storage and ad_user_data to “granted” to use Google Ads Conversion Tracking (Google Ireland Limited) to determine whether an ad click leads to a relevant action. Remarketing, Google Signals and personalised advertising remain disabled regardless of your choice. On withdrawal, Google Ads cookies are deleted and both consent signals return to “denied”.

Detailed information about the cookies we use and how to manage your settings is available in our cookie settings.

Retention periods

Server logs

up to 30 days, IP truncated after 7 days

Contact enquiries

until fully handled, then 6 months

User account

for the duration of the contractual relationship

Invoices

10 years (§ 147 AO)

Your rights as a data subject

You have the right to:

• access (Art. 15 GDPR)
• rectification (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability in a structured format (Art. 20 GDPR)
• objection to processing (Art. 21 GDPR)
• withdrawal of consent with effect for the future (Art. 7 (3) GDPR)
• complaint to a supervisory authority (Art. 77 GDPR)

The competent supervisory authority for our location is the Berlin Commissioner for Data Protection and Freedom of Information (Friedrichstr. 219, 10969 Berlin). Please send requests to us at compliance@batteriepasswerk.com. We respond within the statutory period of one month.

Changes to this privacy policy

We update this policy when legal or factual circumstances change. The current version is always available on this page; the date of the most recent update is shown above.