`
Last revised: August 2026
ENERCON Global GmbH (‘ENERCON’) thanks you for visiting our website at www.enercon.de (‘website’) and for your interest in our company and our products.
The purpose of this Privacy Statement is to inform you about how we handle your personal data. It applies to the processing of personal data for the purposes of communication through this website and outside the context of this website.
I. Controller and Data Protection Officer
II. Definitions
III. Data processing when visiting the website
IV. Other data processing operations
V. Data processing operations in the context of services and other business operations
VI. Presences in social networks
VII. Rights as data subject
VIII. Data security
IX. Obligations to provide data
X. Automated decision-making
XI. Information about your right to object
XII. Amendments to and updates of this Privacy Statement
I. Controller; Data Protection Officer
Controller pursuant to the General Data Protection Regulation is:
Contact details:
ENERCON Global GmbH
Dreekamp 5
26605 Aurich
Germany
E-mail: info@enercon.de
Represented by the Management:
Uwe Eberhardt
Heiko Juritz
You can contact our Data Protection Officer by post at:
Data Protection Officer
ENERCON Global GmbH
Dreekamp 5
26605 Aurich
Germany
Alternatively, you can contact our Data Protection Officer by e-mail at:
datenschutz@enercon.de
II. Definitions
The following is an overview of the terms used in this Privacy Statement. Many of the terms have been taken from the applicable laws and are defined in particular in Article 4 of the General Data Protection Regulation (GDPR). The statutory definitions are binding. The explanations below, however, are intended to contribute to a better understanding.
• Cookies: 'Cookies' are small text files that the web browser stores on the computer (either in the browser folder or the Program Data folder). These text files automatically store certain information about your computer or your internet connection such as the IP address, the browser used, the operating system or similar, which are used again for future connections to the corresponding applications.
• Recipient: ‘Recipient’ means any legal or natural person to whom personal data processed by the Controller is transmitted and who thus gains access to this data.
• Personal data: ‘Personal data’ means any information relating to an identified or identifiable natural person (hereinafter referred to as ‘data subject’); any natural person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (e.g. cookie), or to one or more factors specific to said natural person’s physical, physiological, genetic, mental, economic, cultural or social identity is deemed to be identifiable.
• Controller: ‘Controller’ means any natural or legal person, public authority, agency or any other body which – alone or jointly with others – decides on the purposes and means of processing of personal data.
• Processing: ‘Processing’ means any operation or set of operations performed on personal data, whether or not by automated means. This is a broad term and covers virtually any handling of data such as collection, analysis, storage, transmission or erasure.
III. Data processing when visiting the website
1) Cookies
We use cookies and comparable technologies on our website. Some of these technologies are required technically to provide the website and to ensure its security as well as essential functions. Other technologies are intended to help us analyse usage behaviour or optimise our website.
The first time you visit our website, our consent management tool (Cookiebot) will inform you about the use of cookies and comparable technologies and you can consent to or decline their use. You can change or revoke your settings at any time with effect for the future.
Depending on the function, the following categories of cookies and technologies are used:
• Necessary cookies: These are required to operate the website and provide essential functions.
• Preference cookies: These save your selected settings and improve user-friendliness.
• Statistical/analysis cookies: These help us to understand how visitors use our website in order for us to continuously improve its content and functions.
• Marketing cookies (if used): These are used to deliver content or campaigns and measure their success.
Insofar as technically necessary cookies are used, processing is carried out on the basis of our legitimate interest as per Art. 6(1)(f) GDPR as well as Art. 25(2)(2) of the German Telecommunications Digital Services Data Protection Act (TDDDG). In the case of all cookies or comparable technologies which are not necessary, processing is carried out purely on the basis of your consent as per Art. 6(1)(a) GDPR as well as Art. 25(1) TDDDG.
You can also configure your browser so that cookies are blocked or cookies which have already been set are deleted. Please note that this may restrict individual website functions.
You can adjust or withdraw the consents you have given via Cookiebot at any time by clicking the icon displayed at the bottom of your browser.
Further information on the specific cookies used, providers, storage periods, and legal bases can be found in the cookie settings of our consent management tool.
2) Hosting – Webflow The service provider is Webflow, Inc., 398 11th Street, 2nd Floor, San Francisco, CA 94103, USA (hereinafter Webflow). When you visit our website, Webflow collects various log files including your IP addresses.
Webflow is a tool for creating and hosting websites. Webflow stores cookies or other recognition technologies which are required for displaying pages, providing certain website functionalities and ensuring security (necessary cookies).
For details, please refer to Webflow's privacy statement.
The use of Webflow is based on GDPR Article 6(1)(f). We have a legitimate interest in displaying our website in the most reliable manner. If consent has been requested, processing is performed solely on the basis of Article 6(1)(a) GDPR and Article 25(1) TDDDG, insofar as the consent covers the storage of cookies or access to information on the user's device (e.g. device fingerprinting) pursuant to the TDDDG. This consent can be withdrawn at any time.
We have concluded a processing agreement with the above-mentioned service provider. This contract is mandatory under data protection law; it ensures that the personal data of the visitors to our website are processed only in accordance with our instructions and in compliance with the GDPR.
If personal data is transmitted to third countries as a result of the use of Webflow, this is carried out on the basis of an adequacy decision from the European Commission or other suitable safeguards as per Article 44 et seq. GDPR (transmission of personal data to third countries), in particular Standard Contractual Clauses adopted by the European Commission. Webflow is certified according to the EU-U.S. Data Privacy Framework.
Further information on the processing of personal data by Webflow can be found in the Webflow privacy statement as well as in the information for users from the European Union. Further information on transmission to third countries can be found in Section V.5, ‘Transmission to third countries outside the EU’.
3) Making the website technically available using a server log file
If you just visit our website without actively contacting us, we process only the personal data transmitted automatically by your browser. Our web servers record every access in a temporary log file for a period of seven days.
The following information is collected: IP address of your client; website from which access takes place; date and time of access; name and URL of the file accessed; pages visited; data volume transmitted; message as to whether access was successful; playback of video/audio files; clicks on individual links; search terms or phrases; detection of browser and operating system used and name of your internet access provider.
This information is processed for the purpose of presenting our website optimally and securely from a technical point of view. There is no analysis of personal data.
The legal basis for this processing is our legitimate interest in the secure, stable and technically flawless operation of our website as per Article 6(1)(f) GDPR. There are no overriding interests, rights or freedoms of the data subject to object to this processing.
4) Usage analysis with Matomo Analytics
We use Matomo Analytics (formerly Piwik), an analytics service for statistical evaluation of the usage of our website. We use cookies to store information about how you use our website and what browser/operating system you use. This includes your IP address. The IP address is instantly anonymised during the process so that you remain anonymous to us as a user.
We use Matomo only with your express prior consent in accordance with Article 6(1)(a) GDPR, which you can give using the cookie banner when accessing our website for the first time. Once given, you can revoke your consent at any time with effect for the future by proceeding as follows: https://enercon.matomo.cloud/index.php?module=CoreAdminHome&action=optOut&language=en
Please note: If you delete all your cookies, the opt-out cookie will also be deleted. This means that you will have to give your consent again and also opt out from the processing for analysis purposes again.
Within the context of using Matomo for collecting and processing your usage data, we transmit your truncated IP address to New Zealand. Data transmission takes place on the basis of an existing adequacy decision of the European Commission regarding the adequacy of the data protection level in New Zealand.
The cookies used as part of this process are stored for a period of 30 days. However, you have the option to delete cookies manually at any time.
5) Friendly Captcha (bot/spam protection)
Our website uses the 'Friendly Captcha' service from Friendly Captcha GmbH, Am Anger 3-5, 82237 Wörthsee, Germany. Friendly Captcha is a privacy-friendly protection solution that makes it harder for automated programs and scripts (known as 'bots') to use our website.
For this purpose, we have integrated a Friendly Captcha program code into our website, enabling the visitor's device to establish a connection to the Friendly Captcha servers in order to receive a Friendly Captcha challenge. The visitor's device responds to the challenge, which uses certain system resources, and sends the computed result to our web server. Our web server contacts the Friendly Captcha server via an interface, and in return receives the information whether the device sent the correct response to the challenge. Depending on the result, we can attach security rules to requests coming in from our website and then accept or reject them accordingly.
This data is used exclusively for protection against spam and bots as described above. Friendly Captcha does not place or retrieve any cookies on the visitor's device. IP addresses are stored only in ‘hashed’ format (one-way encryption) and do not permit us or Friendly Captcha to make any inferences about individuals. If personal data is stored, it is deleted within 30 days.
For details, please refer to Friendly Captcha's privacy statement.
The legal basis for processing this data is our legitimate interest in accordance with Article 6(1)(f) GDPR in protecting our website from abusive access by bots, thus protecting it from spam and denial-of-service attacks.
Processing:
We have concluded a processing agreement with the above-mentioned service provider. This contract is mandatory under data protection law; it ensures that the personal data of the visitors to our website is processed only in accordance with our instructions and in compliance with the GDPR.
6) Use of Adobe Marketo Engage on landing pages and forms
On certain landing pages and forms, we use Adobe Marketo Engage, a service provided by Adobe Systems Software Ireland Limited, 4–6 Riverwalk, Citywest Business Campus, Dublin 24, Ireland. Adobe Marketo Engage helps us with the technical provision of forms, the collection of enquiries, registrations or download requests, and in linking these interactions to the relevant communications or information resources.
If you use the relevant form, we will process, in particular, the data you enter, such as your name, company, role, e-mail address, telephone number and details of your enquiry or the information you are looking for. This includes, in particular, information about the landing page accessed or the form used, timestamps, browser and device information, referrer information, and other data relating to interactions with the content provided.
Adobe Marketo Engage may use cookies or similar technologies, in particular what is known as Munchkin tracking. Munchkin tracking enables us to track visits to landing pages, form interactions, page views, the times of visits and other interactions with our online services. Provided you have given your consent, this information may be linked to an existing contact profile in order to better understand, analyse and tailor the use of our information, communication and service offerings to your needs.
The use of cookies or similar technologies, as well as the storage of information on your device or access to information already stored, takes place only on the basis of your prior consent in accordance with Article 25(1) TDDDG, provided that no statutory exception in accordance with Article 25(2) TDDDG applies. You can withdraw or amend your consent at any time, with effect for the future, via the settings in our consent management tool.
Insofar as Adobe Marketo Engage uses analytics, tracking or personalisation functions, personal data is processed on the basis of your consent in accordance with Article 6(1)(a) of the GDPR. Insofar as personal data is processed for the technical provision of forms, to deal with your enquiry or to carry out pre-contractual measures, such processing is carried out on the basis of Article 6(1)(b) of the GDPR. Insofar as processing is necessary to ensure the security, functionality and provision of our online services in line with users’ needs, it is carried out on the basis of our legitimate interest in accordance with Article 6(1)(f) of the GDPR.
If you provide your details via a form or are already stored as a contact in our systems, information regarding your use of landing pages and forms may be combined with your existing contact and communication details. Data is combined exclusively on the basis of the relevant legal grounds and, where applicable, on the basis of the consent you have given.
Insofar as you request newsletters, product information, event information, white papers, webinars or other marketing communications via a landing page or a form, the information set out in Section IV.3, ‘Newsletters, e-mail marketing and marketing automation with Adobe Marketo Engage’, shall also apply.
ENERCON has entered into a data processing agreement with Adobe Systems Software Ireland Limited in accordance with Article 28 of the GDPR.
Adobe may also process personal data outside the European Union or the European Economic Area. Insofar as data is transferred to third countries in this context, this is carried out on the basis of appropriate safeguards in accordance with Article 44 et seqq. of the GDPR, in particular on the basis of the Standard Contractual Clauses adopted by the European Commission and, where applicable, supplementary protective measures or other legally permissible transmission mechanisms. Further information on transfers to third countries can be found in Section V.5, ‘ Transmission to third countries outside the EU’.
IV. Other data processing operations
1) Making contact
We process your personal data when you enter it in the contact form on our website, send it to us by e-mail, or contact us by phone. When you contact us, we collect the following information about you: Title; last name/first name; company; address details; contact details (phone/e-mail); content (of enquiry). We use your personal data only to communicate with you, or for the purpose you intended when providing this data, and then delete it.
We process your personal data for responding to contact requests on the following legal basis:
• Safeguarding of our legitimate interests under Article 6(1)(f) GDPR; our legitimate interest consists in properly responding to contact requests and is not overridden by any interests or fundamental rights and freedoms of the data subject that require the protection of personal data, or
• Fulfilment of a contract or performance of precontractual measures under Article 6(1)(b) GDPR, if that is the purpose of your contact request.
The personal data collected as part of making contact is erased once the purpose of the communication ceases to exist and provided that there are no statutory retention obligations or other legal grounds which prevent erasure.
2) Making contact, initiating business and sending information
This section relates to making contact as part of existing or potential business relationships as well as direct marketing and the sending of information. Information regarding newsletters, e-mail marketing, automated management of marketing and information campaigns as well as analysis of marketing communication can be found in Section IV.3 ‘Newsletters, e-mail marketing and marketing automation with Adobe Marketo Engage’.
a) Making contact as part of initiating business
Insofar as you make contact with us in relation to a specific enquiry, an event, a personal interaction or any other means of initiating business, we shall process your contact and communication details (e.g. name, company, role, address, e mail address, telephone number as well as details regarding your enquiry) in order to process your enquiry, examine business opportunities or to continue business communication.
Processing is carried out on the basis of Article 6(1)(b) GDPR insofar as the contact or communication is focussed on concluding a contract or performing precontractual measures.
Insofar as the conditions for this are not met, processing is carried out on the basis of our legitimate interest as per Article 6(1)(f) GDPR (safeguarding of legitimate interests) in initiating, maintaining and advancing business relationships.
The personal data processed as part of initiating business is erased once the purpose of processing has ceased to be relevant and there are no statutory retention obligations or other legal bases which require further storage.
b) Direct marketing and sending information
If we receive your address or e-mail address in relation to an existing business relationship or the sale of goods or services and you have not objected to use, we may process this data in order to send you information about similar products, services, events or other business activities we have.
Processing takes place on the basis of our legitimate interest as per Article 6(1)(f) GDPR (safeguarding of legitimate interests) in maintaining existing customer and business relationships as well as, insofar as applicable, Article 7(3) UWG (advertising to existing customers or separate consent).
You can object to the use of your personal data for the purposes of direct marketing at any time with effect for the future. In particular, you can submit your objection by e-mail to vertrieb@enercon.de or by post to ENERCON GmbH, Vertrieb National, Dreekamp 5, 26605 Aurich.
The personal data processed as part of direct marketing is erased once the data subject has objected to the processing for advertising purposes and there are no statutory retention obligations or other legal bases which prevent erasure. Once an objection has been received, we can save the data required for documentation and implementation of the objection in a suppression list to ensure that you are not contacted again for advertising purposes. In this respect, processing takes place on the basis of our legitimate interest as per Article 6(1)(f) GDPR (safeguarding of legitimate interests).
3) Newsletters, e-mail marketing and marketing automation with Adobe Marketo Engage
This section relates to marketing communications for which consent has been given, as well as the organisation, management and evaluation of the relevant communication activities. Information on marketing communications to existing customers without specific consent can be found in Section IV.2. Information on the technical integration of Adobe Marketo Engage into landing pages and forms, as well as on the associated collection of form, usage and interaction data, can be found in Section III.6.
If you sign up to receive newsletters, product information, event information, white papers, webinars or other marketing communications, we will process the personal data you provide – in particular contact and company details, information from forms, registration and consent data, communication histories, and usage and interaction data – in order to provide you with the requested information and to organise, segment and analyse our marketing communications.
In order to implement, manage and analyse these communication and marketing activities, we use Adobe Marketo Engage, a service provided by Adobe Systems Software Ireland Limited, 4–6 Riverwalk, Citywest Business Campus, Dublin 24, Ireland. In particular, the platform helps us to send marketing e-mails, manage contact and prospective customer details, run automated campaigns, and analyse and segment our communication activities. ENERCON has entered into a data processing agreement with Adobe Systems Software Ireland Limited in accordance with Article 28 of the GDPR.
We use the processed data to send marketing communications, provide requested information, segment our communication activities and manage automated campaigns. In addition, lead scoring can be used to better gauge interest in our products, services and information resources, and to tailor our marketing and sales processes to meet specific needs. When it comes to lead scoring, information relating in particular to enquiries, downloaded content, event registrations and interactions with our marketing communications can be taken into account. Lead scoring is used solely to prioritise and process leads by our marketing and sales teams. No decisions are made solely by automated means pursuant to Article 22 of the GDPR.
If an enquiry or interaction indicates a demonstrable interest in our products, services or information resources, contact details and relevant contextual information may be forwarded as a so-called ‘Marketing Qualified Lead’ (MQL), i.e. as a contact with a demonstrable interest in our offerings, to the relevant sales departments or ENERCON companies within the ENERCON Group, insofar as this is necessary to process your enquiry or address your interest. At present, this data is transferred without any detailed lead score information being disclosed.
Data processing is carried out on the basis of your consent in accordance with Article 6(1)(a) of the GDPR, insofar as it relates to the sending of marketing communications and the use of consent-based analytics and tracking functions. Where processing is necessary to deal with your enquiry or to take steps prior to entering into a contract, it is carried out on the basis of Article 6(1)(b) of the GDPR. Where the processing relates solely to contact, communication or enquiry details and serves the purpose of managing marketing and sales processes in line with our needs, it is carried out on the basis of our legitimate interest pursuant to Article 6(1)(f) of the GDPR. Our legitimate interest lies in the efficient organisation, management and optimisation of our information, marketing and sales processes.
You can opt out of receiving marketing communications at any time or withdraw your consent with effect for the future. To this end, a corresponding opt-out link is provided in every marketing e-mail. Alternatively, you can submit your withdrawal by e-mail to abmelden@enercon.de or by post to ENERCON Global GmbH, Marketing Department, Dreekamp 5, 26605 Aurich, Germany. Withdrawal does not affect the lawfulness of the processing carried out prior to the withdrawal. Similarly, you can object at any time to the processing of your personal data for direct marketing purposes. The right to object applies regardless of whether the processing is based on consent or on legitimate interests.
Personal data processed in connection with Adobe Marketo Engage will only be stored for as long as is necessary for the respective purposes, or until you withdraw your consent or object to the processing, provided that there are no statutory retention obligations or overriding legitimate grounds to the contrary. Following an opt-out from marketing communications or an objection to direct marketing, we may store your e-mail address and the information required to process your withdrawal of consent or objection in a suppression list, insofar as this is necessary to reliably prevent future mailings and to document the withdrawal of consent or objection.
Adobe may also process personal data outside the European Union or the European Economic Area. Insofar as data is transferred to third countries in this context, this is carried out on the basis of appropriate safeguards in accordance with Article 44 et seqq. of the GDPR, in particular through the use of EU Standard Contractual Clauses or other permissible transmission mechanisms. Further information on transfers to third countries can be found in Section V.5, ‘ Transmission to third countries outside the EU’.
4) Use of the Service Info Portal (SIP)
Our Service Info Portal (SIP) that can be accessed from this website gives customers the option to store operating reports, service reports and other documents about their wind energy converters, or to share them with us within the framework of the performance of the contract. Safeguarding our legitimate interest as per Article 6(1)(f) GDPR forms the legal basis for the associated processing of your personal data; our legitimate interest consists in responding appropriately to customer enquiries and in the proper rendering of our contractually agreed services or fulfilment of the contract pursuant to Article 6(1)(1)(b) GDPR. During use of the Service Info Portal, only the personal data required for the provision, management and use of the portal is ever processed. We keep this information strictly confidential and store and use the data only to enable you to use the Service Info Portal; following termination of the contractual relationship the information is erased at once if no other legal basis for processing exists.
5) Queries and surveys
We occasionally use Microsoft Forms for internal and external queries and surveys. For this purpose, ENERCON has concluded a processing agreement with Microsoft that meets the requirements of Article 28 GDPR. Insofar as personal data is transmitted to third countries as part of the use of Microsoft Forms, this is carried out on the basis of an adequacy decision from the European Commission or other suitable safeguards as per Article 44 et seq. GDPR (transmission of personal data to third countries). Further information on transmission to third countries can be found in Section V.5, ‘Transmission to third countries outside the EU’.
Depending on the type and content of the respective survey, personal data may be processed. This includes, among other things, first name and last name, contact details, date of birth and other information from the list of questions.
If and to the extent that we request the data subject’s permission for the processing of personal data, Article 6(1)(a) GDPR (consent) serves as a legal basis. For the processing of personal data required for the fulfilment of a contract or the performance of precontractual measures, Article 6(1)(b) GDPR serves as a legal basis (processing for the performance of precontractual measures or a contract). Insofar as the processing of personal data is required for the fulfilment of a statutory obligation to which our company is subject, Article 6(1)(c) GDPR (fulfilment of a legal obligation) serves as a legal basis. If processing is necessary for the purposes of safeguarding the legitimate interests pursued by our company or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject, Article 6(1)(f) GDPR (safeguarding of legitimate interests) serves as a legal basis.
V. Data processing operations in the context of services and other business operations
Within the framework of the services provided by us and that of other business operations, we process personal data for different purposes (see items 1 to 3 of this section), transmit this data to third parties from time to time and store it until the purpose has been achieved (see items 4 to 6 of this section).
1) Contractual relationships
Within the framework of the contracts concluded or initiated with us (e.g. for installation or maintenance of a wind energy converter, with suppliers or service providers, etc.) we collect and process personal data on the legal basis of Article 6(1)(b) GDPR for the purpose of performance, initiation or implementation of a contractual relationship.
2) Statutory obligation
We process personal data insofar as there is a statutory obligation to that effect (e.g. as part of the execution of administrative procedures) in accordance with Article 6(1)(c) GDPR in conjunction with the relevant specific legal basis.
3) Legitimate corporate interests
In addition, we process personal data in different cases in order to assert legitimate corporate interests (e.g. to enforce legal claims or for video surveillance of our facilities for protection against unauthorised access, where required) on the legal basis of Article 6(1)(f) GDPR, after the careful consideration of legally protected interests has confirmed that there are no overriding interests or fundamental rights and freedoms of the data subject that require the protection of personal data.
4) Recipient
ENERCON Global GmbH and other national and international companies of the ENERCON Group host central functions, are active on behalf of the corporate network and, in this context, also process personal data, e.g. Marketing and Communication, Sales, Service, Purchasing, Central Administration (e.g. Legal Department), and Finance, IT and HR. Insofar as central functions or other affiliated companies of the ENERCON Group are involved in the initiation, performance or implementation of business and contractual relationships, the processing of enquiries, support of customers, business partners and prospective customers or other internal management purposes, personal data is exchanged between the various affiliated companies involved to the extent necessary. The legal basis for this is Article 6(1)(b) GDPR (processing for the performance of precontractual measures or a contract) or Article(6)(1)(f) GDPR (safeguarding of legitimate interests). The legitimate interest is in efficient collaboration within the Group as well as standardised support for customers, business partners and prospective customers within the ENERCON Group. These may be commercial, administrative, technical or other internal business purposes; this applies only to the extent that the interests or fundamental rights and freedoms requiring the protection of personal data of data subjects do not override the above.
We transfer personal data to other third parties (e.g. authorities or banks or service providers employed to fulfil a contract) only if required by the particular business relationship or a statutory requirement. We oblige any service provider we employ (e.g. acting as processors on our behalf for IT or printing services) by contract to process personal data only within the scope of their duties.
The categories of recipients to whom we transfer data in order to fulfil our contractual and statutory obligations, or on the basis of our legitimate interests are listed below:
• IT service providers for the provision, administration and safeguarding of our IT systems and websites
• Printing and shipping service providers for the creation and delivery of informational materials
• Banks and payment providers for the execution of payment transactions
• Authorities and public bodies, insofar as statutory obligations require this
• Other service providers, insofar as they are involved in order to fulfil contractual or statutory obligations
5) Transmission to third countries outside the EU
ENERCON also cooperates with companies of the ENERCON Group and external service providers that are located in countries outside the EU or the EEA. In this context, personal data may be transmitted to countries outside the EU or the EEA in the context of our international business activities. If personal data is transmitted from an EU or EEA country to a country outside the EU or EEA, this is carried out on the basis of an adequacy decision from the European Commission or other suitable safeguards as per Article 44 et seqq. GDPR (transmission of personal data to third countries).
Insofar as there is no adequacy decision from the European Commission for the relevant third country, ENERCON uses the Standard Contractual Clauses adopted by the European Commission in particular in order to contractually oblige the data recipient to ensure a level of data protection equivalent to the GDPR for protecting personal data.
Insofar as personal data is transmitted to recipients in the USA, transmission can take place on the basis of the EU-U.S. Data Privacy Framework or another suitable safeguard as per Article 44 et seqq. GDPR.
Regardless of this, US companies may be obligated to hand over personal data to authorities or security bodies due to statutory obligations.
6) Storage period
Personal data processed by us is always stored for the period required for the particular purpose (e.g. performance of contract until withdrawal of your consent) and then erased, taking into account the statutory retention periods, or locked for the required retention period after the purpose has been achieved (e.g. fulfilment of contract by both parties), or restricted from processing and then erased. In addition, we store personal data until the limitation period for any legal claim has expired. As a rule, the limitation period is between 12 and 36 months; it may, however, be up to 30 years.
Upon the start of limitation we erase personal data unless there is a statutory retention period, e.g. under the German Commercial Code (Articles 238, 257(4) HGB) or the German Tax Code (Article 147(3) and (4) AO). These retention periods may be two to ten years.
VI. Presences in social networks
We maintain presences in the social networks named below and, within this framework, process user data in order to communicate with active users in these networks or to provide information.
Please note that user data might be processed outside the European Union in the course of the process. This may entail risks to the users, e.g. because enforcement of user rights might be hampered.
Moreover, user data is typically processed inside social networks for market research and advertising purposes. For instance, usage profiles can be generated based on user behaviour and the interests of users derived from it. These usage profiles can be utilised e.g. to show advertisements inside and outside the networks that are presumed to match the users’ interests. As a rule, cookies that store user behaviour and users’ interests are placed on users’ computers for that purpose. In addition, usage profiles can also contain data that are unrelated to the individual devices a user uses (particularly if that user is a member of the respective platform and has logged in to it).
For a more precise description of the individual types of processing and the options for objection, please refer to the privacy statements and information provided by operators of the respective platforms.
With regard to requests for information and enforcement of data subjects’ rights, we would also like to point out that these are most effectively asserted vis-à-vis the providers. Only the respective providers have access to user data and can take suitable measures directly and provide information. Nevertheless, if you have any questions about this you can contact us directly at the addresses given above.
Data types processed: Contact details (e.g. e-mail, phone numbers); content (e.g. inputs into online forms); usage (e.g. websites visited, interest in content, access times); metadata/communication data (e.g. device information, IP addresses).
Data subjects: Users (e.g. website users, users of online services).
Purposes of processing: Contact requests and communication; feedback (e.g. collecting feedback through online forms); marketing
Legal bases: Our legitimate interest as per Article 6(1)(1)(f) GDPR is to publish information about our company and to establish contact with prospective customers. There are no overriding interests of data subjects conflicting with this interest.
1) YouTube
Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Website: www.YouTube.com
YouTube privacy statement
When you visit our YouTube page, YouTube collects, among other things, your IP address as well as other information stored on your PC in the form of cookies. This information is used to provide us as operator of the YouTube pages with statistical information about the use of the pages.
More information on this is provided by YouTube here.
Your data collected in this context is processed by Google Ireland Limited and may be transmitted to countries outside the European Union. A general description of what data Google receives and how it uses this data is provided by Google in its privacy statement. Here, you can also find information about how to contact YouTube and how to modify the settings for the display of advertisements.
YouTube does not provide conclusive or clear information about the manner in which it uses data from your visit to YouTube pages for its own purposes; to what extent it associates activities on the YouTube page with individual users; for how long YouTube stores this data; and whether data from visiting a YouTube page is transmitted to third parties, and consequently we have no knowledge in this regard.
When accessing a YouTube page, your device's assigned IP address is transmitted to YouTube. Moreover, YouTube stores information about users' devices; this may enable YouTube to associate specific IP addresses with individual users.
If you are currently logged into YouTube as a user, this login will have placed a YouTube ID cookie on your device. This enables YouTube to track the fact that you have visited this page and how you have used the page. The same is true for all other YouTube pages. The YouTube buttons integrated into websites enable YouTube to track your visits to these websites and to connect them to your YouTube profile. This data can be used to tailor content or advertisements to you personally.
If you would like to avoid this, you should log out of YouTube, delete the cookies on your device, and close and restart your browser. This will delete YouTube data that can identify you directly. This allows you to use YouTube pages without revealing your YouTube ID. If you access any interactive features of the page (like, comment, share, etc.), the YouTube login prompt will appear. If you log in at this point, you will again be identifiable by YouTube as a specific user. For information on how to manage or delete existing information, go to the YouTube support page.
2) Instagram
Service provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland
Website: www.instagram.com
Instagram privacy statement
3) LinkedIn
Service provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland;
Website: www.linkedin.com
LinkedIn privacy statement
4) Xing
Service provider: New Work SE, Baumwall 7, 20459 Hamburg, Germany;
Website: www.xing.de
Xing privacy statement
VII. Rights as data subject
Subject to the statutory provisions, you have the following rights as a data subject, which you may assert against us:
Right of access: You are entitled at any time, within the framework of Article 15 GDPR, to obtain confirmation from us as to whether or not we process personal data concerning you; if this is the case, you are also entitled, within the framework of Article 15 GDPR, to receive information about this personal data, as well as specific further information (among others, purposes of processing; personal data categories; recipient categories; envisaged storage period; origin of the data; use of automated decision-making, and – in the event of transmission to third countries – suitable safeguards) and a copy of your data.
Right to rectification: You are entitled under Article 16 GDPR to request us to correct the personal data we have stored about you if it is inapplicable or incorrect.
Right to erasure: You are entitled, subject to the provisions of Article 17 GDPR, to request us to erase personal data concerning you without delay. No right to erasure exists if, among other things, processing of personal data is required for exercising the right to freedom of expression and information, fulfilling a statutory obligation to which we are subject (e.g. statutory retention periods), or asserting, exercising or defending legal claims.
Right to restriction of processing: You are entitled, subject to the provisions of Article 18 GDPR, to request us to restrict processing of your personal data.
Right to data portability: You are entitled, subject to the provisions of Article 20 GDPR, to request us to hand over, in a structured, common, machine-readable format, the personal data that concerns you and you have provided to us.
Right to revoke consent: You are entitled to revoke your consent to the processing of personal data with effect for the future at any time. The revocation of consent dies not affect the lawfulness of the processing performed on the basis of that consent prior to the revocation.
Right to objection: You are entitled, subject to the provisions of Article 21 GDPR, to object to the processing of your personal data so that we have to discontinue processing of your personal data. The right to objection exists only within the limits set by Article 21 GDPR. Furthermore, our interests may rule out the discontinuation of processing so that we are entitled to continue to process your personal data despite your objection.
Right to complain to a supervisory authority: You are entitled, subject to the provisions of Article 77 GDPR, to lodge a complaint with a supervisory authority, particularly in the member state of your residence, your workplace or the location of the suspected violation, if you are of the opinion that processing of the personal data concerning you is in breach of the GDPR. The right to complain exists without prejudice to any other administrative or judicial remedy.
Competent supervisory authority for ENERCON:
Die Landesbeauftragte für den Datenschutz Niedersachsen [State Commissioner for Data Protection; Lower Saxony]
Prinzenstraße 5
30159 Hannover, Germany
Phone: +49 (0511) 120 45 00
Fax: +49 (0511) 120 45 99
E-mail: poststelle@lfd.niedersachsen.de
Nevertheless, we recommend that you direct any complaint to our Data Protection Officer first.
If possible, please address your requests for exercising your rights to the above address or directly to our Data Protection Officer in writing.
VIII. Data security
We have taken extensive technological and operational precautions to protect your data against accidental or intentional manipulation, loss, destruction or access by unauthorised persons. We review and adapt our security procedures on a regular basis to keep up with technological progress.
When you use our contact form or log on to the Service Info Portal (SIP) platform you also provide personal data about yourself.
We use state-of-the-art, modern encryption methods to safeguard the personal data transmitted during data transmission. In particular, this includes encrypted transmission by means of TLS (Transport Layer Security). This is a tried-and-tested data transmission method on the internet that is highly secure if used according to the state of the art the way we do.
IX. Obligations to provide data
In principle, you are not obliged to share your personal data with us. However, certain information may be required to use individual website functions, to be able to process enquiries, provide information or conclude and fulfil contracts. Insofar as certain information is strictly required, we shall identify this accordingly. If the required data is not provided, this may result in it not being possible to use the relevant function or service, or only to a limited extent.
X. Automated decision-making
No decisions are made solely by automated means pursuant to Article 22 GDPR.
Insofar as we employ marketing automation, segmentation or methods to prioritise contacts (e.g. lead scoring), these methods are used only for the internal organisation, planning and management of marketing and sales processes. No decisions which have a legal effect for the data subject or which may significantly impact them in a comparable manner are made on the basis of these methods.
XI. Information about your right to object
You are entitled to object to the processing of your data performed on the basis of Article 6(1)(f) GDPR (data processing on the basis of a weighing of interests) or Article 6(1)(e) GDPR (data processing in the public interest), if there are any reasons resulting from your particular situation. This applies likewise to any profiling based on this provision in the context of of Article 4(4) GDPR. If you raise an objection we no longer process your personal data unless we are able to give compelling reasons for processing worthy of protection that override your interests, rights and freedoms, or processing serves to assert, exercise or defend legal claims.
If, in individual cases, we process your personal data for direct marketing purposes, you are entitled to object to this at any time. Once your objection has been received, we will no longer process your personal data for the purposes of direct marketing in the future.
This objection may be informal and should be addressed to the point of contact given in Section I.
XII. Amendments to and updates of this Privacy Statement
The content of this Privacy Statement may be updated if necessitated by modifications to the data processing operations performed by us. We will inform you in case any modification requires assistance on your part (e.g. consent) or any other individual notification.
