Privacy policy

2. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws of the Member States is:

AK-FAMILY GmbH (acting under the trading name (Geschäftsbezeichnung) DGfE – Deutsche Gesellschaft für Energie)
Große Gallusstraße 16–18, 60312 Frankfurt am Main, Germany
Email: kontakt@deutsche-energie-wirtschaft.de
Managing director (Geschäftsführer): Amarnath Kakar
Commercial register: Amtsgericht Frankfurt am Main, HRB 140284

3. Data protection officer

You can reach our internal data protection officer at:

Fabian Zadmajid
Email: datenschutz@deutsche-energie-wirtschaft.de

When corresponding with the data protection officer, please state the reference to DGfE – AK-FAMILY GmbH.

Enquiries relating exclusively to data protection may additionally be sent to datenschutz@deutsche-energie-wirtschaft.de , and the withdrawal of consent already given to widerspruch@deutsche-energie-wirtschaft.de.

4. General principles of processing

Personal data is processed only to the extent necessary to provide a functioning website and the services offered, and where a legal basis under Art. 6 GDPR exists. Technical and organisational measures under Art. 32 GDPR are taken to protect your data against unauthorised access, loss or manipulation. Employees are bound to data secrecy and to the confidentiality obligations under Art. 28 GDPR.

5. Data processed and purposes

5.1 Enquiry form on this website

Verarbeitete Daten (je nachdem, was Sie ausfüllen):

• Company name
• Form of address, first name and surname
• Email address
• Telephone number
• Your Topic or Your message
• Angaben zum Energiebezug (Energieart, Jahresverbrauch, aktueller Arbeitspreis) – freiwillig
• an uploaded energy invoice as a PDF or image – optional
• preferred day and time slot for a call back or a meeting – optional

Was mit den Angaben geschieht: They are sent to our internal mailboxes by email and handled there. They are not stored in this website's database. An uploaded invoice is attached to that email.

Purposes: Handling your enquiry, preparing and holding a free consultation and, if you ask us to, reviewing your energy supply.

Legal basis: Art. 6(1)(b) GDPR (steps taken at your request prior to entering into a contract). If you provide a telephone number and ask to be called back, contacting you by telephone is additionally based on your consent under Art. 6(1)(a) GDPR. Diese Einwilligung können Sie jederzeit widerrufen, formlos an widerspruch@deutsche-energie-wirtschaft.de. The lawfulness of processing carried out before the withdrawal remains unaffected.

Pflichtangaben: Without a name and a way of contacting you we cannot answer your enquiry. All other fields are optional; without them our answer is simply less precise.

5.2 Contact by email

If you contact us by email (e.g. at kontakt@deutsche-energie-wirtschaft.de) or via a contact form, the data transmitted is processed in order to handle the enquiry. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest in effective correspondence). Incoming business emails are archived in an audit-proof manner on the basis of commercial and tax requirements (GoBD).

5.3 Server log files

On every access the web server automatically collects the following data:

• requested URL and HTTP status code
• date and time of access
• volume of data transferred
• browser type, browser version, operating system
• referrer URL (page previously visited)
• IP address

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in IT security and operational stability).
Retention period: 30 days, then automatic erasure. In the event of a specific security incident, retention is extended until final resolution.

5.4 Cookies and comparable technologies

This website does not use cookies and it does not use comparable techniques that store information on your device or read information from it. There is no access within the meaning of Section 25(1) TDDDG, and no consent is therefore required.

Not in use are marketing services, advertising pixels, session recording and reach measurement by third parties. For reach measurement we use exclusively our own, cookie-free counter, see section 8.

Should this change, this policy will be amended beforehand and, where required, consent will be obtained.

6. Hosting

Provider: Hostinger International Limited, 61 Lordou Vironos str., 6023 Larnaca, Zypern.
Purpose: Provision of the server infrastructure for operating this website.
Server location: Frankfurt am Main, Deutschland. Der Anbieter hat seinen Sitz in Zypern und damit innerhalb der Europäischen Union; eine Übermittlung in ein Drittland findet insoweit nicht statt.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in stable and secure operation), together with a data processing agreement under Art. 28 GDPR.

The provider processes the server log data described in section 5.3 on our behalf and solely on our instructions.

7. E-Mail-Bearbeitung

Enquiries submitted through the form and emails sent to our mailboxes are processed in Microsoft 365 (Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland). The mailboxes are held in our own Microsoft tenant.

Legal basis: Art. 6(1)(b) and (f) GDPR, together with a data processing agreement under Art. 28 GDPR.

Enquiries sent to our mailboxes for data subject rights are additionally handled in a ticketing system that we selbst betreiben. Ein Dritter erhält dabei keinen Zugriff.

8. Reichweitenmessung mit einem eigenen Zähler

To see which of our pages are found and read, we use the software Umami . It runs on unserem eigenen Server unter statistik.deutsche-energie-wirtschaft.de. No third party receives this data; it does not leave our infrastructure, and no transfer to a country outside the EU takes place.

No cookies are set and no information is read from your device. There is therefore no access within the meaning of Section 25(1) TDDDG, and no consent is required.

What is processed: the page opened, the time, the referring page, device type, screen size, browser, operating system, language setting and the approximate location the provider derives from the IP address (country, region and city). the IP address is not stored. It is used only in passing, to derive a daily value that cannot be reversed and that allows visits on the same day to be grouped. This value changes every day; recognition beyond that day is impossible, and no conclusion about your identity can be drawn.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is in assessing the reach and the clarity of what we offer. This interest prevails because the analysis works without cookies, without recognition and without disclosure to third parties, and because we cannot identify you.

Retention period: the analysis data is deleted after twelve months at the latest.

Widerspruch: You may object to this measurement at any time, informally to widerspruch@deutsche-energie-wirtschaft.de. The counter also respects the “Do Not Track” setting in your browser.

9. Recipients and processors

Your data is received by:

• the members of our staff dealing with your enquiry;
• Hostinger International Limited as the host of this website (section 6);
• Microsoft als Betreiber unseres E-Mail-Dienstes (Abschnitt 7);
• tax advisors, auditors and public authorities, where we are required by law to disclose it.

Your data is not passed on for advertising purposes, and it is not sold. If you ask us to arrange a tariff, you will be informed separately and in advance about the recipients involved.

10. Drittland-Übermittlung

As a rule, no data is transferred to countries outside the EU or the EEA. When Microsoft 365 is used (section 7), access from the United States may occur in individual cases, for instance during maintenance and support. Microsoft is certified under the EU-US Data Privacy Framework; the European Commission's standard contractual clauses apply in addition.

11. Speicherdauer

• Server-Protokolle: 30 Tage (Abschnitt 5.3).
• Enquiries and email correspondence: until your enquiry has been dealt with, and for up to 24 months thereafter so that we can pick the matter up again.
• Business emails and documents: for as long as retention obligations under commercial and tax law apply (GoBD), six or ten years respectively.
• Anmeldeversuche am Verwaltungsbereich: The protection mechanism in use stores the IP addresses of failed login attempts in order to fend off automated attacks. The legal basis is Art. 6(1)(f) GDPR; the entries are deleted after 60 days at the latest.

Once the relevant period has expired, the data is deleted unless a statutory retention obligation prevents this.

12. Your rights as a data subject

You have the right at any time to:

• access to the personal data concerning you (Art. 15 GDPR)
• rectification of inaccurate personal data (Art. 16 GDPR)
• erasure of your personal data (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability in a structured, commonly used and machine-readable format (Art. 20 GDPR)
• objection to processing based on legitimate interests, including profiling (Art. 21 GDPR)
• withdrawal of consent given, with effect for the future (Art. 7(3) GDPR)

To exercise your rights, please address your request to datenschutz@deutsche-energie-wirtschaft.de, widerspruch@deutsche-energie-wirtschaft.de or to the data protection officer (see section 3).

13. Right to lodge a complaint with a supervisory authority

Without prejudice to other remedies, you have the right to lodge a complaint with a data protection supervisory authority – in particular in the Member State of your residence, place of work or the place of the alleged infringement. The competent supervisory authority at the controller’s registered office is:

Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (Hessian Commissioner for Data Protection and Freedom of Information)
Gustav-Stresemann-Ring 1, 65189 Wiesbaden
Telephone: +49 611 1408-0
Email: poststelle@datenschutz.hessen.de
Web: datenschutz.hessen.de

14. Automated decision-making and profiling

Solely automated decision-making with legal effect or a similarly significant effect within the meaning of Art. 22 GDPR does not take place. Consumption and tariff details are evaluated on a rule-based basis in order to prepare a precisely matched energy offer; the final advisory and contractual decision is always taken by our employees.

15. Obligation to provide data

Providing personal data is required neither by law nor by contract. There is no obligation to provide it. Without the details marked in the lead form as mandatory, however, an offer cannot be prepared.

16. Currency and amendment of this policy

This privacy policy is continually adapted to current legal and technical developments. In each case the version published on this page at the time of your visit applies. The current status is shown above.