Privacy notice

1. Data controller

The data controller responsible for the processing of personal data on this website within the meaning of the GDPR is:

2. Hosting

This website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. Vercel operates the infrastructure required to deliver the site. A data-processing agreement (DPA) is in place; data transfers to the USA take place on the basis of the EU Standard Contractual Clauses (SCCs).

3. Server log files

When you access this website, technically necessary data are stored in server log files: IP address (shortened where possible), date and time of the request, requested URL, referrer and user agent. The legal basis is Art. 6(1)(f) GDPR (ensuring stable operation and defending against attacks). Retention period: 14 days.

4. Audience measurement with Vercel Analytics

We use Vercel Web Analytics, a service of Vercel Inc., for aggregated evaluation of page views. Vercel Analytics sets no cookies and processes no personal identifiers; an anonymous daily hash is derived from IP address and user agent and discarded after 24 hours.

Although Vercel Analytics sets no cookies and, in the provider's view, does not constitute terminal-device access within the meaning of §25 TTDSG, we load the service only after your consent as a precaution. The legal basis is therefore Art. 6(1)(a) GDPR. You can withdraw your consent at any time, see section 12.

5. Google Analytics 4 & Google Ads conversion tracking

Where you have consented, we use Google Analytics 4 (GA4), a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. GA4 uses cookies and similar technologies to evaluate your use of the website. The data processed includes, among other things, a truncated IP address, device and browser information, approximate location, pages visited, time spent and interactions. We have enabled IP anonymisation.

In this process, data may be transferred to Google LLC in the USA; this is based on the EU Standard Contractual Clauses and Google's certification under the EU-US Data Privacy Framework. The legal basis is Art. 6(1)(a) GDPR in conjunction with §25(1) TTDSG (consent). You can withdraw your consent at any time with effect for the future, see section 12.

We use Google Consent Mode v2. The Google tag library (gtag.js) is loaded on every page, but defaults to "denied" mode. Before you consent, no cookies or identifiers are set and no personal analytics data is collected; only anonymous, cookieless signals without any personal reference are transmitted. Cookies are set and the processing described in section 5 is activated only after you have given your consent.

Where you have consented to the "Marketing" category, we additionally use Google Ads conversion tracking (Google Ireland Limited) with the "Enhanced Conversions" feature. When you complete a booking via /termin, the email address you entered is hashed in your browser using SHA-256 and transmitted to Google solely in this hashed (non-reversible) form, in order to attribute the booking to a prior interaction with one of our ads. If you have not consented to the "Marketing" category, no email address is transmitted. Any transfer to the USA is based on the EU Standard Contractual Clauses and the EU-US Data Privacy Framework; the legal basis is Art. 6(1)(a) GDPR in conjunction with §25(1) TTDSG (consent). You can withdraw your consent at any time with effect for the future, see section 12.

In addition, to measure the effectiveness of our ads, we transmit conversion events server-side from our CRM system to Google Ads (conversion import / "Enhanced Conversions for Leads"). This transmission is limited to a click identifier assigned by Google when the ad was clicked (gclid) or the SHA-256-hashed (non-reversible) contact details (email address, phone number), together with the time and name of the event; your name and the contents of your enquiry are not transmitted. So that this attribution still works if you navigate within our website before submitting the form or return to the site at a later time, your browser stores the parameters passed in the address bar when the ad was clicked (click identifier, campaign parameters) as well as the first page you opened and the referring website (in each case without any search terms they may contain) locally in so-called localStorage. When you submit the form, we also store this origin information alongside your enquiry in our CRM system so that we can tell how you found us; it is not transmitted to Google Ads. The storage in your browser remains solely there, is deleted automatically after 90 days at the latest, can be removed by you at any time by clearing your browser's site data and does not enable any cross-site or cross-device tracking (§25(2) no. 2 TTDSG). The legal basis is Art. 6(1)(f) GDPR (legitimate interest in measuring the effectiveness of our advertising); transfers to the USA are based on the EU Standard Contractual Clauses and the EU-US Data Privacy Framework. You may object to this processing at any time with effect for the future (Art. 21 GDPR), see section 11.

6. Tracking with the Meta Pixel (Facebook)

Where you have consented to the "Marketing" category, we use the Meta Pixel, a tracking tool provided by Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. The pixel sets cookies and processes, among other things, a device and browser identifier, your IP address, pages visited and events triggered (e.g. page view, completed booking) in order to measure the effectiveness of our ads and build audiences. The pixel script is loaded only after you have consented; before that it is not executed and no data is transmitted to Meta.

In this process, data may be transferred to Meta Platforms, Inc. in the USA; this is based on the EU Standard Contractual Clauses and Meta's certification under the EU-US Data Privacy Framework. For the collection of data via the pixel, we and Meta are joint controllers within the meaning of Art. 26 GDPR. The legal basis is Art. 6(1)(a) GDPR in conjunction with §25(1) TTDSG (consent). You can withdraw your consent at any time with effect for the future, see section 12.

In addition, we forward the same events (e.g. page view, completed booking) to Meta server-side via our own first-party domain "sgw.copernica-partners.de", which we operate (Meta Signals Gateway / server-side Conversions API forwarding). The browser-side and server-side events are deduplicated via a shared event ID; no categories of personal data beyond those collected by the pixel are processed. This forwarding likewise takes place only after you have consented to the "Marketing" category; the same legal basis (Art. 6(1)(a) GDPR in conjunction with §25(1) TTDSG), joint controllership and safeguards for transfers to the USA described above apply. You can withdraw your consent at any time with effect for the future, see section 12.

In addition, to measure the effectiveness of our ads, we transmit conversion events server-side from our CRM system to Meta (Conversions API), irrespective of whether you have consented to the "Marketing" category. This concerns only two events that you trigger yourself: submitting our form and completing a booking. What is transmitted are the SHA-256-hashed (non-reversible) details email address, phone number and first and last name, together with the click identifier passed by Meta in the address bar when the ad was clicked (fbclid), your IP address and your browser identifier (user agent), as well as the time and name of the event; the contents of your enquiry are not transmitted. The description in section 5 applies to the local caching of the click identifier in your browser. The legal basis for the transmission is Art. 6(1)(f) GDPR (legitimate interest in measuring the effectiveness of our advertising); the safeguards for transfers to the USA described above apply. You may object to this processing at any time with effect for the future (Art. 21 GDPR), see section 12.

7. Session recordings with Microsoft Clarity

Where you have consented to the "Audience measurement" category, we use Microsoft Clarity, an analytics service provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Clarity records how visitors use the website (including mouse movements, clicks, scrolling behaviour, pages visited, and device and browser information) and generates session replays and heatmaps from this data, which we use to improve the usability of the website. Sensitive input (e.g. in form fields) is masked by default. Clarity sets cookies (including "_clck" and "_clsk") to recognise visitors across sessions. The Clarity script is loaded only after you have consented; before that it is not executed and no data is transmitted to Microsoft.

In this process, data may be transferred to Microsoft Corporation in the USA; this is based on the EU Standard Contractual Clauses and Microsoft's certification under the EU-US Data Privacy Framework. The legal basis is Art. 6(1)(a) GDPR in conjunction with §25(1) TTDSG (consent). You can withdraw your consent at any time with effect for the future, see section 12.

Further information on data processing by Microsoft Clarity can be found in Microsoft's privacy statement at https://privacy.microsoft.com/en-us/privacystatement.

8. Contact by email

If you contact us by email, we process the data you provide solely to handle your request. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest in efficient communication). The data are deleted as soon as they are no longer required for the purpose and no statutory retention obligations stand in the way.

9. Booking via Cal.com

On the /termin page we embed the Cal.com booking calendar. The embed script and any cookies set within the embed are functionally necessary in order to accept your booking; we therefore load them irrespective of your consent to the marketing tracking. If you don't visit /termin, the embed is not loaded.

The data you enter (name, email address, preferred time, any optional details) and technical embed data are transmitted to Cal.com, Inc., 2261 Market Street #4382, San Francisco, CA 94114, USA and processed there on our behalf. Transfer to the USA is based on the EU Standard Contractual Clauses. The legal basis is Art. 6(1)(b) GDPR (taking pre-contractual measures at your request). Booking data received via Cal.com are subsequently imported into our CRM system Attio (Attio, United Kingdom) in order to process your request; an EU Commission adequacy decision is in place for the United Kingdom. Even before booking, you can submit your name, email address and phone number via a form on /termin; these details are stored directly in our CRM system Attio in order to process your contact request (legal basis Art. 6(1)(b) GDPR).

10. Self-disclosure form (financing request)

Prospects who are already in touch with us can complete a self-disclosure form for their financing request via an access-code-protected page. The information you enter remains in your browser until you submit it; only upon submission is it transmitted to us, delivered to our mailbox by email and stored in our CRM system Attio. The legal basis is Art. 6(1)(b) GDPR (taking pre-contractual measures at your request). Supplementary privacy information, in particular on disclosure to credit institutions, is provided within the form itself.

Supporting documents uploaded in the form are transmitted in encrypted form to access-protected storage operated by our hosting provider Vercel (Vercel Blob) and forwarded from there to our mailbox as an email attachment. A backup copy of your form entries and of the documents generated from them is stored alongside them, so that a submission is not lost if transmission to us fails. This data is retained in that storage for a maximum of 14 days as a delivery safeguard and is then deleted automatically. The safeguards described in the hosting section (data processing agreement, EU Standard Contractual Clauses) apply to Vercel.

To deliver form submissions to our mailbox by email we use the email service provider Resend (Plus Five Five, Inc., USA), which processes the content on our behalf. A data processing agreement is in place with the provider; data transfers to the USA are based on the EU Standard Contractual Clauses.

11. Lead forms on Facebook and Instagram (Meta Lead Ads)

We run ads on Facebook and Instagram that open a contact form directly on the respective platform (so-called Lead Ads or Instant Forms of Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland). When you submit such a form, Meta transmits the details you entered there to us: your name, email address, phone number and your answers to the questions asked in the form, together with the time of submission and an indication of which ad and campaign the form was opened from. Meta is responsible for the processing of your data within the Meta platforms, such as pre-filling the form from your profile, in accordance with Meta's privacy policy.

We import the submitted details via an automated, access-secured interface into our CRM system Attio (Attio, United Kingdom; EU Commission adequacy decision, see section 9) in order to process your enquiry and get in touch with you. The legal basis is Art. 6(1)(b) GDPR (taking pre-contractual measures at your request); for the attribution to ad and campaign it is Art. 6(1)(f) GDPR (legitimate interest in measuring the effectiveness of our advertising). The data is deleted once it is no longer required for these purposes and no statutory retention obligations apply; your rights, including the right to object, are described in section 12.

12. Direct marketing and contact data from public sources

We approach professional contacts in selected professions and industries directly, by letter and by email, to draw their attention to our energy direct-investment offering. The contact details we use for this were not collected from you; they were taken from publicly accessible sources. We are informing you about this processing pursuant to Art. 14 GDPR.

Our sources are official and publicly accessible professional registers (such as the Amtliches Steuerberaterverzeichnis under §86b StBerG, the Bundesweites Amtliches Anwaltsverzeichnis under §31 BRAO or the register of the Bundesnotarkammer), publicly accessible map and business data (OpenStreetMap), publicly available membership and association lists, and the freely accessible websites of the respective firm, practice or company, in particular their legal-notice, team and contact pages. We process professional details only: name, form of address and title, professional designation and role, name and address of the firm, practice or company, business telephone number, business email address and website address. We do not derive email addresses from name patterns; we only use addresses we have actually found in one of the sources named above.

The purpose of the processing is direct marketing, i.e. an initial and occasional further approach. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in approaching potential prospects and business partners, and recitals 47 and 70 GDPR expressly name direct marketing as such an interest. The data are stored in our CRM system Attio (see section 9); to check the technical deliverability of email addresses we use an email-verification service provider as a processor. We store the data for as long as they are needed for the approach and any business relationship arising from it. The decisive criterion is whether you are still a potential prospect for our offering; if your response, or the lasting absence of one, shows that there is no such interest, we delete the data. Statutory retention obligations remain unaffected. If you object to the processing, we retain only the details required to permanently exclude you from further advertising.

You may object to the processing of your data for direct-marketing purposes at any time and free of charge. Following your objection we will no longer process your data for these purposes (Art. 21(2) and (3) GDPR). An informal message to info(at)copernica-partners.de is sufficient.

13. Your rights as a data subject

You have the following rights at any time:

• Access to the data we hold about you (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on legitimate interests (Art. 21 GDPR)
• Withdrawal of consent with effect for the future (Art. 7(3) GDPR)
• Lodging a complaint with a data-protection supervisory authority (Art. 77 GDPR)

To exercise these rights, an informal message to info(at)copernica-partners.de is sufficient.

14. Manage cookies & consent

You can adjust or withdraw your consent to optional cookies and tracking at any time.