1. Responsible person:

IKOSIA Energy Solutions (Germany) GmbH

Wadzeckstrasse 10, 10178 Berlin

Website: www.ikosia.de

Email: info@ikosia.de

2. Why do we process your data?

For a more precise understanding, we will first explain a few of the essential terms:

• Personal data: Personal data is any information that relates to an identified or identifiable natural person. In other words, all information that can be used to establish a connection to you as a person.
• Processing: Processing is any operation related to personal data. This can be, for example, collecting, storing, organizing, changing or transmitting.
• Controller: The controller is the natural person, authority or institution that decides on the means and purposes of processing personal data.
• Consent: Consent is the voluntary declaration by the data subject of agreeing to the processing of personal data in a specific case.

By using the platform on the website www.ikosia.de, customers can carry out a non-binding current energy analysis for their property online and receive additional services, such as creating an individual renovation plan or applying for funding for the energy-related renovation of the property Commission IKOSIA. In addition, the customer has the option of viewing brokerage offers via the platform for the implementation of their construction project by building contractors, craftsmen, financial service providers or other service providers. To make this possible, we process the necessary data. If you do not wish to provide us with the required data, we cannot provide our services. We only process your data to the extent that this is possible for us in accordance with the applicable data protection regulations. Accordingly, we only process your data to the extent that this is necessary to provide the services you have requested, you have consented to the processing or we are otherwise authorized to do so based on data protection laws.

3. Which data do we process on the basis of which legal basis?

3.1 Registration for our newsletter

It is possible to register for our newsletter via our website. This requires you to provide your email address. We use your email address exclusively to regularly send you our newsletter with interesting information about our range of products and services. You can unsubscribe at any time, for example via a link at the end of each newsletter. Alternatively, you can send your request to unsubscribe at any time to info@ikosia.de. The legal basis for data processing for this is your consent in accordance with Article 6 Paragraph 1 Letter a) GDPR. You can revoke your consent at any time without affecting the permissibility of processing up to the point of revocation.

3.2 Visiting the website

When you access our website www.ikosia.de, your browser automatically sends information to our website server. This information is temporarily stored in a log file. The following information is recorded without your intervention and stored until it is automatically deleted:

• IP address of the requesting computer
• Date and time of access
• Name and URL of the retrieved file
• Website through which access is made (referrer URL)
• Browser used, if applicable
• the operating system of your computer

We use the data mentioned for the purposes of ensuring a smooth connection setup and comfortable use of our website, to evaluate system security and stability and for other administrative purposes. Data storage and hosting
We take the protection of your personal data very seriously. Our website is hosted on Amazon Web Services (AWS) servers located in Europe. AWS is a leading provider of cloud infrastructure services that offers high standards of security and privacy.
Location of servers: All data collected through our website is stored on servers in Europe. This ensures that your data is in accordance with the strict legal basis for data processing is Art. 6 Para. 1 lit. f) GDPR. Our legitimate interest follows from the data collection purposes listed above. Under no circumstances do we use the data collected for the purpose of drawing conclusions about you personally. For security reasons, our website uses SSL or TLS encryption. This means that data that you transmit via this website cannot be read by third parties. You can recognize an encrypted connection by the “https://” address line in your browser and by the lock symbol in the browser line. We also use appropriate technical and organizational security measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction or against unauthorized access by third parties.

3.3 Use of cookies

Our website uses so-called “cookies”. Cookies are small data packages and do not cause any damage to your device. They are stored on your device either temporarily for the duration of a session (session cookies) or permanently (persistent cookies). Session cookies are automatically deleted at the end of your visit. Permanent cookies remain stored on your device until you delete them yourself or your web browser automatically deletes them. In some cases, cookies from third-party companies may also be stored on your device when you visit our site (third-party cookies). These enable us or you to use certain third-party services. As such third-party cookies we use:

3.3.1 Google Analytics to analyze the use of our website. It is used to collect data about user behavior.

Processing company: Google Analytics is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When you visit our website, the following data is processed by Google, for example:

• pages accessed
• Your behavior on the pages (length of stay, clicks, scrolling behavior)
• Approximate location
• IP address
• Technical information such as browser, internet provider, device
• The legal basis for this data processing is your consent in accordance with Article 6 Paragraph 1 Letter a) GDPR. You can select this consent using the consent tool displayed when you first visit our website. Your consent can be revoked at any time. A revocation does not affect the lawfulness of the data processing that took place up to the time of revocation. It cannot be ruled out that Google will also process your data on servers in the USA. We have no influence on these processing activities. For data transfers to the USA, there is an adequacy decision by the EU Commission in accordance with Article 45 GDPR. The company Google LLC is certified according to the Data Privacy Framework and hereby guarantees a level of data protection comparable to that of the EU. Further information about Google Analytics can be found in Google's data protection regulations at https://support.google.com/analytics/answer/ 6004245?hl=de.

3.3.2 Hotjar may also process information provided by you as part of surveys and feedback functions included on our website. Processing company: Hotjar Limited, Dragonara Business Centre, 5th Floor, Dragonara Road, Paceville St Julian's STJ 3141, Malta

Data protection officer of the processing company This list contains all (personal) data collected by or through the use of this service:

• Date and time of the visit
• Device type
• Geographic location
• IP address
• Mouse movements
• Pages visited
• Referrer URL
• Screen resolution
• Unique device identifier
• Language information
• Device operating system
• Browser type
• Clicks
• domain name
• Unique user ID
• Answers to surveys
• Legal basis
• The required legal basis for the Vera is set out below
• Numerous cookies are technically necessary because certain website functions would not work without them (necessary cookies). Other cookies are used to evaluate user behavior or display advertising (optional cookies). Necessary cookies that are required to carry out the electronic communication process are stored on the basis of Art. 6 Para. 1 lit. f) GDPR. We have a legitimate interest in storing necessary cookies for the technically error-free and optimized provision of our services. We only use optional cookies after you have given your consent. You can select these when you first visit our website using the cookie consent tool. If consent to the storage of cookies is given, processing is carried out exclusively on the basis of this consent (Art. 6 Para. 1 lit. a) GDPR and Section 25 Para. 1 TTDSG). You can revoke your consent at any time without affecting the permissibility of processing up to the point of revocation.

3.4 Registration

Access to the user portal provided on the website www.ikosia.de is only possible with a user account. To create a user account, the following user data is required and processed:

• Date of registration
• Status of consents
• Operating system version
• Telephone number
• Address
• E-Mail

The scope of the data collected by IKOSIA depends on the registration and use of products and services. However, as described, entering the above user data is a prerequisite for registration and the associated comprehensive use of the products and services offered by IKOSIA. The legal basis for data processing is the contract concluded between you and IKOSIA upon registration in accordance with Article 6 Paragraph 1 Letter b) GDPR.

3.5 Contact and email communication

If you write to us, send an email or otherwise contact us, the information from the respective request including the contact details provided (in particular name, email, address) will be used to process the request, to enable smooth communication and in the event We store your follow-up questions. This data processing is necessary for the implementation and processing of the contractual relationship. The legal basis for data processing is Article 6 Paragraph 1 Letter b) GDPR. If you have been requested to give your consent in accordance with Article 6 Paragraph 1 Letter a) of the GDPR, your consent alone is the basis for data processing. You can revoke your consent at any time without affecting the permissibility of processing up to the point of revocation.

3.6 Data processing based on a contractual relationship

We process your data due to the creation, fulfillment and termination of a contractual relationship with you in accordance with our current terms and conditions. In this context, we process in particular your contact data (name, address, telephone number), contract data (data relating to the affected property or planning project) and other data provided for the contractual relationship. We process this data primarily to establish, implement and process the contractual relationship, to enable smooth communication with you, to transmit your data to external service providers commissioned by you or to comply with legal obligations. In addition, we also process your data in order to make suggestions to you about products or services from third parties that are related to the current state analysis we carry out or our commissioning by you. This processing is in our legitimate interest to provide you with the broadest possible range of services. The legal basis for the processing described is Article 6 Paragraph 1 Letter b), Article 6 Paragraph 1 Letter c) and 6 Paragraph 1 Letter f) GDPR. If you have been requested to give your consent in accordance with Article 6 Paragraph 1 Letter a) GDPR, this is the legal basis for the data processing in question. You can revoke your consent at any time, without affecting the permissibility of processing until its revocation is touched.

4. Sharing of Data

As a general rule, we only pass on your data to third parties if you have agreed to this or if there is another legal basis or obligation to do so. We only pass on your personal data within our company to employees who need it to successfully provide the contractual service. We may transfer your personal data to persons contractually linked to IKOSIA, to the extent that this is legally permissible within the scope of the purposes and legal bases set out. With your voluntary, separate and express consent in accordance with Art. 6 Para. 1 lit. a) GDPR, we will provide your contact details (name, e-mail) as well as property data for the construction project (street, postal code, city/country, if necessary further information on the Object) for the purpose of arranging and providing planning services or other services related to your request to external service providers who provide such planning or other services. The external service providers are their own responsible bodies within the meaning of the GDPR with regard to the processing of the transmitted data. Further information about our collaboration with external service providers can be found in our terms and conditions. You can revoke your consent at any time. A later revocation will not affect the lawfulness of the data processing carried out up to the revocation.

5. Storage and deletion

We store your data for as long as we need it to carry out the contractual relationship and provide our services to you. Personal data will be deleted no later than 3 years after the last request has been processed, unless we are legally obliged to retain it for a longer period. You have the right to object to us storing and processing your personal data at any time. The contractual relationship may not be able to be continued afterwards. We also store your data if we are obliged to do so in accordance with legal retention periods.

6. What rights do you have regarding your data?

6.1. Revocation of consent – ​​Art. 7 Para. 3 GDPR

If we process your data based on your consent, you can withdraw your consent at any time without this affecting the lawfulness of the processing before the withdrawal. We will continue to provide our services as long as they do not depend on the revoked consent. In order to exercise your right of withdrawal, you must inform us of your decision to withdraw your consent by means of a clear statement (e.g. a letter sent by post, SMS, WhatsApp or email) to the contacts mentioned above. If you make use of this option, we will immediately send you confirmation (e.g. by email) of receipt of such a revocation. If you revoke your consent, the processing of your data until then remains lawful. After revocation, your personal data can be further processed to the extent this is legally permissible, e.g. within the framework of statutory retention periods or in legal disputes before courts or authorities.

6.2. Information, correction and restriction – Articles 15, 16, 18 GDPR

Every data subject has the right to request information about the processing of their personal data. Please contact us at any time at info@ikosia.de. The right to information includes information about the purposes of processing, data and recipient categories, storage period, possible origin of your data, the existence of automated decision-making including profiling, as well as your rights in accordance with data protection regulations. You will find all of this in this data protection declaration and we will be happy to provide it to you in an electronic format upon request. If it turns out that some of your personal data is incorrect, you can request that your data be corrected or completed at any time. You also have the right to restrict data processing for the duration of any review of your request.

6.3. Deletion (“right to be forgotten”) – Art. 17 GDPR

Every data subject has the right to request the deletion of their personal data. Please contact us at any time at info@ikosia.de.

6.4. Data portability – Art. 20 GDPR

Finally, every data subject has the right to request that we transmit an overview of their personal data to another person responsible, to the extent that this is technically feasible.

6.5. complaints

If you are of the opinion that we are not sufficiently protecting your data protection rights, please contact us at any time at info@ikosia.de. We will take care of your concerns immediately. Otherwise, every affected person has the right to lodge a complaint with the supervisory authority responsible for IKOSIA.

Contact State Commissioner for Data Protection:

Berlin Commissioner for Data Protection and Freedom of Information Alt-Moabit 59-61 10555 Berlin Tel: +49 30 13889-0 Email: mailbox@datenschutz-berlin.de

7. What else you should know about the processing of your data

7.1. Purpose and security

We will only use your personal data for the purposes set out in this privacy policy and in the relevant consents. We ensure that any processing is limited to what is necessary for its purposes. Any processing will be carried out in a manner that ensures appropriate security and confidentiality of your personal data. This includes protection against unauthorized and unlawful processing, as well as against accidental loss, destruction, or damage through appropriate technical and organizational measures. To do this, we use strict internal procedures and security features, taking into account the state-of-the-art and implementation costs.

7.2. Storage and deletion

Your data is stored on your device and on our servers. We only use systems that meet the requirements of the GDPR. We delete your data when it is no longer needed for the purpose for which it was collected or you have withdrawn your consent to the corresponding processing. We will also delete your data no later than 3 years after the last request has been dealt with. To revoke your consent, please contact us at any time at info@ikosia.de. We will delete your data immediately, i.e. in this context, taking into account an appropriate period of time to examine the situation, which also includes a comprehensive inventory of your data. In exceptional cases, longer storage may be necessary to fulfill post-contractual obligations or statutory retention, or information obligations, or to assert, exercise, or defend legal claims (limitation periods).

7.3. Changes

Since technology and procedures on the Internet as well as data protection legislation are constantly evolving, we have to make adjustments from time to time. We will announce adjustments in advance in an appropriate manner and within a reasonable period of time and, if necessary, obtain new consent.