Data Protection Declaration

In line with the EU General Data Protection Regulation (GDPR)

The protection of your privacy is an important issue for ECOSPEED. We respect your identity and privacy and ensure their protection; we also process your personal data in line with applicable laws.

Personal data are all details and information that refer to a certain or identifiable person. These include e.g. your contact data such as your name, telephone number, address or e-mail address.

With this Data Protection Declaration, we inform you regarding which of your data we process, what we need these data for, how long we store them, and how you can object to collection of the data.

When we refer to processing your personal data in this Data Protection Declaration, we mean any way in which your personal data is handled. This includes storage, processing, use, deletion etc.

I. Name and address of the entity responsible

The entity responsible as defined by the General Data Protection Regulation and other national data privacy protection legislation of the Member States as well as other regulations in compliance with data protection legislation is:

ECOSPEED AG
Drahtzugstrasse 18
CH-8008 Zürich
Telephone: +41 (0)44 388 95 00
Telefax: +41 (0)44 388 95 09
Web: www.ecospeed.ch
E-mail: info@ecospeed.ch

Registered office: Zurich
Commercial register: CH-020.3.025.987-5
VAT ID: CHE-109.660.752
Represented by company management:
Christoph Hartmann, CEO

II. General aspects of data processing

1. Scope of processing personal data

As a general principle, we only process personal data of our users where this is required to provide a functioning website and our software tools. The processing of personal data of our users takes place with the consent of the users. An exception applies in such cases in which obtaining consent beforehand is not possible for practical reasons and processing the data is permitted by legal regulations.

2. Legal basis for processing personal data

Insofar as we obtain the consent of the person concerned for the processing of personal data, Article 6, Paragraph 1, lit. a, of the GDPR serves as the legal basis.

The legal basis for the processing of personal data that are required to fulfill a contract where the contracting party is the person concerned is Article 6, Paragraph 1, lit. b, of the GDPR.

To the extent that processing personal data is required to fulfill a legal obligation which our company must comply with, Article 6, Paragraph 1, lit. c, of the GDPR serves as the legal basis.

In the event that vital interests of the person concerned or of another natural person mean that processing personal data is required, Article 6, Paragraph 1, lit. d, of the GDPR serves as the legal basis. If this processing is required to assert a legitimate interest of our company or of a third party, and the interests, fundamental rights and freedoms of the person concerned do not outweigh that interest, Article 6, Paragraph 1, lit. f, of the GDPR serves as the legal basis for processing.

3. Data deletion and storage duration

The personal data of the person concerned are deleted or anonymized as soon as the purpose of the storage no longer applies. Over and above this, storage can take place if it is stipulated by European or national legislation in Union legal ordinances, laws or other regulations to which the person responsible is subject. Deletion or anonymization of the data also takes place if a period of storage prescribed by the above standards expires, unless there is a need for the data to remain stored for contract conclusion or contract fulfillment.

4. SSL encryption

In order to protect your data in the best possible way, our internet site and the online tools use SSL encryption. You can recognize connections encrypted in this way from the address "https://" in the site link of your browser. Thanks to SSL encryption, none of the data that you transfer to this internet site – for example, requests for quotations, registrations, orders or contact forms – can be read by third parties.

III. Provision of the website and creation of log files

1. Description and scope of data processing

Every time our internet site is viewed, our system automatically records data and information from the viewing computer system.

The following data of the user are collected in this context:

  • Information regarding the user agent (operating system as well as browser type)
  • Domain
  • IP addresses
  • Referrer (who recommended the user)
  • Date and time of the access
  • Tool-internal cookies (cf. section V. Use of cookies)
  • Form details for a demo account (cf. section IV. Provision of the ECOSPEED online tools)
  • Newsletter registration (cf. point VI. Newsletters and customer information)

2. Legal basis for data processing

Article 6, Paragraph 1, lit. f, of the GDPR is the legal basis for the temporary storage of the data and log files.

3. Purpose of data processing

Log files are stored in order to ensure the functional capability of the website. The data of the tools are also used for the purposes of both security and support. An evaluation of the data for the purposes of marketing does not take place in this context. These purposes also define our legitimate interest in data processing in line with Article 6, Paragraph 1, lit. f, of the GDPR.

4. Duration of storage

The data are deleted from the logs after 12 months at the latest.

5. Cancellation and removal option

The recording of data for provision of the website and the storage of data in log files is imperative for operation of the internet site. Consequently, there is no right of objection on the part of the user.

IV. Provision of the ECOSPEED online tools

1. Description and scope of data processing

On registration of our software tools, whether for test purposes in a demo account or in the course of ordering a license, data are collected in the input screen and sent to us so that we can set up your account accordingly.

As a rule, the following data of the user are obtained (can deviate slightly depending on the tool involved):

  • E-mail address*
  • Form of address*
  • First name*
  • Last name*
  • Telephone number
  • Region or company designation*
  • User name*
  • Country, region where applicable*
  • Details relevant to calculation of the price and license (e.g. number of inhabitants)*

* = mandatory entries


When our tools are used, the following information is also logged:

  • Information regarding the user agent (operating system as well as browser type)
  • Domain
  • IP addresses
  • Referrer (who recommended the user)
  • The start, certain events (such as loading, saving, changing data), and the end of the session per time and tool page
  • Tool-internal cookies (cf. section V. Use of cookies)

Under certain circumstances, we use the services of Google Maps and YouTube in the software tools. In the process, neither personal data nor balance data are transferred to these services.


2. Legal basis for data processing

Article 6, Paragraph 1, lit. b, of the GDPR is the legal basis for the processing of personal data that are required to fulfill a contract where the contracting party is the person concerned. Article 6, Paragraph 1, lit. f, of the GDPR is the legal basis for the temporary storage of the data and log files.

3. Purpose of data processing

The storage of collected data is necessary to enable access to the online tools and to set up the accounts in line with customer wishes (e.g. sending a confirmation e-mails on registration or order placement, license and community assignment, corresponding user setup, including user rights and roles), to calculate the corresponding license costs, and to enable invoicing.

Your personal data are used for the sole purpose of tool operation, for delivery of customer information or newsletters, and for possible advisory discussions. Your data will not be passed on to third parties. It is also possible that ECOSPEED will use the anonymized balance data for statistical evaluations and benchmarks (also after a license to use has expired). Region and company names may also be listed on the ECOSPEED website for reference purposes following cancellation, but without specifying any personal data.

Log files are stored in order to ensure the functional capability of the tools. The data are also used to optimize the tools for the purposes of both security and support. An evaluation of the data for the purposes of marketing does not take place in this context.

Communities

In the online tools, customers can come together to form "communities". In joining a community or a number of communities, users allow these communities insight into their balance data and personal data (name, e-mail, telephone number). Community operators undertake to use the data of members only for the intended purpose and within reason. The responsibility for this lies with the community operator.

4. Duration of storage

Your user data are blocked and/or deleted as soon as they are no longer required to achieve the purpose for which they were obtained.

a) On expiration of a test phase in the demo account:

2 months after expiration of the test license, all of your data are deleted. During this period, ECOSPEED reserves the right to contact you to clarify your needs or to obtain reports on your experience (per e-mail or by telephone).

b) Following cancellation of a license:

Following cancellation of a license, your user data are blocked immediately. At the latest 6 months after expiration of the license, personal data are anonymized and/or pseudo-anonymized so that it is no longer possible to draw conclusions regarding your identity. During this period, ECOSPEED reserves the right to contact you to clarify your needs or to obtain reports on your experience (per e-mail or by telephone).

The data are stored as default in backups for 5 years in order to ensure rapid and uncomplicated data recovery (Article 32, Paragraph 1, lit. b, of the GDPR), e.g. in the event of loss of data or the resumption of municipal balancing activities (usually after a political legislature period), as well as for the purpose of data integrity, but also as defense against possible legal claims (cf. Article 17, Paragraph 3, lit. e, of the GDPR). Here, the anonymized data may also be used by ECOSPEED for statistical purpose. After 5 years, all data are deleted in full.

To ensure data integrity, the backups are encrypted using only the latest methods and stored in data centers with certified security.

5. Cancellation and removal option

The recording of data for provision of the tools and the storage of data in log files are imperative for operation of the tools. Consequently, there is no right of objection on the part of the user. Following expiration of a license, users can have the storage periods for personal data shortened or request anonymization of the personal data within 2 months.

V. Use of cookies

1. Description and scope of data processing

Our online tools use cookies. Cookies are text files that are stored in the internet browser or are stored by the internet browser on the computer system of the user.

Under certain circumstances, the following cookies are written by our online tools:

  • Session ID (for identification of the browser between page views)
  • Language setting (to output the tools in the same language in which the user last worked)
  • Load balancer data (for performance optimization)
  • Application version (to support various program versions)

We only read our own cookies as described above, i.e. not cookies of other websites, e.g. tracking or advertising cookies.


2. Legal basis for data processing

The legal basis for the processing of personal data using technically necessary cookies is Article 6, Paragraph 1, lit. f, of the GDPR.
With the consent of the user, the legal basis for the processing of personal data using cookies for the purposes of analysis is Article 6, Paragraph 1, lit. a, of the GDPR.

3. Purpose of data processing

The purpose of using cookies is to improve the quality of our website and tools as well as their content. The sessions are logged for the purposes of security and support.
These purposes also define our legitimate interest in processing personal data in line with Article 6, Paragraph 1, lit. f, of the GDPR.

4. Duration of storage, cancellation and removal option

Cookies are stored on the computer of the user and transferred from there to our site. You as a user therefore also have full control over the use of cookies. You can disable or restrict the transfer of cookies by changing the settings in your internet browser. Cookies that have already been saved can be deleted at any time; this can also take place automatically. Cookies can be disabled for our website. Session cookies are an exception here: If these are disabled, use of the online tools is no longer possible for technical reasons.

VI. Newsletters and customer information

1. Description and scope of data processing

On our internet site, there is the possibility to subscribe to a newsletter free of charge. When you register for the newsletter, the following data are sent to us:

  • E-mail address*
  • Form of address*
  • First name*
  • Last name*
  • Company
  • Language*
  • IP addresses of the viewing computer
  • Date and time of registration

* = mandatory entries


Your consent to the processing of the data is obtained within the framework of the registration and you are referred to this Data Protection Declaration.

If you purchase licenses on our internet site and, in doing so, provide your e-mail address, we then can use this to send tool-related customer information (e.g. data releases, program updates). In our newsletters and customer information, you are informed exclusively regarding similar products or services.

In the context of data processing for the dispatch of newsletters and customer information, no data are passed on to third parties. The data are used exclusively for the dispatch of the newsletter and/or customer information. E-mail tracking is not used, either.

2. Legal basis for data processing

Where the user has given their consent, the legal basis for the processing of data following registration for the newsletter is Article 6, Paragraph 1, lit. a, of the GDPR.
The legal basis for the dispatch of the newsletter as a consequence of the sale of products or services is Article 7, Paragraph 3, of the [German] Unfair Competition Act.

3. Purpose of data processing

The purpose of obtaining the e-mail address of the user is to be able to send the newsletter or customer information. The purpose of obtaining other personal data within the framework of the registration is to prevent misuse of the services or the e-mail address that is used.

4. Duration of storage

Your personal data are blocked and/or deleted as soon as they are no longer required to achieve the purpose for which they were obtained. This means that the e-mail address of the user is used for as long as the subscription for the newsletter or the license is valid. If you cancel the newsletter or customer information, your e-mail address is immediately removed from the distribution list (black list). After a period of 6 months at the latest, the data are automatically deleted and/or anonymized by ECOSPEED so that it is no longer possible to draw conclusions regarding your identity.

5. Cancellation and removal option

The subscription for the newsletter can be canceled by the user concerned at any time in order to ensure immediate deletion from the distribution list. For this purpose, each newsletter contains a corresponding cancellation link. Established customers also have the possibility at any time to be excluded from delivery of the tool-related customer information and to notify us of this orally or in writing.

VII. Specialist consultants, training partners, and cooperation partners

1. Description and scope of data processing

ECOSPEED has established a sales and consultant network consisting of specialist consultants, training partners, and cooperation partners. The partners offer ECOSPEED software solutions on the market and in turn receive an ECOSPEED certificate as well as the possibility to be listed with their organization name, name, and telephone numbers on our website for the purposes of promotion.

The following data are collected in the course of a cooperation agreement:

  • E-mail address*
  • Form of address*
  • First name
  • Last name*
  • Telephone number*
  • Company name*

* = mandatory entries


Your consent to the processing of the data is obtained within the framework of the contract and you are referred to this Data Protection Declaration.

As a consequence, we can use the specified e-mail addresses to send tool-related information (e.g. data releases, program updates). The customer information exclusively covers similar products or services.


2. Legal basis for data processing

The legal basis for processing the data for fulfillment of a cooperation agreement is Article 6, Paragraph 1, lit. b, of the GDPR.
Article 7, Paragraph 3, of the [German] Unfair Competition Act is the legal basis for the delivery of customer information as a consequence of the sale of products or services.

3. Purpose of data processing

The purpose of obtaining the data is to list the cooperation partner appropriately on the ECOSPEED website so that they can be found and contacted by potential customers or also obtain access to the tools. The purpose of obtaining other personal data is to prevent misuse of the services or the e-mail address that is used.

4. Duration of storage

On termination or dissolution of the contractual relationship, all data are deleted from the ECOSPEED website and the e-mail address is blocked for customer information. The personal data are deleted and/or anonymized as soon as they are no longer required to achieve the purpose for which they were obtained (and taking account of the usual retention requirements).

5. Cancellation and removal option

The recording of data is contractually agreed and is imperative in order to enter into a cooperation. There is no right of objection on the part of the user.

VIII. Rights of the person concerned

If your personal data are processed, you are a person concerned as defined by the GDPR and you have the following rights vis-à-vis the entity responsible:

1. Right to obtain information

You can request from the entity responsible a confirmation of whether we process personal data that concern you.
If such processing is taking place, you can request the following information from the entity responsible:

  • the purpose for which the personal data are being processed;
  • the categories of personal data that are being processed;
  • the recipients and/or categories of recipient to whom your personal data has been revealed or will be revealed;
  • the planned duration of storage of your personal data; if specific details of this are not possible, criteria for specification of the storage duration;
  • the existence of a right to correction or deletion of your personal data, of a right to restrict processing by the entity responsible or a right to object to this processing;
  • the existence of a right to lodge a complaint with a supervisory authority;
  • all available information regarding the origin of the data if the personal data were not obtained from the person concerned;
  • the existence of an automated decision, including profiling in accordance with Article 22, Paragraphs 1 and 4, of the GDPR, and – at least in these cases – meaningful information regarding the logic involved as well as the scope and consequences and intended effects of processing of this nature for the person concerned. You have the right to request information as to whether your personal data are transferred into another country or to an international organization. In this context, you can request to be notified regarding the suitable guarantees according to Article 46 of the GDPR in relation to this transfer.

2. Right to correction

You have a right to correction and/or completion vis-à-vis the entity responsible in the event that the processed personal data that concern you are incorrect or incomplete. The entity responsible must perform the correction immediately.

3. Right to restriction of the processing

Subject to the following conditions, you can request a restriction of the processing of your personal data:

  • if you dispute the correctness of your personal data for a period that enables the entity responsible to check the correctness of the personal data;
  • the processing is illegal and you do not request deletion of the personal data, but request a restriction in the use of the personal data instead;
  • the entity responsible no longer requires the personal data for the purpose of processing, but you require them to assert, exercise or defend legal claims, or
  • if you have lodged an objection to the processing in accordance with Article 21, Paragraph 1, of the GDPR and it has not yet been decided whether the legitimate reasons of the entity responsible outweigh your reasons.

If the processing of your personal data has been restricted, these data – apart from their storage – may only be processed with your consent or to assert, exercise or defend legal claims or to protect the rights of another natural person or legal entity or for reasons related to important public interest of the Union or of a Member State. If the restriction of the processing has been limited in line with the above-mentioned requirements, you are notified by the entity responsible before the restriction is lifted.


4. Right to deletion

a) Duty to delete

You can request that the entity responsible delete your personal data immediately and the entity responsible is under obligation to delete these data if one of the following reasons applies:

  • Your personal data are no longer necessary for the purposes for which they were obtained or otherwise processed.
  • You revoke the consent on which the processing was based according to Article 6, Paragraph 1, lit. a, or Article 9, Paragraph 2, lit. a, of the GDPR and there is no other legal basis for the processing.
  • In accordance with Article 21, Paragraph 1, of the GDPR, you lodge an objection to the processing and there are no legitimate reasons with higher priority for the processing, or, in accordance with Article 21, Paragraph 2, of the GDPR, you lodge an objection to the processing.
  • Your personal data have been processed illegally.
  • The deletion of your personal data is required for compliance with a legal obligation in line with Union law or the law of the Member States that governs the entity responsible.
  • Your personal data were obtained with regard to services offered by the information society in accordance with Article 8, Paragraph 1, of the GDPR.

b) Information to third parties

If the entity responsible has placed your personal data in the public domain and they are under obligation according to Article 17, Paragraph 1, of the GDPR to delete the data, they shall initiate appropriate measures, also of a technical nature, taking account of the available technology and implementation costs, to notify those responsible for processing the personal data that you, as the person concerned, have requested the deletion of all links to these personal data or copies or replications of these personal data.


c) Exceptions

The right to deletion does not apply where processing is required

  • to exercise the right to free speech and freedom of information;
  • to comply with a legal obligation that requires processing in line with the law of the Union or of Member States to which the entity responsible is subject, or to perform a task in the public interest, or to exercise public authority that has been assigned to the entity responsible;
  • for reasons of public interest in the area of public health in accordance with Article 9, Paragraph 2, lit. h and i, as well as Article 9, Paragraph 3, of the GDPR;
  • for archiving or for scientific or historical research purposes or for statistical purposes in the public interest according to Article 89, Paragraph 1, of the GDPR, provided the right stated under section a) is likely to make the achievement of the objectives of this processing impossible or seriously compromise the achievement of these objectives, or
  • to assert, exercise or defend legal claims.

5. Right to notification

If you have asserted your right to correction, deletion or restriction of the processing vis-à-vis the entity responsible, they are under obligation to notify all recipients to whom your personal data has been revealed regarding this correction or deletion of the data or restriction of the processing, unless this turns out to be impossible or involves unreasonably high overhead. You have the right vis-à-vis the entity responsible to be informed regarding these recipients.

6. Right to data transfer

You have the right to receive the personal data that you have provided in a structured, commonly available, and machine-readable format, and to transfer these data to another entity responsible.

7. Right to objection

You have the right, for reasons arising out of your particular situation, to lodge an objection to the processing of your personal data based on Article 6, Paragraph 1, lit. e or f, of the GDPR; this also applies to profiling based on these regulations. The entity responsible no longer processes your personal data, unless they can prove there are reasons worthy of protection that make processing imperative and these outweigh your interests, rights, and freedoms or the processing is used to assert, exercise or defend legal claims. If your personal data are processed for the purposes of direct marketing, you have the right at any time to lodge an objection to the processing of your personal data for the purpose of advertising of this nature; this also applies to profiling insofar as it is related to such direct marketing. If you object to processing for the purpose of direct marketing, your personal data will no longer be processed for this purpose. In the context of using services of the information society – irrespective of Directive 2002/58/EU – you have the possibility to exercise your right to object by means of automated procedures in which technical specifications are used.

8. Right to revoke the declaration of consent in compliance with data protection legislation

You have the right to revoke your declaration of consent in compliance with data protection legislation at any time. Revoking the consent does not affect the legality of the processing that has taken place based on that consent.

9. Automated decision in individual cases, including profiling

You have the right not to be bound by a decision based exclusively on automated processing – including profiling – which has legal consequences for you or in a similar manner negatively affects you to a considerable degree. This does not apply if the decision

  • is required for the conclusion or performance of a contract between you and the entity responsible;
  • is permitted on the basis of legal regulations of the Union or Member States that govern the actions of the entity responsible and these legal regulations include appropriate measures to uphold your rights and freedom as well as your legitimate interests; or
  • is made with your express consent.

However, these decisions may not be based on special categories of personal data according to Article 9, Paragraph 1, of the GDPR unless Article 9, Paragraph 2, lit. a or g, of the GDPR applies and appropriate measures to protect your rights and freedoms as well as your legitimate interests have been implemented. With regard to the cases stated in (1) and (3), the entity responsible shall initiate appropriate measures to protect your rights, freedoms, and legitimate interests, including at least the right to demand the intervention of a person at the entity responsible, to present your own standpoint, and to object to the decision.


10. Right of complaint to a supervisory authority

Irrespective of any other administrative-legal or judicial remedy, if you are of the opinion that processing your personal data infringes the GDPR you have the right to lodge a complaint with supervisory authorities, particularly in the Member State in which you and/or your workplace are located or in the location of the alleged infringement. The supervisory authorities to which the complaint has been submitted notifies the complainant regarding the status and results of the complaint, including the possibility of a judicial remedy in line with Article 78 of the GDPR.

IX. Changes to this Data Protection Declaration

We reserve the right to alter and supplement this declaration at any time and at our own discretion. Please consult this declaration regularly.

Last update: May 2018