App Privacy Policy

General information

This Privacy Policy explains the nature, scope, and purpose of the processing of personal data within our app and its associated features and content. Our Privacy Policy is designed to be simple and easy to understand for everyone. This Privacy Policy generally uses the official terms of the General Data Protection Regulation (GDPR). The official definitions are explained in Article 4 of the GDPR.

Who is responsible for data processing?

ESFORIN SE
Ruhrallee 201
45136 Essen
+49.201.220.38-100
info@esforin.com

Contact Details of the Data Protection Officer

Proliance GmbH / www.datenschutzexperte.de
Data Protection Officer
Leopoldstr. 21
80802 Munich
datenschutzbeauftragter@datenschutzexperte.de

When contacting the Data Protection Officer, please specify the company to which your inquiry relates. Please refrain from including sensitive information, such as a copy of your ID, with your inquiry.

Data collection in the context of app use

We take the protection of your data very seriously. We treat your personal data confidentially and in accordance with applicable data protection laws and this Privacy Policy.

With our app, we offer our customers an interface to our digital energy services.

When you download our app, register or log in to the app and use the app, various personal data are processed.

Personal data is data that can be used to identify you personally. This Privacy Policy explains what data we collect and how we use it. It also explains how and for what purpose this is done.

Access to and Storage of Information on Terminal Equipment

By using our app, information (e.g. IP address) may be accessed or information (e.g. cookies) may be stored in your end devices. This access or storage may involve further processing of personal data within the meaning of the GDPR.

In cases where such access to or storage of information is absolutely necessary for the technically flawless provision of our services, this is done in accordance with § 25(1), sentence 1, and (2), no. 2 of the TTDSG.

In cases where such processing serves other purposes (e.g., tailoring our app to your needs), it is carried out on the basis of Section 25(1) of the TTDSG only with your consent in accordance with Article 6(1)(a) of the GDPR. You may revoke your consent at any time with future effect. The processing of your personal data is subject to the provisions of the GDPR and the Federal Data Protection Act (BDSG).

For more information about the processing of your personal data and the relevant legal bases in this context, please refer to the following sections on the specific processing activities in our app.

Information that is collected when the app is downloaded

When you download the app, certain required information is transmitted to the app store you have selected (Google Play Store, Apple App Store). In particular, the following information may be processed: your username, email address, account number, the time of the download, payment information, and your device’s unique identifier. We have no control over this data collection and are not responsible for it. The contract is concluded with the respective store provider and is handled in accordance with that provider’s terms and conditions and privacy policy. In connection with your use of the app stores, we process only the reviews you post about our app and associated data, and we receive anonymous statistics from the app stores—for example, regarding download numbers, uninstalls, and crashes.

Hosting

We operate our app services in the EU. We use Microsoft Azure AD B2C for user identification. Azure AD B2C is a CIAM (Customer Identity and Access Management) solution that supports millions of users and billions of authentications per day. It ensures the scalability and security of the authentication platform, as well as the monitoring and automatic handling of threats such as denial-of-service, password-spraying, or brute-force attacks.

Data processing when using the app

As part of your use of the app, we automatically collect certain data that is necessary for the provision and use of the app. The following data is processed for this purpose: time of access, IP address, and content of the access.

This data is automatically transmitted to us in order to provide you with the service and its associated features, and to prevent and resolve misuse and malfunctions.

This data processing is justified by the fact that it is necessary for the performance of the contract between you, as the data subject, and us, in accordance with Article 6(1)(b) of the GDPR, for the use of the app.

Technical functions of the app

To fully use our services, the app requires the following permissions:

Internet access: This is required to save your entries on our servers.

Push Notifications: This is required to send you targeted push notifications about operational information and news.

Permissions to access the features listed above will be explicitly requested no later than the first time they are used on the device and can be accepted or denied.

If you have granted the individual permissions, the associated processing of your data is based on your consent pursuant to Article 6(1)(a) of the GDPR. You may revoke any consent you have granted at any time with future effect. A granted permission can normally be revoked at any time in the device’s settings (however, this depends on the device and the operating system, over which we have no control). The lawfulness of data processing that has already taken place remains unaffected by the withdrawal. Please note that permissions that have not been granted may restrict the use of the app.

Creation of a user account (registration) and login

You can download our app from the App Store without registering with us. We do not collect any personal data when you download the app. Nor does the App Store provider share any personal data with us. However, you can only use our app if you register via Microsoft Azure user authentication. We use Microsoft Azure AD B2C for user authentication. Azure AD B2C is a CIAM (Customer Identity and Access Management) solution that supports millions of users and billions of authentications per day. It ensures the scalability and security of the authentication platform, as well as the monitoring and automatic handling of threats such as denial-of-service, password-spraying, or brute-force attacks.

In addition, for registration, we need your first and last names, company name, and the email address associated with your Microsoft Azure user account.

The data entered during registration is processed to fulfill a contract with the user or to take steps prior to entering into a contract (Art. 6(1)(b) GDPR).  Any additional voluntary information is processed based on your voluntary consent (Art. 6(1)(a) GDPR). You may revoke any consent you have given at any time with future effect. To do so, simply send an informal email to the contact information for the data controller provided above. The lawfulness of data processing that has already taken place remains unaffected by the withdrawal of consent.

Furthermore, based on our legitimate interest pursuant to Article 6(1)(f) of the GDPR in ensuring the functionality and error-free operation of the app and in detecting misuse, we collect and process the following data when you use the app:

• Date of your registration
• Date of your last login

Contact us via contact form, e-mail or telephone

If you submit inquiries to us via the contact form, email, or phone, we will store the information you provide in the inquiry form or your email—including any personal data you provide there—for the purpose of processing your inquiry and in case of follow-up questions. We will not disclose this data under any circumstances without your consent. The legal basis for processing this data is our legitimate interest in responding to your inquiry pursuant to Article 6(1)(f) of the GDPR, as well as, where applicable, Article 6(1)(b) of the GDPR, if your inquiry is aimed at entering into a contract.

Your data will be deleted once your request has been fully processed, provided there are no legal retention requirements to the contrary. In cases falling under Article 6(1)(f) of the GDPR, you may object to the processing of your personal data at any time.

Data Disclosure and Recipients

Your personal data will not be disclosed to third parties, unless we have explicitly indicated this in the description of the respective data processing, unless you have given your explicit consent pursuant to Article 6(1), sentence 1, subparagraph (a) of the GDPR, the disclosure is necessary pursuant to Article 6(1)(f) of the GDPR to assert, exercise, or defend legal claims, and there is no reason to believe that you have an overriding legitimate interest in preventing the disclosure of your data, in the event that there is a legal obligation to disclose data pursuant to Article 6(1), sentence 1, letter c of the GDPR, and to the extent that this is necessary pursuant to Article 6(1), sentence 1, letter b of the GDPR for the performance of contractual relationships with you.

In addition, we use external service providers to deliver our services; we have carefully selected these providers, commissioned them in writing, and, where necessary, entered into data processing agreements with them in accordance with Article 28 of the GDPR. These providers are bound by our instructions and are regularly monitored by us. These include, among others, service providers for app hosting, email delivery, and the maintenance and support of our IT systems. The service providers will not disclose this data to third parties.

Duration of the Storage of Personal Data

The duration of the storage of personal data is determined by the applicable statutory retention periods (e.g., under commercial and tax law). Once the respective retention period has expired, the corresponding data is routinely deleted. If data is necessary for the performance of a contract or for entering into a contract, or if we have a legitimate interest in continuing to store the data, the data will be deleted when it is no longer necessary for these purposes or when you exercise your right of withdrawal or objection.

Your Rights

Below you will find information on the rights granted to you under applicable data protection law with respect to the controller regarding the processing of your personal data:

The right, pursuant to Article 15 of the GDPR, to request information about your personal data that we process. In particular, you may request information regarding the purposes of processing, the categories of personal data, the categories of recipients to whom your data has been or will be disclosed, the planned retention period, the existence of a right to rectification, erasure, restriction of processing, or objection; the existence of a right to lodge a complaint; the origin of your data, if it was not collected by us; and the existence of automated decision-making, including profiling, and, where applicable, meaningful information regarding its details.

The right, pursuant to Article 16 of the GDPR, to request the immediate rectification of inaccurate personal data or the completion of your personal data stored by us.

The right, pursuant to Article 17 of the GDPR, to request the erasure of your personal data stored by us, unless the processing is necessary for the exercise of the right to freedom of expression and information, to comply with a legal obligation, for reasons of public interest, or to assert, exercise, or defend legal claims.

The right, pursuant to Article 18 of the GDPR, to request the restriction of the processing of your personal data if you contest the accuracy of the data, if the processing is unlawful but you oppose its erasure, and if we no longer need the data but you require it to assert, exercise, or defend legal claims, or you have objected to the processing pursuant to Article 21 of the GDPR.

The right, pursuant to Article 20 of the GDPR, to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format, or to request that it be transferred to another controller.

The right to lodge a complaint with a supervisory authority pursuant to Article 77 of the GDPR. As a general rule, you may contact the supervisory authority of the federal state where our registered office is located, as indicated above, or, if applicable, the supervisory authority of your usual place of residence or workplace.

The right to withdraw consent pursuant to Article 7(3) of the GDPR: You have the right to withdraw your consent to the processing of your data at any time, with effect for the future. In the event of withdrawal, we will delete the relevant data immediately, unless further processing can be based on a legal basis that does not require consent. The withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent prior to the withdrawal.

Right of Objection

If we process your personal data on the basis of legitimate interests pursuant to Article 6(1), first sentence, subparagraph (f) of the GDPR, you have the right under Article 21 of the GDPR to object to the processing of your personal data, provided that such objection is based on grounds arising from your particular situation. If the objection is directed against the processing of personal data for the purposes of direct marketing, you have a general right to object without being required to specify a particular situation.

If you wish to exercise your right of withdrawal or right to object, simply send an email to datenschutz@esforin.com

Legal Obligations

The provision of personal data for the purpose of deciding whether to enter into a contract, fulfilling a contract, or carrying out precontractual measures is voluntary. However, we can only make a decision in the context of contractual measures if you provide the personal data necessary for the conclusion of a contract, the performance of a contract, or precontractual measures.

Automated decision-making / profiling

There is no automated decision-making or profiling as defined in Article 22 of the GDPR.

Changes and Updates to This Privacy Policy

We reserve the right to amend or update this Privacy Policy as necessary, in accordance with applicable data protection regulations. This allows us to bring it into line with current legal requirements and to reflect changes to our services, such as the introduction of new services. The most recent version applies to your visit.

Date of this Privacy Policy: November 9, 2023