Privacy policy

Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Sunwires GbR
Mühlemattweg 19
79539 Lörrach
Represented by the partners: Enrico S. Barbera, Paramie S. Willmann, Lukas J. Welti, Volker Eschbach
Phone: +49 172 5366001
Email: info@sunwires.com

We have not appointed a data protection officer because the legal requirements for doing so (Art. 37 GDPR, § 38 BDSG) do not apply to us. For any privacy questions, write to the email address above.

Founding of Sunwires GmbH

The partners are currently founding Sunwires GmbH. Once founded, the GmbH will take over the business, including open requests and quotes. Your data will then pass to Sunwires GmbH, which will continue to process it as the new controller for the purposes described here. The legal basis is Art. 6(1)(b) GDPR (continuing your request) and Art. 6(1)(f) GDPR (our legitimate interest in continuing the business without interruption). You can object to the transfer at any time; we will then delete your request. We will update this policy when the GmbH is founded.

Hosting, servers and email

We run this website, our database and our internal sales system on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The servers are located in a data centre in Finland (EU). Our mailboxes are also hosted by Hetzner. Hetzner processes the data solely on our behalf under a data processing agreement (Art. 28 GDPR).

The connection to our website is encrypted with TLS.

Visiting the website

When you visit our website, your browser sends technically necessary data to our server: IP address, date and time, requested address, amount of data transferred, browser and operating system, and the previously visited page (referrer). We need this data to deliver the pages and keep the service secure (Art. 6(1)(f) GDPR).

Our web server logs do not store your IP address. To protect against abuse and automated mass requests, our server counts requests per IP address in memory only; these counters are discarded after 24 hours at the latest (Art. 6(1)(f) GDPR).

Home check and quote request

In the home check we ask for the details we need for an estimate and a quote:

• your interest (solar system, battery, wallbox)
• address and location of the building (street, house number, postcode, town, federal state, coordinates) and your confirmation of the roof on the aerial image
• house type, roof shape, monthly electricity costs, whether you own the house, planned heat pump or electric car
• first name, email address, optionally phone number, and whether you want a link or a call back

From these details we calculate an estimate (system size, yield, savings, price) and prepare your quote. The legal basis is Art. 6(1)(b) GDPR (pre-contractual steps at your request). Providing the details is not required by law or contract, but without a first name and email address we cannot send you a quote.

During the home check your browser keeps your answers in session storage (sessionStorage) so they are not lost when the page reloads. It is cleared when you close the tab. This access is strictly necessary for the service you requested (§ 25(2) no. 2 TDDDG).

After you submit, we store the request in our database and transfer it to our internal sales system; our sales team also receives an email notification. The estimate is calculated automatically. No automated decision with legal effect (Art. 22 GDPR) is made: if your roof is less suitable, we offer you a personal consultation instead of a price.

Your personal quote link

You reach your quote through a personal link with a random identifier. Anyone who knows this link can see the quote with your name and address, so only share it with people who should see the quote. Quote pages are blocked for search engines.

Services your browser contacts during the home check

For the address search, building outline and aerial image, your browser fetches data directly from the providers below during the home check. For technical reasons they receive your IP address and browser details as well as the search term or the coordinates of the chosen address, but not your name or contact details:

• Address search: Photon by komoot GmbH, Potsdam, Germany (photon.komoot.io)
• Postcode, town and federal state: OpenPLZ API (openplzapi.org)
• Building outlines: OpenStreetMap API of the OpenStreetMap Foundation, United Kingdom (api.openstreetmap.org), alternatively Overpass servers (overpass-api.de, Germany; overpass.kumi.systems and overpass.private.coffee, Austria)
• Aerial images: geodata services of your federal state surveying office (Baden-Württemberg, Bavaria, Berlin, Brandenburg, North Rhine-Westphalia, Saxony, Thuringia)
• Only if no state service is available for your federal state or it does not respond: Esri World Imagery by Esri Inc., Redlands, USA (server.arcgisonline.com)

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is to provide the address search and roof view you use. The EU Commission has issued an adequacy decision for the United Kingdom. When Esri aerial images are loaded, your IP address may be transferred to the USA; an adequate level of data protection exists there only if the recipient is certified under the EU-US Data Privacy Framework. If you want to avoid these requests, ask for your quote by phone or email.

Services our server contacts

For the roof analysis our server sends the coordinates of the address you chose to the Google Solar API (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; processing also by Google LLC, USA). Google only receives the coordinates, not your IP address, name or contact details. Google LLC is certified under the EU-US Data Privacy Framework (adequacy decision, Art. 45 GDPR). We store the results per building without reference to you and request them again after 30 days at the earliest.

If no roof analysis is possible, our server requests the typical solar yield for the coordinates from PVGIS, a service of the European Commission Joint Research Centre (Ispra, Italy).

The legal basis in both cases is Art. 6(1)(b) GDPR (preparing the estimate you requested).

Contact by email, phone or WhatsApp

If you contact us by email or phone, we process your details to handle your request (Art. 6(1)(b) GDPR for questions about a quote or contract, otherwise Art. 6(1)(f) GDPR).

Our WhatsApp links open WhatsApp, a service of WhatsApp Ireland Limited, Dublin, Ireland. Data may be transferred to Meta Platforms Inc. in the USA (certified under the EU-US Data Privacy Framework). Messages sent via WhatsApp are also subject to the WhatsApp privacy policy. If you do not want this, please use phone or email.

Customer management

Your request from the house check (name, e-mail address, phone number, address of the building, your answers and our estimate) as well as later offers and appointments are managed in our internal sales system.

The legal basis is Art. 6 (1) (b) GDPR (handling your request and performing the contract). Retention follows the section “Retention”.

Newsletter

For the newsletter we only need your e-mail address. After signing up (in the footer or in the house check) you receive an e-mail with a confirmation link; the sign-up only takes effect once you click it (double opt-in). We store the time of sign-up and confirmation as proof of your consent.

The legal basis is your consent (Art. 6 (1) (a) GDPR, § 7 (2) no. 2 UWG). You can unsubscribe at any time with the link at the end of every issue or by e-mail to us. Unconfirmed sign-ups are deleted after 30 days; after unsubscribing we keep your address only on a suppression list so you receive no further newsletters.

Job applications

If you apply via the form on /karriere/bewerben/ or by e-mail, we process the details and documents you send us for that purpose (name, contact details, desired position, earliest start date, message, CV, cover letter, certificates) to decide on entering into an employment relationship (Art. 6(1)(b) GDPR, Section 26(1) BDSG). Please do not send us information on health, religion or other special categories (Art. 9 GDPR) that the position does not require.

Your application goes directly to our internal applicant management on our own servers (see Hosting). Only the team deciding on the position has access. We do not pass applicant data to third parties; no job portal is involved. The form keeps the files on this website only for the transfer and deletes them there after 30 days at the latest.

Storage period: If no employment relationship comes about, we delete your application no later than six months after the process ends (limitation periods under Section 15(4) AGG, Section 61b ArbGG). If you agreed that we may contact you about later positions (talent pool), we keep the application for twelve months (Art. 6(1)(a) GDPR); you can revoke this consent at any time. If an employment relationship comes about, the documents become part of the personnel file.

You can withdraw your application or request deletion at any time: an e-mail to info@sunwires.com is enough.

Recipients

Your data is only received by the parties named in this policy and, where we are legally required, by public authorities. We do not sell your data or pass it on for advertising.

Storage period

• Requests that do not lead to a contract: deleted 12 months after receipt at the latest, earlier on request.
• If a contract is concluded: for the duration of the contract and the warranty period; records we must keep under commercial and tax law for up to 10 years (§ 257 HGB, § 147 AO).
• Answers in your browser's session storage: until you close the tab.
• Abuse protection counters: 24 hours at most.
• Backups: deleted data may remain in our backups for up to 14 days; after that the backups are deleted.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). Just write to us at info@sunwires.com.

Right to object: where we process data on the basis of Art. 6(1)(f) GDPR, you can object to this processing at any time on grounds relating to your particular situation (Art. 21 GDPR).

You can also lodge a complaint with a data protection supervisory authority, for example the one responsible for us: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany, www.baden-wuerttemberg.datenschutz.de.

Changes

We update this policy when our website, our services or the law change, and at the latest when Sunwires GmbH is founded.