Data Protection

Last revised: May 23rd, 2018

We, the company EnBW Energie Baden-Wuerttemberg AG, take the protection of your personal data very seriously. In the following we would like to inform you about which personal data we collect when you visit our website, how we process this data and what rights you have in connection with your personal data.

Responsible for the processing of your data is:

EnBW Energie Baden-Württemberg AG
Durlacher Allee 93
76131 Karlsruhe

Telephone exchange: +49 (0)721 63-00
Customer service number: +49 (0)721 72586-001
E-mail: kontakt@enbw.com

If you have any questions, suggestions or complaints, you can contact us using the contact details above.

You can contact our data protection officer at datenschutz@enbw.com. He will be happy to answer any questions you may have about data protection.

We collect and process your data only if we have either received your consent for data processing or processing is legally permitted.

If you visit our website for information purposes only, i.e. do not register or otherwise transmit data (e.g. via a contact form), we collect the data that your browser transmits to us. In detail, these are the following data:

• IP address
• Date and time of the request
• Time zone difference to Greenwich Mean Time (GMT)
• Content of the request (specific page)
• The amount of data transferred in each case
• Website from which you visit us (referrer URL)
• Website you are visiting
• Browser type and version used
• Operating system and its interface
• Language and version of the browser software

This data is collected and processed in order to display the website, to ensure and improve stability and for security reasons. The legal basis for this processing is art. 6 para. 1 f) GDPR (General Data Protection Regulation). The collection of this data as well as the storage of the data in log files is absolutely necessary for the operation of the website. There is therefore no possibility for the user to object.

If you use offers on our web pages, which require a registration, further data are stored. Information on registration can be found in the "Registration" section of the Terms of Use.

In addition, cookies are used when you visit our website. Cookies are small text files that are stored on your computer by us or by another website (more detailed information can be found in the description of our analysis procedures below) and through which specific information flows to the respective website setting the cookie. Cookies are always assigned to the browser. By using cookies, it is not possible to run programs or transfer viruses to your PC.

You can configure your browser settings according to your wishes and, for example, refuse the acceptance of third party cookies or all cookies. However, this may result in you not being able to use all functions of our website. You are also free to delete all cookies at any time using your browser settings.

Use of technically necessary cookies

We use technically necessary cookies to make our website more user-friendly and effective. In detail, the following data is stored in the cookies and transmitted to us:

• Log in Information
• Form data
• Order-relevant data
• Search configurations
• Contradictions and consents to the processing of information

The legal basis for this data processing is art. 6 para. 1 f) GDPR. The use of these cookies is intended to facilitate your use of our website. Some functions of our website do not function without the use of these cookies and could therefore not be offered. Our legitimate interest in the processing of cookies arises from the aforementioned purposes. The cookies are deleted after the end of the session (e.g. logging out or closing the browser) or after a specified period.

Use of technically unnecessary cookies

In addition, we also use cookies which enable us to analyse the user behaviour of visitors to our website. In detail, the following data is stored in the cookies and transmitted to us:

• Click flows (this means that we record which of our pages you have viewed)
• Entered search terms
• Duration of stay on the individual websites
• A/B-Test: displayed variant of variant tests

The legal basis for this data processing is art. 6 para. 1 f) GDPR and § 15 para. 3 TMG (German Telemedia Act) .The use of the analysis cookies allows us to optimise our websites and make them more tailored to your needs. These purposes also justify our legitimate interest in the processing of these data. The analysis cookies are deleted after a specified period of time.

Use of third party cookies

In addition to our own cookies, we also use third party cookies on our website. Third party cookies are those that are not stored by us, but by third party providers on your computer. Further information on the scope and purpose of data processing, the respective legal basis, the storage period as well as the possibilities of objection and removal of third party cookies can be found below in the explanation of the individual procedures we use.

Use of Mouseflow

This website uses Mouseflow, a web analysis tool of Mouseflow ApS, Flaesketorvet 68, 1711 Copenhagen, Denmark. The data processing serves the purpose of analysing this website and its visitors. To this end, data are collected and stored for purposes of marketing and optimization. From these data, a user profile under a pseudonym can be created. For this, cookies can be used. With the Mouseflow web analysis tool, randomly selected individual visits (only with anonymized IP addresses) can be recorded. In so doing, a log of the mouse movements and clocks is created, with the intention of a random-sampling playback of the individual website visits and of deriving potential improvements for the website. The data collected with Mouseflow shall not be used, in the absence of separately issued consent of the data subject, to personally identify the visitors to this website, nor are such data combined with personal data about the user to whom a pseudonym has been assigned. The legal basis for the processing is § 15 para. 3 of the Telemediengesetz (the Telemedia Act) or Article 6(1)(f) of the General Data Protection Regulation (GDPR). If you do not desire any recording via Mouseflow, then you can deactivate it on all websites that use Mouseflow by clicking on the following link: https://mouseflow.de/opt-out/

We use the web statistics tool Webtrekk by the company Webtrekk GmbH, Robert-Koch-Platz 4, 10115 Berlin. In this procedure, a pixel is integrated on each of our pages which collects and stores the following data by means of a cookie. The purpose of using the Webtrekk web statistics tool is to evaluate the data collected by the pixel for marketing and optimisation purposes.

The following data is collected: Browser type and version, internal resolution of the browser window, screen resolution, JavaScript enabled, Java installed, cookies enabled, colour depth, Webtrekk pixel version, page name, accessed URL, client timestamp (in milliseconds), referrer (otherwise the encoded URL), client language setting country code, operating system used, device type, IP address (collected anonymously and deleted immediately after use), clicks.

Pseudonymous user profiles are created from this data through the use of cookies. These user profiles are used to analyse visitor behaviour and are evaluated to improve our Internet offering and create a needs-based design for it. The legal basis for this data processing is art. 6 para. 1 f) GDPR and art. 15 para. 3 TMG. The data collected via Webtrekk will not be used to identify you personally without your express consent. A combination with data that personally identifies you is also only possible if you provide us with your tracking ID (Ever-ID), for example to assert your right to information.

The collection and storage of data by the Webtrekk web statistics tool can be revoked at any time with effect for the future. To object to the storage of your data, please click here . After your objection, an opt-out cookie is stored on your end device. If you delete your cookies or use another browser, you must click the link again.

To comply with your right of access with regard to Webtrekk, we require your unique tracking ID (Ever-ID).

Your unique Tracking ID (Ever-ID) is: {{getWebtrekkEid()}}.

This website uses Google Analytics, a web analysis service of Google Inc. "("Google"). Google Analytics uses so-called "cookies", which are text files placed on the user's end device, and which make it possible to analyse how users use the site. The information generated by the cookie about the use of this website by users is generally transmitted to and stored on a Google server in the USA.

However, if IP anonymisation is activated on this website, Google will shorten the IP addresses of users within Member States of the European Union or in other states party to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there. IP anonymisation is active on this website.

On our behalf, Google will use this information to evaluate the use of the website by users, to compile reports on website activity and to provide us as the website operator with further services relating to website and Internet use. The IP address transmitted by your browser in the context of Google Analytics is not merged with other Google data. The legal basis for this data processing is art. 6 para. 1 f) GDPR and art. 15 para. 3 TMG. Our legitimate interest arises from the aforementioned purposes.

You can prevent the storage of cookies by adjusting your browser software accordingly. Users can also prevent Google from collecting data generated by the cookie and relating to their use of the website (including their IP address) and they can prevent Google from processing this data by downloading and installing the browser plug-in available under the following link:

http://tools.google.com/dlpage/gaoptout?hl=de.

As an alternative to the browser add-on or within browsers on mobile devices, please click this link to prevent Google Analytics from collecting data on this website in the future. An opt-out cookie is then stored on your device. Please note that the opt-out cookie only works in the browser in which it was set. Even if you delete your cookies, you must click this link again.

As an AdWords customer, we also use Google Conversion Tracking on our website. This is an analysis service by Google Inc. (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; "Google"). As part of this service, Google AdWords sets a cookie on your computer ("conversion cookie") when you visit our website via a Google advertisement. These types of cookies expire after 30 days and are not used to personally identify you.

If you visit certain pages of ours and if the cookie has not yet expired, it is possible for us and for Google to recognize with the help of this cookie that someone has clicked on the advertisement and has thus been forwarded to our page. Since each AdWords customer receives a different cookie, it is not possible to track the cookie on websites of other AdWords customers. The purpose of using the conversion cookie is to use the information collected to generate conversion statistics for AdWords customers.

As an AdWords customer, we only see the total number of users who clicked on our advertisement and were redirected to a page with a conversion tracking tag. However, we do not receive any information that would enable us to identify a user personally. The legal basis for this data processing is art. 6 para. 1 f) GDPR and art. 15 para. 3 TMG.

If you do not wish to participate in this tracking process, you can refuse the setting of the conversion cookie. This is done by configuring your browser settings according to your wishes and, for example, rejecting the acceptance of third party cookies or all cookies. You can also deactivate cookies for conversion tracking by setting your browser to block cookies from the "googleadservices.com" domain. Please note that the browser settings you make only work in the relevant browser.

We use the remarketing technology of Google Inc. (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; "Google"). By using this technology, it is possible for users who have already visited our Internet pages and online services and are interested in the offer to be addressed again through targeted advertising on the pages of the Google Partner Network. The display of the advertisement takes place via the use of cookies, i.e. small text files which are stored on the user's computer. The purpose of data processing is to analyse user behaviour when visiting the website with the help of these text files and then use it for targeted product recommendations and interest-based advertising. The legal basis for this processing is art. 6 para. 1 f) GDPR and art. 15 para. 3 TMG.

Our legitimate interest lies in the aforementioned purpose. The remarketing cookies used are valid for a maximum of 120 days after your last visit. Please note that this period begins to run again when you visit our website again.

If you do not wish to receive interest-based advertising, you are free at any time to disable Google's use of cookies for these purposes. Deactivation is possible via the page https://support.google.com/ads/answer/2662922?hl=en. Alternatively, you can disable the use of third party cookies by visiting the opt-out page of the Network Advertising Initiative.

We also point out that Google has its own privacy policy, which is independent of ours. We assume no responsibility or liability for these policies and procedures. Please read Google's privacy policy before using our website. You can find it here.

On our website we use a service of YouTube LLC, 901 Cherry Avenue, San Bruno, CA 94066, USA for the integration of videos. The videos are stored on http://www.YouTube.com.

You can play these videos directly from our website. The videos are all in "enhanced privacy mode", which means that no data about you as a YouTube user will be stored unless you play the videos. Nevertheless, YouTube will contact the Google service DoubleClick, but according to YouTube, in this case no data will be saved. Only when you play the videos will your IP address and the information that you have watched the video be stored by YouTube. If you are logged in to YouTube, this information will also be associated with your YouTube account. If you do not want this, you must log out of your YouTube account before playing the video. We have no influence on the collection and processing of data by YouTube. For more information about YouTube's data processing, please refer to YouTube's privacy policy. You can find it on https://policies.google.com/privacy?hl=en.

Adform A/S (Wildersgade 10B, 1, 1408 Copenhagen K, Denmark) cookies are used on our website for purposes of interest-based advertising. These cookies store information about the operating system, browser version, geographical location, URLs on which Adform advertising is displayed, as well as the number of clicks or views. When the data is collected, your IP address is anonymised by shortening it by the last three digits. Therefore, neither Adform nor we are able to identify a person with the collected data. The cookie set by Adform has duration of 60 days. The data collected with the Adform cookie is used for the following purposes:

• Record the number of visitors to our websites
• Specify the order in which a visitor visits the various pages of our website
• Assess which parts of our website need to be adapted
• Optimization of the website

The legal basis for this data processing is art. 6 para. 1 f) GDPR and art. 15 para. 3 TMG. If you do not wish to have your data collected by Adform, you can object at any time by clicking on the following link: https://site.adform.com/privacy-center/website-privacy/opt-out

This website uses the web analysis service with bid management of the company intelliAd Media GmbH, Sendlinger Str. 7, 80331 Munich. For the purposes of demand-oriented design and optimization of this website, anonymized usage data is collected and stored in aggregated form, and user profiles are created from this data using pseudonyms.

When intelliAd Tracking is used, cookies are stored locally. The legal basis for this processing is art. 6 para. 1 f) GDPR and art. 15 para. 3 TMG. The collected data are anonymized directly when they are collected by shortening the IP address. No personal identification is possible with the remaining data. As a website visitor, you have the right to object to the storage and profiling of your (anonymously recorded) visitor data for the future as well. Use the intelliAd opt-out function.

We use Application Insights, a web analysis service of Microsoft Corporation ("Microsoft") based on the database application "Azure". Application Insights uses cookies. By setting the cookie, the following additional data is collected from you:

• Your operating system
• The browser you are using and the version
• The screen resolution
• Your approximate location
• Your IP address (anonymized, the last octet is set to 0)

The information generated by the cookie about your use of our websites is usually transferred to a Microsoft server in the USA and stored there. Microsoft will use this information on our behalf to evaluate your use of the websites and to compile reports on website activity. The evaluations serve the purpose of troubleshooting and optimizing the website and the application. The legal basis for this data processing is art. 6 para. 1 f) GDPR and art. 15 para. 3 TMG.

You may refuse the use of cookies by selecting the appropriate settings on your browser, however please note that if you do this you may not be able to use the full functionality of this website. The cookie is stored for 12 months.

Further information from Microsoft on data protection and Azure can be found at https://privacy.microsoft.com/en-us/privacystatement.

We use ONE technology from Thunderhead 5th Floor, Ingeni Building, 17 Broadwick Street London W1F 0DJ. A ONE cookie is stored on your end device. If you are not logged in to the customer portal/registered area, your user behaviour will be recorded anonymously. Your user behaviour includes which of our websites you visit, how long you stay there, what you "click" or in which fields you enter data (so-called listening and capturing). This serves to improve our website as well as our products and services as such, as we hope that this will give us insights into what our customers or potential customers/users of our websites are interested in and which functions they use and how they use them. The IP address is anonymized immediately as the data is collected.

The following data is recorded:

Device manufacturer, device model, type of device (e.g. smartphone, tablet), name and version of operating system, name and version of browser used, information about whether Flash is supported, location data (geo-coordinates) of the device and accuracy of location data measured in metres, country and city from which the last known interaction with the ONE cookie occurred, a timestamp when the device first and last communicated with the ONE cookie and when geo-coordinates were last available. The system also records which postcode you enter for electricity and gas availability, what electricity or gas consumption you specify, the product (electricity/gas) you click on and whether you are logged in and, if so, your customer number.

The legal basis for this data processing is art. 6 para. 1 f) GDPR and art. 15 para. 3 TMG. If you do not wish the ONE cookie to collect and use the above-mentioned data, you can of course use your browser settings to specify that you want to delete the stored cookies or prevent your browser from accepting cookies. We assume that you agree to the setting of cookies if your browser permits this. Furthermore, we expressly point out that the deletion and / or the suppression of the acceptance of cookies are limited, since the browser setting is only valid for the browser currently in use. When using a different or new browser, the browser settings must be re-adjusted.

If you log in to the registered area and have given your consent, the user behaviour data collected by means of the Thunderhead cookie will be processed on a personal basis by linking it to your identity and your contractual data. The purpose of creating your personal customer profile is to enable us to display content that is individually tailored to you and your interests and which we assume could be particularly helpful or interesting for you in your situation. Thunderhead does not receive any personal data. The legal basis for this data processing is art. 6 para. 1 a) GDPR. The customer profile created in this way will be stored until you either revoke your consent or until our purposes in connection with the contractual relationship existing between us cease to exist. For further information, please refer to the data protection information about the contractual relationship between us.

Some offers on our website require registration. The use of these offers is voluntary. The data required for registration is requested during the registration process. These include your name, e-mail address, date of birth and a password of your choice. The information is required for registration purposes. The data requested during the registration process will be stored by us for the purpose of managing your access to the customer portal until you delete your account. The legal basis for this data processing is art. 6 para. 1 b) GDPR.

If you contact us via a form on www.enbw.com, this is basically done with 128-bit encryption. If you do not use the EnBW contact forms, but your private e-mail account, please note that you must take your own security measures to ensure the confidentiality of your message. Therefore, please use the encrypted forms of EnBW. If the form is not encrypted, there is a technical problem and we cannot assume any liability for the security of your data transmission. You can see whether a form is encrypted by the closed "lock" symbol in your browser window. Depending on the content of your request, the legal basis for this data processing is art. 6 para. 1 b), f) or a) GDPR. We will delete the data you send us by means of your inquiry after reaching the respective purpose. If the transmitted inquiry refers to a contract concluded with us, your inquiry will be deleted as explained in the data protection information of the respective contract. You can find the data protection information for your respective contract here.

If you contact us by telephone, we will use the information you provide to us for the purpose for which you contacted us. Depending on the content of your request, the legal basis for this data processing is art. 6 para. 1 b), f) or a) GDPR. We will delete the data that you provide us during the telephone call once the respective purpose has been achieved. If our telephone call is in connection with an existing contract or in connection with a contractual inquiry, please also note our data protection information with regard to the respective product. This data protection information can be found here..

On our website you have the possibility to subscribe to a newsletter. Should you do this, we will inform you about our offers at regular intervals. To subscribe to the newsletter, you must provide us with a valid e-mail address and register to receive the newsletter. We will then check your e-mail address to make sure that you really are the owner of this e-mail address and that you have access to the specified e-mail account (double opt-in procedure).

Furthermore, we use your e-mail address exclusively for sending the newsletter. When you register for our newsletter, we log your IP address, the date and time of your registration for verification purposes. The data collected when ordering the newsletter will not be combined with other data collected via our website, unless you have given us your consent to do so. The legal basis for this data processing is your consent to receive the newsletter (art. 6 para. 1 a) GDPR). If you no longer wish to receive the newsletter, you can unsubscribe at any time. Simply click the unsubscribe link at the end of each newsletter. By doing so, you revoke your consent to receive the newsletter. The legality of data processing up to the time of revocation remains unaffected by this.

Your data collected in connection with the newsletter will be deleted 3 years after the end of the year in which you unsubscribed.

On our website you have the possibility to give feedback on individual services in the form of a star rating. The possibility to provide information is purely voluntary and is done anonymously. Furthermore you can write a comment and send it to us together with your star rating. Your evaluation serves the purpose of improving our services. The legal basis for the aforementioned data processing is art. 6 para. 1 f) GDPR and art. 6 para. 1 a) GDPR. Comments received are deleted when the purpose ceases to exist, generally after one year.

If we are subject to any legal obligations that make further processing of your data necessary, we shall also process your data for the purposes provided for by law. The legal basis for this data processing is art. 6 para. 1 c) GDPR in connection with the provision containing the respective legal obligation.

Data will also be processed if and to the extent that you have consented to data processing in accordance with art. 6 para. 1 a) GDPR. The purposes of data processing result from the respective consent.

We treat your data confidentially. Within the EnBW Energie Baden-Wuerttemberg AG, only those departments and employees who require access to your data in order to fulfil the above-mentioned purposes are actually granted access.

Personal data will only be transmitted by us to third parties if this is necessary for the aforementioned purposes and legally permitted or if you have given your prior consent.

In addition to the recipients already named above, we make use of the assistance of other service providers (contractors) to fulfil our obligations. The following recipient categories can receive data:

• IT service providers
• Survey service providers
• Call centres
• Marketing service providers
• Analysis specialists
• File and data carrier disposal specialists
• Authorities
• Legal guardians and persons who have a power of attorney

Personal data is also only transferred to other affiliated companies if there is a legal basis for this and this is necessary for one of the purposes mentioned above.

We also transfer your data to service providers and vicarious agents who are located in third countries and carry out data processing there. An adequate level of data protection is ensured in all cases. All of our service providers in third countries process the data in accordance with our instructions and are contractually bound. In detail, we transfer your data to the following third countries:

• IT service providers in the USA. The adequate level of data protection is ensured by the Commission's Privacy Shield and/or standard contractual clauses that have been concluded (specimen available at: https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2010:039:0005:0018:EN:PDF)

For data transmissions through administrative access, access from another country is also possible, since the systems are often guaranteed to operate according to the follow-the-sun principle. However, your data will not be stored in other countries. In these cases, data will also only be accessed if we have ensured compliance with an adequate level of data protection.

Our website may contain links to other providers to whom our data protection regulations do not apply.

EnBW uses state-of-the-art technical and organizational security measures to protect the data you provide us from accidental or intentional manipulation, loss, destruction or access by unauthorized persons. Our security measures are continuously improved in line with technological developments.

We strongly encourage parents to accompany their children's online activities. Children should not transmit any personal data to us without the consent of their parents or legal guardians. We do not knowingly request or process personal data from children.

With regard to the processing of your personal data, you have the right pursuant to art. 15 GDPR to request information about your personal data processed by us. Furthermore, you have the right to have data corrected in accordance with article 16 GDPR or deleted in accordance with article 17 GDPR and to restrict processing in accordance with article 18 GDPR. Furthermore, in accordance with article 20 GDPR, you have the right to demand the handing over of the personal data provided by you in a structured, current and machine-readable format. With regard to the right to information the restrictions of article 34 BDSG (German Data Protection Act) and with regard to the right of cancellation the exceptions of article 35 BDSG apply.

You can address your objection to us at any time requiring no particular form. For the best possible processing, please use the following contact data:

EnBW Energie Baden-Württemberg AG
Durlacher Allee 93
76131 Karlsruhe

Telephone exchange: +49 (0)721 63-00
Customer service number: +49 (0)721 72586-001
E-mail: kontakt@enbw.com

Please note that you can only implement your objection to the use of tracking procedures on our website yourself. It is technically not possible to do this centrally. For each tracking procedure where you have to implement the objection yourself, we have attached a statement above.

If we process your data on the basis of a consent given by you, you have the right to revoke your consent at any time. Your data will then no longer be processed for the purposes covered by the consent. Please note that the legality of the data processing, which took place before the revocation, is not affected by the revocation. For more information on how you can explain your revocation in detail, please refer to the previous information or the information in the respective consent. Please address your revocation to:

EnBW Energie Baden-Württemberg AG
Durlacher Allee 93
76131 Karlsruhe

Telephone exchange: +49 (0)721 63-00
Customer service number: +49 (0)721 72586-001
E-mail: kontakt@enbw.com

Here your revocation - if technically possible - is implemented directly centrally or you will find an explanation how you can implement the revocation yourself, since a central implementation by us is not possible for some technical procedures.

If you believe that the processing of your personal data violates applicable law, you can complain to a data protection supervisory authority at any time in accordance with art. 77 GDPR. This is without prejudice to other administrative or judicial remedies.

With the exception of the technically necessary data for displaying our website, any provision of data by you is voluntary. Should this be different in exceptional cases, this is explicitly mentioned in the appropriate section of this declaration.

No, automated decision making does not take place.

As our data processing is subject to change, we will also adjust our data protection information from time to time. We will inform you of any changes in good time. You will find the current version of these data protection regulations here.