data protection

Data categories

​

Data from customers, interested parties and suppliers are processed if they are necessary to fulfill the purposes mentioned below. This includes the following categories of personal data: master data (e.g. surname, first name, address, contact data, date of birth, telephone number, email address), contract data (e.g. customer number, meter number), billing data, consumption and payment information as well as comparable data. On request, we will be happy to inform you about the process in which your data may be stored and what data it is.

​

Purposes and legal basis of data processing

As a rule, you can visit the website of the Vattenfall company without us needing any personal data from you, as long as you do not register or transmit data in any other way, e.g. B. via a contact form.

If you use offers on our websites that require registration or conclude a contract with us, we process personal data in accordance with the provisions of the EU General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG) for the following purposes:

​

a) to fulfill contractual obligations (Art. 6 Paragraph 1 lit. b GDPR)
The collection of the data and its processing is necessary for the initiation, implementation and billing of the contract. Failure to provide the data means that no contract can be concluded. The data processing takes place in the context of the conclusion of the contract and for the execution of the contract. Among other things, personal information (such as name, address, telephone number, e-mail address), contract data (such as contract period, meter number, meter value), payment information (such as bank details, billing data) and information about the delivery point are collected. Furthermore, we subject your data to a plausibility check in order to correctly classify and bill the consumption point as a household or commercial facility. If necessary, we use external sources such as population registers or external service providers to identify missing information and ensure that our messages reach you even after your move. In addition, in connection with contract processing, we process data about your payment behavior (number of reminders, delivery blocks), which we need as part of our internal billing, dunning and installment plan procedure in order to collect open claims from you and, if necessary, take measures such as number and frequency to carry out reminders, possible reminders by SMS, delivery blocks, contract termination, initiation of judicial dunning proceedings or the sale of receivables.

​

b) based on consent (Art. 6 Paragraph 1 lit. a GDPR)
For advertising about our products and services as well as offers and services from our partners, we will only contact you via communication channels for which we have given our prior consent, subject to mailing and personal address. We use your contact information for the following purposes:

• General or personalized advertising measures and contract offers on various channels (SMS, e-mail, telephone, push)

• Newsletter

• (Telephone) surveys about your satisfaction with our products and the improvement of our services

• ​

In addition, we process your personal data on the basis of your consent for the following additional purposes:

• Recording of telephone conversations with our customer service as evidence of contractual matters, such as the conclusion of contracts

• Use of SEPA direct debit mandates for contract processing

• ​

A given consent can be revoked at any time without giving reasons with effect for the future. To exercise your revocation, you can send us a message at my-privacy@mailbox.org.

​

c) Data processing based on a legitimate interest (Art. 6 Para. 1 lit.f GDPR)
It is our goal to guarantee our customers the best advice and support through needs-based product design and constant further development of our services at economically competitive conditions. We would like to make offers tailored to your needs, improve the quality of our services and products and further develop our sales partners and other service providers. We use your customer, contact, consumption, contract and payment data for this purpose. The use of data and, if necessary, the transfer to service providers takes place in a permissible manner, taking into account the legitimate interests of both parties. In order to safeguard your legitimate interests, we only process your data strictly for the specific purpose and limit the use of the data to a minimum.

​

​

d) Data processing based on legal obligation (Art. 6 Para. 1 lit. c GDPR)
As a company, we are subject to various legal obligations (e.g. Energy Industry Act, Meter Operation Act, tax laws, commercial code, e-invoicing ordinance, tax code), which make it necessary to process your data in order to comply with the law.

​

Passing on the data
We treat your data confidentially. Within My-Privacy GmbH, only those departments and employees who need it to fulfill the above-mentioned purposes have access to your data.

In addition, the data is passed on due to legal obligations to public bodies in the event of overriding legal provisions.

​

If you fail to settle outstanding invoices / installments despite repeated reminders, we can send the data required to carry out a collection (name, address, email address, company name and, if applicable, contract and claim data) to a debt collection service provider for the purpose of debt collection and payment Submit collection processing. If these dunning processes remain unsuccessful, we can also sell the outstanding claims to debt collection companies. Your personal data will also be transmitted to the debt collection company. They then assert the claims against you in their own name.

​

The service providers we use in the field of logistics and printing services use subcontractors in individual cases to ensure their technical support, some of whom are active in countries outside the EU for which there is no adequacy decision by the EU Commission. Sub-processes of processing supplier data (master data, contact data and bank data) are carried out with the assistance of service providers in the USA and India. Occasional access to personal data cannot be ruled out. Therefore, compliance with the data protection level of the GDPR is ensured through the conclusion of additional EU standard contractual clauses. For more information on the contracts, please contact datenschutz@vattenfall.de .

A further transfer of customer or prospect data to third countries (outside the EU / EEA) is not planned.

​

Storage duration of personal data
We process your personal data as long as this is necessary for the fulfillment of our contractual and legal obligations and the processing purposes mentioned above. The legislature has issued a wide range of retention obligations and periods. This includes retention obligations from the Commercial Code (HGB) and the Tax Code (AO). Insofar as such storage is mandatory, your data will only be used for the specific purpose beyond what is required under the contract and are no longer accessible for addressing customers. After these deadlines have expired, the relevant data is routinely deleted. If data is not affected by this, it will be deleted when the stated purposes no longer apply.

​

Obligation to provide the data
We only request and process personal data from you that we absolutely need to process and fulfill the above-mentioned purposes and obligations (contract processing, service offers, registration for our newsletter). Without this data, no services can be offered.

​

Automated decision making
We work with credit agencies and marketing service providers to justify and carry out the processing processes described. This includes advertising. This profile creation has no legal effect.

​

​