top of page

data protection

Thank you for visiting our website and for your interest in My-Privacy GmbH.

We take the protection of your data very seriously and want you to feel safe and comfortable when visiting our website. As a rule, you can visit the My-Privacy GmbH website without us needing any personal data from you. We only save access data without personal reference.

Below you will find all information for customers, interested parties and suppliers that apply to data protection and the use of our website.

A) Information about the data processor

Responsible for data processing

My-Privacy GmbH

At Tangstedter Forst 2

22851 Norderstedt

represented by Mike Betke

Contact details of the data protection officer:

Processing framework

Data categories

Data from customers, interested parties and suppliers are processed if they are necessary to fulfill the purposes mentioned below. This includes the following categories of personal data: master data (e.g. surname, first name, address, contact data, date of birth, telephone number, email address), contract data (e.g. customer number, meter number), billing data, consumption and payment information as well as comparable data. On request, we will be happy to inform you about the process in which your data may be stored and what data it is.

Purposes and legal basis of data processing

As a rule, you can visit the website of the Vattenfall company without us needing any personal data from you, as long as you do not register or transmit data in any other way, e.g. B. via a contact form.

If you use offers on our websites that require registration or conclude a contract with us, we process personal data in accordance with the provisions of the EU General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG) for the following purposes:

a) to fulfill contractual obligations (Art. 6 Paragraph 1 lit. b GDPR)
The collection of the data and its processing is necessary for the initiation, implementation and billing of the contract. Failure to provide the data means that no contract can be concluded. The data processing takes place in the context of the conclusion of the contract and for the execution of the contract. Among other things, personal information (such as name, address, telephone number, e-mail address), contract data (such as contract period, meter number, meter value), payment information (such as bank details, billing data) and information about the delivery point are collected. Furthermore, we subject your data to a plausibility check in order to correctly classify and bill the consumption point as a household or commercial facility. If necessary, we use external sources such as population registers or external service providers to identify missing information and ensure that our messages reach you even after your move. In addition, in connection with contract processing, we process data about your payment behavior (number of reminders, delivery blocks), which we need as part of our internal billing, dunning and installment plan procedure in order to collect open claims from you and, if necessary, take measures such as number and frequency to carry out reminders, possible reminders by SMS, delivery blocks, contract termination, initiation of judicial dunning proceedings or the sale of receivables.

b) based on consent (Art. 6 Paragraph 1 lit. a GDPR)
For advertising about our products and services as well as offers and services from our partners, we will only contact you via communication channels for which we have given our prior consent, subject to mailing and personal address. We use your contact information for the following purposes:

  • General or personalized advertising measures and contract offers on various channels (SMS, e-mail, telephone, push)

  • Newsletter

  • (Telephone) surveys about your satisfaction with our products and the improvement of our services

In addition, we process your personal data on the basis of your consent for the following additional purposes:

  • Recording of telephone conversations with our customer service as evidence of contractual matters, such as the conclusion of contracts

  • Use of SEPA direct debit mandates for contract processing

A given consent can be revoked at any time without giving reasons with effect for the future. To exercise your revocation, you can send us a message at

c) Data processing based on a legitimate interest (Art. 6 Para. 1 lit.f GDPR)
It is our goal to guarantee our customers the best advice and support through needs-based product design and constant further development of our services at economically competitive conditions. We would like to make offers tailored to your needs, improve the quality of our services and products and further develop our sales partners and other service providers. We use your customer, contact, consumption, contract and payment data for this purpose. The use of data and, if necessary, the transfer to service providers takes place in a permissible manner, taking into account the legitimate interests of both parties. In order to safeguard your legitimate interests, we only process your data strictly for the specific purpose and limit the use of the data to a minimum.

d) Data processing based on legal obligation (Art. 6 Para. 1 lit. c GDPR)
As a company, we are subject to various legal obligations (e.g. Energy Industry Act, Meter Operation Act, tax laws, commercial code, e-invoicing ordinance, tax code), which make it necessary to process your data in order to comply with the law.

Passing on the data
We treat your data confidentially. Within My-Privacy GmbH, only those departments and employees who need it to fulfill the above-mentioned purposes have access to your data.

In addition, the data is passed on due to legal obligations to public bodies in the event of overriding legal provisions.

If you fail to settle outstanding invoices / installments despite repeated reminders, we can send the data required to carry out a collection (name, address, email address, company name and, if applicable, contract and claim data) to a debt collection service provider for the purpose of debt collection and payment Submit collection processing. If these dunning processes remain unsuccessful, we can also sell the outstanding claims to debt collection companies. Your personal data will also be transmitted to the debt collection company. They then assert the claims against you in their own name.

The service providers we use in the field of logistics and printing services use subcontractors in individual cases to ensure their technical support, some of whom are active in countries outside the EU for which there is no adequacy decision by the EU Commission. Sub-processes of processing supplier data (master data, contact data and bank data) are carried out with the assistance of service providers in the USA and India. Occasional access to personal data cannot be ruled out. Therefore, compliance with the data protection level of the GDPR is ensured through the conclusion of additional EU standard contractual clauses. For more information on the contracts, please contact .

A further transfer of customer or prospect data to third countries (outside the EU / EEA) is not planned.

Storage duration of personal data
We process your personal data as long as this is necessary for the fulfillment of our contractual and legal obligations and the processing purposes mentioned above. The legislature has issued a wide range of retention obligations and periods. This includes retention obligations from the Commercial Code (HGB) and the Tax Code (AO). Insofar as such storage is mandatory, your data will only be used for the specific purpose beyond what is required under the contract and are no longer accessible for addressing customers. After these deadlines have expired, the relevant data is routinely deleted. If data is not affected by this, it will be deleted when the stated purposes no longer apply.

Obligation to provide the data
We only request and process personal data from you that we absolutely need to process and fulfill the above-mentioned purposes and obligations (contract processing, service offers, registration for our newsletter). Without this data, no services can be offered.

Automated decision making
We work with credit agencies and marketing service providers to justify and carry out the processing processes described. This includes advertising. This profile creation has no legal effect.

C) Information about data subject rights

If you have any questions regarding the processing of your personal data, you can contact our data protection officer directly, who and her team are also available in the event of requests for information, applications or complaints. All inquiries about the data stored about you in accordance with Art. 15 GDPR should be addressed to:

My-Privacy GmbH
Data protection officer
At Tangstedter Forst 2
22851 Norderstedt

The data protection officer is also your point of contact for exercising your rights to correction in the event of errors in the storage and processing of your data (Art. 16 GDPR), deletion of your data, for example if the purpose no longer applies or if consent has been revoked (Art. 17 and 18 GDPR), restriction of processing, for example, due to the contestation of the correctness of personal data or for the safeguarding of possible existing claims (Art. 18 GDPR), objection to the processing based on legitimate interest (Art. 21 GDPR) and data portability via the Provided data in a machine-readable format (Art. 20 GDPR).

Revocation of Consent
If your data processing is based on the legal basis of consent, you have the right to revoke this consent at any time for the future.
You can exercise your revocation via the following email address:

Objection according to Art. 21 GDPR:
If the data processing takes place on the basis of a balancing of interests in accordance with Art. 6 Paragraph 1 lit. In the event of an objection, we will no longer process your data for these purposes, unless we can prove compelling legitimate reasons for the processing that outweigh your interests, rights and freedoms or the processing serves to assert, exercise or defend legal claims.

Please send your objection to:

Right to complain
In addition, there is a right of appeal to a competent data protection supervisory authority (Art. 77 GDPR). You can contact the data protection supervisory authority responsible for My-Privacy GmbH at:

Independent state center for data protection Schleswig-Holstein

Holstenstrasse 98

24103 Kiel,

Tel .: +49 431 988-1200, Fax: +49 431 988-1223



Find out more here.

bottom of page