Legal information

Privacy Policy

This Privacy Policy explains how personal data is processed when you visit this website and when you contact us through it. This is a business-to-business information website. We do not operate an online shop and do not conclude online orders, contracts, or payments through this website.

Diese Seite auf Deutsch lesen →

1. Controller

The controller responsible for data processing on this website is:

Telephone: +49 40 298 234 60
Email: info [at] ecoefxsol [dot] com

2. Data Protection Officer

You can reach our Data Protection Officer at:

3. Website hosting and server log files

Our website is hosted by Netlify, Inc. (101 2nd Street, San Francisco, CA 94105, United States), which provides hosting and the serverless functions that process our web forms on our behalf as a processor under a data processing agreement pursuant to Article 28 GDPR.

When you access the website, technical information is processed automatically, in particular your IP address, the date and time of the request, the requested resource, the referring page, and information about your browser and operating system. This processing is necessary to deliver the website reliably and securely and to detect and prevent misuse. The legal basis is our legitimate interest in the secure and stable operation of the website (Article 6(1)(f) GDPR). These server log files are stored only for a limited period and are then deleted or anonymised.

4. Contact form and pilot request

You can contact us through our contact form and request a pilot through our pilot form. The data you enter is transmitted to us and stored in our customer relationship system, Zoho CRM, operated by Zoho Corporation B.V. (Beneluxlaan 4B, 3527 HT Utrecht, Netherlands). Zoho acts as our processor under a data processing agreement pursuant to Article 28 GDPR; the data is stored in Zoho's data centre in the European Union.

Depending on the form, we process the following data:

• Contact form: name, email address, company, country, and your message.
• Pilot form: first and last name, company, email address, telephone number, country, address, fleet size, and the industry areas you select.

We use this data solely to process and respond to your enquiry and, where your enquiry concerns a possible business relationship, to take steps at your request prior to entering into a contract. The legal basis is Article 6(1)(b) GDPR for pre-contractual steps and Article 6(1)(f) GDPR for our legitimate interest in responding to enquiries addressed to us.

After you submit a form, we send you a confirmation email that we have received your enquiry. This email is sent through Zoho CRM's own mail function.

When we correspond with you by email in response to your enquiry, this correspondence is handled through our email systems: Zoho Mail, operated by Zoho Corporation B.V. (Beneluxlaan 4B, 3527 HT Utrecht, Netherlands), and STRATO Mail, operated by STRATO GmbH (Otto-Ostrowski-Straße 7, 10249 Berlin, Germany). Both act as our processors under data processing agreements pursuant to Article 28 GDPR, and the data is processed within the European Union. STRATO's privacy information is available at strato.de/datenschutz.

Providing the data marked as required in the respective form is necessary for us to process your enquiry. If you do not provide it, we may be unable to respond.

5. Newsletter

You can subscribe to our newsletter to receive information and updates about NanoEFX and our products. Subscribing to the newsletter is optional and is separate from contacting us: submitting a contact or pilot request does not subscribe you to the newsletter, and subscribing to the newsletter is not required in order to contact us.

To subscribe, we process the email address you provide and, if you provide it, your name. We use a double opt-in procedure: after you enter your email address, we send you a confirmation email containing a confirmation link, and we only add you to the newsletter distribution list once you click that link. This allows us to verify that the email address provided belongs to you.

The legal basis is your consent (Article 6(1)(a) GDPR; Section 7(2) of the German Act Against Unfair Competition (UWG) for electronic marketing). We record your subscription and confirmation, including the time and the consent text shown to you, so that we can demonstrate your consent.

You can withdraw your consent and unsubscribe at any time with effect for the future, using the unsubscribe link contained in every newsletter or by contacting us using the details in section 1. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

To evaluate and improve our newsletter, we measure whether newsletters are opened and which links contained in them are clicked. Zoho Campaigns uses an invisible tracking image to record opening events and trackable links to record link clicks. These interaction data can be associated with the respective recipient.

We use these data to assess newsletter performance and understand which topics and content are of interest to recipients. The legal basis is your consent (Article 6(1)(a) GDPR). The consent you give when subscribing covers both receipt of the newsletter and this open and click measurement. You can withdraw your consent at any time with effect for the future, including by unsubscribing from the newsletter. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

Opening and click measurements are technical indicators of interaction and do not necessarily prove that a newsletter was actually read. Email software, privacy features and automated security systems can influence these measurements.

Our newsletter is sent using Zoho Campaigns, operated by Zoho Corporation B.V. (Beneluxlaan 4B, 3527 HT Utrecht, Netherlands), which processes subscription and newsletter interaction data on our behalf as our processor under a data processing agreement pursuant to Article 28 GDPR. The data is stored in Zoho's data centre in the European Union. For more information, see Zoho's privacy policy: zoho.com/privacy.

6. Regional handling of enquiries

We distribute our product internationally through regional companies. Depending on the country or territory stated in your enquiry, we may forward your enquiry to the responsible regional company so that it can respond to you:

• Scandinavia: ECO EFX Solutions Scandinavia ApS
• South Africa and Zimbabwe: ECO EFX Solutions South Africa Ltd.
• Japan, Korea, Vietnam, and the Philippines: EiShin Co., Ltd.
• all other territories: ECO EFX Solutions GmbH

Where an enquiry is forwarded, the receiving regional company is a recipient of your data. The legal basis is Article 6(1)(f) GDPR, namely our legitimate interest in handling enquiries through the responsible regional contact.

7. Cookies and consent

When you first visit our website, we show you a consent banner. We distinguish between strictly necessary storage and optional technologies:

• Strictly necessary storage is required to operate the website securely and to remember the consent choice you make in the banner. It is used on the basis of Section 25(2) of the German Telecommunications and Digital Services Data Protection Act (TDDDG) and Article 6(1)(f) GDPR (our legitimate interest in a secure, functioning website and in documenting your choice) and does not require your consent.
• Optional technologies — in particular the web analytics service (Google Analytics) described in section 8 — are only used after you have actively given your consent through the banner (Section 25(1) TDDDG; Article 6(1)(a) GDPR). They are not active before you consent.

The banner lets you accept or reject optional technologies with equal ease, and adjust your choices by category. You can change or withdraw your choices at any time, with effect for the future, via the “Cookie settings” link available in the footer on every page. Withdrawing consent is as easy as giving it. We store your consent choice, including the banner version and the time, so that we can present the banner correctly and demonstrate your choice.

Overview of the technologies we use

8. Web analytics (Google Analytics)

Subject to your consent, we use Google Analytics, a web analytics service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). Google Analytics uses cookies and comparable technologies to help us understand how visitors use our website — for example which pages are viewed and how visitors navigate — so that we can improve our content and structure.

In this context, device and browser information, the pages you view, interaction events and coarse location information may be processed. Google Analytics uses the IP address transmitted as part of the connection to derive location information, but does not log or store individual IP addresses in Google Analytics. Google processes this data on our behalf as our processor under a data processing agreement pursuant to Article 28 GDPR.

The legal basis is your consent (Article 6(1)(a) GDPR and Section 25(1) TDDDG). Google Analytics is loaded only after you have consented through our consent banner, and not before. You can withdraw your consent at any time with effect for the future via the “Cookie settings” link in the footer. For further information on how Google processes personal data, see Google's privacy policy: policies.google.com/privacy.

In connection with this service, data may be transferred to Google LLC in the United States. This transfer is based on the appropriate safeguards described in section 11.

9. Social media

We maintain a presence on the social media platforms listed below, and our website links to our profiles there. The icons in our footer are simple hyperlinks: displaying them does not transmit your personal data to the platforms, and they do not set cookies or load third-party scripts on our website. Only when you actively follow a link do you leave our website and enter the respective platform.

On each platform, the respective provider processes your personal data under its own responsibility and in accordance with its own privacy policy, over which we have no influence. For the EU/EEA, the responsible entities and their privacy policies are:

• LinkedIn — LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. Privacy policy: linkedin.com/legal/privacy-policy.
• X (formerly Twitter) — X Internet Unlimited Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland. Privacy policy: x.com/en/privacy.
• Facebook — Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. Privacy policy: facebook.com/privacy/policy.
• YouTube — Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Privacy policy: policies.google.com/privacy.

When you visit or interact with our own profiles on these platforms, the respective provider processes your data under its own responsibility. Where a platform makes statistical information about the use of our profile available to us (for example page or channel insights), we and the platform operator may be joint controllers within the meaning of Article 26 GDPR; we will provide the relevant joint-controller information where this applies.

10. Recipients and processors

We do not sell your personal data. We disclose personal data only to the processors and recipients described in this policy:

• Netlify, Inc. — website hosting and form transport (processor);
• Zoho — storage of enquiries in Zoho CRM, email correspondence via Zoho Mail, and confirmation email (processor);
• STRATO GmbH — email correspondence via STRATO Mail (processor), as described in section 4;
• Google Ireland Limited / Google LLC — web analytics via Google Analytics (processor), subject to your consent as described in section 8;
• Zoho Corporation B.V. (Zoho Campaigns) — newsletter distribution, subject to your consent (processor), as described in section 5;
• the responsible regional company, where your enquiry is forwarded (recipient), as described in section 6.

We may also disclose data where we are legally required to do so.

11. International data transfers

Enquiry data stored in Zoho CRM is held in the European Union.

Website hosting through Netlify, Inc. involves processing in the United States. This transfer is covered by the appropriate safeguards set out in our data processing agreement with Netlify, in particular the European Commission's Standard Contractual Clauses.

Where Google Analytics, as described in section 8, involves processing by Google LLC in the United States, this transfer is based on appropriate safeguards, in particular Google LLC's certification under the EU–US Data Privacy Framework and, where applicable, the European Commission's Standard Contractual Clauses.

Newsletter data processed through Zoho Campaigns is held in Zoho's data centre in the European Union, so no transfer to a third country arises from the newsletter service itself.

You can request further information on these safeguards using the contact details in section 1.

12. Retention

We keep enquiry data for as long as necessary to process your enquiry and to handle any resulting business relationship or follow-up. If no further contact or business relationship arises, we delete enquiry data after 24 months. Longer retention applies only where we are required to retain data to comply with statutory obligations, in particular commercial and tax retention periods, or to establish, exercise, or defend legal claims.

We keep newsletter data until you unsubscribe or withdraw your consent, after which we delete it from the distribution list. We retain a record of your consent and its withdrawal for as long as necessary to demonstrate compliance and within applicable limitation periods.

The Google Analytics data-retention setting for this property is 14 months for the user-level and event-level data covered by Google's retention controls. The retention period for user identifiers is not reset when new activity occurs. Data subject to this setting is automatically deleted after the applicable retention period. This setting is separate from the lifetime of the analytics cookies described in section 7. We retain your consent choices for as long as necessary to document them.

13. Your rights

Under the GDPR, you have the right to request access to your personal data (Article 15), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), and data portability (Article 20).

Where processing is based on your consent (Article 6(1)(a) GDPR), you have the right to withdraw your consent at any time with effect for the future (Article 7(3) GDPR). This applies in particular to web analytics and the newsletter. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

You also have the right to object, on grounds relating to your particular situation, to processing based on Article 6(1)(f) GDPR (Article 21).

To exercise these rights, please contact us using the details in section 1 or our Data Protection Officer in section 2.

You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:

14. Automated decision-making

We do not use automated decision-making, including profiling, within the meaning of Article 22 GDPR.

15. Data security

We use appropriate technical and organisational measures to protect your personal data against loss, misuse, alteration, and unauthorised access, and we review these measures in light of technological developments. In particular, this website is delivered over an encrypted connection (TLS/HTTPS), and access to the systems in which enquiry data is stored is restricted to authorised persons.

16. Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes to our website or to legal requirements. The current version is available on this page.