Privacy Policy

Effective date: October, 2023

With this Privacy Policy, we, enshift AG (herein after referred to as "Company", "we" or "us"), located in Baar, Switzerland (CHE-267.270.479), describe how we collect and process Personal Data in the course of providing our Services (as defined in Section 2 below).

The term "Personal Data" as used in this Privacy Policy means any information that identifies, or could reasonably be used to identify, an individual ("Data Subject").

If you provide us with personal information about others, please make sure that they are aware of this Privacy Policy and only provide us with their information if you are authorized to do so and that personal information is accurate.

This Privacy Policy complies with the Swiss Federal Data Protection Act ("DPA") and the EU General Data Protection Regulation ("GDPR").

‍

1. Responsible party

The "Data Controller" of the data processing as described in this Privacy Policy is enshift AG, located in Switzerland (CHE-267.270.479). You can notify us of any concerns regarding data protection via the contact details in the imprint.

The responsible party is part of an international group of companies. "Group Companies" means the companies affiliated with the Company which have their registered office in Germany and abroad.

‍

2. Our services and their relationship with data processing

In the following (No. 2.1 et seq.), we describe the services that we provide to customers and users and in their connection with the processing of Personal Data (herein after each a "Service", all or several together the "Services").

The term "User" as used herein means any person who has access to use the Website.

‍

2.1 Visit our website

Description: As part of the normal operation of our website, certain data about you is actively or passively collected in connection with your visit to the website, or sent to our server. Our servers may collect data such as the data listed below in categories of processed Personal Data. This information is temporarily stored in a so-called log file. In addition, our website also uses cookies and other tracking technologies (such as pixels, beacons, tags or Adobe Flash technology) to collect, store and track data about your website usage. For more information about our use of cookies and similar technologies, please see our Cookie Policy.

You are not required to actively disclose personal information to use our website.

Categories of Personal Data processed:

· IP address of the requesting computer;

· Date and time of access;

· Name and URL of the retrieved file;

· Internet page from which the access is made (referrer URL);

· browser used;

· if necessary, the operating system of your computer;

· Name of your access provider.

Origin of Personal Data: We receive your Personal Data either from you or from a third party provider.

Legal basis: We process your Personal Data based on our legitimate interest, Art. 6 (1) lit. f GDPR or Art.31 para. 1 DPA, as well as the fulfilment of the contract with you for the use of the website, Art. 6 (1) lit. f GDPR or Art. 31 para. 2 lit. a DPA.

Purpose of processing: The aforementioned data will be processed by us for the following purposes:

· To ensure the smooth operation of the website;

· To evaluate system security and stability;

· To improve our offer or individualize our website;

· Assertion of legal claims and defense in connection with legal disputes and official proceedings;

· For other administrative purposes.

Recipients of Personal Data: We share your Personal Data with our Group Companies and with selected service providers that we need to operate our website.

In cases where we are required to do so by law or in order to defend or exercise our legal rights, we may also disclose your Personal Data to third parties (for example, lawyers, authorities or courts).

‍

2.2 Software Platform

Description: You are able to sign-up to our platform to plan energy-related renovations, new constructions and conversions of buildings and land, obtain offers from cooperating companies or us for installation of renewable energy systems, financing or additional services.

Categories of Personal Data processed: In addition to the data listed under point 2.1, we also process your contact details and data which we require for the login and administration of your customer account. Also, we process information regarding your ownership and/or your tenancy of buildings and plots.

Origin of Personal Data: We receive your Personal Data either from you or from a third party provider.

Legal basis: We process your Personal Data based on our legitimate interest, Art. 6(1) lit. f GDPR or Art. 31 para. 1 DPA, as well as the fulfilment of the contract with you to use the software platform, Art. 6 (1) lit. b GDPR or Art.31 para. 2lit. a DPA.

Purpose of processing: The aforementioned data will be processed by us for the following purposes:

· to ensure smooth operation of the software platform;

· to simulate buildings and portfolios regarding energy potential, calculation of investment costs, economic figures as well as CO2 impact;

· for marketing and sales purposes to help you realize your project;

· to evaluate the system security and stability of the software platform;

· to improve our offer or individualize our website and software platform;

· assertion of legal claims and defense in connection with legal disputes and official proceedings;

· for other administrative purposes.

Recipients of Personal Data: We share your Personal Data with our Group Companies, as well as with sales partners and third parties who are needed to process your request and with selected service providers who we need to operate our website and platform.

In cases where we are required todo so by law or in order to defend or exercise our legal rights, we may also disclose your Personal Data to third parties (for example, lawyers, authorities or courts).

‍

2.3 Contact request via our website

Description: You have the possibility to contact us through our website by filling out and sending the corresponding contact form.

Categories of Personal Data processed: In addition to the data listed under point 2.1, we also process your contact data and any Personal Data that you integrate into your inquiry.

Origin of PersonalData: We receive your Personal Data either from you or from a third party provider.

Legal basis: We process your Personal Data based on our legitimate interests, Art. 6 (1) lit. f GDPR orArt. 31 para. 1 DPA, as well as to fulfil your request, Art. 6 (1) lit. b GDPR or Art. 31 para. 2 lit. a DPA.

Purpose of processing: The aforementioned data will be processed by us for the following purposes:

· To process your respective request;

· To improve our offer or individualize our website;

· Assertion of legal claims and defense in connection with legal disputes and official proceedings;

· For other administrative purposes.

Recipients of Personal Data: We share your Personal Data with our Group Companies, as well as with sales partners and third parties who are needed to process your request and selected service providers who we need to operate our website and process your request.

‍

2.4 Downloads

Description: We provide various documents for you on our website. Some of these documents can only be downloaded after providing your contact information. In these cases, we use selected third party providers to collect your contact details and provide you with there quested documents. Your contact details are then provided to us by these third party providers. Therefore, please also note the terms of use and privacy statements of these third-party providers.

Categories of Personal Data processed: In addition to the data listed under point 2.1, we also process your contact data if specified.

Origin of Personal Data: We obtain your Personal Data from you or a third party provider.

Legal basis: We process your Personal Data based on your consent, Art. 6 (1) lit. a GDPR or Art. 31para. 1 DPA.

Purpose of processing: The aforementioned data will be processed by us for the following purposes:

· To provide the downloads you want;

· To improve our offer or individualize our website;

· Assertion of legal claims and defense in connection with legal disputes and official proceedings;

· For other administrative purposes.

Recipients of Personal Data: We share your Personal Data with our Group Companies and with selected service providers that we need to operate our website.

‍

2.5 Customer Support Portal

Description: If you wish, you can get access to our Customer Support Portal. In our Customer Support Portal you can submit requests and get answers to common questions.

Origin of PersonalData: We receive your Personal Data either from you or from a third party provider.

Legal basis:We process your Personal Data based on our legitimate interest, Art. 6 (1) lit. f GDPR orArt. 31 para. 1 DPA, as well as the fulfilment of the contract with you to use the customer portal, Art. 6 (1) lit. b GDPR or Art. 31 para. 2 lit. a DPA.

Purpose of processing: The aforementioned data will be processed by us for the following purposes:

· To ensure smooth operation of the customer support portal;

· To evaluate the system security and stability of the Customer Support Portal;

· To improve our offer or individualize our website and customer support portal;

· Assertion of legal claims and defense in connection with legal disputes and official proceedings;

· For other administrative purposes.

‍

2.6 Newsletter

Description: You can subscribe to our newsletter on our website, so that we can keep you informed about current developments and other information of interest to you.

Categories of Personal Data processed: In addition to the data listed under point 2.1, we also process your specified contact data here.

Origin of PersonalData: We obtain your Personal Data from you or a third party provider.

Legal basis: We process your Personal Data based on your consent, Art. 6 (1) lit. a GDPR or Art. 31para. 1 DPA.

Purpose of processing: The aforementioned data will be processed by us for the following purposes:

· For sending and administration of our newsletter;

· To improve our offer or individualize our website;

· Assertion of legal claims and defense in connection with legal disputes and official proceedings;

· For other administrative purposes.

Recipients of Personal Data: We share your Personal Data with our Group Companies as well as with selected service providers that we need to operate our website and to operate and administer the newsletter. In addition, your Personal Data may be shared with selected distribution partners.

‍

3. Cookies and similar technologies

Our website uses cookies. For more detailed information on the use of cookies, please see our Cookie Policy.

‍

4. Automated decision making

We do not use automated decision making in the processing of your Personal Data on the website.

‍

5. Cross-border data transmission:

In principle, all data is processed on our servers in Switzerland, from where our website is also operated. In some cases, in particular our service providers or Group Companies, are based outside the EU/EEA or Switzerland, for example in the USA, so that the applicable laws guarantee a different national level of data protection than that provided for in European or Swiss data protection law. When transferring data to such countries, we ensure (e.g. by concluding appropriate contracts) that the relevant service providers guarantee an appropriate level of data protection comparable to that in Switzerland. A copy of the respective suitable and appropriate guarantees is available upon request.

‍

6. Duration of data processing

Your PersonalData will be stored by us and/or our service providers exclusively to the extent necessary to fulfil our obligations. The Personal Data will be stored exclusively for the period necessary to achieve the purposes for which the Personal Data were collected.This is done in each case in accordance with applicable data protection law.When we no longer need your Personal Data, we delete it and/or take the necessary measures to properly anonymize it. This does not apply insofar as we are obliged to retain the data for a longer period of time, in particular in order to comply with statutory retention obligations. For example, Personal Data contained in contracts, communications and business letters may be subject to legal retention obligations that may require retention for up to 10 years. Otherwise, we generally delete other Personal Data 5 years after the end of the respective contractual relationship between you and us.

‍

7. Rights of the Data Subjects

In accordance with and to the extent provided by applicable law (as in cases where the GDPR applies), you have the right to access, rectify and erase your PersonalData, the right to restrict processing or the right to object to our data processing; in addition, you may have the right to obtain certain Personal Data for transfer to another controller (data portability). If the processing of your data is based on consent, you also have the right to withdraw this consent. Please note, however, that we reserve the right to assert legal restrictions on our part. In addition, every Data Subject has the right to assert his or her rights in court or to file a complaint with the competent data protection authority in accordance with the applicable laws.

‍

8. Data security

We have implemented appropriate technical and organizational security measures to protect your Personal Data from unauthorized access and misuse while you are with us, such as internal policies, IT and network security solutions, access controls and restrictions, encryption of data media and transmissions, inspections, third-party penetration testing.

‍

9. Changes to this privacy policy

We may change this privacy policy at any time and without prior notice. The current version published on our website applies.

‍

*****