Your rights - our obligations

We attach great importance to the protection of personal data. That's why we process your data in accordance with the provisions of the European General Data Protection Regulation (GDPR) and other applicable legal provisions on personal data protection and data security

The following information applies to our website (hereinafter referred to as the "website"). It gives you an overview of the personal data we collect from you via our website, as well as the purposes and manner in which we use it. In addition, we inform you of the rights you have towards us with regard to your personal data.

1. Entity responsible for data protection legislation

Iqony Renewables GmbH
Rüttenscheider Str. 1-3
45128 Essen

renewables@iqony.energy

2. Contact address of data protection officer

STEAG GmbH
STEAG Group Data Protection Officer
Rüttenscheider Straße 1-3
45128 Essen

datenschutz@steag.com

3. Processing your data

In principle, we process personal data when this is necessary for the provision of a service or functional offer on our website. Any other processing of personal data requires your consent. In the following, we explain which of our offers, functions or services that you will find on our pages require the processing of personal data, and which we offer you only on the basis of your consent.

4. Legal basis and purposes of processing

4.1 Use of the website

Every time you visit our website, our system automatically records data and information about your computer system in server log files, which your browser automatically transmits to us. When you visit a website, your IP address is anonymized by our website provider. The data recorded includes :

• type and version of browser used
• operating system
• date and time of server request
• status and error codes with execution time
• website from which the request originated ("exit page")
• IP address (anonymized before registration)
• URL/address of items to be loaded
• Type of request (GET or POST

Some of this data is transmitted to us automatically as a result of the settings on your terminal equipment. Some of this data is required to display our website correctly and to make it more secure, as well as to detect and resolve any technical problems (§ 25 para. 2 no. 2 TTDSG). Insofar as this data enables us to make our website more convenient, secure and attractive, we invoke a legitimate interest in accordance with Article 6, paragraph 1, sentence 1, point f) of the RGPD.

Your server log data is deleted after 7 days. This data is not stored with other personal user data.

4.2 Information you provide

If you use our general contact form, we will receive your message at renewables@iqony.energy. We process the data you have provided for the purposes you have indicated on the basis of your consent (legal basis: Article 6, paragraph 1, sentence 1, point a) GDPR). We store the information you send us via the contact form. The information provided is used solely to process your request. Your data will be deleted once your request has been processed. You may revoke your consent at any time with effect for the future, details of which can be found in section 6 "Your rights".

4.3 Cookies

We also use cookies in some areas of our website. Cookies are small pieces of data that a web server can send to your computer. These cookies record information about your visit to our site.

Our website uses different types of cookies. Some cookies ensure that the website functions properly, e.g. that the graphics settings on your terminal are correct (technically necessary cookies). Other cookies tell us how you use our site, so that we can improve its performance (analysis and statistical cookies).

In accordance with the law, we may store cookies on your terminal if they are absolutely necessary for the operation of our website. All other cookies are described below, along with their purpose and the legal basis for their use (legitimate interest or your consent). Some cookies are placed by third parties who appear on our pages; we also mention them separately in the following paragraphs.

4.3.1 CCM1 cookie consent manager

When visiting our site for the first time, you will be asked whether you wish to actively accept the use of cookies.

You can change your consent at any time by clicking on the "Change my consent" link (see bottom of this section) or by clicking on the symbol at the bottom left of any page.

4.3.2 SalesViewer® technology

We use SalesViewer® to improve our website.e.

Scope of data processing
As part of SalesViewer®, a javascript-based tracking code is inserted into our website. Using this code, we determine, as part of the process described in more detail here (https://www.salesviewer.com/de/datenschutz), the following information ("company data"):

• Name, origin and sector of the company visiting the site
• Website from which the request originates ("exit page")
• Keyword on the exit page
• Visitor behavior (e.g. (sub)pages visited, time of visit, duration of visit).

Purposes of data processing
We use the data collected for marketing, market research and optimization purposes. In doing so, we collect and process exclusively company data.

Data recipients
SalesViewer ® uses Hetzer Online GmbH, Industriestr. 25, 91710, Gunzenhausen, Germany, as a subcontractor for server hosting (SalesViewer® infrastructure) and Host Europe GmbH, Welserstr. 14, 51149 Cologne, Germany, for the provision of DNS servers for SalesViewer®. We have concluded an order processing contract with SalesViewer®.

Data storage period
The application does not collect personal data on users.

Legal basis and revocation option
Using SalesViewer® GmbH's technology, we collect and store data for marketing, market research and optimization purposes on the basis of legitimate interests (Article 6, paragraph 1, sentence 1, point f) of the GDPR).

You can object to the collection and storage of data with effect for the future at any time by clicking on this link www.salesviewer.com/opt-out to prevent collection by SalesViewer® on this website in the future. An opt-out cookie for this website will then be placed on your terminal. If you delete your cookies in this browser, you must click on this link again.

4.3.3 OpenStreetMap / uMap

On our website, we use the uMap open-source project to offer individual maps with landmarks via an API (programming interface) of the OpenStreetMap mapping service. The aim of this is to enable you to display interactive maps directly on the website, to easily find the places we point out on the website and to comfortably use the map function. The provider is the OpenStreetMap Foundation (OSMF for short), 132 Maney Hill Road, Sutton Coldfield, West Midlands, B72 1JU, United Kingdom.

Each time a user accesses a corresponding page, data from OSM caching servers (as a rule, the one closest to their location, list available at hardware.openstreetmap.org/#tile-caches) as well as servers in France are retrieved for uMap and displayed in the browser. At the same time, data is also sent to these servers and temporarily processed in a log file.

In particular, the following data is recorded for each access/call:

• Date and time of consultation (timestamp) and IP address of the device or server accessing the site,
• Request details and target address (protocol version, HTTP method, referer, UserAgent-String),
• Name of file accessed and amount of data transmitted (URL requested, including query string, size in bytes), as well as
• message indicating whether the call was successful (HTTP Status Code).

This protocol data is stored for a certain period of time. It is used for statistical evaluation, error analysis and defense against attacks. The processing of IP addresses is necessary to enable communication on the Internet. OpenStreetMap's privacy statement can be found at wiki.osmfoundation.org/wiki/Privacy_Policy and wiki.osmfoundation.org/wiki/Services_and_tile_users_privacy_FAQ.

4.3.4 Social networks and media

Icons
We have integrated social network icons for Youtube, LinkedIn, Instagram and Twitter into our website. You can only access these networks via an external link. These are not share buttons, only hyperlinks.

Social media presence
We have a presence on "social media". Further information can be found here .

4.3.5 Our website

We use the services of IT service and support providers to make our website available. We carefully select these service providers, who work for us as subcontractors. Our hosting provider is Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany.

The conception, design, implementation and maintenance of the website are carried out by BOROS, Hofaue 63, 42103 Wuppertal, Germany.

5. Recipients of your data / transfer to third countries

The processing of your personal data takes place in principle in a member state of the European Union or in another signatory state of the Agreement on the European Economic Area. A transfer of personal data to a third country or access to such data from a third country takes place only if the special conditions of Articles 44 et seq. of the GDPR are met (e.g. by the agreement of standard contractual clauses or insofar as the recipient acts on the basis of a legal basis decided by the European Commission). However, we cannot exclude that suppliers based in the USA or other third countries, as well as their authorities where applicable, may have access to data stored with these suppliers. Further information can be obtained from the various service providers mentioned in section 4.

6. Your rights

You have a right of access, i.e. you can demand that we provide you with all the personal information we have collected and are temporarily storing (Article 15 of the GDPR). In addition, you can also request rectification (Article 16 of the GDPR) or erasure (Article 17 of the GDPR) or restriction of processing (Article 18 of the GDPR). In addition, there is a right of appeal to a data protection supervisory authority in accordance with Article 77 of the GDPR in conjunction with Article 19 of the Federal Data Protection Act (BDSG). You have the right to data portability, i.e. to receive your personal data in a structured, commonly used and machine-readable format, insofar as this is technically possible (Article 20 GDPR).Under certain circumstances, you have the right to object to the further processing of your personal data (Article 21 GDPR). You have the right to lodge a complaint with the aforementioned data protection officer or a data protection supervisory authority.

If we process your personal data on the basis of your consent, you can revoke this consent at any time with effect for the future. The revocation of consent does not affect the lawfulness of the processing carried out on the basis of consent up to the revocation, but the processing will not be carried out in the future.

You may address your revocation or any other request to our STEAG Group Data Protection Officer.

Of course, you have the right to object at any time to the processing of your personal data for advertising purposes, with effect for the future. You can inform us of your objection to advertising using the following contact details: renewables@iqony.energy.