Data protection

Privacy statement

Data protection information for autarc GmbH's online offerings

Scope of application:

• autarc.energy
• app2.autarc.energy
• hilfe.autarc.energy
• scotty.autarc.energy
• scotty.energy
• ai.autarc.energy

1. Basic information

We are pleased that you are visiting our online offerings and thank you for your interest. In the following, we inform you about the handling of your personal data when you use our offers on the internet — such as our website, our app and our AI assistant Scotty. Personal data is all data with which you can be personally identified or that makes you identifiable via an identifier, for example via your IP address.

For security reasons and to protect the transmission of personal data, our online offerings use SSL/TLS encryption in transit, and data is encrypted at rest.

2. Who we are (responsible for data protection)

Responsible for data processing on our online offerings within the meaning of the General Data Protection Regulation (GDPR) is:

autarc GmbH, registered at the Local Court of Charlottenburg under HRB 249005 B, represented by the managing directors Etienne-Noel Krause and Thies Nicolai Hansen, Invalidenstraße 5, 10115 Berlin, Germany. VAT identification number: DE358780788.

Telephone: +49 30 75436808. Email: hello@autarc.energy.

Contact details of our company data protection officer: dataprotection@autarc.energy.

3. Data collection when you visit our online offer

Even visiting our website without registration automatically results in the anonymised collection of the following data on our server: abbreviated IP address; date, time and time zone of access; access status and type of access; protocol type; type and number of pages accessed; name and size of the files accessed; source website; web browser used; and operating system used.

We use this data for troubleshooting, to ensure security and to compile statistics on the use of the website. The legal basis is our legitimate interest in a secure and functioning offering under Art. 6 (1) (f) GDPR. The data is not combined with registration data and is deleted no later than after seven days. Only the staff responsible for operations has access to it.

3.1 Intercom

If you contact us via the Intercom messenger service, data is processed by Intercom, Inc., 98 Battery Street, Suite 402, San Francisco, CA 94111, USA, and 2nd Floor, Stephen Court, 18–21 Saint Stephen's Green, Dublin 2, Ireland. Insofar as data is transferred to the USA, the transfer is based on the EU Standard Contractual Clauses. We have concluded an order processing agreement with Intercom.

3.2 Webflow

We use the Webflow website builder and content delivery network to host and design this website. This service is provided by Webflow Inc., 398 11th Street, 2nd Floor, San Francisco, California 94103, USA. Webflow processes the data mentioned in section 3 and distributes content across regionally distributed servers for faster load times and reliability (legitimate interest, Art. 6 (1) (f) GDPR). Data is processed in Germany and Ireland; for technical reasons infrastructure may be maintained from the USA. We have concluded an order processing agreement and the EU Standard Contractual Clauses with Webflow.

3.3 PostHog

We use PostHog from PostHog, Inc., Market Street #4008, San Francisco, USA, to evaluate how our website is used and to identify usability problems.

This involves processing information on the pages accessed and on clicks, on error messages, and details of your browser and device, in each case with an abbreviated IP address. In addition, we record sessions: mouse movements, clicks, scrolling behaviour and page changes are recorded so that usability problems can be traced. The evaluation is pseudonymised and exclusively internal; recordings are stored for a limited period.

To provide the scripts more quickly and reliably, PostHog's scripts are delivered via an intermediary service operated by us under an autarc-owned address. The recipient of the data remains PostHog, acting as our processor.

The legal basis is your consent under § 25 (1) TDDDG in conjunction with Art. 6 (1) (a) GDPR. You can withdraw your consent at any time with effect for the future via the cookie settings. We have concluded an order processing agreement with PostHog; insofar as data is transferred to the USA, this is based on the EU Standard Contractual Clauses.

3.4 Cloudflare

For storing files and photos uploaded in our application, and for the accelerated and reliable delivery of content, we use services provided by Cloudflare Germany GmbH, Rosental 7, c/o Mindspace, 80331 Munich, Germany. The intermediary service referred to in section 3.3 also runs on this infrastructure.

The connection data required for delivery is processed — in particular IP address, time and extent of access, and details of your browser and device — as well as the files and photos uploaded by users. Processing takes place within the European Union.

The legal basis is Art. 6 (1) (b) GDPR insofar as processing is necessary to provide the contractually agreed service, and otherwise our legitimate interest in secure and efficient operation under Art. 6 (1) (f) GDPR. For content that our customers process in the application we act as a processor; Cloudflare is our subprocessor in that respect. We have concluded an order processing agreement with Cloudflare.

4. Contacting

You can contact us electronically, by post or by telephone. Contacting us is voluntary. We process the data you provide exclusively to answer your request and for the associated technical administration. The legal basis is Art. 6 (1) (b) GDPR where the request serves to initiate or perform a contract, and otherwise Art. 6 (1) (f) GDPR. After processing your request we delete the data immediately, at the latest seven days after completion, unless statutory retention obligations apply.

4.1 HubSpot chat widget

We have integrated a chat widget from HubSpot, Inc., 25 First Street, 2nd Floor, Cambridge, MA 02141, USA. We process the data you provide exclusively to answer your request (Art. 6 (1) (b) GDPR). HubSpot stores this data exclusively on servers in Europe. HubSpot offers a GDPR Data Processing Addendum containing the EU Standard Contractual Clauses: https://legal.hubspot.com/dpa.

5. Data processing when registering to open a customer account

You have the option to register as a specialist partner or customer. We process this data exclusively to perform the contract concluded with you for the use of our offering and to record projects (Art. 6 (1) (b) GDPR). All information is voluntary; to create an account we need at least the data marked with an asterisk (*) during registration. You can delete your account at any time yourself or by sending us a message. After complete processing of the contract, your data will be blocked and deleted after the applicable statutory retention periods expire.

Employees of autarc access customer data only on a case-by-case basis — to handle a customer enquiry, to remedy a fault or to maintain the system. Access is limited to the data required for the respective occasion and to the duration of the work, restricted to named authorised individuals from customer service and IT, and is logged. There is no access to customer data without a specific occasion.

6. Scotty – our AI assistant

Scotty is an AI assistant offered by autarc GmbH, available at scotty.autarc.energy, scotty.energy and ai.autarc.energy. With your authorisation, Scotty connects to the tools you already use — such as email, calendar, messaging and CRM systems — to draft replies, prepare meetings and organise your work. We do not use your content to train foundation AI models.

When you create an account we process your name, email address, organisation, role and authentication data (Art. 6 (1) (b) GDPR). During use we process technical data such as an abbreviated IP address, access time, device and browser information and event logs for authentication, troubleshooting, security and abuse prevention (Art. 6 (1) (f) GDPR).

Scotty only accesses data from a third-party service after you explicitly connect that service and grant the corresponding permissions. You can review and revoke these permissions at any time. To generate drafts and summaries, Scotty sends the relevant content to large language model providers acting as our processors; under our agreements they do not use your content to train their models. AI-generated output can be inaccurate or incomplete and should be reviewed before use. Where required, content may be processed outside the EU/EEA on the basis of the EU Standard Contractual Clauses.

7. Using your data for advertising purposes

If you have used services from us and provided your email address, we may — within the scope of legal requirements — send you recommendations for our own similar services (Art. 6 (1) (f) GDPR in conjunction with Section 7 (3) UWG). You can object at any time with effect for the future, free of charge, via the unsubscribe link in every email or by writing to dataprotection@autarc.energy.

For transactional, automated emails we use SendGrid from Twilio Inc., 899 Winslow St., Redwood City, CA 94063, USA (Art. 6 (1) (b) GDPR). SendGrid acts strictly on our instructions; data is processed on servers in Germany and Ireland. We have concluded an order processing agreement and the EU Standard Contractual Clauses with SendGrid.

8. Cookies and consent management

Cookies are small files stored on your device. Necessary cookies enable basic functions such as login, session management and the storage of your consent decision; the basis is § 25 (2) no. 2 TDDDG and Art. 6 (1) (b) or (f) GDPR. Cookies for statistics and analysis as well as for advertising and marketing are used exclusively with your consent under § 25 (1) TDDDG in conjunction with Art. 6 (1) (a) GDPR.

Your consent is voluntary and can be withdrawn at any time with effect for the future via the cookie settings on our website. A current overview of all cookies used, including provider, purpose and duration, is available there and is kept up to date automatically.

8.1 Reach measurement and website analysis

After your consent we measure how our website is used. We use Google Analytics from Google Ireland Limited with an abbreviated IP address, PostHog (see section 3.3) and HubSpot Analytics. The evaluation is pseudonymised; we do not assign the data to any real names.

8.2 Advertising and performance measurement

After your consent we use services to deliver our advertising and measure its success, using pseudonymous identifiers: Google Ads, Google Ad Manager and Google Tag Manager (Google Ireland Limited) and the Meta pixel (Meta Platforms Ireland Ltd.). For the joint processing with Meta a joint-controller agreement under Art. 26 GDPR is in place. You can withdraw your consent at any time via the cookie settings.

9. Social media and embedded services

We do not use active social plug-ins. We only display inactive icons that link to our profiles; a connection is established only if you click one and leave our website. We operate a company presence on LinkedIn (LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland); we receive only anonymised page statistics. For this joint processing a joint-controller agreement under Art. 26 GDPR is in place.

Map displays are integrated via Mapbox GmbH, Westendstraße 28, 60325 Frankfurt am Main, Germany. Processing takes place within the European Union.

10. Payment service provider

For paid services you can pay by debit card, credit card, SEPA direct debit, invoice or other methods offered by our payment service provider. The provider is Stripe Payments Europe Ltd, Block 4, Harcourt Centre, Harcourt Road, Dublin 2, Ireland. Stripe collects the data necessary to process the payment. The legal basis is Art. 6 (1) (b) GDPR. Complete card details are neither collected nor stored by us. Stripe may process data outside the EU/EEA on the basis of the EU Standard Contractual Clauses.

11. Transfers to third countries

The data in our application is processed in data centres in Germany. For individual supporting services processing takes place outside the European Union, in particular in the USA. In those cases we base the transfer on an adequacy decision under Art. 45 GDPR where the recipient is certified under the EU-US Data Privacy Framework, on the EU Standard Contractual Clauses under Art. 46 (2) (c) GDPR together with additional technical and organisational measures, or on your explicit consent under Art. 49 (1) (a) GDPR. On request we will provide information about the safeguards in place.

12. Your rights as a data subject

You have the right of access (Art. 15 GDPR), to rectification (Art. 16 GDPR), to erasure (Art. 17 GDPR), to restriction of processing (Art. 18 GDPR), to notification (Art. 19 GDPR) and to data portability (Art. 20 GDPR). Where processing is based on your consent, you can withdraw it at any time with effect for the future (Art. 7 (3) GDPR); this does not affect the lawfulness of processing carried out before the withdrawal.

For reasons arising from your particular situation, you have the right to object at any time to processing based on our legitimate interests (Art. 21 GDPR). Where we process your data for direct marketing, you can object at any time without giving reasons; we will then stop processing your data for that purpose without undue delay.

A message to dataprotection@autarc.energy is sufficient to exercise your rights. We will respond without undue delay and at the latest within one month of receipt.

13. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your residence, place of work or the place of the alleged infringement. The authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59–61, 10555 Berlin, Germany. Any other legal remedy remains unaffected.

14. No automated decision-making

We do not take decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. We do not carry out profiling for that purpose.

15. Changes to this privacy statement

We adapt this privacy statement when our processing activities or the legal requirements change. The current version is always available at autarc.energy/datenschutz.

Questions about your data? Email us at hello@autarc.energy or contact our data protection officer at dataprotection@autarc.energy.

© autarc GmbH