Privacy Policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:
PV-SimLab GmbH
Elbstraße 88/1, 22880 Wedel, Germany
Managing Director: Mathias Röper
Email: info@pv-glarecheck.com · Phone: +49 4103 188 53 73

We have not appointed a separate Data Protection Officer as there is no legal obligation to do so.

2. General Information on Data Processing

We process personal data only to the extent necessary to provide a functional application and our content and services. The legal bases are in particular Art. 6(1)(b) GDPR (contract/pre-contractual measures), (f) GDPR (legitimate interest), (c) GDPR (legal obligation) and (a) GDPR (consent), where consent is obtained.

3. Hosting and Server Location

The application is operated on servers located in Germany (Hetzner Online GmbH, Germany). A data processing agreement pursuant to Art. 28 GDPR is in place with the hosting provider. On each access, technically necessary server log data is processed (IP address, date/time, requested resource, status code, browser/device information) on the basis of Art. 6(1)(f) GDPR to ensure operation, stability and security. Log data is generally stored for a short period and then deleted.

4. Registration and User Account

A user account is required to use the Service. We process your name, email address and a securely hashed password, as well as any other data you provide. To confirm the email address we send a verification email (double opt-in). The legal basis is Art. 6(1)(b) GDPR. Data is stored for the duration of the contractual relationship and beyond within statutory retention periods.

When you sign in or out, confirm legal documents, or perform security-relevant account actions (e.g. password changes), we record the time, IP address and technical information from your browser (user agent, e.g. device type, browser and operating system family) in order to safeguard the security of your account and prevent misuse. The legal basis is our legitimate interest in the security of the Service pursuant to Art. 6(1)(f) GDPR. These log entries are deleted or anonymised once they are no longer required for the stated purposes.

Declarations submitted via the electronic withdrawal function and the cancellation button (name, email address, contract concerned, content, time, IP address, user agent) are stored as proof of receipt and content, because we are legally required to confirm them without undue delay (Art. 6(1)(c) and (f) GDPR). The confirmation contains a link with which the account holder can retract a declaration. This data is deleted together with the account unless a retention obligation applies.

5. Project and Simulation Data

We process the project, geometry and simulation data you enter (e.g. locations, coordinates, elevation data, PV areas, observation points) and the resulting calculation results, charts and reports, in order to perform the contract pursuant to Art. 6(1)(b) GDPR. Projects you delete remain in the recycle bin for 30 days and are then permanently deleted; result files are subject to the storage limit of your plan. Longer-term retention is the user's responsibility (download/backup).

6. Services Used and Recipients

a) Google Maps and Google geo services

To display maps and to determine location and elevation data, we use services provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (in particular the Google Maps JavaScript API and server-side elevation/geocoding services). Technically required data – including IP address and entered/selected coordinates/location data – is transmitted to Google; a transfer to the USA (Google LLC) cannot be excluded. These functions are an integral part of the Service and necessary for its provision; the legal basis is Art. 6(1)(b) GDPR, alternatively our legitimate interest in functional map display under Art. 6(1)(f) GDPR. For third-country transfers, Google relies on the EU Standard Contractual Clauses and/or the EU-US Data Privacy Framework. More: policies.google.com/privacy.

b) Google reCAPTCHA

To protect the registration, withdrawal and termination forms against automated abuse, we use Google reCAPTCHA (Google Ireland Limited). reCAPTCHA analyses user behaviour based on various characteristics (incl. IP address, dwell time, mouse movements). The legal basis is our legitimate interest in preventing spam and abuse under Art. 6(1)(f) GDPR. A transfer to Google in the USA may also occur. Details: policies.google.com/privacy.

c) Payment Processing (Stripe)

For processing paid services we use the payment provider Stripe (Stripe Payments Europe, Ltd., Ireland). During payment transactions the required data (e.g. name, email, billing data, payment details) is processed directly by Stripe; full payment instrument data is not disclosed to us. The legal basis is Art. 6(1)(b) GDPR and, regarding statutory retention obligations, Art. 6(1)(c) GDPR. Stripe privacy notice: stripe.com/privacy.

d) Email Delivery

For sending verification, notification and service emails we use an external email service (Titan / SMTP), processing your email address and the message content. The legal basis is Art. 6(1)(b) or (f) GDPR. Promotional product-update emails are only sent with your explicit, separate consent (Art. 6(1)(a) GDPR, § 7 UWG), which can be withdrawn at any time with effect for the future. Operational and contract-related communications (e.g. maintenance and security notices, contract/account information) are independent of this.

e) Object Storage

Generated result, map and report files are stored in an object storage operated by Hetzner Online GmbH (Gunzenhausen, Germany; data centre Falkenstein, Germany). A data processing agreement pursuant to Art. 28 GDPR is in place with the storage provider.

f) Embedded Libraries (CDN)

To deliver styling and functional libraries (e.g. Bootstrap, Bootstrap Icons), content is loaded from content delivery networks (jsdelivr, Cloudflare), transmitting the IP address to the respective provider. The legal basis is our legitimate interest in secure and efficient provision under Art. 6(1)(f) GDPR. The fonts used are served locally from our server; no connection to Google Fonts takes place.

g) Google Ads Conversion Tracking (Google LLC) — consent-based only

With your consent, we use Google Ads Conversion Tracking to measure how many users complete an action (e.g. registration) after clicking on an ad. A cookie is placed on your device. Provider: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Legal basis: Art. 6(1)(a) GDPR. You can withdraw your consent at any time via the "Cookie Settings" link in the footer. Tag ID: AW-18307824556. The click identifier (gclid) from an ad is stored at registration only if you have consented to the marketing category. Privacy Policy: policies.google.com/privacy.

h) Microsoft Clarity (Microsoft Corporation) — consent-based only

With your consent, we use Microsoft Clarity to analyse user behaviour on our website (including click and scroll behaviour, heatmaps). This helps us improve usability. Provider: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, USA. Legal basis: Art. 6(1)(a) GDPR. You can withdraw your consent at any time via the "Cookie Settings" link in the footer. Project ID: n86v98sedb. Privacy Policy: privacy.microsoft.com/privacystatement.

i) Official geodata: elevation, aerial imagery, horizon

To determine elevation, terrain and horizon data and to display official aerial imagery, our server queries geodata services of the surveying authorities (Germany: state services and hoehendaten.de; Austria: BEV and basemap.at; Switzerland: swisstopo) as well as the PVGIS horizon service of the European Commission (JRC). Only the coordinates of the queried points or map sections are transmitted. Your IP address and account data are not passed on, because the queries run through our server. The legal basis is Art. 6(1)(b) GDPR.

7. Cookies

We use the following cookies:

Essential cookies: A technically necessary session cookie for authentication and login (HttpOnly, SameSite, "Secure" with HTTPS). Legal basis: § 25(2)(2) TDDDG, Art. 6(1)(b) GDPR. No consent required.

Analytics cookies (Microsoft Clarity): Only with your consent (Art. 6(1)(a) GDPR). See section 6h.

Marketing cookies (Google Ads): Only with your consent (Art. 6(1)(a) GDPR). See section 6g.

You can change or withdraw your cookie consent at any time via the "Cookie Settings" link in the footer. Your language preference is stored locally in your browser (localStorage) and is not transmitted to us.

8. No Automated Decision-Making / No Profiling

No solely automated decision-making, including profiling within the meaning of Art. 22 GDPR, takes place.

9. Storage Period

We store personal data only as long as necessary for the stated purposes or as required by statutory retention periods (in particular under commercial and tax law). Data is then deleted or restricted.

You can delete your account yourself at any time on the account page. Projects, simulations, reports, files and logs are deleted in the process. Invoice records must be retained for ten years under § 147 AO (German Fiscal Code); they are separated from your personal data and the account record is anonymised.

10. Your Rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on Art. 6(1)(f) GDPR (Art. 21). You may withdraw any given consent at any time with effect for the future. To exercise your rights, a message to info@pv-glarecheck.com is sufficient.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular the Independent State Centre for Data Protection Schleswig-Holstein (ULD), Holstenstraße 98, 24103 Kiel, Germany.

11. Data Security

We take appropriate technical and organisational measures to protect your data against loss, misuse and unauthorised access (incl. transport-encrypted connections via TLS/HTTPS). Please additionally back up important results yourself (download).

12. Changes to this Privacy Policy

We will amend this Privacy Policy whenever changes to data processing or the legal situation make this necessary. The respective versioned version published on this page applies; in the event of material changes, logged-in users will be asked to acknowledge the new version.