Data Protection

Dear users,
Welcome to the website of EnBW Energie Baden-Württemberg AG. We would like to draw your attention to this website's terms of use and privacy policy. Data protection information within the context of further data processing can be found under "Data protection documents".

Last revised: 03 December 2021

We, EnBW Energie Baden-Württemberg AG, take the protection of your personal data very seriously. In the following, we would like to inform you which items of personal data we record when you visit our website, how we process this data and which rights you are entitled to in connection with your personal data.

The controller for purposes of processing your data is:

EnBW Energie Baden-Württemberg AG
Durlacher Allee 93
D-76131 Karlsruhe
Germany

Tel (switchboard): +49 721 63-00
Customer service number: + 721 72586-001
E-Mail: kontakt@enbw.com

If you have any questions, suggestions or complaints, you can reach us at the contact details provided above.

You can reach our data protection officer at datenschutz@enbw.com. Our data protection officer is happy to answer any questions you may have concerning data protection.

We only collect and process your data if we have either received your consent to process the data or if the processing is permitted by law.

If you visit our website for information purposes only, i.e. if you do not register or otherwise transmit data (e.g. via a contact form), we will record the data that your browser transmits to us. In detail, this comprises the following data sets:

• IP address
• Date and time of the access
• Time zone difference to Greenwich Mean Time (GMT)
• Content of the access (specific page)
• Volume of data transmitted in each case
• Website from which you visit us (referrer URL)
• Website you visit
• Browser type and version used
• Operating system and its interface
• Language and version of the browser software

This data is collected and processed in order to be able to display the website to you, to ensure and improve its stability and for security reasons. The legal basis for this processing is Art. 6 para. 1 lit. f) GDPR. The recording of this data and the storage of the data in log files is mandatory for the operation of the website. The user therefore has no possibility of objection.

The legal basis for this processing is Art. 6 para. 1 lit. f) GDPR. The data will be deleted as soon as they are no longer required for the aforementioned purposes. In the event that an IP address is stored, it will be deleted or anonymized after 30 days at the latest. The recording of this data and the storage of the data in log files is mandatory for the operation of the website. The user therefore has no possibility of objection.

If you use offers on our website which require registration, further data will be stored. Information on registration can be found in the "Registration" section of the terms of use.

In addition, cookies and other technologies are used on our website. Cookies are small text files which are stored on your computer by us or by another party (for more detailed information, please refer to the description of our analysis procedures below) and through which the party that sets the cookie receives certain information. Cookies are always assigned for each specific browser. By using cookies, it is not possible to execute programs or transfer viruses to your PC.

You can configure your browser settings according to your wishes and, for example, refuse to accept third-party cookies or all cookies. However, this may mean that you cannot use all the functions of our website. You are also free to delete all cookies at any time via the settings of your browser. In addition to cookies, other technologies (e.g. pixels) are also used in individual cases to collect corresponding information.

We use cookies and technologies to offer you the following functions and services:

• Consent Management Platform
• Tag Management System
• Technically required website cookies
• Fraud Protection
• Website testing and optimization
• Billing with cooperating affiliate partners
• Measuring range without the formation of profiles
• Basic web analysis

The legal basis for the related data processing is Sec. 25 para. 2 TTDSG (German Telecommunications Telemedia Data Protection Act) in conjunction with Art. 6 para. 1 lit. b) or lit. f) GDPR. The purpose of processing is to make it easier for you to use our website and to offer you our services in accordance with your requests. Some functions of our website also do not work without the use of these cookies and could therefore not be offered. Our legitimate interest in the processing of the cookies results from the aforementioned purposes. The cookies are deleted at the end of the session (e.g. when you log out or close the browser) or after a specified period of time has elapsed.

Google Tag Manager

This website uses the Google Tag Manager ("GTM") as a tag management system. Through this service, tracking codes and code fragments ("tags") can be managed via an interface. The tags, e.g. for Google Analytics, are merely provided, configured and maintained via the GTM. The data collection and processing itself, on the other hand, is carried out by the relevant services. Accordingly, the GTM does not access the generated data. No cookies are used and no personal data is collected.

Application Insights

We use Application Insights, a web analytics service provided by Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399 USA ("Microsoft"), to evaluate the use of our websites for statistical purposes and to compile reports on your website activity. In addition, evaluations are created for the purpose of troubleshooting and optimizing the website and the application. Application Insights is based on the database application "Azure". In the process, your IP address is set to the value 0 and thus anonymized. The information generated by the cookie concerning your use of our websites is normally transferred to a Microsoft server in the USA and saved there. Microsoft processes this information on our behalf. The legal basis for the data processing is Art. 6 para. 1 lit. f) GDPR. Our legitimate interest results from the aforementioned purposes. The storage period of the cookie is 12 months.

Further information from Microsoft on the subject of data protection and Azure can be found at https://privacy.microsoft.com/de-de/privacystatement.

Google Analytics

We use Google Analytics ("GA") on our websites, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). This allows us to analyze our website for statistical purposes, exclusively for the purpose of measuring its range without the formation of profiles. The cookie generates information about your use of our websites, which in turn can be graphically processed and visualized via the Google Data Studio software. Google Data Studio only accesses data already generated from GA. Rudimentary processing of cookies for statistical purposes that is purely related to your individual website session is carried out in accordance with Art. 6 para. 1 lit. f) GDPR. Our legitimate interest results from the aforementioned purposes. The duration of the cookie, i.e. how long the collected information is stored, is consequently 30 minutes after you have become inactive. Your session is thus terminated and it is consequently guaranteed that you will not be recognized over several sessions. Our websites use GA exclusively with the "_anonymizeIp()" extension, which causes your IP address to be shortened and encrypted within member states of the European Union or in other contracting states of the Agreement on the European Economic Area. Thus, a direct reference to persons is excluded. The recorded information including the abbreviated and encrypted IP address is generally transmitted to a Google server in the USA and stored there.

Besides the general rights of withdrawal, you can prevent the compilation and sending of data generated by the cookie, its use of website-related data (incl. your IP address) to Google and the processing of data by Google by downloading and installing the browser plugin which is available via the following link: http://tools.google.com/dlpage/gaoptout?hl=de..

In addition to our own cookies, we also use third-party cookies and other third-party technologies on our website. Third-party cookies are those which are not stored on your computer by us but by third-party providers. You will find more detailed information on the scope and purpose of data processing, the respective legal basis, the storage period and the revocation, objection and removal options of third-party cookies and other technologies below in the explanation of the individual procedures we use.

You can access your cookie and privacy settings online at any time in our privacy policy and change the decision you have made or subsequently give or revoke your consent.

We use the services listed in this section on our websites on the basis of your consent, which you have given us via the cookie banner in accordance with Sec. 25 para. 1 TTDSG in conjunction with Art. 6 para. 1 lit. a) GDPR. For these services, you can revoke your consent at any time with effect for the future or subsequently grant it again by accessing your cookie and privacy settings online via our privacy information and configuring them accordingly. Alternatively, you can prevent the storage of cookies by adjusting your browser software accordingly. Please note that the browser settings you make only work for the browser you are using. For further detailed information, please refer to the descriptions below.

We use Google Analytics ("GA") on our websites, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). GA generally uses [ ] "cookies" to obtain and analyze information about the use of our websites. In addition, we also collect data for marketing purposes and for the delivery of individually tailored advertising messages as part of the so-called advertising functions. These functions include, for example, the formation of user groups with similar interests and behavior, as well as the creation of remarketing lists based on collected interest, behavioral and demographic data. For example, you will be addressed with content relevant to you based on your interests. Your data will only be processed if you have actively consented to the "marketing and personalization" section within the cookie banner on our websites. In these cases, the legal basis for the processing of the data is your consent in accordance with Art. 6 para. 1 lit. a), Art. 49 para. 1 lit. a) GDPR. On our behalf, Google will process the information collected for the purpose of evaluating your use of our website and compiling reports on website activity. The duration of the cookies, i.e. how long the collected information is stored, is 12 months. Our websites use GA exclusively with the "_anonymizeIp()" extension, which causes your IP address to be shortened and encrypted within member states of the European Union or in other contracting states of the Agreement on the European Economic Area. Thus, a direct reference to persons is excluded. The recorded information including the abbreviated and encrypted IP address is generally transmitted to a Google server in the USA and stored there.

Besides the general rights of revocation, you can also prevent the compilation and sending of data generated by the cookie, its use of website-related data (incl. your IP address) to Google and the processing of data by Google by downloading and installing the browser plugin which is available via the following link: http://tools.google.com/dlpage/gaoptout?hl=de.

However, we would like to point out that in this case you may not be able to use all the functions of our website to their full extent. As an alternative to the browser plugin or within browsers on mobile devices, you can also click the following link to set an opt-out cookie that will prevent Google Analytics from recording data within this website in the future (JavaScript must be activated): Deactivate Google Analytics

Please note that this opt-out cookie only works in this browser and only for this domain. If you delete your cookies or use a different browser, you will have to click the interface again.

For general information about Google’s privacy policy, please visit https://policies.google.com/privacy?hl=de.

We use the online marketing service "Display & Video 360" (formerly Double Click Bid Manager, "DV360") and the online marketing service "Campaign Manager 360" (formerly Double Click Campaign Manager, "CM360") from Google on our website. We process data about your behavior on our websites for marketing purposes and the delivery of individually tailored advertising messages. In addition, we process data from the application process (e.g. reason for switching, payment method, etc.) that you have selected as part of your website visit in order to form user groups with comparable behavior and to create remarketing lists. For example, you are targeted with content that is relevant to you based on your behavior. In doing so, DV360 and CM360 generally use so-called "cookies" to track where and how our advertisements have been played. In addition, this can prevent advertisements from being displayed to you more than once. In addition, CM360 uses cookies for conversion tracking (so-called "floodlight cookies"), which allow evaluations of your digital user behavior on our websites, for example, information about products in which you were interested (e.g. rate, division, etc.). This allows us to measure the effectiveness of our advertising activities as well as to retarget identified user groups with the right content. In addition to the activities on our website, we collect and process information about your user behavior in the Google advertising network. In these cases, the legal basis for the processing of the data is your consent in accordance with Art. 6 para. 1 lit. a), Art. 49 para. 1 lit. a) GDPR. On our behalf, Google will use the information collected to evaluate the impact of our advertising activities and to create reports on the campaigns. There is a technical connection between DV360, CM360 and GA. This allows data and information already collected to flow between the tools. On our behalf, Google will import the data from CM360 and GA into DV360 and make it available to us there. Your data will only be available to us if you have actively consented to the "Marketing and Personalization" section of the cookie banner on our websites. The cookies stored by CM360 and DV360 are deleted after 90 days at the latest. Your IP address is encrypted and shortened by Google. Thus, a direct reference to persons is excluded. At no time can we see your IP address. This information including the IP address is generally transmitted to a Google server in the USA and stored there. In addition to the general revocation options, you can also use the following link to revoke your consent in the settings of your Google account and prevent the collection of personalized advertising from Google within this website in the future: https://adssettings.google.com/u/0/authenticated?hl=de

For general information about Google’s privacy policy, please visit https://policies.google.com/privacy?hl=de.

As a Google Ads customer, we also use Google Conversion Tracking on our website. This is an analysis service provided by Google. As part of this service, Google Ads sets a cookie on your computer ("conversion cookie") if you have reached our website via a Google advertisement. The purpose of using the conversion cookie is to use the information collected to compile conversion statistics for Ads customers. In these cases, the legal basis for the processing of the data is your consent in accordance with Art. 6 para. 1 lit. a), Art. 49 para. 1 lit. a) GDPR. As an Ads customer, we only learn the total number of users who clicked our ad and were redirected to a page with a conversion tracking tag. However, we do not receive any information that allows us to personally identify a user. If you visit some of our pages and the cookie has not expired, this cookie enables us and Google to recognize that someone has clicked the ad and been redirected to our site. Since every Ads customer receives a different cookie, it is not possible to track the cookie through websites of other Ads customers. This type of cookie loses its validity after 540 days and is not used to identify you personally. If you have completed an order with EnBW, this cookie will lose its validity after 60 days.

For general information about Google’s privacy policy, please visit https://policies.google.com/privacy?hl=de.

For the purpose of placing interest-related advertisements, cookies are set on our website by Adform A/S (Wildersgade 10B, 1, 1408 Copenhagen K, Denmark). These cookies store information about the operating system, browser version, geographical location, URLs where Adform advertisements are displayed and the number of clicks or views. Immediately when the data is collected, your IP address is anonymised by truncating it by the last three digits. The collected data can therefore not be related to any person, neither for Adform nor for us. The cookie set by Adform has a term of 60 days. The data collected with the Adform cookie is used for the following purposes:

• Recording the number of visitors to our websites
• Determining the order in which a visitor visits the various pages of our website
• Assessing which parts of our website need to be adapted
• Optimising the website

The legal basis for this is the declaration of consent given by you when you access this website within the framework of our cookie banner (Art. 6 para. 1 lit. a) GDPR). You can revoke your consent at any time with effect for the future. If you do not want Adform to collect your data, you can revoke your consent at any time by clicking the following link: https://site.adform.com/privacy-center/website-privacy/opt-out.

We use a service of AWIN AG, Eichhornstraße 3, D-10785 Berlin, Germany on our website. As part of its tracking services, AWIN stores cookies on the end devices of users who visit or use our websites or other online services provided by us (e.g. when you register for a newsletter or place an order) for the purpose of documenting transactions (e.g. leads and sales). These cookies are used solely for the purpose of correctly allocating the success of an advertising medium and the corresponding billing of advertising costs. Your IP address will be shortened immediately after recording. A cookie only contains information about when a particular advertising medium was clicked by an end device. In an additional cookie set by us, an individual sequence of digits, which cannot be assigned to the individual user, is stored. The legal basis for data processing is your consent pursuant Art. 6 para. 1 lit. a) GDPR. In addition to the general withdrawal options, you can also use the following link to withdraw your consent and prevent AWIN from collecting data within this website in the future: https://www.awin.com/de/rechtliches/optout. If you click this link, an opt-out cookie will be created and stored in your browser. This cookie prevents Awin tracking services from placing further cookies on your terminal device in the future. At the same time, all Awin Tracking Cookies that may already exist on your terminal device will be deleted.

We use content discovery technology from Taboola (16 Madison Square West, 7th Floor, New York, New York 10010) to recommend additional online content that may be of interest to you. Taboola’s representative in the EU is LionheartSquared (Europe) Ltd., 2 Pembroke House, Upper Pembroke Street 28 - 32, Dublin, D02 EK 84, Ireland. In order to provide these recommendations, Taboola uses cookies and similar technologies to collect information about your device and your user behavior on this website (and other partner websites), and uses pseudonyms to create user profiles that fundamentally do not permit any conclusions to be drawn about personal data. The legal basis for processing [Art. 6 (1) lt. a) GDPR] is the declaration of consent that you submitted in our cookie banner when you called up this website.

In addition to the general withdrawal options, you can also use the following link to withdraw your consent and prevent Taboola from collecting data within this website in the future:

https://www.taboola.com/policies/privacy-policy#user-choices-and-opting-out

The pseudonymous profiles created in this way will be saved by Taboola for 13 months.

Additional information can be found in Taboola’s Privacy Policy (https://www.taboola.com/privacy-policy).

We use ONE technology from Thunderhead ONE Limited (company no. 08115007), Stanford Building, 27A Floral St, London WC2E 9EZ. Here a ONE cookie is stored on your device.

Use without login to the customer portal

If you are not logged into the customer portal/registered area, your user behavior will be recorded anonymously. Your user behavior includes which of our websites you visit, how long you stay there, what you "click" or in which fields you enter data (so-called listening and capturing). This serves to improve our website as well as our products and services as such, as we hope to gain insights into what interests our customers or interested parties/users of our websites and which functions they use and how. The IP address is anonymized immediately when the data is collected. The legal basis for processing (Art. 6 para. 1 lit. a) GDPR) is the declaration of consent that you submitted in our cookie banner when you called up this website. For further information on data usage by Thunderhead, on setting and objection options as well as on data protection, please refer to the following website of Thunderhead: https://www.thunderhead.com/our-product/the-thunderhead-trust-center/privacy-policy/.

Use during login in the customer portal

If you log in to the registered area and have given your consent to do so, the data collected by means of the Thunderhead cookie on user behavior will be processed in a personalized manner by linking it to your identity and your contractual data. The purpose of creating your personal customer profile is to enable us to display content tailored to you and your interests, which we assume could be particularly helpful or interesting for you in your situation. Thunderhead does not receive any personal data beyond the aforementioned data. The legal basis for data processing pursuant to Art. 6 para. 1 lit. a) GDPR is the declaration of consent that you submitted in our cookie banner when you accessed this website. The customer profile created in this way will be stored until you either revoke your consent or until our purposes in connection with the contractual relationship existing between us expire. For further information, please refer to the data protection information regarding the contractual relationship between us.

Facebook Pixel is used on our websites. This is a JavaScript code snippet that enables us to track the activities of our website visitors. The Facebook Pixel is used by Facebook Inc, 1 Hacker Way, Menlo Park, CA 94025, USA, or if you are located in the EU, by Facebook Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland ("Facebook"). The use of the Facebook pixel as well as the storage of "conversion cookies" is only carried out if you have given your consent to the use of cookies and similar procedures when visiting our website. With the help of the Facebook pixel, Facebook is able to determine you as a target group for the display of advertisements (so-called "Facebook ads") by visiting our online offer. In order to make this possible, we use the Facebook pixel to display the Facebook Ads placed by us only to those Facebook users who have also shown an interest in our online offer or who have certain characteristics. A certain characteristic could for example be the interest in a certain product, which could be defined by the website visit. The information collected is transmitted to Facebook (so-called "customer audiences"). We do not have access to this information ourselves. With the help of the Facebook pixel, we want to ensure that our Facebook advertisements match the potential interest of the users. We can also use the Facebook Pixel to track the impact of Facebook Ads for statistical and market research purposes by seeing whether network visitors have been redirected to our website after clicking a Facebook ad (so-called "conversion tracking").

Example 1 for Custom Audiences (Remarketing):

You visit our website, are interested in an electricity tariff and Facebook provides you with further relevant information on the respective product for us via a Facebook advertisement at a later date, based on your interests. The advertising offer tailored to your interests will be displayed on Facebook, Instagram or on other websites cooperating with Facebook.

A special form of customer audiences are the so-called "lookalike audiences". With this method, not the actual website visitors are addressed, but network members with comparable profile characteristics. This means that the advertising message is not displayed to the website visitor, but to the so-called "lookalikes". Comparable profile characteristics can include age, place of residence or interests.

Example 2 for Custom Audiences (Lookalikes):

You visit our website and are interested in an electricity tariff. Based on your interest in our product and your profile characteristics, Facebook will display advertisements on Facebook, Instagram or other websites cooperating with Facebook that resemble your profile.

The Facebook pixel, which is integrated on our website and on Facebook partner pages, also recognizes whether you are the owner of a Facebook account and use it based on the Facebook cookie set. Via the Facebook pixel, the generated data about your usage behavior is forwarded to Facebook. Your Facebook ID is also transferred, which enables a data link on Facebook pages. If you would like to check this data recording, further processing and the general use of the data and/or deactivate this procedure, you can do this directly in the settings of your Facebook account.

The use of the Facebook pixel as well as the storage of "conversion cookies" is only carried out if you have given your consent to the use of cookies and similar procedures when visiting our website. The legal basis is Art. 6 para. 1 lit. a), Art. 49 para. 1 lit. a) GDPR. In addition to the general revocation options, you can also revoke the consent you have given by clicking the following link. This will delete the Facebook pixel:

Deactivate Facebook Pixel.

In order to set directly on Facebook which types of advertisements are displayed to you within Facebook, you can access the page set up by Facebook and follow the instructions there on the settings for usage-based advertising. The settings are platform-independent, i.e. they are applied to all devices, such as desktop computers or mobile devices. You can also object to the use of cookies for audience measurement and advertising purposes via the deactivation page of the Network Advertising Initiative and additionally via the US website aboutads.info or the European website youronlinechoices.com.

On our website, we use a service from YouTube LLC, 901 Cherry Avenue, San Bruno, CA 94066, USA for the integration of videos. The videos are stored at http://www.YouTube.com. You can play these videos directly from our website. The videos are all embedded in "enhanced privacy mode", which means that no information about you as a YouTube user will be stored unless you play the videos. Nevertheless, YouTube will contact Google's Double Click service and, according to YouTube, no data will be stored in this case. Only when you play the videos will your IP address and the information that you have watched the video be saved by YouTube. If you are logged in to YouTube, this information is also assigned to your YouTube user account. If you do not wish this to happen, you will need to log out of your YouTube account before playing the video. We have no influence on the data recording and processing by YouTube. You can find more detailed information about the data processing by YouTube in their privacy policy. You can find this at www.google.de/intl/en/policies/privacy.

We use the Outbrain Pixel of our contractual partner Outbrain UK Ltd, 5th Floor, The Place,175 High Holborn, London, WC1V 7AA, United Kingdom, a technology of Outbrain Inc, 39 W 13th Street New York, NY 10011 USA on our website. The Outbrain service enables us to target those users with advertising who have already shown interest in our offers on our websites. The Outbrain pixel uses a unique identifier (Universally Unique Identifier (UUID)) to recognize you on other websites. The information required for this, as well as the information that you have visited our website, which browser and which device you are using, is stored in cookies on your computer and transmitted to Outbrain. In addition, Outbrain uses the IP address shortened by the last octet to obtain your approximate geolocation. The pseudonymous profiles created in this way will be saved by Outbrain for 13 months. Based on these pseudonymous profiles, however, it is not possible for Outbrain to directly identify you as a person. Outbrain further decides which content you might be interested in and plays corresponding content to you. The decision about what content you see is made based on your previous viewed content, similar browsing patterns of other users, recommendations that are current among Outbrain's addressees at the given time, a certain degree of randomness, and targeting requirements specified by advertisers. The legal basis for this is the declaration of consent given by you when you access this website within the framework of our cookie banner (Art. 6 para. 1 lit. a), Art 49 para. 1 lit. a) GDPR). In addition to the general withdrawal options, you can also use the following link to withdraw your consent and prevent Outbrain from collecting data within this website in the future: https://my.outbrain.com/recommendations-settings/home.

For more information about Outbrain's data processing, please visit: https://www.outbrain.com/legal/privacy.

On our website, we use cookies from Seeding Alliance GmbH, c/o Ströer, Gustav-Heinemann-Ufer 74b, 50968 Cologne. The native advertising technology of Seeding Alliance GmbH places relevant advertising content online in a non-disruptive, native design – referred to in the following as the image/text product. The image/text product of the provider Ströer, including the data generation described, is handled by Seeding Alliance. Data is collected and stored anonymously in order to control which content is uploaded and accessed for analysis. This primarily includes history data, device information, and cookies. Cookies are stored for up to 90 days. Personal data is generally not saved. IP addresses are truncated by the last octet. Seeding Alliance uses IT md5 with salt to do so. In addition, we use the collected information to display relevant content to our website visitors based on their needs. The legal basis for data processing pursuant to Art. 6 para. 1 lit. a) GDPR is the declaration of consent that you submitted in our cookie banner when you accessed this website. In addition to the general procedures for revoking consent, you can also use this link to revoke your consent and to prevent data from being recorded by Seeding Alliance on this website in the future. The term of the opt-out cookie is 10 years.

More information on data protection at Seeding Alliance GmbH is available here.

By a personal customer profile, we mean a data base consisting of the following data:

1. Data that is collected during the use of our digital offers regarding your online usage behaviour
   By this, we mean data that is collected when you visit our website and our social media presence, when you use one of our apps and when we send you our newsletter or push notifications. In detail, this includes information about which pages you view, when and how long you visit us or use our apps, whether you read our newsletter and which devices you use for this purpose. Which data is collected in detail and on the basis of which legal basis within the scope of the respective digital offer is explained in the data protection information of the respective digital offer.
2. Customer and contract-related data
   By this we mean data which we have received from you within the framework of a pre-contractual or contractual relationship. This includes, for example, your name, contact details, contractual details such as your tariff and consumption and also technical or constructional data insofar as it was collected within the scope of our (pre-)contractual relationship (e.g. roof area, system performance data).
3. Further information made available
   By this we mean all data which you yourself have given us outside our contractual or pre-contractual relationship or which you have generated using our applications. This can be, for example, your expressed interest in one of our products or services, but also, for example, an indication of an impending move or other changes to your home, which could have an impact on the tariff that is best for you. Another example is when you use our e-mobility driving simulation to find out whether an e-car could be useful for you.
4. Data that we collect in the course of your communication with us
   By this we mean data that we collect in connection with a communication with you in addition to the information provided in terms of content. This concerns in particular our assessment of your satisfaction.

If you have given your consent to the creation of a personal customer profile, this data will be combined and evaluated on a personal basis. The purpose of creating your personal customer profile is to enable us to inform you of content tailored to your interests, which we assume could be particularly helpful or interesting for you in your situation. In addition, we can make you more suitable offers which are highly likely to be of interest to you. In addition, we can use the customer profile to offer you advice tailored to your personal needs and give you more transparency regarding your energy consumption and costs and help you avoid unnecessary consumption.

Legal basis for data processing is your consent (Art. 6 para. 1 lit. a) GDPR). The personal customer profile created will be deleted when it is no longer required for the purposes for which it was created, at the latest when you withdraw your consent.

Please note that the issuance/non-granting of consent has no influence on data processing that is already permitted on the basis of other legal bases (such as for contractual purposes (Art. 6 para. 1 lit. b) or for legitimate interests (Art. 6 para. 1 lit. f) GDPR)).

Individual offers on our websites require registration. The use of these offers is voluntary. The data required for registration is requested during the registration process. These are, for example, your name, your e-mail address, your date of birth and a password of your choice. This data is required for registration purposes. The data requested during the registration process will be stored by us for the purpose of managing your customer portal access until you delete your account. The legal basis for data processing is Art. 6 para. 1 lit. b) GDPR.

If you contact us via a form on www.enbw.com, this is always done using 128-bit encryption. If you do not use the EnBW contact forms but use your private mail account, you should note that you must take your own security measures to ensure the confidentiality of your message. Therefore please use the encrypted forms of EnBW. If the form is not encrypted, there is a technical problem and we cannot assume any liability for the security of your data transmission. You can see whether a form is encrypted by the closed "padlock" icon in your browser window.

Depending on the content of your request, the legal basis for data processing is Art. 6 para. 1 lit. a), lit. b) or lit. f).
Typical examples of the previously mentioned legal bases are:

• Art. 6 para. 1 lit. a) GDPR: In case of active use of the contact form, you consent to the associated data processing
• Art. 6 para. 1 lit. b) GDPR: In the case of active use of the contact form and specification of contract content, we process this personal data for the purpose of fulfilling the contract
• Art. 6 para. 1 lit. f) GDPR: In order to preventively protect ourselves against possible attack or abuse scenarios via the contact form, we have a legitimate interest in processing your personal data

We will delete the data that you send us by means of your enquiry once the respective purpose has been achieved. If the transmitted enquiry refers to a contract concluded with us, your enquiry will be deleted as explained in the data protection information of the respective contract. The data protection information for your respective contract can be found here.

If you contact us by telephone, we will use the information you provide us with in accordance with the purpose for which you contacted us. Depending on the content of your request, the legal basis for data processing is Art. 6 para. 1 lit. a), lit. b) or lit. f).

Typical examples of the previously mentioned legal bases are:

• Art. 6 para. 1 lit. a) GDPR: You give us permission in the course of your conversation with our customer service representative to record the conversation for quality purposes
• Art. 6 para.1 lit. b) GDPR: Using automated processes to identify you already in the course of your call and identify possible concerns in order to be able to forward you to the customer service representative responsible for you
• Art. 6 para. 1 lit. f) GDPR: Our legitimate interest in processing your personal data may also arise from the purpose of managing our hotline capacities

We will delete the data that you provide us with during the telephone call once the respective purpose has been achieved. Should our telephone call be in connection with an existing contract or in connection with a contract enquiry, please also note our data protection information regarding the respective product. You can find this data protection information here.

We offer our customers and interested parties the possibility to communicate with us via Facebook Messenger (a product of Facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA). Should you decide to use this option, please note the following:

we would like to point out that the chat history cannot be deleted by us or by you. In the event of the exchange of contract-relevant information, we will store this data in our system for verification purposes. The legal basis for data processing is Art. 6 para. 1 lit. b) GDPR. Please refer to the data protection information of your contract concluded with us for the storage period of the data stored for verification purposes. However, we would like to point out that we have no influence on the data processing by Facebook. Please note that a Facebook chat can be unencrypted and Facebook therefore has access to the content of our communication. You can tell whether the chat is encrypted by the fact that a padlock symbol is displayed in the profile picture within Facebook Messenger. Further information on the use of data by Facebook is available at https://www.facebook.com/about/privacy/.

On our website, we have integrated so-called news feeds from social networks such as Facebook andTwitter. When visiting our website, these news feeds are disabled by default. This means that no data is sent to the respective social networks if you don't activate the news feeds. To activate the news feeds, you must start by clicking them. The news feed then remains activated until the browser window is closed. As soon as you have activated the respective news feed, a direct connection is established with the server of the respective social network. This way, the content of the news feed is transmitted to your browser and integrated into the displayed website. By activation, the information you accessed on our website is transmitted to the operator of the respective social network. If, during your visit to our website, you are logged in to the social network via your personal user account, the social network can assign the website visit to your account. This applies regardless of whether you actually use the news feed after activation, or not. Through interaction with the news feed, e.g. by leaving a comment, this corresponding information is transmitted directly to the respective social network and stored there. The legal basis for the transmission of data to the respective social network is your consent (Art. 6 para. 1 lit. a) GDPR), which you give by activating the respective news feed. We would like to point out that we have no influence on the extent of the data collected by the social networks via the news feeds. The scope and the purposes of data processing pursued by the social networks, as well as your related rights and setting options for the protection of your privacy can be found in the data privacy information of the respective social networks.

You have the opportunity on our websites to evaluate our company and our products and services within the framework of so-called short surveys.

The legal basis for this is the declaration of consent given by you when you access the website within the framework of our cookie banner (Art. 6 para. 1 lit. a) GDPR). You can revoke the consent you have given at any time with effect for the future, or subsequently give it again, by accessing your cookie and privacy settings online via our data protection information and configuring them accordingly. Decisive for the possibility to participate in our short surveys is the consent to the setting of what are referred to as "convenience" cookies.

Within the context of the short surveys, we process the data that you voluntarily send us. These are initially all answers that you give us as part of our surveys. If a free text field is integrated into the survey, we also collect the data provided in your response here. We process your data to gain better knowledge about the needs of our users or customers with regard to our products, services and processes as well as customer relations in general. To this end, we evaluate the data collected voluntarily from you as part of the short surveys accordingly.

Personal data received will be deleted or anonymized if it is no longer necessary for the purposes for which it was created or if you withdraw your consent.

You have the opportunity on our websites to evaluate our company and our products and services within the framework of so-called short surveys.

The legal basis for this is the declaration of consent given by you when you access the website within the framework of our cookie banner (Art. 6 para. 1 lit. a) GDPR). You can revoke the consent you have given at any time with effect for the future, or subsequently give it again, by accessing your cookie and privacy settings online via our data protection information and configuring them accordingly.

Within the context of the short surveys, we process the data that you voluntarily send us. These are initially all answers that you give us as part of our surveys. If a free text field is integrated into the survey, we also collect the data provided in your response here. We process your data to gain better knowledge about the needs of our users or customers with regard to our products, services and processes as well as customer relations in general. To this end, we evaluate the data collected voluntarily from you as part of the short surveys accordingly.

• enbw.com - When you participate in surveys on enbw.com, we collect and process the information you provide in the surveys anonymously. Therefore, please do not include any personal information in your survey answers that could be used to trace them back to you personally.
• meine.enbw.com - When you participate in surveys on meine.enbw.com while you are logged in, we will link your survey answers to your customer ID or customer profile. By doing so, we hope to understand more fully how your individual feedback is associated with our business processes, products, services, and communication measures. In addition, we also process the feedback you provide in conjunction with informational, service, or product offers created for individual customers.

Personal data received will be deleted or anonymized if it is no longer necessary for the purposes for which it was created or if you withdraw your consent.

Insofar as we are subject to legal obligations that make further processing of your data necessary, we will also process your data for the purposes provided by law. The legal basis for this data processing is Art. 6 para. 1 lit. c) GDPR in conjunction with the norm which contains the respective legal obligation.

Data will also be processed if and to the extent that you have consented to data processing in accordance with Art. 6 para. 1 lit. a GDPR. The purposes of the data processing result from the respective consent.

We treat your data with confidentiality. Within EnBW Energie-Baden Württemberg AG, only those departments and employees who need your data to fulfil the above-mentioned purposes will have access to it.

Personal data is only shared with third parties by us if necessary and legally permitted for the aforementioned purposes or if you have given your prior consent.

In addition to the recipients already specifically named above, we make use of other service providers (contract processors) to fulfil our obligations. The following categories of recipients may receive data:

• IT service provider-Dienstleister
• Survey service provider
• Call centre
• Marketing service provider
• Analysis specialists
• Disposal of files and data carriers
• Authorities
• Legal guardians and persons for whom a power of attorney exists

Personal data is also only transferred to other Group companies if there is a legal basis to do so and it is necessary for one of the purposes mentioned above.

We also transfer your data to service providers and vicarious agents who are located in third countries and carry out data processing there. Compliance with an adequate level of data protection is ensured on the basis of adequacy decisions pursuant to Art. 45 GDPR or by other appropriate or adequate guarantees pursuant to Art. 46 et seq. GDPR. Our service providers in third countries process the data in accordance with our instructions and are bound by contract. In the event of data being transferred to a third country, there may nevertheless be a risk that there is no adequate level of data protection in accordance with European law and that the rights of data subjects may not be fully enforceable.

In detail, we transfer your data to the following third countries:

• IT service providers in the USA: the adequate level of data protection is ensured by means of standard contractual clauses (template can be accessed here: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc)
• IT service provider in the UK: The adequate level of data protection is ensured by an adequacy decision of the European Commission (available at: https://ec.europa.eu/info/sites/default/files/decision_on_the_adequate_protection_of_personal_data_by_the_united_kingdom_-_general_data_protection_regulation_de.pdf)

Data transfers from another country are also possible through administrative access, as system operability is often ensured based on the "follow-the-sun" principle. However, your data will not be stored in other countries. In these cases, data will only be accessed if we have ensured that an adequate level of data protection is maintained.

Our website may contain links to other providers to whom our data protection provisions do not extend.

EnBW uses state-of-the-art technical and organisational security measures to protect the data you provide us from accidental or deliberate manipulation, loss, destruction or access by unauthorised persons. Our security measures are continuously improved in line with technological developments.

We strongly encourage guardians to supervise their children's online activities. Children should not transmit personal data to us without the consent of their parents or legal guardians. We do not knowingly request personal data from children and do not knowingly process such data.

With regard to the processing of your personal data, you have the right, in accordance with Art. 15 GDPR, to request information about the data we process about you. Furthermore, you have the right to have data corrected in accordance with Art. 16 GDPR, deleted in accordance with Art. 17 GDPR, or to restrict processing in accordance with Art. 18 GDPR. Furthermore, in accordance with Art. 20 GDPR, you have the right to demand the surrender of the personal data provided by you in a structured, common and machine-readable format. With regard to the right to information, the restrictions of § 34 BDSG (German Federal Data Protection Act) apply and with regard to the right of deletion, the exceptions of § 35 BDSG apply.

Right to object Art. 21 GDPR

If we process your data on the basis of a legitimate interest (Art. 6 para. 1 lit. f) GDPR) or to perform a task carried out in the public interest (Art. 6 para. 1 lit. e) GDPR), you have the right to object to this processing in accordance with Art. 21 para. 1 GDPR on grounds relating to your particular situation. In the event of an objection, we will no longer process your data unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.

You have an – unrestricted – right to object to any form of processing for purposes of direct marketing pursuant to Art. 21 para. 2 and 3 GDPR.

You may address your objection to us at any time on an informal basis.
For the best possible processing, we kindly request that you use the following contact data:

EnBW Energie Baden-Württemberg AG
Durlacher Allee 93
D-76131 Karlsruhe
Germany

Tel. (switchboard): +49 721 63-00
Customer service number: +49 721 72586-001
E-Mail: kontakt@enbw.com

Please note that you can only implement your objection to the use of tracking procedures on our website yourself. It is technically not possible to do this centrally. For each tracking procedure in which you must implement the objection yourself, we have attached an explanation above.

If we process your personal data on the basis of consent you have provided, you have the right to withdraw your consent at any time. Your data will then no longer be processed for the purposes covered by the consent. Please note that the lawfulness of data processing performed prior to the withdrawal of your consent is not affected by this withdrawal. Please refer to the above information or the information in the respective consent for details of how you can declare your objection. You are welcome to send your revocation:

EnBW Energie Baden-Württemberg AG

Durlacher Allee 93
D-76131 Karlsruhe
Germany

Tel. (switchboard): +49 721 63-00
Customer service number: +49 721 72586-001

E-Mail: kontakt@enbw.com

Here, your revocation will – if technically possible – be implemented directly centrally or you will be informed how you can implement the revocation yourself, as a central implementation by us is not possible with some technical procedures.

If you believe that the processing of your personal data violates applicable law, you may lodge a complaint with a supervisory authority at any time in accordance with Art. 77 GDPR. This is without prejudice to any other administrative or judicial remedies.

With the exception of the technically necessary data for displaying our website, any provision of data by you is voluntary. Should this be different in exceptional cases, this is explicitly mentioned at the appropriate place in this declaration.

No, we do not use automated decision-making.

In light of the circumstance that data processing is subject to change, we will also update our privacy policies from time to time. We will inform you of any changes in good time. You will find the current status of these data protection regulations here.