Data Protection

Dear users,
Welcome to the website of EnBW Energie Baden-Württemberg AG. We would like to draw your attention to this website's terms of use and privacy policy. Data protection information within the context of further data processing can be found under "Data protection documents".

The controller for purposes of processing your data is:

EnBW Energie Baden-Württemberg AG
Durlacher Allee 93
D-76131 Karlsruhe
Germany

Tel (switchboard): +49 721 63-00
Customer service number: + 721 72586-001
E-Mail: kontakt@enbw.com

If you have any questions, suggestions or complaints, you can reach us at the contact details provided above.

You can reach our data protection officer at datenschutz@enbw.com. Our data protection officer is happy to answer any questions you may have concerning data protection.

We only collect and process your data if we have either received your consent to process the data or if the processing is permitted by law.

If you visit our website for information purposes only, i.e. if you do not register or otherwise transmit data (e.g. via a contact form), we will record the data that your browser transmits to us. In detail, this comprises the following data sets:

• IP address
• Date and time of the access
• Time zone difference to Greenwich Mean Time (GMT)
• Content of the access (specific page)
• Volume of data transmitted in each case
• Website from which you visit us (referrer URL)
• Website you visit
• Browser type and version used
• Operating system and its interface
• Language and version of the browser software

This data is collected and processed in order to be able to display the website to you, to ensure and improve its stability and for security reasons. The legal basis for this processing is Art. 6 para. 1 lit. f) GDPR. The recording of this data and the storage of the data in log files is mandatory for the operation of the website. The user therefore has no possibility of objection.

If you use offers on our website which require registration, further data will be stored. Information on registration can be found in the "Registration" section of the terms of use.

Furthermore, cookies are used when using our website. Cookies are small text files which are stored on your computer by us or by another party (for more detailed information, please refer to the description of our analysis procedures below) and through which the party that sets the cookie receives certain information. Cookies are always assigned for each specific browser. By using cookies, it is not possible to execute programs or transfer viruses to your PC.

You can configure your browser settings according to your wishes and, for example, refuse to accept third-party cookies or all cookies. However, this may mean that you cannot use all the functions of our website. You are also free to delete all cookies at any time via the settings of your browser. In addition to cookies, other technologies (e.g. pixels) are also used in individual cases to collect corresponding information.

We use technically necessary cookies to make our website more user-friendly and effective. In detail, the following data is stored in the cookies and transmitted to us:

• Login information
• Form data
• Order-relevant data
• Search configurations
• Objections and agreements to information processing

The legal basis for this data processing is Art. 6 para. 1 lit. f) GDPR. The use of these cookies is intended to make it easier for you to use our website. Some functions of our website also do not work without the use of these cookies and could therefore not be offered. Our legitimate interest in the processing of the cookies results from the aforementioned purposes. The cookies are deleted at the end of the session (e.g. when you log out or close the browser) or after a specified period of time has elapsed.

We also use cookies which enable us to analyse the user behaviour of visitors to our website. In detail, the following data is stored in the cookies and transmitted to us:

• Click flows (this means that we record which of our pages you have looked at)
• Entered search terms
• Dwell time on the individual website
• A/B test: Displayed variant of variant tests

The legal basis for this data processing is Art. 6 para. 1 lit. f) GDPR. The use of analysis cookies allows us to optimise our websites and make them more demand-oriented. These purposes also substantiate our justified interest in processing this data. The analysis cookies are deleted after a specified period of time.

In addition to our own cookies, we also use third-party cookies and other third-party technologies on our website. Third-party cookies are those which are not stored on your computer by us but by third-party providers. You will find more detailed information on the scope and purpose of data processing, the respective legal basis, the storage period and the revocation, objection and removal options of third-party cookies and other technologies below in the explanation of the individual procedures we use.

On our websites, we use Google Analytics, a web analysis service from Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google"). Google Analytics generally uses so-called "cookies". These are text files that are stored on your end device, e.g. computer. This enables us to analyse the use of our websites. The cookie generates information about your use of our websites. This information including the abbreviated IP address is generally transmitted to a Google server in the USA and stored there.

Our websites use Google Analytics exclusively with the extension "_anonymizeIp()". This extension ensures that the IP address is made anonymous by shortening it, thus excluding the possibility of a direct personal reference. Due to the extension, your IP address will be abbreviated beforehand by Google within member states of the European Union or in other states that are party to the Agreement on the European Economic Area. Only in exceptional cases will a complete IP address be transmitted to a Google server in the USA and truncated there. In these exceptional cases, this processing takes place in accordance with Art. 6 Para. 1 lit. f GDPR on the basis of our justified interest in the statistical analysis of user behaviour for optimisation and marketing purposes. On our behalf, Google will use this information to evaluate your use of the website and to compile reports on website activities.

Even if cookies are rejected, our websites use tracking with Google Analytics, the processing of which is made possible in accordance with Art. 6 para. 1 lit. f GDPR on the basis of our justified interest in the statistical analysis of user behaviour for optimisation and marketing purposes. This involves a rudimentary and purely session-based tracking of website interactions. The cookie runtime is therefore 30 minutes after you have become inactive. With this rudimentary tracking, Google Analytics is configured as follows in addition to the settings mentioned above:

• Retargeting with Google Analytics in Google Ads or other Google tools is prevented.
• Google Signals for cross-device tracking is deactivated.
• Individual visits can no longer be assigned to a unique user.
• Disabling tracking is integrated (opt-out cookie).
• User ID tracking is disabled.

You can prevent the storage of cookies by adjusting your browser software accordingly. Furthermore, you can prevent the compilation and sending of data generated by the cookie, its use of website-related data (incl. your IP address) to Google and the processing of data by Google by downloading and installing the browser plugin which is available via the following link: http://tools.google.com/dlpage/gaoptout.

However, we would like to point out that in this case you may not be able to use all the functions of our website to their full extent. As an alternative to the browser plugin or within browsers on mobile devices, please click the following link to set an opt-out cookie that will prevent Google Analytics from recording data within this website in the future (JavaScript must be activated). Note: this opt-out cookie only works in this browser and only for this domain; if you delete your cookies in this browser, you will have to click this link again:

Deactivate Google Analytics

We use Application Insights, a web analytics service provided by Microsoft Corporation ("Microsoft") based on the "Azure" database application. Application Insights uses cookies. By setting the cookie, the following additional data is collected from you:

• Your operating system
• The browser you use and the version
• The screen resolution
• Your approximate location
• Your IP address (anonymised, the last octet is set to 0)

The information generated by the cookie concerning your use of our websites is normally transferred to a Microsoft server in the USA and saved there. Microsoft uses this information to evaluate the use of the websites and to compile reports on website activity. Microsoft processes personal data exclusively within the scope of our instructions on the basis of a contract for order processing. The use of Application Insights is intended to identify errors that occur and to ensure the operation of the website. Among other things, this can be used to detect attacks and take countermeasures. The legal basis for data processing is Art. 6 para. 1 f) GDPR.

You can prevent the storage of cookies by using an appropriate setting in your browser software; however, we would like to point out that if you do so, you might not be able to use all functions of this website to their full extent. The storage period of the cookie is 12 months.

Further information from Microsoft on the subject of data protection and Azure can be found at

https://privacy.microsoft.com/de-de/privacystatement.

On our websites, we use Google Analytics, a web analysis service from Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google"). Google Analytics generally uses so-called "cookies". These are text files that are stored on your end device, e.g. computer. This enables us to analyse the use of our websites. The cookie generates information about your use of our websites. This information including the abbreviated IP address is generally transmitted to a Google server in the USA and stored there.

Our websites use Google Analytics exclusively with the extension "_anonymizeIp()". This extension ensures that the IP address is made anonymous by shortening it, thus excluding the possibility of a direct personal reference. Due to the extension, your IP address will be abbreviated beforehand by Google within member states of the European Union or in other states that are party to the Agreement on the European Economic Area. Only in exceptional cases will a complete IP address be transmitted to a Google server in the USA and truncated there. In these exceptional cases, this processing takes place in accordance with Art. 6 para. 1 lit. a GDPR on the basis of our justified interest in the statistical analysis of user behaviour for optimisation and marketing purposes. On our behalf, Google will use this information to evaluate your use of the website and to compile reports on website activities.

If you accept the Google Analytics cookies, the information generated is used to provide us with further services related to the use of the website and the internet. This includes retargeting with Google Analytics in Google Ads or other Google tools and the use of Google signals to enable cross-device recognition of a user. The IP address transmitted by your browser as part of Google Analytics will not be merged with any other data held by Google. The cookie duration is 12 months.

You can prevent the storage of cookies by adjusting your browser software accordingly. Furthermore, you can prevent the compilation and sending of data generated by the cookie, its use of website-related data (incl. your IP address) to Google and the processing of data by Google by downloading and installing the browser plugin which is available via the following link: http://tools.google.com/dlpage/gaoptout.

However, we would like to point out that in this case you may not be able to use all the functions of our website to their full extent. As an alternative to the browser plugin or within browsers on mobile devices, please click the following link to set an opt-out cookie that will prevent Google Analytics from recording data within this website in the future (JavaScript must be activated). Note: this opt-out cookie only works in this browser and only for this domain; if you delete your cookies in this browser, you will have to click this link again:

Deactivate Google Analytics

As an AdWords customer, we also use Google Conversion Tracking on our website. This is an analysis service of Google Inc., (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, "Google"). As part of this service, Google AdWords sets a cookie on your computer ("conversion cookie") if you have reached our website via a Google advertisement. This type of cookie loses its validity after 30 days and is not used to identify you personally. If you visit some of our pages and the cookie has not expired, this cookie enables us and Google to recognise that someone has clicked the ad and been redirected to our site. Since every AdWords customer receives a different cookie, it is not possible to track the cookie through websites of other AdWords customers. The purpose of using the conversion cookie is to use the information collected to compile conversion statistics for AdWords customers. As an AdWords customer, we only learn the total number of users who clicked our ad and were redirected to a page with a conversion tracking tag. However, we do not receive any information that allows us to personally identify a user.

The legal basis for the processing is the declaration of consent given by you when you access this website within the framework of our cookie banner (Art. 6 para. 1 a, 7 GDPR). You can revoke your consent at any time with effect for the future. To do this, configure your browser settings according to your wishes and refuse to accept third-party cookies or all cookies, for example. You can also deactivate cookies for conversion tracking by setting your browser to block cookies from the "googleadservices.com" domain. Please note that the browser settings you make only work for the browser you are using.

We use the DoubleClick by Google service on our website to display ads that are relevant to you. DoubleClick by Google is a service of Google Inc, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google").

When you use DoubleClick, your browser is assigned a pseudonymous identification number (ID) in order to be able to determine that you have visited our site, which ads have been shown in your browser and which ads have been viewed. The cookies do not contain any information that enables us to identify you directly. DoubleClick's use of cookies enables Google and its partner sites to serve ads based solely on previous visits to our site or other websites.

The information generated by the cookies is transferred by Google to a server in the USA for evaluation and stored there. A transfer of the data by Google to third parties only takes place due to legal regulations or within the scope of order data processing.

The legal basis for the processing is the declaration of consent given by you when you access this website within the framework of our cookie banner (Art. 6 para. 1 a, 7 GDPR). You can revoke your consent at any time with effect for the future. Prevent the recording of the data generated by the cookies and their transmission to Google by downloading and installing the browser plug-in available at https://support.google.com/ads/answer/7395996?hl=de. verfügbare Browser-Plugin herunterladen und installieren. Alternatively, you can also prevent the storage of cookies by adjusting your browser software accordingly. For more information about data protection at DoubleClick, please visit https://www.google.com/intl/de/policies/.

On our website, we use the remarketing technology of Google Inc. (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; "Google"). By using this technology, it is possible to address users who have already visited our website and online services and are interested in the offer again through targeted advertising on the pages of the Google Partner Network. The display of the advertising is achieved by the use of cookies, i.e. small text files that are stored on the user's computer. The purpose of data processing is to analyse user behaviour when visiting the website with the help of the text files and then to use this information for targeted product recommendations and interest-based advertising.

The legal basis for the processing is the declaration of consent given by you when you access this website within the framework of our cookie banner (Art. 6 para. 1 a, 7 GDPR).

The remarketing cookies used have a maximum validity of 60 days after your last visit. Please note that this period begins to run again the next time you visit our website.

You can revoke your consent at any time with effect for the future. Such a revocation is possible via the website https://support.google.com/ads/answer/2662922. Alternatively, you can deactivate the use of third-party cookies by going to the deactivation page of the network advertising initiative.

Please also note that Google has its own data protection guidelines, which are independent of ours. We assume no responsibility or liability for these policies and procedures. Please review Google's data protection provisions before using our website. You can find this here:

https://policies.google.com/privacy.

For the purpose of placing interest-related advertisements, cookies are set on our website by Adform A/S (Wildersgade 10B, 1, 1408 Copenhagen K, Denmark). These cookies store information about the operating system, browser version, geographical location, URLs where Adform advertisements are displayed and the number of clicks or views. Immediately when the data is collected, your IP address is anonymised by truncating it by the last three digits. The collected data can therefore not be related to any person, neither for Adform nor for us. The cookie set by Adform has a term of 60 days. The data collected with the Adform cookie is used for the following purposes:

• Recording the number of visitors to our websites
• Determining the order in which a visitor visits the various pages of our website
• Assessing which parts of our website need to be adapted
• Optimising the website

The legal basis for this is the declaration of consent given by you when you access this website within the framework of our cookie banner (Art. 6 para. 1 a, 7 GDPR). You can revoke your consent at any time with effect for the future. If you do not want Adform to collect your data, you can revoke your consent at any time by clicking the following link: https://site.adform.com/privacy-center/website-privacy/opt-out.

We use a service of AWIN AG, Eichhornstraße 3, D-10785 Berlin, Germany on our website. As part of its tracking services under the tracking domain *.zanox.com, AWIN stores cookies on the end devices of users who visit or use our websites or other online services provided by us (e.g. when you register for a newsletter or place an order) for the purpose of documenting transactions (e.g. leads and sales). These cookies are used solely for the purpose of correctly allocating the success of an advertising medium and the corresponding billing of advertising costs. Personal data is not processed or used by us in this process. Your IP address will be shortened immediately after recording. A cookie only contains information about when a particular advertising medium was clicked by an end device. In the Awin Tracking Cookies under *.zanox.com an individual sequence of numbers, but not one by means of which the individual user can be assigned, is stored, with which the following information is documented:

• the partner programme of an advertiser
• the Publisher
• the time of the user's action (click or view)

The legal basis for the processing is the declaration of consent given by you when you access this website within the framework of our cookie banner (Art. 6 para. 1 a, 7 GDPR). You can revoke your consent at any time with effect for the future. If you do not wish cookies to be stored in your browser, you can revoke your consent via this link: https://www.awin.com/de/rechtliches/cookieoptout. If you click this link, a *.zanox.com opt-out cookie will be created and stored in your browser. This cookie prevents tracking services under the tracking domain *.zanox.com from placing further cookies on your terminal device in the future. At the same time, all Awin Tracking Cookies under *.zanox.com that may already exist on your terminal device will be deleted. You can also revoke the tracking service by changing your browser settings accordingly. You can deactivate the storage of cookies in your browser under Tools/Internet options, restrict it to certain websites or set your browser to notify you when a cookie is sent. Please note, however, that in this case you must expect a restricted display of the online offers and restricted user guidance. You can also delete cookies at any time. In this case, the information stored in them will be removed from your end device.

This website uses the web analysis service with bid management from intelliAd Media GmbH, Sendlinger Str. 7, D-80331 Munich, Germany. For the purpose of designing and optimising this website, anonymised usage data is collected and stored in aggregated form, and usage profiles are created from this data using pseudonyms. When using intelliAd tracking, cookies are stored locally.

The legal basis for the processing is the declaration of consent given by you when you access this website within the framework of our cookie banner (Art. 6 para. 1 a, 7 GDPR). The collected data is anonymised directly during the recording by shortening the IP address. A conclusion about your person is not possible from the remaining data. You can revoke your consent at any time with effect for the future. For a revocation, you deactivate the data recording by clicking the following website: intelliAd Opt-Out function.

We use content discovery technology from Taboola (16 Madison Square West, 7th Floor, New York, New York 10010) to recommend additional online content that may be of interest to you. Taboola’s representative in the EU is LionheartSquared (Europe) Ltd., 2 Pembroke House, Upper Pembroke Street 28 - 32, Dublin, D02 EK 84, Ireland. In order to provide these recommendations, Taboola uses cookies and similar technologies to collect information about your device and your user behavior on this website (and other partner websites), and uses pseudonyms to create user profiles that fundamentally do not permit any conclusions to be drawn about personal data. The legal basis for processing [Art. 6 (1) lt. a) GDPR] is the declaration of consent that you submitted in our cookie banner when you called up this website.

In addition to the general withdrawal options, you can also use the following link to withdraw your consent and prevent Taboola from collecting data within this website in the future:

https://www.taboola.com/policies/privacy-policy#user-choices-and-opting-out

The pseudonymous profiles created in this way will be saved by Taboola for 13 months.

Additional information can be found in Taboola’s Privacy Policy (https://www.taboola.com/privacy-policy).

We use ONE technology from Thunderhead 5th Floor, Ingeni Building, 17 Broadwick Street London W1F 0DJ. Here a ONE cookie is stored on your device. If you are not logged into the customer portal/registered area, your user behaviour will be recorded anonymously. Your user behaviour includes which of our websites you visit, how long you stay there, what you "click" or in which fields you enter data (so-called listening and capturing). This serves to improve our website as well as our products and services as such, as we hope to gain insights into what interests our customers or interested parties/users of our websites and which functions they use and how. The IP address is anonymised immediately when the data is collected.

The following data is collected:

Device manufacturer, device model, device type (e.g. smartphone, tablet), name and version of the operating system, name and version of the browser used as well as information on whether Flash is supported, location data (geo-coordinates) of the device and accuracy of the location data measured in metres, state and city from which the last known interaction with the ONE cookie took place, as well as a time stamp, when the device communicated with the ONE cookie for the first time and last time and when geo-coordinates were last available. It also records what postcode you enter within the context of an electricity and gas availability, what electricity or gas consumption you name, the product (electricity/gas) you click, whether you are logged in and if so, your customer number.

The legal basis for the processing is the declaration of consent given by you when you access this website within the framework of our cookie banner (Art. 6 para. 1 a, 7 GDPR). You can revoke the consent you have given at any time with effect for the future by setting your browser to delete the cookies you have stored or to prevent your browser from accepting cookies. Furthermore, we expressly point out that the deletion and/or prevention of the acceptance of cookies is limited, as the browser setting is only valid for the browser currently in use. If you use a different or new browser, the browser setting must be reset.

If you log in to the registered area and have given your consent to do so, the data collected by means of the Thunderhead cookie on user behaviour will be processed in a personalised manner by linking it to your identity and your contractual data. The purpose of creating your personal customer profile is to enable us to display content tailored to you and your interests, which we assume could be particularly helpful or interesting for you in your situation. Thunderhead will not receive any personal data in this process. The legal basis for data processing is Art. 6 para. 1 a) GDPR. The customer profile created in this way will be stored until you either revoke your consent or until our purposes in connection with the contractual relationship existing between us expire. For further information, please refer to the data protection information regarding the contractual relationship between us.

We use the Amazon Conversion Pixel and the Amazon Retargeting Pixel of Amazon.com Inc. 410 Terry Ave. North Seattle, WA, USA on our website. Amazon Europe Core S.a.r.l., Rue Plaetis 5, L-2338 Luxembourg, acts as our contract processor when using the pixels.

When you visit our website, an Amazon cookie is set on your computer. The cookie tells Amazon that you have visited our website, which website you came from, what actions you perform on our website (clicks, page views), whether you log in or register, whether you fill in forms and whether your visit resulted in a purchase or order of one of our offers. The data collected using this procedure is not merged with other data stored about you at Amazon (e.g. your Amazon customer account). Your IP address will only be used by Amazon for abuse control purposes and will then be shortened (last 8 digits are set to 0).

In order to recognise you on other websites, in apps or when using other Amazon services, Amazon uses pseudonymous identifiers. The data collected is deleted at the latest 13 months after the last interaction with the browser or device. Data processing may also take place in a country outside the European Economic Area. In this case, however, an adequate level of data protection is always established. This procedure enables us to display advertising tailored to your interests and to optimise and cost-effectively implement our advertising measures.

The legal basis for the processing is the declaration of consent given by you when you access this website within the framework of our cookie banner (Art. 6 para. 1 a, 7 GDPR). You can revoke the consent you have given us at any time with effect for the future by making a corresponding setting at https://www.amazon.de/adprefs. Alternatively, you can also set your preferences at http://www.youronlinechoices.com/de. Further information on data processing with regard to interest-based advertising by Amazon can be found at http://www.amazon.de/gp/BIT/InternetBasedAds.

Facebook Pixel is used on our websites. This is a JavaScript code snippet that enables us to track the activities of our website visitors. The Facebook Pixel is used by Facebook Inc, 1 Hacker Way, Menlo Park, CA 94025, USA, or if you are located in the EU, by Facebook Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland ("Facebook"). The use of the Facebook pixel as well as the storage of "conversion cookies" is only carried out if you have given your consent to the use of cookies and similar procedures when visiting our website. The legal basis is Art. 6 para. 1 lit. a GDPR.

With the help of the Facebook pixel, Facebook is able to determine you as a target group for the display of advertisements (so-called "Facebook ads") by visiting our online offer. In order to make this possible, we use the Facebook pixel to display the Facebook Ads placed by us only to those Facebook users who have also shown an interest in our online offer or who have certain characteristics. A certain characteristic could for example be the interest in a certain product, which could be defined by the website visit. The information collected is transmitted to Facebook (so-called "customer audiences"). We do not have access to this information ourselves. With the help of the Facebook pixel, we want to ensure that our Facebook advertisements match the potential interest of the users. We can also use the Facebook Pixel to track the impact of Facebook Ads for statistical and market research purposes by seeing whether network visitors have been redirected to our website after clicking a Facebook ad (so-called "conversion tracking").

Example 1 for custom audiences (remarketing): you visit our website, are interested in an electricity tariff and Facebook provides you with further relevant information on the respective product for us via a Facebook advertisement at a later date, based on your interests. The advertising offer tailored to your interests will be displayed on Facebook, Instagram or on other websites cooperating with Facebook.

A special form of customer audiences are the so-called "lookalike audiences". With this method, not the actual website visitors are addressed, but network members with comparable profile characteristics. This means that the advertising message is not displayed to the website visitor, but to the so-called "lookalikes". Comparable profile characteristics can include age, place of residence or interests.

Example 2 for custom audiences (lookalikes): you visit our website and are interested in an electricity tariff. Based on your interest in our product and your profile characteristics, Facebook will display advertisements on Facebook, Instagram or other websites cooperating with Facebook that resemble your profile.

When using the Facebook pixel, the following information is passed on to Facebook:

• HTTP header information: e.g. IP address, web browser information, page location, document, referrer.
• Pixel-specific data: this includes the pixel ID and Facebook cookie data
• Standard and user-defined data events – e.g:
• Visit to our websites
• Interactions with certain website content (e.g. articles)
• Price enquiries made
• Degrees awarded

The Facebook pixel, which is integrated into our website and on partner pages of Facebook, also recognises whether you are the owner of a Facebook account and are using it on the basis of the Facebook cookies set. Via the Facebook pixel, the generated data about your usage behaviour is forwarded to Facebook. Your Facebook ID is also transferred, which enables a data link on Facebook pages. If you would like to check this data recording, further processing and the general use of the data and/or deactivate this procedure, you can do this directly in the settings of your Facebook account.

Privacy policy of Facebook

Data processing by Facebook is carried out in accordance with the Facebook Data Usage Guidelines. Accordingly, you will find general information on the presentation of Facebook advertisements in the Facebook Data Usage Guidelines. Further information on the Facebook pixel can be found in the Facebook help section.

Revocation and other privacy settings

You can revoke the consent you have given at any time. If you wish to revoke the consent you have given, please click here. This will delete the Facebook pixel.

In order to set directly on Facebook which types of advertisements are displayed to you within Facebook, you can access the page set up by Facebook and follow the instructions there on the settings for usage-based advertising. The settings are platform-independent, i.e. they are applied to all devices, such as desktop computers or mobile devices. You can also object to the use of cookies for audience measurement and advertising purposes via the deactivation page of the Network Advertising Initiative and additionally via the US website aboutads.info or the European website youronlinechoices.com.

On our website, we use a service from YouTube LLC, 901 Cherry Avenue, San Bruno, CA 94066, USA for the integration of videos. The videos are stored at http://www.YouTube.com. You can play these videos directly from our website. The videos are all embedded in "enhanced privacy mode", which means that no information about you as a YouTube user will be stored unless you play the videos. Nevertheless, YouTube will contact Google's Double Click service and, according to YouTube, no data will be stored in this case. Only when you play the videos will your IP address and the information that you have watched the video be saved by YouTube. If you are logged in to YouTube, this information is also assigned to your YouTube user account. If you do not wish this to happen, you will need to log out of your YouTube account before playing the video. We have no influence on the data recording and processing by YouTube. You can find more detailed information about the data processing by YouTube in their privacy policy. You can find this at www.google.de/intl/en/policies/privacy.

By a personal customer profile, we mean a data base consisting of the following data:

1. Data that is collected during the use of our digital offers regarding your online usage behaviour
   By this, we mean data that is collected when you visit our website and our social media presence, when you use one of our apps and when we send you our newsletter or push notifications. In detail, this includes information about which pages you view, when and how long you visit us or use our apps, whether you read our newsletter and which devices you use for this purpose. Which data is collected in detail and on the basis of which legal basis within the scope of the respective digital offer is explained in the data protection information of the respective digital offer.
2. Customer and contract-related data
   By this we mean data which we have received from you within the framework of a pre-contractual or contractual relationship. This includes, for example, your name, contact details, contractual details such as your tariff and consumption and also technical or constructional data insofar as it was collected within the scope of our (pre-)contractual relationship (e.g. roof area, system performance data).
3. Further information made available
   By this we mean all data which you yourself have given us outside our contractual or pre-contractual relationship or which you have generated using our applications. This can be, for example, your expressed interest in one of our products or services, but also, for example, an indication of an impending move or other changes to your home, which could have an impact on the tariff that is best for you. Another example is when you use our e-mobility driving simulation to find out whether an e-car could be useful for you.
4. Data that we collect in the course of your communication with us
   By this we mean data that we collect in connection with a communication with you in addition to the information provided in terms of content. This concerns in particular our assessment of your satisfaction.

If you have given your consent to the creation of a personal customer profile, this data will be combined and evaluated on a personal basis. The purpose of creating your personal customer profile is to enable us to inform you of content tailored to your interests, which we assume could be particularly helpful or interesting for you in your situation. In addition, we can make you more suitable offers which are highly likely to be of interest to you. In addition, we can use the customer profile to offer you advice tailored to your personal needs and give you more transparency regarding your energy consumption and costs and help you avoid unnecessary consumption.

Legal basis for data processing is your consent (Art. 6 para. 1 a) GDPR). The personal customer profile created will be deleted when it is no longer required for the purposes for which it was created, at the latest when you withdraw your consent.

Please note that the issuance/non-granting of consent has no influence on data processing that is already permitted on the basis of other legal bases (such as for contractual purposes (Art. 6 para. 1 b) or for legitimate interests (Art. 6 para. 1 f) GDPR)).

Individual offers on our websites require registration. The use of these offers is voluntary. The data required for registration is requested during the registration process. These are, for example, your name, your e-mail address, your date of birth and a password of your choice. This data is required for registration purposes. The data requested during the registration process will be stored by us for the purpose of managing your customer portal access until you delete your account. The legal basis for data processing is Art. 6 para. 1 b) GDPR.

If you contact us via a form on www.enbw.com, this is always done using 128-bit encryption. If you do not use the EnBW contact forms but use your private mail account, you should note that you must take your own security measures to ensure the confidentiality of your message. Therefore please use the encrypted forms of EnBW. If the form is not encrypted, there is a technical problem and we cannot assume any liability for the security of your data transmission. You can see whether a form is encrypted by the closed "padlock" icon in your browser window. Depending on the content of your request, the legal basis for data processing is Art. 6 para. 1 b), f) or a). We will delete the data that you send us by means of your enquiry once the respective purpose has been achieved. If the transmitted enquiry refers to a contract concluded with us, your enquiry will be deleted as explained in the data protection information of the respective contract. The data protection information for your respective contract can be found here.

If you contact us by telephone, we will use the information you provide us with in accordance with the purpose for which you contacted us. Depending on the content of your request, the legal basis for data processing is Art. 6 para. 1 b), f) or a). We will delete the data that you provide us with during the telephone call once the respective purpose has been achieved. Should our telephone call be in connection with an existing contract or in connection with a contract enquiry, please also note our data protection information regarding the respective product. You can find this data protection information here.

We offer our customers and interested parties the possibility to communicate with us via Facebook Messenger (a product of Facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA). Should you decide to use this option, please note the following:

we would like to point out that the chat history cannot be deleted by us or by you. In the event of the exchange of contract-relevant information, we will store this data in our system for verification purposes. The legal basis for data processing is Art. 6 para. 1 b) GDPR. Please refer to the data protection information of your contract concluded with us for the storage period of the data stored for verification purposes. However, we would like to point out that we have no influence on the data processing by Facebook. Please note that a Facebook chat can be unencrypted and Facebook therefore has access to the content of our communication. You can tell whether the chat is encrypted by the fact that a padlock symbol is displayed in the profile picture within Facebook Messenger. Further information on the use of data by Facebook is available at https://www.facebook.com/about/privacy/.

On our website, we have integrated so-called news feeds from social networks such as Facebook, Twitter and Google+. When visiting our website, these news feeds are disabled by default. This means that no data is sent to the respective social networks if you don't activate the news feeds. To activate the news feeds, you must start by clicking them. The news feed then remains activated until the browser window is closed. As soon as you have activated the respective news feed, a direct connection is established with the server of the respective social network. This way, the content of the news feed is transmitted to your browser and integrated into the displayed website. By activation, the information you accessed on our website is transmitted to the operator of the respective social network. If, during your visit to our website, you are logged in to the social network via your personal user account, the social network can assign the website visit to your account. This applies regardless of whether you actually use the news feed after activation, or not. Through interaction with the news feed, e.g. by leaving a comment, this corresponding information is transmitted directly to the respective social network and stored there. The legal basis for the transmission of data to the respective social network is your consent (Art. 6 para. 1 a) GDPR), which you give by activating the respective news feed. We would like to point out that we have no influence on the extent of the data collected by the social networks via the news feeds. The scope and the purposes of data processing pursued by the social networks, as well as your related rights and setting options for the protection of your privacy can be found in the data privacy information of the respective social networks.

You have the possibility to subscribe to a newsletter on our website. If you do so, we will inform you about our offers at regular intervals. To subscribe to the newsletter, you must provide us with a valid e-mail address and register to receive the newsletter. We will then check your e-mail address to see whether you are actually the owner of this e-mail address or whether you have access to the specified e-mail account (double opt-in procedure).

Furthermore, we use your e-mail address exclusively for sending the newsletter. If you register for our newsletter, we log your IP address, the date and time of your registration for verification purposes. The data collected when you order the newsletter will not be merged with other data collected via our website unless you have given us permission to do so. The legal basis for data processing is your consent to receive the newsletter (Art. 6 para. 1 a) GDPR). If you no longer wish to receive the newsletter, you can unsubscribe at any time. Simply click the unsubscribe link at the end of the respective newsletter. By doing so, you revoke your consent to receive the newsletter. The legality of the data processing up to the time of the revocation remains unaffected.

Your data, which was collected in connection with the newsletter, will be deleted 3 years after the end of the year in which you have unsubscribed.

On our website, you have the opportunity to give feedback on individual services in the form of a star rating. The possibility to provide information is purely voluntary and anonymous. In addition, when submitting a star rating, you can also write a comment and send it to us. Your rating serves the purpose of improving our services. The legal basis for the aforementioned data processing is Art. 6 Para. 1 f) GDPR or Art. 6 Para. 1 a) GDPR. We delete comments received as soon as the purpose ceases to apply, as a rule after one year.

Insofar as we are subject to legal obligations that make further processing of your data necessary, we will also process your data for the purposes provided by law. The legal basis for this data processing is Art. 6 para. 1 c) GDPR in conjunction with the norm which contains the respective legal obligation.

Data will also be processed if and to the extent that you have consented to data processing in accordance with Art. 6 para. 1 a GDPR. The purposes of the data processing result from the respective consent.

We treat your data with confidentiality. Within EnBW Energie-Baden Württemberg AG, only those departments and employees who need your data to fulfil the above-mentioned purposes will have access to it.

Personal data is only shared with third parties by us if necessary and legally permitted for the aforementioned purposes or if you have given your prior consent.

In addition to the recipients already specifically named above, we make use of other service providers (contract processors) to fulfil our obligations. The following categories of recipients may receive data:

• IT service provider
• Survey service provider
• Call centre
• Marketing service provider
• Analysis specialists
• Disposal of files and data carriers
• Authorities
• Legal guardians and persons for whom a power of attorney exists

Personal data is also only transferred to other Group companies if there is a legal basis to do so and it is necessary for one of the purposes mentioned above.

We also transfer your data to service providers and vicarious agents who are located in third countries and carry out data processing there. Compliance with an adequate level of data protection is ensured on the basis of adequacy decisions pursuant to Art. 45 GDPR or by other appropriate or adequate guarantees pursuant to Art. 46 et seq. GDPR. Our service providers in third countries process the data in accordance with our instructions and are bound by contract. In the event of data being transferred to a third country, there may nevertheless be a risk that there is no adequate level of data protection in accordance with European law and that the rights of data subjects may not be fully enforceable.

In detail, we transfer your data to the following third countries:

• IT service providers in the USA: the adequate level of data protection is ensured by means of standard contractual clauses (template can be accessed here: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc)

Data transfers from another country are also possible through administrative access, as system operability is often ensured based on the "follow-the-sun" principle. However, your data will not be stored in other countries. In these cases, data will only be accessed if we have ensured that an adequate level of data protection is maintained.

Our website may contain links to other providers to whom our data protection provisions do not extend.

EnBW uses state-of-the-art technical and organisational security measures to protect the data you provide us from accidental or deliberate manipulation, loss, destruction or access by unauthorised persons. Our security measures are continuously improved in line with technological developments.

We strongly encourage guardians to supervise their children's online activities. Children should not transmit personal data to us without the consent of their parents or legal guardians. We do not knowingly request personal data from children and do not knowingly process such data.

With regard to the processing of your personal data, you have the right, in accordance with Art. 15 GDPR, to request information about the data we process about you. Furthermore, you have the right to have data corrected in accordance with Art. 16 GDPR, deleted in accordance with Art. 17 GDPR, or to restrict processing in accordance with Art. 18 GDPR. Furthermore, in accordance with Art. 20 GDPR, you have the right to demand the surrender of the personal data provided by you in a structured, common and machine-readable format. With regard to the right to information, the restrictions of § 34 BDSG (German Federal Data Protection Act) apply and with regard to the right of deletion, the exceptions of § 35 BDSG apply.

Right to object Art. 21 GDPR

If we process your data on the basis of a legitimate interest (Art. 6 para. 1 f) GDPR) or to perform a task carried out in the public interest (Art. 6 para. 1 e) GDPR), you have the right to object to this processing in accordance with Art. 21 para. 1 GDPR on grounds relating to your particular situation. In the event of an objection, we will no longer process your data unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.

You have an – unrestricted – right to object to any form of processing for purposes of direct marketing pursuant to Art. 21 para. 2 and 3 GDPR.

You may address your objection to us at any time on an informal basis.

For the best possible processing, we kindly request that you use the following contact data:

EnBW Energie Baden-Württemberg AG

Durlacher Allee 93
D-76131 Karlsruhe
Germany

Tel. (switchboard): +49 721 63-00
Customer service number: +49 721 72586-001

E-Mail: kontakt@enbw.com

Please note that you can only implement your objection to the use of tracking procedures on our website yourself. It is technically not possible to do this centrally. For each tracking procedure in which you must implement the objection yourself, we have attached an explanation above.

If we process your personal data on the basis of consent you have provided, you have the right to withdraw your consent at any time. Your data will then no longer be processed for the purposes covered by the consent. Please note that the lawfulness of data processing performed prior to the withdrawal of your consent is not affected by this withdrawal. Please refer to the above information or the information in the respective consent for details of how you can declare your objection. You are welcome to send your revocation:

EnBW Energie Baden-Württemberg AG

Durlacher Allee 93
D-76131 Karlsruhe
Germany

Tel. (switchboard): +49 721 63-00
Customer service number: +49 721 72586-001

E-Mail: kontakt@enbw.com

Here, your revocation will – if technically possible – be implemented directly centrally or you will be informed how you can implement the revocation yourself, as a central implementation by us is not possible with some technical procedures.

If you believe that the processing of your personal data violates applicable law, you may lodge a complaint with a supervisory authority at any time in accordance with Art. 77 GDPR. This is without prejudice to any other administrative or judicial remedies.

With the exception of the technically necessary data for displaying our website, any provision of data by you is voluntary. Should this be different in exceptional cases, this is explicitly mentioned at the appropriate place in this declaration.

No, we do not use automated decision-making.

In light of the circumstance that data processing is subject to change, we will also update our privacy policies from time to time. We will inform you of any changes in good time. You will find the current status of these data protection regulations here.