Privacy Notice – TRACE.Parser

This Privacy Policy is updated regularly. The current version is always available at Privacy Notice – TRACE.Parser.

1. Scope of this Privacy Policy

This Privacy Notice applies exclusively to TRACE.Parser, the cloud-based SaaS tool for automated processing and analysis of energy production profiles by TRACE Electricity GmbH, accessible at parser.trace-electricity.com.

TRACE.Parser is directed exclusively at business customers (B2B). TRACE Electricity GmbH acts as Data Processor for the respective Controllers pursuant to Art. 28 GDPR. The client (customer) remains the Controller within the meaning of Art. 4 No. 7 GDPR.

The following privacy and contractual documents apply to TRACE.Parser:

• Privacy Notice – TRACE.Parser – this document; governs all data processing within TRACE.Parser
• Data Processing Agreement (DPA) – TRACE.Parser – pursuant to Art. 28 GDPR, automatically becomes part of the contract upon conclusion
• Technical and Organizational Measures (TOM) – TRACE.Parser – security measures pursuant to Art. 32 GDPR, annex to the DPA

For the website trace-electricity.com, a separate Privacy Policy applies. For TRACE.App, the Privacy Notice – TRACE.App applies.

2. Controller

The Controller for the processing of personal data in the context of TRACE.Parser is:

Insofar as TRACE processes personal data of employees or end customers of corporate clients on their behalf, TRACE acts as Data Processor pursuant to Art. 28 GDPR; the client remains the Controller. The legal basis is the Data Processing Agreement (DPA) concluded with the customer.

TRACE Electricity GmbH
Dorothea-Bernstein-Weg 48
22081 Hamburg
Germany
Email: privacy@trace-electricity.com

TRACE Electricity GmbH has not appointed a Data Protection Officer, as the statutory requirements under Art. 37 GDPR in conjunction with § 38 BDSG are not met.

3. What is TRACE.Parser?

TRACE.Parser is a cloud-based SaaS tool for automated processing and analysis of energy production profiles. Users can upload production data (e.g. as CSV or XLSX files); the application analyses these for data errors, anomalies and metrics / key figures and provides the results as reports.

TRACE.Parser is directed exclusively at companies and commercially active persons. Use by minors under 18 years of age is not intended.

4. What data do we process?

Data processed in TRACE.Parser

Upload data (production profile CSV): Uploaded CSV files with electricity production profiles are processed exclusively for analysis purposes and are automatically deleted within 24 hours after completion of the analysis. Storage location: AWS eu-central-1 (Frankfurt).

Analysis results: Calculated evaluations (e.g. LCOE values, production profiles) are stored for the duration of the usage contract and deleted within 30 days after the contract ends.

Storage limitation: All temporary processing data is deleted immediately after processing is complete (Art. 5(1)(e) GDPR).

4.1 Registration and contact data

When requesting a trial access or quote, we collect:

• First and last name
• Business email address
• Company and industry (optional)
• Position / job title (optional)
• Content of the enquiry

If you register for TRACE.Parser via a third-party provider service (e.g. Google), we receive the profile data transmitted by that service (name, email address) as part of the OAuth process. Please note that Google processes data in accordance with its own privacy policy when you use Google login (policies.google.com/privacy). We have no influence over this processing. You can revoke TRACE application access to your Google account at any time at myaccount.google.com/permissions.

When using Google Sign-In, the privacy policies of Google Ireland Ltd. also apply (policies.google.com/privacy). Transfer of data to the USA is based on the EU-U.S. DPF. Should the EU-U.S. adequacy decision (C(2023) 4745) be suspended or revoked, the transfer will alternatively be based on the EU Standard Contractual Clauses pursuant to Implementing Decision (EU) 2021/914.

After conclusion of the contract, we also store the account access data (email address as user identifier) and, if applicable, billing data.

4.2 Usage data

During use of TRACE.Parser, technical usage data is collected automatically:

• Timestamps of logins and analysis calls
• Number and type of analyses performed (credit consumption)
• Browser type and operating system (for technical support)
• IP address (anonymised before permanent storage; a complete IP address is not persisted)

4.3 Uploaded production profiles (commissioned data)

The production profiles (CSV/XLSX) uploaded by the customer may contain measurement data that – depending on configuration – can be related to individuals (e.g. for installations on privately used properties). This data is processed by TRACE exclusively to carry out the commissioned analysis. The customer remains the Controller with regard to this data; TRACE acts as Data Processor pursuant to Art. 28 GDPR. As Controller, the customer is responsible for ensuring that they have an appropriate legal basis under Art. 6 GDPR to transfer personal data contained in the uploaded production profiles to TRACE for processing.

Note on energy production profiles: TRACE.Parser processes electricity production profiles and plant data. This data generally relates to commercial installations (B2B) and not to individual consumers. Where personal data of natural persons is included in individual cases (e.g. for small-scale installations), these are processed with particular care.

Energy consumption data imported as part of the analysis may contain personal data (e.g. location data, consumption patterns). The client is responsible for the lawfulness of the transfer of this data (DPA §4).

5. Processing and results

Data processing is carried out automatically on the basis of algorithms and technical processes.

The results generated by TRACE.Parser may be incomplete or erroneous. The provider assumes no liability for the accuracy, correctness, completeness or suitability of the results for any particular purpose.

Responsibility for reviewing and using the results lies exclusively with the customer.

Anonymised use for training purposes: TRACE Electricity is entitled to create statistically aggregated and fully anonymised datasets from the processed production profile data and to use these for the further development and training of its own algorithms and AI models. Anonymisation is carried out in accordance with the requirements of Recital 26 GDPR; re-identification of individual clients or their customers is technically excluded. Legal basis: Art. 6(1)(f) GDPR (legitimate interests of TRACE in product improvement). Within the framework of the Data Processing Agreement, use of your data for training proprietary AI models is excluded insofar as personal data is concerned. Customers may object to the use of their data for training purposes at any time (Art. 21 GDPR) — by email to privacy@trace-electricity.com.

6. Legal bases

• Contract initiation and performance (Art. 6(1)(b) GDPR): Processing of registration and contact data as well as usage data required for the provision of the service.
• Legitimate interests (Art. 6(1)(f) GDPR): Processing of technical usage data to ensure operations, to detect and repel attacks (intrusion detection), for fault diagnosis and for product development. TRACE has carefully weighed that this processing does not constitute an unreasonable impairment of the persons concerned: the data collected is technical in nature (IP addresses anonymised, timestamps, error codes), is not used for profiling or advertising purposes and is deleted after 30 days. The interest in smooth and secure operations outweighs users' interest in non-processing. The legitimate interest lies in abuse prevention, system security and improvement of the Parser service.
• Legal retention obligations (Art. 6(1)(c) GDPR): Retention of billing and contract data pursuant to § 147 AO, § 257 HGB (6 and 10 years respectively).
• Commissioned data processing (Art. 28 GDPR): Processing of the uploaded production profiles on the instructions of the customer.
• Consent (Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG): The TRACE.Parser landing page on trace-electricity.com sets – after your consent – analytics and marketing cookies (Google Analytics 4, Hotjar, LinkedIn Insight Tag). Details and withdrawal: Privacy Policy of the TRACE website.

Differentiation under TDDDG:

• § 25(2)(2) TDDDG (technically necessary, no consent required): Session cookie, CSRF token, authentication token.
• § 25(1) TDDDG (requiring consent): Analytics tools (Google Analytics 4, Hotjar, LinkedIn Insight Tag) – only after prior consent.

7. Obligation to provide data

The provision of name and business email address is contractually required for requesting trial access and, after conclusion of the contract, for the operation of the account. Without this information, no access to TRACE.Parser can be provided.

The provision of production profiles (CSV/XLSX) is required for the performance of the commissioned analysis service; without production data, no analysis can be carried out. Further details (industry, function) are voluntary.

8. Commissioned data processing and sub-processors

TRACE uses the following service providers as sub-processors. Data Processing Agreements required under Art. 28 GDPR are in place with all service providers.

All production data is processed exclusively within the EU.

For email delivery (registration confirmation, price change notifications), TRACE uses Amazon Web Services (AWS SES), Frankfurt (EU). AWS acts as Data Processor pursuant to Art. 28 GDPR.

AWS EMEA SARL (Luxembourg) uses AWS Inc., 410 Terry Ave. North, Seattle, WA 98109, USA as a sub-processor. Legal basis for the third-country transfer: EU Standard Contractual Clauses (Decision 2021/914, Module 4: Processor→Processor) in conjunction with EU-U.S. Data Privacy Framework. AWS Inc. is certified under the EU-U.S. DPF. Should the EU-U.S. adequacy decision (C(2023) 4745) be suspended or revoked, the transfer will alternatively be based on the EU Standard Contractual Clauses pursuant to Implementing Decision (EU) 2021/914.

Third-country transfers – legal bases: The legal basis for third-country transfers for US providers (Google, AWS, Cloudflare) is the EU-U.S. Data Privacy Framework (DPF, adequacy decision of the EU Commission of 10 July 2023) and Standard Contractual Clauses (SCCs) of the EU Commission (Decision 2021/914). Certification status can be verified at dataprivacyframework.gov. Should the EU-U.S. adequacy decision (C(2023) 4745) be suspended or revoked, the transfer will alternatively be based on the EU Standard Contractual Clauses pursuant to Implementing Decision (EU) 2021/914.

Third-country transfers at a glance:

• Google (USA): EU-U.S. Data Privacy Framework (DPF)
• AWS / Amazon Web Services (USA): DPF + Standard Contractual Clauses (SCCs)
• Cloudflare (USA): DPF + Standard Contractual Clauses (SCCs)

9. Retention periods

• Registration and contact data: For the duration of the contractual relationship plus statutory retention periods (max. 10 years).
• Uploaded production profiles: For the duration of the subscription. After the contract ends, a 30-day retention period for export and data portability (pursuant to § 10 DPA TRACE.Parser). Users can download their data within 14 days of a deletion notice. Thereafter, irreversible deletion.
• Analysis results (calculated evaluations): For the duration of the subscription. After the contract ends, deletion within 30 days (see Section 4). Legal basis: Art. 6(1)(b) GDPR.
• Usage data (logs): 30 days, then automatic deletion.
• Audit and access logs: Retention 12 months, legal basis Art. 6(1)(c) GDPR in conjunction with §§ 147 AO, 257 HGB.
• Enquiry data (trial access/quote without contract conclusion): 6 months after the last contact (legal basis: Art. 6(1)(f) GDPR; legitimate interests in processing and documenting customer enquiries). The legitimate interest lies in abuse prevention, system security and improvement of the Parser service.

Retention periods at a glance:

• Contact enquiries without contract conclusion: 6 months after last contact
• Contact enquiries with contract initiation (pre-contractual measures): 3 years (§ 195 BGB limitation period). Enquiries leading to a contract conclusion are retained for the duration of the 3-year limitation period (§ 195 BGB). Enquiries without contract conclusion are deleted after 6 months.
• Billing data: 10 years (§ 147 AO, § 257 HGB)
• Analytics logs (anonymised): max. 14 months (GA4)
• Account data after cancellation: 30 days (re-entry), then deletion
• Legally required data: pursuant to applicable law
• Credit transactions and billing data: 10 years pursuant to § 147 AO and § 257 HGB.

10. Your rights

As a data subject, you have the following rights against TRACE:

• Access (Art. 15 GDPR): You can request information about the data we have stored about you.
• Rectification (Art. 16 GDPR): You can request the rectification of inaccurate data.
• Erasure (Art. 17 GDPR): You can request the deletion of your data, insofar as no statutory retention obligations apply.
• Restriction of processing (Art. 18 GDPR): You can request the restriction of processing.
• Notification obligation (Art. 19 GDPR): We will notify each recipient to whom your personal data has been disclosed of any rectification, erasure or restriction of processing, unless this proves impossible or involves disproportionate effort. We will inform you of these recipients upon request.
• Data portability (Art. 20 GDPR): You have the right to receive your data in a machine-readable format.
• Objection (Art. 21 GDPR): You can object to processing based on legitimate interests at any time.
• Withdrawal of consent (Art. 7(3) GDPR): Consent given (e.g. for analytics cookies on the landing page) can be withdrawn at any time with effect for the future — via the cookie settings or by email to privacy@trace-electricity.com.

Right to object to direct marketing (Art. 21(2) GDPR): You have the right to object at any time to the processing of personal data concerning you for direct marketing purposes; this also applies to profiling insofar as it is connected with direct marketing.

To exercise your rights, please contact: privacy@trace-electricity.com.

Pursuant to Art. 12(3) GDPR, your requests will be answered within one month. In cases of particular complexity, this deadline may be extended by up to two further months; we will inform you of any extension.

You also have the right to lodge a complaint with a data protection supervisory authority. The competent authority for TRACE is the Hamburg Commissioner for Data Protection and Freedom of Information, Ludwig-Erhard-Str. 22, 20459 Hamburg, Tel. 040 42854-4040 (www.datenschutz.hamburg.de).

Complaints may be addressed to the competent supervisory authority. Competent for TRACE: Hamburg Commissioner for Data Protection and Freedom of Information (HmbBfDI), Ludwig-Erhard-Str. 22, 20459 Hamburg, mailbox@datenschutz.hamburg.de.

11. Right to object (Art. 21 GDPR)

Insofar as we process your personal data on the basis of legitimate interests pursuant to Art. 6(1)(f) GDPR, you have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data. In that case, we will no longer process your data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

To exercise your right to object, an informal email to privacy@trace-electricity.com is sufficient.

In addition, you have a separate right to object to the processing of your personal data for direct marketing purposes pursuant to Art. 21(2) GDPR. Insofar as TRACE sends you product-related information or service notifications within the framework of the contractual relationship (e.g. notices about new features or price changes), you may object to this at any time — without needing to demonstrate a particular situation.

12. Data security

TRACE uses technical and organizational measures (TOM) pursuant to Art. 32 GDPR to protect your data against unauthorised access, loss or destruction. Communication between your browser and our servers takes place exclusively via encrypted HTTPS connections (TLS 1.2+). Data at rest is stored on AWS infrastructure encrypted with AES-256. Access rights are assigned according to the principle of least privilege. The complete TOM documentation is available at: Technical and Organizational Measures TRACE.Parser (TOM).

13. Changes to this Privacy Notice

We reserve the right to update this Privacy Notice to reflect changes in data processing or legal requirements. The current version is always available at trace-electricity.com/en/privacy-parser/. We will inform you of material changes by email.

14. Automated decision-making

TRACE does not make automated individual decisions with legal or similarly significant effects (Art. 22(1) GDPR). Algorithmically generated recommendations and analyses serve as decision support; the final decision always lies with the user.

15. Data Processing Agreement (DPA)

Insofar as personal data for which you as a customer are the Controller is processed within the framework of using TRACE.Parser (in particular in uploaded production profiles), we conclude a mandatory Data Processing Agreement (DPA) with you pursuant to Art. 28 GDPR, which automatically becomes part of the contractual relationship upon conclusion of the contract. The Data Processing Agreement (DPA) – TRACE.Parser automatically becomes part of the contractual relationship upon conclusion of the contract.

16. Information for indirectly affected persons (Art. 14 GDPR)

Insofar as data of natural persons is also processed through the analysis of production profiles (e.g. for small-scale installation operators) who are not themselves contractual partners of TRACE Electricity, the following applies: The data subjects receive this privacy information via the TRACE.Parser customer (our client) as Controller. Direct enquiries can be addressed to privacy@trace-electricity.com.

If you also use TRACE.App or the TRACE website, the privacy notices under Privacy Notice – TRACE.App and the Privacy Policy also apply.

LinkedIn Insight Tag (joint controllership pursuant to Art. 26 GDPR)

On our TRACE.Parser product page, we use the LinkedIn Insight Tag. The provider is LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. Together with LinkedIn, we are jointly responsible for the collection and forwarding of data captured with the Insight Tag pursuant to Art. 26 GDPR.

Legal basis: Art. 6(1)(a) GDPR (consent). You can object to collection in our cookie banner.

Point of contact for data subject rights pursuant to Art. 26(2) GDPR: TRACE Electricity GmbH, privacy@trace-electricity.com. Further information: LinkedIn Privacy Policy.

Okta EMEA Limited (Auth0) — User authentication

For user login, we use Auth0, a service of Okta EMEA Limited, 1 Beckett Way, Park West Business Park, Dublin 12, Ireland.

Data processed: Email address, encrypted password hash (bcrypt), login timestamp, IP address, device information (user agent), session token, refresh token, MFA status if applicable.

Purpose: Secure user authentication, session management and access control to the TRACE service.

Legal basis: Art. 6(1)(b) GDPR (contract performance).

Retention period: For the duration of the user account; after account deletion, Auth0-side data is deleted within 30 days.

Processing location: EU (eu.auth0.com, AWS eu-west-1, Ireland). No transfer to third countries takes place, as the EU tenant of Auth0 is used.

More information: okta.com/privacy-policy. Basis of commissioned data processing: Art. 28 GDPR.

Note on group structure: As a subsidiary guarantee in the event of a group interaction with the US parent company Okta, Inc. (San Francisco, USA), Standard Contractual Clauses pursuant to SCC 2021/914 Module 4 (Non-EU Processor → EU Controller) are agreed.