This Privacy Policy is updated regularly. The current version is always available at trace-electricity.com/en/privacy/.
If you also use TRACE.App or TRACE.Parser, the Privacy Notice - TRACE.App and the Privacy Notice - TRACE.Parser apply in addition.
This Privacy Policy applies to our website at trace-electricity.com. The domains trace-electricity.de, trace-electricity.ai and trace-electricity.io are redirected to trace-electricity.com; from the moment the target domain is accessed, this Privacy Policy applies.
In addition to the website, TRACE Electricity GmbH operates further products for which separate privacy and contractual documents apply. An overview of the relevant documents per product:
TRACE.App enables energy consumers to independently analyse their consumption data. TRACE Electricity GmbH is the Controller within the meaning of Art. 4 No. 7 GDPR (DSGVO) for end users (B2C). For B2B corporate accounts, TRACE Electricity GmbH acts as Data Processor (Art. 28 GDPR (DSGVO)).
The TRACE.Parser application is aimed exclusively at business customers (B2B). TRACE Electricity GmbH acts as Data Processor for the respective Controllers (Art. 28 GDPR (DSGVO)).
For customer-specific white-label instances (TRACE.Configurator) and individual consulting projects (TRACE.Studio), separate contractual data protection provisions apply, which are agreed upon in the respective license and service agreement or Data Processing Agreement. A template DPA for TRACE.Configurator/Studio is available on request: privacy@trace-electricity.com.
The Controller within the meaning of the General Data Protection Regulation (GDPR (DSGVO)) is:
TRACE Electricity GmbH
Dorothea-Bernstein-Weg 48
22081 Hamburg
Germany
Email: privacy@trace-electricity.com
A Data Protection Officer has not been appointed at TRACE Electricity GmbH, as the statutory requirements under Art. 37 GDPR (DSGVO) in conjunction with § 38 BDSG are not met. Please direct data protection inquiries to: privacy@trace-electricity.com.
When you access our website, your browser automatically sends information to our server, which is temporarily stored in a log file. Log data is automatically deleted after no more than 7 days; longer retention occurs only in specific circumstances (e.g. security incident or official request). The following information is collected automatically:
The aforementioned data is processed for the following purposes: ensuring smooth website connectivity, providing comfortable website use, evaluating system security and stability, as well as detecting and defending against attacks (intrusion detection), error diagnosis, and server capacity planning.
The legal basis for data processing is Art. 6(1) sentence 1 lit. f GDPR (DSGVO). Our legitimate interest arises from the above-listed purposes for data collection. The legitimate interest consists in ensuring the secure and stable operation of the website (website optimisation, fraud prevention). We never use the collected data to draw conclusions about your identity.
If you have any questions, you can contact us through a form provided on the website. A valid email address is required so we know who is making the inquiry and can respond. Additional information may be provided voluntarily.
Data processing for the purpose of contacting us is based on Art. 6(1) sentence 1 lit. f GDPR (DSGVO) on the basis of our legitimate interest in responding to your inquiry, and on Art. 6(1) sentence 1 lit. b GDPR (DSGVO) insofar as the contact serves to initiate or fulfil a contract. The legitimate interest consists in answering and processing user inquiries.
Personal data we collect through the contact form is deleted once your inquiry has been resolved, provided no statutory retention obligations preclude this (in particular commercial and tax retention periods of up to 10 years). Email dispatch via the contact form is handled by the service provider EmailJS (details see Section 9). Inquiries via the contact form are deleted 3 years after the conclusion of the communication (§ 195 BGB). Billing-relevant correspondence: 10 years (§ 147 AO).
Obligation to provide data: Providing a valid email address is required for contacting us; without it, your inquiry cannot be answered. Additional information (message text, name) is voluntary but helpful for meaningful processing of your inquiry.
When you click the "Get Started Free" button on a mobile device, a dialog opens where you can request the TRACE.App link to be sent to your email address. Background: TRACE.App is optimised for desktop or laptop use; with the link sent to you, you can later conveniently open the app on a larger screen.
Data processed: the email address you enter, the time of the request, and a technical processing identifier. Purpose: solely the one-time delivery of the app link to the provided address. Your email address will not be reused for newsletters or marketing purposes.
The legal basis is Art. 6(1) sentence 1 lit. b GDPR (DSGVO) (performance of pre-contractual measures at your request). Data is deleted once the link has been sent, but no later than 30 days thereafter.
Obligation to provide data: Providing your email address is required for sending the app link; without this information, the link cannot be delivered.
Data processing in TRACE.App is governed by the Privacy Notice - TRACE.App. For corporate accounts (B2B), the Data Processing Agreement (DPA) - TRACE.App pursuant to Art. 28 GDPR (DSGVO) is additionally available.
Data processing in the TRACE.Parser application is governed by the Privacy Notice - TRACE.Parser.
Data processing in TRACE.Configurator instances and in consulting/studio projects is governed by the provisions of the respective license and service agreement as well as the associated Data Processing Agreement (DPA) pursuant to Art. 28 GDPR (DSGVO).
Your personal data will not be transmitted to third parties for purposes other than those listed below.
We share your personal data with third parties only if:
We use cookies and similar technologies (e.g. Local Storage) on our website. Cookies are small files that your browser automatically creates and stores on your device. They cause no harm to your device and contain no viruses or other malware.
We distinguish three categories:
On your first visit to our website, a cookie banner appears allowing you to make your selection. You can withdraw or adjust your consent at any time via the "Cookie settings" link in the footer. Alternatively, you can delete cookies through your browser settings.
Legal basis: Setting of cookies is based on § 25(1) TTDSG (optional cookies, with consent) or § 25(2) No. 2 TTDSG (technically necessary cookies), each in conjunction with Art. 6 GDPR (DSGVO).
TTDSG classification overview:
| Name | Provider | Purpose | Retention | Legal basis |
|---|---|---|---|---|
| _ga | Google Ireland Ltd. | Reach analysis (GA4) | 2 years | Consent (§ 25 TTDSG) |
| _ga_* | Google Ireland Ltd. | GA4 Session ID | 2 years | Consent (§ 25 TTDSG) |
| _gid | Google Ireland Ltd. | GA4 user distinction | 24 hours | Consent (§ 25 TTDSG) |
| _hjSession* | Hotjar Ltd. | Hotjar session | 30 minutes | Consent (§ 25 TTDSG) |
| _hjSessionUser* | Hotjar Ltd. | Hotjar user ID | 365 days | Consent (§ 25 TTDSG) |
| li_sugr | LinkedIn Ireland | LinkedIn Insight Tag | 90 days | Consent (§ 25 TTDSG) |
| AnalyticsSyncHistory | LinkedIn Ireland | LinkedIn sync | 30 days | Consent (§ 25 TTDSG) |
We use Google Analytics 4 (GA4) on our website. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin, D04 E5W5, Ireland. GA4 does not use cookies for basic functionality by default; pseudonymous user identifiers are set via the first-party cookie _ga only if you have consented to the use of statistical cookies. GA4 works with IP anonymisation — complete IP addresses are not stored.
The purpose of processing is to analyse user behaviour on our website for optimising content and functionality. Processing only takes place with your consent pursuant to Art. 6(1) sentence 1 lit. a GDPR (DSGVO) (Consent Mode v2). For data transfers to the USA, the EU-U.S. Data Privacy Framework applies, under which Google is certified, supplemented by EU Standard Contractual Clauses (SCC). Should the EU-U.S. adequacy decision (C(2023) 4745) be suspended or revoked, the transfer shall alternatively be based on the EU Standard Contractual Clauses pursuant to Implementing Decision (EU) 2021/914.
Basis for third-country transfer (Google): EU-U.S. Data Privacy Framework (DPF, adequacy decision of the EU Commission of 10 July 2023) and Standard Contractual Clauses (SCCs) of the EU Commission (Decision 2021/914). Certification status verifiable at dataprivacyframework.gov. Should the EU-U.S. adequacy decision (C(2023) 4745) be suspended or revoked, the transfer shall alternatively be based on the EU Standard Contractual Clauses pursuant to Implementing Decision (EU) 2021/914.
You can object to data collection by Google Analytics by downloading the browser add-on at https://tools.google.com/dlpage/gaoptout, or withdraw your consent via the cookie settings in the footer. Further information: policies.google.com/privacy.
Note on Consent Mode v2: GA4 transmits minimal, non-personal signals (so-called consent state pings) to Google even without your consent, in order to ensure the reliability of consent-based modelling. No cookies are set and no IP addresses are transmitted in this process. The legal basis is Art. 6(1) sentence 1 lit. f GDPR (DSGVO); our legitimate interest lies in the privacy-compliant implementation of the consent-based measurement concept.
TRACE uses GA4 Consent Mode v2. Where consent is refused, only consent state pings without personal data are transmitted to Google. Data collection for analysis purposes only occurs where consent has been granted.
Under Google Consent Mode v2, where non-essential cookies are declined, no personalised tracking data is transmitted to Google. Consent state signals are only set after interaction with the cookie banner. Without your consent, no GA4 event data and no Google signals are collected. Complete blocking of GA4 prior to consent is ensured by our cookie consent implementation.
Note: TRACE.App and TRACE.Parser use the same Google Analytics 4 account (G-75HZ5JXDNZ) with an identical consent concept (Consent Mode v2). Detailed information can be found in the privacy notices for Privacy Notice - TRACE.App and the Privacy Notice - TRACE.Parser.
Retention period: The retention period for user and event data in Google Analytics is 14 months by default; after this, data is automatically deleted.
We use the LinkedIn Insight Tag from LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland on our website.
Purpose: Analysis of the effectiveness of our LinkedIn advertisements (conversion tracking); creation of anonymous statistics on website usage by LinkedIn members (retargeting function).
Joint controllership: LinkedIn Ireland Unlimited Company and we are joint controllers for the data collection triggered by the Insight Tag within the meaning of Art. 26 GDPR (DSGVO). LinkedIn Ireland acts as an independent Controller — not as our Data Processor. The basis of our cooperation is the LinkedIn Joint Controller Agreement, available at legal.linkedin.com/pages-joint-controller-addendum.
Data processed: IP address (anonymised by LinkedIn within 7 days), URL data, referrer information, device data, timestamps, and LinkedIn member ID (for logged-in LinkedIn users, pseudonymised only).
Legal basis: Art. 6(1)(a) GDPR (DSGVO) (your consent, which you grant via our cookie banner).
Retention period: 90 days (pseudonymised conversion data at LinkedIn); aggregated reports without personal reference permanently.
Third-country transfer: LinkedIn Ireland Limited, headquartered in Ireland (EU). Parent company LinkedIn Corporation is headquartered in the USA. Basis for any intra-group transfers: EU Standard Contractual Clauses and EU-US Data Privacy Framework.
Opt-out: Via your LinkedIn account settings (Privacy Settings → Advertising Settings) or via the cookie banner on our website. Alternatively: LinkedIn Opt-out.
Pursuant to Art. 26(2) sentence 2 GDPR (DSGVO), we designate TRACE Electricity GmbH (privacy@trace-electricity.com) as the primary point of contact for data subject rights in relation to data processed by LinkedIn. We will forward your request to LinkedIn if necessary.
We use Hotjar, an analytics service provided by Hotjar Ltd., Level 2, St Julian's Business Centre, 3, Elia Zammit Street, St Julian's STJ 1000, Malta. Hotjar was acquired by Contentsquare in 2021; data protection responsibility remains with Hotjar Ltd. as a separate legal entity. Hotjar records mouse movements, clicks and scrolling behaviour (heatmaps) as well as session recordings. Processing takes place exclusively on servers within the EU (no third-country transfer). The legal basis is your consent pursuant to Art. 6(1) lit. a GDPR (DSGVO) in conjunction with § 25(1) TTDSG. You can disable Hotjar tracking at any time at https://www.hotjar.com/legal/compliance/opt-out. Hotjar Privacy Policy: https://www.hotjar.com/legal/policies/privacy/
Hotjar processes: mouse movements, clicks, scrolling behaviour (heatmaps), and recorded sessions (session recordings) — the latter only with explicit consent and without recording password fields or payment data. Retention at Hotjar: 365 days for heatmap data, 60 minutes for session recordings (thereafter only metadata for 365 days). Legal basis: Art. 6(1)(a) GDPR (DSGVO) (consent via cookie banner).
Our website at trace-electricity.com as well as the domains trace-electricity.ai and trace-electricity.io (DNS and forwarding to .com) are provided via the services of Cloudflare. The provider is Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA, represented in the EU by Cloudflare Germany GmbH, Rosental 7, c/o Mindspace, 80331 Munich.
Cloudflare provides hosting and content delivery services for our website (in particular delivery of static content, DNS, TLS termination, protection against DDoS attacks and bot traffic). All data traffic between your browser and our website is routed through Cloudflare's servers. Cloudflare processes personal data of website visitors, in particular IP address, date and time of the request, referrer, user agent, and technical connection and security metadata.
Cloudflare, Inc. provides CDN, DDoS protection and HTTPS. Cloudflare processes IP addresses and request metadata as a Data Processor pursuant to Art. 28 GDPR (DSGVO). Server locations: EU (primarily Frankfurt/Amsterdam).
The legal basis is Art. 6(1) sentence 1 lit. f GDPR (DSGVO); our legitimate interest lies in the secure, high-performance and reliable operation of our website. The legitimate interest consists in website optimisation, DDoS protection and fraud prevention. A Data Processing Agreement pursuant to Art. 28 GDPR (DSGVO) and an agreement on EU Standard Contractual Clauses (SCC) for the transfer of personal data to third countries are in place with Cloudflare. Cloudflare is also certified under the EU-U.S. Data Privacy Framework. Should the EU-U.S. adequacy decision (C(2023) 4745) be suspended or revoked, the transfer shall alternatively be based on the EU Standard Contractual Clauses pursuant to Implementing Decision (EU) 2021/914.
A transfer of personal data to the USA or servers outside the EU cannot be excluded, as Cloudflare operates a globally distributed network and routes requests through the nearest edge location.
Further information on data processing by Cloudflare can be found at: cloudflare.com/privacypolicy.
The domain trace-electricity.de is resolved via Strato AG, Otto-Ostrowski-Straße 7, 10249 Berlin, by HTTP redirect to trace-electricity.com. In the course of this forwarding, Strato briefly processes the IP address and connection metadata of visitors for the purpose of providing the domain and forwarding service. The IP addresses and connection metadata processed in this context are automatically deleted by Strato after no more than 7 days. The legal basis is Art. 6(1) sentence 1 lit. f GDPR (DSGVO). The legitimate interest consists in maintaining the accessibility of the website via all registered domains. Server location: Germany. Further information: strato.de/datenschutz.
Email dispatch (EmailJS): For the dispatch of transactional emails via the contact form and the mobile app link dialog, we use the service EmailJS (EmailJS Ltd., 3rd Floor, 207 Regent Street, London, W1B 3HH, United Kingdom). EmailJS processes the sender address, message content and technical connection metadata exclusively for the purpose of email delivery. The legal basis is Art. 6(1) sentence 1 lit. f GDPR (DSGVO) (legitimate interest in providing the contact form). The legitimate interest consists in providing a functional contact channel for user inquiries. A Data Processing Agreement is in place with EmailJS; for transfers to the United Kingdom, the adequacy decision of the EU Commission pursuant to Art. 45 GDPR (DSGVO) applies, supplemented by EU Standard Contractual Clauses (SCC) as a subsidiary safeguard in the event of a future change in adequacy status. Further information: emailjs.com/legal/privacy-policy. EmailJS Ltd. (UK) processes contact form data as a Data Processor. Basis for third-country transfer: UK adequacy decision (IDTA).
For appointment bookings via book.trace-electricity.com, Microsoft Bookings (Microsoft Ireland Operations Ltd.) is used. Legal basis: Art. 6(1) lit. b GDPR (DSGVO) (contract initiation). Third-country transfer: Standard Contractual Clauses.
A booking system from Microsoft (Microsoft Bookings) is integrated on our website via the subdomain book.trace-electricity.com. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland.
When you book an appointment via the booking page, Microsoft processes the following data on our behalf: name, business email address, company, role, as well as service-specific details (use case, industry, project description), the selected appointment and service, IP address, browser information and the creation of a Microsoft Teams meeting including its associated metadata.
The purpose is the organisation and execution of the booked appointment as well as the pre-contractual exchange to initiate a potential business relationship. The legal basis is Art. 6(1) sentence 1 lit. b GDPR (DSGVO) (pre-contractual measures) or Art. 6(1) sentence 1 lit. f GDPR (DSGVO) (legitimate interest in efficient appointment organisation). The legitimate interest consists in the efficient organisation and execution of customer appointments.
A Data Processing Agreement pursuant to Art. 28 GDPR (DSGVO) and an agreement on EU Standard Contractual Clauses (SCC) are in place with Microsoft. Microsoft is also certified under the EU-U.S. Data Privacy Framework. A transfer of personal data to the USA cannot be fully excluded. Should the EU-U.S. adequacy decision (C(2023) 4745) be suspended or revoked, the transfer shall alternatively be based on the EU Standard Contractual Clauses pursuant to Implementing Decision (EU) 2021/914.
Booking and appointment data are deleted as soon as they are no longer required for the stated purposes, but no later than 24 months after the appointment date. The 24-month retention period serves to fulfil tax documentation obligations and to assure quality of our consulting services. Longer statutory retention periods remain unaffected.
Further information: privacy.microsoft.com/en-us/privacystatement.
Note on Teams: Microsoft acts as an independent Controller for the operation of its Teams video conferencing infrastructure (conducting appointments as Teams meetings) — independently of the data processing by Microsoft Bookings. For this processing, the Microsoft Privacy Statement at privacy.microsoft.com/en-us/privacystatement applies. TRACE has no influence over this processing carried out independently by Microsoft.
Overview of retention periods:
You have the right to:
To exercise your rights, please contact: privacy@trace-electricity.com. Pursuant to Art. 12(3) GDPR (DSGVO), inquiries are answered within one month; in cases of particular complexity, this period may be extended by up to two further months.
Competent data protection supervisory authority: Hamburg Commissioner for Data Protection and Freedom of Information (HmbBfDI), Ludwig-Erhard-Str. 22, 20459 Hamburg, Tel. 040 42854-4040, www.datenschutz.hamburg.de. Complaints may be addressed to the competent supervisory authority. Responsible for TRACE: Hamburg Commissioner for Data Protection and Freedom of Information (HmbBfDI), Ludwig-Erhard-Str. 22, 20459 Hamburg, mailbox@datenschutz.hamburg.de.
Insofar as your personal data is processed on the basis of legitimate interests pursuant to Art. 6(1) sentence 1 lit. f GDPR (DSGVO), you have the right to object (Widerspruchsrecht) pursuant to Art. 21 GDPR (DSGVO) to the processing of your personal data, provided there are grounds arising from your particular situation.
To exercise your right to object, a simple email to privacy@trace-electricity.com is sufficient.
Our website is delivered exclusively via encrypted HTTPS connections. We use TLS 1.2 and TLS 1.3 — older, insecure protocols (SSL 3.0, TLS 1.0, TLS 1.1) are disabled. TLS termination is handled via Cloudflare; the cipher suites used correspond to the current recommendations of the BSI (German Federal Office for Information Security).
We also employ appropriate Technical and Organizational Measures (TOM) to protect your data against accidental or intentional manipulation, partial or complete loss, destruction, or unauthorised access by third parties. Our security measures are continuously improved in line with technological development.
This Privacy Policy is currently valid as of June 2026. Due to the further development of our website and offerings or due to changed legal or regulatory requirements, it may become necessary to amend this Privacy Policy. We recommend that you regularly review this Privacy Policy for updates. We will, where possible, notify you separately of significant changes.
TRACE does not make automated individual decisions with legal or similarly significant effect (Art. 22(1) GDPR (DSGVO)). Algorithmically generated recommendations and analyses serve as decision-support tools; the final decision always rests with the user.
The EU Commission provides a platform for online dispute resolution (ODR), available at https://odr.ec.europa.eu/. Our email address is: contact@trace-electricity.com. We are not obligated and not willing to participate in dispute resolution proceedings before a consumer arbitration body.
We'll send you a link by email so you can open the app on your desktop or laptop.
We sent the app link to . Open the email on your laptop or desktop to launch TRACE.App.
We use your email solely to send you this link. Details in our Privacy Policy.