Privacy policy

1. General information

We take the protection of your personal data seriously and process it in accordance with the GDPR.

Controller: Elephant Power GmbH Sieglestraße 33H 70469 Stuttgart Germany E-mail: [email protected]

Registered: Commercial Register B, Stuttgart Local Court, HRB 800747

Data protection officer: Steven Wolter E-mail: [email protected]

2. Collection and processing of personal data

a) Visiting the website Data collected: IP address, date/time, file, referrer, browser/OS, provider Purpose: security, stability, functionality Legal basis: Art. 6(1)(f) GDPR. Retention period: 14 days

b) Contact enquiries (e-mail/form) Data collected: name, e-mail address, telephone number (optional), content of the message Purpose: processing and follow-up communication Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR Retention period: up to 6 months after completion

c) Customer/contract data Data collected: name, address, payment/contract data, communication Purpose: performance of the contract, invoicing, compliance with the law Legal basis: Art. 6(1)(b), (c) GDPR Retention period: 6 years (German Commercial Code, HGB), 10 years (tax law)

d) Application data Data collected: application documents, communication Purpose: recruitment procedure Legal basis: Section 26 BDSG, Art. 6(1)(b) GDPR Retention period: up to 6 months after the procedure

e) Cookies & analytics Cookie categories:

• strictly necessary cookies (session, security)
• analytics cookies (Google Analytics – anonymised)
• no advertising/tracking cookies without consent

Legal basis: Necessary cookies: Art. 6(1)(f) GDPR, Section 25(2) TTDSG Analytics cookies: Art. 6(1)(a) GDPR, Section 25(1) TTDSG

Details can be found in our cookie table.

3. Disclosure of data and recipients

Personal data is only disclosed if:

• you consent (Art. 6(1)(a) GDPR),
• this is necessary for the performance of a contract (Art. 6(1)(b) GDPR),
• it is required by law (Art. 6(1)(c) GDPR)
• or it is based on a legitimate interest (Art. 6(1)(f) GDPR).

Recipients may be:

• IT service providers (hosting, maintenance)
• legal and tax advisers
• public authorities (where required by law)

We carry out a balancing test to ensure that your fundamental rights are protected.

4. International data transfers

Data may only be transferred outside the EU/EEA subject to the following safeguards:

Google LLC (USA): EU Standard Contractual Clauses + EU-US Data Privacy Framework. Data processing agreements ensure protection at GDPR level.

Data may be processed on servers outside the EU

5. Rights of the data subject

You have the following rights: access, rectification, erasure, restriction, portability, objection, withdrawal of consent, complaint (Art. 15–21, 77 GDPR).

Special right to object to direct marketing (Art. 21(2) GDPR): You may object at any time to the processing of your personal data for the purposes of direct marketing.

Supervisory authority: Landesbeauftragter für Datenschutz und Informationsfreiheit Baden-Württemberg (State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg) Prof. Dr. Tobias Keber Lautenschlagerstraße 20, 70173 Stuttgart E-mail: [email protected] Tel.: +49 711 615541-0

Exercising your rights: E-mail: [email protected]. We will respond within 30 days (Art. 12 GDPR).

6. Retention and erasure

7. Data security

SSL encryption and technical/organisational security measures.

8. Updates

Last updated: September 2025.

We may update this policy to reflect legal changes or business developments. Material changes will be communicated by e-mail or a notice on the website.

Current version: elephant-power.ai/en/privacy/