Privacy Policy

Last updated: 05 May 2026

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) and other applicable data protection laws is:

Energy Hub Emsland Entwicklungsgesellschaft mbH
Kaiserstrasse 10b
49809 Lingen (Ems)
Germany
Phone: +49 591 14050260
Email: info@energy-hub-emsland.de

2. Scope and purposes of processing

The ValHyCon application enables account login and management of user-owned data points.

In particular, the following categories of personal data may be processed:

  • Account data (email address, password hash, account timestamps)
  • Session data (hashed session token, expiry time, authentication cookie)
  • Data point content entered by users (for example name, category, description, website)
  • Optional contact and organization-related fields entered by users (for example company name, contact person, email, and phone)
  • Location and geodata provided by users (address fields and coordinates)
  • User-provided structured project details and notes (for example status, technical data points, feedback)
  • Uploaded media metadata and files (images and PDF documents)
  • Technical usage data (see section 4)

These data are processed to:

  • provide secure login and user session handling
  • create, display, update, and delete user-owned data points
  • store and deliver uploaded images and documents
  • support map search and location assignment
  • maintain security, integrity, and technical operation of the application

3. Legal bases (Art. 6(1) GDPR)

  • Art. 6(1)(a) GDPR: consent (for example voluntary form submissions)
  • Art. 6(1)(b) GDPR: performance of a contract and pre-contractual measures
  • Art. 6(1)(f) GDPR: legitimate interests (operation, security, abuse prevention)

4. Technical usage data and server logs

When accessing the platform, the following technical data may be processed for system security:

  • IP address of the requesting device
  • Date and time of access
  • Requested pages or API resources
  • Browser and operating system information

The legal basis is Art. 6(1)(f) GDPR. Log data is generally retained for up to 30 days and then deleted or anonymized, unless longer storage is required to investigate specific security incidents.

5. User accounts and platform entries

5.1 Registration and authentication

Registration requires at least an email address. It is used as login identifier and for technical notifications. Passwords are stored in hashed form only.

5.2 Project, infrastructure, and service entries

Submitted content (for example title, description, location data, and contact information) is stored in platform databases and displayed according to platform functionality.

6. Contact and support requests

If you contact us by email or contact form, the submitted data is processed only to handle your request. Depending on the request, legal basis is Art. 6(1)(a), Art. 6(1)(b), or Art. 6(1)(f) GDPR.

7. Recipients and hosting

7.1 General

External service providers may be used for operation, hosting, and maintenance as processors under Art. 28 GDPR. This website is hosted on Hetzner servers in Germany. Personal data is not shared with third parties for marketing purposes.

7.2 Map services (Mapbox)

Mapbox, Inc. is used for geocoding. Using map functionality may transmit personal data to Mapbox, including IP address, device information, and search queries.

More information: https://www.mapbox.com/legal/privacy

Data transfers to the United States may occur. At present, such transfers are based on the EU-U.S. Data Privacy Framework (adequacy decision under Art. 45 GDPR).

7.3 Media file storage

Uploaded media files are stored in server-side storage paths that are assigned to the authenticated user account. Depending on deployment, storage can be local or provider-based; where external providers are used, they are bound by data processing agreements under Art. 28 GDPR.

8. Storage period

  • Account data: for the duration of registration
  • Platform entries: while published or administratively required
  • Contact requests: until request handling is complete plus legal retention duties
  • Technical logs: generally up to 30 days

9. Your rights as a data subject

You have the following rights regarding your personal data:

  • Right of access (Art. 15 GDPR)
  • Right to rectification (Art. 16 GDPR)
  • Right to erasure (Art. 17 GDPR)
  • Right to restriction of processing (Art. 18 GDPR)
  • Right to data portability (Art. 20 GDPR)
  • Right to object (Art. 21 GDPR)
  • Right to withdraw consent at any time (Art. 7(3) GDPR)
  • Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

To exercise your rights, please use the contact details listed above.

10. Automated decision-making

No automated decision-making, including profiling within the meaning of Art. 22 GDPR, is used.

11. Cookies and local storage

11.1 Strictly necessary session cookies

The platform uses only technically necessary session cookies or similar technologies for login, session management, and security. No tracking, analytics, or advertising cookies are used.

11.2 Local storage

No local storage usage for account tracking is implemented in the current feature set.

12. No membership or invitation workflow

The current ValHyCon application does not implement company membership requests, join approvals, or company-owner invitation workflows. Email addresses are therefore not disclosed through such mechanisms in the implemented feature set.

13. International transfers

Transfers outside the EEA occur only where an adequate level of protection exists or appropriate safeguards are in place (for example adequacy decisions or standard contractual clauses).

14. Contact for data protection enquiries

For data protection enquiries, please contact:
Energy Hub Emsland Entwicklungsgesellschaft mbH
Data Protection Enquiries
Kaiserstrasse 10b
49809 Lingen (Ems)
Email: info@energy-hub-emsland.de

15. Changes to this Privacy Policy

This Privacy Policy may be updated to reflect legal requirements, processing changes, or platform feature updates.