Privacy policy

Data controller

Data controller:
[The City of Ulm and THU, with Steinbeis involved, must confirm the legal entity, full address and data protection contact for EnergyCheckUlm]
[Add the data protection officer and contact details, where applicable]

Under the draft contract amendment and the Steinbeis offer dated 14 October 2026, THU is to coordinate the subject matter, take editorial responsibility and maintain the content independently. The City of Ulm is to commission Steinbeis separately for technical handover, hosting, administration, maintenance, security updates, backups and fault resolution. Continued operation is planned from 1 January 2027 to 31 December 2029. The copies provided are unsigned; commissioning and entry into force still require confirmation. This description of tasks does not finally determine responsibility as data controller. Where processing on behalf of a controller applies, the offer provides for an appropriate agreement before that processing begins.

Data protection officer: [Add contact details if a data protection officer has been appointed].

Website operation and hosting

The current draft at energycheckulm-entwurf.com is hosted on WordPress.com. When a page is requested, technical connection data is processed, in particular the IP address, requested URL, time, browser and device information and, where applicable, the previously visited page. This is used to deliver the website and maintain its stability and security.

Hosting provider: WordPress.com / Automattic; [add the full contracting party and address from the hosting agreement]. Some images are loaded through WordPress.com’s image delivery service. This also generates technical request data.

Proposed legal basis: Article 6(1)(f) GDPR, insofar as it applies to the confirmed operator. The legitimate interest is the secure and functional operation of the information website. The controller, once confirmed, must review and approve this assessment.

Retention period: Automattic generally states a retention period of approximately 30 days for web server logs. The specific periods, exceptions and deletion procedures applicable to this hosting arrangement must be confirmed before approval.

WordPress.com also processes data outside the EU/EEA. The specific recipients and service providers, the data processing agreement and the safeguards used for transfers, including how to obtain a copy of them, still need to be added. Storage exclusively within Europe is not guaranteed.

Provider information: Privacy notice for website visitors and Data processing agreement.

Calculators, notes and search

Interactive tools: EnergyCheckUlm’s own calculators process entries in your browser without sending those values to the website operator. The planning sheet temporarily keeps your notes in this browser tab while you enter them, using sessionStorage. Calculator results are added only when you choose “Add to my plan”. The saved snapshot includes inputs, assumptions, unresolved questions, a date and the calculator page address. It is available when you move between pages in the same tab. It is not stored in a cookie or in a visitor account on the website. Browser session restoration may also restore the plan; use “Clear plan” on shared devices. Export important information before ending the browser session. Copying, downloading and printing take place when you choose the corresponding action. You decide how to retain or share the resulting files and printouts.

This statement concerns entries in our tools. It does not cover hosting data or any statistics data generated when the website loads. Browser functions may restore form fields independently of our software.

Website search: The search term is sent to the website and appears in the requested URL. It may therefore appear in technical logs. Please do not enter names, addresses or other confidential information in the search. The search is used to display relevant content; the proposed legal basis is the one explained above for website operation.

No visitor account is required for the planned information pages and calculators. Comments are closed on the content pages; contact forms, newsletter sign-ups and embedded maps or videos are not part of their saved content. Administration accounts are separate from this.

Contact by email

If you contact us by email, the responsible staff process your email address, message content and any further information you voluntarily provide in order to handle your enquiry. The editorial email address for EnergyCheckUlm will be decided later.

For general enquiries, the proposed legal basis is Article 6(1)(f) GDPR; the legitimate interest is responding to and appropriately handling the enquiry. If the enquiry relates to a contract or steps prior to entering into one, Article 6(1)(b) GDPR may apply. The legal basis, email service provider and access permissions will be agreed with the confirmed controller and the service providers involved.

Providing this information is voluntary. We cannot answer an individual enquiry without a way to reply. Messages should be deleted once they are no longer needed to handle the enquiry, unless retention obligations or legitimate grounds prevent deletion. [Add the confirmed controller’s specific deletion procedure, retention period and any applicable retention obligations].

Cookies and statistics

WordPress.com and Jetpack may use cookies and similar technologies depending on the function. The current draft has active hosting extensions and a statistics interface. This does not yet allow a conclusive assessment of future processing for visitors who are not signed in.

The technical and legal details of this section must be completed before publication. The services and cookies actually loaded, their purposes, recipients, lifetimes, legal bases and any required consent and means of withdrawing it remain to be determined. No consent mechanism was set up in this round of work.

Section 25(2) TDDDG may apply to strictly necessary storage or access. Other storage or access generally requires prior consent under Section 25(1) TDDDG. Subsequent processing of personal data also requires an appropriate legal basis under the GDPR. An information banner alone or this policy does not replace any required consent.

Before approval, a decision will be made on which optional services to remove and which may only load after consent. No claim is currently made that the entire website is free of tracking or that an effective consent mechanism has already been implemented.

Background: Automattic’s cookie information and WordPress.com statistics.

Links to external services

Solar roof maps, public charging maps, funding bodies and advice services are included on the content pages as external links. They are not embedded there as maps or videos. Opening a link takes you to the respective provider’s service, where that provider’s privacy notice applies. These external services are distinct from this website’s image delivery and hosting services.

Your rights

Under the GDPR, you may request access to information about the processing of your data, rectification, erasure or restriction of processing. A right to data portability also applies where the statutory conditions are met. You may withdraw consent at any time with effect for the future; processing carried out before withdrawal remains unaffected.

Right to object to processing

If processing is based on Article 6(1)(e) or (f) GDPR, you may object on grounds relating to your particular situation. Processing will then cease unless there are overriding compelling grounds or grounds for pursuing or defending legal claims.

Please send enquiries to [add data protection contact]. You may also lodge a complaint with a data protection supervisory authority, in particular in the place where you live or work, or where the alleged infringement occurred. [Add the supervisory authority responsible for the confirmed operator and its contact details].

Our calculators provide non-binding guidance. They do not make automated decisions about you that have legal or similarly significant effects.