Privacy policy
Last updated: July 2026
1. Privacy at a glance
The following notes provide an overview of what happens to your personal data when you visit this website. Personal data is any data that can be used to identify you personally. Data processing on this website is carried out by the website operator; you will find the operator's contact details in section 2. Some data is collected because you provide it to us — for example by entering it into the contact or enquiry form. Other data is collected automatically by our IT systems when you visit the website; this is primarily technical data (e.g. internet browser, operating system, or time of the page request). A detailed description of the individual processing operations and of your rights can be found in the following sections of this privacy policy.
2. Controller
The controller responsible for data processing on this website within the meaning of Art. 4 No. 7 GDPR is: ECS EnergieConsulting Sommer Dipl.-Ing. (FH) Matthias Sommer Glehner Weg 19 40547 Düsseldorf Germany Phone: +49 211 78 867 006 Mobile: +49 160 95 437 982 Email: matthias.sommer@ecs-energieconsulting.de The controller is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data.
3. SSL/TLS encryption
For security reasons and to protect the transmission of confidential content — such as enquiries you send to us — this website uses SSL/TLS encryption. You can recognise an encrypted connection by the browser address line changing from "http://" to "https://" and by the lock symbol in your browser bar. When encryption is activated, the data you transmit to us cannot be read by third parties. Please note that data transmission on the internet (e.g. communication by email) may have security gaps; complete protection of data against access by third parties is not possible.
4. Storage period and statutory retention obligations
Unless a more specific storage period is stated within this privacy policy, your personal data remains with us until the purpose of the data processing no longer applies. If you assert a justified request for deletion or withdraw your consent to data processing, your data will be deleted unless we have other legally permissible reasons for continued storage. Where business correspondence (commercial and business letters) or accounting records are concerned, the retention periods under German commercial and tax law of six or ten years apply (§ 257 HGB, § 147 AO). In these cases, deletion takes place after the respective period has expired.
5. Hosting
This website is hosted by the following provider: Hetzner Online GmbH Industriestr. 25 91710 Gunzenhausen Germany When you visit this website, the personal data generated in the process (see section 6, "Server log files") is processed on the host's servers. The host is used on the basis of our legitimate interest in the most reliable, secure, and efficient provision of our online offering (Art. 6 (1) (f) GDPR). We have concluded a data processing agreement with the host pursuant to Art. 28 GDPR. It ensures that the host processes the data of visitors to this website only in accordance with our instructions and in compliance with the GDPR.
6. Server log files
The provider of this website automatically collects and stores information in so-called server log files, which your browser transmits automatically. These are in particular: – browser type and browser version – operating system used – referrer URL (the previously visited page) – hostname of the accessing device – time of the server request – IP address This data is not merged with other data sources. It is collected on the basis of Art. 6 (1) (f) GDPR; we have a legitimate interest in the technically error-free presentation, stability, and security of this website. The log files are stored only for as long as is necessary for these purposes and are then deleted.
7. Cookies and consent management
This website uses its own consent manager (cookie banner) with four categories: – Functional (always active): required for operating the website, e.g. navigation, language setting, and storing your cookie selection. – Preferences: convenience settings that are not strictly required. – Statistics: anonymised usage statistics; no statistics service is currently active (see section 17). – Marketing / external media: allows loading external content, currently only the OpenStreetMap map on the contact page (see section 14). Your selection is stored exclusively locally in your browser (localStorage, key "ecs_cookie_consent", including the time and version of your decision); your consent decision is not transmitted to our servers. Categories that are not strictly required are only activated after your explicit consent. The legal basis for cookies and comparable technologies requiring consent is Art. 6 (1) (a) GDPR in conjunction with § 25 (1) of the German TDDDG; technically necessary storage and access operations are based on § 25 (2) No. 2 TDDDG and Art. 6 (1) (f) GDPR. You can withdraw or adjust your consent at any time with effect for the future by deleting the stored "ecs_cookie_consent" entry in your browser — the consent banner will reappear the next time you load the page. Further details can be found in our cookie policy.
8. Contact form
If you send us an enquiry via the contact form, we process the data you provide there: name, email address, your request type (selection: initial consultation, consulting, seminar, or other), and your message, as well as — if provided — phone number and company. In addition, we store your confirmation that you have taken note of the privacy policy, your optional consent to be informed about seminars and dates, and the language you selected. This data is processed in order to handle your enquiry and in case of follow-up questions. The legal basis is Art. 6 (1) (b) GDPR where your enquiry is related to the initiation or performance of a contract, and otherwise our legitimate interest in the effective handling of enquiries addressed to us (Art. 6 (1) (f) GDPR). The data you enter in the form remains with us until you request its deletion, withdraw your consent, or the purpose of the data storage no longer applies (e.g. after your enquiry has been dealt with). Enquiries submitted via the contact form are automatically deleted after 90 days at the latest, unless statutory retention obligations apply. Mandatory statutory provisions — in particular the retention periods mentioned in section 4 — remain unaffected.
9. Enquiry form
Via the enquiry form you can submit a structured request for a consulting service or a seminar. In doing so we process: the type of your request (consulting or seminar), name, email address, and the description of your request, as well as — if provided — phone number, company, for consulting requests the contract end date you specify, and for seminar requests the desired seminar topic and the expected number of participants. In addition, we store your confirmation of having taken note of the privacy policy, your optional consent to information about seminars and dates, and the selected language. The legal bases and storage period correspond to the information on the contact form in section 8: Art. 6 (1) (b) GDPR (pre-contractual measures) or Art. 6 (1) (f) GDPR (legitimate interest).
10. Contact by email or phone
If you contact us by email or phone, your enquiry, including all personal data arising from it (e.g. name, request, contact details), will be stored and processed by us for the purpose of handling your request. We do not pass on this data without your consent. Processing is carried out on the basis of Art. 6 (1) (b) GDPR where your enquiry is related to the initiation or performance of a contract, and otherwise on the basis of our legitimate interest in the effective handling of enquiries addressed to us (Art. 6 (1) (f) GDPR). Section 4 applies accordingly to the storage period.
11. Information about seminars and dates
If, when submitting a form, you have explicitly consented to being informed about seminars and dates, we use your email address to send you such information. The legal basis is your consent (Art. 6 (1) (a) GDPR). These emails may include measurement of open and click rates, which we use to evaluate the success of our mailings. Every email contains an unsubscribe link; in addition, you can withdraw your consent at any time without any formal requirements (e.g. by email to the address given in section 2). The lawfulness of the processing carried out until the withdrawal remains unaffected.
12. Chat assistant
A chat assistant is available on this website. Its use is voluntary and only possible after you have explicitly consented at the start of the chat (Art. 6 (1) (a) GDPR); your consent is stored locally in your browser. When you use the chat, your chat messages are stored on our server to provide the conversation history. To generate the replies, the chat content may be transmitted to an external AI service (OpenRouter, openrouter.ai); processing in third countries outside the EU/EEA (in particular the USA) cannot be ruled out in this respect. Please do not enter any sensitive personal data in the chat. If you leave your contact details via the chat (name, email address, and optionally phone number, company, and message), we process them to handle your enquiry in accordance with section 8. Chat histories are automatically deleted after 90 days.
13. Client portal (login area)
We provide an access-protected portal area for clients and administrators. When you log in, we process your access data (email address and password); passwords are stored exclusively as a cryptographic hash, never in plain text. For session management we use technically necessary, time-limited login cookies ("access_token" and "refresh_token", both httpOnly), which are required for operating the portal (§ 25 (2) No. 2 TDDDG). Optionally, you can activate two-factor authentication (TOTP); in that case we store the secret required for it as well as backup codes. Processing is carried out to provide the portal and to perform the underlying contractual relationship (Art. 6 (1) (b) GDPR) and on the basis of our legitimate interest in the security of the portal (Art. 6 (1) (f) GDPR).
14. OpenStreetMap map on the contact page
On our contact page we embed a map from the OpenStreetMap service, provided by the OpenStreetMap Foundation (OSMF), St John's Innovation Centre, Cowley Road, Cambridge, United Kingdom. The map is only loaded after you have consented to the "Marketing / external media" category — either via the consent banner or directly via the button shown in place of the map. Without your consent, no connection to OpenStreetMap servers is established. When the map is loaded, data (including your IP address) is transferred to the OSMF. The legal basis is your consent (Art. 6 (1) (a) GDPR in conjunction with § 25 (1) TDDDG); you can withdraw it at any time with effect for the future (see section 7). The OSMF is based in the United Kingdom. An adequacy decision of the European Commission exists for data transfers to the United Kingdom (Art. 45 GDPR). Further information can be found in the OSMF's privacy policy: https://wiki.osmfoundation.org/wiki/Privacy_Policy
15. LinkedIn
We maintain a profile on the professional network LinkedIn. On this website, LinkedIn is included solely as a plain link; no LinkedIn plugins or other content are loaded from LinkedIn servers. No data is therefore transferred to LinkedIn when you visit this website. Only when you follow the link to our LinkedIn profile do you leave our website; from that point on, LinkedIn's privacy information applies.
16. Locally hosted fonts
For a consistent presentation, this website uses fonts that are hosted locally (self-hosting). When you visit this website, no connection to servers of Google or other font providers is established; no data is transferred to third parties as a result.
17. Analytics and marketing services
We currently do not use any analytics, tracking, or marketing services on this website. The "Statistics" and "Marketing / external media" categories provided in the consent manager only take effect if such services are embedded; the "Marketing / external media" category currently controls only the OpenStreetMap map (see section 14). Should we use analytics or marketing services in the future, this will only happen after your prior consent; we will then update this privacy policy accordingly.
18. Your rights as a data subject
Within the scope of the statutory provisions, you have the following rights with regard to your personal data: – right of access (Art. 15 GDPR) – right to rectification (Art. 16 GDPR) – right to erasure (Art. 17 GDPR) – right to restriction of processing (Art. 18 GDPR) – right to data portability (Art. 20 GDPR) – right to object to processing (Art. 21 GDPR, see section 19) To exercise these rights, and for any questions on the subject of data protection, you can contact us at any time using the contact details given in section 2.
19. Withdrawal of your consent and right to object
Many data processing operations are only possible with your explicit consent. You can withdraw consent you have already given at any time (Art. 7 (3) GDPR). The lawfulness of the data processing carried out until the withdrawal remains unaffected by the withdrawal. RIGHT TO OBJECT: Where the processing of your personal data is based on Art. 6 (1) (e) or (f) GDPR, you have the right to object to the processing at any time on grounds relating to your particular situation (Art. 21 (1) GDPR). Where your personal data is processed for direct marketing purposes, you have the right to object at any time to processing for the purposes of such marketing (Art. 21 (2) GDPR).
20. Right to lodge a complaint with a supervisory authority
In the event of infringements of the GDPR, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your place of work, or the place of the alleged infringement (Art. 77 GDPR). The supervisory authority responsible for us is: State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, LDI NRW) Düsseldorf, Germany The right to lodge a complaint exists without prejudice to any other administrative or judicial remedy.
21. No automated decision-making
No automated individual decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.
22. Changes to this privacy policy
We reserve the right to adapt this privacy policy so that it always complies with the current legal requirements, or to implement changes to our services (e.g. when introducing new services). The then-current privacy policy applies to your next visit.
This privacy policy is an English convenience translation. In case of discrepancies, the German version is authoritative.