Privacy Policy

GLOBAL sonnen EXTERNAL PRIVACY NOTICE

‍

1. What does this privacy notice cover?
This privacy notice informs you about the processing of your personal data by companies belonging to the sonnen Group (hereinafter “sonnen”, “we”, or “us”), as well as by our parent company Shell.

This privacy notice applies to our customers, suppliers, business partners and/or investors, as well as to visitors to our website and customer portal. If you visit one of the websites we provide, our provisions on data protection and the use of cookies shall also apply. Further information can be found in the privacy notices published on the website.

In addition, local privacy notices and regulations may apply in the countries in which we operate, reflecting local practices and applicable legal requirements. This privacy notice is therefore always subject to the applicable legal provisions and may need to be adapted accordingly.

This privacy notice explains which personal data are processed for which purposes, how long we retain personal data, how you can access and update your personal data, where you can obtain further information, and where you can lodge a complaint.

2. Special notice if you are under 16 years of age. Processing of children’s personal data
If you are under 16 years of age (or older, where this is provided for by law), please do not send us any personal data (such as your name, address, or email address). If you nevertheless wish to ask us a question that requires you to provide personal data (for example in connection with an apprenticeship or an event we offer), please contact your parents or legal guardians and ask them to contact us on your behalf.

3. What personal data do we process?
We process the following personal data from and in connection with individuals who are customers, suppliers, business partners and/or investors:

• Private contact information (such as name, postal address, email address and telephone number), insofar as required for the intended purposes;
• Business contacts and other information (such as job title, department, company name and the reason for collaboration with sonnen).

4. Who is responsible for the personal data collected?
The data controller within the meaning of the law is sonnen Holding GmbH, Am Riedbach 1, 87499 Wildpoldsried, Germany, and/or the company within the sonnen Group with which you have a contractual relationship.

5. For what purpose do we process your personal data?
We process the personal data received from you in the following cases on the basis of these provisions:

5.1 In the course of our business activities and for the performance of concluded contracts
Carrying out our business activities, including for the purpose of researching, developing and improving the products and services we offer; concluding and performing contracts with customers, suppliers and business partners; recording and invoicing services, products and materials from and to sonnen; managing and promoting a business relationship, e.g. maintaining and fostering contacts with existing and potential future customers; for our accounting, customer service, the development, implementation and analysis of market surveys and marketing strategies.

5.2 Organisation of our business operations
The organisation and management of our business, including financial and asset management, the implementation of control mechanisms, reporting, evaluations, audits and internal investigations.

5.3 Health and safety
To protect the health and safety of our employees, including the protection of a person’s life or health, we verify a person’s identity and access rights to the facilities and premises of our companies.

5.4 Compliance with legal requirements; enforcement of rights
Compliance with legal and statutory provisions, including for the purpose of conducting legal proceedings or defending against claims.

5.5 Screening against publicly accessible sanctions lists
In order to comply with legal obligations, protect assets, our employees and contractors, and in particular to ensure that sonnen can comply with all trade control, anti-money laundering and/or anti-bribery and corruption laws and other legal requirements, we carry out regular checks (at least quarterly) of our existing and potential future customers and business partners.

This screening is carried out on the basis of publicly available or government-issued sanctions lists. It is conducted in Europe. For this purpose, we compare your first and last name with the data contained in the published sanctions lists. In the event of an initial match, we will use the data stored by sonnen (e.g. date of birth, nationality, address) to verify whether the match is indeed correct. For this review, sonnen may also use other public sources, such as information from credit agencies. sonnen may also contact the data subject directly for this purpose in order to obtain further information. If sonnen cannot rule out the match, we reserve the right to engage external advisors (KPMG EU) for further review and assessment.

If a match has been confirmed, Shell plc has a legal reporting obligation to the U.S. Securities and Exchange Commission (SEC). Shell Midstream Partners LP (MLP) is required to submit quarterly and annual reports to the SEC. Where legally required, sonnen must report to the competent local supervisory authorities.

The legal basis for this data processing is Article 6(1)(c) and (f) GDPR.

This screening does not result in automated decisions regarding an existing customer or business partner or a future customer or business partner.

6. Legal basis for the processing of personal data
The personal data covered by this privacy notice are processed exclusively in accordance with the following provisions:

• to contact a person at their request prior to entering into a contract;
• to perform a contract concluded between you and sonnen;
• insofar as necessary for compliance with the laws and legal provisions to which we are subject;
• insofar as necessary for the purposes of the legitimate business interests of sonnen, provided that such interests are not overridden by the interests, fundamental rights or freedoms of the data subject; or
• (only where legally required) with the explicit consent of a person.

Where we process personal data on the basis of your consent, you have the right, unless otherwise provided by law, to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal.

7. To whom do we disclose personal data?
Your personal data will be processed exclusively for the purposes stated above. They will only be disclosed strictly in accordance with the “need-to-know” principle as follows:

• Your personal data may be transferred to other companies within the sonnen Group, including our parent company Shell plc, insofar as this is necessary for the purposes stated in Section 5.
• We may also share your data within our group of companies in order to offer you promotions or inform you about related products and/or services. This is done on the basis of the consent you have given for marketing purposes, and in all cases marketing materials will only be sent to you by us.

Shell’s view of the customer
To ensure you have a positive experience with the Shell Group, taking into account the context of your interaction with Shell, we combine the information obtained from the above-mentioned sources to create a personal profile about you; this enables you to interact more easily with different Shell companies. It also ensures that we have the most up-to-date information about you in order to better develop services and products and tailor offers to your particular interests.

However, please note that you have the possibility to control how Shell uses this information. You may object to the combination of your personal data in this manner – please refer to the section below entitled “Your rights in relation to your personal data.”

• Your personal data may also, where applicable, be transferred to companies within sonnen Holding GmbH that provide sonnen products and services which we require in order to perform the contracts concluded with you.
• Authorised third parties, such as sales representatives, partners, service providers and subcontractors of sonnen.
• A competent public authority, government or administration, insofar as this is necessary to fulfil legal obligations to which the respective company of sonnen Holding GmbH is subject.

8. Transfer of personal data
Where personal data are transferred to companies within the sonnen Group and/or to authorised third parties in accordance with the above provisions, whether inside or outside the country in which you reside (including outside the European Economic Area), we take organisational, contractual and legal measures to ensure that your personal data are processed only for the above-mentioned purposes and that an adequate level of protection of personal data is ensured.

These measures include mechanisms approved by the European Commission for the transfer of personal data to third parties in countries whose level of data protection is not considered adequate, as well as additional local legal requirements.

9. How long will your personal data be retained?
sonnen stores all personal data collected for the conclusion and performance of a contract with a customer, supplier or business partner, or in the context of submitting an offer, for the duration of the contractual relationship and for up to 3 years after the end of the collaboration.

In all other cases, personal data, including data collected in the context of an unsuccessful offer submission as well as data processed pursuant to Section 5.5, will be deleted no later than three months after their collection.

In all cases, information may be retained a) for a longer period if there is a legal reason for doing so (in which case it will be deleted once it is no longer needed for the legal purpose), or b) for a shorter period if the purpose of storage ceases to apply before the end of the defined retention period.

10. How can I access my personal data?
Our aim is to keep our information about you as accurate as possible. You have the right to obtain information about your personal data.

You may access your personal data and request correction or deletion of personal data. Deletion of data may only be requested insofar as the purpose of storage no longer applies. Furthermore, you have the right to request that the processing of your data and the transfer of the data be restricted to the extent necessary. For this purpose, please contact the data controller as explained below.

11. Whom can I contact for further information?
Please address your questions and claims arising from this privacy notice to sonnen Holding GmbH, for the attention of the management, Am Riedbach 1, 87499 Wildpoldsried, Germany, privacy-notice@sonnen.de. In addition, the sonnen Holding GmbH company with which you have concluded a contract will also provide information.

You may also contact our data protection officer at the following address: Deutsche Shell Holding GmbH, Michael Seus, Suhrenkamp 71–77, 22335 Hamburg, Germany, datenschutz@sonnen.de.

You may also lodge a complaint with a data protection authority. The competent supervisory authority for sonnen Holding GmbH is the Bavarian State Commissioner for Data Protection (BayLfD), Wagmüllerstraße 18, 80538 Munich, +49 89 212 673.0, poststelle@datenschutz-bayern.de.

12. Contact by email or via the contact form
When you contact sonnen by email or via the contact form, the data you provide (your email address and, where applicable, your name and telephone number) will be stored by us in order to process your enquiry and in case of follow-up questions. They will not be passed on to third parties without your consent. The processing of these data is therefore based exclusively on Article 6(1), sentence 1, lit. a GDPR. The data collected in this context remain with us until you request deletion, revoke your consent to storage, or the purpose for data processing no longer applies. Statutory retention obligations and other mandatory legal provisions remain unaffected.

13. Collection of personal data when visiting our website
When you use the website for information purposes only, i.e. if you do not register or otherwise provide us with information, we only collect the personal data that your browser transmits to our server. If you wish to view our website, we collect the following data, which are technically necessary for us to display our website to you and to ensure stability and security (the legal basis is Article 6(1), sentence 1, lit. f GDPR):

• IP address
• Date and time of the request
• Time zone difference to Greenwich Mean Time (GMT)
• Content of the request (specific page)
• Access status / HTTP status code
• Amount of data transferred in each case
• Website from which the request originates
• Browser
• Operating system and its interface
• Language and version of the browser software

14. Further functions and offers on our website
In addition to the purely informational use of our website, we offer various services that you can use if interested. To do so, you generally need to provide additional personal data, which we use to provide the respective services and to which the aforementioned principles of data processing apply.

In some cases, we use external service providers and partner companies to process your data or to execute and handle commissioned services. These have been carefully selected and commissioned by us, are bound by our instructions and are regularly monitored.

Furthermore, we may pass on your personal data to third parties if participation in promotions, competitions, contract conclusions or similar services are offered jointly with partners. More detailed information on this is provided when you enter your personal data or in the description of the offer below.

The processing of your data is based on Article 6(1), sentence 1, lit. a GDPR.

If our service providers or partners are based in a country outside the European Economic Area (EEA), we will inform you about the consequences of this circumstance in the description of the offer.

15. sonnenDrive
As part of the sonnenDrive offer, sonnen cooperates with Fleetpool GmbH, Schanzenstraße 41 d, 51063 Cologne, Germany. If you use this offer, the vehicle transfer agreement is concluded directly between you and Fleetpool. For the purpose of preparing an offer and performing the contract, Fleetpool processes in particular the following data that you enter on our website: first name, last name, billing and delivery address, email address, billing and payment data, date of birth, telephone number and driver’s licence details. The legal basis for this is Article 6(1)(b) GDPR.

In order to process payments, Fleetpool transfers the specific payment amount to the selected payment service provider. Further information will be provided by Fleetpool during the conclusion of the contract.

For the processing of the shipment of the sonnenDrive charging card offered, sonnen transfers your name and address to the commissioned service provider Dutch Card Printing B.V., Groningen. The legal basis is Article 6(1)(b) GDPR.

With regard to the personal data obtained via our website, sonnen GmbH has entered into an agreement with Fleetpool GmbH governing the joint responsibility of sonnen and Fleetpool for the processing of your personal data. The joint contact point of sonnen and Fleetpool for all information and communications to the data subject in this context is sonnen GmbH. You may send your questions and objections by post to the management, Am Riedbach 1, 87499 Wildpoldsried, Germany. You can reach us by telephone at +49 8304 929 33 400 and by email at datenschutz@sonnendrive.de. sonnen will deal with your enquiry promptly. In the interest of providing a timely and comprehensive response to your request, the email will also be forwarded to Fleetpool.

16. SSL or TLS encryption
For security reasons and to protect the transmission of confidential content, such as enquiries or orders that you send to us, this site uses SSL or TLS encryption. You can recognise an encrypted connection by the fact that the address line of your browser changes from “http://” to “https://” and by the lock symbol displayed in your browser line.

When SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.

17. Use of cookies
Further information on the use of cookies on our website can be found at https://www.sonnen.de/cookies.

18. Email security
As soon as you initiate electronic contact with sonnen, you agree to electronic communication. Please note that emails may be read or altered without authorisation and without notice during transmission. Only some parts of this website use encryption technology. sonnen uses software to filter unwanted emails (spam filter). The spam filter may reject emails if they are incorrectly identified as spam due to certain characteristics.

19. Security through technical and organisational measures
In accordance with the applicable legal provisions, we use technical and organisational measures to protect personal data against accidental or intentional manipulation, loss, destruction or access by unauthorised persons. The security measures in use are continuously improved in line with technological developments.

20. Publication of job advertisements / online job applications
Your application data are collected and processed electronically by us for the purpose of handling the application process. The legal basis for data processing is Article 6(1), sentence 1, lit. a GDPR. If your application leads to the conclusion of an employment contract, the data you have submitted may be stored in your personnel file for the purposes of the usual organisational and administrative process, in compliance with the relevant legal provisions. The legal basis for data processing is Article 6(1), sentence 1, lit. f GDPR. If your application is rejected, the data you have submitted will be deleted automatically two months after notification of the rejection. This does not apply if longer storage is required by law (for example, due to the burden of proof under the General Equal Treatment Act) or if you have expressly consented to longer storage in our applicant database.

21. Changes to this privacy notice
This privacy notice may be amended over time. It applies in its current version and is subject to the applicable legal provisions. This privacy notice was last updated on 22 November 2021.

‍