We are aware of the trust you are placing in us. Therefore, we would like to provide comprehensive information to you on how we handle your personal data, in particular, we would like to inform you about the type of data we collect when you visit and/or use our website and on how we use this data. If we have received personal data from you through other communication channels (e.g. by e-mail), the following Privacy Notice applies as well.
Given that our website and the technologies on which it is based, as well as our business processes are subject to continuous development, the Privacy Notice may need to be changed too. All future changes will be published on this website.
II. Use of the website and data protection
1. Name and contact data of the controller of the website
We, Aquila Sustainable Infrastructure GmbH, represented by the managing directors Rolf Zarnekow and Markus Holzer, Valentinskamp 70, 20355 Hamburg (Tel.: +49 40 875050-100 / receptionist, Fax: +49 40 87 5050-129) are the provider of this website within the meaning of § 5 TMG and the controller within the meaning of Art. 4(7) GDPR.
2. Contact data of the data protection officer
Aquila Sustainable Infrastructure GmbH is part of Aquila Capital (meaning Aquila Capital Holding GmbH and its affiliated companies in the sense of 15 et seq. of the German Stock Corporation Act (AktG)). The data protection officer of Aquila Capital can be reached as follows:
Aquila Capital Holding GmbH
c/o the data protection officer
Valentinskamp 70, 20355 Hamburg
3. Restriction of the scope of this Privacy Notice for visits to our website
Our Privacy Notice only applies to our content which is stored on our servers. It expressly does not cover any links to websites of third parties in our offerings.
4. Collection of personal data in the context of informational use of our website
a. Description and scope of data processing
If you only use our website for informational purposes, we do not collect any personal data aside from the data transmitted by your browser to enable you to visit the website.
That data is:
- Date and time of your request
- Duration of your visit
- Time zone difference compared to Greenwich Mean Time (GMT)
- Content of the request (specific page)
- Access status / HTTP status code
- Website & provider from/by which the request is made
- Operating system
- Language and version of the browser software
- IP address (anonymised)
b. Purpose and legal basis of data processing
We store data related to the end device in order to create use statistics, for example, or to identify and trace unauthorised attempts to access our web servers. We only create profiles regarding the use of our website in anonymised form and only to improve user navigation and optimise our products and services. Our legitimate interest in data processing pursuant to Art. 6 (1) lit. f GDPR also lies in these purposes. We do not create or process behavior profiles relating to a specific person from the aforementioned information.
c. Duration of data storage
The data will be deleted as soon as they are no longer necessary to achieve the purpose for which they were collected. In the case of the collection of data for the provision of the website, this is the case when the respective session has ended.
5. Collection of personal data during the use of our website features
We only store personal data, such as your e-mail address or your name, if you choose to provide this information to us, e.g. in the context of the contact form, or for the performance of a contract (principle of direct collection).
a. Contact form
The following data is collected:
- e-mail address,
- any information you choose to include in the text-field.
We process your personal data provided in the contact form in order to contact you and to process your request (Art. 6 (1) lit. b GDPR). This data will not be passed on without your consent. Data transmitted via the contact form will remain with us until you request us to delete it or there is no longer any need to store the data. Mandatory legal provisions – in particular retention periods – remain unaffected. Your rights in connection with data processing can be found under III. point 7.
b. LinkedIn Plug-In
Components of LinkedIn Corporation are also integrated on this website. In Europe, LinkedIn is operated by LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland, which are also responsible for privacy matters outside the United States
Each time a LinkedIn component (LinkedIn plug-in) is installed on our website, that component causes the browser used by the individual to download an appropriate representation of the LinkedIn component. More information about the LinkedIn plug-ins can be found at https://developer.linkedin.com/plugins. As part of this technical process, LinkedIn obtains information as to which specific subpage of our website is visited by the person concerned.
If the person concerned is logged in to LinkedIn at the same time, LinkedIn recognizes which specific page of our website the person concerned is visiting each time the person visits our website and for the entire duration of that person’s stay on our website. This information is collected by the LinkedIn component and assigned by LinkedIn to the respective LinkedIn account of the person concerned. If the person concerned clicks on an integrated LinkedIn button on our website, LinkedIn assigns this information to the personal LinkedIn user account of the person concerned and saves this personal data.
LinkedIn always receives information through the LinkedIn component that the person concerned has visited our website if the person concerned is logged in to LinkedIn at the same time as accessing our website; this occurs regardless of whether the person concerned clicks on the LinkedIn component or not. If the data subject does not want LinkedIn to receive such information, he or she can prevent the transmission by logging out of his or her LinkedIn account before accessing our website.
Notes on legal bases:
If we ask you for your consent to the use of LinkedIn, the legal basis for the processing of data is the consent in accordance with Art. 6 (1) lit. a. GDPR. In other cases, your data will be processed on the basis of our legitimate interests (i.e. interest in an attractive presentation of our online services) pursuant to Art. 6 (1) lit. f. GDPR.
6. Disclosure to third parties
To facilitate the purposes described we may exchange your data with third parties we use to process orders and inquiries. In this context we may provide access to your information to third parties that support our provision of services to you. Examples are third parties used to manage our web servers and to analyse data who may be able to access your data in this context. A data processing agreement is concluded in this case.
If you make your personal data available to us for the purpose of potential future cooperation, potential investments and/or to enable us to contact you, we may disclose this data to affiliated companies (as defined in Sections 15 et seqq. of the German Stock Corporation Act), if there is a legitimate interest on our part and your interests, fundamental rights and freedoms do not outweigh.
Otherwise we only provide your personal data to third parties if we are obligated to do so by compulsory legal regulations, if you ask us to do so or have consented to the disclosure, or after the data has been anonymised or pseudonymised.
We only transfer data to third parties established in a third country with your consent or to fulfil our contractual obligations pursuant to Art. 44 GDPR et seqq.
7. Data security, TLS encryption with https:, Technologies used
We take diligent precautions to protect your data against manipulations, loss, destruction and against access by unauthorised persons. We continuously improve our security measures in accordance with the development of technology. All employees are obligated to maintain data confidentiality in accordance with the provisions of the GDPR.
We use https to transmit data in a tap-proof manner on the internet (data protection through technology design Article 25 (1) GDPR). Through the use of TLS (Transport Layer Security), an encryption protocol for secure data transmission on the internet, we can ensure the protection of confidential data. You can recognize the use of this data transmission security by the small lock symbol in the upper left corner of the browser and the use of the https scheme (instead of http) as part of our Internet address.
8. Technologies used
9. CookiesChange your Privacy Preferences
a. Description and scope of data processing
If you want to, you can suppress the storage of cookies in general through your web browser or you can decide if you want to be asked if a cookie should be stored or not. However, if you do not accept cookies, some pages may not be displayed correctly any more.
- Language and country
- Browser settings and installed plug-ins
- Data on the use of our website.
This website uses the following cookies:
- Transient cookies (temporary use)
- Persistent cookies (use for a limited time)
Transient cookies are deleted automatically when you close your browser. They specifically include session cookies. Session cookies store a “session ID” which allows to allocate various requests from your browser to a joint session. This allows the website to recognize your computer when you return to the website. Session cookies are deleted when you log out or close your browser.
Persistent cookies are deleted automatically after a specified period which may vary depending on the type of the cookie. You can delete the cookies at any time in the security settings of your browser.
The user data collected in this way is pseudonymised by technical precautions. Therefore, it is no longer possible to assign the data to the calling user. The data will not be stored together with other personal data of the users.
More information on how cookies work can be found on the following website: http://www.allaboutcookies.org.
b. Purpose and legal basis of data processing
The user data collected by technically necessary cookies are not used to create user profiles.
The legal basis for the processing of personal data using technically necessary cookies is Art. 6 (1) lit. f. GDPR. Legal basis for the processing of personal data using other cookies (marketing, statistics, etc.) will be on the basis of your consent Art. 6 (1) lit. a. GDPR.
c. Duration of storage objection and elimination options
d. Customize cookie settings
When calling up our website, we offer you the possibility to individually adjust the cookies via the “Settings” item in the cookie banner. This consent is voluntary, not necessary for the use of this website and can be revoked at any time. You can adjust the cookie settings here at any time.
By clicking on “accept” in the cookie banner, you also consent to your data being processed in the USA in accordance with Art. 49 (1) lit a GDPR. The USA is considered by the European Court of Justice to be a country with an inadequate level of data protection according to EU standards. In particular, there is a risk that your data may be processed by US authorities, for control and monitoring purposes, possibly without the possibility of legal recourse. If you click on “accept only necessary”, the transfer described above will not take place.
10. Google Analytics
We use the Google Analytics service of the provider Google Ireland Limited (Google Ireland/EU) on our website.
Some of this data is information stored in the terminal device you are using. In addition, further information is also stored on your end device via the cookies used. Such storage of information by Google Analytics or access to information already stored in your terminal device will only take place with your consent.
Google Ireland will process the data thus collected on our behalf in order to evaluate the use of our website by users, to compile reports on the activities within our website and to provide us with further services related to the use of our website and the use of the Internet. In doing so, pseudonymous user profiles can be created from the processed data.
The setting of cookies and the further processing of personal data described here takes place with your consent. The legal basis for the data processing in connection with the Google Analytics service is therefore Art. 6 (1) lit. a GDPR. You can revoke this consent via our Consent Management Tool at any time with effect for the future.
The personal data processed on our behalf to provide Google Analytics may be transferred to any country in which Google Ireland or Google Ireland’s sub-processors maintain facilities. Google Ireland uses the EU standard data protection clauses as appropriate safeguards for these transfers of personal data in third countries, which can be found at the following link: https://business.safety.google/adsprocessorterms/sccs/eu-p2p-intra-group/.
We use the Google Universal Analytics variant. This enables us to assign interaction data from different devices and from different sessions to a unique user ID. This allows us to put individual user actions in context and analyse long-term relationships.
The data on user actions is stored for a period of 14 months and then automatically deleted. Data whose storage period has expired is automatically deleted once a month.
11. Your rights
III. General Information and specific data processing at Aquila Capital (data protection information according to Art. 13 GDPR)
The privacy and the cautious processing of your personal data is very important to Aquila Capital (meaning Aquila Capital Holding GmbH and its affiliated companies within the meaning of Art. 15 et. seq of the German Stock Corporation Act (AktG)). In the following we would like to inform you about the processing of your personal data within Aquila Capital and your rights regarding personal data protection. Which specific personal data will be collected and/or used significantly depends on the specific business relationship we have with you or the occasion and the purpose of the processing or other factors. In this respect, you will find in this section data protection information relating to specific processing activities.
1. Name and contact data of the controller
Controller within the meaning of GDPR and/or other European data protection laws or regulations, is the legal entity within Aquila Capital, with which you maintain a business relationship, that collects personal data from you or to which you provide personal data.
The responsible company of Aquila Capital with legal seat in Hamburg, Germany, can be reached as follows:
Valentinskamp 70, 20355 Hamburg, Germany
Tel.: +49 40 875050-100
The responsible company of Aquila Capital with legal seat in Spain can be reached as follows:
Paseo de la Castellana, 259D, Torre Emperador, 28046 Madrid, Spain
Tel.: +34 91 511 90-50
Carrer del Foc, 30, 08038 Barcelona, Spanien
Tel.: +34 91 511 90-50
The responsible company of Aquila Capital with legal seat in Norway can be reached as follows:
Haakon VIIs gate 6
0161 Olso, Norway
phone: +49 40 87 5050-100
2. Contact data of the data protection officer of Aquila Capital
The data protection officer of Aquila Capital can be reached as follows:
Aquila Capital Holding GmbH
c/o data protection officer
Valentinskamp 70, 20355 Hamburg
In addition, a data protection officer has been appointed for the relevant Spanish Group companies, who can be contacted as follows: e-mail: firstname.lastname@example.org.
3. Purpose of personal data processing and legal basis
We process personal data in accordance with the relevant rules and regulations, in particular with GDPR.
The processing of personal data is necessary for the performance of a contract with you (Art. 6 (1) lit. b. GDPR).
The processing of personal data is necessary for the purposes of the legitimate interests pursued by you or by a third party (Art. 6 (1) lit. f. GDPR).
If you have declared your consent in the processing of personal data for certain purposes, we process such data on the basis of your consent (Art. 6 (1) lit. a. GDPR.
In addition, we are subject to a large number of legal obligations (money- laundering act, tax law etc.) as well as regulatory regulations. For this purpose we can use and process your personal data (Art. 6(1) lit. c. GDPR).
4. Recipients or categories of recipients of the personal data
Your personal data will be transmitted within Aquila Capital to all entities which need these data for contractual and/or regulatory purposes. For these purposes we also may transmit your personal data to processors (Art. 28 GDPR) if applicable. To comply with certain contractual obligations we may transmit personal data to other recipients, e.g. public authorities or organisations in case of legal obligations. A transfer of personal data to third parties with a registered office in a third country will only take place with your consent or in order to fulfil our contractual obligations pursuant to Art. 44 et seq GDPR.
5. Duration of storage
Where required, we process and store your personal data for the period of our business relation or until the revocation of your consent. The retention period of personal data within the Know Your Costumer process is 5 years. The retention period begins upon conclusion of the calendar year in which the business relationship is terminated. In all other cases, it begins upon conclusion of the calendar year in which the respective information was gathered (see Sec. 8 para 4 Money Laundering Act).
Furthermore, we are subject to miscellaneous safekeeping and documentation obligations that may arise from e.g. German Commercial Code or General Fiscal Code. Pursuant to the provisions of these laws, personal data must generally be retained for a period of ten years. In addition, the statutory period of limitations within the meaning of §§195 et seq German Civil Code (BGB) shall apply in relation to the duration of storage period. Thus, the maximum period of limitation term is up to 30 years.
6. Automated decision-making including profiling
We do not use automated decision-making within the meaning of Art. 22 GDPR for establishing and fulfilling the business relationship with you. We do not use procedures based solely on automated processings. Your personal data will be partially processed automatically, to analyse certain personal aspects (profiling). Profiling is used in the following areas: We are subject to certain legal and regulatory requirements, e.g. anti-money laundering, terrorist financing and asset risk offenses. Concurrently, these measures are for your protection.
7. Your Rights
IV. DATA SUBJECT RIGHTS
As a data subject within the meaning of the GDPR, you have various rights vis-à-vis the responsible entity of Aquila Capital with regard to your personal data, which we inform you about below. You can also find details about your rights in Art.15-21 of the GDPR:
- right of access
You have the right to request information about your personal data processed by the controller. In particular, about the purposes of processing, the categories of personal data and about recipients or categories of recipients to whom the personal data have been disclosed. Furthermore, you have the right to obtain information about the planned duration of storage.
- right to rectification or erasure,
You have the right to request the correction of incorrect data or the completion of your personal data stored by the controller without delay. You have the right to request the erasure of your data under the conditions specified in Art. 17 GDPR.
- right to restriction of processing,
In specific cases set out in the GDPR, you have the right to request the restriction of the processing of your personal data.
- right to withdraw the consent
Insofar as we process your data on the basis of your consent you have the right to revoke this consent at any time with effect for the future, without this affecting the lawfulness of the consent valid until then. The revocation is – like the granting of consent itself – possible orally or in text form.
- right to object to processing,
Insofar as personal data are processed based on legitimate interests pursuant to Art. 6 (1) lit. f GDPR, you have the right to object to the processing of your personal data, insofar as there are grounds for doing so that arise from your particular situation.
- right to data portability
In specific cases set out in the GDPR, you have the right to receive and transfer all personal data concerning you to another controller (right to data portability).
You can contact us or our data protection officer to assert your rights (for contact details see section II. 1 and 2).
You also have the right to complain with a data protection supervisory authority about our processing of your personal data.