Privacy notice

Who is responsible

The controller within the meaning of the General Data Protection Regulation (GDPR) is the operator of this tool: RegioVision GmbH Schwerin, represented by the managing director Thomas Blum, Am Margaretenhof 28, 19057 Schwerin, Germany. For all questions about data protection and for exercising your rights, please contact: blum@regiovision-sn.de.

Data protection officer: none appointed, as none is required by law; please contact the controller directly at blum@regiovision-sn.de.

The tool is used in the Interreg Baltic Sea Region project Energy Circle (#C074). The partner organisation that advises you works with the tool and can see the data of your case; see “Who receives your data”.

Whom this notice concerns

This notice applies to people at organisations that take part in the EnergyCircle Roadmap (businesses, municipalities, community initiatives), in particular the contact person of the organisation, and to staff of project partner organisations who have a user account in the tool.

What we process, why, and on what legal basis

Organisation data and Quick Check answers: details about your organisation (name, type, location, main activity, size), your energy sources and consumption, buildings and systems, waste heat and other resource flows, responsibilities, experience and barriers, goals, external factors and support needs. This is mainly company data; it can be personal data where an organisation is very small or a citizen initiative. Purpose: to prepare your individual energy roadmap together with your advising partner and to document the results of the project. Legal basis: Art. 6(1)(b) GDPR where the processing serves the advisory service you asked for, otherwise Art. 6(1)(f) GDPR (our legitimate interest, and that of the project partners, in carrying out and documenting the project).

Contact person: name, role, business email address and business telephone number of one contact person per organisation. Purpose: to send you your personal link, to stay in touch, to hand over the roadmap and to answer your requests. These data are not printed in the roadmap, are not part of the anonymised reporting and are not passed on to the One-Stop-Energy-Shop. Legal basis: Art. 6(1)(b) or (f) GDPR, as above.

Free text and evidence notes: some fields accept free text, and the advising partner can add an evidence note (up to 2,000 characters) to each rating. Please do not enter details about individuals and no special categories of data (for example health, religion, political opinions, trade-union membership). The tool does not ask for such data.

Reflection rating and roadmap: from your Quick Check answers, the advising partner rates how complete the information is in six dimensions (scale 1 to 4). From this the tool derives an information profile and proposals for actions, which the partner edits before anything reaches a roadmap document. The profile describes how complete the information about an organisation is, not a person and not the performance of the organisation. There is no automated decision with legal or similarly significant effect on you (Art. 22 GDPR): the tool proposes, a human decides. Legal basis: as above.

User accounts of partner staff: name, business email address, partner organisation, role, a password (stored only as a hash), the time of the last sign-in, a counter of failed sign-ins with a temporary lock (15 minutes) and one-time reset links (stored only as a hash, valid for 60 minutes). Purpose: access control and security of the tool. Legal basis: Art. 6(1)(f) GDPR (secure operation of the tool and cooperation in the project).

Action log: the tool records who created, viewed, changed, exported or deleted a case and who signed in, with the account, the case number and the time. The log contains no names, contact data or answers. Purpose: security, traceability and proof of lawful processing. Legal basis: Art. 6(1)(f) GDPR and Art. 32 GDPR.

Email: we send the invitation with your personal link to the business address of the contact person, password reset links to users, short notifications to the project owner and to the administrators of the advising partner (event, case number, partner, type of organisation, time and a link; never names, contact data or answers) and, where switched on, a receipt after you submit your answers and a summary to the OSES. Purpose: operating the service. Legal basis: Art. 6(1)(b) or (f) GDPR. Where no mail transport is configured, messages are only written to a redacted log on the server.

Technical data: when you open a page, the web server processes technical data such as the IP address, date and time, the requested address and browser information, and writes them to server logs (deleted after 14 days). To protect sign-in and password reset against misuse, the tool itself keeps only an irreversibly converted form of the IP address (a hash with a secret key) for one hour; the address itself is not stored. The tool uses no analytics, tracking or advertising. Its own error log contains technical error messages that are designed not to contain names, contact data or answers. Legal basis: Art. 6(1)(f) GDPR (stable and secure operation).

Reports from users: partner staff can report problems and suggestions. A report contains the account, a category, the screen it was written on, a subject and an optional description. Purpose: improving the tool. Legal basis: Art. 6(1)(f) GDPR.

Reporting: reports to the programme use anonymised figures only (numbers of cases, types of organisation, regions, scores, barrier categories), without names. The finalised roadmap is kept as project evidence (see “How long we keep your data”).

Excel import: a partner can import an Excel workbook that was filled in with you offline. The file is read in memory and is not stored; only a checksum is kept to warn about importing the same file twice. Nothing reaches the case until the partner has reviewed and confirmed it.

Where the data comes from

From you, through your personal link; from the advising partner, who enters data during the advice or imports it from a workbook; and from the tool itself, which calculates scores and drafts proposals. If the partner entered your contact details, this notice informs you under Art. 14 GDPR; the invitation email links to it.

Who receives your data

The advising partner: the staff of that partner organisation who work on your case. Partners see only their own cases; across partners only anonymised totals are visible.

The operator: staff of the controller who run and support the tool, including administrators and the project owner. The project owner may open the cases of all partners for oversight; every such access is recorded in the action log.

The One-Stop-Energy-Shop (OSES, operated by the Lead Partner, Tønder Kommune, on behalf of the consortium): only when further support is requested or the partner forwards the case. It receives a structured summary by email: case number, type of organisation, country and pilot area, status, information ratings per dimension, flags for resource flows (for example waste heat), support requested and the number of actions per time horizon. It receives no names, no contact data and no free text.

Service providers acting on our behalf under a data processing agreement (Art. 28 GDPR): hosting (Arsys Internet S.L.U., IONOS group, data centre in Spain, EU) and email transport (Arsys Internet S.L.U., on the same server, Spain, EU).

Programme bodies (Managing Authority, Joint Secretariat, auditors): only within their control rights, usually the finalised roadmap or anonymised data.

We do not sell data and do not use it for advertising.

Hosting and transfers to third countries

The tool runs at Arsys Internet S.L.U., IONOS group, data centre in Spain, EU. It loads nothing from third-party servers: fonts are delivered from the same server, and there are no analytics, tracking pixels or external scripts. We do not intend to transfer personal data to countries outside the EU/EEA. Should this change, we will inform you and ensure suitable safeguards under Art. 44 ff. GDPR.

How long we keep your data

Case data are anonymised 24 months after the roadmap has been agreed or, if no roadmap was agreed or produced, 12 months after the last change. If a roadmap version was frozen but never agreed, they are anonymised 24 months after the latest version. Anonymisation deletes the organisation name, contact details, free text, evidence notes, the roadmap text, exported files and the imported source record, and invalidates access links. Only the case number, type of organisation, region, scores and the categories of barriers and actions remain for statistics. A case can also be deleted completely on request.

The finalised roadmap document is handed to you and leaves the tool. Copies are kept as project evidence for as long as the funding rules require: under the Interreg Baltic Sea Region subsidy contract, for three years after the official end of the project on 28 February 2028, i.e. until 28 February 2031.

If your organisation takes part in a follow-up round, the data you provided may be updated. Earlier versions of your roadmap are kept as project evidence until the retention date stated above.

Your personal link expires after 30 days and when you submit your answers; it is stored only as a hash. A sign-in session ends after four hours without activity. Password reset links are valid for 60 minutes. Copies of mails that could not be delivered, and records of the mail queue, are deleted after 30 days.

User accounts are deactivated when access is no longer needed. The action log refers to accounts by number; it is kept for three years. Reports from users are kept until an administrator deletes them. Data deleted from the live system can remain in backups until these are overwritten (at most 30 days).

Cookies

The tool sets one cookie, a session cookie (named “enc_rm” unless configured otherwise). It is strictly necessary: it keeps signed-in users signed in, remembers the language you chose, carries a security token against forged requests and holds short on-screen messages. It is not used for tracking or analytics. It is marked HttpOnly and SameSite=Lax, and Secure when you use HTTPS; the session ends after four hours without activity. Because the cookie is strictly necessary, no consent is requested. Your personal link contains an access key: please do not forward it.

Providing data

Providing data is voluntary. Only the name of the organisation and the type of organisation are needed to start a case; all other answers are optional. Without data we cannot prepare a meaningful roadmap, and without a business email address we cannot send you the personal link.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). You can object at any time, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) GDPR. If processing is ever based on your consent, you can withdraw it at any time; the tool does not currently ask for consent.

How we help: the partner can give you a copy of your case as a machine-readable file, correct data, set a case to restricted (read-only, excluded from exports and notifications) or delete it. Please send your request to blum@regiovision-sn.de or to your advising partner, who passes it on. We answer within one month. Project evidence that must be kept under the funding rules cannot be erased before the retention period ends; we tell you if this applies.

Complaints

You have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement. Competent authority for the controller: Der Landesbeauftragte für Datenschutz und Informationsfreiheit Mecklenburg-Vorpommern (the data protection authority of the German federal state of Mecklenburg-Vorpommern), Werderstraße 74a, 19055 Schwerin, Germany; postal address: Schloss Schwerin, Lennéstraße 1, 19053 Schwerin; info@datenschutz-mv.de; www.datenschutz-mv.de.

Status of this notice

Version of 30 October 2026. We update this notice when the tool or the processing changes.