Privacy Policy

As of 06/11/2025

Who we are

The controller according to the General Data Protection Regulation (GDPR) and other data protection regulations is:

heatbeat engineering GmbH
Karl-Grillenberger-Straße 1a
90402 Nürnberg
Germany
0911 477188 10
hello@heatbeat.de
https://heatbeat.de

Contacting the Data Protection Officer

The Data Protection Officer of the controller is:

DataCo GmbH
Sandstr. 33
80335 München
Germany
+49 89 7400 45840
www.dataguard.de

On this page we inform you about the processing of your personal data on the website.

How we collect and use your personal data depends on how you interact with us or which services you use. We only collect, use or share your personal data when we have a legitimate purpose and legal basis for doing so.

What do we mean by legal basis?

  • Consent (Art. 6 para. 1 p. 1 lit. a GDPR) - You have given us your consent to process your personal data for the specific purpose we have explained to you. You have the right to withdraw your consent at any time.
  • Contract (Art. 6 para. 1 p. 1 lit. b GDPR) - We need to use your data to fulfill a contract you have with us.
  • Legal obligation (Art. 6 para. 1 p. 1 lit. c GDPR) - We need to use your data to comply with the law.
  • Vital interests (Art. 6 para. 1 p. 1 lit. d GDPR) - The processing of your data is necessary to protect your vital interests or those of another person.
  • Public task (Art. 6 para. 1 p. 1 lit. e GDPR) - The processing of your data is necessary for the performance of a task carried out in the public interest.
  • Legitimate interests (Art. 6 para. 1 p. 1 lit. f GDPR) - The processing of your data is necessary to support a legitimate interest.

Please note that we may not be able to provide you with our website services if your data is processed to fulfill a contract or legal obligation and you do not provide the requested data.

Data sharing and international transfer

As explained in this privacy policy, we use various service providers who help us provide our services and secure your data. When we use these service providers, it is necessary for us to share your personal data with them.

We have agreements with all service providers to whom we transfer your data that oblige them to protect your data.

If your personal data is transferred outside the EU, we ensure that your personal data receives an equivalent level of protection, either because the country to which your data is transferred has an "adequate" level of data protection according to the European Commission, or by applying another protective measure, such as an extended contractual agreement, i.e. the standard contractual clauses (SCCs) adopted by the European Commission.

For example, when we use US service providers, we rely either on the SCCs or the EU-US Data Privacy Framework, depending on the provider. You can request a copy of the SCCs we have concluded with our service providers by sending an email to the email address specified in this privacy policy.

Your rights

If your personal data is processed, you are a data subject within the meaning of the GDPR and you have the following rights with regard to the controller:

1. The right to information (Art. 15 GDPR)

You have the right to obtain confirmation from us as to whether or not personal data concerning you is being processed. Where that is the case, you have the right to access the personal data and the following information:

  • Purposes of processing
  • Categories of personal data
  • Recipients or categories of recipients
  • Planned storage period or the criteria for determining this period
  • the existence of the right to rectification, erasure, restriction or objection
  • Right to lodge a complaint with a supervisory authority
  • Where applicable, the origin of the data (if collected from a third party)
  • Where applicable, the existence of automated decision-making, including profiling, with meaningful information about the logic involved, the scope and the intended effects
  • Where applicable, the transfer of personal data to a third country or international organization

2. Right to rectification (Art. 16 GDPR)

If your personal data is inaccurate or incomplete, you have the right to request the immediate correction or completion of the personal data.

3. Right to restriction of processing (Art. 18 GDPR)

If one of the following conditions is met, you have the right to request the restriction of the processing of your personal data:

  • You contest the accuracy of your personal data, for a period enabling us to verify the accuracy of the personal data.
  • The processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead.
  • We no longer need the personal data for the purposes of the processing, but you require them for the establishment, exercise or defense of legal claims, or
  • you have objected to processing pending the verification whether our legitimate grounds override yours.

4. Right to erasure ("right to be forgotten") (Art. 17 GDPR)

If one of the following reasons applies, you have the right to request the immediate erasure of your personal data:

  • Your data is no longer necessary for the purposes for which it was collected or otherwise processed.
  • You withdraw your consent and there is no other legal basis for the processing.
  • You object to the processing and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Art. 21(2) GDPR.
  • Your personal data has been unlawfully processed.
  • The erasure is necessary for compliance with a legal obligation under Union or Member State law to which we are subject.
  • The personal data has been collected in relation to the offer of information society services referred to in Article 8(1) GDPR.

Please note that the above reasons do not apply to the extent that processing is necessary:

  • For exercising the right of freedom of expression and information;
  • For compliance with a legal obligation or for the performance of a task carried out in the public interest or in the exercise of official authority vested in us;
  • For reasons of public interest in the area of public health;
  • For archiving purposes in the public interest, scientific or historical research purposes or statistical purposes;
  • For the establishment, exercise or defense of legal claims.

5. Right to data portability (Art. 20 GDPR)

You have the right to receive your personal data in a structured, commonly used and machine-readable format or to request transmission to another controller.

6. Right to object to certain data processing (Art. 21 GDPR)

You have the right to object at any time to processing of personal data concerning you which is based on Art. 6(1)(e) or (f) GDPR, including profiling based on those provisions, on grounds relating to your particular situation.

Where personal data concerning you is processed for direct marketing purposes, you have the right to object at any time to processing of personal data concerning you for such marketing, which includes profiling to the extent that it is related to such direct marketing.

7. Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority if you consider that the processing of personal data relating to you infringes the GDPR.

The supervisory authority with which the complaint has been lodged informs the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to Art. 78 GDPR.

You can find a list of the locally competent supervisory authorities in Germany on the website of the Federal Commissioner for Data Protection at the following link: https://www.bfdi.bund.de/DE/Service/Anschriften/Laender/Laender-node.html

Provision of the website and creation of log files

1. Description and scope of data processing

Every time you visit our website, our system automatically collects data and information from the computer system of the accessing computer.

The following data is collected:

  • Information about browser type and version used
  • The user's operating system
  • Date and time of access
  • Websites from which the user's system reaches our website
  • Websites accessed by the user's system via our website
  • Location, screen size

This data is stored in our system's log files.

This does not affect the user's IP addresses or other data that enables the assignment of data to a user. These data are not stored together with other personal data of the user.

2. Purpose of data processing

The storage in log files is done to ensure the functionality of the website. In addition, we use the data to optimize the website and to ensure the security of our information technology systems. No evaluation of the data for marketing purposes takes place in this context.

3. Legal basis for data processing

The legal basis for the temporary storage of data and log files is Art. 6 para. 1 sentence 1 lit. f GDPR.

4. Storage duration

The data will be deleted as soon as they are no longer necessary for the achievement of the purpose for which they were collected. In the case of collecting data for providing the website, this is the case when the respective session has ended.

In the case of storing data in log files, this is the case after no more than seven days. Storage beyond this is possible. In this case, the IP addresses of the users are deleted or anonymized, so that an assignment of the calling client is no longer possible.

5. Exercising your rights

The collection of data for the provision of the website and the storage of the data in log files is absolutely necessary for the operation of the website. The user can object to this. Whether the objection is successful is to be determined within the framework of a balancing of interests.

Use of cookies

1. Description and scope of data processing

During your visit to our website, we use technical tools for various functions, in particular cookies that can be stored on your device. When you visit our website and at any time later, you can choose whether to allow the setting of cookies in general or which individual additional functions you wish to select. You can make changes in your browser settings or via our consent manager.

Cookies are text files or information in a database that are stored on your hard drive and assigned to the browser you are using, so that certain information can flow to the party that sets the cookie. Below we describe what types of cookies we use:

We use technically necessary cookies that are required for the technical structure of the website. Without these cookies, our website cannot be displayed (completely correctly) or the support functions are not possible.

The following data is stored and transmitted by the technically necessary cookies:

  • CSRF token: Randomly generated string used to ensure that requests to the server come from an authenticated user
  • Session ID: A session ID is a unique identification number assigned to a user session. This ID is used to combine and assign multiple requests from a user to a session.
  • Django-Language: This cookie stores the user's preferred language for the web application.

2. Purpose of data processing

The purpose of using technically necessary cookies is to ensure the functionality of our website. Some functions of our website cannot be offered without the use of cookies. For these, it is necessary that the browser is recognized even after a page change.

We need the technically necessary cookies for the following applications:

  • Functionality of the website

The use of technically unnecessary cookies serves the purpose of improving the quality of our website, its content and thus our reach and profitability. By setting these cookies, we learn how the website is used and can thus continuously optimize our offering. In particular, these cookies serve us for the following purposes:

  • CSRF token: Ensures that requests to the application are legitimate and come from authenticated users (lifetime: for the duration of the session)
  • Session ID: Ensures that the CSRF token is uniquely referenced to the user (lifetime: for the duration of the session)
  • Django-Language: Used to store the user's language if it differs from the default language German (lifetime: for the duration of the session)

3. Legal basis for data processing

For the storage of information in the end user's terminal equipment and/or access to information already stored in the end user's terminal equipment, the provisions of the Telecommunications-Digital Services Data Protection Act (TDDDG) are relevant. If the setting and reading of cookies is technically necessary, this is done to ensure the functionality of our website. In this case, the storage of and access to cookies on your terminal equipment is based on Section 25 (2) No. 2 TDDDG. This storage and access to the information in your terminal equipment serves to facilitate your use of our website and to enable us to offer you our services as requested by you. Some functions of our website also do not work without the use of these cookies and could therefore not be offered. The cookies are generally deleted after the end of the session (e.g. logging out or closing the browser) or after a specified period has expired. Information about deviating storage periods for cookies can be found in the following sections of this privacy policy.

If cookies are used that are not technically necessary, this is done on the basis of your express consent, which you can give via the cookie banner. The basis for the storage and access to information in this case is Section 25 (1) TDDDG in conjunction with Art. 6 (1) lit. a), Art. 7 GDPR. You can revoke your consent at any time with effect for the future or subsequently reissue it by configuring your cookie settings accordingly. Alternatively, you can prevent the storage of cookies by making the appropriate settings in your browser software. Please note that the browser settings you make always only apply to the browser you are using. If personal data is processed after the storage of and access to the information on your terminal equipment, the provisions of the GDPR are relevant. You can find information on this in the following sections of this privacy policy.

Newsletter

1. Description and scope of data processing

On our website, there is the option to subscribe to a free newsletter. When registering for the newsletter, the data from the input mask is transmitted to us.

To provide this service, we collect the following data from you:

  • Email address
  • Date and time of registration
  • Language selection

For the processing of the data, your consent is obtained as part of the registration process and reference is made to this privacy policy.

There is no transfer of data to third parties in connection with data processing for the dispatch of newsletters. The data is used exclusively for the dispatch of the newsletter.

2. Purpose of data processing

The collection of the user's email address serves to deliver the newsletter.

The collection of other personal data as part of the registration process serves to prevent misuse of the services or the email address used.

3. Legal basis for data processing

The legal basis for the processing of the data after registration for the newsletter by the user is Art. 6 (1) sentence 1 lit. a GDPR if the user has given consent.

4. Storage duration

The data will be deleted as soon as it is no longer required for the purpose of its collection. The user's email address will therefore be stored as long as the newsletter subscription is active.

The other personal data collected as part of the registration process is usually deleted after a period of seven days.

5. Exercising your rights

The subscription to the newsletter can be terminated by the affected user at any time. For this purpose, a corresponding link can be found in each newsletter.

This also makes it possible to revoke the consent to the storage of the personal data collected during the registration process.

Email contact

1. Description and scope of data processing

On our website, it is possible to contact us via the provided email address. In this case, the personal data of the user transmitted with the email will be stored.

The data is used exclusively for processing the conversation.

2. Purpose of data processing

In the case of contact by email, this also constitutes the necessary legitimate interest in the processing of the data.

3. Legal basis for data processing

The legal basis for the processing of data transmitted in the course of sending an email is Art. 6 (1) lit. f GDPR. Our legitimate interest lies in answering your request, which you send by email, in the best possible way.

If the email contact is aimed at concluding a contract, the additional legal basis for the processing is Art. 6 (1) lit. b GDPR.

4. Storage duration

The data will be deleted as soon as it is no longer required to achieve the purpose for which it was collected. For personal data sent by email, this is the case when the respective conversation with the user has ended. The conversation is ended when it can be inferred from the circumstances that the matter in question has been conclusively clarified.

The personal data additionally collected during the sending process will be deleted after a period of seven days at the latest.

5. Exercising your rights

If the user contacts us by email, he can object to the storage of his personal data at any time. In such a case, the conversation cannot be continued.

For a revocation of consent and an objection to the storage of your contact details, a short email to hello@heatbeat.de is sufficient

All personal data stored in the course of contacting us will be deleted in this case.

Application by email

1. Description and scope of data processing

You can send us your application by email. We collect your email address and the data you provide in the email.

After sending your application, you will receive a confirmation of receipt of your application documents by email from us.

2. Purpose of data processing

The processing of personal data from your application email serves us solely to process your application.

3. Legal basis for data processing

The legal basis for the processing of your data is the initiation of a contract at the request of the data subject, Art. 6 (1) sentence 1 lit. b alternative 1 GDPR and Section 26 (1) sentence 1 BDSG.

4. Storage duration

After completion of the application process, the data will be stored for up to 6 months. Your data will be deleted after 6 months at the latest. In the event of a legal obligation, the data will be stored within the framework of the applicable regulations.

Use of company profiles in career-oriented networks

1. Scope of data processing

The company profile is used for applications, information/PR and active sourcing. We have no information about the processing of your personal data by the companies jointly responsible for the company profile. Further information can be found in the privacy policy of:

  • LinkedIn
  • XING

On our site, we provide information and offer users the opportunity to communicate.

The company profile is used for applications, information/PR and active sourcing.

We have no information about the processing of your personal data by the companies jointly responsible for the company profile. Further information can be found in the privacy policy of:

LinkedIn: https://www.linkedin.com/legal/privacy-policy

XING: https://privacy.xing.com/de

If you perform an action on our company profile (e.g. comments, posts, likes, etc.), you may disclose personal data (e.g. your real name or photo of your user profile) as a result.

2. Legal basis for data processing

The legal basis for the processing of personal data for the purpose of communication with customers and interested parties is Art. 6 (1) sentence 1 lit. f GDPR. Our legitimate interest lies in answering your request in the best possible way and in being able to provide the requested information.

If the contact is aimed at concluding a contract, the additional legal basis for the processing is Art. 6 (1) lit. b GDPR.

3. Purpose of data processing

Our company profile serves to inform users about our services. At the same time, every user is free to publish personal data through activities.

4. Storage duration

The data generated by the company profile is not stored in our own systems.

5. Exercising your rights

You can object to the processing of your personal data that we collect in the course of your use of our company presence at any time and assert your rights as a data subject as set out in the "Your Rights" section of this privacy policy. To do so, please send us an informal email to the email address specified in this privacy policy.

Further information on exercising your rights can be found here:

LinkedIn: https://www.linkedin.com/legal/privacy-policy

XING: https://privacy.xing.com/en

Hosting

The website is hosted on our own servers. Third parties do not have access to server log files.

The servers automatically collect and store information in so-called server log files, which your browser automatically transmits when you visit the website. The stored information is:

  • Information about browser type and version used
  • The user's operating system
  • Date and time of access
  • Websites from which the user's system reaches our website
  • Websites accessed by the user's system via our website
  • Location, screen size

These data are not merged with other data sources. The collection of these data is based on Art. 6 (1) lit. f GDPR. Our legitimate interest in processing this data lies in displaying our website without errors and optimizing its functions.

The location of the website's server is geographically in Germany.

Registration

1. Description and scope of data processing

On our website, we offer users the opportunity to register by providing personal data. The data is entered into an input mask and transmitted to us and stored. The data is not passed on to third parties. The following data is collected as part of the registration process:

  • Email address
  • Last name
  • First name
  • Address
  • Date and time of registration
  • Role (building owner, interested party, part of a community of owners)

As part of the registration process, the user's consent to the processing of this data is obtained.

2. Purpose of data processing

Registration of the user is necessary for the performance of a contract with the user or for the implementation of pre-contractual measures.

3. Legal basis for data processing

If the registration serves the fulfillment of a contract to which the user is a party or the implementation of pre-contractual measures, the additional legal basis for the processing of the data is Art. 6 (1) sentence 1 lit. b GDPR.

The legal basis for the processing of the data is Art. 6 (1) sentence 1 lit. a GDPR if the user has given his consent.

4. Storage duration

The data will be deleted as soon as it is no longer required to achieve the purpose for which it was collected.

This is the case for the data collected during the registration process for the fulfillment of a contract or for the implementation of pre-contractual measures when the data is no longer required for the implementation of the contract. Even after the conclusion of the contract, there may be a need to store personal data of the contractual partner in order to comply with contractual or legal obligations.

5. Exercising your rights

As a user, you have the option of canceling the registration at any time. You can have the data stored about you changed at any time.

In detail, you can request deletion in the following way:

For the deletion or modification of your data, a short email to hello@heatbeat.de is sufficient

If the data is required for the fulfillment of a contract or for the implementation of pre-contractual measures, premature deletion of the data is only possible insofar as contractual or legal obligations do not prevent deletion.

This privacy policy was created with the support of DataGuard.