Privacy Policy

1. Controller

The controller responsible for data processing on this website is: Dipl.-Ing. Jonas Maasho (BESS-Market), Winkelriedstraße 6, 76185 Karlsruhe, Germany, e-mail: info@bess-market.com. A limited liability company (GmbH) for BESS-Market is being formed; until it is registered, Jonas Maasho is the controller.

No data protection officer has been appointed, as the legal requirements for this are not met. Please send privacy questions to info@bess-market.com.

2. Overview

BESS-Market is an information and tools platform for businesses (B2B). We process personal data only where necessary to operate the website, provide the features you use or answer your requests, or where you have consented. We do not sell data and do not show advertising. For audience measurement we use Google Analytics — only if you have consented (section 6).

3. Hosting and server logs

The website is hosted by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. When a page is requested, the server processes technically necessary data: IP address, date and time, requested address, amount of data transferred, referrer and browser/operating system details. This data is stored in server logs for a limited period to ensure operation and fend off attacks, and is then deleted.

Legal basis: our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR). A data processing agreement (Art. 28 GDPR) is in place with IONOS.

4. Fonts

The fonts (Bricolage Grotesque, JetBrains Mono) are hosted on our own server. No connection to Google or other font providers is made when a page is loaded.

5. Database and application services (Supabase)

For market data, map, calculator features, accounts, forms and notifications we use Supabase (Supabase Inc., registered outside the EU). The database and application services run in a data centre in Frankfurt am Main (region eu-central-1). When data is retrieved, Supabase technically processes your IP address. A data processing agreement is in place with Supabase; the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) apply to any access from third countries.

Legal basis: provision of the features you request (Art. 6(1)(b) GDPR where you use an account) or our legitimate interest in a functioning service (Art. 6(1)(f) GDPR).

6. Consent, cookies and browser storage

On your first visit a dialog asks whether you allow comfort features, anonymous usage statistics and Google Analytics. You can choose “Accept all”, “Decline” or select individually. You can change or withdraw your choice at any time via “Cookie settings” in the footer; this does not affect the lawfulness of processing carried out before withdrawal.

We do not set cookies for advertising. Cookies for audience measurement are set only by Google Analytics, and only with your consent. Otherwise we use your browser’s local storage (localStorage/sessionStorage) as follows:

• Necessary (no consent required, § 25(2) no. 2 TDDDG): your sign-in when you log in (session key, until you sign out), your choice in the consent dialog, a short intermediate step during registration (until the tab is closed).
• Comfort (only with consent, § 25(1) TDDDG, Art. 6(1)(a) GDPR): drafts in the configurator, grid navigator, readiness check, RFQ builder and project valuation; remembered segment and saved projects; market data cache and the time of your last visit to Market Pulse. This data stays in your browser and is deleted when you withdraw consent.
• Anonymous statistics (only with consent, Art. 6(1)(a) GDPR): we count which features are used (e.g. “map opened”, “site analysed”, key figures of a calculation such as power, capacity, federal state and result). Nothing is stored on your device for this; a random identifier exists only while the page is open. We store neither IP address nor e-mail; the entries cannot be attributed to a person.
• Google Analytics (only with consent, § 25(1) TDDDG, Art. 6(1)(a) GDPR): The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The Google script is loaded only after you consent. Google Analytics sets cookies (_ga, _ga_<id>, lifetime up to 2 years) and records usage information (pages viewed, time on page, traffic source, device, browser, approximate location derived from the IP address). Google Analytics 4 does not store IP addresses. Google signals and advertising features are disabled. Event data is deleted after 2 months. We have concluded a data processing agreement with Google. Data may be transferred to Google LLC in the USA; Google LLC is certified under the EU-US Data Privacy Framework (adequacy decision, Art. 45 GDPR). You can withdraw consent at any time via “Cookie settings” in the footer; the Google Analytics cookies are then deleted. More: https://policies.google.com/privacy

7. Map (OpenFreeMap) and open data sources

The base map of the “Grid & Infrastructure Map” is loaded from OpenFreeMap (tiles.openfreemap.org). Your IP address is technically transmitted to the map server so that map tiles can be delivered. Legal basis: our legitimate interest in displaying the map you requested (Art. 6(1)(f) GDPR). The map is only loaded on pages that contain a map.

Grid, plant and market data come from open sources (including OpenStreetMap, the German market master data register, RTE/ODRÉ, Enedis, Cerema). This data is stored on our servers; your browser does not connect to these providers.

8. Contact and request forms

When you use a form (e.g. contact, start a project, investment mandate, supplier listing, brokerage request from the ROI calculator), we store your details (including e-mail, company, role, message and project details) in our database and notify our mailbox info@bess-market.com via our e-mail provider IONOS. To prevent abuse we additionally store a shortened, irreversible check value (hash) of your IP address, which is deleted after 30 days.

Legal basis: handling your request or pre-contractual measures (Art. 6(1)(b) GDPR); for brokerage requests your consent (Art. 6(1)(a) GDPR). We present project key data without contact details to providers only if you have separately agreed; we pass on your contact details only after your consent in the individual case. We delete requests once they have been dealt with and no statutory retention obligations apply, at the latest after three years without further contact.

9. Account, member profile and network

For an account we store your e-mail address and the details you provide yourself (including name, company, position, category, skills, “I am looking for / I offer”, saved sites, projects and calculations, risk registers and cockpit settings such as hurdle rate, site alerts). Sign-in and confirmation e-mails are sent by Supabase. Your profile is private by default. Only if you choose “Visible to members” can signed-in members see it — without e-mail address and phone number; these become visible only when you accept a contact request. BESS-Market is informed by e-mail about new profiles and contact requests (without message text) in order to broker where appropriate.

Deal board: listings appear without company name, contact details or exact location; BESS-Market sees them in full for moderation. Anyone expressing interest accepts a confidentiality agreement — we store the version and time as evidence. Name, company, email, phone and website are shown to the other side only once the lister agrees (Art. 6(1)(b) GDPR). Listings run for 90 days; you can close or delete them at any time.

We send site alerts to you by e-mail via our e-mail provider IONOS. Legal basis: the terms of use (Art. 6(1)(b) GDPR). You can change your visibility at any time, delete alerts and request deletion of your account by e-mail to info@bess-market.com; we will then delete the account, profile and stored content.

10. Recipients and third countries

Recipients of your data are only our processors IONOS (hosting, e-mail) and Supabase (database, sign-in) and, when the map is loaded, OpenFreeMap and, only with your consent, Google (Google Analytics, see section 6). Data is passed on to providers or partners only with your explicit consent or where we are legally obliged to do so. Data is generally processed in the EU; regarding Supabase see section 5, regarding Google Analytics section 6.

11. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to withdraw consent with effect for the future (Art. 7(3)). Please write to info@bess-market.com.

Right to object: where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation (Art. 21 GDPR).

You may lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), e.g. the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany.

12. Obligation to provide data, no automated decisions

You are not obliged to provide us with data. Without the details marked as mandatory in forms, however, we cannot process your request. There is no automated decision-making including profiling within the meaning of Art. 22 GDPR; grades in the site ranking and calculator results relate to sites and projects, not to persons.

13. Security and changes

Data is transmitted encrypted (HTTPS). Access to data in the database is restricted to the respective authorised persons by access rules (row level security). We adapt this policy when our website or the legal situation changes; the version published here applies.