Collection and processing of personal data
Data Protection at ista
The protection of your personal data is very important to ista.
ista complies with the legal data protection regulations and does everything to keep your and your customer’s/tenant‘s data confidential. All personal data is collected, processed and used in accordance with the provisions of the General Data Protection Regulation (GDPR) and only for the purposes of contract processing, fulfilment of legal obligations or for safeguarding our own legitimate business interests with regard to the advice and support of the customers as well as the demand-oriented product design.
All service providers of ista dealing with the processing of personal data also comply with the provisions of the GDPR in accordance with Art. 28 GDPR. Compliance is monitored by our data protection officer.
Collection and processing of personal data
Each time a user accesses the ista website and each time a file is accessed, data about that activity is stored in a log file. This data is not related to a person; so ista cannot trace back which user has retrieved what data.
In detail, the following data record is saved for each call:
• Name of the file
• Date and time of access
• Amount of data transferred
• Message whether the call was successful
• Anonymous IP-Address
• If necessary, operating system and browser software on your computer
• As well as the website from which you visited the ista website
Personal user profiles cannot be created.
The above-mentioned data is evaluated for statistical purposes only.
Personal data will only be collected if you give it to ista on your own - for example, when registering for a survey or conducting a contract. A transmission of your data to third parties does not take place, unless ista is legally obliged to do so. Insofar as external service providers come into contact with your personal data, ista has ensured that they comply with the provisions of data protection laws through legal, technical and organizational measures as well as regular checks.
Cookies:
ista uses so-called cookies on the ista website to recognize multiple use of the offer by the same user/internet connection owner. Cookies are small text files that your internet browser stores on your computer. They serve to optimize ista's internet presence and offers. The cookies are usually so-called "session cookies", which are deleted after the end of your visit.
In some cases, however, these cookies provide information in order to automatically recognize you. This recognition is based on the IP address stored in the cookies. The information obtained in this way serves to optimize ista's offers and to make it easier for you to access the ista website.
You may refuse the use of cookies by selecting the appropriate settings in your browser; however, ista points out that in this case you may not be able to use the full functionality of the ista website.
Google Tag Manager
This is a tag management system. Via Google Tag Manager, tags can be integrated centrally via a user interface. Tags are small sections of code that can track activities. Script codes of other tools are integrated via the Google Tag Manager. The Tag Manager allows to control when a particular tag is triggered.
Processing Company
Google Ireland Limited
Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland
Data Protection Officer of Processing Company
Below you can find the email address of the data protection officer of the processing company.
https://support.google.com/policies/contact/general_privacy_form
Data Purposes
This list represents the purposes of the data collection and processing.
- Tag Management
Technologies Used
This list represents all technologies this service uses to collect data. Typical technologies are Cookies and Pixels that are placed in the browser.
- Website tags
Data Collected
This list represents all (personal) data that is collected by or through the use of this service.
- Aggregated data about tag firing
Legal Basis
In the following the required legal basis for the processing of data is listed.
- Art. 6 para. 1 s. 1 lit. a GDPR
Location of Processing
This is the primary location where the collected data is being processed. If the data is also processed in other countries, you are informed separately.
- European Union
Retention Period
The retention period is the time span the collected data is saved for the processing purposes. The data needs to be deleted as soon as it is no longer needed for the stated processing purposes.
- The data will be deleted as soon as they are no longer needed for the processing purposes.
Transfer to Third Countries
This service may forward the collected data to a different country. Please note that this service might transfer the data to a country without the required data protection standards. Below you can find a list of countries to which the data is being transferred. For more information regarding safeguards please refer to the provider's privacy policy or contact the provider directly.
- Singapore
- Taiwan
- Chile
- United States of America
Data Recipients
In the following the recipients of the data collected are listed.
- Alphabet Inc., Google LLC, Google Ireland Limited
Click here to read the privacy policy of the data processor
https://business.safety.google/privacy/?hl=en
Click here to read the cookie policy of the data processor
https://policies.google.com/technologies/cookies?hl=en
User Centrics
Use of the Usercentrics Consent Management Platform
We use the Usercentrics Consent Management Platform to comply with the statutory provision pursuant to Article 7, para. 1 GDPR. The operator is Usercentrics GmbH, Rosental 4, 80331 Munich. The Usercentrics Consent Management Platform collects Logfile data, user agent (device, browser type, browser language, browser version, resolution) and consent data (consent yes/no, timestamp, data extent, data attributes, ControllerID, ProcessorID, consentID) by means of a Javascript. This JavaScript permits Usercentrics GmbH to inform the user about specific tags and web technologies on our website and to obtain, manage and document the user's consent. The legal basis for data processing is Article 6, para. 1, letter c) GDPR since we are legally obliged to prove consent (pursuant to Article 7, para 1 GDPR). Our aim is to know and implement our users' preferences as well as to document these legally in a secure manner. The data are deleted as soon as they are no longer required for our documentation and there are no legal obligations to retain records.
You can permanently disable the execution of JavaScript at any time by selecting the relevant settings in your browser, which would also prevent Usercentrics from executing JavaScript.
For further details on Usercentrics data protection policy go to: https://usercentrics.com/privacy-policy/
You can select your privacy settings here:
Web Analytics
Service description
This is a B2B Software-as-a-Service platform. With this service, the user can collect and analyze customer feedback.
Processing company
zenloop GmbH
Pappelallee 78-79, 10437 Berlin, Germany
Data protection officer of the processing company
Please find below the e-mail address of the data protection officer of the processing company.
dpo@zenloop.com
Purposes of data processing
This list shows the purposes for which we collect and process data.
- Surveys
- Analysis
Technologies used
This list shows all the technologies used by this service to collect data. Typical technologies are cookies and pixels that are placed in the browser.
- Cookies
Collected data
This list contains all (personal) data collected during or via use of the service.
- Device information
- Browser information
- Referrer URL
- e-mail address
- Usage data
- IP address
- Survey responses
Legal basis
Below you will find the legal basis required for data processing.
- Art. 6 al. 1 lit. a RGPD
Place of processing
This is the main location where the data collected is processed. If the data is also processed in other countries, you will be informed separately.
- European Union
Retention period
The retention period is the period during which the data collected is stored for processing. Data must be deleted as soon as it is no longer required for the specified processing purposes.
- Data will be deleted as soon as it is no longer required for processing purposes.
Transfer to third countries
This service may transfer the data collected to another country. Please note that this service may transfer data to a country that does not have the required data protection standards. Below is a list of countries to which data may be transferred. To find out more about guarantees, please consult the supplier's privacy policy or contact them directly.
- United States of America
Recipients of data
The following lists the recipients of the data collected.
- Salesforce.com Inc.
- zenloop GmbH
- Amazon Web Services, Inc.
- Elasticsearch B.V.
Click here to read the data processor's privacy policy
Processing company
Qualtrics LLC
333 W. River Park Drive
Provo, UT 84604, United States of America
Data processing purposes
This list shows the purposes of data collection and processing.
- Surveys
- Analysis
Technologies used
- Cookies and similar technologies
Data collected
This list contains all (personal) data collected during or through the use of the service.
- IP address
- Device information
- Browser information
- Referrer URL
- Responses to surveys
- Email address
- Usage data
Legal basis
The following is the required legal basis for the processing of data
- Art. 6 para. 1 s. 1 lit. a GDPR
Place of processing
European Union and United States of America
Retention period
The retention period is the period of time during which the collected data is stored for processing. The data must be deleted as soon as it is no longer required for the specified processing purposes.
The data is deleted as soon as it is no longer required for processing.
Data recipient
- Qualtrics LLC
- Salesforce.com Inc.
- Amazon Web Services, Inc.
- Elasticsearch B.V.
Data protection officer of the processing company
Below you will find the e-mail address of the data protection officer of the processing company.
privacy@qualtrics.com
We use the analysis software Piwik PRO Analytics Suite (piwikpro.de) to analyse and optimise this website. The data collected with this software can be used to create user profiles under a pseudonym.
Data processing purposes
This list contains the purposes for which data are collected and processed. Consent is valid only for the purposes specified. The data collected cannot be used or stored for purposes other than those listed below.
- Analysis
- Optimisation
Technologies used
- Cookies
Data collected
This list contains all (personal) data that are collected during or through the use of the service.
- Anonymised shortened IP address
- Usage data
- User ID
- Date and time of the visit
- Referrer URL
- Websites visited
- Screen resolution
- Geographic location
- User agent
- Visitor ID
Legal basis
The required legal basis for the processing of data is listed in the following:
- Art. 6, para. 1 s. 1 lit. a GDPR
Location of processing
- European Union
Retention period
The retention period is the period of time during which the data collected are stored for processing. The data must be deleted as soon as they are no longer needed for the stated processing purposes. The data are stored for up to 25 months.
Data recipient
- Piwik PRO Sp. z o.o.
- Piwik PRO GmbH
Data protection officer of the processing company
Below you will find the email address of the data protection officer of the processing company.
Consent to the collection and storage of data can be withdrawn at any time with immediate future effect.
Click here to read the privacy policy of the data processor https://piwik.pro/privacy-policy/
Click here to withdraw consent on all domains of the data processing company https://piwik.pro/opt-out/
This is a web analytics service. With this, the user can measure the advertising return on investment "ROI" as well as track user behavior with flash, video, websites and applications.
Processing Company
Google Ireland Limited
Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland
Data Purposes
This list represents the purposes of the data collection and processing.
- Marketing
- Analytics
Technologies Used
- Cookies
- Pixel
- JavaScript
- Device fingerprinting
Data Collected
This list represents all (personal) data that is collected by or through the use of this service.
- Click path
- Date and time of visit
- Device information
- Location information
- IP address
- Pages visited
- Referrer URL
- Browser information
- Hostname
- Browser language
- Browser type
- Screen resolution
- Device operating system
- Interaction data
- User behaviour
- Visited URL
Legal Basis
In the following the required legal basis for the processing of data is listed.
- Art. 6 para. 1 s. 1 lit. a GDPR
Location of Processing
European Union
Retention Period
The retention period is the time span the collected data is saved for the processing purposes. The data needs to be deleted as soon as it is no longer needed for the stated processing purposes.
The Retention Period depends on the type of the saved data. Each client can choose how long Google Analytics retains data before automatically deleting it.
Data Recipients
- Google Ireland Limited, Alphabet Inc., Google LLC
Data Protection Officer of Processing Company
Below you can find the email address of the data protection officer of the processing company.
https://support.google.com/policies/contact/general_privacy_form
Transfer to Third Countries
This service may forward the collected data to a different country. Please note that this service might transfer the data to a country without the required data protection standards. If the data is transferred to the USA, there is a risk that your data can be processed by US authorities, for control and surveillance measures, possibly without legal remedies. Below you can find a list of countries to which the data is being transferred. For more information regarding safeguards please refer to the website provider’s privacy policy or contact the website provider directly.
United States of America,Singapore,Chile,Taiwan
Click here to read the privacy policy of the data processor https://policies.google.com/privacy?hl=en
Click here to opt out from this processor across all domains https://tools.google.com/dlpage/gaoptout?hl=de
Click here to read the cookie policy of the data processor https://policies.google.com/technologies/cookies?hl=en
Storage Information
Below you can see the longest potential duration for storage on a device, as set when using the cookie method of storage and if there are any other methods used.
- Maximum age of cookie storage: 2 years
1. Introduction
1.1 This privacy notice tells you (the data subject) how we, ista Energy Solutions Ltd (the data controller), will collect and use your personal data for the purposes of recruitment.
1.2 All personal data collected from you (either directly or indirectly) will be processed in accordance with this privacy notice and in line with the requirements of the UK data protection legislation, including the retained EU law version of the General Data Protection Regulation ((EU) 2016/679) (UK GDPR); the Data Protection Act 2018 (DPA 2018) (and regulations made thereunder), the Privacy and Electronic Communications Regulations 2003 (SI 2003/2426), the Data Use and Access Act 2025 (DUAA 2025) and any other legislation we may be subject to from time to time.
2. Collection and Use
2.1 We use the Workday cloud-based recruitment system to manage recruitment activities and job applications. Through the Workday platform, you can apply for current vacancies at ista Energy Solutions Ltd in the UK and other ista group companies located around the world. If you apply for a position with another ista group company, the processing of your personal data for that application will be governed by that company's privacy notice. Any application submitted to another ista group company will be managed separately and will not affect any application you have made to ista Energy Solutions Ltd.
2.2 The personal data we would like to collect and process from you may include any of the following:
- Name
- Contact details
- Location of residence
- Nationality immigration status and/or right-to-work information
- Employment history
- Professional training / qualifications
- Salary information
- Education history
- Fields of interest
- Access and account data for your applicant account (“Candidate Home”) in the Workday applicant management system (in particular username, email address, password in encrypted form, status and history of your applications, and your communications with us via the system)
- Technical log data generated when you use the application portal (in particular IP address and time of access)
2.3 This data will either be supplied directly by you or indirectly through a recruitment agency for the purpose of applying for employment with us.
2.4 We will not contact you unless in direct relation to the recruitment of the role you applied for, or another role we feel you may be suitable for. If your information was provided via a recruitment agent contact will take place through that recruitment agent, unless otherwise agreed.
2.5 The personal data we collect will be used for the screening, interviewing and selection of candidates. In any event, we are committed to ensuring that the information we collect and use is appropriate for this purpose, and does not constitute an invasion of your privacy.
2.6 The data collected from you under this activity will only be used for the purpose of recruitment and will not be used for any other activity or for marketing.
2.7 Your data will be retained for no longer than is necessary, in line with the specified organisational retention period (see section 5. Retention Period). We retain your data for the purpose of future recruitment if a suitable position becomes available. Your data is also retained to monitor future applications.
2.8 Our lawful basis for processing of the personal data collected is that it is necessary for the recruitment of new employees (legitimate interest) and to take steps to enter into an employment contract with you (if your application is successful).
If your application is unsuccessful, we may include your data in our talent pool for the purpose of contacting you in the future should a suitable vacancy become available. Our lawful basis for this processing is your consent (see section 3. Consent below).
2.9 No special categories of data as defined under the UK GDPR will be routinely processed as part of our recruitment activity. If you choose to share special category data with us during the recruitment process (for example health data to allow for extra accommodations during the interview process), this will always be handled in accordance with the UK GDPR and kept in the strictest confidence for the minimum period required.
2.10 The information you provide will be subject to rigorous technical and organisational measures and procedures to minimise the risk of unauthorised access or disclosure.
2.11 If your application is successful and you accept an offer of employment with us, you should refer to document GD-PN-4 – Privacy Notice (Employees) for details of further processing of your data (this document will be provided to you in your induction pack, or sooner if requested by you).
3. Consent
3.1 Processing of data provided to us for the purposes of recruitment is done so under the legal basis set out in section 2.8 above. Information provided to us (directly or indirectly through a recruitment agent) will be processed for the specific purposes identified in this privacy notice.
3.2 Your consent is not required for the processing of your data for the purposes of recruitment with us. However, you are able to withdraw from the recruitment process at any time by advising us (see section 6. Your Rights as a Data Subject). If you withdraw from the recruitment process, your data will be retained as detailed in section 5. Retention Period.
3.3 If you’re application is unsuccessful, and you provide your consent. We will include your data in our Talent Pool. You may withdraw your consent at any time with effect for the future. Should you wish to do so, please contact us using the contact details on appendix B. If you do not consent to the inclusion of your applicant data in our talent pool, you will not suffer any disadvantages in future application processes.
3.4 You can create a personal applicant account ("Candidate Home") within the Workday platform. Through this account, you can view and update your applications, submit additional information, withdraw applications, manage your account settings and delete your account if required. Should you delete your account, your personal data will still be retained by us for the periods set out in section 5. Retention Period.
4. Disclosure
4.1 Information collected from you as part of the recruitment process is done so through the Workday platform, which is provided and administered by ista SE, Luxemburger Straße 1, 45131 Essen, Germany for all ista group companies. Germany is recognised as providing an adequate level of data protection under UK data protection law. Any sharing of personal data will be carried out in accordance with applicable data protection legislation. Workday uses a number of approved sub-processors, including Workday, Inc., 6110 Stoneridge Mall Road, Pleasanton, California 94588, USA. An up-to-date list of Workday's sub-processors is available on Workday's website.
4.2 If you have applied though a recruitment agent and we receive an application on your behalf from another agent or directly from you (for the same or an alternative role), we may be required to inform the original recruitment agent in line with our contractual agreements with them.
4.3 If your application is successful, we may contact your previous employer(s) or educational establishment(s) (using contact details provided by yourself) for the purpose of obtaining a reference(s).
4.4 As part of the recruitment process, applicants for certain roles may be required to complete a Clifton Strengths test. This test is provided by Gallup. Your data will be provided to them by us and by yourself in order to facilitate this test.
4.5 We will not pass on your personal data to any other third party as part of the recruitment process.
4.6 If your data is passed to a third party, they will be required to process and store your data only for the purpose specified by us and only in a way that is compatible with the UK GDPR and any other legislation affecting data that we may be subject to from time to time.
5. Retention Period
5.1 We will retain your personal data for only as long necessary for the purposes of job application and recruitment.
5.2 If your application is not successful, data held on you will be retained for 1 year + 1 from the date the role has been filled (with data being deleted during the plus 1 year).
5.3 Data for successful applicants is not governed by the retention periods listed in this clause. You should refer to the document GD-PN-4 – Privacy Notice (Employees) for the retention period of your data (this document will be provided to you in your induction pack, or sooner if requested by you).
5.4 At the end of the retention period all data will be securely destroyed or fully anonymised.
6. Your Rights as a Data Subject
6.1 At any point while we are in possession of or processing your personal data, you, the data subject, have the following rights:
6.1.1 Right to be informed – you have the right to be informed of what data we will collect from you, why we collect that data and the way in which it is processed. This right is fulfilled by this Privacy Notice.
6.1.2 Right of access – you have the right to request a copy of the information that we hold about you. This should be done through a Subject Access Request (SAR).
6.1.3 Right of rectification – you have a right to correct any data that we hold about you that is inaccurate or incomplete.
6.1.4 Right to be forgotten – we are required to keep a record of your name for the retention period set out in section 5.2, above. If you do not wish us to retain any other data held on you (such as CVs and interview notes) before the end of the retention period, you can request that it is erased at any time. Erasure requests before the interview process has been completed will result in your application being deemed unsuccessful.
6.1.5 Right to restriction of processing – if you do not wish to continue with the recruitment processes but would like us to retain your data (in line with our retention policy) for inclusion in our talent pool, you have the right to request we restrict the processing of your data.
6.1.6 Right of portability – Data obtained and processed in this activity is solely for the recruitment of new employees. As such we are unable transmit this data to other organisations.
6.1.7 Right to object – Your consent is not the legal basis for the processing of your personal data for the purpose of recruitment with us. Therefore, you are unable to object to the processing of your data. This does not affect any other rights you hold as a data subject. You are able to object to your data being included in our talent pool should your application be unsuccessful.
6.1.8 Right to object to automated processing, including profiling – No automated processing is carried out as part of the recruitment process. Profiling may be carried out on applicants for certain roles in the form of a Clifton Strengths test. You will be advised in advance of completing the test if this applies to the role you have applied for. A copy of the results of this test will be supplied to you on completion. You have the right to ask the hiring manager to review the results of this test.
6.2 If you wish to make a request under any of the rights listed in section 6.1, above, you may do so either verbally or in writing through your point of contact or by contacting our Data Protection Coordinator directly (see Appendix B – Data Protection Coordinator Details).
6.3 We will confirm receipt of any rights request as soon as practically possible.
6.4 It may be necessary for your identity to be verified before a rights request is completed to ensure the confidentiality of your data. We may request at least one of the following documents from you to assist in identification;
Passport
Driving licence
Birth certificate
Utility bill (from last 3 months)
Bank statement (from last 3 months)
6.5 A third party may make a rights request on your behalf. In this case we will require either written permission from you (including additional ID as listed in section 6.4, above) naming the individual who you have authorised, or a valid power of attorney. The third party may also be required to supply ID as listed in section 6.4 so their identity can be verified.
6.6 We will complete any rights request within one month from verification of your identity. If a request is complex and more time is required, this may be extended by a further two months. You will be informed of a need for an extension as soon as practically possible and within the initial one-month time frame.
6.7 In the event that we refuse your request under any of the rights, we will provide you with a reason why. You have the right to complain as outlined in section 7. Complaints.
6.8 Data relating to rights requests (the initial request, any documents required for identification, the response and any documents relating to the response) will be retained for 3 years + 1 (with data to be deleted in the + 1 year) from the date of last action on the request. This does not affect the retention periods for the original data as set out in section 5. Retention Period in this document.
7. Complaints
7.1 In the event you wish to make a complaint about how your personal data is processed by us, you have the right to lodge a complaint with our Data Protection Coordinator (see Appendix B. Data Protection Coordinator Details) in the first instance.
We will:
- Acknowledge your complaint within 30 days of receipt.
- Investigate and respond without undue delay, keeping you informed throughout.
- Aim to resolve your complaint within 3 months, unless exceptional circumstances apply.
7.2 If you remain dissatisfied with our response or if your complaint is not resolved promptly, you may escalate your complaint to the Information Commissioner’s Office (ICO) (see Appendix C. Supervisory Authority Details).
Appendix A . Definitions
Personal Data Any data that relates to an identified or identifiable individual.
Processing Any operation or set of operations performed on personal data or set of personal data, including collecting, storing and any operation.
Data Subject A natural living person whose personal data is processed.
Data Controller Person or organisation that determines the purpose and the means of the processing of personal data.
Joint Controller Person or organisation that determines the purpose and the means of processing of personal data, together with another organisation.
Data Processor Person or organisation that processes data on behalf of, and as instructed by, the data controller.
Supervisory Authority Organisation responsible for the monitoring and application of data protection legislation.
Google Ads
This is an advertising service.
Processing Company
Google Ireland Limited
Google Building Gordon House, 4 Barrow Street, Dublin D04 E5W5, Ireland
Data Purposes
This list represents the purposes of the data collection and processing.
- Advertisement
- Analytics
- Providing Service
- Statistics
Technologies Used
- Cookies
Data Collected
This list represents all (personal) data that is collected by or through the use of this service.
- Ads viewed
- Cookie ID
- Date and time of visit
- Device information
- Geographic location
- IP address
- Search terms
- Ads shown
- Client ID
- Impressions
- Online identifiers
- Browser information
Legal Basis
In the following the required legal basis for the processing of data is listed.
- Art. 6 para. 1 s. 1 lit. a GDPR
Location of Processing
European Union
Retention Period
The retention period is the time span the collected data is saved for the processing purposes. The data needs to be deleted as soon as it is no longer needed for the stated processing purposes.
The data will be deleted as soon as they are no longer needed for the processing purposes. Log data is anonymized after 9 months and cookie information is anonymized after 18 months.
Data Recipients
- Alphabet Inc., Google LLC, Google Ireland Limited
Data Protection Officer of Processing Company
Below you can find the email address of the data protection officer of the processing company.
https://support.google.com/policies/troubleshooter/7575787?hl=en
Transfer to Third Countries
This service may forward the collected data to a different country. Please note that this service might transfer the data to a country without the required data protection standards. If the data is transferred to the USA, there is a risk that your data can be processed by US authorities, for control and surveillance measures, possibly without legal remedies. Below you can find a list of countries to which the data is being transferred. For more information regarding safeguards please refer to the website provider’s privacy policy or contact the website provider directly.
Chile,Singapore,United States of America,Taiwan
Click here to read the privacy policy of the data processor https://policies.google.com/privacy?hl=en
Click here to opt out from this processor across all domains https://safety.google/privacy/privacy-controls/
Click here to read the cookie policy of the data processor https://policies.google.com/technologies/cookies?hl=en
Storage Information
Below you can see the longest potential duration for storage on a device, as set when using the cookie method of storage and if there are any other methods used.
- Maximum age of cookie storage: 1 year
Remarketing activities and cookies
This website uses the remarketing or "similar target group" function of Google Inc. (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; „Google“).
This feature allows you to view interest-based ads on Google Display Network web pages. For this purpose, a cookie is stored in your browser when you visit a website. This serves to recognize you as a visitor to the website and to determine visits and usage data.
According to Google's own information, server logs are stored in which parts of the IP address and cookie information are partially deleted after 9 to 18 months. For more information, please visit http://www.google.com/policies/technologies/ads/.
An example of a server log is provided by Google at the following link:
https://policies.google.com/privacy/key-terms?hl=gb#toc-terms-server-logs
There are several ways in which cookies can be deactivated in the browser to exclude your own browser from remarketing.
Google provides the option of downloading a browser plug-in that permanently deactivates these cookies under the following link: https://www.google.com/settings/ads/plugin
You can also make settings in your browser to deactivate the installation of cookies.
If you wish to object to tracking, you can do so by adjusting your browser settings regarding cookie installations. You can find information on this under the following links:
Firefox: https://support.mozilla.org/en-US/kb/enable-and-disable-cookies-website-preferences
Internet Explorer: https://support.microsoft.com/en-gb/help/17442/windows-internet-explorer-delete-manage-cookies
Chrome: https://support.google.com/chrome/answer/95647?co=GENIE.Platform%3DDesktop&hl=en-GB
Safari: https://support.apple.com/en-gb/HT201265
Third-party providers may also disable browser cookies. The Network Advertising Initiative (NAI) offers the possibility to implement an opt-out for your own browser. Information can be found on the following page: optout.networkadvertising.org.
This website uses the conversion tracking of "Google-Adwords", a Google service.
When you visit Google pages, Google stores cookies. You can deactivate or leave this storage activated. If the cookie is still activated and you visit certain websites on the website, Google and ista can recognize that you have clicked on an ad placed by ista and have thus been forwarded to an ista page.
The information collected is used by Google to generate statistics for Adwords customers. These statistics include information about the number of users who clicked on ads and were redirected to pages that were tagged with a conversion tracking tag.
You can find Google's privacy policy here: https://policies.google.com/privacy
Rights of data subjects
In accordance with the GDPR, ista takes appropriate measures to provide the data subject with all information and communications relating to processing in a precise, transparent, comprehensible and easily accessible form in clear and simple language. The information shall be transmitted in writing or in any other form, including, where appropriate, electronically.
Since ista processes personal data automatically, ista informs you of the following information in accordance with Art. 13 GDPR:
Anna Cole, ista Energy Solutions Limited, The Officers‘ Mess, Royston Road, Duxford, CB22 4QH, is the person responsible for ista.
The contact details of ista's data protection officer are:
ista Energy Solutions Limited, Data Protection Officer, The Officers‘ Mess, Royston Road, Duxford, CB22 4QH, e-mail: dpo@ista-uk.com
The purpose for which the personal data is to be processed and the legal basis for the processing are as follows: Optimization of customer satisfaction and the website, Art. 6 paragraph 1 f GDPR.
The legitimate interest in this is to be seen in particular in the pseudonymized processing for the optimisation of the website.
Data deletion and duration of storage
The personal data of the data subjects will be deleted or blocked as soon as the purpose of storage ceases to apply. Furthermore, data may be stored if this has been provided for the European or national legislator in EU regulations, laws or other provisions to which the person responsible is subject. The data will also be blocked or deleted if a storage period prescribed by the aforementioned standards expires, unless there is a need for further storage of the data for the conclusion or fulfilment of a contract.
Newsletter
ista offers you the option to subscribe to a newsletter on the ista webpage. From this newsletter you will receive information on ista topics and offers at regular intervals. To receive this newsletter, you need a valid e-mail address. Your entered e-mail address will be checked by ista for accuracy and completeness. Your login data as well as your official IP address, date and time will be stored. This serves as security to prevent your e-mail address from being misused by unauthorized third parties. No other data will be stored by ista. The data collected will only be used for the newsletter dispatch. ista undertakes not to transmit the data collected to other third parties. You have the option of cancelling the newsletter at any time without giving reasons and requesting information from the ista site. The details are marked in each newsletter.
Rights of data subjects
In accordance with the GDPR, ista takes appropriate measures to provide the data subject with all information and communications relating to data processing in a precise, transparent, understandable and easily accessible form in clear and simple language. The information shall be transmitted in writing or in any other form, including, where appropriate, electronically.
Social Media / Social Bookmarks
Social bookmarks from LinkedIn, Twitter and YouTube are integrated on the ista website. Social Bookmarks are internet bookmarks that allow users of such services to collect links and news messages. These are only included on the website as a link to the corresponding services. After clicking on the integrated graphic you will be forwarded to the page of the respective provider, i.e. only then will user information be transferred to the respective provider. For information on the handling of your personal data when using these websites, please refer to the respective data protection regulations of the providers.
Important Notice: This data protection information applies exclusively to ista's internet service offering. The ista website contains links to other websites. Please note that ista is not responsible for the data protection or the content of these other internet services. We recommend all internet users to inform themselves about the respective data protection notices of other internet services when leaving ista's website.
Changes to this data protection information
ista reserves the right to amend this disclosures at any time in compliance with the applicable data protection regulations; current status is May 2018.
If you have any questions regarding the processing or security of your personal data, you can contact ista’s data protection officer directly.
Web Analytics
Service description
This is a B2B Software-as-a-Service platform. With this service, the user can collect and analyze customer feedback.
Processing company
zenloop GmbH
Pappelallee 78-79, 10437 Berlin, Germany
Data protection officer of the processing company
Please find below the e-mail address of the data protection officer of the processing company.
dpo@zenloop.com
Purposes of data processing
This list shows the purposes for which we collect and process data.
- Surveys
- Analysis
Technologies used
This list shows all the technologies used by this service to collect data. Typical technologies are cookies and pixels that are placed in the browser.
- Cookies
Collected data
This list contains all (personal) data collected during or via use of the service.
- Device information
- Browser information
- Referrer URL
- e-mail address
- Usage data
- IP address
- Survey responses
Legal basis
Below you will find the legal basis required for data processing.
- Art. 6 al. 1 lit. a RGPD
Place of processing
This is the main location where the data collected is processed. If the data is also processed in other countries, you will be informed separately.
- European Union
Retention period
The retention period is the period during which the data collected is stored for processing. Data must be deleted as soon as it is no longer required for the specified processing purposes.
- Data will be deleted as soon as it is no longer required for processing purposes.
Transfer to third countries
This service may transfer the data collected to another country. Please note that this service may transfer data to a country that does not have the required data protection standards. Below is a list of countries to which data may be transferred. To find out more about guarantees, please consult the supplier's privacy policy or contact them directly.
- United States of America
Recipients of data
The following lists the recipients of the data collected.
- Salesforce.com Inc.
- zenloop GmbH
- Amazon Web Services, Inc.
- Elasticsearch B.V.
Click here to read the data processor's privacy policy
Processing company
Qualtrics LLC
333 W. River Park Drive
Provo, UT 84604, United States of America
Data processing purposes
This list shows the purposes of data collection and processing.
- Surveys
- Analysis
Technologies used
- Cookies and similar technologies
Data collected
This list contains all (personal) data collected during or through the use of the service.
- IP address
- Device information
- Browser information
- Referrer URL
- Responses to surveys
- Email address
- Usage data
Legal basis
The following is the required legal basis for the processing of data
- Art. 6 para. 1 s. 1 lit. a GDPR
Place of processing
European Union and United States of America
Retention period
The retention period is the period of time during which the collected data is stored for processing. The data must be deleted as soon as it is no longer required for the specified processing purposes.
The data is deleted as soon as it is no longer required for processing.
Data recipient
- Qualtrics LLC
- Salesforce.com Inc.
- Amazon Web Services, Inc.
- Elasticsearch B.V.
Data protection officer of the processing company
Below you will find the e-mail address of the data protection officer of the processing company.
privacy@qualtrics.com
Description of Service
This is a notification tool for websites. With this tool websites can provide on-site messages without pop-ups.
Processing Company
Sleeknote ApS
Jens Baggesens Vej 90A, 8200 Aarhus, Denmark
Data Protection Officer of Processing Company
Below you can find the email address of the data protection officer of the processing company.
Data Purposes
This list represents the purposes of the data collection and processing.
- Functionality
- Analytics
Technologies Used
This list represents all technologies this service uses to collect data. Typical technologies are Cookies and Pixels that are placed in the browser.
- Cookies
- Log files
Data Collected
This list represents all (personal) data that is collected by or through the use of this service.
- IP Address
- Browser information
- Browser language
- Date and time of visit
- Message text
- Statistical information
Legal Basis
In the following the required legal basis for the processing of data is listed.
- Art. 6 para. 1 s. 1 lit. f GDPR
Location of Processing
This is the primary location where the collected data is being processed. If the data is also processed in other countries, you are informed separately.
- European Union
Retention Period
The retention period is the time span the collected data is saved for the processing purposes. The data needs to be deleted as soon as it is no longer needed for the stated processing purposes.
- The data will be deleted as soon as they are no longer needed for the processing purposes
Data Recipients
In the following the recipients of the data collected are listed.
- Sleeknote ApS
Click here to read the privacy policy of the data processor
We use the analysis software Piwik PRO Analytics Suite (piwikpro.de) to analyse and optimise this website. The data collected with this software can be used to create user profiles under a pseudonym.
Data processing purposes
This list contains the purposes for which data are collected and processed. Consent is valid only for the purposes specified. The data collected cannot be used or stored for purposes other than those listed below.
- Analysis
- Optimisation
Technologies used
- Cookies
Data collected
This list contains all (personal) data that are collected during or through the use of the service.
- Anonymised shortened IP address
- Usage data
- User ID
- Date and time of the visit
- Referrer URL
- Websites visited
- Screen resolution
- Geographic location
- User agent
- Visitor ID
Legal basis
The required legal basis for the processing of data is listed in the following:
- Art. 6, para. 1 s. 1 lit. a GDPR
Location of processing
- European Union
Retention period
The retention period is the period of time during which the data collected are stored for processing. The data must be deleted as soon as they are no longer needed for the stated processing purposes. The data are stored for up to 25 months.
Data recipient
- Piwik PRO Sp. z o.o.
- Piwik PRO GmbH
Data protection officer of the processing company
Below you will find the email address of the data protection officer of the processing company.
Consent to the collection and storage of data can be withdrawn at any time with immediate future effect.
Click here to read the privacy policy of the data processor https://piwik.pro/privacy-policy/
Click here to withdraw consent on all domains of the data processing company https://piwik.pro/opt-out/
This is a web analytics service. With this, the user can measure the advertising return on investment "ROI" as well as track user behavior with flash, video, websites and applications.
Processing Company
Google Ireland Limited
Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland
Data Purposes
This list represents the purposes of the data collection and processing.
- Marketing
- Analytics
Technologies Used
- Cookies
- Pixel
- JavaScript
- Device fingerprinting
Data Collected
This list represents all (personal) data that is collected by or through the use of this service.
- Click path
- Date and time of visit
- Device information
- Location information
- IP address
- Pages visited
- Referrer URL
- Browser information
- Hostname
- Browser language
- Browser type
- Screen resolution
- Device operating system
- Interaction data
- User behaviour
- Visited URL
Legal Basis
In the following the required legal basis for the processing of data is listed.
- Art. 6 para. 1 s. 1 lit. a GDPR
Location of Processing
European Union
Retention Period
The retention period is the time span the collected data is saved for the processing purposes. The data needs to be deleted as soon as it is no longer needed for the stated processing purposes.
The Retention Period depends on the type of the saved data. Each client can choose how long Google Analytics retains data before automatically deleting it.
Data Recipients
- Google Ireland Limited, Alphabet Inc., Google LLC
Data Protection Officer of Processing Company
Below you can find the email address of the data protection officer of the processing company.
https://support.google.com/policies/contact/general_privacy_form
Transfer to Third Countries
This service may forward the collected data to a different country. Please note that this service might transfer the data to a country without the required data protection standards. If the data is transferred to the USA, there is a risk that your data can be processed by US authorities, for control and surveillance measures, possibly without legal remedies. Below you can find a list of countries to which the data is being transferred. For more information regarding safeguards please refer to the website provider’s privacy policy or contact the website provider directly.
United States of America,Singapore,Chile,Taiwan
Click here to read the privacy policy of the data processor https://policies.google.com/privacy?hl=en
Click here to opt out from this processor across all domains https://tools.google.com/dlpage/gaoptout?hl=de
Click here to read the cookie policy of the data processor https://policies.google.com/technologies/cookies?hl=en
Storage Information
Below you can see the longest potential duration for storage on a device, as set when using the cookie method of storage and if there are any other methods used.
- Maximum age of cookie storage: 2 years