With this privacy notice, European Energy Exchange AG (Augustusplatz 9, 04109 Leipzig, Germany) and EPEX Spot SE (5 boulevard Montmartre 75002 Paris, France) (hereinafter "We" or "Us") inform you how we process your personal data. Personal data is any information that concerns you, your employees or other individuals (hereinafter: "Personal Data").

This Privacy Notice describes, with regard to the purchase by you or your company of our information products, the types of Personal Data we collect on our Website (including our Webshop), in our Databases, and in other ways discussed below, how we may use that Personal Data and with whom we may share it. The Notice also describes the measures we take to protect the security of your Personal Data. We also tell you how you can exercise your right to (i) access, change, recover, opposition, erasure, portability and to be forgotten personal information you have provided to us, (ii) withdraw any consent you previously provided to us, (iii) tell us to refrain from communicating with you about our products or services, and (iv) answer any questions you may have about our privacy practices.
Should we collect Personal Data from legal entities, such entities, acting thus as data controllers, guaranty that the Personal Data they provide us with have been legally obtained from data subjects and transferred to us according to applicable (data privacy) laws and regulations. Related data subjects have thus consented with this transfer/processing and are aware of their rights, including but not limited to access, change, recover, opposition, erasure, portability and to be forgotten. 

We pay special attention on the processing of Personal Data in accordance with the General Data Protection Regulation EU 2016/679 (“GDPR”) and any other applicable data protection laws and regulations.

1. Joint Controllers

1.1 Our identity and contact details

We may process your Personal Data as joint controllers, according to Article 4 Paragraph 7 and Article 26 GDPR

In this context, we strive to provide uniform support for customers and interested parties and therefore works together for the purposes mentioned under 2.1, so that we act as jointly responsible. We have concluded an agreement for this joint responsibility in accordance with Article 26 GDPR. We will inform you of the essential content of this agreement under point 6.

1.2 Contact details of our Data Protection Officer

If you have any questions or comments about this Privacy Notice, or if you would like us to update information we have about you or your preferences, please contact us as indicated below:

2. Purpose, categories of Personal Data, legal basis and retention

2.1 Categories of your Personal Data, purposes of our processing and their legal basis

We process the following categories of your Personal Data for the following purposes:

2.1.1 Registration and Login

You may be able to register/log on our Website. To do so, we ask for information such as your name, your company, email address, login name and password, in order to access the online information and services. The legal basis for this processing is your consent, in accordance with Article 6 Paragraph 1 lit. a in connection with Article 7 GDPR. 

2.1.2 Newsletters

You may sign up to receive electronic newsletters and promotional emails. You can register for the categories you would like to subscribe to on our Websites, by entering your email address. After entering your Personal Data, you will receive an e-mail in which you can confirm your registration in order to activate the newsletter. You can unsubscribe from this service in every newsletter and withdraw your consent with effect for the future. The legal basis for this processing is your consent, in accordance with Article 6 Paragraph 1 lit. a in connection with Article 7 GDPR. The opening and click rates of the newsletters are measured exclusively anonymously. It is not possible to assign them to individual newsletter recipients. 

2.1.3 Webshop and E-learing Platform

When you buy our information products or obtain services online, we request information we need to process your purchase or provide you with the services you purchased.

Depending on the payment method you use, and as permitted by applicable law, we may ask for information such as your name, mailing address, telephone number, checking information, payment method, prices, and the item(s) bought. We use this information to process your transaction.

Also, you can buy training courses offered by our E-Learning services and will therefore be registered as user of the E-learning Platform once you have been granted access. In order to do so, your name, name of the company and e-mail address are registered on the platform.

The legal basis for processing this personal data is Article 6 (1) lit. b GDPR, as processing is necessary to fulfil a contract or for pre-contractual measures between you and us. If you are not our direct customer, and did not conclude any contract with us, but personnel of our customer or otherwise authorized by our customer to use our services, the legal basis for this processing is our legitimate interest, according to Article 6 (1) lit. f GDPR.

2.1.4 Contact us via e-mail, post, telephone and contact form

In the course of any request of information, your Personal Data may be collected by us. This includes any type of Personal Data within the meaning of GDPR, such as contact details (surname, first name, company, position, e-mail, postal address, and telephone number). This Personal Data can be registered in our contact directories in order to ease the communication with you and perform our obligations.

This Personal Data can also be included in mails exchanged within our organizations or with you or, if necessary, with partners, subcontractors, service providers or any other third party. This information is necessary to perform the services requested by you or, or to comply with any obligation according to applicable law or contractual engagements.

The Personal Data that we collect from you will only be used to answer and fulfil your specific enquiries. Your contact details, such as email address, telephone, post address, name, function, can be registered in our contact directories in order to ease the communication with you and perform our obligations.

The legal basis of this processing is our legitimate interest, according to Art. 6 para. 1 lit. (f) GDPR. Your Personal Data processed in this respect will be stored by us for as long as it is necessary to carry out our relationship (communication) with you and in accordance with the applicable legal storage regulations.

2.1.5 Information Collected by Automated Means

When you use our Websites (including Webshop), and any other online platforms, we will automatically log information about the browser that is used to access said Websites (including Webshop), such as your IP address, session time, pages viewed from that address and the page from which you are visiting our Websites. We may also collect device-specific information, such as your hardware model and operating system. This information is required to (1) correctly deliver the content of our Websites, (2) optimize the content of our Websites and, if necessary, the advertising for it, (3) ensure the permanent functionality of our information technology systems and the technology of our Websites, and (4) provide law enforcement authorities with the information necessary for criminal prosecution in the event of a cyber-attack. These anonymously collected Personal Data and information are therefore evaluated statistically and additionally evaluated with the aim of increasing data protection and data security within our organisation, in order to ultimately ensure an optimal level of protection for your Personal Data. The anonymous Personal Data of the server log files are stored separately from all other Personal Data provided by a data subject. The legal basis for the processing of your personal data for these purposes is Art. 6 para. 1 lit. (c) GDPR in fulfilling our legal obligation to take technical and organisational measures to ensure secure data processing in accordance with Article 32 GDPR and Article 6 para. 1 lit. (f) GDPR in order to pursue our legitimate interests in data processing for network and information security. 

2.1.6 Customer Relationship Management Tools (CRM)

Your contact details such as name, mailing address and telephone number may be provided on our Customer Relationship Management Tools (CRM), interfaces used by our clients to provide and update their contact details. These interfaces are also used to inform and communicate with our clients. The legal basis of this processing is our legitimate interest, according to Art. 6 para. 1 lit. (f) GDPR. 

2.1.7 Surveys

We may ask you to complete a satisfaction survey or any other survey, on behalf of your company. If you choose to do so, you may provide on an optional basis information such as your name, email address, telephone number, in addition to your comments. We use this information to contact you in order to improve our products and services and enhance your user and customer experience. The legal basis of this processing is our legitimate interest, according to Art. 6 para. 1 lit. (f) GDPR.

2.1.8 Events

As representative or staff member of our clients or prospects, you can be invited and participate to events organized by us. As part of the preparation or realization of such events, we may ask you for information such as your name, phone number, email address, name and address of your company, if any, your address in order to communicate and ease the communication with you. During these events, we could also take pictures of you or interview you and therefore obtain video and / or voice recordings. These photos and recordings allow us to illustrate articles that we share with our affiliates on the one hand, but also with the public on the internet on the other hand, including on this website, or LinkedIn; the objective being the promotion of our companies and their activities to the public.  The legal basis of this processing is our legitimate interest, according to Art. 6 para. 1 lit. (f) GDPR.

2.2 Do you have to provide personal data to us?

The provision of your personal data is necessary in order to access the protected areas of the website, which are restricted to members of our customer groups, to contact us directly or to receive a newsletter. This means that it is necessary that you give us your personal data in the context of e.g. to provide a user registration process or contract.
 

2.3 Do We make automated decisions on you? 

We do not make any automated decisions solely on automatic processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.
 

2.4 Retention periods 

The retention periods for Personal Data depend on the purpose of the processing. We will store the personal data mentioned under 2.1 above as long as (i) this is necessary for the respective purpose and / or (ii) this is required in accordance with the applicable statutory retention laws. We will keep Personal Data that you provide us for as long as our business relationship with you or with your company exists, plus all applicable retention periods that are in accordance with the statutory provisions (e.g. based on tax regulations) or to the extent they are necessary to pursue our legitimate interests after the end of the business relationship (e.g. to assert claims within the statutory limitation periods).

3. Transfer of Personal Data

We do not sell or otherwise disclose your Personal Data, except as described herein. We may share your Personal Data with our affiliates worldwide, licensees and joint venture partners for the purposes described in this Privacy Notice. We also may share the information with our service providers who perform services on our behalf based on our instructions. They are not authorized by us to use or disclose the information except as necessary to perform services on our behalf or comply with legal requirements.
We also may disclose information about you (i) if we are required to do so by law or legal process (including litigation, such as a court order) to, among others, our lawyers or collection agency), (ii) in response to a request by law enforcement authorities, or (iii) when such disclosure is deemed necessary or appropriate to prevent physical harm or financial loss or in connection with an investigation of suspected or actual illegal activity. We also reserve the right to transfer personal information in the event of a sale or transfer of all or a portion of our business or assets. Should such a sale or transfer occur, we will use reasonable efforts to direct the transferee to use personal information you have provided to us in a manner that is consistent with our Privacy Notice. Following such a sale or transfer, you may contact the entity to which we transferred your personal information with any inquiries concerning the processing of that information. 

We may transfer your Personal Data to recipients in countries other than the country in which you originally provided it. These countries may not have the same data protection laws as the country in which you provided the information. In such a case, we will comply with applicable legal requirements providing adequate protection for such transfer.

4. Cookies and similar technologies

Please see our cookie policy at: Cookies policy.

5. Your rights 

Right of access, correction, limitation, opposition, recovery, portability, erasure and shelf life

Subject to applicable law, we provide you with access to your personal information we process and the ability to review, correct, update, recover or delete the information where it is inaccurate or not. You also have the right to ask for the limitation of the processing thereof, as well as a right of erasure and portability of said information. Therefore, you may withdraw any consent you previously provided to us or object at any time to the processing of your personal information, and we will apply your preferences going forward. Besides, you can choose not to receive member or customer communications from us by updating your details in Customer Center or contacting us as specified in the "How to Contact Us" section below. You also have the right to ask about the shelf life of your personal information, which is limited to a reasonable and proportional duration with regard to the aim of the processing. Subject to applicable law, we may limit or deny access to personal information where providing such access is unreasonably burdensome or expensive under the circumstances.

To exercise your rights, you can contact Us as set out in Section 1.2 above. You can also lodge a complaint about Our processing of your Personal Data with a data protection authority. A list and contact details of the local data protection authorities can be found here. https://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=612080

6. Our joint responsibility

The controllers are responsible for keeping a record of processing activities, carrying out data protection impact assessments or consulting the supervisory authorities. The controllers have committed to take appropriate technical and organizational security measures for the data to be processed in order to ensure and be able to prove that the processing is carried out in accordance with data protection regulations. The security measures must ensure a level of protection appropriate to the risk and are checked and updated if necessary. The technical and organizational measures must also ensure that the data is processed in accordance with the legal requirements. The responsible controllers inform each other immediately about disruptions in the operational process that pose a risk to the data as well as suspected data protection violations in connection with the personal data. The responsible controllers agree on the content of the report and keep themselves informed about the communication with the supervisory authority. This also applies if there is a legal obligation to inform you as a person of a data protection breach.
If you exercise one of your rights as a person vis-à-vis one of the responsible controllers, this controller will immediately inform the other controllers of this in writing. The responsible controller for fulfilling the rights of the data subject is, who is contacted directly by you.
The controller in charge contacted by you takes on e.g. communicating with you, gathers the necessary information, checks the asserted right and implements it accordingly. The controllers are obliged to support each other in fulfilling such requests. They keep themselves informed about this on an ongoing basis and intend to reach agreement on all essential steps. You can exercise your rights against all responsible parties. Should measures become necessary in accordance with the asserted right of data subjects (e.g. correction, deletion, restriction, notifications to recipients, transfer and access), those responsible will implement this independently.

• EEX AG
• EPEX SPOT SE

Updates to Our Privacy Notice

This Privacy Notice may be updated periodically and without prior notice to you to reflect changes in our personal information practices or relevant laws. We will indicate at the top of the notice when it was updated.