Privacy

Privacy Notice

This privacy notice is provided by the ClimatePartner Group and explains how ClimatePartner collects, processes, and protects your personal data in accordance with applicable data protection law, in particular the GDPR.

1. Controller

The controller for all data processing in connection with the ClimatePartner website is:

ClimatePartner GmbH
St.-Martin-Straße 59, D-81669 Munich
Phone: +49 89 1222875-0 | Email: dataprotection@climatepartner.com

For data processing related to the contact form on climatepartnerimpact.com, the controller is ClimatePartner Impact GmbH (same address and contact details).

For processing unrelated to the website, the responsible controller is the respective ClimatePartner Group company with which you are in contact. An overview of all Group companies is available at 
climatepartner.com/en/offices.

2. Data Protection Officer

Our external data protection officer can be contacted at datenschutz@nextwork.de (Nextwork GmbH). You can also reach our data protection team at dataprotection@climatepartner.com or by post to ClimatePartner GmbH at the address above.

3. Your Rights as a Data Subject

To exercise any of the following rights, please contact us by email or post, clearly identifying yourself. We will respond within one month.
 

4. Data Security

We implement appropriate technical and organisational measures to protect your personal data in line with current security standards. Your data is protected by strong encryption during both transmission and storage. Please note that transmission via email carries inherent security risks. We regularly back up our servers but cannot guarantee uninterrupted availability of our web services.

5. Data Sharing and International Transfers

We process your personal data primarily within our company. Where we engage third-party processors, they receive only the data necessary for their specific service and are contractually bound to comply with data protection requirements.

Within the ClimatePartner Group, data is shared only with those companies and departments that need it to fulfil contractual or legal obligations or their specific Group function.

Where personal data is transferred to third countries (outside the EU/EEA), we rely on adequacy decisions (e.g. the EU-US Data Privacy Framework) or Standard Contractual Clauses approved by the European Commission (Art. 46 GDPR). The same level of protection applies regardless of where your data is processed.

6. Website Use and Hosting

Hosting

We use leased data centres to operate our website and online platforms, providing infrastructure, storage, and security services. Our data centres are located in the European Union. Data processed includes inventory, contact, content, usage, metadata, and communication data, processed on the basis of our legitimate interest in secure and efficient service provision (Art. 6(1)(f) GDPR). We only store personal data for as long as necessary for the intended purpose.

Access data (server logs)

We automatically record access to our web services in server log files. This includes the name and URL of the retrieved file, date and time, data volume, HTTP response code, browser type and version, operating system, referrer URL, IP address, and requesting provider.

We use log data anonymously for statistical evaluation, to operate and optimise services, and to prove service provision. IP addresses are not assigned to individual persons. Log data including IP addresses is retained for a maximum of 12 months. We reserve the right to review log data retrospectively if there is a justified suspicion of unlawful use. Additionally, we store the date of your last account activity.

Legal basis: legitimate interest (Art. 6(1)(f) GDPR).

Business-related processing

For the provision of our online services, we process the following customer data:
 

• Name, email address, telephone number
• Purchase data: services ordered (e.g. CO₂ calculation), address and contact details
• Payment data: credit card data, PayPal account, payment history
• Contract data: subject matter of the contract
• Event registration data (ClimatePartner Academy): name, email, telephone number

7. Cookies

Our website uses cookies, small text files stored on your device to enable certain functions. Cookies are categorised as follows:
 

Necessary cookies are based on our legitimate interest; all other cookies require your consent, which you may withdraw at any time with future effect via the cookie banner. Withdrawal does not affect the lawfulness of prior processing.

The maximum cookie retention period is 399 days (approx. 13 months). You can also delete cookies at any time via your browser settings.

8. Third-Party Tools and Services

To provide and improve our services, we use the third-party tools listed below. All providers have been carefully selected in accordance with GDPR requirements. You can withdraw consent to any consent-based tool at any time via the cookie banner; the relevant cookies will be deleted immediately.

9. Contact via Form or Email

When you contact us via a contact form or email, we process the personal data you provide (e.g. name, email address, and the content of your message) to handle your enquiry and communicate with you.
Legal basis: Art. 6(1)(b) GDPR where your enquiry concerns the initiation or fulfilment of a contract; otherwise Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries and maintaining business relationships).
We delete your data once your enquiry is fully resolved and no further communication is expected, and in any case no later than 12 months after the last activity. Where statutory retention obligations apply or data is needed for legal claims, we restrict processing accordingly.

10. Newsletter and Marketing

Newsletter

You can subscribe to our email newsletter to receive regular updates on climate protection and ClimatePartner services. The data required for registration is indicated in the sign-up form. Participation is voluntary; you can unsubscribe at any time by clicking the unsubscribe link in any newsletter.
Newsletters may contain tracking pixels to measure open rates and click behaviour. This data is transferred to and stored on Microsoft's servers for statistical purposes and personalisation of the newsletter.
We use Microsoft Dynamics 365 for newsletter dispatch, statistical evaluation, and logging of the registration process, on the basis of a data processing agreement. Data is processed only for the duration of your consent and deleted upon withdrawal. Further information: privacy.microsoft.com.
 

Email campaigns

As part of our lead acquisition, we may contact potential partners who have a demonstrable interest in climate protection by email (maximum two contacts per person unless you respond or withdraw consent). The purpose is to provide topic-specific offers (e.g. webinars, white papers) that may lead to a business relationship.
Legal basis: legitimate interest (Art. 6(1)(f) GDPR) or consent. You may withdraw or object at any time via the opt-out link in the email footer, directly to the sender, or in writing to ClimatePartner GmbH.
Where we have not collected your data directly (e.g. from publicly accessible B2B networks or lead exchanges), data is deleted within 30 days after the purpose ceases to apply or upon withdrawal.
 

Marketing (personalised advertising)

We and our advertising partners use standard internet technologies to display personalised advertising on ClimatePartner services and on third-party websites and apps. Legal basis: consent (Art. 6(1)(a) GDPR), which can be withdrawn via the cookie banner.

Telephone Lead Qualification

As part of our lead generation activities, we use external service providers who qualify incoming enquiries from interested parties by telephone on our behalf, based on our legitimate interest in efficiently processing such enquiries (Art. 6(1)(f) GDPR) or, where consent to contact has been given, based on your consent (Art. 6(1)(a) GDPR). For this purpose, these service providers are given access in our CRM system to the personal data required for contacting you (e.g. name, telephone number, company). The service providers are contractually obliged to comply with data protection requirements (Art. 28 GDPR) and may use the data exclusively to carry out telephone qualification on behalf of ClimatePartner.

11. Applications

We process application data to assess suitability for vacancies and to conduct the application process. We use Personio GmbH (Rundfunkplatz 4, 80335 Munich) to manage applicant data; their servers are located in Frankfurt, Germany (ISO 27001 certified). Further information: 
personio.com/privacy-policy.
Legal basis: your consent and the initiation of a potential employment relationship (Art. 6(1)(b) GDPR).
Retention: Applications are deleted six months after receipt. If you consent to inclusion in our talent pool, data is retained for one calendar year, after which further consent is sought or data is deleted.

12. Contractual Partners and Suppliers

We process the data received in connection with our collaboration (names, contact details, and information gathered during supplier selection) in our internal CRM system to facilitate ongoing and future cooperation.
Legal basis: performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR) or legitimate interest in enabling future cooperation (Art. 6(1)(f) GDPR). Data is retained for the duration of the business relationship and any applicable statutory retention periods thereafter.

13. ClimatePartner Services

When you purchase ClimatePartner products or use our platforms, we process personal data (e.g. name, email address, payment and credit card data) to provide the services, fulfil contractual obligations, and, where applicable, settle commission payments with partner companies you have designated.

Legal basis: contract performance (Art. 6(1)(b) GDPR) or consent. Data is retained for the duration of the contract and deleted thereafter, unless tax law requires retention for up to 10 years.
In some cases, ClimatePartner acts as a data processor on behalf of its customers. In such cases, a data processing agreement pursuant to Art. 28 GDPR is in place.

Overview of ClimatePartner platforms and the personal data processed:
 

14. Credit Assessment (Creditreform Boniversum)

When concluding contracts, and in certain cases with existing customers where there is a legitimate interest, we carry out creditworthiness checks via Creditreform Boniversum GmbH, Hammfelddamm 13, 41460 Neuss.
Creditreform Boniversum stores data on name, address, date of birth, email address (where applicable), payment history, and shareholdings, and provides a score value that we use to inform our credit decision. Source data comes from public sources and debt collection companies.
Legal basis: our legitimate interest in protecting against payment default (Art. 6(1)(f) GDPR). Data stored by Creditreform Boniversum is initially retained for three years. Transfers to third countries, where applicable, are made on the basis of Standard Contractual Clauses.
You are entitled to exercise all applicable data subject rights (see Section 3) directly against Creditreform Boniversum GmbH. Further information: 
boniversum.de/bonipedia (under "Data Erasure").

15. Whistleblowing System

Our whistleblowing system provides a reporting channel in accordance with the Whistleblower Protection Act. If you submit a report, we process only the personal data you voluntarily provide (e.g. name, contact details, employee information).
Legal basis: fulfilment of legal obligations (Whistleblower Protection Act) or your consent.
Our reporting channel is operated by Whistlelaw, with whom we have concluded a data processing agreement. Data is retained for three years and then reviewed; if retention is no longer necessary, data is deleted. Further information: 
whistle.law/dsgvo-sicherheit

16. Social Media

We maintain a presence on social networks to share content, offers, and product information. When you interact with our profiles, the platform operators may use cookies and similar technologies to record your behaviour. The scope and purpose of data processing by the platform operators are determined by their own privacy policies. Legal basis for our own activities: legitimate interest (Art. 6(1)(f) GDPR); where you have a user account and have given consent to the platform, your consent serves as the additional legal basis.
 

17. Amendments to This Privacy Notice 

We regularly review and update this privacy notice to reflect changes in our services, data processing activities, or applicable law. We recommend checking this notice periodically.
This notice is regularly reviewed and updated.
 

Version: June 2026