Privacy
What we do with your data.
Last updated 2026-08-16
Short version: we collect what you type into a form, we use it to talk to you about the thing you filled the form in for, we do not sell it, and you can have it back or have it deleted by sending one email.
Who is responsible
The controller under Article 4(7) GDPR is the business named in the Impressum, which also carries the postal address and contact email. The European Heat Council is not yet a legal entity, so it cannot be a controller. If and when it forms, this page will name it and say when the change happened.
We have not appointed a data protection officer. We are below the threshold in §38 BDSG that would require one.
What we collect, and why
Membership form (/join)
Your email, name, brand, country, and the answers you give about your business: what you make, roughly how much, which countries you sell into, and where you stand on membership. We save each answer the moment you give it, before you finish. That is deliberate, so that stopping halfway does not lose your work, and it means we may hold a partial record even if you never submit. Legal basis: Article 6(1)(b), steps taken at your request before entering a contract, and Article 6(1)(f), our legitimate interest in building a members’ organisation.
Press, sample and event forms
Name, email, publication or business, role, and a postal address only if you have asked us to send you something. Used to send what you asked for and to run accreditation. Legal basis: Article 6(1)(b) and Article 6(1)(f).
Analytics
Aggregate counts of pages viewed, referrer, and rough country. Our Umami instance sets no cookies and does not identify you. Legal basis: Article 6(1)(f). Because nothing is stored on or read from your device for this, §25 TDDDG consent is not required and we do not show you a cookie banner asking for something we do not do.
Server logs
Our host records requests, including IP address, for security and to keep the site running. Legal basis: Article 6(1)(f).
Who processes it
We use the following processors under Article 28 GDPR. Where processing happens outside the EU it is covered by the European Commission’s Standard Contractual Clauses.
Vercel Inc.
EU and USA
Hosting, content delivery, and the Analytics and Speed Insights measurement built into the site.
Neon Inc.
EU (Frankfurt)
The PostgreSQL database that stores form submissions.
Resend / Google (Gmail SMTP)
EU and USA
Sends transactional email: notifications to us, confirmations and resume links to you. Resend is primary and Gmail is the fallback.
Umami
EU
Website analytics, self-hosted by us. No cookies, no cross-site tracking, no identification of individuals.
DHL
EU
Only where you have asked us to post you a sample box or a press pack, and only then. Receives the name and postal address needed to print the label.
We do not sell your data, and we do not share it with other members or with producers. Nothing you tell us on a form is published.
How long we keep it
- Completed membership registrations: for as long as you are a member, and for six years afterwards where German commercial and tax law requires it.
- Abandoned and partial form entries: deleted after twelve months of no contact.
- Press and sample requests: kept for the campaign they relate to and for two years after it, so we know who we have already sent things to.
- Postal addresses used for a shipment: kept only as long as needed to prove delivery.
Your rights
Under Articles 15 to 21 GDPR you have the right of access, to rectification, to erasure, to restriction of processing, to data portability, and to object to processing based on legitimate interests. Where we rely on consent you can withdraw it at any time without affecting what was lawful before.
Ask by emailing the address in the Impressum. We answer within one month.
You also have the right to complain to a supervisory authority (Article 77). Ours is the Berliner Beauftragte für Datenschutz und Informationsfreiheit.
Changes
When this page changes, the date at the top changes with it. If the Council forms as its own entity, that is a change of controller and we will say so here rather than letting it happen quietly.