Privacy Policy

The data controller responsible for data processing on this website is:

GreenPlanVision
Bernhard Mike Petrovic
Av. Octavio Paz 12, Portal 1, Esc. 1, 4ºE
29190 Málaga, España
E-Mail: info@greenplanvision.com

This website is hosted on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Processing takes place exclusively in data centres in Germany. A Data Processing Agreement (DPA) pursuant to Art. 28 GDPR has been concluded with Hetzner.

When visiting the website, the following data is automatically recorded in server log files:

• IP address (anonymised after 7 days)
• Date and time of access
• Page/URL accessed
• HTTP status code
• Volume of data transferred
• Browser and operating system
• Referrer URL

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in ensuring the operation and security of the website).

For security purposes, this website uses 256-bit SSL/TLS encryption. You can recognise an encrypted connection by the lock symbol in the address bar of your browser. The transmission of your data between your browser and our server is thus protected against interception by third parties.

When you contact us via the contact form, by email or by telephone, your information will be processed for the purpose of handling the enquiry. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures or performance of a contract) or Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries). The data will be deleted as soon as the purpose of processing ceases to apply and no statutory retention obligations prevent deletion.

To prepare and perform advisory mandates and, where an offer provides for it, distribution orders, we process the details you provide in the contact form, by email, by telephone or when booking an appointment. We do not operate a customer account on this website.

6.1 Data for preparing an offer and performing the contract

• Name and email address
• Company or designation, where provided
• Address, where required for the offer or the invoice
• VAT identification number or tax number, where required for the invoice
• Content of the enquiry and the agreed scope of services
• Fee and term according to the individual offer
• Payment reference of a settled invoice; we do not store full card numbers

Legal basis: Art. 6 (1) (b) GDPR (performance of a contract and steps prior to a contract). The data are deleted after the statutory retention periods expire. Where Spanish tax or commercial law applies, its periods apply; where German law is relevant, § 147 AO (10 years for invoices) and § 257 HGB (6 years for commercial correspondence) apply.

6.2 No customer account

• There is no login and no password.
• Contracts are formed by offer and acceptance in text form, not by unlocking access.

Login data are not processed, because this offering has no user account.

6.3 Local settings in the browser

The display mode (light or dark) and acknowledgement of the notice banner may be stored in the browser’s local storage. Language follows the address that was opened and is not stored as an account.

6.4 Technical access logs

For the security of the website, conspicuous requests may be recorded in addition to the server logs in section 3.

• Time of the request
• Address requested
• IP address and device type, where they appear in the server logs
• Unusual request patterns, such as mass requests

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in the security of the website). The logs are deleted after 90 days unless there is a specific suspicion of misuse. If there is a specific suspicion, the relevant data are kept until the matter is clarified.

We issue invoices ourselves and send them by email. Payment is typically by bank transfer. We do not store full payment-card numbers. No payment service provider is embedded on this website. A named payment service provider appears only if an individual offer names one; that provider then processes the payment data on its own responsibility, and we receive a payment confirmation and a reference. Legal basis: Art. 6 (1) (b) GDPR.

This website does not set cookies for a customer account. The following local entries may be created in the browser:

• Display mode, light or dark (local storage, not a cookie)
• Acknowledgement of the privacy notice (local storage)
• No authentication token

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in technical operation). For technically necessary cookies, no consent is required pursuant to Art. 22.2 LSSI-CE (Ley 34/2002) and § 25(2) TDDDG.

We do not use any analytics, tracking or marketing cookies. No third-party tracking takes place.

9.1 Fonts (Ubuntu Sans)

This website uses the font "Ubuntu Sans". The font is hosted locally on our server (self-hosting). No connection to external servers (e.g. Google) is established. When retrieving the font, no IP address is transmitted to third parties.

9.2 Web analytics (Umami, self-hosted)

We use Umami Analytics, hosted on our own subdomain analytics.greenplanvision.com. Umami is a privacy-friendly, cookieless analytics tool that does not store personal data about end devices. It records anonymised visit counts, page views, referrers and browser type. The IP address is processed solely for statistical evaluation in a non-identifiable form and is not stored. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in measuring reach and improving the website). Consent under § 25 TDDDG is not required because no information is stored on or accessed from the user’s device.

9.3 Processing of contact enquiries (n8n + HubSpot)

Enquiries via the contact form are received technically through n8n (workflow automation, hosted on our own infrastructure in Germany/EU) and forwarded to HubSpot Ireland Ltd. (CRM, registered office: Dublin, Ireland). HubSpot processes the data in part on servers in the USA (third-country transfer). The transfer is based on EU standard contractual clauses (Art. 46(2)(c) GDPR) and the EU-US Data Privacy Framework. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in efficient communication and sales handling). A data processing agreement under Art. 28 GDPR is in place with HubSpot. Retention: for the duration of handling the enquiry plus statutory retention periods.

9.4 Appointment booking (Cal.com)

For booking initial meetings we use a self-hosted Cal.com instance at booking.greenplanvision.com (open-source software, hosting in Germany/EU). When a booking is made we process name, e-mail address and, where provided, the message field. The meeting itself takes place via Google Meet (Google Ireland Ltd.); Google processes connection data in that context (see the Google Meet privacy notice). Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures).

9.5 Greene chat assistant

On some pages we offer an AI-supported chat assistant (Greene) that answers general questions about our services. Greene runs entirely on our own infrastructure (servers in Germany/EU). Chat inputs are sent to an external AI provider (Anthropic PBC, USA) to generate replies; only the chat text is transmitted, without identifying metadata. Anthropic processes data on the basis of EU standard contractual clauses and contractually undertakes not to use the requests for model training. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in automated first-line information). Chat histories are stored for a maximum of 30 days and then deleted.

9.6 Transfers to the USA

In connection with the services named above we transfer personal data to providers established or processing in the USA: HubSpot (CRM) and Anthropic (AI for the Greene chat). A payment service provider is to be added to this list only if a specific offer uses one. These transfers are based on the EU-US Data Privacy Framework (adequacy decision of the European Commission of 10 July 2023) and, in addition, on EU standard contractual clauses (Art. 46 (2) (c) GDPR). The providers named are listed as certified in the Data Privacy Framework register or are subject to appropriate safeguards. On request we provide the relevant processing agreements and transfer impact assessments.

9.7 Further external services

If further external services are integrated in the future, this privacy policy will be updated accordingly and, where necessary, consent will be obtained.

Under the GDPR, you have the following rights:

• Right of access (Art. 15 GDPR) – Right to obtain information about the personal data we process about you.
• Right to rectification (Art. 16 GDPR) – Right to have inaccurate data corrected or incomplete data completed.
• Right to erasure (Art. 17 GDPR) – Right to have your data deleted, provided no statutory retention obligations prevent this.
• Right to restriction of processing (Art. 18 GDPR) – Right to restrict the processing of your data under certain conditions.
• Right to data portability (Art. 20 GDPR) – Right to receive your data in a structured, commonly used and machine-readable format.
• Right to object (Art. 21 GDPR) – Right to object to the processing of your data based on legitimate interests.
• Right to withdraw consent (Art. 7(3) GDPR) – You may withdraw any consent given at any time with effect for the future.

To exercise your rights, an informal notification to info@greenplanvision.com.

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority if you believe that the processing of your personal data infringes the GDPR.

The supervisory authority responsible for us is:

Agencia Española de Protección de Datos (AEPD)
C/ Jorge Juan, 6, 28001 Madrid, España
Telefon: +34 900 293 183
Website: www.aepd.es

As a data subject resident in Germany, you may also contact your competent state data protection authority, which will forward your complaint to the AEPD under the GDPR consistency mechanism.

We implement technical and organisational measures pursuant to Art. 32 GDPR to protect your data against accidental or intentional manipulation, loss, destruction or access by unauthorised persons. Our security measures are continuously improved in line with technological developments. These include in particular:

• 256-bit SSL/TLS encryption of data in transit
• No user account and therefore no storage of passwords on this website
• Regular security updates and backups
• Hosting in ISO 27001-certified data centres in Germany

We reserve the right to update this privacy policy to reflect changes in the legal situation, technical standards or our services. The current version is always available on this page. In the event of material changes, we will inform you in an appropriate manner.