Privacy notice

1. Controller

The following provider is the controller for the public website, pilot enquiries, and its own business, security, and account data:

2. Roles in customer campaigns

• For a campaign, the organizing customer normally determines its purpose, participant group, photo use, and publication scope. In that case, the organization will normally be the controller for campaign data.
• Green Impact Report provides the platform and processes that data for the organization within the agreed scope. Before a real customer pilot, roles and instructions are recorded in the customer agreement or a data processing agreement.
• Green Impact Report acts as controller for technical security, website, account, support, and its own business data. Participants can contact the organizer about the purpose of a campaign and Green Impact Report about technical privacy matters.

3. Processing activities

The information processed depends on whether you only visit the website, send an enquiry, use an organizer account, or participate in a campaign.

4. Cookies and local browser storage

• Organizer login uses technically necessary authentication cookies.
• Participation stores a technical session in local browser storage so team selection and later submissions work on the same device. It may contain the session ID, campaign, team, optional nickname, and consent time and remains until the person or browser removes it.
• A separate return shortcut for the last campaign expires after 48 hours. A short-lived portal check in the current tab expires after five minutes.
• We use no advertising cookies, advertising pixels, or cross-site profiles.

This storage provides the participation, session, or login function explicitly requested. It is not used for advertising. Where section 25 TDDDG applies, technically necessary access relies on section 25(2)(2) TDDDG.

5. Recipients and service providers

We do not sell data. Access is limited to authorized people and service providers where required for the relevant purpose.

6. Data location and transfers outside the EEA

Primary campaign infrastructure is configured for AWS Europe (Frankfurt), eu-central-1. Individual providers or subprocessors may process data outside the European Economic Area. Where required, an adequacy decision, Standard Contractual Clauses, or another permitted transfer mechanism is used. The specific service scope is reviewed before a customer contract with special location requirements.

7. Required information and data sources

• Pilot form: email address and organization are required so we can reply and understand the request. The form cannot be sent without them. All other fields are optional.
• Campaign participation requires a team, value, technical session, and photo. Full Evidence Trail campaigns also require a measurement method and waste category; before and scale photos remain optional. Nickname and note are optional.
• Organizer account: identity and account details required by the login and permission system are necessary for protected access.
• Data mainly comes directly from the person, from the organizing customer, or is generated technically when the service is used.

8. Rights of individuals

Subject to the GDPR conditions, individuals have the following rights in particular:

• Access and a copy of personal data being processed
• Correction of inaccurate or incomplete data
• Deletion or restriction of processing
• Data portability where the legal conditions apply
• Withdrawal of consent with future effect
• Objection to processing based on legitimate interests

Objection under Article 21 GDPR

You may object to processing based on Article 6(1)(f) GDPR for reasons arising from your particular situation. We do not use campaign or participant data for direct advertising.

9. Right to complain

You may complain to a data protection supervisory authority, in particular where you live, work, or believe an infringement occurred. You are also welcome to contact us first.

10. Automated decisions

There is no solely automated decision with legal or similarly significant effect and no profiling for advertising.

11. Security and privacy requests

We use technical and organizational measures to protect data against unauthorized access, loss, and alteration. For a request, we must verify identity, campaign, and authority sufficiently so that another person’s data is not disclosed or deleted. Do not send passwords, report tokens, or sensitive credentials by email.

12. Changes to this notice

We update this notice when providers, functions, retention, or legal requirements change materially. The date above identifies the current version.