This website works without tracking, without advertising networks and without external font services. Whatever data does arise is set out here in full.
No tracking
Fonts served locally
Article 13 GDPR
One day over time · schematic, not measurements
This is a non-binding translation. In case of any discrepancy, the German version prevails.
The essentials first
No analytics tool, no advertising network, no profiling.
Fonts and images are delivered with the page — nothing is loaded from third-party servers.
We transmit forms to our mailbox through the Brevo service.
Only what a function needs is stored in your browser: your choice of light or dark, your consent decision and, when you jump from the search, briefly the target.
The search runs entirely in your browser; your search terms are not transmitted.
You can change or withdraw your consent at any time using the “Cookie settings” link in the footer of every page.
01 Controller
The controller for the processing of personal data on this website within the meaning of the General Data Protection Regulation is:
Controller5 entries
Item
Value
Controller
GFG Energy GmbH (in formation)
Represented by
Dr. Ralf Heidelberg, Robert Schlichting (managing directors)
Address
Perlacher Straße 44, 82031 Grünwald, Germany
Phone
0800 80801071
Email
office@gfg.energy
No data protection officer has been appointed, because the conditions for a mandatory appointment under § 38 BDSG are not currently met. Please send questions about data protection to the email address above.
02 Principles of this website
This website is a static site. There are no user accounts, no comment function and no personalised content. All fonts, images, scripts and style sheets are delivered together with the page. Google Fonts, advertising networks, social networks, map and video services are not embedded.
No analytics or statistics tools are used. No profiling within the meaning of Article 4 (4) GDPR takes place, and no automated decision-making.
03 Hosting, delivery and name resolution
The website is provided through Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA). Cloudflare delivers the pages at www.gfg.energy and protects the website against attacks and overload. When a page is requested, Cloudflare processes technically necessary connection data so that the page can be delivered at all.
The domain gfg.energy and its name resolution (DNS) are managed by ALL-INKL.COM – Neue Medien Münnich, owner René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. Anyone who enters the address without “www” is forwarded to www.gfg.energy by a server operated by ALL-INKL. In doing so, ALL-INKL processes the IP address, the date and time and the requested address and keeps them in server logs only for as long as secure operation requires.
The legal basis is Article 6 (1) (f) GDPR. Our legitimate interest lies in providing the website securely, quickly and reliably. Cloudflare and ALL-INKL process the data as processors on the basis of an agreement pursuant to Article 28 GDPR.
Hosting, delivery and name resolution5 entries
Data processed
Purpose
Retention
IP address
Delivery of the page, defence against attacks
briefly, in aggregated form
Date and time of access
Operational security
briefly
Address requested
Delivery of the page
briefly
Browser and device identifier
Correct display
briefly
Volume of data transferred
Operation and billing
briefly
This data is not combined with other sources and is not used to identify individual persons.
04 What is stored in your browser
This website sets no cookies in the technical sense. It creates at most three entries in your browser's storage (localStorage and sessionStorage), each only when you use the related function. These entries do not leave your device and are not transmitted to us.
What is stored in your browser3 entries
Entry
Purpose
Duration
gf-modus (localStorage)
Remembers whether you chose the light or the dark view
until you clear your browser storage
gf-consent (localStorage)
Stores your consent decision together with its timestamp
until you clear your browser storage
gf-suchziel (sessionStorage)
When you jump from the search to another page, remembers the target so that it can be briefly highlighted there
deleted immediately on the target page, at the latest when you close the tab
All entries are necessary for the functions you have asked for and are therefore exempt from consent under § 25 (2) no. 2 TDDDG. You can delete them at any time by removing the site data in your browser.
05 Consent and withdrawal
As soon as this website embeds services that require consent, we will ask for it beforehand. The consent dialogue is in place for that: refusing is as easy as accepting, nothing is pre-ticked, and you can change or fully withdraw your choice at any time using the “Cookie settings” link in the footer of every page — on large screens also using the button at the bottom left.
Your decision is stored in your browser with its timestamp and version number so that we can demonstrate it (Article 7 (1) GDPR) and so that you are asked again if the categories change. Withdrawal takes effect for the future; the lawfulness of processing carried out until then remains unaffected (Article 7 (3) GDPR).
At present nothing is loaded in any of the categories that require consent.
06 Forms and contacting us
If you write to us using one of the forms on this website — the site check or a project referral from partners —, we process the information you enter: usually name, company, email address, optionally phone number, details about the site and your message.
To transmit it we use the Brevo service of Brevo GmbH, Köpenicker Str. 126, 10179 Berlin, Germany. After you submit the form, your enquiry is transmitted through Brevo to our email mailbox and from there taken into our internal system for handling enquiries. Brevo processes the data as a processor on the basis of an agreement pursuant to Article 28 GDPR and, according to its own information, stores it on servers in the European Union.
The legal basis is Article 6 (1) (b) GDPR where your enquiry is aimed at a contract, otherwise Article 6 (1) (f) GDPR on the basis of our legitimate interest in answering enquiries. We need the fields marked as required in order to reply.
We delete the information once the enquiry has been dealt with conclusively and no statutory retention obligations stand in the way. If a contract is concluded, the retention periods under commercial and tax law apply.
If you email or call us, we process your information on the same basis and only to deal with your request.
We run our email mailbox on Google Workspace. The contracting party is Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland. It processes the emails you send us and the requests from the forms as a processor on the basis of a contract under Article 28 GDPR.
07 Applications
Applications submitted through the form on the careers page, including uploaded documents, are also transmitted to us through Brevo. We process the information solely to carry out the application procedure; the legal basis is Article 6 (1) (b) GDPR in conjunction with Article 88 GDPR.
If no employment relationship results, we delete the documents no later than six months after the procedure ends. This period serves to defend against possible claims under the German General Equal Treatment Act. Longer storage, for example for later vacancies, only takes place with your consent.
08 Fonts, visualisations and search
The fonts used (Barlow and IBM Plex Mono, both under the SIL Open Font License) are delivered together with the website. There is no connection to Google Fonts or any other font service.
All diagrams and three-dimensional representations are computed locally in your browser; no data is transmitted in the process.
The search on this website runs entirely in your browser. The search index is loaded from our server when you open the search; your search terms are neither transmitted nor stored.
09 Recipients and transfers to third countries
Recipients in the operation of this website are Cloudflare (delivery, protection against attacks), ALL-INKL (name resolution, forwarding of the address without “www”), Brevo (transmission of forms) and Google (email mailbox), each as a processor. Beyond that we only pass on data where this is necessary to perform a contract, where you have consented, or where we are legally obliged to do so.
With Cloudflare and Google, a transfer to the USA may take place. It is based on the European Commission's adequacy decision for the EU-US Data Privacy Framework (Article 45 GDPR), under which both companies are certified, and additionally on the European Commission's standard contractual clauses.
10 Your rights
You have the following rights vis-à-vis the controller:
Access to the data processed about you (Article 15 GDPR)
Rectification of inaccurate data (Article 16 GDPR)
Erasure (Article 17 GDPR)
Restriction of processing (Article 18 GDPR)
Data portability (Article 20 GDPR)
Withdrawal of consent with effect for the future (Article 7 (3) GDPR)
Objection to processing based on legitimate interests (Article 21 GDPR)
An informal message to the address given above is enough to exercise these rights. Independently of that, you have the right to lodge a complaint with a data protection supervisory authority (Article 77 GDPR). The authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany.
11 Right to object
Where we process data on the basis of legitimate interests (Article 6 (1) (f) GDPR), you have the right to object to this processing at any time on grounds relating to your particular situation (Article 21 (1) GDPR).
We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. An informal message to the address given above is enough.
12 Data security
The website is delivered exclusively in encrypted form over HTTPS. In addition we apply technical protective measures, among them a Content Security Policy that prevents third-party content from being loaded.
13 Changes to this policy
We adapt this privacy policy as soon as the processing changes. The version available on this page is the one that applies. Version: October 2026.
Your choice about cookies
This website works without tracking. Technically necessary entries in your browser are required for it to work. Everything else is loaded only with your consent — and at the moment nothing there is in operation.