Skip to main content
GERES-Group

Privacy policy

Thank you for your interest in our website. The protection of your personal data is important to us. Below, in accordance with Articles 13 and 14 of the General Data Protection Regulation (GDPR), we inform you which data we process when you visit this website, for what purposes and on what legal basis, and which rights you have.

1. Controller

The controller responsible for data processing on this website within the meaning of Art. 4 (7) GDPR is:

GERES Umwelt Management GmbH
An den Bergen 28
60437 Frankfurt am Main
Germany
Represented by the management
Email: info@geres-group.de

2. Data protection officer

You can reach our data protection officer at: Etienne Wiemann, GERES Umwelt Management GmbH, An den Bergen 28, 60437 Frankfurt am Main, Germany, info@geres-group.de

3. Provision of the website and server log files

You can visit our website without providing any information about yourself. Each time a page is called up, the web server automatically stores information that your browser transmits in so-called server log files (access data). These are in particular:

  • IP address of the requesting device
  • date and time of access
  • name and URL of the file retrieved
  • amount of data transferred and status code
  • website from which the access is made (referrer URL)
  • browser and operating system used

Purpose: delivery of the website, ensuring system security and stability, and error analysis.

Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest lies in providing our website securely and without disruption. Insofar as information on your device is accessed for this purpose, this is strictly necessary within the meaning of § 25 (2) no. 2 TDDDG.

Storage period: the access data are deleted no later than seven days after the end of your visit, unless they are needed for longer in an individual case to investigate a security incident.

SSL/TLS encryption: for security reasons, this website uses SSL or TLS encryption. You can recognise an encrypted connection by the “https://” in the address bar of your browser.

4. Hosting

Our website is hosted by an external service provider: Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. The host processes all data arising when the website is visited (in particular the access data listed under section 3) exclusively on our behalf and in accordance with our instructions. We have concluded a data processing agreement with the host pursuant to Art. 28 GDPR. Requests from the European Union are generally served via servers in the European Union; a transfer to the USA cannot be ruled out technically in every case (see section 7).

Legal basis: Art. 6 (1) (f) GDPR; our legitimate interest lies in the reliable and secure presentation of our website.

5. Cookies and similar technologies

Cookies are small text files that are stored on your device. Storing information on your device or accessing it is governed by § 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG); the subsequent processing of personal data is governed by the GDPR.

We do not set any cookies when you visit this website. Only when staff log in to our editorial area is a cookie set that is strictly necessary for the login. The legal basis is § 25 (2) no. 2 TDDDG; the subsequent data processing is based on Art. 6 (1) (f) GDPR. We do not use analytics, tracking or marketing cookies.

Regardless of this, you can set your browser to inform you when cookies are set, to allow cookies only in individual cases or to exclude them in general, and to delete cookies that have already been stored. How this works is described in the help function of your browser.

6. Contacting us

When you contact us by email, telephone or via our contact form, we process the data you provide (e.g. name, email address, telephone number, content of the enquiry) in order to handle and answer your enquiry.

Mandatory fields in the contact form are marked as such; all other information is voluntary. The data are transmitted with TLS encryption. The form data are used exclusively to handle your enquiry and are not passed on to third parties without your consent.

For the technical sending of form messages, we use the Resend service of Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA, which acts as our processor pursuant to Art. 28 GDPR; in the process, the form data are transferred to the USA (see section 7). To prevent abusive mass submissions, a shortened hash of your IP address, salted with a random value, is kept in memory for a maximum of ten minutes when you submit the form; the IP address itself is neither stored nor logged.

Legal basis: Art. 6 (1) (b) GDPR if your enquiry relates to a contract or pre-contractual measures; otherwise Art. 6 (1) (f) GDPR on the basis of our legitimate interest in handling the enquiries addressed to us and in preventing abuse.

Storage period: we delete your data as soon as your enquiry has been finally dealt with and no statutory retention obligations (in particular retention periods of up to ten years under commercial and tax law) prevent this.

7. Recipients and transfers to third countries

We only pass on your personal data insofar as this is necessary to fulfil the purposes stated, namely to our hosting provider (section 4) and to the service provider for sending form messages (section 6), each acting as a processor. In the process, data may be transferred to the USA. This transfer is safeguarded by the standard contractual clauses of the EU Commission and, in the case of Cloudflare, additionally by the certification of Cloudflare, Inc. under the EU-US Data Privacy Framework.

8. Obligation to provide data and automated decision-making

You are under no statutory or contractual obligation to provide us with personal data. Without the access data listed under section 3, however, the website cannot be delivered technically; without contact details, we cannot answer your enquiry. There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

9. Your rights

With regard to the personal data concerning you, you have the following rights vis-à-vis us:

  • access to the data we process (Art. 15 GDPR)
  • rectification of inaccurate data or completion of incomplete data (Art. 16 GDPR)
  • erasure of your data (Art. 17 GDPR), unless further processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the establishment, exercise or defence of legal claims
  • restriction of processing (Art. 18 GDPR)
  • data portability (Art. 20 GDPR)
  • withdrawal of consent given, with effect for the future (Art. 7 (3) GDPR); the lawfulness of processing carried out until the withdrawal remains unaffected
  • objection to processing (Art. 21 GDPR, see section 10)

An informal notice to the contact details given under section 1 is sufficient to exercise your rights.

Right to lodge a complaint: you also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement. The supervisory authority responsible for us is: Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (Hessian Commissioner for Data Protection and Freedom of Information), Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany.

10. Right to object under Art. 21 GDPR

INSOFAR AS WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF LEGITIMATE INTERESTS (ART. 6 (1) (F) GDPR), YOU HAVE THE RIGHT TO OBJECT TO THIS PROCESSING AT ANY TIME ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION. WE WILL THEN NO LONGER PROCESS YOUR DATA UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS, OR THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS.

IF WE PROCESS YOUR DATA FOR THE PURPOSE OF DIRECT MARKETING, YOU MAY OBJECT TO THIS PROCESSING AT ANY TIME WITHOUT GIVING REASONS; WE WILL THEN NO LONGER PROCESS YOUR DATA FOR THIS PURPOSE.

11. Currency and amendment of this privacy policy

This privacy policy is dated October 2026. We will amend it if our website, the services used or the legal requirements change. The current version is always available on this website.