Privacy Policy.

Last updated: 14 May 2026

We take the protection of your personal data seriously. This Privacy Policy explains what data we collect when you use klima-one.com, why we collect it, on which legal basis, with whom we share it, and what rights you have.

1. Controller

The controller responsible for processing personal data on this website within the meaning of Art. 4(7) GDPR is:

0-1 Group GmbH
Mombacher Straße 68
55122 Mainz
Germany
Email: [email protected]
Commercial Register: HRB 53378 (Local Court of Mainz)
Represented by Tarek Baraghith and Samuel Oscar Zinni

We have not appointed a data protection officer because we are not legally required to do so (§ 38 BDSG). For all data protection enquiries, please use the email address above.

2. Server logs when visiting the website

When you access klima-one.com, our hosting provider Cloudflare automatically collects information that your browser transmits. The following data is processed:

• IP address (truncated by Cloudflare for anonymisation in most cases)
• Date and time of the request
• URL of the requested resource
• HTTP status code
• Referrer URL (the page from which you came)
• Browser type, language and version
• Operating system

Purpose: Ensuring the technical operation, security and stability of the website (defence against attacks, bot mitigation, network optimisation).

Legal basis: Art. 6(1)(f) GDPR — legitimate interest in operating a secure, performant website.

Storage period: Cloudflare access logs are typically retained for 7 days for operational security purposes; aggregated, anonymised analytics may be retained longer.

3. Contact form

If you use our contact form on the homepage, we collect the data you enter to process your enquiry.

Data collected

• First and last name
• Email address
• Phone number (optional)
• Your message

Purpose: Processing your enquiry and contacting you with a reply.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) where the enquiry relates to a possible business relationship; Art. 6(1)(f) GDPR (legitimate interest) otherwise.

Recipients: Your message is sent via our email-service provider Resend (see section 6). A copy of your enquiry is delivered to [email protected].

Storage period: Your enquiry remains stored until the matter is fully resolved and any statutory retention obligations (e.g. under tax or commercial law: up to 10 years) have expired, or until you request deletion. Routine enquiries without a contractual outcome are deleted within 12 months.

4. Job applications

If you apply for one of our open positions via the application form on a job-detail page or via email to [email protected], we process the data you submit for the purpose of the application procedure.

Data collected

• First and last name
• Email address
• Phone number (optional)
• Position applied for
• Cover message
• CV (PDF or DOCX, mandatory)
• Cover letter (PDF or DOCX, optional)
• Any further documents or photos you voluntarily provide as part of the CV (e.g. application photo)

Purpose: Selection of applicants for the relevant position and, where applicable, initiation and conclusion of an employment contract.

Legal basis: § 26(1) sentence 1 BDSG (Federal Data Protection Act) in conjunction with Art. 88 GDPR for processing in the context of an envisaged employment relationship; Art. 6(1)(f) GDPR for legitimate interests where applicable.

Recipients: Management and the persons involved in the hiring decision at 0-1 Group GmbH. Applications are transmitted via our email-service provider Resend (see section 6).

Storage period: If the application is unsuccessful, we delete your data no later than 6 months after notifying you of the rejection. This period covers the limitation period for claims under the General Equal Treatment Act (AGG § 15(4): 2 months for filing a claim plus an additional buffer). If you are hired, the data relevant to your employment becomes part of your personnel file; a separate privacy notice will be provided to you at that time.

If you would like us to keep your application on file for future opportunities, please tell us in writing — we will then ask for your express consent under Art. 6(1)(a) GDPR.

5. Cookies and local storage

We do NOT use tracking, analytics, marketing or third-party advertising cookies. We do not load Google Analytics, Meta Pixel, Hotjar or comparable services. We do not display a cookie banner because we do not set any cookies that require consent.

Technically necessary local storage

We use the browser's local storage (localStorage) to remember two of your preferences across page navigation:

• klimaone_lang — stores your language choice ("de" or "en") when you click the language toggle in the navigation.
• klimaone_dark — stores your light-/dark-mode choice when you click the mode toggle in the footer.

These entries are only created when you actively use the corresponding toggle and never on first page load. They are technically necessary for the service you have requested (your chosen language and theme) within the meaning of § 25(2) no. 2 TDDDG, and therefore do not require consent.

Cloudflare security cookies

Our hosting provider Cloudflare may set strictly-necessary cookies (e.g. __cf_bm, cf_clearance) for bot detection and DDoS protection. These cookies are essential for the security of the service and are exempt from consent under § 25(2) no. 2 TDDDG. Legal basis: Art. 6(1)(f) GDPR.

You can configure your browser to block cookies or to delete them after each session. This may limit some functions (e.g. you would lose your language preference between visits).

6. Processors and external service providers

We use the following service providers to operate this website. With each of them, we have either concluded a Data Processing Agreement (DPA, Art. 28 GDPR) or rely on their published standard DPA.

Cloudflare, Inc. (Hosting + CDN)

Cloudflare hosts and delivers this website via its global edge network and provides DDoS protection. Cloudflare may process data via servers in the United States.

• Provider: Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA
• Data processed: IP address, request headers, server logs (see section 2)
• Purpose: Hosting, content delivery, security
• Legal basis: Art. 6(1)(f) GDPR (legitimate interest)
• Transfer safeguard: EU-US Data Privacy Framework (DPF certification); Cloudflare DPA; Cloudflare Privacy Policy

Resend, Inc. (Transactional email)

We use Resend to send transactional emails — that is, notifications of contact-form submissions and job applications to our team, plus branded confirmation emails to you.

• Provider: Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA
• Data processed: Sender + recipient email address, message content, file attachments (CVs, cover letters)
• Purpose: Email delivery for contact-form and job-application notifications
• Legal basis: Art. 6(1)(b) GDPR (contact form, pre-contractual); § 26(1) BDSG (for job applications)
• Transfer safeguard: Standard Contractual Clauses (SCC); Resend DPA; Resend Privacy Policy

7. Transfer of data to third countries

Where data is transmitted to providers in the United States as described in section 6, the level of data protection has been ensured by one of the following safeguards required under Art. 44–49 GDPR:

• EU-US Data Privacy Framework (DPF) — for Cloudflare
• Standard Contractual Clauses (SCC) per Commission Implementing Decision (EU) 2021/914 — for Resend

Both Cloudflare and Resend additionally apply technical and organisational measures (encryption, access controls, etc.) to protect your data.

8. Storage period

We process personal data only for as long as necessary to achieve the purposes set out in this Privacy Policy, or as long as we are legally obliged to retain it. The specific storage periods for each processing activity are stated in the relevant sections above. Once the purpose ceases and no statutory retention period applies, the data is deleted.

9. Your rights as a data subject

Under the GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15) — you can request information about what personal data we process and receive a copy
• Right to rectification (Art. 16) — you can have inaccurate or incomplete data corrected
• Right to erasure (Art. 17) — you can request deletion of your data
• Right to restriction of processing (Art. 18) — you can request that processing be temporarily limited
• Right to data portability (Art. 20) — you can receive your data in a machine-readable format and have it transferred to another controller
• Right to object (Art. 21) — you can object to processing based on legitimate interest (Art. 6(1)(f) GDPR) for reasons relating to your particular situation
• Right to withdraw consent (Art. 7(3)) — where processing is based on consent, you can withdraw it at any time with effect for the future

To exercise your rights, please write to: [email protected]

10. Right to lodge a complaint

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement (Art. 77 GDPR). The competent supervisory authority for 0-1 Group GmbH is:

State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate
Hintere Bleiche 34
55116 Mainz
Phone: +49 6131 208-2449
Email: [email protected]
Web: www.datenschutz.rlp.de

11. Automated decision-making

We do not use any automated decision-making, including profiling, within the meaning of Art. 22 GDPR. Decisions about applications and enquiries are made by humans.

12. SSL/TLS encryption

This website uses TLS encryption for security and to protect the transmission of confidential content, such as the data you submit through the contact and job-application forms. You can identify an encrypted connection by the "https://" prefix in your browser's address bar and the lock icon. While SSL/TLS encryption is active, the data you submit cannot be read by third parties.

13. Currency of this policy and updates

This Privacy Policy reflects the state as of the date stated at the top. As our services or legal requirements evolve, we may update this Policy. The current version is always available at https://klima-one.com/datenschutz.