PRIVACY NOTICE FOR SUPPLIERS
We look forward to working with you. The protection of your personal data is very important to us. Below, we provide information on how we process personal data from suppliers, service providers, and their contacts in the context of our business relationship.
This privacy notice supplements our general privacy policy, which you can access on our website and which contains further information regarding the processing of personal data.
Last updated: June 10, 2026
1. JOINT CONTROLLERSHIP FOR DATA PROCESSING and processing on behalf of
Within the group’s internal structure, the purchasing department can serve as a central support function for affiliated companies. The purchasing department may carry out certain procurement processes (e.g., requests for quotes, purchase orders, and supplier communication) on behalf of or in the legitimate interest of other group companies.
In this context, it may be necessary to exchange and use supplier, contact, and communication data among the participating companies within the corporate group, to the extent that this is necessary for the initiation, execution, and completion of procurement processes.
Personal data of suppliers and their contacts may be processed by any of the companies listed above—depending on the respective organizational responsibilities—to the extent necessary for establishing, conducting, and managing the business relationship.
Depending on the specific nature of the collaboration, the processing of personal data takes place either under joint controllership pursuant to Article 26 of the GDPR or—in the case of processing on behalf of another party—on the basis of a data processing agreement pursuant to Article 28 of the GDPR between the following companies:
- H2APEX Energy GmbH
- HydroExceed GmbH
- AKROS Energy GmbH
In both cases, appropriate contractual agreements as well as technical and organizational measures ensure that the protection of personal data and compliance with data protection requirements are guaranteed.
We will be happy to provide you with the key provisions of the agreement on joint controllership within the meaning of Article 26 of the GDPR or—where applicable—the data processing agreement pursuant to Article 28 of the GDPR upon request.
Contact information for the joint controllers:
H2APEX Energy GmbH
Hans-Adam-Allee 1, 18299 Rostock-Laage
Email: click here
HydroExceed GmbH
Hans-Adam-Allee 1, 18299 Rostock-Laage
Email: click here
AKROS Energy GmbH
Hans-Adam-Allee 1, 18299 Rostock-Laage
Email: click here
2. CONTACT INFORMATION FOR THE DATA PROTECTION OFFICER
Hans-Adam-Allee 1
18299 Rostock-Laage
Phone: +49 381 799902-313
Email: click here
3. TYPE OF DATA PROCESSED AND PURPOSES OF PROCESSING
We process personal data that we receive in connection with the establishment, conduct, and termination of our business relationship with suppliers.
As part of our collaboration with suppliers, we process the following personal data of the relevant contacts in particular:
- First and last name
- E-mail address
- Position within the company
- Phone number
- Salutation
- Cell phone number
- Correspondence and
- Communication content (e.g., emails)
The data is processed, in particular, for the following purposes:
- Correspondence and communication with suppliers, including contacts at suppliers, service providers, and subcontractors
- Initiating, arranging, and processing orders of all kinds,
including requests for quotes, quote review, order placement, delivery, and billing - Contract management, specifically the creation, management, and archiving of contract documents, proposals, agreements, and other business-related documents
- Management and preparation of receipt and handover documents, in particular
acceptance and handover reports, and proof of delivery and service - Processing of contact information, in particular contact information for supplier representatives and lists of drivers, to the extent that such information is necessary for delivery, pickup, or handover processes
- Creation, maintenance, and management of supplier and contact data in the ERP system (
), including master data management, ordering, and billing processes - Compliance with legal obligations, in particular commercial, tax, and record-keeping requirements
- Organization and safeguarding of internal business processes, including documentation, record-keeping, and monitoring requirements
- Supplier evaluation and development (e.g., quality, on-time delivery, performance)
- Credit checks on suppliers, particularly to assess their financial standing, evaluate risk, and determine whether to establish, conduct, or continue business relationships
- Conducting compliance reviews, audits, and internal and external controls
- Risk Assessment and Monitoring in the Context of Supplier Management
4. LEGAL BASIS FOR PROCESSING
The processing of personal data is based on the following legal grounds:
- Art. 6(1)(b) of the GDPR (performance of a contract or implementation of pre-contractual measures)
- Art. 6(1)(c) of the GDPR (Compliance with legal obligations)
- Art. 6(1)(f) of the GDPR (legitimate interests, e.g., efficient business operations, internal organization, documentation)
5. SOURCES OF DATA
We process personal data that you provide to us directly or that is generated in the course of our business relationship (e.g., in connection with orders, deliveries, or acceptance of goods).
6. RECIPIENTS OF THE DATA
Personal data is shared within our company only with those departments that need it to fulfill the stated purposes.
In addition, data may be transferred to:
- our affiliated companies,
- external service providers (processors under Article 28 of the GDPR), such as IT service providers, ERP system providers,
- Government agencies and public authorities, where there is a legal obligation to do so.
7. TRANSFER TO A THIRD COUNTRY
As a general rule, we do not intend to transfer personal data to countries outside the European Union or the European Economic Area.
If such a transfer occurs in individual cases, it is carried out in compliance with the provisions of Art. 44 et seq. of the GDPR (e.g., standard contractual clauses).
8. DATA RETENTION PERIOD
We retain personal data only for as long as is necessary for the purposes stated or as required by legal retention obligations. Once the purpose no longer applies or the legal retention periods have expired, the data will be deleted.
9. RIGHTS OF DATA SUBJECTS
You have the right to:
- Right of access (Art. 15 of the GDPR)
- Rectification (Art. 16 of the GDPR)
- Erasure (Art. 17 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Data Portability (Art. 20 GDPR)
- Right to object (Art. 21 GDPR)
In addition, you have the right to file a complaint with a data protection supervisory authority (Art. 77 GDPR).
10. REQUIREMENT TO PROVIDE PERSONAL DATA
The provision of personal data is necessary for the conduct of our business relationship. Without this data, it is not possible to properly process orders and contracts.
11. AUTOMATED DECISION-MAKING
No automated decision-making within the meaning of Article 22 of the GDPR takes place.
12. CHANGES TO THIS PRIVACY POLICY
We reserve the right to update this privacy policy as necessary to reflect changes in legal or organizational requirements.