Privacy Policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

2. Hosting and technical infrastructure

Website (Vercel). The website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. On each access, Vercel processes the connection data technically required for delivery and for ensuring operational security (IP address, date and time of access, resource requested, browser and device identifier) in server log files. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest lies in the secure and stable provision of the service. The log files are deleted automatically after a short period. Vercel is certified under the EU-U.S. Data Privacy Framework; in addition, EU Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR have been concluded.

Database (Supabase). The data collected in connection with the waitlist is processed in a database operated by Supabase Inc., 970 Toa Payoh North #07-04, Singapore, as a processor pursuant to Art. 28 GDPR. The storage location is exclusively the eu-central-1 region (Frankfurt am Main, Germany). A data processing agreement is in place; EU Standard Contractual Clauses have been concluded for any access from third countries.

Email delivery (Resend). Resend (Resend, Inc., 2261 Market Street, San Francisco, CA 94114, USA) acts as processor for sending the confirmation and information emails of the waitlist. Delivery takes place via infrastructure in the European Union (Ireland). The sender addresses are noreply@send.4000watt.com for the waitlist and website@send.4000watt.com for the contact form; all system-generated emails are sent via the subdomain send.4000watt.com. Any transfer to the USA is based on EU Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR.

Email communication (IONOS). The email mailboxes are operated by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany, as a processor in data centers located in Germany.

3. Website access and reach measurement

Cookies. No cookies are used on this website for analytics or advertising purposes. A consent banner is therefore not required.

Reach measurement. No reach or access measurement takes place. No visitor profiles are created and no analytics or tracking services are embedded. The only evaluation concerns which campaign a waitlist sign-up came from (Section 4).

4. Waitlist and product information

Upon sign-up to the waitlist, the email address is processed for the purpose of providing notification of the market launch of 4000Watt, sending the associated promo code, and providing product information at irregular intervals. In addition, the language selected on the website is stored in order to send the communications in that language.

Double opt-in. The sign-up becomes effective only upon confirmation via the link sent by email. The confirmation link is valid for 48 hours. If no confirmation is given, the entry is not used for communications.

Proof of consent. In order to demonstrate that consent was validly given, the time, IP address, and browser identifier of both the sign-up and the confirmation are logged. The legal basis for this is Art. 6(1)(c) GDPR in conjunction with the accountability obligation under Art. 5(2) GDPR.

Origin of the sign-up. The campaign details contained in the address used to access the site (utm_source, utm_medium, utm_campaign, utm_content) are stored with the sign-up, together with the form used. The purpose is to evaluate which advertising measures lead to sign-ups. Nothing is stored on the device for this purpose. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest lies in evaluating our own advertising measures.

Dispatch log of the confirmation email. A log entry is stored for the confirmation email that was sent, comprising the recipient address, subject, type and time of the message, but not its content. It evidences that and when the message went out. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest lies in being able to trace dispatch. The entry is stored until the end of the third calendar year following dispatch and is then deleted automatically; it is retained even after consent has been withdrawn.

Protection against automated sign-ups. In order to prevent abusive bulk sign-ups, the IP address of the submission is stored for a maximum of one hour and used to limit the number of sign-ups per sender. It is deleted automatically thereafter. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest lies in the protection against abuse and in avoiding unsolicited confirmation emails to third-party addresses.

Legal basis and withdrawal. The legal basis for processing for information purposes is consent pursuant to Art. 6(1)(a) GDPR. Consent may be withdrawn at any time with effect for the future via the unsubscribe link contained in every email. The entry is deleted in full in that case; only the log entry for the confirmation email that was sent is retained.

Signing up to the waitlist does not establish a contractual relationship and entails no obligation. No payment data is collected in this context.

5. Contact

When contact is made by email (in particular to support@4000watt.com), the information provided is processed for the purpose of handling the inquiry. The legal basis is Art. 6(1)(b) GDPR where the inquiry relates to a contractual relationship or its initiation, and otherwise Art. 6(1)(f) GDPR. The correspondence is deleted once the inquiry has been conclusively handled and no statutory retention obligations apply.

6. Contact form

Data submitted through the contact form on 4000watt.com is used solely to process the request.

Data processed: name, email address, subject, message text, language of the request, and time of submission.

The legal basis is Art. 6(1)(b) GDPR where the request serves the initiation or performance of a contract. In all other cases Art. 6(1)(f) GDPR applies – the legitimate interest in responding to requests.

Submission is delivered as an email to support@4000watt.com. The sender address is website@send.4000watt.com. Resend acts as processor for delivery in accordance with Section 2. The mailbox is operated by IONOS SE, Montabaur, Germany.

To prevent automated submissions, the IP address is processed exclusively as a cryptographic hash and deleted after ten minutes. The legal basis is Art. 6(1)(f) GDPR – the legitimate interest in preventing abuse. The IP address is neither transmitted with the message nor stored.

The request is not stored in the 4000Watt database. The message remains in the mailbox and is deleted once the request has been conclusively handled and no statutory retention obligations apply, at the latest after 24 months.

Name and email address are required in order to answer the request. Without them no reply is possible. A request may alternatively be sent directly by email to support@4000watt.com.

An email address submitted through the contact form is not added to the waitlist. The two processes are independent of each other.

7. Storage periods and deletion

Personal data is stored only for as long as necessary for the stated purposes or as required by statutory retention obligations. In detail:

• Waitlist addresses including evidentiary data and origin details: until consent is withdrawn.
• Unconfirmed sign-ups: deleted at the latest 30 days after the confirmation link expires.
• Dispatch log of the confirmation email: until the end of the third calendar year following dispatch, irrespective of any withdrawal of consent.
• IP addresses for abuse prevention: a maximum of one hour.
• Server log files: a short period in accordance with Section 2.
• Email correspondence including form requests: until the request has been concluded, at the latest 24 months.
• Hash values of the IP address from the contact form: ten minutes.

8. Rights of data subjects

Data subjects have the rights of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), and data portability (Art. 20 GDPR). Processing based on Art. 6(1)(f) GDPR is subject to the right to object under Art. 21 GDPR. Consent given may be withdrawn at any time with effect for the future pursuant to Art. 7(3) GDPR; the lawfulness of processing carried out prior to withdrawal remains unaffected. An email to support@4000watt.com is sufficient to exercise these rights.

Furthermore, pursuant to Art. 77 GDPR, there is a right to lodge a complaint with a data protection supervisory authority. The supervisory authority competent for the controller is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, https://www.ldi.nrw.de.

9. Changes to this privacy policy

This privacy policy will be amended whenever the data processing or the legal situation changes. The version published at https://4000watt.com/datenschutz is authoritative.