Legal Privacy

Privacy policy

The legally binding version is the German Datenschutzerklärung. This website sets no cookies, uses no analytics or advertising tools and loads fonts, images and scripts from its own server only.

1. Controller

eXo GmbH, represented by its managing director Thomas Räck
Jakob-Krebs-Straße 99, 47877 Willich‑Anrath, Germany
Phone +49 2156 90 98 930, email info@exo.AG

2. Hosting and server logs

The website is hosted on Cloudflare Pages (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA). When you open a page, Cloudflare processes technically necessary connection data (IP address, date and time, requested address, amount of data, referrer, browser and system information) to deliver the page, keep it stable and secure and fend off attacks. Legal basis is our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR). Cloudflare is certified under the EU-US Data Privacy Framework (Art. 45 GDPR). The technical operation of the website is entrusted to an IT service provider acting as our processor, who uses Cloudflare as a further processor. Cloudflare processes the data only to provide these services and keeps it only as long as necessary for that purpose; we do not analyse or store server logs ourselves.

In addition, your browser may send reports on failed connections to Cloudflare via the Network Error Logging feature set by Cloudflare, for example time, requested address, type of error and IP address. Successful requests are not reported. The reports serve solely the stability and error analysis of the network; the legal basis is again our legitimate interest (Art. 6(1)(f) GDPR).

3. Cookies, analytics and fonts

No cookies, no tracking, no reach measurement, no advertising. All fonts are served from our own server.

4. Contact by email, phone, WhatsApp and enquiry forms

If you contact us, we process the details you provide (such as name, company, email address, phone number and your request) to answer your enquiry and, where applicable, to prepare an offer or contract (Art. 6(1)(b) GDPR; otherwise Art. 6(1)(f) GDPR). The enquiry forms on this website do not transmit anything to a server: when you send, your own email program opens with a prepared message to info@exo.AG, which you check and send yourself. We delete the data once your request is settled, unless statutory retention periods apply.

If you write to us via the WhatsApp link, WhatsApp Ireland Limited (Merrion Road, Dublin 4, D04 X2K5, Ireland) also processes your message under its own terms; a transfer to Meta Platforms, Inc. in the USA is possible. Using WhatsApp is voluntary.

5. Online applications with PDF generation

The DUB membership application, the consulting mandate and the application documents in the partner area are filled in and signed in your browser. The PDF is created on your device only; entries, signature and PDF are neither transmitted nor stored through the website. You download or share the PDF yourself.

6. Partner area

The partner area is protected by user name and password. The credentials are only processed to check access and are not stored, apart from the server logs under section 2 (Art. 6(1)(f) GDPR).

7. YouTube videos (two-click solution)

On the funding page we show a video by Energie Audit Deutschland hosted on YouTube. Until you click, only a preview image from our own server is shown and there is no connection to YouTube. Only when you click “Load and play video” does your browser load the video via YouTube's privacy-enhanced mode (youtube-nocookie.com), provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data such as your IP address, browser information and the page visited are then transferred to YouTube; a transfer to Google servers in the USA is possible. Legal basis is your consent by clicking (Art. 6(1)(a) GDPR, section 25(1) TDDDG).

8. Links to other websites

We link to our partners' websites (for example Energie Audit Deutschland, Deutscher Unternehmer Bund, eXoFee, esos24). Their own privacy policies apply once you follow such a link.

9. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20), and you may withdraw consent at any time with effect for the future (Art. 7(3)). Right to object: where we process data on the basis of legitimate interest, you may object at any time on grounds relating to your particular situation (Art. 21 GDPR). An informal message to info@exo.AG is sufficient. You may also lodge a complaint with a supervisory authority (Art. 77 GDPR), for example the data protection commissioner of North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2-4, 40213 Düsseldorf, Germany.

10. No obligation, no automated decisions

You are not obliged to provide personal data, but we cannot answer an enquiry without contact details. There is no automated decision-making or profiling.

Last updated: October 2026