Privacy Policy

Logo

1. Name and contact details of the controller

The controller within the meaning of the General Data Protection Regulation (GDPR) and other applicable data protection laws for the LIHYP Networking Platform is:

Energy Hub Emsland Entwicklungsgesellschaft mbH

Kaiserstraße 10b

49809 Lingen (Ems)

Germany

Phone: +49 591 14050260

Email: info@energy-hub-emsland.de

2. Scope and purposes of data processing on the LIHYP Networking Platform

2.1 Platform use and registration

The LIHYP Networking Platform allows users to register accounts, manage basic profile information, and optionally submit information on hydrogen-related projects, infrastructure and services. For this purpose, we process personal data that you provide via the registration and input forms.

2.2 Categories of personal data

In particular, the following categories of data may be processed:

  • Name (e.g. contact person)
  • Email address (used as login and contact channel)
  • Company or organisation name
  • Information about hydrogen projects, infrastructure, services or locations provided by you via the platform (e.g. project title, description, location data)
  • Roles/permissions within the platform (e.g. company owner/member status)
  • Invitation and membership request metadata (e.g. request status, timestamps)
  • Technical usage data (see section 4 below)

2.3 Purposes of processing

We process the above personal data for the following purposes:

  • Provision and operation of the LIHYP Networking Platform
  • Creation and administration of user accounts
  • Display and management of hydrogen-related projects, infrastructure and services on the map-based platform
  • Communication with registered users regarding their entries and the platform
  • Ensuring the security and stability of the technical systems

3. Legal bases for processing

We process personal data on the LIHYP Networking Platform on the basis of the following legal grounds in accordance with Art. 6 GDPR:

  • Art. 6 (1) lit. a GDPR – processing based on your consent, for example when you provide information voluntarily via a project or contact form.
  • Art. 6 (1) lit. b GDPR – processing necessary for the performance of a contract or for steps prior to entering into a contract, e.g. when creating and maintaining a user account.
  • Art. 6 (1) lit. f GDPR – processing based on our legitimate interests, such as ensuring the secure and reliable operation of the platform, preventing misuse, and documenting platform usage in a basic, non-marketing-related way.

4. Technical usage data and server log files

When you access the LIHYP Networking Platform, our systems automatically process certain technical data to ensure the secure operation of the service. This includes:

  • IP address of the requesting device
  • Date and time of access
  • Requested pages or API resources
  • Information about browser type and version
  • Information about the operating system used

These log files are processed to ensure the functionality, security and stability of the platform. The legal basis is our legitimate interest pursuant to Art. 6 (1) lit. f GDPR. Log data is stored for up to 30 days and then deleted or anonymised, unless longer retention is required in specific cases (e.g. for the clarification of security incidents).

5. User accounts and hydrogen project data

5.1 Registration and authentication

To register for the LIHYP Networking Platform, you are asked to provide at least your email address and company or organisation name. Your email address is used as your login identifier and may be used to send technical or platform-related notifications (e.g. onboarding information or important service messages).

Providing your email address is required to create an account. Without it, registration is not possible. Other profile and project information is voluntary unless marked as required in the relevant form; without required fields, the respective entry cannot be submitted or published.

Passwords are stored only in hashed form (with salt and state-of-the-art hashing algorithms). We cannot view passwords in plain text.

Please note: Your email address may become visible to other users in certain contexts, in particular to company owners when you submit a join request to their company profile. For details, see section 12 below.

5.2 Project, infrastructure and service entries

Registered users can create and manage entries on hydrogen projects, infrastructure, services and related activities. Depending on the respective form, these entries may contain project titles, descriptions, classification along the hydrogen value chain, location data (e.g. map coordinates), and contact persons or organisations.

These data are stored in our databases and displayed on the map-based platform where appropriate. Please ensure that you only submit information that may be used for this purpose and that you are authorised to provide.

6. Contact and support requests

If you contact us via a contact form or by email, we process the data you provide (e.g. name, email address, content of your message) solely for the purpose of processing and answering your request.

Depending on the nature of your request, the legal basis is either your consent (Art. 6 (1) lit. a GDPR), the performance of pre-contractual or contractual measures (Art. 6 (1) lit. b GDPR), or our legitimate interest in responding to enquiries (Art. 6 (1) lit. f GDPR).

7. Recipients of personal data and hosting

7.1 General information

We may involve external service providers for the technical operation, hosting and maintenance of the LIHYP Networking Platform. These service providers act as contract processors and are bound by strict instructions in accordance with Art. 28 GDPR. They process personal data only as necessary to provide their services and in compliance with applicable data protection requirements.

Personal data is not transferred to third parties for marketing purposes. Data may be transmitted to authorities or other public bodies if we are legally obliged to do so.

7.2 Mapbox (map services and geocoding)

The LIHYP Networking Platform uses services provided by Mapbox, Inc., 740 15th Street NW, 5th Floor, Washington, DC 20005, USA ("Mapbox") for displaying interactive maps and for geocoding (address search and location lookup).

When you use the map or geocoding features on our platform, requests are sent to Mapbox. This may include your IP address, device information, and search queries (e.g. addresses or place names). Depending on the configuration and features used, Mapbox may use cookies or similar technologies to provide and protect its services.

Mapbox processes this data in accordance with Mapbox’s own privacy documentation and may act as an independent controller for certain processing operations related to the provision, security and improvement of its services. For more information, please refer to Mapbox's privacy policy at: https://www.mapbox.com/legal/privacy

Data may be transferred to the United States. Mapbox participates in the EU-U.S. Data Privacy Framework; the transfer is therefore based on an adequacy decision by the European Commission in accordance with Art. 45 GDPR.

The legal basis for using Mapbox is our legitimate interest in providing an interactive, map-based platform pursuant to Art. 6 (1) lit. f GDPR, as well as Art. 6 (1) lit. b GDPR where the map is essential for the contractual use of the platform.

7.3 Cloud storage for media files

User-uploaded media files (e.g. images for project entries) are stored using S3-compatible cloud storage services. These service providers process data exclusively on our behalf and in accordance with our instructions pursuant to Art. 28 GDPR. Storage locations are within the European Union or in countries with an adequate level of data protection as determined by the European Commission.

7.4 Email service provider

We use an email service provider (SMTP relay) to send transactional emails, including verification codes, password resets, and invitation links. The email addresses and message content are transmitted to the provider solely for the purpose of email delivery. Our email service provider processes data on our behalf in accordance with Art. 28 GDPR.

8. Storage period and deletion of data

We store personal data only for as long as necessary to fulfil the respective purposes described in this Privacy Policy or as required by statutory retention obligations.

  • Account data is stored for the duration of your registration on the platform. You can request deletion of your account in accordance with section 9.
  • Project and infrastructure entries are stored as long as they are published or administratively required for the purposes of the platform.
  • Contact and support requests are stored for the duration of processing and subsequently within the framework of applicable retention periods.
  • Technical log data is stored for up to 30 days and then deleted or anonymised, unless further storage is required for the clarification of specific incidents.

9. Your rights as a data subject

As a data subject within the meaning of the GDPR, you have the following rights with regard to the processing of your personal data:

  • Right of access (Art. 15 GDPR)
  • Right to rectification (Art. 16 GDPR)
  • Right to erasure (Art. 17 GDPR)
  • Right to restriction of processing (Art. 18 GDPR)
  • Right to data portability (Art. 20 GDPR)
  • Right to object to processing (Art. 21 GDPR)
  • Right to withdraw consent at any time with effect for the future (Art. 7 (3) GDPR)
  • Right to lodge a complaint with a supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence, place of work or place of the alleged infringement.

To exercise your rights, you can contact us at the contact details given in section 1.

9.1 Automated decision-making and profiling

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

10. Data security and changes to this Privacy Policy

We take appropriate technical and organisational measures to protect your personal data against loss, misuse, unauthorised access and alteration. However, no Internet-based transmission or storage system is completely secure.

We may update this Privacy Policy from time to time to reflect changes in legal requirements, our processing activities or the functionalities of the platform. The currently valid version is available at any time via the LIHYP Networking Platform.

11. Cookies and local storage

11.1 Authentication cookies (strictly necessary)

The LIHYP Networking Platform uses a small number of cookies (or comparable technologies) that are strictly necessary to provide the service, enable sign-in, and secure user sessions. These cookies:

  • store an encrypted session token (JWT) after sign-in
  • enable secure requests to protected areas of the platform
  • are not used for tracking or analytics purposes
  • expire automatically after a short period or when you sign out

These cookies are required for the operation of the platform and therefore do not require separate consent under applicable cookie rules (e.g. TTDSG/ePrivacy) where they are strictly necessary to provide the service. The related processing of personal data is based on Art. 6 (1) lit. f GDPR (legitimate interest in operating a secure service) and, where applicable, Art. 6 (1) lit. b GDPR (performance of the user contract). Without these cookies, the platform’s login-related features cannot be used.

11.2 Local storage (session time indicator)

The platform stores a single timestamp in your browser’s local storage to visually display the remaining session duration (“time left until logout”). This value:

  • is used only on your device for convenience
  • is not transmitted to our servers
  • resets automatically when the session expires or you sign out

Depending on the context, such a value can be considered personal data (e.g. in connection with an authenticated session). However, we use it purely for this functional display on your device.

11.3 No analytics, tracking or advertising cookies

The LIHYP Networking Platform does not use:

  • tracking cookies
  • analytics cookies
  • advertising or profiling tools

Your activity on the platform is not tracked for marketing or behavioural analysis. Please note that third-party technologies required to deliver core functionality (e.g. Mapbox map delivery as described in section 7.2) may involve cookies or similar technologies depending on configuration and features used.

12. Company membership, join requests and disclosure of email addresses

12.1 Company registration and ownership

When you register on the LIHYP Networking Platform and provide a company or organisation name, you may become the "owner" of that company profile if no other user has previously registered or claimed it. As an owner, you are granted administrative privileges over the company profile, including the ability to manage members, approve or reject join requests, and send invitations.

Important: We do not verify the actual affiliation or authorisation of a user to represent a company. If you believe that your company has been registered or claimed by an unauthorised person, please contact us immediately at info@lihyp.eu.

12.2 Join requests and disclosure of your email address to company owners

If you submit a "join request" to become a member of a company profile on this platform, your email address will be disclosed to the owner(s) of that company profile. This is necessary to enable the owner to identify the requesting person and to decide whether to approve or reject the request.

After disclosure, the company owner(s) process your email address as independent controllers. The platform operator cannot control how the company owner(s) may use or store your email address outside the platform.

The legal basis for this disclosure is Art. 6 (1) lit. b GDPR (processing necessary for the performance of the platform membership features and for steps prior to entering into a contract).

12.3 Invitations sent by company owners

Company owners can invite new users to join their company by providing an email address and sending an invitation. If you receive such an invitation, your email address was provided to the platform by the inviting company owner. The platform sends the invitation on behalf of the company owner.

12.4 Limitation of platform operator's liability

The platform operator (Energy Hub Emsland Entwicklungsgesellschaft mbH) provides the technical infrastructure for company profiles, memberships, and join requests. However, the platform operator is not responsible for:

  • The accuracy of company registrations or the legitimacy of ownership claims
  • The actions of company owners after receiving your email address via join requests
  • The use of your personal data by other registered users or company owners outside of the platform

We recommend that you only submit join requests to companies whose owners you trust or can verify. If you suspect misuse of your data by another user or company owner, please report it to us at info@lihyp.eu.

13. International data transfers

As described in section 7.2, certain data may be transferred to the United States when using Mapbox map and geocoding services. This transfer is based on the adequacy decision by the European Commission regarding the EU-U.S. Data Privacy Framework.

We do not transfer personal data to other third countries outside the European Economic Area (EEA) unless an adequate level of data protection is ensured or appropriate safeguards (e.g. Standard Contractual Clauses) are in place.

14. Contact for data protection enquiries

For any questions or concerns regarding data protection on the LIHYP Networking Platform, or to exercise your rights under the GDPR, please contact:

Energy Hub Emsland Entwicklungsgesellschaft mbH

Data Protection Enquiries

Kaiserstraße 10b

49809 Lingen (Ems)

Germany

15. Version and effective date

This Privacy Policy was last updated on 20 January 2026 and is effective as of this date.