Privacy policy

1. In brief

• We do not use any analytics or tracking tools and no advertising.
• Fonts are served from our own server; no third-party content (e.g. Google Fonts, maps, videos) is embedded.
• We only use technically necessary cookies – that is why there is no cookie banner.
• Your data is stored in the European Union.

2. Visiting the website and server logs

When you visit this website, your browser transmits technically necessary data: IP address, date and time, the page requested, browser and operating system, and the previously visited page. The IP address is only used to deliver the page and to fend off attacks.

Server logs are stored without the IP address in plain text and deleted after 30 days at the latest.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the secure and stable operation of the website.

3. Enquiries and appointment requests

If you send us an enquiry or appointment request via a form, we process the information you provide there:

• name
• contact details (phone number, email address)
• vehicle details (e.g. make, model, licence plate)
• photos you upload
• your message and the requested appointment

We use this data to handle your enquiry, prepare a quote or arrange an appointment. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures and performance of a contract).

Photos may show your vehicle’s licence plate. They are visible to us only and are not published.

To protect against abuse, forms may use the Cloudflare Turnstile service. It checks technical characteristics of the browser to tell whether a request comes from a human and does not set tracking cookies. The legal basis is Art. 6(1)(f) GDPR (protection against spam and abuse).

4. Cookies and local storage

We only use technically necessary cookies: a session cookie when you sign in (e.g. to the customer area). It contains a random identifier, is deleted when you sign out and expires after 30 days of inactivity at the latest.

So that the website can also start offline, your browser stores program files of the site (service worker); these contain no personal data.

The legal basis is § 25(2) no. 2 TDDDG; subsequent processing is based on Art. 6(1)(b) and (f) GDPR. No consent is required, which is why we do not show a cookie banner.

5. Notification of new enquiries

We are notified of new enquiries via the Telegram messenger. The notification only contains what is needed for a quick reply (e.g. your name and the type of enquiry); the full enquiry stays in our system.

The provider is Telegram FZ-LLC, Dubai, United Arab Emirates. There is no adequacy decision of the EU Commission for this country. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is handling your enquiry promptly.

6. Recipients and processors

We only share your data with service providers who process it on our behalf and according to our instructions:

The website, forms and customer area run on the HourPick platform. The platform is operated by a sole proprietor based in Ukraine, who processes the data as a processor under a contract pursuant to Art. 28 GDPR. Data is stored in the EU: our business’s database with an EU storage location, photos and files in storage located in the EU.

The sub-processor for hosting, delivery and protection of the website is Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Data is stored in the EU. Cloudflare, Inc. is certified under the EU-US Data Privacy Framework; the EU Commission’s standard contractual clauses also apply.

Where the platform operator accesses data from a country outside the EU for operation and support, this is based on the EU Commission’s standard contractual clauses (Art. 46(2)(c) GDPR).

7. Storage period

• Enquiries: until they are dealt with, then for 12 more months for follow-up questions.
• Invoices and accounting records: 10 years (§ 147 AO, § 257 HGB).
• Server logs: 30 days at most.
• Database backups: overwritten after 30 days.

8. Your rights

You have the right at any time to:

• access your stored data (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• withdraw consent with effect for the future (Art. 7(3) GDPR)

You may also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your habitual residence, place of work or place of the alleged infringement. To exercise your rights, a message to the contact details above is enough.

9. Right to object

Where we process data on the basis of Art. 6(1)(f) GDPR, you may object to this processing at any time on grounds relating to your particular situation (Art. 21 GDPR).

10. Obligation to provide data, automated decisions

Providing your data is voluntary. Without contact details, however, we cannot answer your enquiry.

There is no automated decision-making, including profiling.