Privacy policy

The following notes give a simple overview of what happens to your personal data when you visit this website. Personal data are any data by which you can be personally identified. Detailed information on data protection can be found in our privacy policy set out below this text.

The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy.

When you use this website, various personal data are collected. Personal data are data by which you can be personally identified. This privacy policy explains which data we collect and what we use them for. It also explains how and for what purpose this happens.

Please note that data transmitted over the internet (for example when communicating by e-mail) may be subject to security gaps. Complete protection of data against access by third parties is not possible.

The party responsible for data processing on this website is:

The responsible party is the natural or legal person who, alone or jointly with others, decides on the purposes and means of processing personal data (for example names, e-mail addresses or the like).

Unless a more specific storage period is stated in this privacy policy, your personal data remain with us until the purpose for which they were processed no longer applies. If you assert a justified request for erasure or withdraw your consent to data processing, your data will be erased unless we have other legally permissible reasons for storing your personal data (for example retention periods under tax or commercial law); in the latter case, the data will be erased once those reasons cease to apply.

If you have consented to data processing, we process your personal data on the basis of Art. 6(1)(a) GDPR or, where special categories of data under Art. 9(1) GDPR are processed, Art. 9(2)(a) GDPR. In the case of explicit consent to the transfer of personal data to third countries, the processing is also based on Art. 49(1)(a) GDPR. If you have consented to the storage of cookies or to access to information on your device (for example via device fingerprinting), the processing is additionally based on Section 25(1) TDDDG. Consent can be withdrawn at any time. If your data are required to perform a contract or to take pre-contractual steps, we process them on the basis of Art. 6(1)(b) GDPR. We also process your data where this is necessary to comply with a legal obligation, on the basis of Art. 6(1)(c) GDPR. Processing may also be based on our legitimate interest under Art. 6(1)(f) GDPR. The legal bases that apply in each individual case are set out in the following paragraphs of this privacy policy.

In the course of our business we work with various external bodies. In some cases this requires personal data to be transferred to them. We pass personal data on to external bodies only where this is necessary to perform a contract, where we are legally obliged to do so (for example passing data on to tax authorities), where we have a legitimate interest in doing so under Art. 6(1)(f) GDPR, or where another legal basis permits it. Where we use processors, we pass our customers' personal data on to them only on the basis of a valid data processing agreement. In the case of joint processing, a joint processing agreement is concluded.

Many data processing operations are only possible with your express consent. You can withdraw consent you have already given at any time. The withdrawal does not affect the lawfulness of the processing carried out before it.

IF THE DATA PROCESSING IS BASED ON ART. 6(1)(E) OR (F) GDPR, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT TO THE PROCESSING OF YOUR PERSONAL DATA ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION; THIS ALSO APPLIES TO PROFILING BASED ON THESE PROVISIONS. THE LEGAL BASIS ON WHICH ANY PROCESSING RELIES CAN BE FOUND IN THIS PRIVACY POLICY. IF YOU OBJECT, WE WILL NO LONGER PROCESS THE PERSONAL DATA CONCERNED UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS, OR THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS (OBJECTION UNDER ART. 21(1) GDPR).

IF YOUR PERSONAL DATA ARE PROCESSED FOR DIRECT MARKETING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR SUCH MARKETING; THIS ALSO APPLIES TO PROFILING TO THE EXTENT THAT IT IS RELATED TO SUCH DIRECT MARKETING. IF YOU OBJECT, YOUR PERSONAL DATA WILL NO LONGER BE USED FOR DIRECT MARKETING (OBJECTION UNDER ART. 21(2) GDPR).

In the event of breaches of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the member state of their habitual residence, their place of work or the place of the alleged breach. This right exists without prejudice to any other administrative or judicial remedies.

You have the right to have data that we process automatically on the basis of your consent or in performance of a contract handed over to you or to a third party in a common, machine-readable format. If you request the direct transfer of the data to another controller, this will only be done where it is technically feasible.

Within the scope of the applicable statutory provisions, you have the right at any time to obtain information free of charge about your stored personal data, their origin and recipients and the purpose of the processing and, where applicable, the right to have these data corrected or erased. You can contact us at any time about this and any other questions on personal data.

You have the right to request that the processing of your personal data be restricted. You can contact us about this at any time. The right to restriction of processing applies in the following cases:

• If you dispute the accuracy of the personal data we hold about you, we usually need time to check this. For the duration of the check, you have the right to request that the processing of your personal data be restricted.
• If the processing of your personal data was or is unlawful, you can request that it be restricted instead of erased.
• If we no longer need your personal data but you need them to exercise, defend or assert legal claims, you have the right to request that their processing be restricted instead of their being erased.
• If you have lodged an objection under Art. 21(1) GDPR, your interests and ours must be weighed against each other. As long as it has not been established whose interests prevail, you have the right to request that the processing of your personal data be restricted.

If you have restricted the processing of your personal data, these data — apart from being stored — may only be processed with your consent, for the establishment, exercise or defence of legal claims, for the protection of the rights of another natural or legal person, or for reasons of important public interest of the European Union or of a member state.

This website is not run on our own servers but with an external hosting provider. The provider processes the data arising when pages are requested solely on our behalf and on our instructions. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in providing the website securely and reliably.

• TODO (owner): enter the hosting provider's company name and full address once it has been chosen.
• TODO (owner): conclude a data processing agreement under Art. 28 GDPR with the hosting provider before launch.
• TODO (owner): check whether the provider processes data outside the EU or EEA and adjust the section on third-country transfers accordingly.

When you open this website, your browser automatically transmits technical data which the web server records in what are known as server log files. These are:

• the IP address of the requesting device
• the date and time of access
• the name and address of the file requested
• the volume of data transferred and confirmation of successful retrieval
• browser type, browser version and the operating system used
• the referrer URL, that is, the page visited previously
• TODO (owner): ask the hosting provider for the actual log retention period once the data processing agreement is in place, and enter it here.

These data serve only to deliver the website, to investigate faults and to keep our IT systems secure. They are not combined with other data sources, are not used to build usage profiles and are not analysed in order to recognise individual visitors. The legal basis is Art. 6(1)(f) GDPR.

For security reasons and to protect the transmission of confidential content, this website uses SSL/TLS encryption. You can recognise an encrypted connection by the address bar of your browser changing from “http://” to “https://” and by the padlock symbol.

While encryption is active, the data you send us cannot be read by third parties.

• TODO (owner): make sure the hosting provider supplies a valid TLS certificate and that requests to “http://” are permanently redirected to “https://”.

You can send us an enquiry using the contact form on this website. The following details, which you enter yourself, are processed, together with one technical value used to protect the form against automated bulk submissions and explained in the section “Protecting the contact form against abuse”:

• name (required)
• e-mail address (required)
• telephone number (optional)
• vehicle, for example model and year (optional)
• subject (required)
• message (required)

We use your details solely to deal with your enquiry and to reply to you. Where your enquiry is aimed at entering into or performing a contract — a workshop appointment or a quotation, for instance — the legal basis is Art. 6(1)(b) GDPR. In all other cases the processing is based on Art. 6(1)(f) GDPR; our legitimate interest lies in answering enquiries addressed to our business.

Delivery for the contact form has not been set up yet. For as long as that is the case, the form rejects every submission with an error message; your details are neither sent nor stored. Once delivery has been set up, the details will be delivered to our own e-mail account, and you will receive an automatic confirmation at the e-mail address you entered. It names only the subject you chose; it contains neither the text of your message nor advertising. Your details are in no case stored in a database on the web server and are not passed on for advertising purposes.

• TODO (owner): once delivery for the contact form has been set up, amend the paragraph above accordingly, name the mail or delivery service used here and conclude a data processing agreement under Art. 28 GDPR with that provider.

To protect the form against automated bulk submissions we use three measures, none of which requires cookies or an external service.

First, the form contains an additional field that is invisible to you (a honeypot). If that field is filled in, as automated programs routinely do, we discard the submission.

Second, your browser measures how long it takes from the page being built to the form being submitted and transmits that span along with your enquiry. Submissions made in under two seconds are discarded, because in practice only a program can produce them. Nothing but this one span in milliseconds is transmitted; it is not stored, not evaluated and not combined with any other detail.

Third, we limit the number of submissions per IP address within a short window, currently five submissions in ten minutes. A counter is kept purely in the server's working memory and is deleted automatically once the window has passed. Your IP address is not stored persistently, not logged and not passed on to third parties for this purpose. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in preventing spam and keeping our contact channel usable.

You can use this website without providing personal data. To send an enquiry through the contact form we need the fields marked as required; without them we cannot deal with your request. All other details are optional.

If you contact us by telephone or e-mail, we likewise process the details involved solely in order to deal with your enquiry. The same legal bases apply as for the contact form: Art. 6(1)(b) GDPR for contract-related enquiries and Art. 6(1)(f) GDPR otherwise.

This website sets no cookies of its own. It uses no web analytics, tracking pixels, conversion tracking, A/B testing tools or advertising networks, and it builds no usage profiles.

Because no technologies requiring consent under Section 25 TDDDG are used, this website also needs no consent banner. Your language choice is expressed in the page address and is not stored on your device.

Within our business, only those people who need your data in order to deal with your enquiry have access to it.

Beyond that, data are passed to processors within the meaning of Art. 28 GDPR where this is necessary to operate the website. This concerns the hosting provider, the service through which the contact form sends its e-mails, and the provider of our e-mail account. Data are passed to any other third party only where you have consented or where we are legally obliged to do so.

• TODO (owner): name the hosting provider and the e-mail provider, and conclude the respective data processing agreements before launch.

As this website is currently built, no transfer of personal data to countries outside the European Union or the European Economic Area is envisaged.

• TODO (owner): once the hosting and e-mail providers have been chosen, check whether processing takes place in a third country. If so, state the safeguards under Art. 44 et seq. GDPR here, such as standard contractual clauses or an adequacy decision.

We process personal data only for as long as is necessary for the relevant purpose or as long as statutory retention periods require. In detail:

• Server log files: deleted after the period configured at the hosting provider, usually within a few days.
• Contact form abuse counter: deleted at the end of the time window, and at the latest when the server restarts.
• Time between the page being built and the form being submitted: not stored; the value is evaluated for that one submission and then discarded.
• Contact enquiries: deleted once your matter has been dealt with conclusively and no statutory retention period applies.
• Records arising from a resulting job: retained for the commercial and tax law periods of six and ten years respectively (Section 257 HGB, Section 147 AO).

This website uses the typefaces Archivo, Manrope and JetBrains Mono. They are included via the “next/font/google” feature of the Next.js framework, which downloads the font files at build time and then serves them from our hosting provider's server together with the rest of the site.

Opening these pages therefore establishes no connection to Google servers. In particular, no IP address is transmitted to Google and no Google cookies are set.

We embed no map in this website. Several pages, such as the contact page, contain only an ordinary link to a mapping service. As long as you do not click that link, no data whatsoever are transmitted to its operator.

If you follow the link, you leave this website. From that point on, only the privacy policy of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland applies, over whose content we have no influence.

The header and the footer contain an ordinary link to our Instagram profile. No Instagram content is embedded in this website, and no pixels or provider buttons are used. Before you click the link, no data are transmitted to Instagram.

Once you click it, you leave this website and the privacy policy of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland applies.

Many pages offer to write to us on WhatsApp. This uses an ordinary link (wa.me) that opens a prepared message to our phone number; WhatsApp is not embedded in this website. Before you click the link, no data are transmitted to WhatsApp.

Once you click it, WhatsApp opens. The prepared message is only sent when you send it yourself, and you can change it first. The transmission is subject to the privacy policy of WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. We use what you write to us on WhatsApp only to answer your enquiry (Art. 6(1)(b) and (f) GDPR).