Skip to content

Privacy Policy

Last updated: 28 September 2026

In this policy we inform you, in accordance with Articles 13 and 14 of the General Data Protection Regulation (GDPR), which personal data we process when you visit this website and use its features: for what purpose, on what legal basis, to whom we disclose it and how long we keep it. It describes the website as it actually works on the date stated above.

1. Controller and data protection contact

Hermann Jansen GmbH & Co. KG
Rheiner Straße 43-45 + 55
49809 Lingen
Phone: +49 591 800670
Email: [email protected]

We have not appointed a data protection officer; we are not required to do so. Our data protection coordination is your point of contact for all questions about data protection and for requests concerning your rights. You can reach it using the contact details above, most easily by email with the subject line “Datenschutz” (data protection).

2. Overview: who is involved in the website

The website and platform (forms, appointment booking, notifications, connection to our systems) are provided to us by rainmaker GmbH, Kolonnenstraße 8, 10827 Berlin, Germany. It processes your data solely on our behalf and on our instructions (processing by a processor, Art. 28 GDPR). The platform runs on Cloudflare (section “Hosting”).

Any other service providers involved in a feature are named in the relevant section. A summary can be found under “Recipients”, “Transfers to third countries” and “Retention”.

3. Hosting, delivery and security

The website and platform run on Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA (processor): delivery of the pages, platform logic, database and file storage, and protection against attacks and abuse (firewall, bot protection). The database and file storage holding your requests and files are restricted to the EU. A few short-lived entries – counters to prevent abuse and check values to avoid duplicate emails – are kept in a Cloudflare key-value store that is replicated worldwide.

With every request Cloudflare processes the technically necessary connection data: IP address, time, requested address, referring page and browser and device information. Visitors whose browser language is Dutch are redirected once to the Dutch site on their first visit. Vehicle images load from a Cloudflare file store (r2.dev), some other images from our platform’s media store (embed.rainmakerpulse.ai). Fonts are hosted on our own server; we do not use Google Fonts.

We do not keep our own access logs (server log files) for the website; for telemetry and error logging see section “Telemetry”. How long Cloudflare retains connection and security data is governed by Cloudflare’s own rules.

Form protection (Cloudflare Turnstile): when you use a form (enquiry, test drive, contact, callback, subsidy, vehicle valuation, price alert and search agent, workshop and glass service appointment, voucher), Cloudflare Turnstile checks whether the request comes from a human. For this, your browser loads a script from challenges.cloudflare.com as soon as you start filling in the form (so that submitting does not have to wait) – merely visiting the pages does not trigger it. Turnstile evaluates technical characteristics of the browser and connection (including IP address, browser and device details) and shows a confirmation box only in cases of doubt; it does not set cookies for advertising or analytics purposes. The result, a single-use check value, is sent with your form to our platform, which has it confirmed by Cloudflare. The purpose is protection against automated abuse (spam, mass queries).

The legal basis is our legitimate interest in a secure, fast and stable website (Art. 6(1)(f) GDPR). Cloudflare is certified under the EU-US Data Privacy Framework.

5. Cookies and storage in your browser

The website stores some information in your browser – as a cookie or in web storage (localStorage persists until deleted, sessionStorage until the tab is closed). Without consent, such storage is only permitted where it is strictly necessary for a feature you have expressly requested (Section 25(2) no. 2 TDDDG); all other storage requires your consent (Section 25(1) TDDDG). The list below names every entry the website itself creates and when it is created. You can delete all entries at any time in your browser settings.

  • aj-lang – Cookie (this website)
    Purpose: Remembers the language so that visitors with a Dutch browser language are not redirected again on every visit
    When: On the first visit
    Duration: 12 months
  • rmp_csrf – Cookie (our platform, api.rainmakerpulse.ai)
    Purpose: Protects forms against forged submissions (CSRF protection)
    When: When a form loads
    Duration: 24 hours
  • auto-jansen-gdpr-consent – localStorage
    Purpose: Your decision in the cookie notice, with its date
    When: When you click “Essential only” or “Accept all”
    Duration: Until deleted
  • aj_prefill_token – localStorage
    Purpose: Personal access key with which our platform releases your name, email address and phone numbers for pre-filling (section “Personal links”)
    When: When you arrive via a personal link with a key, after submitting a form whose email address and phone number match a customer profile, after you have confirmed your email address via “Fill in my details”, or when a form (with the consent box ticked) or the Greenflash registration has created a new customer profile for you
    Duration: At most 7 days (from campaign emails at most 30 days); earlier via “Cookie settings” → “Delete stored data”
  • aj_prefill_confirm_dismissed – sessionStorage
    Purpose: Remembers that you hid the “Fill in my details” offer with “No thanks” (section “Personal links”)
    When: When you click “No thanks”
    Duration: Until the tab is closed
  • crm_contact_id – localStorage and sessionStorage
    Purpose: Your customer number in our CRM, so that we recognise you and pre-fill forms (section “Personal links”)
    When: When you arrive via a personal link, after submitting a form whose email address matches a customer profile, or after submitting a form (with the consent box ticked) or the Greenflash registration that created a new customer profile for you – regardless of the cookie notice
    Duration: Until you click “Delete stored data” in the “Cookie settings” or delete the website data in your browser. “Essential only” or a withdrawal does not remove it, because without consent it is only used for pre-filling
  • aj_compare_vehicles – localStorage
    Purpose: Your comparison list (up to 3 vehicles)
    When: When you add a vehicle to the comparison
    Duration: Until you empty the list
  • aj_viewed_vehicles, aj_preferred_make, aj_preferred_fuel, aj_preferred_condition, aj_search_history, aj_visit_count, aj_last_visit – localStorage
    Purpose: Browsing history for suitable recommendations (viewed vehicles, preferences, search terms, number and time of visits)
    When: Only with consent (“Accept all”)
    Duration: Until withdrawal; then deleted the next time you open the home page or a vehicle page
  • aj_price_alerts, aj_search_agents – localStorage
    Purpose: List of your price alerts and search agents on this device
    When: After signing up, if you have made a choice in the cookie notice
    Duration: Until deleted
  • aj_last_plate – localStorage
    Purpose: Most recently recognised licence plate for your next appointment booking
    When: After a successful licence plate search, if you have made a choice in the cookie notice
    Duration: Until deleted
  • aj_financing_calc – sessionStorage
    Purpose: Values of the financing calculator for the financing request
    When: As soon as you use the calculator
    Duration: Until the tab is closed
  • aj_activity_summary, aj_activity_summary_ts – sessionStorage
    Purpose: Overview of your open requests on the home page
    When: Only with consent and if we recognise you as a customer
    Duration: Until the tab is closed, reused for at most 1 hour
  • aj_alerts_token – sessionStorage
    Purpose: Access key from your email link for managing your notifications
    When: When you open the manage link from an email
    Duration: Until the tab is closed
  • aj-chat-ok – sessionStorage
    Purpose: Remembers that you have seen the chat notice and started the chat
    When: When you start the chat
    Duration: Until the tab is closed
  • static-aj-v2, pages-aj-v2 – Cache storage (service worker)
    Purpose: Faster loading and offline display: program files and visited pages. Addresses containing a customer number, access key or contact details and the “Price alert” and “Confirm customer data” pages are never stored
    When: On every page view
    Duration: Until the next version of the website or until deleted

If a third party loads content at your request (Google map, chat, Stripe payment form), it may create its own cookies or storage entries. These are described in the relevant sections.

6. Web analytics

We currently do not use any web analytics tool. The website does not load analytics or advertising programs from Google or other providers and sets no analytics cookies; we no longer use the Google Tag Manager that was previously integrated.

Which actions the website reports to our own platform is described in section “Usage events sent to our platform”. If we introduce an analytics tool, we will update this policy beforehand; it will then only become active with your consent (“Accept all”).

7. Usage events sent to our platform

So that we can see which vehicles, pages and contact channels are used, the website reports certain actions to our platform: page view, view of a vehicle page, click on call or WhatsApp, use of the financing calculator, opening the enquiry or callback form and – only with consent – the vehicle comparison. The type of action, the page address and title, where applicable the vehicle (name, fuel type, condition, price) or the phone number chosen, and the time are transmitted. We use your IP address for at most two minutes to limit abusively frequent requests; it is not stored with the event.

  • Without consent the event is sent to our platform without a customer number. It is stored there, not linked to any customer profile and not passed on to the CRM. We transmit the page address without personal additions: the website first removes customer numbers (section “Personal links”), access keys from email links and email addresses.
  • With consent (“Accept all”) and if we recognise you as a customer, we send your customer number and link the action to your customer profile in the CRM: clicks (call, WhatsApp, calculator, comparison, opening a form) appear immediately as a note, page and vehicle views once a day as a combined “website activity” note. From your actions over the last 90 days we compile an overview (preferred makes, fuel type and condition, price range, recently viewed vehicles, open requests), which our advisers use for personal advice and which we show you on the home page.
  • If you submit a form with the consent box ticked, we always link that request to your customer profile (section “Enquiries”).

Without linking, the legal basis is our legitimate interest in evaluating and improving the website’s offering and contact channels (Art. 6(1)(f) GDPR); linking to your customer profile only takes place with your consent (Art. 6(1)(a) GDPR). We delete the events from our database after 90 days; notes in the CRM are kept for as long as your customer profile exists.

9. Enquiries: contact, vehicle, test drive, callback, financing, subsidies

Using the forms you can send us a message, enquire about a vehicle, request a test drive or financing, find out about subsidies for electric cars or ask for a callback.

Data: name, email address, phone number, your message and, depending on the form, subject, location, vehicle, preferred date, the values of the financing calculator and file attachments; for a callback, first and last name and phone number. In addition there is technical information (the form and page the enquiry came from, your customer number if applicable). We suggest the location based on the approximate place of your connection; you can change it.

Process and recipients: we store the enquiry on our platform and send it by email to our sales team (section “Sending emails”). If a customer profile already exists in our CRM Vendasta for your email address – for a callback, for your customer number or phone number – we attach the enquiry to it as a note; otherwise we create a customer profile. After a subsidy enquiry we send you our white paper on subsidies for electric cars by email.

Attachments (contact form, at most 10 MB per file): files are uploaded as soon as you select them and checked for malware (ClamAV virus scanner on Cloudflare servers); only clean files are stored. The email to our team does not contain the files but links that are valid for 7 days. We delete files that do not belong to a submitted enquiry after 24 hours (at the latest after 48 hours), all others after 90 days.

Legal basis: handling your enquiry and pre-contractual measures (Art. 6(1)(b) GDPR); for general enquiries our legitimate interest in answering them (Art. 6(1)(f) GDPR). The forms (except the callback) can only be submitted with the consent box ticked. Retention: see section “Retention”.

10. Workshop and glass service appointments, confirming your customer details

For workshop and glass service appointments we work with the workshop planning system from dagosoft (tpjansen.dagosoft.org) and our dealer management system CAR-IT.

Licence plate check: as soon as you have entered a complete licence plate, we automatically compare it with our customers’ vehicles (a copy from CAR-IT, updated nightly). The website only learns whether the vehicle is known, which location looks after it and whether a phone number is on file – no names or contact details. If an email address is stored for the vehicle, we send a link to that address for confirming or correcting the customer details, valid for 6 hours (at most one email per licence plate within 6 hours); on the website we show the email address only partially masked. Please therefore enter only the licence plate of your own vehicle. Your browser remembers the most recently recognised licence plate for your next booking (aj_last_plate).

Confirming your customer details (page “Confirm your contact details” via the link): you see the contact details and licence plate we hold and can confirm or correct them; we store corrections and forward them by email to the service team of the location.

Appointment: we process the licence plate, location, appointment, requested services, form of address, name, email address, phone number, mileage, your message and, for new customers, the address as well as make and model; for glass service also the type of damage, the affected window and the insurer. We enter the booking in the workshop calendar via dagosoft’s booking service; to do so, our platform fills in the booking form automatically using a browser service from Cloudflare. You receive an appointment confirmation by email, the location a notification, and a “workshop booking” note is added to your customer profile in our CRM.

The legal basis is arranging the appointment and carrying out the workshop order (Art. 6(1)(b) GDPR); the licence plate check and the confirmation link are based on our legitimate interest in sparing you from entering known data and keeping our customer data up to date (Art. 6(1)(f) GDPR). We keep booking data on the platform for three years; after that it is blocked from any further processing.

11. Vehicle valuation with registration certificate

With the “Trade-in” form you offer us your vehicle for valuation or part-exchange.

Data: make, model, year, mileage, condition, comments, name, email address, phone number and – voluntarily – a photo or PDF of your vehicle registration certificate (Zulassungsbescheinigung Teil I). The document also contains the name and address of the registered keeper.

Licence plate lookup (optional): if you search for your licence plate, we compare it with our customers’ vehicles (copy from CAR-IT). If an email address is stored for it, we send a link there that is valid for 15 minutes and pre-fills the form with the stored data. Without a stored email address we only pre-fill vehicle data (make, model, year, mileage), no personal data.

Registration certificate: the file is uploaded when you select it and checked for malware (ClamAV on Cloudflare servers); only clean files are stored, in our platform’s file storage in the EU. Until you submit the request with the consent box ticked, the image is not processed any further; if you do not submit, we delete it after 24 hours (at the next daily deletion run, at the latest after 48 hours). Only after submission does an AI service read the technical vehicle data (e.g. vehicle identification number, manufacturer and type codes, first registration, power). For this we transmit via Cloudflare a copy to Anthropic, PBC, San Francisco, USA (AI model Claude) in which the field with the keeper’s name and address (left third of the unfolded certificate, fields C.1.1–C.1.3) has been blacked out beforehand. If we cannot reliably determine the orientation or format of the image (e.g. PDF), it is not sent to the AI service. Only 14 technical fields are taken over. The unredacted original remains stored with restricted access in the EU and is visible only to our team.

Recipients: our responsible team receives an email with a link to a web view of your request (contact details, extracted values, document image); the link is valid for 7 days. We add a note to your customer profile in our CRM.

The legal basis is taking steps towards a contract at your request (Art. 6(1)(b) GDPR). The registration certificate is optional; without it we prepare the valuation based on your details. We delete the document image, the redacted copy and uploaded files after 90 days, uploads that were not submitted after 24 hours.

12. Search agent, price alert and “Save search”

On request we notify you by email about new matching vehicles (search agent, “Save search” on the vehicle list) or about price reductions for a vehicle (price alert).

Data: first name, last name, email address, your search criteria or the vehicle, language, the page where you signed up, the time of your consent and of your confirmation, and your customer number if applicable.

Double opt-in: after signing up we send you an email with a confirmation link (valid for 7 days). Only after confirmation do we send notifications – at most one summary email per day – and add a note to your customer profile in our CRM (creating a new profile if necessary), including for each summary email sent. To prevent abuse we limit the number of sign-ups per connection and per email address.

Unsubscribe: at any time via the unsubscribe link in every email or via the manage link, also in every email, where you can see all your notifications. The legal basis is your consent (Art. 6(1)(a) GDPR). We delete unconfirmed and unsubscribed sign-ups 30 days after the last change; confirmed ones remain until you unsubscribe.

13. Voucher purchase and payment (Stripe)

You can buy vouchers online. We process the voucher type and value, the buyer’s name and email address, for gifts the recipient’s name and email address and your message, the delivery method and the payment reference. We generate the voucher as a PDF, store it and send it by email; we add a note to your customer profile in our CRM.

Payment is handled by Stripe (Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland). Stripe’s payment form (js.stripe.com) is loaded only at the payment step. Your browser passes your card details directly to Stripe; we do not see them. From us Stripe receives the amount, currency, a voucher identifier and your email address for the payment receipt. Stripe also processes data under its own responsibility, for example to prevent fraud, and may set cookies for this; transfer to Stripe, Inc. in the USA is possible (certified under the EU-US Data Privacy Framework). Details: Stripe privacy policy.

The legal basis is the purchase contract (Art. 6(1)(b) GDPR) and, for retention, our legal obligations (Art. 6(1)(c) GDPR). Vouchers are valid for three years; we keep purchase and payment data in accordance with commercial and tax law retention periods (up to 10 years).

14. Charging card and wallbox (Greenflash)

On the “E-mobility” page you can register for a Greenflash charging card or wallbox account. The account is created in the Greenflash charging portal (auto-jansen.evc-net.com); in the form you confirm its terms and privacy policy.

Data: form of address, first and last name, date of birth, address, phone number, email address, user name and password for the charging portal, IBAN and account holder (SEPA direct debit mandate), invoice address, your choice regarding the charging portal’s newsletter and, for companies, company name, VAT identification number and commercial register number.

Process: our platform transmits the registration to the charging portal, where your account is managed; the charging portal’s privacy policy applies to processing there. We store a record of the transmission (checksum of the data, IP address, browser information, user name) and create a customer profile with your contact details and address in our CRM.

Checks while you type: your browser only checks the format and check digits of the IBAN; it is not transmitted for this. For companies, our platform checks the VAT identification number with the European Commission’s VIES service; only the number is transmitted, and your browser does not connect to the Commission for this. For address suggestions our platform sends the address fragments you enter to Google Places (Google Ireland Limited); Google does not receive your IP address in the process.

The legal basis is entering into and performing the contract for the charging card (Art. 6(1)(b) GDPR); for the checks while you type, our legitimate interest in error-free registrations (Art. 6(1)(f) GDPR).

15. AI chat

Using the “Start chat” button (bottom right) and on the home page you can ask questions in an AI-assisted chat. The chat is provided by our CRM provider Vendasta (Vendasta Technologies Inc., Saskatoon, Canada) with servers in the USA.

The chat is only loaded when you click “Load and start chat” after the notice; no connection is made before that. Your browser then loads the chat program from the provider’s servers (including cdn.apigateway.co, conversation-prod.apigateway.co) and images from Google servers (lh3.googleusercontent.com). In the process your IP address and browser information are transmitted; the provider may create its own cookies or storage entries. Your messages and anything you provide in the chat (e.g. name, email address, phone number) are also processed. The answers are generated by an AI system of the provider; conversation histories and contact details may be stored in our CRM so that we can follow up your request. Please do not enter particularly sensitive data in the chat.

The legal basis for loading the chat is your consent given by clicking (Art. 6(1)(a) GDPR, Section 25(1) TDDDG); for handling your request, Art. 6(1)(b) GDPR. Consent applies to the current session; if you close the tab, the chat is only loaded again after another click.

16. Google Maps

On the “Locations” page we show maps from Google Maps (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). The map is only loaded when you click “Load map”; no connection to Google is made before that. After the click Google receives your IP address, browser information and the address shown and may set cookies; transfer to the USA is possible (Google LLC is certified under the EU-US Data Privacy Framework). The legal basis is your consent given by clicking (Art. 6(1)(a) GDPR, Section 25(1) TDDDG); it applies to the respective page view. More information: Google privacy policy.

17. WhatsApp and phone links

The WhatsApp buttons are simple links (wa.me) to our WhatsApp number. Nothing is transmitted to WhatsApp unless you click. After the click, WhatsApp opens with a prepared text (on vehicle pages with the link to the vehicle), which you can change before sending. WhatsApp Ireland Limited, Merrion Road, Dublin 4, Ireland, is responsible for processing in WhatsApp under its own terms; transfer to the USA is possible. If you write to us via WhatsApp, we process your message and phone number to reply (Art. 6(1)(b) GDPR).

The website reports a click on a WhatsApp or phone link to our platform as a usage event (section “Usage events”).

18. Telemetry, error logging and feedback tool

Telemetry and error logging: so that we can detect errors and slow pages, the website sends technical measurements to our platform: page view, loading-time metrics, program errors (error message, code location) and failed requests (path, status code), each with the page address. We do not record form entries, names or contact details; the website removes personal additions to the page address (customer number, access keys from email links, email addresses) before sending. The values are stored together with your IP address and deleted after 30 days. If your browser has “Do Not Track” enabled, the website sends no telemetry. The legal basis is our legitimate interest in an error-free, stable website (Art. 6(1)(f) GDPR).

Feedback tool: a small program from our platform is loaded on every page that allows our team and our service providers to report improvements to the website. It only becomes active via a personal activation link; for normal visitors it stays inactive, and when it loads our platform only receives the usual connection data. Activated persons use it to submit their name, email address, page, browser information, screen size, comment and a screenshot.

19. Sending emails

We send the website’s emails – to you (confirmations, links, notifications, white paper, vouchers) and to our team (enquiries, appointment notifications) – via Resend (Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA; processor, certified under the EU-US Data Privacy Framework). The senders are addresses under send.auto-jansen.de and mail.rainmakerpulse.ai. Resend processes the recipient address, subject and content of the email and delivery information.

For quality assurance, our technical service provider receives a blind copy of the subsidy white paper email and of the internal appointment notifications to our locations; if an appointment booking fails technically, it receives an error message with licence plate, name and contact details so that it can fix it.

20. Job applications

We accept applications by email or via the contact form (“Careers” page). We process your details and documents solely for the application procedure (Section 26 BDSG, the German Federal Data Protection Act; Art. 6(1)(b) GDPR). If no employment relationship results, we delete your documents no later than six months after the procedure has ended, unless you have agreed to longer storage. If you use the contact form, section “Enquiries” also applies.

21. Social networks

We refer to our profiles on Facebook, Instagram and other networks only with simple links. There are no plug-ins or embedded content from these networks on the website; data only flows if you follow a link, and then under the terms of the respective network.

22. Recipients

Within our company, only the employees who need your data for the task in question receive it (sales, purchasing, workshop, service). Outside our company, data is received by:

  • Processors (Art. 28 GDPR): rainmaker GmbH, Berlin (website and platform); Cloudflare, Inc., USA (hosting, storage, security, virus scanning, browser service for appointment booking); Vendasta Technologies Inc., Canada (CRM and AI chat); Plus Five Five, Inc. (Resend), USA (sending emails); Anthropic, PBC, USA (reading the registration certificate); dagosoft (workshop planning); CAR-IT (dealer management system).
  • Independent recipients, if you use the respective feature: Stripe (payment), Greenflash charging portal (charging card), Google (map after click, address suggestions), WhatsApp (after click), European Commission (VAT ID check).
  • Authorities and courts, where we are legally obliged.

23. Transfers to third countries

Some recipients are based outside the EU or process data there: Cloudflare, Resend, Anthropic and – after your click or consent – Google, Stripe and WhatsApp (Meta) in the USA; Vendasta in Canada with servers in the USA. For transfers to the USA we rely on the European Commission’s adequacy decision on the EU-US Data Privacy Framework where the recipient is certified under it, otherwise on the EU standard contractual clauses (Art. 46(2)(c) GDPR). An adequacy decision of the European Commission exists for Canada. You can request a copy of the safeguards from our data protection coordination.

24. Retention

We store data only for as long as is necessary for the respective purpose or required by law. Where the platform has fixed periods, we state them:

DataRetention
Usage events (section “Usage events”)90 days
Telemetry and error logging30 days
File attachments and registration certificate90 days; uploads that were not submitted 24 hours (deleted after 48 hours at the latest)
Links in emailsweb view and attachments 7 days, confirming customer details 6 hours, pre-filling the vehicle valuation 15 minutes, confirming a notification 7 days
Notifications (search agent, price alert)until you unsubscribe; unconfirmed and unsubscribed ones 30 days after the last change
Workshop and glass service bookings3 years on the platform, then blocked
Cache of the contact details behind personal links24 hours
Enquiries, callback requests, voucher purchases, record of the Greenflash registration, customer profile and notes in the CRMas long as necessary to handle your request and any resulting business relationship; after that we delete them unless statutory retention obligations apply (generally 6 or 10 years under the German Commercial Code and Fiscal Code for business letters, accounting records and invoices)
Entries in your browsersee section “Cookies and storage in your browser”

25. Your rights

You have the following rights with regard to your personal data:

  • access to the stored data (Art. 15 GDPR),
  • rectification of inaccurate data (Art. 16 GDPR),
  • erasure (Art. 17 GDPR),
  • restriction of processing (Art. 18 GDPR),
  • data portability (Art. 20 GDPR),
  • withdrawal of consent with effect for the future (Art. 7(3) GDPR) – for cookie consent via “Cookie settings”, for email notifications via the unsubscribe link in every email.

Right to object (Art. 21 GDPR): where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation. We will then no longer process the data unless we demonstrate compelling legitimate grounds or the processing serves legal claims. You can object to processing for direct marketing at any time without giving reasons.

To exercise your rights, please contact our data protection coordination (section “Controller and data protection contact”).

26. Right to lodge a complaint with a supervisory authority

You can lodge a complaint with any data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:

Der Landesbeauftragte für den Datenschutz Niedersachsen (State Commissioner for Data Protection of Lower Saxony)
Prinzenstraße 5, 30159 Hannover, Germany
Phone: +49 511 120-4500
Email: [email protected]
Online complaint: www.lfd.niedersachsen.de/beschwerde

27. Obligation to provide data

You are under no statutory or contractual obligation to provide us with data via the website. Without the information marked as required, however, we cannot process an enquiry, appointment, notification or purchase. Without consent in the cookie notice you can use the website in full; only the additional features listed in section “Consent” are not available.

28. Automated decision-making

There is no decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR). We use the overview of your interests (section “Usage events”, only with consent) solely for advice and suitable vehicle suggestions; no scoring takes place.

29. Data security

The website is transmitted exclusively in encrypted form (HTTPS/TLS). Forms are protected against improper submission, uploaded files are checked for malware, and links in emails that give access to your data are time-limited (see the respective sections).

30. Changes to this policy

We update this policy when the website or the services used change. The version published here with the date stated above is authoritative.