Privacy

1 · Controller

eauto-check GbR, represented by Jan Wichmann and Karl Wichmann

Conradstraße 12, 13509 Berlin, Germany

Email: info@eauto-check.de

2 · Data collection and storage

Server log files

When you visit our website, our web server automatically stores access data such as IP address, time, page requested and browser. The server is hosted by a hosting provider in Germany.

This data is stored for a maximum of 14 days and then automatically deleted.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in technical provision and security).

Abuse protection

To fend off misuse such as automated bulk access and to know our visitor numbers, we evaluate IP address and recognition ID. What this produces is deleted after one day at the latest, except for the cases on the block list (next paragraph). Otherwise all that remains are totals that cannot be traced to any person. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure operation and in knowing our reach).

Recognition cookie (client ID)

We set a cookie with a random identifier without any name or contact details. The vehicle finder needs it: it links your saved eAuto-Checks, sessions and chats and your feedback to your device. The cookie lasts up to 12 months; you can delete it in your browser at any time.

Legal basis: § 25(2) TDDDG for the cookie, Art. 6(1)(f) GDPR (legitimate interest in operating core functionality).

Vehicle images (IMAGIN Studio)

Vehicle images are delivered by the image service IMAGIN Studio (IMAGIN.studio B.V., Amsterdam, Netherlands). When an image loads, it receives your IP address for technical reasons.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in displaying the vehicles).

Dealer map (Google Maps)

The dealer map uses Google Maps by Google Ireland Limited and only loads once you click on it. Google then receives your IP address, may set cookies and processes the data as an independent controller, also in the USA (EU-U.S. Data Privacy Framework). You can withdraw your consent in the Cookie settings. Legal basis: Art. 6(1)(a) GDPR, § 25(1) TDDDG.

Location search

If you enter an address instead of a postcode in the dealer search, our server sends it to Google's geocoding service (Google Ireland Limited), also to the USA (EU-U.S. Data Privacy Framework). Legal basis: Art. 6(1)(f) GDPR (legitimate interest in searching by place).

Partner links

Links to Carwow go through the partner network Daisycon so that we receive a commission for requests we refer. Daisycon receives your IP address and sets cookies for up to one year to match the request to our link. Details: Daisycon privacy policy. Legal basis: Art. 6(1)(f) GDPR.

Storing your cookie choice

Your cookie choice, including the ones for the dealer map, our own usage measurement and the advisor's memory, is stored only in your browser so the prompt does not come back on every visit. The only part of it that reaches us is the record of your consent to the advisor's memory (section 3). Legal basis: § 25(2) no. 2 TDDDG and Art. 6(1)(f) GDPR.

Service providers

For hosting, email, AI features and our internal team chat we use service providers that work only on our behalf and on our instructions (Art. 28 GDPR). Some are based in the USA or use sub-processors outside the EU. We base transfers there on the EU-U.S. Data Privacy Framework or on standard contractual clauses. On request we tell you which providers these are and give you a copy of the clauses.

3 · AI-powered vehicle recommendation

Your input in the vehicle finder, in the chats and in free-text fields is processed by an AI language model that a service provider runs for us (section 2). Please do not enter personal data such as names, addresses or contact details there; it is not required for the vehicle recommendation.

Your answers in the vehicle finder and the transcript of your conversations stay with us for three years from your last activity, after which they are deleted automatically. We read them to improve the vehicle finder and its answers.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in providing and improving vehicle recommendations).

Advisor

If you have consented to our own usage measurement (section 4), our advisor follows which cars and sections you view and for how long, and suggests wishes for your search based on that. Without that consent it does not follow along. Your browser keeps what it reads only in the open tab. For the suggestions, it goes without any identifier to an AI model that a service provider runs for us (section 2). Legal basis: Art. 6(1)(a) GDPR (consent), § 25(1) TDDDG.

With your consent the advisor remembers this beyond the visit: on our server in Germany we store, linked to your recognition cookie, which models and topics you read and for how long, which wishes you set and whether you switched the advisor off. On your next visit it carries on from there; for this, what it remembered goes without any identifier to the AI model from the paragraph above. As a record of your consent we also store when you gave it and in which version. We delete all of this 90 days after your last visit. If you withdraw in the Cookie settings, we delete it at once; the wishes in your eAuto-Check are not affected. Legal basis: Art. 6(1)(a) GDPR (consent), § 25(1) TDDDG; for the record of consent, Art. 6(1)(c) in conjunction with Art. 7(1) GDPR.

4 · Analytics and our own usage measurement

Google Analytics

With your consent we use Google Analytics to analyze user behavior. Google receives pseudonymized usage data (e.g. page views, session duration, device type) and processes it also in the USA on the basis of the EU-U.S. Data Privacy Framework (Art. 45 GDPR). Google Analytics uses your IP address only to determine your approximate country and region, and does not store it.

For this we use the Google Analytics Advertising Features (Google Signals): if you are signed in to Google and have allowed personalised advertising, Google links this data to your account and its advertising identifiers. You can object in your Google ad settings, and view or delete the data under My Activity.

We also use Google Analytics to measure whether visitors arrive through our Google Ads and then click a partner offer. For this, Google Analytics passes these clicks to our Google Ads account.

The two Google Analytics cookies have a lifetime of two years; you can delete them in your browser at any time. Google deletes the data about your visits after 14 months. You can withdraw your consent at any time in the Cookie settings.

Legal basis: Art. 6(1)(a) GDPR (consent), § 25(1) TDDDG.

More information: Google Privacy Policy

Our own usage measurement with recording

With your consent we measure ourselves how the site is used: where people click, how far they scroll and which steps a visit takes. In the eAuto-Check we also note your answers and how many cars match your wishes afterwards. We record the visit as a replay. For this we store a random identifier that your browser keeps until you close the tab, along with the device class, window size, language, the first page opened, the domain of the page you came from and campaign parameters from the link.

The data is kept on our server in Germany. We delete recordings after 30 days and everything else after 90 days. In the server's backups they remain until the backup is overwritten.

We link the identifier to nothing else. So we cannot attribute earlier visits to a person, or look them up or delete them individually (Art. 11 GDPR). If you withdraw in the Cookie settings, capturing stops immediately and we delete the current visit.

Legal basis: Art. 6(1)(a) GDPR (consent), § 25(1) TDDDG.

Tests with several versions

Some pages we test in several versions, each with a letter. With your consent to our own usage measurement, your browser keeps the letter of the version you see, so it stays the same from page to page, and the measurement notes it with your visit. If you withdraw, we delete it along with the current visit. Without consent the version is picked anew on every page view, and nothing is stored on your device for it.

On every page view, with or without consent, we count on which page which version was shown or clicked, with the time and the device class (phone, tablet or computer), which we read from your browser's identifier. We store no recognition ID and no visit identifier with it. Legal basis for this count: Art. 6(1)(f) GDPR (legitimate interest in improving the service).

5 · Contact by email

If you contact us by email, we store your details including your email address to handle your inquiry and any follow-up questions. We delete them once the inquiry is resolved and no statutory retention obligation applies.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in responding to inquiries).

Partner inquiries

If you fill in our partner form, we store the data you provide (name, email address, company, role and your message) in our database in order to process your inquiry and contact you. This data is deleted once the inquiry has been resolved and no statutory retention obligations apply.

Legal basis: Art. 6(1)(b) GDPR (steps prior to entering a contract) or Art. 6(1)(f) GDPR (legitimate interest in handling partner inquiries).

6 · Forwarding your test-drive request to dealers

When you request a test drive, we pass your name, contact details, vehicle model, preferred date and your message to the selected dealer with your consent and show them in the dealer's account with us. From receipt, the dealer is responsible for the data. We delete our copy after twelve months, after which the request is no longer visible in the dealer's account either. You can withdraw your consent at any time with a message to us; we then delete our copy right away.

If you ask a dealership that does not work with us directly yet (the form tells you so), we forward your request with your consent to the dealership's general email address (section 8). If it does not arrive, we write to you once with the dealership's phone number. Retention and withdrawal work as described above.

Legal basis: Art. 6(1)(a) GDPR (consent).

7 · Dealer area

We store applications from dealerships with the details from the form for review and delete them twelve months after the decision (Art. 6(1)(b) GDPR). For signing in to the portal we store sessions for 30 days at most (Art. 6(1)(b) and (f) GDPR, interest in secure sign-in). The email addresses for signing in are entered by the dealership itself. We store them for as long as they are entered and send each new address a short email (Art. 6(1)(f) GDPR, interest in access to the portal).

8 · Dealer directory

Our dealer directory also shows dealerships that have not signed up with us. The details come from publicly accessible sources: name, address, phone number, website, brands sold and a general email address of the dealership. We do not show the email address publicly; we only forward test drive requests to it (section 6). We derive the map coordinates from the address using Google's geocoding service (section 2, location search). Where these details are personal data, for example for a sole trader, the legal basis is our legitimate interest in bringing interested buyers and dealerships together (Art. 6(1)(f) GDPR).

A dealership can object to this at any time, through the opt-out link in every forwarded request or by email to widerspruch@eauto-check.de. After that we forward no more requests and, on request, remove the dealership from the directory altogether. We keep the details for as long as a dealership is in the directory; after an objection, only what we need to honour it permanently. The other rights are set out in section 11.

We delete mail to widerspruch@ and our notes on it after about 90 days, unless an objection still in force rests on it. Legal basis: Art. 6(1)(c) GDPR (duty to honour objections) and (f) (interest in recognising them quickly).

9 · Feedback

When you rate questions or results of the eAuto-Check, or report something about a result, we store your input together with the place in the app, your language and the recognition ID from section 2.

When you answer whether you would recommend eAuto-Check, or write to us via "Send feedback", we store the answer or message with the page you were on, your language and the time. We delete messages after 12 months.

The question appears in changing places, because we are testing where it is seen best. For that we count whether it was shown, answered or closed, each time with the place, the page, the time and the device class (phone, tablet or computer), which we read from your browser's identifier. We store no recognition ID and no name with any of it.

During the beta, which has ended, we asked for a name and a contact detail (email or phone) on a voluntary basis. We no longer use these details and are deleting them.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in improving the service); for the voluntary beta details, until they are deleted, Art. 6(1)(a) GDPR (consent, given by volunteering them).

10 · Automated decision-making

The AI-powered vehicle recommendation serves exclusively as non-binding guidance. No automated decision-making within the meaning of Art. 22 GDPR takes place that produces legal effects concerning you or similarly significantly affects you.

11 · Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection (Art. 21 GDPR).

To exercise these rights, contact the email address above. You also have the right to lodge a complaint with a data protection supervisory authority. The competent authority is the Berlin Commissioner for Data Protection and Freedom of Information.

You are not obliged to provide us with any data. Without it, you cannot use individual features such as the test-drive request.