Privacy

1 · Controller

eauto-check GbR, represented by Jan Wichmann and Karl Wichmann

Conradstraße 12, 13509 Berlin, Germany

Email: info@eauto-check.de

2 · Data collection and storage

Server log files

When you visit our website, our hosting provider (Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany) automatically records information in server log files: IP address, date and time of request, URL accessed, data volume, browser and operating system.

This data is stored for a maximum of 14 days and then automatically deleted.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in technical provision and security).

Abuse protection

To fend off automated bulk access, we count requests per IP address. The web server counts requests for the vehicle and brand pages in its own memory and slows down anyone fetching more pages in a short time than a person reads. Above a limit it refuses the request and shows a notice page; the limit lifts by itself as soon as the pace drops. For the interface the site loads its data from, we also still count in a cache (Redis); those counters expire with their window, which runs from a minute up to a day.

Refused requests sit in the server log like every other request, with IP address, time and target, and are deleted after the same 14 days.

We read those logs internally once a day: how often we refused, and how many vehicle pages a single address fetched in one day. We need the second figure for the licence on the vehicle data, which obliges us to prevent bulk extraction.

In that evaluation the address appears only as a salted hash. The salt is new for every run and is stored nowhere, the address cannot be derived from it, and the evaluation creates no storage of its own. Within one run it recognises the same address across the days it compares; two runs cannot be linked to each other.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the availability and security of the service).

Recognition cookie (client ID)

We set a technically necessary cookie to recognize your device (§ 25(2) TDDDG). It contains an anonymous random ID and is required for the vehicle finder to work. Among other things, it keeps your shortlist and saved searches across sessions. The cookie has a storage period of up to 12 months; you can delete it at any time via your browser settings.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in operating core functionality).

Vehicle images (IMAGIN Studio)

Vehicle images are delivered via the external image service IMAGIN Studio (IMAGIN.studio B.V., Amsterdam, Netherlands). When a vehicle image loads, your IP address is transmitted to this service for technical reasons.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in displaying the vehicles).

Storing your cookie choice

Whether you allow necessary cookies only or also analytics cookies is saved in your browser on your device so the prompt does not reappear on every visit and your preference is applied. This is separate from analytics cookies themselves, which are only set after you give consent.

Legal basis: If you consent to analytics cookies, Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG; for technical management of your choice without analytics tracking, Art. 6(1)(f) GDPR (legitimate interest in a working consent and settings flow).

3 · AI-powered vehicle recommendation

For the vehicle finder and the AI-powered chat and free-text features (follow-up questions about results, comparisons and individual vehicles, as well as free-text input in the vehicle search), your input is sent to the OpenAI API, including any free text you enter. Please do not enter personal data (e.g. names, addresses or contact details) in these fields; it is not required for the vehicle recommendation.

OpenAI processes requests on servers in the USA. The data transfer is based on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework (Art. 45 GDPR). Data is not used by OpenAI for training and is deleted after a maximum of 30 days.

Your answers in the vehicle finder and the transcript of your conversations stay with us for three years from your last activity, after which they are deleted automatically. We read them to improve the vehicle finder and its answers. A conversation can only be continued within the first seven days; after that you start a new one, even though the earlier transcript is still stored with us.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in providing vehicle recommendations).

More information: OpenAI Privacy Policy

4 · Analytics cookies

We use Google Analytics to analyze user behavior. Pseudonymized usage data (e.g. page views, session duration, device type) is transmitted to Google. Your IP address is truncated before it reaches Google. Google processes this data on servers in the USA. The data transfer is based on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework (Art. 45 GDPR).

For this we use the Google Analytics Advertising Features (Google Signals): if you are signed in to Google and have allowed personalised advertising, Google links this data to your account and its advertising identifiers. You can object in your Google ad settings, and view or delete the data under My Activity.

The two Google Analytics cookies have a lifetime of two years; you can delete them in your browser at any time.

Analytics cookies are only set with your explicit consent. You can withdraw your consent at any time in the Cookie settings.

Legal basis: Art. 6(1)(a) GDPR (consent), § 25(1) TDDDG.

More information: Google Privacy Policy

5 · Contact by email

If you contact us by email, your details including your email address will be stored for the purpose of processing your inquiry and in case of follow-up questions. This data will be deleted once the inquiry has been fully resolved, unless statutory retention obligations apply.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in responding to inquiries).

Partner inquiries

If you fill in our partner form, we store the data you provide (name, email address, company, role and your message) in our database in order to process your inquiry and contact you. This data is deleted once the inquiry has been resolved and no statutory retention obligations apply.

Legal basis: Art. 6(1)(b) GDPR (steps prior to entering a contract) or Art. 6(1)(f) GDPR (legitimate interest in handling partner inquiries).

6 · Forwarding your test-drive request to dealers

When you request a test drive through our platform, we forward the details you provide to the dealer you selected so that they can arrange the test drive with you. The following is transmitted: name, email address, phone number, the vehicle model you are interested in, your preferred appointment, and your message to the dealer.

We only forward these details if you expressly consent before submitting the request. You can withdraw this consent at any time with effect for the future; the lawfulness of processing carried out before the withdrawal remains unaffected. A message to the email address above is enough to withdraw.

We use these details solely to pass your request on to the dealer. They are not used for advertising, behavioral analysis, or profiling, and we neither enrich nor score your request before forwarding it.

We delete our own copy of your request no later than twelve months after we receive it. This period applies only to the copy stored with us.

Shown in the dealer's account

The dealer does not only get your request by email. The same details stay with us until they are deleted and are shown to the dealer in their account on eauto-check, so that they can work on the request and record whether they have dealt with it. We store nothing there beyond that status; whatever the two of you discuss goes past us.

Their account shows exactly those requests that are still stored with us, and not one row longer. After twelve months your request is therefore gone from there as well. If you withdraw before that, we delete our copy right away and it disappears from their account without leaving a note that it ever existed. The email they already received stays with them; from the moment they received it, they are responsible for it themselves.

From the moment the dealer receives your data, the dealer is an independent controller under the GDPR and decides on its own about the purpose, duration, and manner of any further processing, in particular its own retention period. You therefore exercise rights such as access or erasure regarding the data held by the dealer directly with that dealer; we have no influence over their processing.

Legal basis: Art. 6(1)(a) GDPR (consent).

Sent through a processor

We do not send the email carrying your request ourselves. It goes through Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg, using their Amazon Simple Email Service. Sending runs in the eu-central-1 region in Frankfurt am Main. The same service carries the other emails of the dealer area: your confirmation, the acknowledgement of a dealer application, the decision on it, and the sign-in links for the portal. We have a data processing agreement with AWS.

Sending is not confined to Europe. AWS uses its own sub-processors for this service, among them AMCS LLC in the USA and AMCS SG Private Limited in Singapore. These transfers are based on the European Commission's standard contractual clauses, which the AWS agreement incorporates.

Which sub-processors AWS uses is published by AWS and kept up to date there. We deliberately do not copy the list here, because a copied list would be wrong at the next change: AWS sub-processors.

The legal basis for the processing remains the one of the matter the email belongs to, so your consent or steps prior to entering a contract. AWS acts as a processor under Art. 28 GDPR; transfers to third countries rely on Art. 46(2)(c) GDPR.

7 · Dealer area: application, portal and access addresses

This section is about car dealerships and the people who work there. If you are here as a prospective buyer, section 6 is the one that concerns you.

Application to join

When a dealership applies through our form at /for-dealers, we store what is entered there: company name, address, name of the contact person, email address, their role in the business, phone number, website, which models are offered, and the free-text message. We use it to review the application, decide on it, and inform the business of that decision. If we turn an application down, we also store the reason and the wording we sent.

Twelve months after the decision we delete the application. As long as nobody has decided, no clock runs: an application that vanished before anyone looked at it would be lost, not deleted.

Legal basis: Art. 6(1)(b) GDPR (steps prior to entering a contract).

Portal

An approved dealership maintains its own details in the portal and sees the test-drive requests that went to its location. For signing in we store a session: a checksum of the sign-in token, when the session started, when it was last used, and when it expires. The token itself only ever sits in your browser's cookie, never in our database. A session ends after twelve hours at the latest, or after 30 days with "remember this device". We also record when a dealership signed in.

Legal basis: Art. 6(1)(b) GDPR for using the portal, Art. 6(1)(f) GDPR for the session and for preventing misuse.

Access addresses

Access does not hang on a location's public contact address but on a separate list of email addresses that the dealership maintains itself and can change at any time. For us these are personal data of the people behind those addresses. We store the address, when it was added, and, if mail to it permanently stops being deliverable, when and why we retired it.

We store an address for as long as the dealership keeps it on that list. Once they take it off, it is gone, and the sessions opened through it end at the same moment.

Legal basis: Art. 6(1)(f) GDPR. Our contract is with the dealership and not with the person behind the address, and without such a list there would be no way into the portal.

We get these addresses from the dealership, not from you. That is why every newly added address gets a short email from us straight away: which dealership added it, that it is held by us for as long as it stays on the list, where to read this notice, and how signing in works. It deliberately contains no sign-in link. If you want to know what we hold about you, or want your address gone, a message to the address given above is enough; the dealership can also take it off the list itself.

8 · Feedback and beta programme

When you rate questions or results, or send us free text, we store your input together with the place in the app, your language and the anonymous recognition ID from section 2.

During the running beta we also ask for your name and a contact detail (email or phone) when you start, so we can follow up on your feedback. Both are voluntary and can be skipped. Beta programme data is deleted when the programme ends.

Legal basis: for name and contact details Art. 6(1)(a) GDPR (consent, given by volunteering them); for ratings and free text without a name Art. 6(1)(f) GDPR (legitimate interest in improving the service).

9 · Automated decision-making

The AI-powered vehicle recommendation serves exclusively as non-binding guidance. No automated decision-making within the meaning of Art. 22 GDPR takes place that produces legal effects concerning you or similarly significantly affects you.

10 · Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection (Art. 21 GDPR).

To exercise these rights, contact the email address above. You also have the right to lodge a complaint with a data protection supervisory authority. The competent authority is the Berlin Commissioner for Data Protection and Freedom of Information.