Privacy notice

Please note: this is a translation for your convenience. The German version of this page is the legally binding one.

1. Controller

The controller for data processing on this website is:
Hanna Rem KFZ Handel, Owner Hanna Rem, sole trader, Strobenrieder Str. 97, 86579 Waidhofen, Germany
Email: hanna@cargru.de · Phone: +49 176 84868653

No data protection officer has been appointed, as the conditions of § 38 BDSG are not met. For any data protection question please write to the address above.

2. Hosting and delivery of the website

The website runs on Cloudflare's infrastructure (Cloudflare Germany GmbH, Rosental 7, 80331 Munich; parent company Cloudflare, Inc., USA). Cloudflare provides the computing, the content delivery network, attack protection and the database and storage services we use. In doing so it processes all data required to serve and operate the site.

The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest lies in providing the site securely, reliably and fast. A data processing agreement under Art. 28 GDPR is in place with Cloudflare.

3. Server log files

Every request causes technical connection data to be processed: a shortened IP address, the date and time, the address requested, the volume transferred, the status code, the referrer and the browser and operating system identifiers. This is needed to serve the site, keep it stable and fend off attacks. It is not combined with other sources to identify individuals.

Legal basis: Art. 6 (1) (f) GDPR. Deleted after 30 days at the latest, unless needed to investigate a specific security incident.

4. Cookies and storage on your device

Without any action on your part we set only the cookies Cloudflare needs for its security check and abuse prevention. Four further cookies are set only at your request. If you choose a price view on the vehicle pages (private buyer in Germany, business in the EU or export), the cookie buyer_mode remembers that choice for twelve months; it holds only the view you chose. In the customer area for your transaction (section 13) a cookie remembers the device you confirmed. If you allow a partner's insurance calculator to load (section 20), the cookie partner_calc_consent stores that decision and the version of the consent information for twelve months so you are not asked again on every visit. The cookie analytics_consent records your decision on audience measurement (section 6), made in the notice at the bottom of the page or under “Cookie settings”, for twelve months; it holds your agreement or refusal and the version of the consent information. Until you decide, the notice stays visible and audience measurement stays off. Our own cookies serve website functions and store your choices. For storage by third-party services you allow, see sections 19 and 20. You can also allow the insurance calculator under “Cookie settings” or with “Accept all”; it then loads automatically on insurance pages. YouTube videos still load only after you click the individual video.

The strictly necessary cookies, the price-view cookie included, need no consent under § 25 (2) no. 2 TDDDG, because they are essential to provide the service you expressly asked for; the subsequent processing rests on Art. 6 (1) (f) GDPR, in the customer area on Art. 6 (1) (b) GDPR. The insurance calculator cookie rests on your consent under § 25 (1) TDDDG and Art. 6 (1) (a) GDPR. The cookie analytics_consent also needs no consent under § 25 (2) no. 2 TDDDG: it stores your decision with the version of the consent information and is essential for that decision to be respected, so that audience measurement does not load without your agreement and you are not asked again on every visit. The subsequent processing rests on Art. 6 (1) (f) GDPR, our legitimate interest being to keep to your decision.

5. Fonts and images

Fonts and images are bundled when the pages are built and served from our own server. Visiting the site opens no connection to third-party servers for them.

6. Audience measurement (Cloudflare Web Analytics)

We use Cloudflare Web Analytics (provider as in section 2) to measure the reach of this website, but only with your consent in the notice at the bottom of the page or under “Cookie settings”. Only then does your browser load a script from static.cloudflareinsights.com. For each page view it sends Cloudflare the page viewed, the referrer, details of the browser and device type and technical load times; in doing so Cloudflare also receives your IP address. Cloudflare shows us aggregate figures only, with location at country level only.

According to Cloudflare, the script sets no cookies, uses no local storage and takes no fingerprint of your device. Because it runs in your browser and reads information there, we ask for your consent first. The legal basis is your consent under § 25 (1) TDDDG and Art. 6 (1) (a) GDPR. Without consent nothing loads, and you can use the website without any restriction.

You can withdraw your consent at any time with effect for the future (Art. 7 (3) GDPR), under “Cookie settings” at the bottom of the page or using the button below this paragraph, which appears after you agree. The lawfulness of measurement carried out before the withdrawal is not affected. Under “Cookie settings” you can also agree after previously declining. On withdrawal, open pages of this website on which audience measurement has already started reload so that the loaded script also stops.

Cloudflare describes seven days of storage for unsampled beacon measurements, followed by a reduced dataset for longer-term storage. Web Analytics provides access to the previous six months. This access period does not confirm complete deletion of all copies. It is separate from the twelve-month cookie for our consent setting. Further information: Cloudflare Web Analytics FAQ.

In addition, on our vehicle pages we count views per vehicle and day in our own database on the Cloudflare infrastructure named above. The count itself stores only the number of views, not who caused them. To fend off automated mass requests we keep a shortened hash of your IP address for at most one hour and then delete it. We use it only for this limit and do not combine it with other data.

The legal basis for this count of our own is Art. 6 (1) (f) GDPR. Our legitimate interest is to see which vehicles are in demand.

7. Contact, vehicle and appointment enquiries

When you use our enquiry form or contact us by email, phone, WhatsApp or Telegram, we process the details you provide, usually your name, contact details, the vehicle concerned and the content of your message, in order to handle your enquiry. For workshop enquiries (air-conditioning service, detailing, chip tuning and coding) the details needed for that are added, such as model, engine, year, mileage, the condition of the vehicle or photos you send. Nothing you send is displayed publicly.

The legal basis is Art. 6 (1) (b) GDPR where the enquiry serves to prepare or perform a contract, otherwise Art. 6 (1) (f) GDPR, our interest in handling enquiries properly. Section 9 says how long we keep enquiries and the related correspondence.

On the inspection page you can enter where the vehicle is and choose “Calculate distance”. Our server, not your browser, then sends our starting address and the address you entered to Google Maps Platform (Routes API) of Google Cloud EMEA Limited, Ireland, whose parent company is Google LLC in the USA. Before that we check the request with Cloudflare Turnstile (section 8). We receive only the length of the route back, from which we work out the travel price. We do not store the address at this step. To prevent abuse we keep a check value of your IP address, formed with a secret key and irreversible, together with the time of the request; both are deleted as soon as the next request comes in after the day has ended. You can also enter the distance yourself, in which case nothing goes to Google.

Google processes these details as a controller in its own right and may also process them in the USA. Google LLC is certified under the EU-US Data Privacy Framework; the European Commission's adequacy decision of 10 July 2023 applies to it (Art. 45 GDPR, see section 22). The legal basis for the transfer is Art. 6 (1) (b) GDPR, because by calculating the distance you ask for a quote for a vehicle inspection, otherwise Art. 6 (1) (f) GDPR, our interest in a correct travel price. The link “View route in Google Maps” is an ordinary link: only when you click it do you leave our website, and Google receives both addresses from the link. If you then send the request, we process the address together with your request as described above.

8. Spam and abuse protection (Cloudflare Turnstile)

We use Cloudflare Turnstile to protect our forms against automated submissions. Technical characteristics of your browser and your IP address are sent to Cloudflare and assessed to tell a human apart from an automated system. Turnstile uses no advertising cookies and builds no cross-device profiles.

Legal basis: Art. 6 (1) (f) GDPR, our interest in preventing abuse and spam.

9. Customer records and storage of correspondence

We keep enquiries, orders, contracts and the related communication together in our own customer records, which run on the Cloudflare infrastructure named above. There we also store the content of the messages you send us on WhatsApp, Telegram or by email, and our replies. The purpose is that any team member with access can follow a transaction and that what was agreed about the vehicle, the price and the appointment stays on record.

Messages on WhatsApp reach us through the WhatsApp Business Platform of Meta Platforms Ireland Limited (Merrion Road, Dublin 4, Ireland), messages on Telegram through the interface of Telegram FZ-LLC (Dubai, United Arab Emirates). In doing so these providers process your phone number or account identifier and the metadata of the transmission under their own privacy terms. If you would rather avoid that, please email or call us. Our mailbox is kept at Google Workspace (provider as in section 11). Your emails arrive and are stored there. We send our replies to your emails from this mailbox.

The legal basis is Art. 6 (1) (b) GDPR where the correspondence prepares or concerns a contract, otherwise Art. 6 (1) (f) GDPR, our interest in orderly and documented handling. Correspondence without a contract is deleted at the latest twelve months after the last message. Correspondence relating to a contract is kept, insofar as it matters for taxation, for six years after the end of the year in which the transaction was closed (Art. 6 (1) (c) GDPR, § 147 (1) nos. 2, 3 and 5, (3) sentence 1 AO), and beyond that for as long as it is relevant to taxes whose assessment period has not yet expired (§ 147 (3) sentence 5 AO). The other correspondence on the same contract is kept for the same time, because it cannot be reliably separated from the tax-relevant part and we need it to assert or defend claims under the contract; such claims can become time-barred up to ten years after they arise (Art. 6 (1) (f) GDPR, §§ 195, 199 (4) BGB). The correspondence is then deleted.

10. Internal notifications via Telegram

We notify our team of incoming enquiries, orders and withdrawals through a Telegram bot. Your name, the subject of the enquiry and the content of the message may be transmitted to Telegram (provider as in section 9).

Legal basis: Art. 6 (1) (f) GDPR, our interest in responding promptly. If you would rather avoid this transmission, please contact us by email or phone.

11. Appointments in the Google calendar

When we arrange an appointment with you, for example to view a vehicle, for a mobile vehicle inspection or for workshop work, we enter it in the team calendar we keep at Google Workspace (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). The entry holds the date and time, the service requested, your name, the vehicle and the phone number or email address for queries. Appointment requests made through the website are first created as a provisional entry by a script on Google's side; a team member confirms the appointment and replies to you.

Legal basis: Art. 6 (1) (b) GDPR. Google processes the data as a processor under Art. 28 GDPR on the basis of the Google Workspace terms. We delete the calendar entry at the latest three years after the appointment; details we need for invoicing are unaffected and follow the periods in section 15.

12. Contracts, orders and payment

When a purchase, brokerage or service contract is concluded we process your name, email address, phone number, postal address, the subject of the contract including the vehicle data, the contract value and the payment and processing status. For workshop work the details needed to carry it out and bill it are added, such as the scope of the work done, the quantity of refrigerant filled, the software versions read out and installed, and the invoice amount. This data is necessary to perform the contract.

Payment for services booked online is handled by Stripe (Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland; parent company Stripe, Inc., USA). You enter your payment details directly with Stripe. We neither collect nor store card data; Stripe only tells us the payment status and the details needed to match the payment. Stripe's privacy notice applies in addition. Vehicle purchases are settled by bank transfer.

Legal basis: Art. 6 (1) (b) GDPR; for fraud prevention Art. 6 (1) (f) GDPR.

13. Customer area for your transaction

For ongoing sales and export transactions we set up, on request, a customer area where you can see the status of your transaction and upload the documents required. Access is through a personal link carrying a random access token, which we store only in hashed form, and a one-time six-digit code that we send you by email or Telegram and that is valid for ten minutes. A cookie remembers a confirmed device so you need not request a new code on every visit. We record which token was created, confirmed and revoked, and when.

Uploaded documents, such as identity or vehicle documents for registration, export and customs, are held in the object storage of the Cloudflare infrastructure and are visible only to you and our team. Access ends thirty days after the transaction is closed; we then move the documents to the transaction file (section 15) and delete them from the customer area.

Legal basis: Art. 6 (1) (b) GDPR. The cookie needs no consent under § 25 (2) no. 2 TDDDG, because it is essential for the access you expressly asked for.

14. Handover, registration, transport and export

To prepare the handover of a vehicle we pass the data required to the parties involved, for example a transport company or freight forwarder we have engaged, a registration office or registration service and, for exports, the customs broker and the customs authorities, where you order such a service or the law requires it. Only the details needed for the respective purpose are passed on.

Legal basis: Art. 6 (1) (b) GDPR; for notifications required by law Art. 6 (1) (c) GDPR.

15. Invoices, files and statutory retention

We keep contracts, invoices, handover reports and the related accounting vouchers because tax law requires it. The files are held in a document archive at Google Workspace (Google Drive; provider: see section 11), which Google operates as our processor. The legal basis is Art. 6 (1) (c) GDPR in conjunction with § 147 AO and § 14b UStG. The retention period is eight years for accounting vouchers and invoices, six years for commercial or business letters received or sent, and ten years for records and annual financial statements. During this time, processing is limited to meeting the retention obligation.

16. Sending email

Confirmations, such as the receipt of a withdrawal, an order or an appointment request, and messages about your transaction that we send from the website or from our customer records are sent through the service Resend (Resend, Inc., USA). Your email address and the content of the respective message are processed. Replies we write in our mailbox are sent through Google Workspace (section 9). We send no marketing newsletters.

Legal basis: Art. 6 (1) (b) GDPR for contract-related messages, otherwise Art. 6 (1) (f) GDPR.

17. AI-assisted reading of vehicle documents

When vehicle documents such as registration certificates or service records are sent to us, we use an AI-assisted reading service from Anthropic (Anthropic PBC, USA) to capture the technical vehicle data. The document, or an image of it, is transmitted for that purpose. The sole purpose is to take technical vehicle characteristics into our inventory; we check the results before publication.

The provider processes the data on our instructions as a processor and does not use it to train its models. Personal details of previous keepers or of workshops that did the work are not carried into public vehicle descriptions. No automated decision with legal effect on you is made.

Legal basis: Art. 6 (1) (b) GDPR for contract-related transactions, otherwise Art. 6 (1) (f) GDPR, our interest in capturing vehicle data correctly and efficiently.

18. Vehicle photos and media

We store vehicle photos in object storage on the Cloudflare infrastructure. Before publication we make sure that number plates, vehicle identification numbers and other identifying features are not visible, unless exceptionally necessary and permissible for the vehicle description.

19. YouTube videos

On some vehicle pages and in articles of our journal we embed videos from our YouTube channel. The embed works in two steps: when the page opens you see only a preview image stored by us, and no connection to YouTube is made. Only when you click the preview does the YouTube player load (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland), in privacy-enhanced mode via youtube-nocookie.com. From that click Google receives your IP address, the page viewed and details of your browser, may set cookies on your device and, if you are signed in to Google, may link the view to your account. Details are in Google's privacy policy.

The legal basis is your consent under Art. 6 (1) (a) GDPR and § 25 (1) TDDDG, which you give by clicking. It applies to the video you click during that page view only; we do not store it persistently. You can withdraw consent and close the player at any time using the button at the loaded video. “Reject all” under “Cookie settings” also closes loaded videos. This cannot retrieve data already sent to Google. Google LLC is certified under the EU-US Data Privacy Framework.

The player may use cookies and Web Storage for player functions, preferences, security and usage measurement. Our check on 15 October 2026 observed three localStorage entries on youtube-nocookie.com, including caption preferences. localStorage has no built-in expiry and can survive a browser session until Google, you or the browser deletes it. Google has not confirmed a fixed deletion period for these entries to us. The twelve months of our own statistics cookie do not apply to them. Processing and cookie lifetime details: Google Privacy, Google Cookies.

20. Partner offers: loan comparison and car insurance

Under vehicles and on the financing and insurance pages we link to comparison offers of a partner programme currently run by TARIFCHECK24 GmbH, Zollstraße 11b, 21465 Wentorf bei Hamburg. These links are labelled as advertising; if you conclude a contract through such a link we receive a commission. Clicking takes you off our website. We transmit no personal data; with the request the partner receives our partner id and, as with any link, the address of the page you came from and your IP address. The partner's privacy policy governs any further processing.

On the insurance page we may offer the partner's rate calculator directly on our site. It loads only with your consent: using the button to load the calculator, under “Cookie settings” or with “Accept all”. Without consent no connection to the partner is made. With your consent the partner's code loads on insurance pages, which processes your entries, your IP address and the partner's cookies. The calculator's form itself is provided by CHECK24 (kfz.check24.de), with which the partner works; CHECK24 therefore also receives your IP address and your entries, and CHECK24's privacy policy governs that processing. We remember your decision in a cookie for twelve months; you can withdraw consent at any time under “Cookie settings” or using the button at the loaded calculator. This deletes our cookie partner_calc_consent and closes the calculator. It does not delete data or cookies already held by the partner.

The legal basis for the links is Art. 6 (1) (f) GDPR, our interest in funding the site; for the calculator it is your consent under Art. 6 (1) (a) GDPR and § 25 (1) TDDDG.

The loaded comparison uses provider cookies and Web Storage for session management, comparison entries and referral attribution. Our check on 17 October 2026 observed entrysession on .check24.de lasting about three hours, a session cookie on form.partner-versicherung.de and five sessionStorage entries on kfz.check24.de. Session cookies last for the browser session, sessionStorage for the tab's page session; restoring a session can preserve data. This is a dated observation, not a complete list of provider cookies. The twelve months of partner_calc_consent apply only to our consent record. Provider information: Tarifcheck Datenschutz, CHECK24 Kfz Datenschutz, CHECK24 Cookies.

21. Recipients of your data

We pass data on only where necessary to perform the contract, where you have consented, or where the law requires it. The categories of recipient are: hosting and infrastructure providers, payment providers, messenger and email services, calendar and document services, transport, customs and registration partners, an AI provider for reading documents, video services that load only after your click and partner calculators that load only with your consent, a map service for calculating the journey, an audience measurement service that loads only with your consent, and our tax adviser and public authorities within statutory obligations. We do not sell data.

22. Transfers to third countries

Some of the providers named process data in the United States or other third countries, or can access it from there. We base such transfers on an adequacy decision of the European Commission where the provider is certified under the EU-US Data Privacy Framework, and otherwise on the European Commission's Standard Contractual Clauses under Art. 46 (2) (c) GDPR together with supplementary measures. Despite these safeguards, access by authorities in the third country cannot be entirely ruled out.

23. Retention period

We process personal data only for as long as the respective purpose requires. Enquiries and correspondence are deleted after the periods in section 9, customer area access as in section 13, contract and billing data after the statutory periods in section 15. Where data is held for several purposes it is deleted once the last purpose lapses.

24. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR). You may withdraw any consent given at any time with effect for the future (Art. 7 (3) GDPR).

Right to object under Art. 21 GDPR: Where we process data on the basis of legitimate interests under Art. 6 (1) (f) GDPR, you have the right to object at any time on grounds arising from your particular situation. We will then stop processing the data concerned unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.

An informal message to hanna@cargru.de is enough to exercise your rights.

25. Right to complain to the supervisory authority

Without prejudice to other remedies, you may lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:
Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach
Phone: +49 981 180093-0 · www.lda.bayern.de

26. Whether you have to provide data

Providing your data is neither required by law nor by contract. Without the details needed to handle it, however, we cannot deal with an enquiry, an order or an appointment.

27. No automated decision-making

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

28. Changes to this notice

We update this notice whenever the procedures we use or the legal framework change. The version published on this page applies.