Privacy notice

Please note: this is a translation for your convenience. The German version of this page is the legally binding one.

1. Controller

The controller for data processing on this website is:
Destacar, Owner Denis Rem, sole trader, Strobenrieder Str. 97, 86579 Waidhofen, Germany
Email: info@destacar.de · Phone: +49 176 23771650

No data protection officer has been appointed, as the conditions of § 38 BDSG are not met. For any data protection question please write to the address above.

2. Hosting and delivery of the website

The website runs on Cloudflare's infrastructure (Cloudflare Germany GmbH, Rosental 7, 80331 Munich; parent company Cloudflare, Inc., USA). Cloudflare provides the computing, the content delivery network, attack protection, the delivery of our email and the database and storage services we use. In doing so it processes all data required to serve and operate the site.

The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest lies in providing the site securely, reliably and fast. A data processing agreement under Art. 28 GDPR is in place with Cloudflare.

3. Server log files

Every request causes technical connection data to be processed: a shortened IP address, the date and time, the address requested, the volume transferred, the status code, the referrer and the browser and operating system identifiers. This is needed to serve the site, keep it stable and fend off attacks. It is not combined with other sources to identify individuals.

Legal basis: Art. 6 (1) (f) GDPR. Deleted after 30 days at the latest, unless needed to investigate a specific security incident.

4. Cookies and storage on your device

Without any action on your part we set only the cookies Cloudflare needs for its security check and abuse prevention, plus the language cookie described in the next paragraph. Three further items are stored only at your request: if you choose a price view on the vehicle pages (private buyer in Germany, business in the EU or export), a cookie remembers that choice for twelve months. In the customer area for your transaction (section 13) a cookie remembers the device you confirmed. And if you load a partner's insurance calculator (section 20) we store that decision in a cookie so you are not asked again on every visit. We set no analytics, advertising or tracking cookies. That is why there is no cookie banner: services that need your consent load only when you click them where they appear.

One further strictly necessary cookie records which language you are reading these pages in. It is called destacar_lang and holds one of three words only: “de”, “en” or “ru”. Without it your browser's language setting would send you back to the language it prefers every time you open the front page, even after you picked a different one in the header. It stores nothing about you as a person, it is closed to scripts in the browser, and it expires after twelve months. Legal basis: the cookie needs no consent under § 25 (2) no. 2 TDDDG, because without it the language you chose cannot be served; the subsequent processing rests on Art. 6 (1) (f) GDPR, our legitimate interest being to show you the pages in the language you want to read them in.

The strictly necessary cookies, the price-view cookie included, need no consent under § 25 (2) no. 2 TDDDG, because they are essential to provide the service you expressly asked for; the subsequent processing rests on Art. 6 (1) (f) GDPR, in the customer area on Art. 6 (1) (b) GDPR. The insurance calculator cookie rests on your consent under § 25 (1) TDDDG and Art. 6 (1) (a) GDPR.

5. Fonts and images

Fonts and images are bundled when the pages are built and served from our own server. Visiting the site opens no connection to third-party servers for them.

6. Audience measurement (Cloudflare Web Analytics)

We use Cloudflare Web Analytics (provider as in section 2) to measure the reach of this website. Only aggregate figures per page view are collected: the page viewed, the referrer, the approximate country, the device type and technical load times.

Cloudflare Web Analytics sets no cookies, reads nothing from your device and stores nothing on it. There is no fingerprinting, individual visitors are not recognised, and no cross-site or cross-device profiles are built. It therefore involves no access to terminal equipment within the meaning of § 25 (1) TDDDG.

In addition, on our vehicle pages we count views per vehicle and day in our own database on the Cloudflare infrastructure named above. Only the number of views is stored, not who caused them. To fend off automated mass requests we keep a shortened, irreversible check value of your IP address for at most one hour; it cannot be traced back to you.

The legal basis in each case is Art. 6 (1) (f) GDPR. Our legitimate interest is to see which content is in demand and whether the site is delivered without technical faults.

7. Contact, vehicle and appointment enquiries

When you use our enquiry form or contact us by email, phone, WhatsApp or Telegram, we process the details you provide, usually your name, contact details, the vehicle concerned and the content of your message, in order to handle your enquiry. For workshop enquiries (air-conditioning service, detailing, chip tuning and coding) the details needed for that are added, such as model, engine, year, mileage, the condition of the vehicle or photos you send. Nothing you send is displayed publicly.

The legal basis is Art. 6 (1) (b) GDPR where the enquiry serves to prepare or perform a contract, otherwise Art. 6 (1) (f) GDPR, our interest in handling enquiries properly. Section 9 says how long we keep enquiries and the related correspondence.

8. Spam and abuse protection (Cloudflare Turnstile)

We use Cloudflare Turnstile to protect our forms against automated submissions. Technical characteristics of your browser and your IP address are sent to Cloudflare and assessed to tell a human apart from an automated system. Turnstile uses no advertising cookies and builds no cross-device profiles.

Legal basis: Art. 6 (1) (f) GDPR, our interest in preventing abuse and spam.

9. Customer records and storage of correspondence

We keep enquiries, orders, contracts and the related communication together in our own customer records, which run on the Cloudflare infrastructure named above. There we also store the content of the messages you send us on WhatsApp, Telegram or by email, and our replies. The purpose is that any team member with access can follow a transaction and that what was agreed about the vehicle, the price and the appointment stays on record.

Messages on WhatsApp reach us through the WhatsApp Business Platform of Meta Platforms Ireland Limited (Merrion Road, Dublin 4, Ireland), messages on Telegram through the interface of Telegram FZ-LLC (Dubai, United Arab Emirates); email is delivered through Cloudflare. In doing so these providers process your phone number or account identifier and the metadata of the transmission under their own privacy terms. If you would rather avoid that, please email or call us.

The legal basis is Art. 6 (1) (b) GDPR where the correspondence prepares or concerns a contract, otherwise Art. 6 (1) (f) GDPR, our interest in orderly and documented handling. Correspondence without a contract is deleted at the latest twelve months after the last message. Correspondence relating to a contract counts as a commercial letter and is kept for six years after the end of the year in which the transaction was closed (§ 257 HGB, § 147 AO); it is deleted after that.

10. Internal notifications via Telegram

We notify our team of incoming enquiries, orders and withdrawals through a Telegram bot. Your name, the subject of the enquiry and the content of the message may be transmitted to Telegram (provider as in section 9).

Legal basis: Art. 6 (1) (f) GDPR, our interest in responding promptly. If you would rather avoid this transmission, please contact us by email or phone.

11. Appointments in the Google calendar

When we arrange an appointment with you, for example to view a vehicle, for a mobile vehicle inspection or for workshop work, we enter it in the team calendar we keep at Google Workspace (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). The entry holds the date and time, the service requested, your name, the vehicle and the phone number or email address for queries. Appointment requests made through the website are first created as a provisional entry by a script on Google's side; a team member confirms the appointment and replies to you.

Legal basis: Art. 6 (1) (b) GDPR. Google processes the data as a processor under Art. 28 GDPR on the basis of the Google Workspace terms. We delete the calendar entry at the latest three years after the appointment; details we need for invoicing are unaffected and follow the periods in section 15.

12. Contracts, orders and payment

When a purchase, brokerage or service contract is concluded we process your name, email address, phone number, postal address, the subject of the contract including the vehicle data, the contract value and the payment and processing status. For workshop work the details needed to carry it out and bill it are added, such as the scope of the work done, the quantity of refrigerant filled, the software versions read out and installed, and the invoice amount. This data is necessary to perform the contract.

Payment for services booked online is handled by Stripe (Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland; parent company Stripe, Inc., USA). You enter your payment details directly with Stripe. We neither collect nor store card data; Stripe only tells us the payment status and the details needed to match the payment. Stripe's privacy notice applies in addition. Vehicle purchases are settled by bank transfer.

Legal basis: Art. 6 (1) (b) GDPR; for fraud prevention Art. 6 (1) (f) GDPR.

13. Customer area for your transaction

For ongoing sales and export transactions we set up, on request, a customer area where you can see the status of your transaction and upload the documents required. Access is through a personal link carrying a random access token, which we store only in hashed form, and a one-time six-digit code that we send you by email or Telegram and that is valid for ten minutes. A cookie remembers a confirmed device so you need not request a new code on every visit. We record which token was created, confirmed and revoked, and when.

Uploaded documents, such as identity or vehicle documents for registration, export and customs, are held in the object storage of the Cloudflare infrastructure and are visible only to you and our team. Access ends thirty days after the transaction is closed; we then move the documents to the transaction file (section 15) and delete them from the customer area.

Legal basis: Art. 6 (1) (b) GDPR. The cookie needs no consent under § 25 (2) no. 2 TDDDG, because it is essential for the access you expressly asked for.

14. Handover, registration, transport and export

To prepare the handover of a vehicle we pass the data required to the parties involved, for example a transport company or freight forwarder we have engaged, a registration office or registration service and, for exports, the customs broker and the customs authorities, where you order such a service or the law requires it. Only the details needed for the respective purpose are passed on.

Legal basis: Art. 6 (1) (b) GDPR; for notifications required by law Art. 6 (1) (c) GDPR.

15. Invoices, files and statutory retention

We retain contracts, invoices, handover reports and the related accounting records as commercial and tax law requires. The files are kept in a document archive at Google Workspace (Google Drive; provider as in section 11), which Google operates as a processor. The legal basis is Art. 6 (1) (c) GDPR in conjunction with § 147 AO and § 257 HGB. The retention period is eight years for accounting records and invoices, six years for commercial letters and ten years for annual accounts, ledgers and inventories. During that time processing is limited to meeting the retention obligation.

16. Sending email

For confirmations, such as the receipt of a withdrawal, for replies to enquiries and for messages about your transaction we use the service Resend (Resend, Inc., USA). Your email address and the content of the respective message are processed. We send no marketing newsletters.

Legal basis: Art. 6 (1) (b) GDPR for contract-related messages, otherwise Art. 6 (1) (f) GDPR.

17. AI-assisted reading of vehicle documents

When vehicle documents such as registration certificates or service records are sent to us, we use an AI-assisted reading service from Anthropic (Anthropic PBC, USA) to capture the technical vehicle data. The document, or an image of it, is transmitted for that purpose. The sole purpose is to take technical vehicle characteristics into our inventory; we check the results before publication.

The provider processes the data on our instructions as a processor and does not use it to train its models. Personal details of previous keepers or of workshops that did the work are not carried into public vehicle descriptions. No automated decision with legal effect on you is made.

Legal basis: Art. 6 (1) (b) GDPR for contract-related transactions, otherwise Art. 6 (1) (f) GDPR, our interest in capturing vehicle data correctly and efficiently.

18. Vehicle photos and media

We store vehicle photos in object storage on the Cloudflare infrastructure. Before publication we make sure that number plates, vehicle identification numbers and other identifying features are not visible, unless exceptionally necessary and permissible for the vehicle description.

19. YouTube videos

On some vehicle pages and in articles of our journal we embed videos from our YouTube channel. The embed works in two steps: when the page opens you see only a preview image stored by us, and no connection to YouTube is made. Only when you click the preview does the YouTube player load (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland), in privacy-enhanced mode via youtube-nocookie.com. From that click Google receives your IP address, the page viewed and details of your browser, may set cookies on your device and, if you are signed in to Google, may link the view to your account. Details are in Google's privacy policy.

The legal basis is your consent under Art. 6 (1) (a) GDPR and § 25 (1) TDDDG, which you give by clicking. It applies to that page view only; we do not store it. Google LLC is certified under the EU-US Data Privacy Framework.

20. Partner offers: loan comparison and car insurance

Under vehicles and on the financing and insurance pages we link to comparison offers of a partner programme currently run by Tarifcheck.de AG, Zollstraße 11b, 21465 Wentorf bei Hamburg. These links are labelled as advertising; if you conclude a contract through such a link we receive a commission. Clicking takes you off our website. We transmit no personal data; with the request the partner receives our partner id and, as with any link, the address of the page you came from and your IP address. The partner's privacy policy governs any further processing.

On the insurance page we may offer the partner's rate calculator directly on our site. It loads only when you click the button to load the calculator; before that no connection to the partner is made. The click loads the partner's code into the page, which processes your entries, your IP address and the partner's cookies. The calculator's form itself is provided by CHECK24 (kfz.check24.de), with which the partner works; CHECK24 therefore also receives your IP address and your entries, and CHECK24's privacy policy governs that processing. We remember your decision in a cookie for twelve months; you can revoke it at any time by deleting that cookie.

The legal basis for the links is Art. 6 (1) (f) GDPR, our interest in funding the site; for the calculator it is your consent under Art. 6 (1) (a) GDPR and § 25 (1) TDDDG.

21. Recipients of your data

We pass data on only where necessary to perform the contract, where you have consented, or where the law requires it. The categories of recipient are: hosting and infrastructure providers, payment providers, messenger and email services, calendar and document services, transport, customs and registration partners, an AI provider for reading documents, video and partner services that load only when you click them, and our tax adviser and public authorities within statutory obligations. We do not sell data.

22. Transfers to third countries

Some of the providers named process data in the United States or other third countries, or can access it from there. We base such transfers on an adequacy decision of the European Commission where the provider is certified under the EU-US Data Privacy Framework, and otherwise on the European Commission's Standard Contractual Clauses under Art. 46 (2) (c) GDPR together with supplementary measures. Despite these safeguards, access by authorities in the third country cannot be entirely ruled out.

23. Retention period

We process personal data only for as long as the respective purpose requires. Enquiries and correspondence are deleted after the periods in section 9, customer area access as in section 13, contract and billing data after the statutory periods in section 15. Where data is held for several purposes it is deleted once the last purpose lapses.

24. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR). You may withdraw any consent given at any time with effect for the future (Art. 7 (3) GDPR).

Right to object under Art. 21 GDPR: Where we process data on the basis of legitimate interests under Art. 6 (1) (f) GDPR, you have the right to object at any time on grounds arising from your particular situation. We will then stop processing the data concerned unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.

An informal message to info@destacar.de is enough to exercise your rights.

25. Right to complain to the supervisory authority

Without prejudice to other remedies, you may lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:
Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach
Phone: +49 981 180093-0 · www.lda.bayern.de

26. Whether you have to provide data

Providing your data is neither required by law nor by contract. Without the details needed to handle it, however, we cannot deal with an enquiry, an order or an appointment.

27. No automated decision-making

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

28. Changes to this notice

We update this notice whenever the procedures we use or the legal framework change. The version published on this page applies.