Privacy policy

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

KFZ RBMOwner: Vlado RamadanovAm Neuhäusl 2493142 Maxhütte-Haidhof (Pirkensee district)Germany

Phone: +49 176 11848557

Email: kfzrbm@gmail.com

We process personal data only to the extent necessary to provide this website and our services. The legal bases are in particular:

• Art. 6(1)(b) GDPR – to perform a contract or to take steps prior to entering into a contract, e.g. for customer accounts, inquiries, vehicle offers and trade-ins;
• Art. 6(1)(c) GDPR – to comply with legal obligations, in particular retention obligations under commercial and tax law;
• Art. 6(1)(f) GDPR – on the basis of our legitimate interests, e.g. in the secure and stable operation of the website and in answering inquiries.

We do not use any analytics, tracking or advertising services and do not create usage profiles.

This website is hosted by Vercel Inc. (USA). When you access the website, technical data transmitted by your browser is processed automatically (server log files), in particular:

• IP address
• date and time of access
• page or file accessed
• referrer URL (the page visited before)
• browser type and operating system

This data is required to deliver the website and to ensure its security and stability, e.g. to fend off attacks. The legal basis is Art. 6(1)(f) GDPR. The data is not combined with other data.

Vercel processes the data on our behalf (Art. 28 GDPR). This may involve a transfer to the USA, which takes place on the basis of the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

Vercel privacy policy: vercel.com/legal/privacy-policy

For security reasons and to protect the data transmitted, such as your form entries and login details, this website uses SSL/TLS encryption. You can recognise an encrypted connection by “https://” in your browser’s address bar and by the padlock icon.

With encryption enabled, the data you send to us cannot be read by third parties.

For customer accounts, sign-in and the storage of inquiries, vehicle offers, favourites and uploaded photos we use Supabase (Supabase Inc.). Supabase provides the database, authentication and file storage and processes the data on our behalf (Art. 28 GDPR).

Passwords are stored in encrypted (hashed) form only; we have no access to your password. Photos of vehicle offers are kept in non-public storage and can only be accessed by you and by us.

The database, sign-in data and file storage of our Supabase project are stored in Frankfurt am Main (Germany, EU). The legal basis is Art. 6(1)(b) GDPR, otherwise Art. 6(1)(f) GDPR.

Supabase privacy policy: supabase.com/privacy

System emails, e.g. to confirm your registration or to reset your password, are sent via the email service Resend (Resend, Inc., USA). Your email address and the content of the message are processed for this purpose.

Resend acts on our behalf (Art. 28 GDPR). The legal basis is Art. 6(1)(b) GDPR. Any transfer to the USA takes place on the basis of the European Commission's standard contractual clauses.

Resend privacy policy: resend.com/legal/privacy-policy

You can create a customer account to offer vehicles, request trade-ins, view your inquiries and save favourites. For this we process:

• name
• email address
• password (stored in encrypted form only)
• phone number, if you add it to your profile

The processing serves to provide the customer account and to perform the services requested through it (Art. 6(1)(b) GDPR).

You can request the deletion of your account at any time by email to kfzrbm@gmail.com. Data that we must retain for legal reasons is blocked until the retention periods expire.

When you contact us via the contact form, a vehicle inquiry or a test drive request, we process:

• name and email address
• phone number (optional)
• your message
• for vehicle inquiries, the vehicle concerned
• for test drives, your preferred date

If you are signed in, we link the inquiry to your customer account so that you can view it there.

We use the information solely to handle your inquiry. The legal basis is Art. 6(1)(b) GDPR where your inquiry aims at a contract, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering). The same applies when you contact us by email or phone.

Our public email address is hosted by Google (Gmail, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). When you contact us by email, your message is therefore processed by Google. This may involve a transfer to the USA, which takes place on the basis of the EU-US Data Privacy Framework.

Google privacy policy: policies.google.com/privacy

To protect against spam, the forms contain a field that is invisible to people. No additional data is collected for this.

When you offer us a vehicle or request a trade-in through your customer account, we process:

• vehicle details such as make, model, year, mileage, equipment and condition
• your asking price or value estimate
• the type of sale you choose and, for a trade-in, the vehicle you want
• the photos you upload

We use the data to assess your vehicle, make you an offer and handle the purchase, trade-in or sale on your behalf (Art. 6(1)(b) GDPR).

If we take your vehicle into our stock or sell it on your behalf, the vehicle details and photos may appear in the public vehicle listing on this website. Your name and contact details are not published.

Please make sure that no people or other vehicles' number plates can be recognised in the photos.

When signed in, you can save vehicles as favourites. They are stored with your customer account until you remove them or your account is deleted (Art. 6(1)(b) GDPR).

We only use technically necessary cookies:

• NEXT_LOCALE – stores the language you have chosen; kept for one year.
• sb-…-auth-token – keeps you signed in after login; deleted when you sign out, at the latest after 400 days.
• sb-…-code-verifier – short-lived security cookie during sign-in and password reset.

These cookies are strictly necessary for the functions you use and are therefore permitted without consent (§ 25(2) no. 2 TDDDG). The legal basis for the processing is Art. 6(1)(b) or (f) GDPR.

We do not use cookies for analytics, tracking or advertising.

The font used on this website is delivered together with the website by our hosting provider. No connection to servers of Google or other font providers is made when you open the pages.

We link to our pages on Facebook and Instagram (Meta Platforms Ireland Ltd.). These are simple links, not embedded plugins: no data is sent to these networks when you visit our website.

Only when you click a link are you taken to the respective network's page, where its privacy policy applies.

Your data is only received by the service providers named in this policy, who act as processors on our behalf. Beyond that, we only pass on data where this is necessary to perform a contract or where we are legally obliged to do so.

We do not sell personal data or pass it on for advertising purposes.

We store personal data only for as long as necessary for the respective purpose:

• customer account and favourites: until the account is deleted;
• inquiries: until they have been fully handled; we then delete them unless they are needed for a contract;
• vehicle offers and trade-ins: until the process is completed or until you request deletion;
• server log files: only briefly, as set by our hosting provider;
• data subject to statutory retention obligations (e.g. business letters and accounting records under § 257 HGB and § 147 AO): for these periods of six or ten years.

Within the statutory framework you have the following rights:

• access to your stored data (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• objection to processing (Art. 21 GDPR)
• withdrawal of any consent given, with effect for the future (Art. 7(3) GDPR)

Right to object: where we process data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation.

To exercise your rights, simply send an email to kfzrbm@gmail.com.

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA, Bavarian Data Protection Authority)Promenade 1891522 AnsbachGermany

Website: www.lda.bayern.de

You are not obliged to provide personal data. Without the information marked as required, however, we cannot set up a customer account or handle your inquiry or offer.

There is no automated decision-making, including profiling (Art. 22 GDPR).