Privacy.

The controller within the meaning of Art. 4 (7) GDPR is Schaltkulisse GmbH, Hochstraße 21–23, 82024 Taufkirchen, Germany. Phone +49 89 6387912910, email [email protected]. Managing director: Kevin Braun.

When you visit the site, your browser automatically transmits technical data — IP address, date and time of the request, the page requested, referrer and browser/operating system. We need this to deliver the site and to keep it secure (legitimate interest, Art. 6 (1) (f) GDPR).

When you contact us by form, email or phone, we process the details you give us (typically name, email, phone and your message) to answer your enquiry and, where applicable, to prepare or perform a contract (Art. 6 (1) (b) GDPR) or on the basis of our legitimate interest in answering you (Art. 6 (1) (f) GDPR).

When you sign up for the newsletter, we process your email address on the basis of your consent (Art. 6 (1) (a) GDPR), which you can withdraw at any time with effect for the future.

The website, its database and uploaded files are hosted by Scaleway SAS, 8 rue de la Ville l'Évêque, 75008 Paris, France, in data centres in Paris, France. Images and documents such as vehicle exposés are stored in Scaleway Object Storage and delivered via Scaleway Edge Services (media.schaltkulisse.com). Scaleway processes all data transmitted when the site is used on our behalf under a data-processing agreement (Art. 28 GDPR).

Requests to the site pass through Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA), which provides the content-delivery network, protection against attacks and bots, and the video on our home page (Cloudflare Stream). Cloudflare processes your IP address and technical request data for this purpose. The legal basis is our legitimate interest in a fast and secure website (Art. 6 (1) (f) GDPR); a data-processing agreement is in place. On data transfers to the USA see section X.

Form submissions (contact, car enquiry and event registration) are stored in our own database at Scaleway (see section III). To notify us, the content of your submission is sent by email to our mailbox through the email service Resend (Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA). Our mailboxes are provided by Microsoft 365 (Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland). Both act as processors under data-processing agreements. On data transfers to the USA see section X.

To protect our forms against spam and automated abuse we use Cloudflare Turnstile. Turnstile evaluates technical signals from your browser (for example IP address and browser characteristics) to tell humans from bots, without setting advertising cookies. The legal basis is our legitimate interest in protecting the forms (Art. 6 (1) (f) GDPR).

If you subscribe to our newsletter, we store your email address, the language you chose and the time of your sign-up in our database at Scaleway (see section III) and use them only to send you our newsletter. You can unsubscribe at any time using the link in every newsletter or by writing to [email protected]; your address is then removed from the mailing list.

This site uses fonts from Adobe Fonts, a service of Adobe Systems Software Ireland Ltd., 4–6 Riverwalk, Citywest Business Campus, Dublin 24, Ireland. To display the fonts, your browser loads them from Adobe's servers, which transmits your IP address to Adobe; Adobe states that no cookies are set for this. The legal basis is our legitimate interest in a consistent typographic presentation (Art. 6 (1) (f) GDPR). Adobe may process data in the USA; see section X.

The video on our home page is delivered by Cloudflare Stream (see section III).

Our film pages show videos from YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) in YouTube’s privacy-enhanced mode (youtube-nocookie.com). The player is only loaded once you have consented to external media — in the cookie banner or by clicking “Load video”. Only then is a connection to YouTube’s servers established, your IP address and technical data are transmitted to Google, and YouTube may store information on your device when you play the video. The legal basis is your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG), which you can withdraw at any time via “Cookie settings”. Google may process data in the USA; see section X.

We use cookies and similar technologies that are strictly necessary to provide the site without asking for consent (§ 25 (2) TDDDG): a cookie that remembers your language preference, a cookie that stores your cookie choice for twelve months, security mechanisms of Cloudflare that distinguish legitimate visitors from bots, and — for our editors only — a login session for the content management system. We do not use advertising cookies.

Everything else needs your consent, which you give or refuse in the cookie banner on your first visit (§ 25 (1) TDDDG, Art. 6 (1) (a) GDPR). This concerns external media (YouTube, see section VII) and web analytics (Google Analytics and PostHog, see section IX). You can change or withdraw your choice at any time with effect for the future via “Cookie settings” at the bottom of every page.

If you consent to statistics in the cookie banner, we use Google Analytics 4 (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) and PostHog (PostHog, Inc., USA; our data is hosted in the EU, in Frankfurt) to understand how the site is used and how fast it is — for example which pages and cars are viewed, where visitors come from, how they move through the site, which enquiry buttons and forms are used (whether a form is started and sent — never what is typed into it), and loading times. For this, cookies or similar identifiers are stored on your device and pseudonymised usage data, device and browser information are processed; Google Analytics 4 does not store IP addresses. PostHog may additionally record pseudonymised sessions (clicks, scrolling, mouse movements) to help us improve the site; anything typed into form fields is never recorded.

The legal basis is your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG); without it, neither service is loaded. You can withdraw your consent at any time with effect for the future via “Cookie settings” at the bottom of every page; the analytics cookies are then deleted. Both providers act as processors under data-processing agreements. Google Analytics data is deleted after 14 months, PostHog data according to the retention settings of our PostHog project. Google and PostHog may process data in the USA; see section X.

Some of the providers named above (Cloudflare, Resend, Adobe, Google, PostHog, Microsoft) are based in the USA or may process data there. Where a provider is certified under the EU–US Data Privacy Framework, the transfer is based on the European Commission's adequacy decision (Art. 45 GDPR); otherwise, and in addition where required, standard contractual clauses (Art. 46 GDPR) are in place.

We delete personal data as soon as it is no longer needed for the purpose it was collected for. Enquiries are kept for as long as needed to handle them and any resulting business relationship. Where statutory retention periods apply — in particular for commercial and tax records (§ 257 HGB, § 147 AO, up to ten years) — we keep the data for that period and restrict its processing. Newsletter data is kept until you unsubscribe. Server log data is kept only as long as needed for security purposes.

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to withdraw any consent you have given at any time with effect for the future (Art. 7 (3)).

Where we process data on the basis of legitimate interest (Art. 6 (1) (f) GDPR), you have the right to object to the processing on grounds relating to your particular situation (Art. 21 GDPR). To exercise any of these rights, write to [email protected].

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany.