Privacy Policy

1. Controller The controller responsible for data processing under the General Data Protection Regulation (GDPR) is: AUTO AUA GmbH, Roelckestraße 102, 13088 Berlin, Germany Phone: +49 157 777 721 02, Email: info@autoaua.de 2. Overview of processing activities We process personal data when you request a workshop appointment, order parts through our shop, apply for a job, or contact us. Specifically: a) Appointment requests (workshop) When requesting an appointment, we collect your license plate, issue description, name, phone number, and optionally your email address. This data is used to process your request and schedule the appointment, and is stored internally; a notification is additionally sent by email to our staff. Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures). b) Orders in the parts shop When placing an order, we collect your name, email address, optionally your phone number, and — for shipped orders — your delivery address. This data is processed to fulfil the contract (order processing, shipping, communication). Legal basis: Art. 6(1)(b) GDPR. c) Payment processing Payments are processed via our payment provider Mollie B.V. (Keizersgracht 313, 1016 EE Amsterdam, Netherlands). The data required for payment processing (e.g. name, order amount, payment method) is transmitted to Mollie. Mollie's privacy policy applies in addition: https://www.mollie.com/en/privacy. Legal basis: Art. 6(1)(b) GDPR. d) Shopping cart The shopping cart is stored exclusively locally in your browser (localStorage) and is not transmitted to us until you complete an order. This is not a cookie; no consent is required. e) Hosting and server log files When you visit our website, our hosting provider automatically collects technical data (e.g. IP address, date/time, page requested) in server log files. This is technically necessary to deliver the website and ensure operational security. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure and functioning website). f) Admin area For staff members with access to our internal administration area, a technically necessary session cookie is set. This cookie is exempt from consent requirements under § 25(2) TDDDG (Telecommunications-Digital-Services-Data-Protection Act), as it is required to provide the service you explicitly requested (login). g) Applications When you apply via our jobs page, we collect your name, email address, optionally a phone number, a message, and optionally an uploaded CV (PDF, DOC, or DOCX, max. 5 MB). This data is used to review and process your application, stored internally, and forwarded by email to the staff responsible for hiring, including any uploaded CV as an attachment. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measure regarding a possible employment relationship). h) Google reviews In the “What our customers say” section, we display genuine reviews from our Google Business Profile. These are retrieved server-side via the Google Places API and cached in our database; loading our website does not establish any connection between your browser and Google. We display the reviewer's name, star rating, and review text as already published publicly by them on Google; we do not store profile photos. Legal basis is our legitimate interest (Art. 6(1)(f) GDPR) in presenting already publicly available customer feedback. Reviewers may request removal of their review from this page by contacting us using the details in section 1. 3. Cookies and external content This website does not use analytics, marketing, or tracking cookies. On our contact page, we optionally offer a location map from OpenStreetMap. This map is only loaded after you have given explicit consent (via the cookie banner or the "Load map" button in the contact section). Loading the map transmits your IP address to the OpenStreetMap Foundation; no cookies of our own are set by this website in the process. Legal basis is your consent (Art. 6(1)(a) GDPR). You can change your choice at any time via the "Cookie settings" link in the footer. 4. Disclosure of data Your data is only disclosed to third parties where necessary to fulfil the contract (e.g. payment provider Mollie, any shipping provider) or where we are legally obliged to do so. 5. Retention period We retain personal data only for as long as necessary for the stated purposes, or as required by statutory retention obligations (e.g. commercial and tax law requirements, typically 6–10 years for business records). 6. Your rights You have the right to access, rectify, erase, and restrict the processing of your personal data, as well as the right to data portability and to object to processing. You also have the right to lodge a complaint with a data protection supervisory authority, e.g. the Berlin Commissioner for Data Protection and Freedom of Information. 7. Automated decision-making No automated decision-making, including profiling within the meaning of Art. 22 GDPR, takes place. 8. Changes to this privacy policy We reserve the right to amend this privacy policy whenever changes to our data processing make this necessary. 9. Language The German-language version of this privacy policy (/de) is legally authoritative; this English text is provided for convenience only.