0
10
20
30
40
50
60
70
80
90
100
0
10
20
30
40
50
60
70
80
90
100
Geigercars.de
Geigercars.de

Privacy policy

Last updated: September 2026. This is a translation for convenience. The German version is legally binding.

1. Controller

The controller responsible for data processing on this website is:

GeigerCars.de GmbH
Zamdorfer Straße 6-8
81677 Munich
Germany

Phone: +49 89 427164-13
Email: info@geigercars.de

2. Data protection officer

We have appointed an external data protection officer:

Gert Landauer
HWH – Gesellschaft für Datenschutz & Beratung GmbH
BGM-Rohrmüller-Straße 14
86554 Pöttmes
Germany

Phone: +49 8091 3939860
Email: landauer@hwh-datenschutz.de

3. Overview

This privacy policy explains which personal data is processed when you visit this website, for what purpose and on what legal basis. Personal data is any data that can be used to identify you personally.

In short:

  • We only use Google Analytics and Google Ads if you have consented in the cookie banner. Without your consent, no connection to Google is established.
  • For anonymous audience measurement we use Vercel Web Analytics. It sets no cookies and does not recognise you across days.
  • Fonts are loaded from our own server, not from Google.
  • YouTube videos and Google Maps are only loaded after you click. Until then, no connection to Google is established.
  • Data you send us through a form is used only to handle your request.

4. Legal bases

We process personal data on the following legal bases of the General Data Protection Regulation (GDPR):

  • Art. 6 (1) (a) GDPR: consent. Where information is stored on or read from your device, also § 25 (1) TDDDG. You can withdraw your consent at any time with effect for the future.
  • Art. 6 (1) (b) GDPR: performance of a contract or pre-contractual measures, for example for enquiries about vehicles, parts or workshop services.
  • Art. 6 (1) (c) GDPR: compliance with legal obligations, such as retention obligations under tax and commercial law.
  • Art. 6 (1) (f) GDPR: legitimate interests, for example in the secure and stable operation of this website. Where information is stored on or read from your device that is strictly necessary for the service you requested, also § 25 (2) no. 2 TDDDG.

5. Hosting and delivery of the website

Vercel

This website is hosted by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA. When you visit the website, Vercel automatically processes data transmitted by your browser (server log files):

  • IP address
  • date and time of the request
  • page requested and amount of data transferred
  • referrer URL (the previously visited page)
  • browser type and version, and operating system

This data is technically necessary to deliver the website and serves its stability and security. It is not combined with other data sources and is deleted after a short period. The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest lies in delivering the website securely, quickly and without errors.

Vercel processes the data on our behalf under a data processing agreement. Data may be transferred to the USA. Vercel is certified under the EU-US Data Privacy Framework (DPF), for which the European Commission has adopted an adequacy decision (Art. 45 GDPR). More information: vercel.com/legal/privacy-policy.

Sanity

We manage the content of this website (texts, images, product data) with the content management system Sanity, provided by Sanity AS, Grensen 13, 0159 Oslo, Norway. Images are delivered through our hosting provider; your browser does not connect to Sanity directly, and Sanity receives no data about visitors to this website.

Fonts

The fonts used on this website are embedded locally and loaded from our own server. No connection to servers of Google or other providers takes place.

SSL/TLS encryption

For security reasons, this website uses SSL/TLS encryption. You can recognise an encrypted connection by "https://" in your browser's address bar. Data you send us cannot be read by third parties.

6. Cookies, consent and web analytics

Without your consent, we only use entries in your browser's storage that are strictly necessary to run the website (§ 25 (2) no. 2 TDDDG), for example to store your choice in the cookie banner. All entries with name, purpose and duration are listed in our cookie policy. Where embedded third-party content (YouTube, Google Maps, vehicle inventory) uses cookies, this is described in the respective sections.

Consent management

On your first visit, a banner asks whether you allow statistics (Google Analytics) and marketing (Google Ads). Your choice is stored in your browser's local storage (entry gc_consent) and is valid for six months. You can change it or withdraw it with effect for the future at any time via “Cookie settings” in the footer of every page.

To be able to demonstrate that consent was given (Art. 7 (1) GDPR), we log every decision on our server: the selected categories, the time, the consent version, a randomly generated identifier and the page on which you decided. We do not store your IP address, browser data or any other information about you. The legal basis is Art. 6 (1) (c) GDPR.

Vercel Web Analytics

To see which pages are visited and how often, we use Vercel Web Analytics by Vercel Inc. (address in section 5). It records the page visited, the previous page (referrer), browser, operating system, device type and the country derived from the IP address. The script is loaded from our own domain.

Vercel Web Analytics sets no cookies and does not store or read any information on your device. To group page views within one visit, Vercel creates a hash from characteristics of the request (such as the IP address and user agent) using a key that changes daily. This value is discarded after 24 hours, and the IP address is not stored. It is therefore not possible to recognise you across days or to identify you.

We have a legitimate interest in evaluating the use of our website in this data-minimising way in order to improve it (Art. 6 (1) (f) GDPR). Vercel processes the data on our behalf; the information in section 5 on the data processing agreement and possible transfers to the USA applies. You can object to this processing under Art. 21 GDPR (see section 15).

Google Tag Manager

We use Google Tag Manager from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Tag Manager is a tool we use to embed the Google services described below. It sets no cookies itself, but when it loads it connects to Google and transmits your IP address.

Tag Manager is only loaded after you have consented to statistics or marketing. Which services it then runs depends on your choice (Google Consent Mode). The legal basis is your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG).

Google Analytics 4

With your consent to statistics, we use Google Analytics 4 from Google Ireland Limited to analyse how our website is used: for example pages viewed, time spent, clicks on the phone number or email address, approximate region, device and browser, and the website you came from. Cookies (_ga, _ga_ZM6TNF3S70) are set and a pseudonymous identifier is assigned. Google Analytics 4 does not store IP addresses.

We use these reports to improve the website and our offering. The data is deleted after the retention period set in our account (at most 14 months). The legal basis is your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG).

Google Ads, conversion tracking and remarketing

With your consent to marketing, we use Google Ads from Google Ireland Limited. If you reach the website through one of our Google ads, the click identifier from the address bar is stored in cookies (_gcl_au, _gcl_aw and our own entry _gc_clid). If you then send us an enquiry, we and Google can tell that it came from an ad (conversion tracking). So that we can attribute a later purchase to the ad, the click identifier is also sent along with your enquiry: in the enquiry email to us for our own forms (section 7), and to Autegro for the vehicle and purchase widget (see “Where enquiries come from”).

For more accurate attribution (enhanced conversions), after you submit a form we transmit your email address and phone number to Google only as a SHA-256 hash. No plain-text contact details are sent to Google. Google matches the hash against signed-in Google accounts and then deletes it.

We also use remarketing: Google may show our ads to visitors of our website on other websites and in Google services. For this, Google may set its own cookies, including on the doubleclick.net domain. We only receive aggregated reports, no information about individuals.

The legal basis is your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG).

Transfers to the USA

For all Google services in this section, data may be transferred to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework (DPF), for which the European Commission has adopted an adequacy decision (Art. 45 GDPR). More information: policies.google.com/privacy and business.safety.google/privacy.

Where enquiries come from

With your consent to marketing, we store in the af_attribution cookie how you reached our website: source and medium (such as a search engine, an ad or a referring website), where applicable the campaign name and the click identifier from the address bar (gclid, gbraid, wbraid, fbclid), the referring page, the page you arrived on and the time. The cookie contains no contact details. It is only written or updated when a visit comes through a recognisable channel, is kept for 90 days and is deleted when you withdraw your consent. The legal basis is your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG).

Enquiries sent through the vehicle or purchase widget go to Auto Freunde GmbH (Autegro), which processes them on our behalf (see section 10). The widget transmits this information along with your enquiry; without the cookie, only the corresponding information from your current visit, such as campaign details in the address bar. This shows us which channels enquiries come from. The legal basis for this transmission is Art. 6 (1) (f) GDPR; our legitimate interest lies in the cost-effectiveness of our advertising.

7. Contact and enquiry forms

When you contact us through one of our own forms on this website, for example with a general question, about a part or a workshop appointment, we process the data you provide. This usually includes your name, email address, phone number if given, your message, a preferred appointment date or contact person and the page from which you sent the enquiry. For workshop enquiries you can also upload your vehicle registration document. Enquiries about a vehicle in our inventory and offers through our purchase form go through the Autegro widget instead (see below).

We use the data from our own forms and from the widget exclusively to handle your enquiry and answer follow-up questions. The legal basis is Art. 6 (1) (b) GDPR where your enquiry relates to a contract or pre-contractual measures, and otherwise Art. 6 (1) (f) GDPR. Our legitimate interest lies in answering enquiries addressed to us.

To protect against automated spam, our own forms contain a field that is invisible to humans. No additional data is collected and no third-party services are used for this.

If you reached our website through a Google ad, we note the ad's click identifier (gclid, gbraid or wbraid) in the enquiry email for enquiries through our own forms. It contains no information about you and serves to measure the success of our ads (see section 6). The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest lies in the cost-effectiveness of our advertising.

Email delivery via Postmark

Submissions from our own forms are sent to us by email, an uploaded registration document as an attachment. Files are not stored on the web server. For delivery we use Postmark, a service of ActiveCampaign, LLC, 1 N Dearborn Street, 5th Floor, Chicago, IL 60602, USA. Postmark processes the content of your enquiry solely to deliver the email and keeps delivery logs for a limited period.

Postmark processes the data on our behalf under a data processing agreement. Data is transferred to the USA. ActiveCampaign is certified under the EU-US Data Privacy Framework (DPF) (Art. 45 GDPR). More information: postmarkapp.com/eu-privacy.

Enquiries through the vehicle and purchase widget

If you enquire about a vehicle directly in our vehicle inventory or use our purchase form, you send your enquiry through the Autegro widget. Your details are then not sent by email via Postmark but directly to Auto Freunde GmbH, which processes them on our behalf and makes them available to us for handling. Details are in section 10.

Retention

We delete your enquiry once it has been fully handled, unless statutory retention obligations apply. If an enquiry leads to a contract, the statutory retention periods of up to ten years apply.

8. Contact by email or phone

If you contact us by email or phone, we process your details to handle your request. The legal bases and retention periods are the same as for the contact forms (section 7).

9. Job applications

You can apply through the application form on our careers page or by email. We process your contact details, your message and any application documents you upload. The documents are sent to us as email attachments via Postmark (see section 7) and are not stored on the web server.

We process your data to decide whether to enter into an employment relationship. The legal basis is Art. 6 (1) (b) GDPR in conjunction with § 26 BDSG. Within our company, only the people involved in the application process have access.

If you are hired, we store your data for the purpose of the employment relationship. Otherwise, we delete your documents no later than six months after the application process has ended. Retention during this period serves as evidence in the event of legal disputes (Art. 6 (1) (f) GDPR). Longer storage, for example in a talent pool, only takes place with your express consent (Art. 6 (1) (a) GDPR).

10. Vehicle inventory and enquiries (Autegro)

We display our current vehicle inventory using the Autegro vehicle widget. The provider is Auto Freunde GmbH, Lindenberg 10, 82343 Pöcking, Germany. The data is processed within the EU. When you open the vehicle pages, your browser loads the widget from the provider's servers. Your IP address is transmitted to the provider, as this is technically necessary to deliver the content.

Your browser loads the vehicle photos from the image server of mobile.de GmbH, Dernburgstraße 50, 14057 Berlin, Germany (img.classistatic.de), where our vehicle listings are stored. This transmits your IP address to mobile.de. If you tap our phone number on a vehicle page, the widget sends the vehicle and a random identifier to the provider, so we can match your call to that vehicle. The entries the widget stores in your browser are listed in our cookie policy.

The integration serves to present our vehicle offering completely and up to date. The legal basis is Art. 6 (1) (f) GDPR and, where information is stored on your device, § 25 (2) no. 2 TDDDG. The provider processes the data on our behalf under a data processing agreement.

You can also use the widget to enquire about a vehicle in our inventory or to offer us your car for sale. The widget sends the details you enter to the provider: for example your contact details and your message, for a vehicle enquiry the vehicle concerned and, where applicable, your interest in a test drive, trade-in or financing, and for a purchase enquiry the details of your car. The provider also processes these enquiries on our behalf under the data processing agreement and makes them available to us for handling. We use the data to answer your enquiry; the legal basis is Art. 6 (1) (b) GDPR where the enquiry relates to a contract or pre-contractual measures, and otherwise Art. 6 (1) (f) GDPR.

11. YouTube videos

On some pages we embed videos from our YouTube channel. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Videos are not loaded automatically. At first you only see a preview image delivered from our own server. Only when you click the video is the player loaded in privacy-enhanced mode (youtube-nocookie.com) and a connection to Google's servers established. Among other things, your IP address and the page you are visiting are transmitted to Google. Once playback starts, Google may use cookies or similar technologies. If you are logged into your Google account, Google can associate the visit with your account.

The legal basis is your consent, which you give by clicking the video (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG). Data may be transferred to the USA. Google LLC is certified under the EU-US Data Privacy Framework (DPF) (Art. 45 GDPR). More information: policies.google.com/privacy.

12. Google Maps

On our contact page and in the section about our location, you can display a Google Maps map. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

The map is only loaded once you confirm this with a click. A connection to Google's servers is then established and, among other things, your IP address is transmitted to Google. Google may use cookies or similar technologies.

The legal basis is your consent, which you give by clicking (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG). Data may be transferred to the USA. Google LLC is certified under the EU-US Data Privacy Framework (DPF) (Art. 45 GDPR). More information: policies.google.com/privacy.

13. Links to social networks

This website links to our profiles on Instagram, Facebook, YouTube and TikTok. These are plain links, not embedded plugins. No data is transmitted to these networks when you visit our website. Only when you follow a link do you reach the provider's page, where its own privacy policy applies.

14. Recipients and transfers to third countries

We only pass on personal data as described in this privacy policy, where necessary to perform a contract, where we are legally obliged to, or where you have consented. Service providers who process data on our behalf are contractually bound by our instructions and the GDPR. Transfers to countries outside the European Economic Area only take place where an adequacy decision or appropriate safeguards such as EU standard contractual clauses exist.

15. Your rights

Within the statutory framework, you have the right at any time to:

  • access the data we hold about you (Art. 15 GDPR)
  • rectification of inaccurate data (Art. 16 GDPR)
  • erasure of your data (Art. 17 GDPR)
  • restriction of processing (Art. 18 GDPR)
  • data portability (Art. 20 GDPR)
  • withdraw consent with effect for the future (Art. 7 (3) GDPR)

To exercise these rights, simply contact info@geigercars.de or our data protection officer.

Right to object (Art. 21 GDPR)

Where we process your data on the basis of Art. 6 (1) (f) GDPR, you have the right to object at any time, on grounds relating to your particular situation. We will then no longer process your data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. You can object to the processing of your data for direct marketing at any time without giving reasons.

Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your residence, place of work or the place of the alleged infringement. The authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

16. Obligation to provide data and automated decisions

You are not obliged to provide us with personal data. However, without your contact details we cannot answer enquiries sent through the form. No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

17. Changes to this privacy policy

We update this privacy policy when our website or the legal requirements change. The version published on this page applies.