Privacy policy

1. Controller

Controller

— to be supplied —

Represented by

— to be supplied —

Address

Auto 2T, Beethovenstraße 16, 01587 Riesa

Phone

0152 03142254

Email

info@auto2t.com

We have not appointed a data protection officer; a business of this size does not meet the statutory threshold requiring one.

2. Visiting the website (server logs)

When you open this website, our hosting provider automatically processes technical data sent by your browser:

• the address requested
• date and time of access
• amount of data transferred and the HTTP status code
• browser type and operating system
• IP address

This processing is technically necessary to deliver the site and to keep it stable and secure. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the secure operation of the service. Our provider retains these logs briefly and deletes them automatically.

3. Sales enquiry (the “sell your vehicle” form)

If you offer us a vehicle, we process the details you enter into the form:

• first and last name
• phone number and email address
• vehicle details: make, model, mileage, first registration, fuel type, gearbox
• any voluntary notes you add in the free-text field
• the photos you upload
• your confirmation that we may contact you

We process this in order to value your vehicle and to contact you. The legal basis is Art. 6(1)(b) GDPR, as the processing is carried out to take steps at your request prior to entering into a contract.

The required fields are necessary for us to handle the enquiry. Without them we cannot send you a valuation; there is no obligation to provide the data beyond that. The free-text field is optional — please do not enter special categories of personal data within the meaning of Art. 9 GDPR there.

Your photos are stored in a non-public area. They cannot be retrieved freely over the internet; our staff access them through individually generated, time-limited links that expire after one hour. The internal notification email uses time-limited links as well.

We keep your enquiry for as long as we need it to deal with your request, and delete it afterwards. If a purchase contract results, the resulting records are subject to German commercial and tax retention periods (§257 HGB, §147 AO).

4. Spam protection (Cloudflare Turnstile)

To protect the sales form against automated submissions we use Turnstile, provided by Cloudflare Inc. Turnstile checks whether an entry comes from a human, and processes your IP address and technical characteristics of your browser to do so.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is preventing abuse. According to the provider, Turnstile sets no advertising cookies and builds no user profile. The script loads only once you actually interact with the form — simply viewing the page makes no connection to Cloudflare.

5. Abuse prevention (submission limit)

To prevent the form being submitted en masse, we limit how many enquiries one sender can make per hour. To do this your IP address is not stored but converted into an irreversible check value, which is deleted automatically once the period has elapsed. The legal basis is Art. 6(1)(f) GDPR.

6. Vehicle view counter

Vehicle pages show how often a vehicle has been viewed. So that the same visitor is not counted repeatedly, we compute an irreversible check value from your IP address and the date. The IP address itself is neither stored nor logged, and the check value cannot be traced back to you.

The check value is deleted automatically after 24 hours. No cookie is set and no profile is built across visits. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is a rough measure of reach without tracking individuals.

7. Recipients and processors

We do not pass your data on for advertising purposes and we do not sell it. We use the following providers to operate the website, each under a data processing agreement pursuant to Art. 28 GDPR:

• Vercel Inc. — hosting and delivery of the website
• Supabase — database and file storage; the data is held in a data centre within the European Union (Ireland)
• Resend — sending the internal notification about a new sales enquiry
• Cloudflare Inc. — spam protection for the form (see section 4)

Where data is transferred to countries outside the EU in the process, the providers rely on the European Commission's standard contractual clauses or on an adequacy decision. Beyond this we disclose data only where we are legally required to.

8. Cookies

This website sets no analytics, tracking or advertising cookies. A cookie is set only in the internal administration area, and only after our staff sign in; its sole purpose is to maintain that session. It is of no relevance to visitors to the public pages.

9. Your rights

You have the following rights regarding your personal data:

• access to the data processed (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• objection to processing based on legitimate interests (Art. 21 GDPR)

An informal message to the email address above is enough to exercise them. When we delete a sales enquiry, the associated photos are deleted with it and can no longer be retrieved, including through links generated earlier.

You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority responsible for us is:

Supervisory authority

Die Sächsische Datenschutzbeauftragte

Address

Devrientstraße 5, 01067 Dresden

Website

https://www.saechsdsb.de

10. Changes to this notice

We update this privacy notice when our processing changes — for example when a feature is added or a provider changes. The version published here, with the date shown above, is the one that applies.