Important: This English text is a translation for information only. The German original remains legally authoritative.

The purpose of this information is to enable an informed decision about consent. If you consent to our processing of your personal data, you should know which data are collected, for which purposes and which processing operations are carried out. Data may, in special situations such as a public interest, also be processed or disclosed without consent or for a purpose different from the original consent situation. This information also explains retention periods and the rights that may affect further processing even where you originally provided the data by consent.

"Data" means personal data within the meaning of the GDPR, Regulation (EU) 2016/679, applicable from 25 May 2018. Auto Gems can provide services, in particular contractual services, online or on site, only if the recipient supplies the minimum data required. Providing data is voluntary, although refusing required data can limit the service; for example, goods cannot be delivered without a delivery address. Consent can be withdrawn at any time; details are set out in section VIII.

Depending on the contact and the resulting requirements or duties, the following data may be collected or provided:

• surname and first name;
• company;
• date of birth;
• postal address;
• e-mail address;
• bank details where cashless payment for a chargeable service is offered and selected;
• optional telephone number and/or fax number for rapid contact; and
• optional identity-document data and customs documents.

We use data for the main business purposes required to deal with an enquiry or transaction. Auto Gems sells motor vehicles of all kinds and provides related services.

• proper receipt and allocation of orders and their processing;
• preparing cost estimates and offers;
• drafting and performing contracts, including payment and shipping;
• meeting statutory warranty obligations and exercising contractual guarantees, including claims against suppliers;
• pursuing claims against customers and defending claims against us; and
• providing a high level of customer service and support.

For these purposes, limited disclosure to third parties may be necessary, including group companies or other contractually connected companies such as subcontractors and forwarding agents, external tax, business or legal advisers, payment providers and providers used to assess financial risk, creditworthiness, liquidity or payment history.

If you have also consented to secondary purposes, we may use data to determine customer satisfaction with our products, services and website, improve products and services, develop customised offers and provide support or goodwill beyond warranty periods. External service providers may be involved for satisfaction analysis, product innovation or support.

If we want to process data for a purpose other than the purpose of collection and do not have separate consent, we do so only where the new purpose is compatible with the original purpose. We consider the context of collection, the connection between the purposes, the sensitivity of the data, the consequences for you and safeguards such as encryption.

When you access our website, temporary access data may be stored, including the date and time, requested internet service and resource, action or query, transferred data volume, success message and IP address. These data are anonymised for statistical evaluation and used to defend and analyse attacks. Cookies may be used with information and consent where required. You can block them in your browser, although this may limit website functions or language preferences. You can delete cookies through your browser.

Google Analytics: Google may create pseudonymised usage profiles and use cookies. Browser and device information, referrer URL, host name or IP address and server-request time may be transferred to and stored on a Google server in the USA and used for activity reports. IP addresses remain anonymised. You can block cookies or use the Google Analytics opt-out.

Google Ads conversion tracking: If you arrive through a Google advertisement, Google Ads may place a cookie that expires after 30 days. It is used for conversion statistics and not to identify you personally. You can reject the cookie in your browser or block www.googleadservices.com.

Google Maps: Embedded maps from Google LLC may process IP addresses and location data. This occurs only with consent, normally through mobile-device settings. The data are processed in the USA. See Google's privacy policy and opt-out settings.

Some processing may be required or permitted without a consent declaration, for example to comply with legal obligations or to respond to a lawful request from a public authority in the public interest.

In addition to collection, use and disclosure, we store data in an organised database so that they can be found and retrieved for the relevant business transaction. Data may be corrected or updated, restricted or erased on request or when a retention period ends. Processing is normally automated, although manual processing may still occur and is subject to the same protection.

Processors: We use processors. Guarantee agreements require them to comply with our data protection policy and the GDPR.

The GDPR requires deletion when the purpose of collection no longer applies unless a continuing retention obligation exists or retention is needed for legal claims. We use the following periods, measured from the last contact, subject to earlier deletion duties:

1. no contract, no expectation of a contract, no liability situation and no business letters: two years from last contact, beginning at the end of that year;
2. no contract or expectation of a contract, no business letters, but a liability situation cannot be ruled out: three years from last contact, beginning at the end of that year;
3. a contract or business letters: six years from receipt or dispatch of the business letter; if last contact would end later, the later date applies; and
4. accounting records, business documentation or customs documents: ten years from the accounting date, documentation date or transmission to the customs authority; if last contact would end later, the later date applies.

You may withdraw consent at any time. Withdrawal does not affect processing already carried out lawfully. We must stop processing after withdrawal if consent was the only legal basis, unless another obligation such as retention applies. Withdrawal is informal and may be sent to:

Auto Gems, Langenbergerstraße 3, 40233 Düsseldorf, Owner: Stefan Gems, info@autogems.de, telephone +49 (0) 211 7377 59-0.

You may ask whether we process your personal data and, if so, request the categories and purposes, recipients and safeguards, retention period or criteria, source of data obtained from third parties and meaningful information about any automated decision-making. We do not currently carry out such automated decision-making. We will provide a copy, electronically where requested electronically; a reasonable fee may be charged for additional copies.

You may require the immediate correction of inaccurate data and completion of incomplete data. Where data were disclosed to third parties, we will inform them of the correction where this is not impossible or disproportionate and will name them on request.

Subject to exceptions, you may require erasure where data are no longer necessary, consent has been withdrawn, you object, processing was unlawful, erasure is required by law, or data concerning a child under 16 were collected for information-society services. Where we made data public, we will take reasonable measures to inform other controllers of the erasure request. We will notify third-party recipients where this is not impossible or disproportionate.

Erasure may be refused where processing is necessary for freedom of expression and information, a legal obligation, legal claims, another legal basis after withdrawal, or compelling legitimate grounds that override an objection. An objection only to direct advertising or related profiling always gives rise to an erasure right. If erasure is not available, you may have a right to restriction.

You may request restriction instead of erasure where processing is unlawful, where we no longer need the data but you need them for legal claims, or while we examine an objection or a challenge to accuracy. Restricted data may generally be processed only with your consent, for legal claims, to protect another person's rights or for an important public interest.

Where processing is based on consent or a contract and is automated, you may request the data you provided in a structured, commonly used and machine-readable format, or, where technically feasible and the rights of others are not affected, direct transmission to another controller.

Where a breach creates a high risk to your personal rights and freedoms, we will notify you without undue delay with details of the contact person, likely consequences and measures taken or planned. Notification may be omitted where effective measures have removed the high risk, the data were already protected or notification would require disproportionate effort.

You have the right, subject to statutory exceptions, not to be subject to a decision based solely on automated processing, including profiling, that has legal effect or similarly significantly affects you. We do not currently use such structures.

You may complain to the competent supervisory authority at any time and may also contact us so that we can try to resolve the issue together.

Where we process data to protect legitimate interests or perform a public-interest task, you may object at any time. We may continue only where compelling grounds override your interests, rights and freedoms or where processing serves legal claims. If the objection concerns direct advertising or related profiling, we will stop using the data for those purposes.

We will normally explain the effect of a request within one month. In complex cases or where many requests are pending, the period may be extended to three months, with notice and reasons within the first month. If we do not act, we will give reasons within one month.

This is not an exhaustive list of rights; the GDPR and other laws supplement it. No special form is required and exercising rights, receiving information and measures taken are free of charge, except that a reasonable fee may be charged or a request refused if it is manifestly unfounded or excessive.

The controller for processing in connection with this consent declaration is the managing director, Mr Stefan Gems.

Where processing by us or our processors is covered by your consent, the legal basis is Article 6(1)(a) GDPR. Article 13(3) GDPR may be relevant to processing for compatible purposes. Processing outside the scope of consent may also have a legal basis, for example a task in the public interest under Article 6(1)(e) GDPR or a legitimate interest that outweighs the data subject's opposing interests under Article 6(1)(f) GDPR.

German consent declaration (legally authoritative original)