Privacy policy

This is a translation for convenience; the German version is legally binding. Deutsche Fassung

Open cookie settings

1. Controller

Autohaus Buzziol Mobile GmbH
Autofocus 9, 15517 Fürstenwalde/Spree, Germany
Phone: 03361 30 10 76 · Email: info@buzziol-mobile.de
Represented by the managing directors Tino Buzziol and Michael Mewes. Legal notice

2. Data protection officer

Manja Palutz, m.palutz@buzziol-mobile.de, postal address as above with the addition “Datenschutzbeauftragte”. You can contact our data protection officer directly and in confidence with any questions about data protection and about exercising your rights.

3. Overview of processing

Types of data: master and contact data (e.g. name, address, phone, email), contract and payment data, vehicle data (e.g. vehicle identification number, registration, mileage), content data (e.g. messages), usage and metadata (e.g. pages visited, time of access, IP address), and – for driver training – the information required for the driving licence application.

Data subjects: visitors to our website, prospective customers and customers of the dealership, workshop and driving school, business partners and applicants.

Purposes: provision of the website, handling enquiries, conclusion and performance of contracts, driver training, customer service, security, and – only with consent – audience measurement and marketing.

Legal bases: consent (Art. 6(1)(a) GDPR), performance of a contract and pre-contractual measures (Art. 6(1)(b) GDPR), legal obligations (Art. 6(1)(c) GDPR) and legitimate interests (Art. 6(1)(f) GDPR). For storing information on or reading it from your device, Section 25 TDDDG (German Telecommunications Digital Services Data Protection Act) also applies. We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

4. Hosting and server log files

This website is operated on a server of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in a data centre in Nuremberg. We have concluded a data processing agreement with Hetzner (Art. 28 GDPR). Whenever a page is accessed, the web server automatically processes technically necessary data: IP address, date and time, requested address, amount of data transferred, status code, referrer, and browser and operating system. This processing serves to deliver the website, ensure its stability and defend against attacks (Art. 6(1)(f) GDPR). Log files are deleted after 14 days at the latest unless they are needed to investigate a security incident.

5. Security measures

We take technical and organisational measures appropriate to the risk (Art. 32 GDPR): all connections to this website are encrypted (TLS/HTTPS); access to the admin area is password-protected and restricted to authorised staff; access data for external services is stored in encrypted form; we create regular backups and keep server software up to date.

6. Cookies and local storage

Without your consent we set no cookies for statistics or marketing. In your browser’s local storage (localStorage) we only store what you yourself expressly request:

• theme – your choice between light and dark mode, once you use the toggle,
• bm_consent – your selection in the consent banner (time and categories chosen).

This storage is strictly necessary to provide the function you have requested (Section 25(2) No. 2 TDDDG). The entries remain in your browser until deleted. In the admin area, a session cookie is used for staff login. Which cookies are set after your consent is described in sections 15 and 16.

7. Contact and enquiry forms

If you contact us via a form (contact, vehicle enquiry, test drive, car purchase, workshop appointment, service enquiries), by phone or by email, we process your details (e.g. name, email, phone, vehicle data, message) to handle your enquiry. Fields marked as required are needed to process the enquiry; all other information is voluntary. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR (responding to general enquiries). The enquiry is stored in our system and forwarded by email to the relevant department; you receive a copy of your details by email.

We delete enquiries after 180 days unless they lead to a contractual relationship or statutory retention obligations (e.g. under the German Commercial Code (HGB) or Fiscal Code (AO)) apply.

8. Email communication (Microsoft 365)

Our email mailboxes and office applications are provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland (Microsoft 365). Emails you send us and enquiries forwarded from this website are therefore processed on Microsoft servers. We have concluded a data processing agreement with Microsoft (Art. 28 GDPR); the data is stored primarily in data centres in the EU. Transfers to the USA cannot be ruled out; Microsoft Corporation is certified under the EU-US Data Privacy Framework, and standard contractual clauses have also been agreed. The legal basis is our legitimate interest in efficient and secure communication (Art. 6(1)(f) GDPR) or the performance of a contract (Art. 6(1)(b) GDPR).

9. Spam protection (parking captcha)

To protect against automated spam submissions, we use a captcha we developed ourselves (“parking”) with an audio alternative, an invisible check field, a timestamp and a limit on the number of requests per IP address. For this purpose, your IP address is processed briefly (for a maximum of 10 minutes) to count requests. No data is transferred to third parties and no external captcha service (such as Google reCAPTCHA) is used. The legal basis is our legitimate interest in preventing misuse (Art. 6(1)(f) GDPR).

10. Online registration for the driving school

For registration for driver training we process your name, date of birth, place of birth, nationality, height, address, phone, email, the licence classes you require and your message. We need this information for the training contract and the application for a driving licence at the driving licence authority (Art. 6(1)(b) and (c) GDPR). The data is transferred to the competent driving licence authority and the testing organisation (TÜV/DEKRA) to the extent necessary for training and testing. We store the data for the duration of the training and thereafter in accordance with statutory retention obligations (including the German Driving Instructors Act and commercial and tax law).

11. Vehicle purchase, workshop and driver training

When you buy or lease a vehicle from us, have your vehicle serviced or repaired in our workshop, or train with our driving school, we process the data required to perform the contract: master and contact data, contract and payment data, vehicle data (e.g. vehicle identification number, registration number, mileage, service history) and, where applicable, information about trade-ins, financing or insurance (Art. 6(1)(b) and (c) GDPR).

Where necessary to perform the contract or required by law, we pass data on to: the manufacturers or importers of the brands we represent (CUPRA, SEAT, Honda) for warranty, guarantee, goodwill and recall handling; banks and leasing companies for financing you have requested; insurers; registration authorities; testing organisations (e.g. TÜV, DEKRA) for main inspections; payment service providers; and our tax advisers. Some manufacturer systems (e.g. for service and warranty) are operated by the manufacturers themselves; their privacy policies then also apply.

12. Withdrawal function

You can withdraw from a contract using the “Withdraw from contract” function. In doing so, we process your name, email, contract details and, if applicable, your message in order to process the withdrawal and send you an acknowledgement of receipt (Art. 6(1)(c) GDPR in conjunction with Section 356a of the German Civil Code (BGB)). The data is stored in accordance with the statutory limitation and retention periods.

13. Vehicle offers and mobile.de

Our vehicle offers are imported automatically from our dealer account on mobile.de and in some cases exported back there; this only involves vehicle data, no personal data of our visitors. Vehicle images are copied to our own server. Therefore no connection to mobile.de is established when you visit our pages. Only when you click the “On mobile.de” link does the privacy policy of mobile.de GmbH, Albert-Einstein-Ring 26, 14532 Kleinmachnow, Germany, apply.

If you contact us via mobile.de, mobile.de forwards your enquiry to us. We then process your details as described in section 7; the legal basis is Art. 6(1)(b) GDPR.

14. Google reviews

On our website we show a selection of reviews that customers have published about us on Google (only reviews with at least 3 stars – we point this out next to the reviews). Our server retrieves these reviews via the Google Places API of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and stores them; your browser does not connect to Google when you view them. We display the name, rating, text and date as published by the reviewer on Google. The legal basis is our legitimate interest in presenting customer feedback (Art. 6(1)(f) GDPR). If a review is deleted on Google, it is also removed here at the next update; you can also ask us directly to stop displaying your review.

15. Google Tag Manager, Google Analytics and Google Ads (only with consent)

Only if you agree to “Statistics” or “Marketing” in the consent banner do we load Google Tag Manager from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Tag Manager itself does not create user profiles; it is used to integrate other services:

• Google Analytics (category “Statistics”): measurement of how our website is used, e.g. pages visited, time spent, device and browser, approximate location (based on the shortened IP address). IP addresses are not stored in full in the EU. Cookies such as _ga are stored for up to 2 years.
• Google Ads conversion tracking and remarketing (category “Marketing”): measuring the success of our ads and displaying our ads to visitors to our website on other sites. Cookies are stored for up to 13 months.

We use Google Consent Mode: the services are only activated in line with the categories you have consented to. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Data may be transferred to the USA; Google LLC is certified under the EU-US Data Privacy Framework. You can withdraw your consent at any time with effect for the future: Open cookie settings Further information: policies.google.com/privacy.

16. Directions map (OpenStreetMap) and 360° tour (Google Maps) – only with consent

The directions map is only loaded once you confirm this with a click or allow “External media” in the settings. Your IP address is then transferred to the OpenStreetMap Foundation, St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom. An adequacy decision of the EU Commission exists for the United Kingdom. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG).

The 360° tour of our dealership is a Street View indoor tour that we embed via Google Maps, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It is likewise only loaded after your click or your consent to “External media”. This involves transferring, among other things, your IP address, device information and your interactions with the tour to Google; Google may set cookies. Further information: policies.google.com/privacy. Data may be transferred to the USA; Google LLC is certified under the EU-US Data Privacy Framework. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), which you can withdraw at any time via “Cookie settings”.

17. Communication via WhatsApp

The WhatsApp chat window at the bottom right is purely an element of our website without any scripts from Meta – no data is transferred while browsing. Only when you click “Chat” does the WhatsApp app or website open.

If you write to us via WhatsApp, the service of WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, is used. Message content is end-to-end encrypted; WhatsApp can, however, see metadata (e.g. phone number, time, device information). Transfers to the USA are possible; Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework. We process your messages to answer your enquiry (Art. 6(1)(b) or (f) GDPR). Please do not send us any sensitive data (e.g. ID documents) via WhatsApp; phone and email are available as alternatives.

18. Our social media pages

We maintain pages on Facebook and Instagram. On our website these are only included as simple links – no plug-ins are loaded and no data is transferred until you click a link.

When you visit our pages on these networks, Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, D02 X525, Ireland, processes your data. For the statistics (“Page Insights”) that Meta provides to us about our pages, we are jointly responsible with Meta (Art. 26 GDPR); Meta has assumed primary responsibility under the Page Insights addendum. You can exercise your rights directly with Meta. We process messages and comments that you send us there to communicate with you (Art. 6(1)(f) GDPR). Transfers to the USA are possible; Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework.

19. Fonts

All fonts are loaded locally from our server. There is no connection to Google Fonts or other font providers.

20. Job applications

If you apply to us (by email, post or in person), we process the information and documents you provide (e.g. contact details, CV, certificates) to carry out the application process (Art. 6(1)(b) GDPR, Art. 88 GDPR in conjunction with Section 26 of the German Federal Data Protection Act (BDSG)). Only the people involved in the selection process have access. If you are hired, the data is transferred to your personnel file. If you are not hired, we delete your application documents six months after the end of the application process, unless you have consented to longer storage for future vacancies (Art. 6(1)(a) GDPR).

21. Recipients and transfers to third countries

We only pass on personal data where this is necessary for the purposes described above, required by law or where you have consented. Recipients may include: service providers who process data on our behalf (hosting, email, IT maintenance), each bound by a data processing agreement; the bodies named in sections 10 and 11; and authorities where we are legally obliged to do so.

Where data is transferred to countries outside the EU/EEA (in particular the USA), this only takes place if there is an adequacy decision of the EU Commission (e.g. EU-US Data Privacy Framework for certified companies), suitable safeguards such as standard contractual clauses have been agreed, or you have given your consent.

22. Storage period and erasure

We delete personal data as soon as it is no longer required for the respective purpose, unless statutory retention obligations apply. Business letters and contract documents are generally retained for 6 years, and accounting records and invoices for 8 years (Section 257 HGB, Section 147 AO, as amended from 2025). Data from contracts is also retained until the expiry of warranty and limitation periods (generally three years from the end of the year in which the claim arose). During these periods, processing is restricted to fulfilling the retention obligation. Specific periods are stated in the respective sections.

23. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to withdraw any consent given at any time with effect for the future (Art. 7(3)). You have the right to object at any time, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR). You can object to the use of your data for direct marketing at any time without giving reasons. Simply contact us at info@buzziol-mobile.de or our data protection officer.

24. Right to lodge a complaint

You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR); the authority responsible for us is:
Die Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg (Brandenburg State Commissioner for Data Protection and Access to Information)
Stahnsdorfer Damm 77, 14532 Kleinmachnow
www.lda.brandenburg.de

25. Changes to this privacy policy

We update this privacy policy when our website or our data processing changes, or when this is required by law. The version published here applies.

Last updated: November 2026