Basic information on data processing

This privacy policy informs you about how we use personal data within our online services and for what purpose. You can access this information at any time on our website. We take the protection of your personal data seriously and handle it confidentially and in accordance with applicable data protection regulations. We collect, use, and store personal data only within the framework of data protection laws, including the General Data Protection Regulation (GDPR), the Federal Data Protection Act (BDSG), and specific state data protection laws. Specifically, this means that we will only use your data if permitted by law. This means we may process your data when data processing is necessary to provide our services (such as selling used cars), when required by law, with your consent, or when processing is justified by our legitimate interests (economic operation of our business and the security of our online services).

Controller

The controller for data processing is:

Vehicle-Trade GmbH, San-Remo-Str. 15, 40545 Düsseldorf, Phone: +49 211 8383617-0, Email: datenschutz@vehicle-trade.com.

Legal basis

We inform you that the following legal bases exist for processing:

• Consent Art. 6 (1) a) and Art. 7 GDPR.

• Processing for the performance of our services, execution of contractual measures, Art. 6 (1) b) GDPR.

• Fulfillment of our legal obligations, Art. 6 (1) c) GDPR.

• Protection of our legitimate interests, Art. 6 (1) f) GDPR.

Disclosure of data to third parties and third-party providers

We only disclose your data to third parties within the scope of legal requirements, for example, if you have consented to this (Art. 6 (1) a) and Art. 7 GDPR), if this is necessary for contractual purposes based on Art. 6 (1) b) GDPR, to fulfill our legal obligations pursuant to Art. 6 (1) c) GDPR, or if it is justified on the basis of legitimate interests pursuant to Art. 6 (1) f) GDPR. When you select a vehicle for purchase with us, we provide your data to credit agencies to check your creditworthiness. We also share your data with relevant authorities to fulfill our legal obligations under the Money Laundering Act, export regulations, and other legal requirements. Furthermore, it is possible that we will share your data with the car dealer from whom we purchase the car to resell it to you. This may be particularly the case if you want to pick up the car in person from the car dealer. When we use third parties to provide our online services, we take appropriate legal precautions and technical and organizational measures to ensure the protection of your personal data.

Collection and use of data

We collect and use personal data from each user to the extent necessary for the user to use our online services. This includes, in particular, features for identifying the user and information about the start and end as well as the scope of the user's use of our online services. We collect a number of general data and information each time our online services are accessed. This general data and information is stored in the log files of the server (see section 7 of this privacy policy).

Security

We maintain technical and organizational measures to ensure data security. Security measures include, in particular, the encrypted transmission of data between your browser and our server. However, we point out that data transmission over the Internet (e.g., communication by email) may have security vulnerabilities. A complete protection of data against access by third parties is not possible.

Server logs

We collect data on every access to the server on which our online services are located based on our legitimate interests within the meaning of Art. 6 (1) f) GDPR (server log files). Our online services are located on a server assigned to us by Amazon Web Services Inc., which hosts the online services as our data processor. Your browser automatically transmits this server log file data to us. The data collected in this way includes, among other things, the date and time of access, location, country, state, region, city, the URL (internet address) of the referring website, the retrieved file, message about the successful retrieval, the type of browser and its version, as well as information about the operating system of the users. We use this information exclusively for statistical purposes and for internal analysis purposes, such as improving the offer. This data cannot be assigned to specific individuals. This data is not merged with other data sources.

Cookies

Cookies are used on our online services to make the offer attractive and to enable the use of certain functions. Cookies are small text files that are stored on your computer and enable your browser to be recognized. They also serve to determine the frequency of use and the number of users of our Internet offering. "Session cookies" are used on our websites, which are only stored temporarily for the duration of your use of one of our Internet pages. These cookies contain a so-called session ID, with which various requests from your browser can be assigned to the common session. This will allow your computer to be recognized when you return to our website. Session cookies are deleted when you log out or close the browser. You can prevent the installation of cookies by adjusting the settings of your browser software accordingly; however, please note that in this case, you may not be able to use all functions of our online services to their full extent. You can also delete cookies already stored on your computer at any time.

Contact form and email contact

If you contact us via the contact form on our website or via email, the data you provide will be stored by us for the purpose of processing your inquiry and for possible follow-up questions. We will not share this data without your consent.

Your rights

You have the right to:

• Obtain information about your personal data processed by us.

• Request the correction of incorrect or incomplete personal data.

• Request the deletion of your personal data stored by us, unless processing is necessary to exercise the right to freedom of expression and information, to fulfill a legal obligation, for reasons of public interest, or to assert, exercise, or defend legal claims.

• Restrict the processing of your personal data if you dispute the accuracy of the data, if the processing is unlawful, but you refuse to delete it, or if we no longer need the data, but you need it to assert, exercise, or defend legal claims, or if you have objected to the processing of the data.

• Receive your personal data that you have provided to us in a structured, common, and machine-readable format or to request transmission to another controller.

• Revoke your consent to us at any time. As a result, we are no longer allowed to continue processing data based on this consent in the future.

• Complain to a supervisory authority. As a rule, you can contact the supervisory authority at your usual place of residence or workplace or at our company headquarters.

Changes to this privacy policy

We reserve the right to change this privacy policy in compliance with legal requirements. The current version published on our website applies.

Our contact details

If you have any questions about this privacy policy, please contact us using the contact details provided above.

We use, process, and store personal data in compliance with legal requirements, ensuring the confidentiality, integrity, and availability of the data. We only share data with third parties when necessary and have measures in place to protect your data.

a. Google Analytics

For our online offering, we use the functions of the web analytics service Google Analytics. The provider is Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Google is certified under the Privacy Shield agreement, providing a guarantee of compliance with European data protection laws (https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active). Google Analytics uses cookies, which are text files stored on your computer enabling an analysis of your website usage. The information generated by the cookie about your use of this website is usually transmitted to a Google server in the USA and stored there. For more information on how Google Analytics handles user data, please see Google's privacy policy: https://support.google.com/analytics/answer/6004245?hl=en. You can prevent the storage of cookies by adjusting your browser settings accordingly; however, please note that if you do this, you may not be able to use all the features of this website to their full extent. Furthermore, you can prevent Google from collecting and processing data generated by the cookie related to your use of the website by downloading and installing the browser plugin available at the following link: https://tools.google.com/dlpage/gaoptout?hl=en. We only use Google Analytics if you have previously consented to it through a cookie banner or cookie consent tool (Art. 6 para. 1 a). We use Google Analytics only with IP anonymization enabled. This means that the IP address of users is truncated within member states of the European Union or other parties to the Agreement on the European Economic Area. Only in exceptional cases is the full IP address sent to a Google server in the US and truncated there. For more information about how Google uses data, settings, and opt-out options, please visit Google's websites: https://www.google.com/intl/en/policies/privacy/partners ("How Google uses data when you use our partners' sites or apps"), http://www.google.com/policies/technologies/ads ("Data usage for advertising purposes"), http://www.google.com/settings/ads ("Manage information Google uses to show you ads").

b. Google Re-Marketing

Furthermore, we use the marketing and remarketing services (short "Google Marketing Services") of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google"). We only use Google Marketing and Remarketing services if you have previously consented to it through a cookie banner or cookie consent tool (Art. 6 para. 1 a). Google Marketing Services allow us to display advertisements for and within our online offering in a more targeted manner, to present users with ads that are likely to correspond to their interests. "Remarketing" means that users are shown ads for products they have shown interest in on other websites. For these purposes, Google executes a code and embeds so-called (re)marketing tags (invisible graphics or code, also known as "web beacons") into a website when users visit our online offering and other websites where Google Marketing Services are active. Using (re)marketing tags, an individual cookie, i.e., a small file, is stored on the user's device (instead of cookies, comparable technologies may also be used). The cookies may be set by various domains, including google.com, doubleclick.net, invitemedia.com, admeld.com, googlesyndication.com, or googleadservices.com. This cookie file records which websites the user has visited, what content they are interested in, and what offers they have clicked on. Additionally, the file contains technical information about the browser and operating system, referring websites, visit times, and other information about the use of the online offering. The IP address of users is also recorded. However, we inform Google Analytics that the IP address is shortened within member states of the European Union or other parties to the Agreement on the European Economic Area and is only transmitted to a Google server in the US and shortened there in exceptional cases. The IP address is not merged with user data from other Google offerings. The information mentioned above may also be combined by Google with information from other sources. Subsequently, when users visit other websites, they may be shown ads tailored to their interests. User data is processed pseudonymously within the scope of Google Marketing Services. This means that Google stores and processes not the names or email addresses of users but processes the relevant data cookie-related within pseudonymous user profiles. Thus, the ads are not managed and displayed from the perspective of a specifically identified person but for the cookie holder, regardless of who the cookie holder is. This does not apply if a user has expressly allowed Google to process the data without this pseudonymization. The information collected by Google Marketing Services about users is transmitted to Google and stored on Google's servers in the US. If you do not wish to use Google's remarketing function, you can generally deactivate it by making the appropriate settings at http://www.google.com/settings/ads. Alternatively, you can disable the use of cookies for interest-based advertising through the Network Advertising Initiative by following the instructions at http://www.networkadvertising.org/managing/opt_out.asp. Further information on Google Remarketing and Google's privacy policy can be found at: http://www.google.com/privacy/ads/. For more information on Google's data usage for marketing purposes, please visit: https://policies.google.com/technologies/ads, and Google's privacy policy is available at https://policies.google.com/privacy.

c. Hotjar

Additionally, for our online offering, we use the functions of the web analysis service Hotjar. The provider is Hotjar Ltd., a European company based in Malta (Hotjar Ltd, Level 2, St Julians Business Centre, 3, Elia Zammit Street, St Julians STJ 1000, Malta). With Hotjar, it is possible to measure and evaluate your usage behavior (clicks, mouse movements, scroll heights, etc.) in our online offering. This provides us with valuable information to make our websites even faster and more user-friendly. The information generated by the "tracking code" and cookies about your visit to our website is transmitted to Hotjar servers in Ireland and stored there. The following information can be recorded by your device and browser: the IP address of your device (collected and stored in an anonymized format), your email address including your first and last name, if you provided it to us via our website, screen size of your device, device type and browser information, country from which you access the online offering, preferred language for displaying our website, log data. The following data is automatically generated by our servers when Hotjar is used: referring domain, visited pages, country from which you access the online offering, the preferred language for displaying our website, date and time you accessed our online offering. Hotjar will use this information to evaluate your visit to our online offering, create usage reports, and evaluate other services related to the use of our online offering. The cookies used by Hotjar have different "lifetimes."

Some cookies remain valid for up to one year, while others are only valid for the current visit. You can prevent Hotjar from collecting data by following the instructions at https://www.hotjar.com/opt-out. For more information about Hotjar Ltd. and the service, please visit: https://www.hotjar.com. You can find Hotjar Ltd.'s privacy policy at: https://www.hotjar.com/privacy.

We only use Hotjar if you have previously consented to it through a cookie banner or cookie consent tool (Art. 6 para. 1 a).

Integration of Third-Party Services and Content

Within our online offering, we use third-party content or service offerings based on our legitimate interests (meaning our interest in analyzing, optimizing, and economically operating our online offering within the meaning of Art. 6 para. 1 lit. f. GDPR) or based on your prior consent to integrate their content and services, such as videos or fonts (“Content”). For this purpose, it is necessary for the providers of this content to perceive the IP address of the users. Without the IP address, they cannot send the content to the users' browsers.

The IP address is thus necessary for the presentation of this content. We try to use only such content providers who use the IP address solely to deliver the content.

Third-party providers may also use so-called pixel tags (invisible graphics, also known as "web beacons") for statistical or marketing purposes. Through the "pixel tags," information about the traffic on the pages of this website can be analyzed. The pseudonymous information can also be stored in cookies on the users' devices. These can include technical information about the browser and operating system, referring websites, visit times, and further information about the use of our online offering, as well as they can be linked to such information from other sources.

Below we have listed which third-party content providers we use, along with links to their privacy policies:

• External fonts from Google, LLC., https://www.google.com/fonts ("Google Fonts"). The integration of Google Fonts is done by calling a server at Google (usually in the USA). Privacy Policy: https://policies.google.com/privacy, Opt-Out: https://adssettings.google.com/authenticated.

• Maps from the "Google Maps" service provided by the third-party provider Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Privacy Policy: https://www.google.com/policies/privacy/, Opt-Out: https://www.google.com/settings/ads/.

• Within our online offering, functions of the service or platform Twitter may be integrated (hereinafter referred to as "Twitter"). Twitter is an offering from Twitter Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA. The functions include displaying our posts within Twitter within our online offering, linking to our profile on Twitter, as well as the possibility to interact with the posts and functions of Twitter, and to measure whether users access our online offering via the advertisements we place on Twitter (so-called conversion tracking). Twitter is certified under the Privacy Shield Agreement, providing a guarantee of compliance with European data protection law (https://www.privacyshield.gov/participant?id=a2zt0000000TORzAAO&status=Active). Privacy Policy: https://twitter.com/en/privacy, Opt-Out: https://twitter.com/personalization.

Your Rights

Subject to the legal requirements, you have rights under Articles 15 to 22 of the GDPR. These include your rights to information, correction, deletion, restriction of processing, and data portability.

You also have the right to object to processing based on Art. 6 para. 1 f) GDPR and thus our legitimate interests.

You can object to the future processing of data concerning you in accordance with Art. 21 GDPR at any time. The objection can be made in particular against processing for direct marketing purposes.

You can revoke your consent given at any time for the future.

Right to Lodge a Complaint with a Supervisory Authority

You have the right under Art. 77 GDPR to lodge a complaint with a supervisory authority if you believe that the processing of your personal data is not lawful.

Data Deletion

The data stored by us will be deleted as soon as it is no longer necessary for the purposes for which it was collected for you, and the deletion does not conflict with any legal retention obligations. The legal retention periods are six years according to § 257 HGB for commercial books, inventories, commercial letters, opening balance sheets, etc., and ten years according to § 147 AO for books, records, documents relevant for taxation.