Privacy Policy

1. Data protection at a glance

General information

The following information provides a simple overview of what happens to your personal data when you visit our website or use our online services. Personal data is any data that can be used to identify you personally.

Detailed information on the processing of personal data can be found in the following sections of this privacy policy.

Controller

The controller responsible for data processing on this website is:

Carpoint GmbH
Weserstraße 3
47506 Neukirchen-Vluyn
Germany
Phone: +49 2845 9802860
E-mail: ···

How do we collect your data?

Your data is collected, on the one hand, by you providing it to us. This may occur, for example, in connection with a contact, vehicle, purchase, leasing, financing, configurator, service or application enquiry, as well as when subscribing to our newsletter.

Other data is collected automatically, or after your consent, by our IT systems or the services we use when you visit our website. This is primarily technical data such as IP address, browser, operating system, time of the page visit, and information about your use of our website.

What do we use your data for?

We process personal data in particular:

• to provide and secure our website
• to process contact and vehicle enquiries
• to process vehicle purchase (trade-in) enquiries
• to carry out pre-contractual measures and existing contracts
• to handle vehicle purchases and orders
• to process financing and leasing enquiries
• to arrange and carry out inspection, service and installation appointments
• to process job applications
• to send our newsletter
• with your consent, to analyse the website
• with your consent, to measure and optimise our advertising activities

What rights do you have?

Subject to the statutory requirements, you have, in particular, the right to information, rectification, erasure, restriction of processing, data portability and objection.

You may withdraw any consent you have given at any time with effect for the future.

You also have the right to lodge a complaint with a competent data protection supervisory authority.

2. Hosting

External hosting

This website is hosted externally. We use the following hosting provider:

Igor Wasilew
Würzburger Str. 13
40599 Düsseldorf
Germany

The physical server infrastructure is located in a data centre operated by:

Hetzner Online GmbH
Industriestr. 25
91710 Gunzenhausen
Germany

As part of hosting, data such as IP addresses, server log files, website visits, meta and communication data, contact and contract data, and other data processed via the website may be stored and processed.

Processing is carried out to provide our online offering securely, quickly and reliably.

Where processing is necessary to carry out pre-contractual measures or to perform a contract, it is based on Art. 6(1)(b) GDPR. Otherwise, processing is based on our legitimate interest in the secure and efficient provision of our website pursuant to Art. 6(1)(f) GDPR.

Where service providers process personal data on our behalf, this takes place on the basis of a data processing agreement pursuant to Art. 28 GDPR.

3. General information and mandatory disclosures

Data protection

We treat your personal data confidentially and in accordance with applicable data protection law and this privacy policy.

When using this website, various personal data are processed. This privacy policy explains what data we process, for what purposes, and on what legal basis.

We point out that data transmission over the internet (e.g. when communicating by e-mail) may have security vulnerabilities. Complete protection of data against access by third parties cannot be guaranteed.

Controller

The controller is:

Carpoint GmbH
Weserstraße 3
47506 Neukirchen-Vluyn
Germany
Phone: +49 2845 9802860
E-mail: ···

The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of processing personal data.

Storage period

Unless a more specific storage period is stated in this privacy policy, we only store personal data for as long as is necessary for the respective processing purpose.

Where statutory retention obligations exist, the relevant data is stored in accordance with those legal requirements.

If you withdraw a consent or make a legitimate request for erasure, the relevant data will be deleted, unless there are legal or other permissible grounds for further storage.

Legal bases

Personal data is processed in particular on the following legal bases:

• Art. 6(1)(a) GDPR – consent
• Art. 6(1)(b) GDPR – performance of a contract and pre-contractual measures
• Art. 6(1)(c) GDPR – compliance with a legal obligation
• Art. 6(1)(f) GDPR – legitimate interests
• Sec. 26 of the German Federal Data Protection Act (BDSG) – data processing in connection with employment relationships and job applications

Where consent is required for storing information on your terminal device, or for accessing information already stored there, this is based on Sec. 25(1) TDDDG (German Telecommunications and Telemedia Data Protection Act).

Where storage or access is strictly necessary to provide a digital service you have explicitly requested, this may take place without consent under the conditions of Sec. 25(2) TDDDG.

Data transfers to third countries

For some of the services we use, personal data may be processed outside the European Union or the European Economic Area.

Any such transfer only takes place in compliance with the statutory requirements of Art. 44 et seq. GDPR. Depending on the provider and recipient, the transfer may be based, in particular, on an adequacy decision or appropriate safeguards such as the European Commission's standard contractual clauses.

Withdrawal of your consent

You may withdraw any consent already given at any time with effect for the future.

The lawfulness of processing carried out on the basis of the consent until withdrawal remains unaffected.

Right to object under Art. 21 GDPR

IF THE PROCESSING OF YOUR PERSONAL DATA IS BASED ON ART. 6(1)(E) OR (F) GDPR, YOU HAVE THE RIGHT, AT ANY TIME, ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION, TO OBJECT TO THE PROCESSING OF YOUR PERSONAL DATA.

IF YOUR PERSONAL DATA IS PROCESSED FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF YOUR PERSONAL DATA FOR SUCH MARKETING, WHICH ALSO APPLIES TO PROFILING TO THE EXTENT IT IS RELATED TO SUCH DIRECT MARKETING.

Right to lodge a complaint

Pursuant to Art. 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data violates applicable data protection law.

Right to data portability

Subject to the statutory requirements, you have the right to receive data that we process automatically on the basis of your consent or in performance of a contract, in a structured, commonly used and machine-readable format, or to have it transferred to another controller.

Access, rectification and erasure

Subject to the statutory requirements, you have the right, at any time, to information about your stored personal data and, where applicable, to have this data rectified or erased.

Right to restriction of processing

Subject to the statutory requirements, you have the right to request the restriction of the processing of your personal data.

SSL/TLS encryption

For security reasons and to protect confidential content, this website uses SSL/TLS encryption.

4. Data collection and contacting us

Server log files

When you visit our website, information is automatically processed in server log files. This may include, in particular:

• browser type and version
• operating system used
• referrer URL
• IP address
• time of the server request
• pages and files accessed

Processing is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure and technically fault-free operation of our website as well as its optimisation.

Contact forms and online enquiries

If you contact us via a form on our website, we process the data you enter in order to process your enquiry.

Depending on the type of enquiry, this may include, in particular:

• name
• address
• e-mail address
• phone number
• vehicle data
• details on purchasing, selling or trading in a vehicle
• financing or leasing preferences
• desired modifications and equipment
• service and appointment enquiries
• the content of your message
• any documents, images or files submitted

Where the enquiry relates to an existing or prospective contract, processing is based on Art. 6(1)(b) GDPR.

For other enquiries, processing is based on our legitimate interest in handling your enquiry pursuant to Art. 6(1)(f) GDPR, or on your consent pursuant to Art. 6(1)(a) GDPR, where such consent is obtained.

Contact by e-mail, phone or fax

If you contact us by e-mail, phone or fax, we process the personal data you transmit in order to handle your request.

For contract-related or pre-contractual enquiries, processing is based on Art. 6(1)(b) GDPR. In other cases, it is based on Art. 6(1)(f) GDPR or – where obtained – Art. 6(1)(a) GDPR.

5. Vehicle sales, orders and configuration

If you enquire about, configure, order or purchase a vehicle from us, we process the personal data required to initiate and carry out the contractual relationship.

This may include, in particular:

• name and contact details
• address
• date of birth, where required
• vehicle and configuration data
• desired special equipment
• desired modifications to the vehicle
• contract and order data
• payment information
• communication and advisory data
• information and documents required for financing, leasing or registration, where applicable

Processing is based on Art. 6(1)(b) GDPR and, where legal obligations exist, Art. 6(1)(c) GDPR.

Where necessary to perform the contract, data may be transmitted to manufacturers, importers, suppliers, logistics companies, registration service providers, financing partners or other service providers involved in the performance of the contract.

6. Vehicle purchase and trade-in

If you offer us a vehicle for purchase or trade-in, we process the personal data and vehicle data you provide in order to review, assess and, where applicable, carry out the vehicle purchase.

This may include, in particular:

• name and contact details
• vehicle data
• vehicle identification number
• mileage
• registration and owner data
• information on the condition of the vehicle
• images and documents
• price expectations
• information on financing or existing third-party rights

Processing is carried out to perform pre-contractual measures and, where applicable, to perform the contract pursuant to Art. 6(1)(b) GDPR.

7. Financing and leasing

If you would like financing or leasing, the personal data required to process your enquiry may be transmitted to the financing or leasing partner selected by you or named in the respective offer.

The specific processing by the respective financing partner is additionally governed by that partner's own privacy information.

The transmission takes place, insofar as it is necessary to process your financing or leasing request, on the basis of Art. 6(1)(b) GDPR.

8. Inspection, service and installation

If you enquire about or commission inspection, service, installation or other vehicle-related services from us, we process the personal data required to process and carry out the order.

This may include, in particular:

• name and contact details
• vehicle data
• vehicle identification number
• mileage
• service and repair information
• desired work and modifications
• appointment and order data
• invoice and payment data

Processing is based on Art. 6(1)(b) GDPR.

9. Newsletter

If you subscribe to our newsletter, we process, in particular, your e-mail address as well as information required to prove your subscription and consent.

Processing is based on your consent pursuant to Art. 6(1)(a) GDPR.

You can withdraw your consent at any time with effect for the future, in particular via the unsubscribe link in the newsletter.

Dispatch via our own servers

Our newsletter is sent via our own server infrastructure at: admin.carpoint-nrw.de

No external newsletter e-mail service provider is used for sending the newsletter.

Data stored for sending the newsletter is generally kept until you unsubscribe. After unsubscribing, evidence data on a consent given may continue to be stored where required by statutory limitation periods and record-keeping obligations.

10. Cookies and consent management

Our website uses cookies and comparable technologies.

Technically necessary technologies are used insofar as they are required for the secure operation of the website or to provide a function you have explicitly requested.

Optional technologies for analytics, marketing or external content are used in accordance with the selection you make via our consent system.

Where consent is required, the storage of information on your terminal device, or access to information already stored there, is based on Sec. 25(1) TDDDG. Any subsequent processing of personal data is based on Art. 6(1)(a) GDPR.

Our own consent solution

We use a consent solution operated on our own infrastructure to manage and document your cookie and privacy settings.

Your selection is stored so that the website can take your decision into account.

You can change or withdraw your consent at any time, with effect for the future, via the cookie settings provided on our website.

11. Google Tag Manager

We use Google Tag Manager, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Tag Manager is used to manage and trigger various website tags. It can, in particular, be used to embed analytics and marketing services.

The optional services managed via Google Tag Manager are used in accordance with the selection you make in the consent system.

Where consent is required, processing is based on Art. 6(1)(a) GDPR and Sec. 25(1) TDDDG.

12. Google Analytics

With your consent, we use Google Analytics 4, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics allows us, in particular, to evaluate the use of our website. This may include information on pages visited, interactions, dwell time, visitor origin, and device and browser information.

Processing is based on your consent pursuant to Art. 6(1)(a) GDPR and, where information is stored on or read from your terminal device, Sec. 25(1) TDDDG.

You can withdraw your consent at any time, with effect for the future, via the cookie settings.

13. Google Ads and conversion tracking

With your consent, we use Google Ads services, in particular to measure conversions and optimise our advertising campaigns.

The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

This allows us, in particular, to measure whether users take certain actions on our website after interacting with a Google ad, for example:

• vehicle enquiries
• contact enquiries
• purchase (trade-in) enquiries
• configurator enquiries
• leasing or financing enquiries
• service enquiries
• other defined conversions

In addition, insofar as covered by your consent, functions for forming audiences and displaying relevant advertising may be used.

Processing is based on your consent pursuant to Art. 6(1)(a) GDPR and Sec. 25(1) TDDDG.

14. Meta Pixel

With your consent, we may use the Meta Pixel.

For users within the European Union, the provider is generally Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.

The Meta Pixel is used, in particular, to:

• measure the effectiveness of our advertising
• record conversions
• evaluate advertising campaigns
• form audiences for advertising purposes
• optimise advertising measures

Processing takes place exclusively with your consent, based on Art. 6(1)(a) GDPR and Sec. 25(1) TDDDG.

You can withdraw your consent at any time, with effect for the future, via the cookie settings.

15. YouTube

Our website may embed videos from YouTube.

The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

YouTube content is loaded in accordance with the selection you make via our consent system.

When a YouTube video is loaded or played, your IP address, technical information, details of the page visited, and other usage data may be transmitted to Google/YouTube.

If you are logged into Google or YouTube, information may be linked to your account there.

Processing is based on your consent pursuant to Art. 6(1)(a) GDPR and, where necessary, Sec. 25(1) TDDDG.

16. Google Maps

Our website uses Google Maps to display locations and directions.

The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Maps is loaded in accordance with the selection you make via our consent system.

When Google Maps is loaded, your IP address, technical data and usage information may be transmitted to Google.

Processing is based on your consent pursuant to Art. 6(1)(a) GDPR and, where necessary, Sec. 25(1) TDDDG.

17. Cloudflare Turnstile

We use Cloudflare Turnstile on selected forms.

The provider is:

Cloudflare, Inc.
101 Townsend Street
San Francisco, CA 94107
USA

Turnstile is used to detect automated access, bots, abuse and spam, and to protect our forms from misuse.

Technical information about the device used and the connection may be processed for this purpose.

Processing is based on our legitimate interest in the security of our website and forms pursuant to Art. 6(1)(f) GDPR.

Where personal data is transferred to third countries, the statutory requirements of Art. 44 et seq. GDPR are observed.

18. Job applications

Processing of applicant data

You may apply to us, in particular, by e-mail, by post, or via an online application form.

As part of the application process, the following data may in particular be processed:

• name and contact details
• CV
• certificates
• qualifications and professional experience
• application documents
• interview notes
• other information you provide

Processing is based on Sec. 26 BDSG, insofar as it is necessary for deciding whether to establish an employment relationship.

Where you have additionally given consent, the relevant processing is based on Art. 6(1)(a) GDPR.

Retention period

If no employment relationship is established, we generally store your application data for up to six months after the application process has been completed, unless there are special reasons for longer retention.

Longer storage may in particular occur where necessary to assert, exercise or defend legal claims, or where you have expressly consented to longer storage.

Talent pool

With your express consent, we may include your application data in a talent pool in order to be able to contact you regarding suitable future job openings.

Processing is based on your consent pursuant to Art. 6(1)(a) GDPR.

You may withdraw this consent at any time with effect for the future.

Unless a different retention period has been agreed, data in the talent pool is deleted no later than two years after consent was given.

19. Advertising and customer communication

Where you have given us corresponding consent, we may use your contact details to inform you about vehicles, accessories, modifications, services, promotions or other offers from Carpoint.

Depending on the scope of your consent, contact may take place, in particular, by e-mail, phone, or via other communication channels you have expressly authorised.

Processing is based on your consent pursuant to Art. 6(1)(a) GDPR, unless another legal basis exists for the respective communication.

You may withdraw a given consent at any time with effect for the future.

20. Recipients of personal data

As part of our business activities, personal data may, insofar as necessary and legally permissible, be transmitted in particular to the following recipients or categories of recipients:

• hosting and IT service providers
• manufacturers and importers
• suppliers and logistics companies
• registration service providers
• financing and leasing partners
• payment service providers
• technical service providers
• analytics and marketing service providers, with your consent
• tax advisors and other professional advisors
• authorities and public bodies, where there is a legal obligation to do so

Data is only transmitted where a corresponding legal basis exists.

21. Data security

We take appropriate technical and organisational measures to protect personal data against loss, manipulation, unauthorised access and other unlawful processing.

Our security measures are reviewed and adapted in line with technological developments.

22. Changes to this privacy policy

We may amend this privacy policy if our website, the services we use, our business processes or the legal requirements change.

The version published on our website at the relevant time applies.

Last updated: August 2026