Privacy Policy

§ 1 INFORMATION ON THE COLLECTION OF PERSONAL DATA

‍

(1) In the following, we inform you about the collection of personal data when using our website. Personal data is all data that can be related to you personally, e.g. name, address, e-mail addresses, user behavior.

(2) The responsible party pursuant to Art. 4 (7) of the EU General Data Protection Regulation (GDPR) is

Castle Tech GmbH c/o WeWork, Eichhornstraße 3, 10785 Berlin, info@caronsale.com (see also our imprint).

You can reach our data protection officer(s) as follows:

PROLIANCE GmbH
Leopoldstr. 21
80802 München
datenschutzbeauftragter@datenschutzexperte.de
‍

(3) When you contact us by e-mail or via a contact form, the data you provide to
(your e-mail address, your name and your telephone number, if applicable) will be stored by us in order to answer your questions. We delete the data accruing in this context after the storage is no longer necessary or restrict the processing if there are statutory retention obligations. The legal basis for this is our legitimate interest within the meaning of Art. 6 (1) lit. f DS-GVO to answer your enquiry.

(4) If we use commissioned service providers for individual functions of our offer or would like to use your data for advertising purposes, we will inform you in detail about the respective processes below. In doing so, we will also state the defined criteria for the storage period.

§ 2 YOUR RIGHTS
‍

(1) You have the following rights in relation to the personal data concerning you.

• Right to information. You have the right to obtain from us at any time, on request, information on the personal data processed by us and relating to you, in accordance with Article 15 of the GDPR. To this end, you may submit a request by post or by e-mail to the address given above.
  ‍
• Right of rectification. You have the right to ask us to rectify any personal data concerning you
  without delay if it is incorrect. To do so, please contact us at the contact addresses given above.
  ‍
• Right of cancellation. You have the right, under the conditions described in Art. 17 GDPR, to request us to delete the personal data concerning you. These conditions provide in particular for a right of deletion if the personal data are no longer necessary for the purposes for which they were collected or otherwise processed, and in cases of unlawful processing, opposition or the existence of an obligation to delete them under Union law or the law of the Member State to which we are subject. To exercise your above right, please contact us at the above addresses.
  ‍
• Right to restrict processing. You have the right to demand that we restrict
  processing in accordance with Art. 18 GDPR. This right exists in particular if the accuracy of the personal data is disputed between the user and us, for the period of time required to verify its accuracy, and in the event that the user requests limited processing instead of deletion in the event of an existing right to deletion; also in the event that the data is no longer required for the purposes we pursue, but the user needs it for the assertion, exercise or defense of legal claims, and if the successful exercise of an objection is still disputed between us and the user. To exercise your above right, please contact us at the contact addresses given above.
  ‍
• You have the right to object at any time, for reasons arising from your particular situation, to the processing of personal data concerning you, which is carried out on the basis of Art. 6, paragraph 1, letters e or f of the DPA, in accordance with Art. 21 of the DPA. We will stop processing your personal data unless we can prove compelling reasons for processing worthy of protection that outweigh your interests, rights and freedoms, or unless the processing serves to assert, exercise or defend legal claims.
  ‍
• Right to data portability. You have the right to receive from us the personal data concerning you which you have provided us with in a structured, common, machine-readable format in accordance with Art. 20 GDPR. To exercise your above right, please contact us at the above addresses.
  ‍
• Right of appeal. They also have the right to appeal to a competent supervisory authority in the event of complaints. A list of all European data protection authorities can be found here:
  http://ec.europa.eu/justice/article-29/structure/data-protection-authorities/index_en.htm.

§ 3 COLLECTION OF PERSONAL DATA WHEN VISITING OUR WEBSITE
‍

(1) When using the website for informational purposes only, i.e. if you do not register or otherwise provide us with information, we only collect the personal data that your browser sends to our server. If you wish to view our website, we collect the following data, which is technically necessary for us to display our website and to ensure its stability and security (legal basis is Art. 6 para. 1. p. 1 lit. f DS-GVO).

• IP address
  
• Date and time of the request
  
• Time zone difference to Greenwich Mean Time (GMT)
• Content of the request (concrete page)
  
• Access status/HTTP status code
  
• Amount of data transferred in each case
  
• Browser
  
• Operating system and its interface
  
• Language and version of the browser software.
  

This data is stored exclusively for technical reasons and is never assigned to a specific person at any time.

(2) In addition to the data mentioned above, cookies are stored on your computer when you use our website. Cookies are small text files that are stored on your hard drive and assigned to the browser you are using and through which the site that sets the cookie (in this case by us) receives certain information. Cookies cannot execute programs or transfer viruses to your computer. They serve to make the Internet offer altogether more user-friendly and effective.

(3) Use of cookies:

a) This website uses the following types of cookies, the scope and function of which are explained below:
‍

• Transient cookies (in addition b)
  
• Persistent cookies (see c)
  

b) Transient cookies are automatically deleted when you close the browser. This includes inparticular the session cookies. These store a so-called session ID, with whichvarious requests from your browser can be assigned to the common session. This enables your computer to be recognized when you return to our website. The session cookies are deleted when you log out or close the browser.

c) Persistent cookies are automatically deleted after a specified period of time, which may vary depending on the cookie. You can delete the cookies in the security settings of your browser at any time.

d) You can configure your browser settings according to your wishes and e.g. B. refuse to accept third party cookies or all cookies. Please note that in this case you will not be able to use all the functions of this website.

e) We use cookies to identify you for subsequent visits if you have an account with us. Otherwise you would have to log in again for each visit.

f) The Flash cookies used are not collected by your browser, but by your Flash plug-in. We also use HTML5 storage objects, which are stored on your end device. These objects store the required data regardless of the browser you use and do not have an automatic expiration date. If you do not want Flash cookies to be processed, you must install an appropriate add-on, e.g. B the Adobe Flash Killer cookie for Google Chrome. You can prevent the use of HTML5 storage objects by setting your browser to private mode. We also recommend that you regularly delete your cookies and browser history manually.

g) These cookies cannot identify you as a person. In any case, the use of cookies is justified on the basis of our legitimate interest in a design that meets your needs as well as the statistical evaluation of our website and the fact that your legitimate interests do not prevail, Art. 6 para. 1 lit. f GDPR.
‍
‍

§ 4 USE OF GOOGLE ANALYTICS
‍

(1) This website uses Google Analytics, a web analysis service of Google Inc ("Google"). Google Analytics uses "cookies", which are text files placed on your computer, to help the website analyze how users use the site. The information generated by the cookie about your use of this website is usually transferred to a Google server in the USA and stored there. However, in the event that IP anonymization is activated on this website, your IP address will be shortened by Google within member states of the European Union or in other signatory states to the Agreement on the European Economic Area before this happens. Only in exceptional cases will the full IP address be transferred to a Google server in the USA and shortened there. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on the website activities and to provide further services to the website operator in connection with the use of the website and the internet.

(2) The IP address transmitted by your browser within the framework of Google Analytics is not merged with other data from Google.

(3) You can prevent the storage of cookies by adjusting your browser software accordingly; however, we would like to point out that in this case you may not be able to use all functions of this website to their full extent. You can also prevent the collection of the data generated by the cookie and related to your use of the website (including your IP address) to Google and the processing of this data by Google by downloading and installing
the browser plug-in available under the following link: http://tools.google.com/dlpage/gaoptout?hl=de.

. (4) This website uses Google Analytics with the extension "_anonymizeIp()". This enables IP
addresses to be further processed in a shortened form, thus excluding the possibility of personal references. If the data collected about you contains a personal reference, this is immediately excluded and the personal data is immediately deleted.

(5) We use Google Analytics to analyze and regularly improve the use of our website. We can use the statistics obtained to improve our offer and make it more interesting for you as a user. For the exceptional cases in which personal data is transferred to the USA, Google has subjected itself to the EU-US Privacy Shield, https://www.privacyshield.gov.

(6) Your data will be stored by Google Analytics for a period of 14 months. After this period, the data will be deleted and only aggregated statistics will be kept.
You can find more information about how Google uses your data in Google's privacy policy: https://www.google.com/policies/privacy/.

(7) The use of Google Analytics is based on our legitimate interest in a design in line with requirements, the statistical evaluation as well as the efficient promotion of our website and the fact that your legitimate interests do not outweigh Art. 6 para. 1 lit. f GDPR.
‍

§ 5 USE OF OUR SITE AS A CAR DEALER
‍

(1) We use the so-called double-opt-in procedure for registration, i.e. Your registration isonly complete once you have confirmed your registration by clicking on the link contained in a confirmatione-mail sent to you for this purpose. If your confirmation is not received within 24 hours, your registration will be automatically deleted from our database.

(2) If you use our portal, we store the data required for the fulfillment of the contract, includingdetails of the method of payment, until you finally delete your access. Furthermore, we will store the voluntary data you have provided for the time of your use of the portal, unless you delete them first. The legal basis is Art. 6 para. 1 p. 1 lit. f GDPR.

(3) If you use the portal, your data may be made available to other participants of the portal in accordance with the contractual performance. Unregistered members will not receive any information about you. Your e-mail address is visible to all registered members, regardless of whether you have released it. In contrast, your entire profile with the data you have released is visible to the car dealership where you were the highest bidder in an auction.

(4) In order to prevent unauthorized access by third parties to your personal data, especially financial data, the connection is encrypted using TLS technology.
‍
‍

§ 6 INTEGRATION OF YOUTUBE VIDEOS
‍

(1) We have integrated YouTube videos into our online offer, which are stored on http://www.YouTube.com and can be played directly from our website. These are all integrated in "extended data protection mode", i.e. no data about you as a user is transmitted to YouTube if you do not play the videos. Only when you play the videos will the data mentioned in paragraph 2 be transmitted. We have no influence on this data transmission. This allows us to show you suitable videos directly on our website and thus enables a more comfortable usability of our website.

(2) By visiting the website, YouTube receives the information that you have called up the corresponding sub-page of our website. In addition, the data mentioned under § 3 of this declaration is transmitted. This takes place regardless of whether YouTube provides a user account via which you are logged in or whether no user account exists. The collection by YouTube is based on your consent (Art. 6 para. 1 lit. a GDPR), to fulfill your contractual relationship with YouTube (Art. 6 para. 1 lit. b GDPR) or based on the legitimate interest of YouTube (Art. 6 para. 1 lit. f GDPR).

(3) Further information on the purpose and scope of data collection and its processing by YouTube can be found in their data protection documents. There you will also find further information on your rights and objection options:https://www.google.de/intl/de/policies/privacy.Google also processes your personal data in the USA and has submitted to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework.
‍
‍

§ 7 INTEGRATION OF GOOGLE MAPS

(1) On this website we use the offer of Google Maps. This allows us to display interactive maps directly on our website and enables you to use the map function conveniently.

(2) By visiting the website, Google receives the information that you have called up the corresponding subpage of our website. In addition, the data mentioned under § 3 of this declaration is transmitted. This occurs regardless of whether Google provides a user account through which you are logged in or whether no user account exists. The collection by Google is based on your consent (Art. 6 para. 1 lit. a GDPR), for the fulfillment of your contractual relationship with Google (Art. 6 para. 1 lit. b GDPR) or on the legitimate interest of Google (Art. 6 para. 1 lit. f GDPR).

(3) Further information on the purpose and scope of data collection and its processing by Google can be found in its privacy policy. There you will also find further information on your rights and the possibility of objection: https://www.google.de/intl/de/policies/privacy.
Google also processes your personal data in the USA and has submitted to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework.
‍
‍

§ 8 USE OF GOOGLE ADWORDS CONVERSION
‍

(1) We use the offer of Google Adwords to draw attention to our attractive offers on external websites with the help of advertising media (so-called Google Adwords). We can determine how successful the individual advertising measures are in relation to the data of the advertising campaigns. In this way, we pursue the interest of showing you advertising that may be of interest to you, making our website more interesting for you and achieving a fair calculation of advertising costs.

(2) These advertising materials are delivered by Google via so-called "ad servers". For this purpose, we use ad server cookies, which can be used to measure certain parameters for measuring success, such as the display of ads or clicks by users. If you access our website via a Google ad, Google Adwords will store a cookie on your PC. These cookies usually lose their validity after 30 days and are not intended to identify you personally. The unique cookie ID, number of ad impressions per placement (frequency), last impression (relevant for post-view conversions) and opt-out information (marking that the user no longer wishes to be addressed) are usually stored as analysis values for this cookie.

(3) These cookies enable Google to recognize your internet browser. If a user visits certain pages of the website of an Adwords customer and the cookie stored on his computer has not yet expired, Google and the customer can recognize that the user clicked on the ad and was redirected to this page. A different cookie is assigned to each Adwords customer. Cookies can therefore not be tracked via the websites of Adwords customers. We ourselves do not collect or process any personal data in the aforementioned advertising measures. We only receive statistical evaluations from Google. These evaluations enable us to recognize which of the advertising measures used are particularly effective. We do not receive any further data from the use of the advertising media; in particular, we cannot identify the users on the basis of this information.

(4) Due to the marketing tools used, your browser automatically establishes a direct connection with Google's server. We have no influence on the scope and further use of the data collected by Google through the use of this tool and therefore inform you according to our state of knowledge: Through the integration of AdWords Conversion, Google receives the information that you have called up the corresponding part of our website or clicked on an advertisement from us. If you are registered with a Google service, Google can assign the visit to your account. Even if you are not registered with Google or have not logged in, it is possible that the provider may obtain and store your IP address.

(5) You can prevent participation in this tracking process in various ways: a) by setting your browser software accordingly, in particular the suppression of third-party cookies will result in you not receiving ads from third-party providers; b) by disabling cookies for conversion tracking by setting your browser to block cookies from the domain "www.googleadservices.com", https://www.google.de/settings/ads, deleting this setting when you delete your cookies; c) by deactivating the interest-based ads of the providers that are part of the self-regulatory campaign "About Ads" via the link http://www.aboutads.info/choices, deleting this setting when you delete your cookies; d) by permanently deactivating them in your Firefox, Internetex-plorer or Google Chrome browsers at the link http://www.google.com/settings/ads/plugin. We would like to point out that in this case you may not be able to use all functions of this offer to their full extent.

(6) Further information on data protection at Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043 USA can be found here: http://www.google.com/intl/de/policies/privacy and
https://services.google.com/sitestats/de.html. Alternatively, you can visit the Network Advertising Initiative (NAI) website at http://www.networkadvertising.org. Google has submitted to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework.
You can object to the use of your pseudonymous data at any time by installing a browser add-on. You can download this here: https://www.google.com/settings/u/0/ads/plugin?hl=de.

‍

§ 9 AUTOMATED INDIVIDUAL DECISIONS OR MEASURES FOR PROFILIN
‍

We do not use automated processing to make a decision or profile.
‍
‍

§ 10 DISCLOSURE OF DATA
‍

In principle, your personal data will only be passed on without your express prior consent in the following cases:
If it is necessary for the clarification of an illegal use of our services or for the prosecution, personal data will be forwarded to the prosecution authorities as well as to injured third parties if necessary. However, this only happens if there are concrete indications of illegal or abusive behavior. A transfer can also take place if this serves the enforcement of terms of use or other agreements. We are also legally obliged to provide information to certain public bodies on request. These are criminal prosecution authorities, authorities that pursue administrative offenses for which fines have been imposed and the tax authorities.

The disclosure of such data is based on our legitimate interest in combating abuse, prosecuting criminal offenses and securing, asserting and enforcing claims and that your rights and interests in the protection of your personal data do not outweigh, Art. 6 para. 1 lit. f GDPR or due to a legal obligation under Art. 6 para. 1 lit. c GDPR.

Furthermore, we use Amazon Web Services (hosting) and Heroku as well as AirCall and external call center services as contract processors.

‍

§ 11 STORAGE PERIOD

We will delete or make anonymous your personal data as soon as it is no longer required for the purposes for which it was collected or used in accordance with the preceding paragraphs. As a rule, we store your personal data for the duration of the usage or contractual relationship via the website plus a period of 14 days during which we retain backup copies after deletion, unless this data is required for longer for legal reasons or for criminal prosecution or to secure, assert or enforce legal claims. If data must be retained for legal reasons, it will be blocked. The data is then no longer available for further use.
‍

§ 12 APPLICATIONS

Collected data: We collect and process the data provided by you, such as your contact details, your name and your application documents, if you apply to us via the application form. All data that you send us is transferred in encrypted form between your browser and our server.
‍

Purposes of data processing: Data processing serves the purpose of transferring your application to us and thus ensuring an application procedure. In exceptional cases, the data will be used to defend against legal claims on your part.

Legal basis: We process your data in order to carry out pre-contractual and contractual measures in response to your application (Article 6(1)(b) of the GDPR) and, where appropriate, in the interests of defending against legal claims (Article 6(1)(f) of the GDPR)

Duration of storage: We store your data for as long as we need them for the specific processing purpose, for warranty purposes or to comply with statutory retention periods.

Disclosure to third parties: see § 10

‍