This Privacy Policy describes how DRIVE’N CAR GmbH (hereinafter “we”, “us”, “our”), operator of 
https://www.drivencar.de (hereinafter “the Website” or “the Site”), collects, uses, stores and protects the personal data of visitors and customers of our automobile sales and services business.
By using the Website you agree to the processing of your personal data as described in this policy. If you do not agree, please do not use the Website.
1. Who we are
Our website address is: https://www.drivencar.de.
Data controller:
- Company: DRIVE’N CAR GmbH
- Registered office: Schlierseestraße 3, 12527 Berlin, Germany
- Managing director: Thomas Scherres
- Commercial register: Amtsgericht Charlottenburg (Berlin), HRB 86988 B
- VAT ID (USt-IdNr.): DE 813640157
- Phone: +49 1577 8742020
- E-mail (data protection): [email protected]
- Data Protection Officer (DPO): Thomas Scherres, [email protected]
2. What personal data we collect
2.1. Data you provide directly
- Contact and sales data: first name, last name, e-mail address, phone number, postal address, country of residence.
- Vehicle data: make, model, year of manufacture, VIN, mileage, service history, condition, estimated value (for trade-in/valuation).
- Test-drive data: driving licence details, preferred date and time, vehicle of interest.
- Financing data: income, employer, payment history, documents required for credit/leasing applications.
- Identity documents: ID/passport copy, driving licence copy where required by law (e.g. for test drives or contract signing).
- Communications: messages sent via the contact form, e-mail, phone or chat, including attachments, offers and price requests.
- Comments/reviews: content of comments, name, e-mail, website URL and IP address.
2.2. Data collected automatically
- Technical data: IP address, browser type and version, operating system, device type, screen resolution, language, referring URL, pages visited, time spent, click paths.
- Approximate location derived from IP (city level).
- Cookies and similar technologies (see section 7).
2.3. Data from third parties
- Financing partners (banks, non-bank lenders, leasing companies) — credit application status, offers.
- Insurance partners — offers for vehicle insurance (liability, comprehensive).
- Vehicle history / inspection services — mileage, accident and ownership history.
- Public registers — only where legally required for fraud prevention or verification.
3. How we use your data (purposes and legal bases)
Under the GDPR (Art. 6), we process your data on the following legal bases:
| Purpose | Legal basis |
|---|---|
| Responding to enquiries, sending quotes, arranging test drives | Performance of a contract (Art. 6(1)(b)) |
| Concluding and performing vehicle sale contracts | Performance of a contract (Art. 6(1)(b)) |
| Trade-in / vehicle valuation and purchase | Performance of a contract (Art. 6(1)(b)) |
| Processing credit/leasing applications, forwarding data to banks/lenders | Consent (Art. 6(1)(a)) + contractual necessity |
| Invoicing, accounting, tax reporting | Legal obligation (Art. 6(1)(c)) |
| Marketing e-mails, newsletters, personalised offers | Consent (Art. 6(1)(a)) — withdraw anytime |
| Website analytics and improvement | Legitimate interest (Art. 6(1)(f)) |
| Fraud prevention and IT security | Legitimate interest (Art. 6(1)(f)) |
| Compliance with legal obligations (GDPR, AML, consumer protection) | Legal obligation (Art. 6(1)(c)) |
4. Comments
When visitors leave comments on the Site we collect the data shown in the comments form, and also the visitor’s IP address and browser user agent string, to help spam detection.
An anonymized string created from your email address (also called a hash) may be provided to the Gravatar service to see if you are using it. The Gravatar service privacy policy is available here: https://automattic.com/privacy/. After approval of your comment, your profile picture is visible to the public in the context of your comment.
5. Media
If you upload images to the Website, you should avoid uploading images with embedded location data (EXIF GPS) included. Visitors to the Website can download and extract any location data from images on the Website.
6. Who we share your data with
We do not sell or rent your personal data. We may share it with:
- Internal staff (sales, service, accounting, administration) on a need-to-know basis.
- Service providers / processors: hosting provider, CRM, payment processors, e-mail marketing, analytics (Google Analytics), customer support tools, IT maintenance — bound by data processing agreements.
- Financing partners (banks, non-bank lenders, leasing companies) — only with your consent.
- Insurance partners (vehicle insurance) — at your request.
- Vehicle history / inspection providers — for valuation and verification.
- Authorities (tax office, police, vehicle registration, courts) — where legally required.
- Advisors (lawyers, accountants, auditors) under confidentiality obligations.
If you request a password reset, your IP address will be included in the reset email.
7. Cookies
7.1. What cookies are
Cookies are small text files stored on your device. We use them to run the Site, analyse traffic and support marketing.
7.2. Categories
| Category | Purpose | Duration | Consent |
|---|---|---|---|
| Strictly necessary | Site operation, session, security, quote cart | Session / 1 year | No (exempt) |
| Preferences | Language, vehicle filters, UI settings | 6–12 months | Yes |
| Statistics/Analytics | Google Analytics, Hotjar (traffic, behaviour) | up to 2 years | Yes |
| Marketing | Meta Pixel, Google Ads, retargeting | 90 days – 1 year | Yes |
7.3. Specific cookies
- Comments: if you leave a comment, you may opt-in to saving your name, email address and website in cookies. These are for your convenience so that you do not have to fill in your details again when you leave another comment. These cookies will last for one year.
- Login: if you visit our login page, we will set a temporary cookie to determine if your browser accepts cookies. This cookie contains no personal data and is discarded when you close your browser. When you log in, we will also set up several cookies to save your login information and your screen display choices. Login cookies last for two days, and screen options cookies last for a year. If you select “Remember Me”, your login will persist for two weeks. If you log out of your account, the login cookies will be removed.
- Editing content: if you edit or publish an article, an additional cookie will be saved in your browser. This cookie includes no personal data and simply indicates the post ID of the article you just edited. It expires after 1 day.
7.4. Managing consent
On your first visit a cookie banner lets you accept or reject optional categories. You can change your preferences at any time via the “Cookie settings” link in the footer. Refusing marketing cookies does not affect the Site’s functionality.
7.5. Third-party cookies
- Google Analytics (Google Ireland Ltd.) —
_ga,_gid,_gat. - Meta Pixel (Meta Platforms Ireland Ltd.) —
_fbp. - YouTube / Vimeo — cookies when playing embedded videos.
- Google Maps — for showing our location.
8. Embedded content from other websites
Articles on this Site may include embedded content (e.g. videos, images, articles, etc.). Embedded content from other websites behaves in the exact same way as if the visitor has visited the other website.
These websites may collect data about you, use cookies, embed additional third-party tracking, and monitor your interaction with that embedded content, including tracking your interaction with the embedded content if you have an account and are logged in to that website.
9. Automated spam detection
Visitor comments may be checked through an automated spam detection service (e.g. Akismet). The service receives the comment content, IP address, browser user agent and other comment metadata for spam classification. Its privacy policy is available at https://automattic.com/privacy/.
10. How long we retain your data
- Enquiry / quote data: 12 months after the last interaction.
- Sales contract data (vehicle purchase): 10 years (accounting/tax obligations).
- Trade-in / valuation data: 5 years.
- Financing/credit documents: contract duration + 5 years.
- Marketing (newsletter): until unsubscription or 24 months of inactivity.
- Technical logs / IP: 90 days.
- Comments: retained indefinitely so follow-up comments can be recognised and approved automatically.
- Registered user profiles: stored while the account exists; users may view, edit or delete their personal information at any time (except they cannot change their username). Website administrators can also see and edit that information.
After the retention period, data is deleted or irreversibly anonymised.
11. Your rights over your data
If you have an account on this Site, or have left comments, you can request to receive an exported file of the personal data we hold about you, including any data you have provided to us. You can also request that we erase any personal data we hold about you. This does not include any data we are obliged to keep for administrative, legal, or security purposes.
In addition, under the GDPR you have the right to:
- Access (Art. 15) — obtain a copy of your data.
- Rectification (Art. 16) — correct inaccurate data.
- Erasure (“right to be forgotten”) (Art. 17).
- Restriction of processing (Art. 18).
- Data portability (Art. 20).
- Objection (Art. 21) — including objection to direct marketing.
- Not to be subject to automated decision-making (Art. 22).
How to exercise your rights: send a written request to [email protected] or by post to our registered office at Schlierseestraße 3, 12527 Berlin, Germany. We respond within 30 days (extendable to 60 days for complex cases, with notice).
Right to complain: you may lodge a complaint with your local supervisory authority (in Germany: the competent Landesdatenschutzbehörde; in the EU: your national DPA). A list is available at https://edpb.europa.eu/about-edpb/board/members_en.
12. Where your data is sent (international transfers)
If some providers (e.g. Google, Meta, cloud services) process data outside the European Economic Area, the transfer is based on:
- an adequacy decision by the European Commission, or
- Standard Contractual Clauses (SCC) approved by the EC, or
- certifications (e.g. EU–US Data Privacy Framework).
You can request copies of the applicable safeguards at [email protected].
13. Security
We implement appropriate technical and organisational measures: TLS/HTTPS encryption, role-based access control, backups, firewall, monitoring, staff training. Access to customer data is restricted and audited. In the event of a data breach we will notify you promptly and inform the supervisory authority within 72 hours.
14. Minors
The Site is not directed at persons under 16. We do not intentionally collect data from minors. If we discover that we have collected data from a minor without parental consent, we delete it immediately.
15. Links to third-party websites
The Site contains links to third-party websites (e.g. financing providers, insurers, vehicle history services, maps). We are not responsible for their privacy practices. Please review their policies before providing them with data.
16. Changes to this policy
We reserve the right to update this policy. The current version is published on the Site with the update date. Significant changes will be communicated by e-mail or banner on the Site. Continued use of the Site after publication constitutes acceptance.
17. Contact
For any questions regarding data protection:
Data Protection Officer (DPO): Thomas Scherres, [email protected]
E-mail: [email protected]
Phone: +49 1577 8742020
Address: Schlierseestraße 3, 12527 Berlin, Germany
