Privacy policy

1. Controller

The controller for the processing of data on carfalke.de, in the CarFalke app and when using the CarFalke market search within the meaning of the General Data Protection Regulation (GDPR) is:

CarFalke GmbH, Mies-van-der-Rohe-Straße 8, 80807 München, Deutschland, e-mail: [email protected]

For all questions about data protection and to exercise your rights, contact us at [email protected].

2. Data protection officer

Under Art. 37 GDPR and § 38 BDSG we are currently not obliged to appoint a data protection officer. Our data protection team handles your requests at [email protected].

3. Overview: whose data we process

CarFalke is a market search for professional car dealers: we read publicly accessible vehicle listings on third-party portals (mobile.de, AutoScout24, Kleinanzeigen), enrich them and notify our customers of new hits. In doing so we process personal data of three groups:

• visitors to our website (sections 4, 13–15),
• contact persons and employees of our customers – from the access request through the user account to the invoice (sections 5–12),
• sellers behind vehicle listings on the portals, whose details we take over from the public listing (section 7).

We process personal data only to the extent necessary to run the service, perform our contracts, keep the platform secure or meet legal obligations, or where you have consented. We do not sell personal data, use no third-party advertising trackers and build no advertising profiles.

4. Hosting, server logs and backups

The website, the database, uploaded documents and the background services (crawler, notifications) run on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, in data centres in Germany. Encrypted backups are stored at Hetzner in Germany and are overwritten after six months at the latest. Hetzner processes the data exclusively on our behalf under a data processing agreement (Art. 28 GDPR).

When you access the website or the app interface we automatically process technically necessary data, in particular:

• IP address
• date and time of the request
• page or file requested and HTTP status code
• browser type, operating system and referrer URL (where transmitted)

We process this data to deliver the service, ensure its stability and security, fend off attacks and limit abuse (e.g. automated mass requests). The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in secure and error-free operation. Server logs are deleted after 30 days at the latest, unless they are needed longer in an individual case to investigate a security incident.

5. Access request and dealer verification

CarFalke is open to professional car dealers only. With the access request we process the details of your company (name, legal form, address, VAT identification number, business e-mail address and phone number, optionally website and commercial register details) and of the requesting person (first and last name, e-mail address, password as a cryptographic hash, optionally the role in the company), as well as your declaration that you trade in vehicles professionally.

Before activation we check whether the applicant is a professional dealer, in particular using the commercial register, the EU VIES system for VAT identification numbers and your website. On request we may ask for evidence (e.g. a trade registration or a register extract). Uploaded evidence is stored encrypted and not publicly; it is viewed only by our team. The decision on activation is made by a human.

The legal bases are Art. 6(1)(b) GDPR (initiation and performance of the contract) and Art. 6(1)(f) GDPR (protecting the service against misuse, in particular the sellers' contact details). We keep the data of an activated company for the duration of the contract; evidence is deleted three years after the end of the contract at the latest, and invoice records are kept for ten years under § 147 AO and § 257 HGB. Data of rejected or incomplete requests is deleted as soon as it is no longer needed, at the latest at the end of the regular three-year limitation period.

6. User account and team

You need a user account to use the service. For it we process your name, e-mail address, password (exclusively as a cryptographic hash) or passkey, optionally a phone number, your language, your notification settings and the times of your sign-ins.

If you sign in with Google or Apple, we receive your name, e-mail address and an identifier from that provider; we never learn your password with that provider. The provider's privacy policy applies to the processing on its side.

Teams: a dealer can invite employees or create accounts for them. We then process the invited person's name, e-mail address and role as the dealer enters them, and send them an invitation or access e-mail. Within a team, the members' names and roles and their activity in the market search (section 8) are visible to the other members; the dealer manages its team itself.

The legal basis is Art. 6(1)(b) GDPR (user contract) and, for accounts invited by your employer, Art. 6(1)(f) GDPR (performance of the contract with your company). We keep the account data until the account is deleted – by you under Settings, by your dealer in the team, or at the end of the contract. Under Settings you can also download a copy of your data.

7. The market search: listings from third-party portals

The core of the service are vehicle listings that sellers have published publicly on mobile.de, AutoScout24 or Kleinanzeigen. Our crawler regularly retrieves these publicly accessible pages – without signing in to the portals – and stores from the listing: the vehicle data (e.g. make, model, first registration, mileage, price, equipment, condition), the photos, the location (town and postcode), the link to the original listing and the price history. About the seller we store what the listing itself shows: whether it is a dealer or a private person, the name displayed (for private persons usually only the first name), the seller's rating on the portal and – where published in the listing – the phone number.

The purpose is to enable our customers, verified car dealers, to find vehicles they wish to buy for their business and to make it easier for them to contact the seller – precisely the purpose for which the seller published the listing and their contact details. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest and that of our customers lies in observing the vehicle market across portals and in good time and in buying vehicles; the sellers' interest in selling their vehicle runs parallel to it. To protect sellers: names and phone numbers are visible only to signed-in employees of activated dealers, never to website visitors or search engines; the data is not passed on to third parties and not used for advertising; our customers are contractually obliged to use the contact details solely for an enquiry about the vehicle offered.

From the listings we compute statistical figures – market value, price rating, purchase potential, the market trend of a model. These relate to the vehicle, not to the person; no profiling of sellers takes place.

To retrieve the portal pages we use the ScrapingBee service of ScrapingBee SAS, Paris (France), as a processor (Art. 28 GDPR); it retrieves the pages on our behalf.

Retention: we keep vehicle data, prices and price history for the market statistics even after a listing has ended. We automatically delete the seller's name and phone number 90 days after the listing is no longer reachable on the portal (sold or removed).

Information under Art. 14 GDPR: since we do not know the sellers and notifying each seller individually would involve a disproportionate effort (Art. 14(5)(b) GDPR), we inform publicly here. The source of the data is the linked listing on the portal. As the seller behind a listing you can object to the processing at any time (section 18) – write to [email protected] and name the link to the listing; we then remove your contact details from the service.

8. Saved searches, notifications, watchlist and team activity

To provide the market search we store the criteria of your saved searches, their hits, your watchlist with status, notes, assignee and calculations, and the activity within the team (e.g. who set a vehicle to “Called” or changed a search). This data is visible to the members of your team so they can work together, and to our team where needed for support or billing. If you use functions that retrieve portal pages on demand (e.g. “Fetch details” or the comparison with the portal), we log who triggered them and when, in order to manage the daily quota.

Notifications: depending on your settings we inform you about new hits, price changes and recalls by e-mail, by web push in the browser and by push notification in the CarFalke app, as well as with a weekly report. For web push we store the push address generated by the browser and its keys; for the app a device token plus platform and app version. App push notifications are delivered via the push service of Expo (650 Industries, Inc., USA) to Apple (APNs) or Google (Firebase Cloud Messaging); only the title and text of the message and the token are transmitted, no further data from your account. You can switch notifications off at any time under Notifications and revoke push permissions in the browser or on the device.

The legal basis is Art. 6(1)(b) GDPR. We keep the data for the duration of the contract with your dealer; deleted searches and removed push addresses are deleted immediately. A note on notes: please enter only factual information required for the vehicle purchase.

9. CarFalke app

The CarFalke app for iOS and Android uses the same accounts and data as the website. On the device it stores your sign-in, your language and settings. Beyond that it processes no device data; in particular it does not access contacts, location or photos. If you open an original listing or call a phone number from the app, the portal's app or your device's phone app opens; the respective provider is responsible for the processing there. The app stores' (Apple App Store, Google Play) privacy policies apply to them; Apple and Google do not share personal data about you with us.

10. Contract, invoices and payment

To perform the contract with your dealer we process the contract data (plan, term, number of users, portals), the billing address and invoices. We send invoices by e-mail; no payment takes place through the website. The legal basis is Art. 6(1)(b) and (c) GDPR (tax law obligations). We keep invoice and accounting records for ten years under § 147 AO and § 257 HGB.

11. E-mails and messages

We send you e-mails that the service requires: to confirm your e-mail address, to reset your password, on the decision about your access request, as notifications about hits (section 8), for invoices and for important changes to the service or to this policy. We log the sending and its success (recipient, subject, time, status) so that delivery problems can be traced.

Sending is done via Google Workspace (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) as a processor. The legal bases are Art. 6(1)(b) GDPR and, for security notices, Art. 6(1)(f) GDPR.

We send promotional e-mails – such as product news – only with your consent (Art. 6(1)(a) GDPR) or to existing customers for our own similar services under § 7(3) UWG; every such e-mail contains an unsubscribe link. For such mailings we may use the Brevo service (Sendinblue SAS, Paris, France) as a processor.

12. Contact form and support

When you write to us via the contact form or by e-mail, we process your name, e-mail address, the topic chosen, your details about the company or the matter and the content of your message in order to answer your request. If you are signed in, we assign the request to your account. The legal basis is Art. 6(1)(b) GDPR (pre-contractual or contractual requests) or Art. 6(1)(f) GDPR (our interest in answering requests). We delete the request once it has been fully handled and no retention obligations apply; business correspondence is kept for six years under § 257 HGB.

To protect the form against automated requests we use Cloudflare Turnstile (section 14).

13. Cookies and local storage

Which cookies and storage technologies we use, how long they are stored and how you change your choice is described in our cookie policy. Necessary storage (sign-in, language, your cookie choice, theme, the live cockpit's settings) takes place without consent on the basis of § 25(2) no. 2 TDDDG and Art. 6(1)(b) or (f) GDPR. We use Google Analytics only with your consent.

14. Web analytics (Google Analytics), bot protection, no advertising services

Google Analytics 4: with your consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR) we use Google Analytics 4 of Google Ireland Limited to evaluate the use of our public pages statistically (pages visited, time on page, approximate origin, device type). Advertising features, Google signals and ad personalisation are switched off; Google Analytics 4 does not store IP addresses. Without consent the script is not loaded and no cookie is set. The data may be transferred to Google LLC in the USA; Google is certified under the EU-US Data Privacy Framework, and the standard contractual clauses apply in addition. You can withdraw your consent at any time via “Cookie settings” in the footer.

Cloudflare Turnstile: on sign-in, the access request, password reset and the contact form, Cloudflare Turnstile (Cloudflare, Inc., USA) checks in the background whether the request comes from a human. Your IP address and technical characteristics of the browser are processed; Turnstile sets no cookies. The legal basis is Art. 6(1)(f) GDPR (protection against automated abuse); the transfer to the USA relies on the EU-US Data Privacy Framework and the standard contractual clauses.

We use no advertising networks, no retargeting and no social media plugins.

15. Recipients

Within CarFalke GmbH only those employees have access to personal data who need it for their task (support, dealer verification, operations, accounting). In addition we use the following processors, bound by contract under Art. 28 GDPR:

• Hetzner Online GmbH, Gunzenhausen (Germany): hosting, database, document storage, backups
• ScrapingBee SAS, Paris (France): retrieval of the public portal pages for the crawler
• Google Ireland Limited, Dublin (Ireland): sending of e-mails (Google Workspace) and – only with consent – Google Analytics
• Cloudflare, Inc. (USA): Turnstile bot protection
• 650 Industries, Inc. (Expo, USA) as well as Apple Inc. and Google LLC: delivery of push notifications to the app
• Sendinblue SAS (Brevo, Paris, France): promotional mailings, where we send them

Beyond that we transfer data to third parties only where legally obliged (e.g. to authorities), to enforce our rights or with your consent. Within a dealer, team data is visible to the team members as described in sections 6 and 8.

16. Retention periods

Unless stated otherwise in the individual sections:

• server logs: 30 days
• account and team data: until the account is deleted or the contract ends
• saved searches, watchlist, activity, push addresses: for the duration of the contract
• a seller's name and phone number: 90 days after their listing ended on the portal
• evidence for dealer verification: up to three years after the end of the contract
• invoice and accounting records: ten years (§ 147 AO, § 257 HGB); business correspondence: six years
• backups: six months at most

After expiry we delete or anonymise the data unless ongoing proceedings require longer retention.

17. Transfers to third countries

Our data is stored in Germany or in the European Union. Transfers to the USA take place only in the cases named (Google Analytics with your consent, Cloudflare Turnstile, push notifications to the app). They rely on the EU Commission's adequacy decision for the EU-US Data Privacy Framework, where the recipient is certified, and additionally on the EU Commission's standard contractual clauses (Art. 46(2)(c) GDPR).

18. Your rights

You have the following rights towards us regarding your personal data:

• access (Art. 15 GDPR) – as a user you can download a copy of your data at any time under Settings
• rectification (Art. 16 GDPR)
• erasure (Art. 17 GDPR) – you can delete your account yourself under Settings
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• withdrawal of consent given, with effect for the future (Art. 7(3) GDPR)

Right to object (Art. 21 GDPR): where we process data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation; we then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests. This applies in particular to sellers behind listings (section 7). You may object to direct marketing at any time without giving reasons.

An e-mail to [email protected] is enough to exercise your rights. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your residence, your workplace or the place of the alleged infringement. The authority responsible for us is: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach.

19. Obligation to provide data

For an access request and a user account the fields marked as required are necessary; without them we cannot verify your company or set up access. All other details are voluntary.

20. Automated decisions

No decision with legal effect is based solely on automated processing (Art. 22 GDPR). A human decides on the activation of a dealer; price ratings and market values are estimates about vehicles, not decisions about people.

21. Data security

The transmission between your device and our servers is encrypted with TLS. We store passwords exclusively as hashes and uploaded evidence encrypted. Access to personal data is limited to the employees who need it; administrative access is logged. We continuously adapt our technical and organisational measures to the state of the art.

22. Changes

We adapt this privacy policy when the service or the legal situation changes. The current version is always available at carfalke.de; the date of the last change is shown at the top of this page. We inform users of material changes by e-mail.