Privacy policy

The controller within the meaning of the General Data Protection Regulation (GDPR) is: DFZ Dellenfreie Zone, owner Gennadij Tscherepanow, Karlstraße 24, 71522 Backnang. Phone: 0176 63220904, email: info@dellen-freie-zone.de.

We process personal data only to the extent necessary to provide a functional website and our services, or where you have given consent. The legal bases are in particular Art. 6 (1) (a) (consent), (b) (contract or pre-contractual measures) and (f) (legitimate interest) GDPR. Data are deleted as soon as the purpose of storage no longer applies and no statutory retention obligations conflict.

You have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR)
• Right to withdraw consent (Art. 7 (3) GDPR)

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The competent authority is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg.

On each access, the hosting provider automatically records technically necessary data: IP address, date and time, the page accessed, the amount of data transferred, browser and operating system, and the previously visited page. The purpose is trouble-free delivery, stability and security. The legal basis is our legitimate interest (Art. 6 (1) (f) GDPR). These data are stored only briefly.

We use only technically necessary local storage (e.g. your cookie choice) and – solely with your consent – analytics and marketing services. On your first visit a cookie banner appears; until you decide, no consent-requiring services are loaded (Consent Mode v2: all consent denied by default). Signals such as “Do Not Track” and “Global Privacy Control” are respected. You can change your consent at any time via “Cookie settings” in the footer. Legal basis: Art. 6 (1) (a) GDPR, § 25 (1) TDDDG.

Via our enquiry assistant you can request a non-binding assessment. We process: name, phone, email, optionally a second set of contact details, details about the vehicle and type of damage, your message, and an optionally uploaded photo. The purpose is handling your enquiry, the call-back and preparing an assessment. The legal basis is Art. 6 (1) (b) GDPR or (a). Contact data are stored encrypted (AES-256); phone and email additionally as a hash. Photos are accessible only internally and password-protected. Data are deleted once no longer required and no retention periods conflict.

To manage website tags we use Google Tag Manager by Google Ireland Limited (Dublin, Ireland). It is loaded only after your consent in the cookie banner and controls the consent-based loading of further services. The legal basis is your consent (Art. 6 (1) (a) GDPR).

Where you consent to marketing, we may use conversion-measurement services from Google (Google Ads) and Meta (Meta Platforms Ireland Limited) to measure the success of ads. Pseudonymous or hashed data – e.g. a hashed email/phone number and click identifiers (gclid, fbclid) – may be transmitted to these providers, solely where marketing consent has been given. Transfer to third countries (in particular the USA) may occur; the basis is the EU standard contractual clauses or the EU-US Data Privacy Framework. Legal basis: Art. 6 (1) (a) GDPR. Withdrawal any time via cookie settings.

As part of order processing we contact you, on request, via the phone number you provided by SMS or WhatsApp, e.g. with a “car ready” message or a request for a review. When using WhatsApp, data are processed by Meta Platforms Ireland Limited. The legal basis is contract performance or our legitimate interest (Art. 6 (1) (b) and (f) GDPR). You may object to this form of contact at any time.

Transfer to third parties takes place only to the extent described. We use in particular our hosting provider and – subject to consent – the services named in sections 7 to 9. Data processing agreements pursuant to Art. 28 GDPR are in place with processors.

Transmission is encrypted via TLS/SSL. Stored contact data are additionally encrypted. We take appropriate technical and organisational measures to protect your data against loss, manipulation and unauthorised access.

This privacy policy is dated June 2026. Further development of our website or changed legal requirements may make an update necessary.