Privacy Policy

1. Controller

The controller responsible for data processing on this website is:

GP Products GmbH
Siemensstraße 31, 47533 Kleve
Germany
Represented by the managing director(s): Patrick Meijer
Telephone: [PLACEHOLDER: Telefon]
E-mail: info@ac-schnitzer.com
For any questions about data protection, please contact us at: info@ac-schnitzer.com

2. Data protection officer

[PLACEHOLDER: FG/DSB aangesteld ja/nee]

If a data protection officer has been appointed: [PLACEHOLDER: Name und Kontaktdaten des Datenschutzbeauftragten]. If no data protection officer has been appointed, please contact us at the address given in section 1.

3. Overview and legal bases

• This website is a brand site. We do not sell goods here. We process personal data only to the extent necessary to provide the website, answer your enquiries, send our newsletter and, with your consent, for analytics and marketing purposes.
• We rely on the following legal bases:
  • Art. 6(1)(a) GDPR (consent), for example for the newsletter, for analytics and marketing services and for loading YouTube videos;
  • Art. 6(1)(b) GDPR (contract or pre-contractual measures), where your enquiry relates to a contract;
  • Art. 6(1)(c) GDPR (legal obligation), for example statutory retention obligations;
  • Art. 6(1)(f) GDPR (legitimate interests), for example the secure and stable operation of the website and responding to general enquiries.
• Where information is stored on or read from your device (for example by cookies or similar technologies), this takes place in accordance with Section 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG) only with your consent, unless access is strictly necessary under Section 25(2) No. 2 TDDDG to provide a service you have expressly requested. Details can be found in our Cookie Policy.

4. Hosting and technical provision

• This website is operated via: [PLACEHOLDER: hosting/CMS brand site, Name und Anschrift des Anbieters, Serverstandort]
• The provider processes the data generated when the website is accessed (in particular the server log files listed in section 5) on our behalf. A data processing agreement pursuant to Art. 28 GDPR is in place with the provider. Where data is transferred to a country outside the European Economic Area, section 17 applies.
• The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure, fast and reliable provision of our website.
• We also use IT and hosting service providers to support the operation of our IT systems, who act on our instructions as processors.

5. Server log files

• Each time our website is accessed, our system automatically records data and information from the accessing device. In particular, the following is processed:
  • IP address of the requesting device;
  • date and time of access;
  • name and URL of the page or file accessed;
  • referrer URL (the previously visited page);
  • amount of data transferred and HTTP status code;
  • browser, operating system and, where applicable, device type used.
• This processing is necessary to deliver the website, to ensure its stability and security and to detect and prevent attacks and misuse. The legal basis is Art. 6(1)(f) GDPR.
• Log files are deleted or anonymised after 14 days, unless they are needed for longer in an individual case to investigate a security incident. They are not combined with other data sources.

6. Encryption

For security reasons, this website uses SSL or TLS encryption. You can recognise an encrypted connection by "https://" in your browser's address bar and by the padlock symbol.

7. Contact by e-mail or contact form

• If you contact us by e-mail or via our contact form, we process the data you provide, usually your name, e-mail address, telephone number where given, details of your vehicle and the content of your message. Mandatory fields in the contact form are marked as such.
• We use this data solely to process and respond to your enquiry. The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to the conclusion or performance of a contract, and otherwise Art. 6(1)(f) GDPR. Our legitimate interest lies in responding effectively to enquiries addressed to us.
• If your enquiry concerns the online shop at shop.ac-schnitzer.com, an order or the fitment of a product, we forward it to the operator of the online shop, Absolute Detailing B.V., where necessary to respond. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in passing your enquiry to the competent party.
• The contact form is technically provided via: [PLACEHOLDER: Formular-Tool / Anbieter des Kontaktformulars]
• We delete your enquiry and the related correspondence two years after it has been finally dealt with, unless statutory retention obligations (for example under Section 257 of the German Commercial Code (HGB) or Section 147 of the German Fiscal Code (AO) for commercial and business letters) prevent deletion.

8. Newsletter

• You can subscribe to our newsletter on our website. In the newsletter we inform you about news on the AC Schnitzer brand, the brand's Revival, new products, events and promotions.
• Only your e-mail address is required to subscribe. You may voluntarily provide further details, for example your first name, country or vehicle model, so that we can send you relevant content.
• Double opt-in: after subscribing, you will receive an e-mail asking you to confirm your subscription. We only add your e-mail address to the mailing list once you have confirmed. This ensures that no one can subscribe using someone else's e-mail address.
• Logging: to evidence your consent, we store the time of subscription and confirmation, the IP address, the source of the subscription (for example the signup form on ac-schnitzer.de) and the wording of the consent declaration. The legal basis for this is Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR and Art. 6(1)(f) GDPR. Our legitimate interest lies in being able to demonstrate that the newsletter is sent lawfully.
• The legal basis for sending the newsletter is your consent pursuant to Art. 6(1)(a) GDPR and Section 7(2) No. 2 of the German Act against Unfair Competition (UWG).
• Service provider: we use Klaviyo, a service of Klaviyo, Inc., 125 Summer Street, Boston, MA 02110, USA, to send the newsletter. Klaviyo stores your e-mail address and other details on our behalf under a data processing agreement pursuant to Art. 28 GDPR. Klaviyo, Inc. is certified under the EU-US Data Privacy Framework; in addition, the European Commission's Standard Contractual Clauses apply (see section 17). [PLACEHOLDER: Klaviyo-Konto der Markenseite getrennt oder gemeinsam mit dem Online-Shop der Ecom BV; bei gemeinsamer Nutzung Hinweis auf gemeinsame Verantwortlichkeit nach Art. 26 DSGVO ergänzen]
• Performance measurement: our newsletters contain technical elements (for example a tracking pixel and personalised links) that allow Klaviyo to record whether a newsletter has been opened and which links have been clicked. We use this analysis to improve our content and tailor it to your interests. This measurement is part of your consent to receive the newsletter (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). If you do not want this, you can unsubscribe from the newsletter.
• Unsubscribing: you can withdraw your consent at any time with effect for the future, for example via the unsubscribe link in every newsletter or by e-mail to info@ac-schnitzer.com. The lawfulness of processing carried out before withdrawal remains unaffected.
• Retention: we store your newsletter data until you unsubscribe. After you unsubscribe, we add your e-mail address to a suppression list to prevent further mailings (Art. 6(1)(f) GDPR). We retain the evidence of your consent for up to three years after the end of the year in which you unsubscribed, in order to defend against claims (standard limitation period under Sections 195 and 199 of the German Civil Code (BGB)). We delete unconfirmed subscriptions after 30 days.

9. Consent management (cookie banner)

• To manage your consents, we use [PLACEHOLDER: naam cookiebanner/CMP, Anbieter und Anschrift]. On your first visit to our website, a banner asks whether you consent to the use of services that are not strictly necessary. Without your consent, such services are not loaded.
• Your consent decision, the time, the banner version and a pseudonymous identifier are stored, usually in a cookie on your device and in a consent log.
• The legal basis is Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR (obligation to demonstrate consent) and Section 25(2) No. 2 TDDDG for storing your consent decision on your device.
• You can change or withdraw your consent at any time via the "Cookie settings" link in the footer of our website.
• We retain consent data for 12 months (cookie on your device) and three years (consent log) respectively.

10. YouTube videos

• We embed videos from the YouTube platform on our website. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google").
• We use the privacy-enhanced mode (youtube-nocookie.com). In addition, videos are only loaded once you expressly consent by clicking the video or via the cookie banner. Before you consent, only a preview image loaded from our own server is displayed and no data is transmitted to YouTube.
• After you consent, a connection to YouTube's servers is established. In particular, your IP address, information about your browser and device and the page visited are transmitted to YouTube. Even in privacy-enhanced mode, YouTube may store or read information on your device when the video is played. If you are logged into your Google account, YouTube may associate your usage with your profile. You can prevent this by logging out beforehand. Google is independently responsible for processing the data after transmission.
• The legal basis is your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw your consent at any time via "Cookie settings".
• Data may be transferred to the USA. Google LLC is certified under the EU-US Data Privacy Framework (see section 17).
• Further information can be found in Google's privacy policy: https://policies.google.com/privacy

11. Links to social networks

• On our website we refer to our profiles on social networks, for example Instagram, Facebook and YouTube, by means of simple links. We do not use social media plugins. Merely visiting our website therefore does not transmit any data to the operators of these networks.
• Only when you click a link are you redirected to the page of the respective network. The privacy policy of the respective operator applies there, for example:
  • Instagram and Facebook: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, https://www.facebook.com/privacy/policy
  • YouTube: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, https://policies.google.com/privacy
• For processing on our own pages within these networks (for example statistics on our Instagram page), we may be jointly responsible with the respective operator (Art. 26 GDPR). For Instagram and Facebook, this is governed by the Page Insights Controller Addendum (https://www.facebook.com/legal/terms/page_controller_addendum); under it, Meta assumes primary responsibility for the processing of Insights data and for fulfilling your rights. Further information is available on request.

12. Web analytics with Google Analytics 4

• If you have consented, we use Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We use Google Tag Manager from the same provider to integrate it. Tag Manager itself does not store user profiles, but controls which services are loaded after you consent.
• Google Analytics uses cookies and similar technologies to analyse the use of our website, for example pages viewed, time spent, source of the visit, approximate location (at country or region level), device and browser. Google Analytics 4 does not store full IP addresses. The information is assigned to a pseudonymous identifier.
• We use Google Consent Mode v2. As long as you have not consented, no analytics cookies are set and no analytics data about you is collected. [PLACEHOLDER: Consent Mode Variante bestätigen: "Basic" (keine Datenübertragung ohne Einwilligung) oder "Advanced" (cookielose Pings ohne Einwilligung); bei "Advanced" diesen Absatz anpassen]
• The purpose is to analyse and improve our website and content. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG.
• Google processes the data as our processor under the Google Ads Data Processing Terms. Data may be transferred to the USA; Google LLC is certified under the EU-US Data Privacy Framework (see section 17).
• Data in Google Analytics is automatically deleted after 14 months.
• You can withdraw your consent at any time via "Cookie settings".

13. Meta Pixel

• If you have consented, we use the Meta Pixel of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland ("Meta").
• The Meta Pixel allows us to measure how visitors respond to our advertisements on Facebook and Instagram, to show relevant advertising again on these platforms to people who have visited our website (remarketing) and to build audiences. In particular, your IP address, browser and device information, the pages viewed, interactions (for example a newsletter signup) and cookie identifiers are transmitted to Meta. If you are logged into Facebook or Instagram, Meta may associate this information with your account.
• The legal basis is your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG.
• We are jointly responsible with Meta for the collection of data on our website by means of the Meta Pixel and its transmission to Meta (Art. 26 GDPR). We have concluded a joint controller agreement with Meta for this purpose (Meta Controller Addendum, https://www.facebook.com/legal/controller_addendum). In essence, it provides that we are responsible for providing information under Art. 13 GDPR and for obtaining your consent, and that Meta is responsible for fulfilling your rights under Articles 15 to 20 GDPR with regard to the data stored by Meta after the joint processing. Irrespective of this, you may exercise your rights against both us and Meta (Art. 26(3) GDPR). The subsequent processing of the transmitted data by Meta, for example for the delivery of advertising, is carried out under Meta's sole responsibility.
• Data may be transferred to the USA; Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework (see section 17).
• Further information can be found in Meta's privacy policy: https://www.facebook.com/privacy/policy
• You can withdraw your consent at any time via "Cookie settings". You can also adjust your advertising preferences with Meta at https://www.facebook.com/adpreferences.

14. Google Ads conversion tracking and remarketing and Klaviyo onsite tracking

[PLACEHOLDER: Ziffer streichen beziehungsweise kürzen, falls Google Ads oder Klaviyo-Onsite-Tracking auf der Markenseite nicht eingesetzt werden]

• If you have consented, we use the conversion tracking and remarketing functions of Google Ads, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. This allows us to measure which actions (for example a newsletter signup) take place after a click on one of our Google ads, and to show visitors to our website relevant ads on other websites and services. In particular, your IP address, cookie identifiers (for example _gcl_au), click identifiers, pages viewed and browser and device information are transmitted to Google. Google processes this data as an independent controller under the Google Ads Controller-Controller Data Protection Terms. Data may be transferred to the USA; Google LLC is certified under the EU-US Data Privacy Framework (see section 17).
• If you have consented, Klaviyo sets a cookie on our website (__kla_id) that links website visits to an existing newsletter subscription, so that we can send you newsletters with content relevant to you. Klaviyo acts as our processor in this respect (see section 8(6) and section 17).
• The legal basis in each case is your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw your consent at any time via "Cookie settings". For the retention periods of the cookies, see our Cookie Policy.

15. Fonts and link to the online shop

• Fonts are loaded locally from our own server or that of our hosting provider. No connection to third-party servers (for example Google Fonts) is established for this purpose.
• Our website contains links to the online shop at shop.ac-schnitzer.com. The online shop is operated by Absolute Detailing B.V., Euroweg 24, 2988 CM Ridderkerk, the Netherlands, as an independent controller. By clicking such a link you leave our website; processing in the online shop is governed exclusively by the privacy policy published there.

16. Recipients and sharing within AM Group

• We only disclose your personal data as described in this privacy policy, where a legal basis permits it or where you have consented. Recipients may include in particular:
  • hosting, IT and maintenance service providers;
  • the contact form provider;
  • Klaviyo (newsletter delivery and, after your consent, onsite tracking);
  • the consent management provider;
  • Google (YouTube, Google Analytics, Google Tag Manager, Google Ads) and Meta (Meta Pixel), in each case only after your consent;
  • the operator of the online shop, where your enquiry relates to the shop (section 7(3));
  • public authorities and courts, where we are legally obliged to do so.
• We are part of the group of companies of AM Group Holding B.V. (the Netherlands). Personal data may be shared within AM Group as described in the following clause:

[PLACEHOLDER: groepsclausule AM Group, delen van gegevens binnen AM Group, tekst volgt via AM Group]

17. Transfers to third countries

• Some of the service providers we use are based in countries outside the European Economic Area (EEA), in particular the USA, or may process data there.
• For the USA, the European Commission adopted an adequacy decision on 10 July 2023 for companies certified under the EU-US Data Privacy Framework (DPF) (Art. 45 GDPR). To our knowledge, this applies to Klaviyo, Inc., Google LLC and Meta Platforms, Inc. You can view the certification at https://www.dataprivacyframework.gov.
• Where there is no certification or adequacy decision, we base the transfer on the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR) and, where necessary, supplementary measures. You can request a copy of the Standard Contractual Clauses from us at the address given in section 1.

18. Retention periods

• We store personal data only for as long as necessary for the respective purpose or as required by statutory retention obligations. The specific periods are stated for each processing activity. In summary:
  • server log files: 14 days;
  • contact enquiries: two years after they have been finally dealt with;
  • newsletter: until you unsubscribe; evidence of consent for up to three years after the end of the year in which you unsubscribed;
  • cookie banner consents: see section 9;
  • analytics and marketing data: see sections 12 to 14 and our Cookie Policy.
• Where data is subject to statutory retention obligations (for example six years for commercial and business letters under Section 257 HGB, up to ten years for tax-relevant documents under Section 147 AO), we restrict processing until the period expires and then delete the data.

19. Your rights

You have the following rights with regard to your personal data:

• right of access (Art. 15 GDPR);
• right to rectification (Art. 16 GDPR);
• right to erasure (Art. 17 GDPR);
• right to restriction of processing (Art. 18 GDPR);
• right to data portability (Art. 20 GDPR);
• right to object to processing (Art. 21 GDPR, see section 20);
• right to withdraw any consent given at any time with effect for the future (Art. 7(3) GDPR). The lawfulness of processing carried out before withdrawal remains unaffected.

To exercise your rights, simply send a message to info@ac-schnitzer.com or to the address given in section 1. We will inform recipients of your data about any rectification, erasure or restriction where necessary (Art. 19 GDPR).

20. Right to object under Art. 21 GDPR

Where we process your personal data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you have the right to object to this processing at any time on grounds relating to your particular situation. We will then no longer process your data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Where your personal data is processed for direct marketing purposes, you have the right to object at any time to processing for such marketing; this also applies to profiling to the extent that it is related to such direct marketing. After you object, we will no longer process your data for direct marketing purposes.

No particular form is required for the objection; it should preferably be addressed to: info@ac-schnitzer.com

21. Right to lodge a complaint with a supervisory authority

• You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes the GDPR (Art. 77 GDPR). You may contact, in particular, the supervisory authority in the place of your habitual residence, your place of work or the place of the alleged infringement.
• The supervisory authority competent for us is: State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2-4, 40213 Düsseldorf, Germany, www.ldi.nrw.de

22. Obligation to provide data, automated decisions and minors

• You are under no statutory or contractual obligation to provide us with personal data. However, without the details marked as mandatory, we cannot process your enquiry or newsletter subscription.
• No automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR) takes place.
• Our website and newsletter are not directed at persons under the age of 16. We do not knowingly process data of persons under the age of 16.

23. Changes to this privacy policy

We will update this privacy policy if our website, the services used or the legal situation change. The current version published on this page applies.