Privacy Policy

1. Introduction

This website is operated by HOF Automotive GmbH. We attach great importance to handling the data of our website visitors responsibly and protecting it in the best possible way. For this reason, we make every effort to comply with the requirements of the GDPR.

In the following, we explain how we process your data on our website. We use clear and transparent language so that you can truly understand what happens to your data.

2. General Information

2.1 Processing of Personal Data and Other Terms

Data protection applies to the processing of personal data. "Personal data" means all data that can identify you personally. This includes, for example, the IP address of the device you are currently using.

Such data is processed whenever "something happens to it." For example, when your browser transmits your IP address to our provider and it is automatically stored there. These and other legal definitions can be found in Art. 4 GDPR.

2.2 Applicable Regulations / Laws

The scope of data protection is governed by laws, in particular:

• The General Data Protection Regulation (GDPR) as an EU regulation
• The Federal Data Protection Act (BDSG) as a national law
• The Telecommunications and Telemedia Data Protection Act (TDDDG), which complements the GDPR where cookies or similar technologies are used

2.3 Data Controller

2.4 Data Protection Officer

2.5 How Data Is Generally Processed

Certain data (such as IP addresses) are automatically collected when you visit our website. These data are mainly required for the technical provision and secure operation of the website.

If we process additional personal data or collect other data, we will inform you accordingly or request your consent.

2.6 Your Rights

The GDPR grants you comprehensive rights, such as the right to receive free information about the origin, recipients and purpose of your stored personal data. You also have the right to request rectification, restriction or deletion of this data and to lodge a complaint with the competent data protection authority. Any consent you have given can be withdrawn at any time with effect for the future.

Details on your rights can be found in Section 6 of this Privacy Policy.

2.7 Our View on Data Protection

For us, data protection is more than just a legal obligation. Personal data has great value, and careful handling of such data should be a matter of course. As a website visitor, you should be able to decide what happens to your data, when, and by whom.

2.8 Data Sharing and Deletion

We only share personal data where there is a legal basis for doing so and only to the extent necessary. We delete your data once the purpose and legal basis for processing no longer exist and there are no other legal obligations preventing deletion. For more details, see Art. 17 GDPR.

2.9 Hosting and Technical Service Providers

This website is hosted on servers of our hosting provider Mittwald CM Service GmbH & Co. KG, Königsberger Str. 4-6, 32339 Espelkamp, Germany.

We also work with our digital agency neusta for development, maintenance and technical operation of the website. neusta may have access to personal data in the course of providing these services and acts as a processor under our instructions.

Legal basis: Art. 6 (1)(b) GDPR (contract performance) and Art. 6 (1)(f) GDPR (legitimate interest in secure and efficient website operation). We have concluded data processing agreements with our hosting provider and technical service providers.

2.10 Legal Bases

Processing personal data always requires a legal basis. Article 6 (1) GDPR provides the main options:

• (a) Consent
• (b) Contract performance or pre-contractual measures
• (c) Legal obligation
• (d) Vital interests
• (e) Public interest / exercise of official authority
• (f) Legitimate interests, except where overridden by your interests or fundamental rights

3. What Happens on Our Website

By visiting our website, we process certain personal data from you. To protect this data against unauthorized access by third parties, we use SSL/TLS encryption.

3.1 Server Log Files

When you access the website, information is automatically stored in server log files, including: browser type and version, operating system, referrer URL, hostname, time of request, and IP address.

These data are temporarily required to ensure system security, stability, error detection, and proper display. Legal basis: Art. 6 (1)(f) GDPR. Data are stored for a maximum of 14 days.

3.2 Cookies

This website uses cookies and similar technologies. We use a consent management platform (CMP) that informs you about all cookies used and allows you to manage your preferences.

All non-essential cookies can be managed through our CMP. You can withdraw consent at any time. Technically necessary cookies are used based on Art. 6 (1)(b), (c) and/or (f) GDPR.

Non-essential cookies (marketing) are only set with your consent under Art. 6 (1)(a) GDPR in conjunction with TDDDG. Our web analytics (Section 4.1) does not use cookies.

3.3 Contact by E-mail, Phone, or Form

If you contact us, we process your contact details and any other data you provide. Legal basis: Art. 6 (1)(b) GDPR or Art. 6 (1)(f) GDPR. Data submitted via our contact form are also stored in our Odoo CRM system (see Section 4.2).

3.4 Cookie-Consent Tool

We use a consent management platform to ensure only authorized cookies are activated. Legal basis: Art. 6 (1)(c) GDPR and Art. 6 (1)(f) GDPR.

3.5 Online appointment booking (Google Calendar)

When you use our online appointment booking (for example via the "Book an Appointment" flow on our website), you select a date and a time slot in your browser. If you confirm the booking, this information is sent to our web server over an encrypted connection (TLS).

Our server then creates a corresponding entry in a Google Calendar managed by us using the Google Calendar API. For this purpose, Google processes the calendar data as a service provider within the scope of Google Workspace / Google Calendar.

The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Depending on the configuration, data may also be processed by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, including in connection with group-internal support or infrastructure. Where personal data are transferred to the USA or other third countries, Google relies on appropriate safeguards such as EU Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework.

Categories of data typically include: the selected date, the selected time window, the title of the calendar event (for example "HOF Appointment"), any description text stored in the event, and technical metadata generated by the calendar service (for example identifiers or timestamps).

Server-side credentials used to access the calendar (such as OAuth tokens) are stored and processed on our systems separately from your browser session; they are used solely to operate the booking function and to maintain the calendar integration.

Legal basis: Art. 6 (1)(b) GDPR (steps prior to entering into a contract and, where applicable, performance of a contract relating to a consultation) and, subsidiarily, Art. 6 (1)(f) GDPR (legitimate interest in organising and documenting consultations efficiently).

Retention depends on our calendar and account settings, statutory retention periods and Google’s terms of use. You may request erasure or other rights under the GDPR in accordance with Section 6 of this Privacy Policy, subject to any overriding retention obligations.

Further information: Google Privacy Policy

4. Analytics, CRM and Marketing Tools

4.1 Plausible Analytics

We use Plausible Analytics, a web analytics service provided by Plausible Insights OÜ, Västriku tn 2, 50403 Tartu, Estonia. Plausible does not set cookies and does not store any identifier on your device. Data are processed on servers in the European Union.

Plausible records aggregated usage statistics: pages visited, referring website and campaign parameters (UTM), approximate time on page and scroll depth, device type, browser, operating system, country, and clicks on contact links (WhatsApp, e-mail, phone), contact form submissions and appointment bookings. Tracking requests are sent to our own server and forwarded to Plausible. Your IP address and browser user agent are used only to calculate an anonymous identifier that changes daily; the IP address is not stored. No user profiles are created and you cannot be recognised across websites or across days.

Legal basis: Art. 6 (1)(f) GDPR. Our legitimate interest is to understand how visitors find and use our website in order to improve it.

Further information: Plausible Data Policy

4.2 Odoo CRM

We use Odoo S.A. (Belgium) as our CRM system to store contact and customer data. Legal basis: Art. 6 (1)(b) and Art. 6 (1)(f) GDPR.

Further information: Odoo Privacy Policy

4.3 Meta (Facebook) Pixel

We use the Meta Pixel from Meta Platforms Ireland Limited to measure the effectiveness of ads. Legal basis: your consent under Art. 6 (1)(a) GDPR. You can withdraw consent at any time via the CMP. Meta is certified under the EU-US Data Privacy Framework.

Further information: Meta Privacy Policy

5. Social Media

We maintain presences on various social networks (Facebook, Instagram, LinkedIn, YouTube). When you visit these platforms, the respective providers process personal data in their own responsibility. Our own processing is based on Art. 6 (1)(f) GDPR.

6. Rights of Data Subjects

As a user of this website, you have various rights under the GDPR:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR)
• Right to withdraw consent (Art. 7 (3) GDPR)
• Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

To exercise your rights, contact us or our Data Protection Officer using the details provided above.

7. Data Retention Period

Personal data are stored only as long as necessary for the purpose of processing, unless statutory retention obligations require longer storage, you have consented to longer storage, or we have a legitimate interest in longer storage.

8. Data Security

We use appropriate technical and organisational measures to protect your data against manipulation, loss, destruction or unauthorised access. Our website uses SSL/TLS encryption for secure data transmission.

9. Changes to This Privacy Policy

We reserve the right to update this Privacy Policy at any time. The current version is always available on our website.

10. Contact