Privacy Policy

1. Introduction

We would like to give you, as a "data subject", the following information to provide an overview of the processing of your personal data by us and your rights under the data protection laws. Use of our internet pages is generally possible without entering personal data. However, if you wish to make use of special services offered by our company via our website, it may become necessary to process personal data. If it is necessary to process personal data and there is no legal basis for such processing, we generally obtain your consent.

The processing of personal data, for example your name, address or e-mail address, is always carried out in accordance with the General Data Protection Regulation (GDPR) and in compliance with the country-specific data protection regulations applicable to "GGH Gebrauchtwagengroßhandel Nord-Süd GmbH". By means of this privacy policy, we would like to inform you about the scope and purpose of the personal data collected, used and processed by us.

As data controllers, we have implemented numerous technical and organisational measures to ensure that the personal data processed via this website is protected as completely as possible. Nevertheless, Internet-based data transmissions can generally have security gaps, so that absolute protection cannot be guaranteed. For this reason, you are also free to transmit personal data to us by alternative means, for example by telephone or post.

2. Controller

The controller within the meaning of the GDPR is:
GGH Gebrauchtwagengroßhandel Nord-Süd GmbH
Steinbecker Meile 1, 42103 Wuppertal, Germany
Telephone: +49 (202) 251 388 – 00

3. Data protection officer

Due to our company size, i.e. the number of employees who have access to data, we are not obliged to appoint a data protection officer.
You can contact us directly at any time with all questions and suggestions regarding data protection using our contact form.
We use a contact form to ensure the delivery of your enquiry.
Data privacy contact form

4. Definitions

The privacy policy is based on the terms used by the European legislator for directives and regulations when the General Data Protection Regulation (GDPR) was adopted. Our privacy policy should be easy to read and understand for the public as well as for our customers and business partners. To ensure this, in advance, we would like to explain the terms used.

We use the following terms, among others, in this privacy policy:

Personal data

Personal data is any information relating to an identified or identifiable individual. An identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that individual.

Data subject

Data subject means any identified or identifiable individual whose personal data is processed by the data controller (our company).

Processing

Processing is any operation or set of operations, performed upon personal data, whether or not by automatic means, such as collection, recording, organisation, filing, storage, adaptation or alteration, reading, querying, use, disclosure by transmission, dissemination or any other form of provision, alignment or combination, restriction, deletion or destruction.

Restriction of processing

Restriction of processing is the marking of stored personal data with the aim of limiting its future processing.

Pseudonymisation

Pseudonymisation is the processing of personal data in such a way that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that this additional information is kept separately and is subject to technical and organisational measures which ensure that the personal data is not attributed to an identified or identifiable individual.

Processor

The processor is an individual or legal person, public authority, agency or other body who processes personal data on behalf of the controller.

Recipient

The recipient is an individual or legal person, public authority, agency or other body to whom personal data is disclosed, whether or not it is a third party. However, authorities that may receive personal data in the context of a specific investigation mandate under Union or national law shall not be considered as recipients.

Third parties

A third party is any individual or legal person, public authority, agency or body other than the data subject, the controller, the processor and the persons who, under the direct authority of the controller or the processor, are authorised to process the personal data.

Consent

Consent shall mean any informed and unequivocal expression of the data subject's free will in a specific case, in the form of a declaration or other unequivocal affirmative act by which the data subject signifies his or her consent to the processing of personal data relating to him or her.

Legal basis of processing

Art. 6(1) lit. a GDPR serves our company as a legal basis for processing operations for which we obtain consent for a specific processing purpose.

If the processing of personal data is necessary for the performance of a contract to which you are party, such as in the case of processing operations necessary for the supply of goods or provision of another service or consideration, processing is based on Art. 6(1) lit. b of the GDPR. The same applies to such processing operations which are necessary to carry out pre-contractual measures, for example in cases of enquiries about our products or services.

If our company is subject to a legal obligation which makes it necessary to process personal data, for example to fulfil tax obligations, processing is based on Art. 6(1) lit. c GDPR.

In rare cases, the processing of personal data might be necessary to protect vital interests of the data subject or another individual. This would be the case, for example, if a visitor to our company were to be injured and his name, age, health insurance details or other vital information had to be passed on to a doctor, hospital or other third party. In this case, processing would be based on Art. 6(1) lit. d GDPR.

Ultimately, processing operations could be based on Art. 6(1) lit. f GDPR. Processing operations which are not covered by any of the aforementioned legal bases are based on this legal basis if processing is necessary to safeguard a legitimate interest of our company or of a third party, unless the interests, fundamental rights and freedoms of the data subject are overriding. We are allowed such processing operations in particular because they were specifically mentioned by European legislation. In this respect, it took the view that a legitimate interest could be assumed if you are a customer of our company (recital 47 sentence 2 GDPR).

6. Transfer of data to third parties

Your personal data will not be transferred to third parties for purposes other than those listed below.

We only pass your personal data onto third parties if:

You have given your express consent in accordance with Art. 6(1) sentence 1 lit. a GDPR,

disclosure is permissible under Art. 6(1) sentence 1 lit. f GDPR to protect our legitimate interests and there is no reason to assume that you have an overriding interest worthy of protection in not disclosing your data,

in the event that there is a legal obligation for disclosure under Art. 6(1) sentence 1 lit. c of the GDPR, and

this is legally permissible and, according to Art. 6(1) sentence 1 lit. b GDPR, necessary for the processing of contractual relationships with you.

7. Technology

7.1 SSL/TLS encryption

This site uses SSL or TLS encryption to ensure the security of data processing and to protect the transmission of confidential content, such as orders, login data or contact enquiries that you send to us as the operator. You can recognise an encrypted connection by the fact that the address line of the browser contains a "https://" instead of "http://" and by the lock symbol in your browser line.

If SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.

7.2 Data collection when visiting the Internet page

When using our website for informational purposes only, i.e. if you do not register or provide us with information in any other way, we only collect the data that your browser sends to our server (in so-called "server log files"). Our website collects a range of general data and information every time you ,or an automated system, access a page. This general data and information is saved in the server log files. The following can be recorded:

Used browser types and versions,

The operating system used by the accessing system,

The website from which an accessing system reaches our website (so-called referrer),

The sub-websites, which are accessed via an accessing system on our website,

The date and time of access to the Internet site,

A shortened Internet protocol address (anonymised IP address),

the Internet-Service-Provider of the accessing system.

When using this general data and information, we do not draw any conclusions about your person. This information is primarily required to

deliver the contents of our Internet site correctly,

optimise the contents of our Internet site and optimise advertising for it,

to guarantee the permanent functionality of our IT systems and the technology of our website and

to provide law enforcement authorities with the information necessary for prosecution in the event of a cyber attack.

This collected data and information is therefore evaluated by us, on the one hand statistically, and also with the aim of increasing data protection and data security in our company in order to ultimately ensure an optimum level of protection for the personal data processed by us. The anonymous data of the server log files are stored separately from all personal data provided by a data subject.

The legal basis for data processing is Art. 6 (1) sentence 1 lit. f GDPR. Our legitimate interest follows from the data collection purposes listed above.

8. Cookies

8.1 General information on cookies

We use cookies on our Internet site. These are small files that your browser automatically creates and that are stored on your IT system (laptop, tablet, smartphone or similar) when you visit our site. Cookies do not cause any damage to your end device, do not contain viruses, trojans or other malware.

Information is stored in the cookie, which results in each case in connection with the specifically used terminal device. This does not mean, however, that we obtain immediate knowledge of your identity.

Most browsers accept cookies automatically. However, you can configure your browser so that no cookies are stored on your computer or so that a message always appears before a new cookie is created. However, completely deactivating cookies may mean that you will not be able to use all the functions of our website.

8.2 Cookie types

We only use technical cookies (so-called session cookies) which are necessary for the provision of functions which are not used for analysis or evaluation purposes and which are also not subject to the legal requirement to opt-in. It is not possible to draw a conclusion about your identity with session cookies.

9. Contents of our Internet site

9.1 Registration as a user

You have the possibility to register on our website by providing personal data.

Which personal data is transmitted to us in the process is determined by the respective input mask used for registration. The personal data you enter is collected and stored exclusively for internal use by us and for our own purposes. We may arrange for the transfer to one or more processors, such as a parcel service provider, who will also use the personal data solely for an internal use attributable to us.

When you register on our website, the IP address assigned by your internet service provider (ISP), the date and time of registration are also saved. The storage of this data takes place against the background that this is the only way to prevent the misuse of our services and, if necessary, to enable the clarification of criminal offences committed. Insofar the storage of this data is necessary for our protection. As a matter of principle, this data is not passed on to third parties, unless there is a legal obligation to pass it on or the passing on serves criminal prosecution.

Your registration with voluntary provision of personal data also enables us to offer you content or services which, by their very nature, can only be offered to registered users. Registered persons are free to change the personal data provided during registration at any time or to have them completely deleted from our database.

On request, we will inform you at any time about what personal data is stored about you. Furthermore, we will correct or delete personal data at your request, provided that this does not conflict with any statutory retention obligations. A data protection officer named in this data protection declaration and all other employees are available to the data subject as contacts in this matter.

Your data is processed in the interest of convenient and easy use of our website. This constitutes a legitimate interest within the meaning of Article 6 (1) lit. f of the GDPR.

9.2 Data processing when opening a customer account and for contract processing

In accordance with Art. 6 (1) lit. b GDPR, personal data is collected and processed when you provide us with this information for the purpose of executing a contract or opening a customer account. You can see which data is collected in the respective input forms. It is possible to delete your customer account at any time and this can be done by sending a message to the above mentioned address of the controller. We store and use the data provided by you for the processing of the contract. After full implementation of the contract or deletion of your customer account, your data will be blocked with regard to tax and commercial retention periods and deleted after these periods, unless you have expressly consented to further use of your data or a legally permitted further use of data was reserved by us, about which we inform you accordingly below.

9.3 Data processing for order transactions

The personal data collected by us will be passed on to the transport company commissioned with the delivery as part of contract processing, insofar as this is necessary to deliver the goods. We pass on your payment data within the scope of the payment processing to the assigned credit institute, if this is necessary for payment processing. If payment service providers are used, we provide explicit information about this below. The legal basis for the transfer of data is Art. 6 (1) lit. b GDPR.

9.4 Conclusion of contracts in the online shop, with dealers and goods shipment

We only transfer personal data to third parties if this is necessary within the framework of contract processing, for example to the companies entrusted with the delivery of the goods or the credit institution commissioned with the handling of payments. A further transmission of the data does not take place, or only if you have expressly agreed to the transmission. Your data will not be passed on to third parties without your express consent, for example for advertising purposes.

The basis for data processing is Art. 6 (1) lit. b GDPR, which permits the processing of data for the fulfilment of a contract or pre-contractual measures.

9.5 Contact / contact form

Personal data is collected in the context of contacting us (e.g. via contact form or e-mail). Which data is collected in case of a contact form can be seen on the respective contact form. This data is stored and used exclusively for the purpose of answering your request or for contacting you and the associated technical administration. The legal basis for processing the data is our legitimate interest in responding to your enquiry in accordance with Art. 6 (1) lit. f GDPR. If the reason for making contact is the conclusion of a contract, an additional legal basis for processing is Art. 6(1) lit. b of the GDPR Your data will be deleted after the final processing of your enquiry; this is the case if it can be concluded from the circumstances that the matter in question has been conclusively clarified and provided that there are no legal storage obligations to the contrary.

10. Newsletter despatch

10.1 Advertising newsletter

On our website you have the possibility to subscribe to our company newsletter. Which personal data is transmitted to us when ordering the newsletter is determined by the input mask used for this purpose.

We inform our customers and business partners about our offers at regular intervals by means of a newsletter. The company newsletter can generally only be received if

you have a valid e-mail address and

you have registered for newsletter despatch.

For legal reasons, a confirmation e-mail will be sent to the e-mail address you entered for the first time for sending the newsletter using the double opt-in procedure. This confirmation e-mail is used to check whether you, as the owner of the e-mail address, have authorised the receipt of the newsletter.

When you register for the newsletter, we also save the IP address assigned by your internet service provider (ISP) for the IT system you are using at the time of registration as well as the date and time of registration. The collection of this data is necessary in order to be able to trace the (possible) misuse of your e-mail address at a later date and therefore serves as our legal safeguard.

The personal data collected during registration for the newsletter is used exclusively for sending our newsletter. Furthermore, subscribers to the newsletter could be informed by e-mail if this is necessary for the operation of the newsletter service or for registration, as could be the case if there are changes to the newsletter offer or if technical conditions change. The personal data collected within the scope of the newsletter service will not be passed on to third parties. The subscription to our newsletter can be cancelled by you at any time. The consent to the storage of personal data, which you have given us for the newsletter despatch, can be revoked at any time. For the purpose of revoking the consent, a corresponding link can be found in every newsletter. Furthermore, it is also possible at any time to unsubscribe from the newsletter directly on our website or to inform us of this in another way.

The legal basis of data processing for the purpose of newsletter despatch is Art. 6 (1) lit. a GDPR.

11. Web analysis

We do not use any web analysis tools.

12. Plug-ins and other services

12.1 Generation of offers for end customers, price lists, price tags from our published vehicle stock

In our dealer area you have the possibility to create offers for end customers, price lists and price tags without branding for your company without providing additional personal data. The generated documents will be offered to you in PDF format for download.

13. Your rights as a data subject

13.1 Right to confirmation

You have the right to ask us to confirm whether personal data concerning you is being processed.

13.2 Right to information Art. 15 GDPR

You have the right to receive free information from us at any time about the personal data stored about you and receive a copy of this data.

13.3 Right to correction Art. 16 GDPR

You have the right to request that incorrect personal data concerning you be corrected. Furthermore, the data subject shall have the right to obtain the completion of incomplete personal data, having regard to the purposes of processing.

13.4 Deletion Art. 17 GDPR

You have the right to demand that the personal data concerning you be deleted immediately if one of the reasons provided for by law applies and if processing is not necessary.

13.5 Restriction of processing Art. 18 GDPR

You have the right to demand that we restrict processing if one of the legal requirements is met.

13.6 Data portability Art. 20 GDPR

You have the right to receive the personal data concerning you which you have provided to us in a structured, conventional and machine-readable format. You also have the right to transfer this data to another controller without hindrance from us, to whom the personal data has been made available, provided that processing is based on consent pursuant to Art. 6(1) lit. a GDPR or Art. 9(2) lit. a GDPR or on a contract pursuant to Art. 6(1) lit. b GDPR and processing is carried out using automated procedures, unless processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority delegated to us.

Furthermore, when exercising your right to data transfer in accordance with Art. 20(1) GDPR, you have the right to request that personal data be transferred directly from one controller to another, as far as this is technically feasible and provided that this does not affect the rights and freedoms of other persons.

13.7 Objection Art. 21 GDPR

You have the right to object at any time, for reasons arising from your particular situation, to the processing of personal data concerning you on the basis of Article 6(1) lit. e (data processing in the public interest) or f (data processing based on a balancing of interests) of the GDPR.

This also applies to profiling based on these provisions within the meaning of Art. 4 No. 4 of the GDPR.

If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate reasons for processing that outweigh your interests, rights and freedoms, or unless the processing serves to assert, exercise or defend legal claims.

In individual cases we process personal data in order to carry out direct advertising. You may object to the processing of your personal data for the purpose of such advertising at any time. If you object to our processing for direct marketing purposes, we will no longer process the personal data for these purposes.

You also have the right to object, for reasons arising from your particular situation, to the processing of personal data concerning you which is carried out by us for the purposes of scientific or historical research or for statistical purposes in accordance with Art. 89(1) of the GDPR, unless such processing is necessary for the performance of a task carried out in the public interest.

They shall be free to exercise their right of objection in connection with the use of information company services, notwithstanding Directive 2002/58/EC, by means of automated procedures involving technical specifications.

13.8 Revocation of data protection consent

You have the right to revoke your consent to the processing of personal data at any time with effect for the future.

13.9 Complaints with a supervisory authority

You have the right to complain to a supervisory authority responsible for data protection about our processing of personal data.

14. Routine storage, deletion and blocking of personal data

We process and store your personal data only for the period of time required to achieve the purpose of storage or if this is provided for by the legal provisions to which our company is subject.

If the purpose of storage ceases to apply or if a prescribed storage period expires, the personal data is routinely blocked or deleted in accordance with statutory provisions.

15. Duration of personal data storage

The criterion for the duration of storage of personal data is the respective legal retention period. After expiry of this period, the corresponding data is routinely deleted if it is no longer required for the fulfilment or initiation of the contract.

16. Actuality and modification of the privacy policy

The privacy policy is currently valid and the last update was October 2019.

It may become necessary to amend this privacy policy as a result of the further development of our websites and offers or due to changed legal or official requirements. You can call up and print out the current data protection declaration at any time on the website at "https://www.ggh.eu/en/datenschutz.html".