General Information

1. Controller

Engel & Engel GmbH
Hauptstraße 90
76865 Rohrbach b. Landau
Phone: +49 6349 963287
E-mail: info@engel-und-engel.de

2. General Notes

We process personal data in accordance with the GDPR and the German Federal Data Protection Act (BDSG). Data is only processed if there is a legal basis for doing so or if you have given your consent.

3. Hosting

Our website is hosted by IONOS SE. IONOS automatically stores server log files (e.g. IP address, browser type, time of access).

Legal basis: Art. 6 para. 1 lit. f GDPR.

We have concluded a data processing agreement (DPA) with IONOS pursuant to Art. 28 GDPR.

4. Cookies & Consent Management (CCM19)

We use the cookie consent tool CCM19, which manages consents for cookies and external services.

Legal basis:

• Art. 6 para. 1 lit. c GDPR (legal obligation)
• Art. 6 para. 1 lit. a GDPR (consent)

5. Server Log Files

When you access the website, the following data is automatically collected, for example:

• IP address
• Browser type
• Operating system
• Referrer URL
• Date/time

Legal basis: Art. 6 para. 1 lit. f GDPR.

6. Forms & Communication

6.1 Forms for vehicle enquiries, newsletter & vehicle purchase (incl. upload)

Data processed:

• Contact details
• Vehicle data
• Files uploaded in the vehicle purchase form

All forms send the data to info@engel-und-engel.de.

Legal basis: Art. 6 para. 1 lit. b GDPR.

6.2 Upload function

Uploaded files are processed exclusively within our own technical infrastructure.

Legal basis: Art. 6 para. 1 lit. b GDPR.

7. Newsletter (MailerLite)

The newsletter is sent via MailerLite (Ireland).

Data:

• E-mail address
• optional name
• evaluation data (opens & clicks)

We use a double opt-in procedure. You can withdraw your consent at any time.

Legal basis: Art. 6 para. 1 lit. a GDPR.

8. Google Services

8.1 Google Analytics 4

Data collected:

• Interactions
• technically pseudonymised IP addresses
• device and browser data

Activated only after consent.

Legal basis: Art. 6 para. 1 lit. a GDPR.

8.2 Google Tag Manager

Controls other tracking scripts. Does not itself process personal data.

Legal basis: Art. 6 para. 1 lit. a GDPR.

8.3 Google Search Console

Does not process personal data. Used for website optimisation.

8.4 Google reCAPTCHA v3

To protect against bots. Data processed includes, among other things:

• IP address
• technical interaction data

Activated only after consent.

Legal basis: Art. 6 para. 1 lit. a GDPR.

8.5 Google Maps

Interactive map display, loaded after consent.

Legal basis: Art. 6 para. 1 lit. a GDPR.

8.6 Google Fonts

Fonts are loaded from Google servers. This involves transmission of your IP address.

Legal basis: Art. 6 para. 1 lit. a GDPR.

9. Instagram

When Instagram content is loaded, data is transmitted to Meta Platforms Ireland Ltd.

Activation only takes place after consent.

Legal basis: Art. 6 para. 1 lit. a GDPR.

10. WhatsApp

We provide a direct link to open a WhatsApp chat. By clicking this link you leave our website and data is transmitted to WhatsApp.

Legal basis: Art. 6 para. 1 lit. b GDPR.

11. Disclosure of Data

Data is only disclosed in the following cases:

• there is a legal basis,
• for contract fulfilment,
• with your consent,
• involvement of processors.

12. Storage Period

Data is deleted as soon as the purpose ceases to apply or statutory retention periods have expired.

13. Your Rights

You have the following rights: the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR).

You also have the right to lodge a complaint with a supervisory authority.

If your personal data is processed on the basis of Art. 6 para. 1 lit. f GDPR, you have the right to object to such processing on grounds relating to your particular situation, or if the objection is directed against direct marketing (Art. 21 GDPR). If you object to direct marketing, the controller will no longer send you marketing communications.

You may withdraw consent given to the controller at any time with effect for the future. This does not affect the lawfulness of processing based on consent before its withdrawal. For your notification, please use the contact address of the controller provided in the imprint.

14. Data Protection Officer

We are not obliged to appoint a data protection officer.

15. Changes to this Privacy Policy

We reserve the right to adapt this statement in line with legal or technical changes.

```