Privacy notice

2. Website delivery and security

The website is hosted on a server operated by Hetzner Online GmbH and is delivered and protected by a Caddy web-server layer. When the site is accessed, the connection and security data required for this purpose is processed, particularly the IP address, time and requested resource. The legal basis is Article 6(1)(f) GDPR; the legitimate interest is secure and reliable operation. For form requests, only the locally connected web-server layer passes the source address to the website application. The application combines it with a separate secret HMAC key to create a non-reversible pseudonymous key. Only that key, the attempt count and the end of the active ten-minute window are held in a local SQLite security database. Once the window ends, the entry is no longer valid for limiting and is removed in bounded cleanup runs. The source address and form content are not stored in this security database, and the source address is not sent to KDM's enquiry queue.

3. Contact, appointment and roadside-assistance forms

We process the contact, vehicle, tyre, location, appointment and message data you enter solely to assess and respond to your enquiry. Article 6(1)(b) GDPR applies to contract-related and pre-contract enquiries; Article 6(1)(f) GDPR applies to other enquiries and technical protection. The legitimate interests are responding to genuine enquiries and preventing misuse. The required checkbox records only that you have read this notice; consent is not used as the legal basis. Automatic location detection is used only after you click the control and grant permission in the browser. The website takes the coordinates supplied by the device and locally creates one cross-platform Google Maps link; it does not contact Google when creating the link or sending the enquiry. Manually pasted Google Maps or Apple Maps links are transmitted as part of the enquiry. Whether the device uses its own system services to determine location depends on the operating-system and browser settings. A connection to the relevant map service is made only when a map link is later opened.

Depending on the enquiry, the following data may be processed:

• Name, telephone number, email address, subject and message
• Vehicle class, commercial vehicle unit where applicable, make, model, registration number and tyre size
• For roadside help: exact location, including coordinates or a submitted map link, wheel position and whether the vehicle is movable
• For appointments: preferred and alternative date and time range
• Language, submission time, version of the privacy notice read and a technically generated reference identifier
• Review decision, the selected rejection reason, any additional explanation entered and the status of the customer notification

Whether the data is required

There is no statutory obligation to use the forms. Fields marked as required are nevertheless needed so that KDM can classify and answer the selected enquiry. Without them, the enquiry cannot be handled through the form; telephone, email and WhatsApp remain available as alternative contact channels.

4. Recipients and storage route

Transmission from the browser to the website is protected by TLS. After successful validation, the website application sends the form data with a server-side signature over an exclusively local connection to KDM's independent enquiry service on the same Hetzner-hosted server. It is stored there in an encrypted database that is separate from the chatbot. The reviewer appointed by KDM initially receives only a content-free email notification that a new enquiry is waiting. The approved form data is forwarded through KDM's Gmail account to the business email address only after the reviewer's manual approval. Rejected enquiries are not forwarded there; where the customer supplied an email address, KDM's Gmail account sends a notice in the language of the enquiry containing the selected rejection reason and any additional explanation entered. In addition, an encrypted backup file is stored in Google Drive storage used solely for this purpose. Google receives the data required for email delivery and backup storage; the backup file is encrypted before transmission. Other providers receive data only where necessary for hosting, security or handling and where legally permitted. Whether and on what basis individual subprocessors process data outside the EEA depends on the provider and contract configuration actually used; information about the safeguards applicable to the specific processing can be requested through the contact address above.

5. Retention

Connection and security data is retained only for as long as necessary to deliver the service, prevent misuse, investigate faults and meet legal obligations; the configured or contractually defined periods of the providers used are decisive. Enquiries awaiting review and entries with an unresolved email status are stored in encrypted form. Regardless of processing status, they become due for deletion on reaching the 14-day threshold and are removed by the next monitored hourly purge; a bounded email handoff already in progress is allowed to finish first. Rejected entries without a customer email address are deleted one day after the decision. Where a rejection notice is sent by email, the entry is deleted one day after the notice has been successfully handed to the email service or an initially uncertain sending status has been manually resolved. Approved entries are deleted one day after successful handoff to the email service for the business address. Content-free security, review and replay records are kept for no more than seven days. During normal backup retention, a deleted enquiry may remain in an encrypted backup for approximately 14 additional days. The copy is removed by the next successful monitored backup-and-prune run after its cutoff; a missed run extends the actual period and triggers an operational alert. If an approved enquiry results in an order or another business record subject to statutory retention, the relevant statutory periods apply to records kept outside this system.

6. Google Maps and WhatsApp

Google Maps is not embedded, and WhatsApp content is not loaded automatically. The external service opens only after a deliberate click. The provider then receives at least your IP address and technical connection data, may process data outside the EEA and applies its own privacy rules. The Google Maps link contains only the business name and address; the WhatsApp link contains no prewritten personal details. This website sends no data to Google Maps or WhatsApp before the click.

7. Cookies, analytics and automated decisions

No analytics, advertising or profiling services and no non-essential cookies are configured on this website. There is no decision based solely on automated processing that has legal or similarly significant effects.

8. Your data-protection rights

• Access to personal data (Article 15 GDPR)
• Correction of inaccurate data (Article 16 GDPR)
• Erasure or restriction of processing (Articles 17 and 18 GDPR)
• Data portability where applicable (Article 20 GDPR)
• Objection to processing based on legitimate interests (Article 21 GDPR)

9. Right to complain

You may complain to a data-protection supervisory authority. For Baden-Württemberg: The State Commissioner for Data Protection and Freedom of Information Baden-Württemberg, Heilbronner Straße 35, 70191 Stuttgart, Germany.