Home » Privacy policy

Privacy policy

DEKRA appreciates your visit to our website www.dekra-congresshotel.com and your interest in our company. We take the protection and security of your personal data entrusted to us seriously and want you to feel safe and comfortable when visiting our website and using our services. It is important to us that you know what personal data is collected when you make use of our offers and services and how we use it afterwards. Insofar as DEKRA processes personal data, this is done for the purposes stated in this privacy policy.

Processing of personal data

Responsible body

DEKRA Automobil GmbH Handwerkstr. 15 70565 Stuttgart

Calling up our website

We collect and store the IP address assigned to your computer in order to transmit the content of our website that you access to your computer (e.g., text, images, and files made available for download, etc.) (see Art. 6(1)(b) of the GDPR). We also process this data to detect and track abuse. In this regard, the legal basis is Article 6, paragraph 1 lit. f GDPR. Our legitimate interest in processing this data is to ensure the proper functioning of our website and the transactions conducted through it.

Consent management solution

We have integrated the consent management tool “consentmanager”(www.consentmanager.net) from consentmanager AB (Håltgelvågen 1b, 72348 Västerås, Sweden, mail@consentmanager.net) on our website in order to obtain consent for data processing or the use of cookies or comparable functions. With the help of “consentmanager” you have the possibility to give or refuse your consent for certain functionalities of our website, e.g. for the purpose of integrating external elements, integrating streaming content, statistical analysis, range measurement and personalized advertising. You can use “consentmanager” to give or refuse your consent for all functions or to give your consent for individual purposes or individual functions. You can also change the settings you have made at a later date. The purpose of integrating “consentmanager” is to allow the users of our website to decide on the aforementioned matters and to offer the possibility of changing settings already made during the further use of our website. In the course of using “consentmanager”, personal data and information about the end devices used (IP address, language, browser, etc.) are processed and sent to consentmanager AB. The information about the settings you have made is also stored on your end device. The legal basis for the processing is Art. 6 para. 1 p. 1 lit. c) GDPR in conjunction with. Art. 7 para. 1 GDPR, insofar as the processing serves to fulfill the legally standardized obligations to provide evidence for the granting of consent. Moreover, Art. 6 para. 1 p. 1 lit. f) GDPR is the relevant legal basis. Our legitimate interests in processing lie in the storage of user settings and preferences in relation to the use of cookies and the evaluation of consent rates. Consent will be requested again no later than twenty-four months after the user settings have been made. The user settings made will then be saved again for this period, unless you delete the information about your user settings yourself beforehand in the terminal device capacities provided for this purpose. You may object to the processing insofar as the processing is based on Art. 6 para. 1 p. 1 lit. f) GDPR is based. You have the right to object on grounds relating to your particular situation. To object, please send an e-mail to mail@consentmanager.net.

Other purposes

Personal data is also processed if you provide it to us voluntarily. In this respect, the data processed by us includes customer data, employee data and data from suppliers, insofar as this is necessary for the purposes stated in this data protection declaration. Insofar as we process your data for the purposes of receiving and processing your respective inquiry, booking or (newsletter) order, as described above, you are contractually obliged to provide us with this data. Without this data, we will not be able to carry out the corresponding processing. If you have consented to the processing of personal data (see Art. 6 para. 1 lit. a GDPR), you can withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

Contact via forms

Personal data is collected when you contact DEKRA (e.g. via contact form or email). On our website, we offer forms for contacting DEKRA, forms for commissioning, forms for bookings, forms for preparing quotations, forms for registering for the DEKRA newsletter and other forms (e.g. for ordering information material). Which data is collected in the case of a contact form can be seen from the respective contact form. This data is stored and used exclusively for the purpose of responding to your request or for contacting you and the associated technical administration. The legal basis for the processing of this data is our legitimate interest in responding to your request in accordance with Art. 6 para. 1 lit. f GDPR. If your contact is aimed at the conclusion of a contract, the additional legal basis for the processing is Art. 6 para. 1 lit. b GDPR. Your data will be deleted after your request has been processed. Processing is completed as soon as the matter in question has been conclusively clarified and if there are no statutory retention obligations to the contrary.

Disclosure to third parties

As a rule, your details will be forwarded to the relevant DEKRA company for the purpose of processing and will be further processed there depending on the service you have requested. We do not sell your data to third parties, nor do we market it in any other way. By integrating external content (YouTube, Vimeo, Google, Facebook Pixel), data such as IP address, browser and JavaScript content can be forwarded to the aforementioned third-party providers when a page is loaded. If you do not want a third-party provider to receive data about you, you do not consent to the processing of marketing and social media cookies. As a result, you will unfortunately not be able to use these functions on our website. In addition, your personal data will be forwarded to the law enforcement authorities and, if necessary, to injured third parties without your express consent if this is necessary to clarify any unlawful use of our services or for legal prosecution. However, this only happens if there are concrete indications of unlawful or abusive behavior. Disclosure may also take place if this serves to enforce terms of use or other agreements. We are also legally obliged to provide information to certain public authorities on request. These are law enforcement authorities, authorities that prosecute administrative offenses subject to fines and the tax authorities. This data is disclosed based on our legitimate interest in combating abuse, prosecuting criminal offenses, and safeguarding, asserting, and enforcing claims, provided that your rights and interests in the protection of your personal data do not take precedence, Art. 6( 1 lit. f GDPR.

Security

DEKRA uses technical and organizational security measures to protect the data you provide to DEKRA against accidental or intentional manipulation, loss, destruction or access by unauthorized persons. This also applies when external services are used. The effectiveness of our security measures is reviewed and the measures are continuously improved in line with technological developments. When personal data is entered, it is always transmitted in highly encrypted form.

Cookies

We use cookies in some areas to make our website user-friendly for you and to tailor it to your needs. A cookie is a small file that is stored locally on your computer as soon as you visit a website. Cookies also enable us to analyze the use of our website. You can decide for yourself which cookies you allow or reject. You can change your decision at any time.

Use of SalesViewer® technology

This website uses SalesViewer® technology from SalesViewer® GmbH to collect and store data for marketing, market research and optimization purposes on the basis of the website operator’s legitimate interests (Art. 6 (1) (f) GDPR). For this purpose, a javascript-based code is used to collect and use company-related data. The data collected with this technology is encrypted using a non-reversible one-way function (known as hashing). The data is immediately pseudonymized and not used to personally identify the visitor to this website. The data stored within the framework of SalesViewer® will be deleted as soon as it is no longer required for its intended purpose and the deletion does not conflict with any statutory retention obligations. You can object to the collection and storage of data at any time with effect for the future by clicking on this link https://www.salesviewer.com/opt-out to prevent the collection by SalesViewer® within this website in the future. An opt-out cookie for this website is stored on your device. If you delete your cookies in this browser, you must click on this link again.

Web analysis with Matomo

This website uses Matomo (www.matomo.org), a service provided by InnoCraft Ltd, 150 Willis St, 6011 Wellington, New Zealand, for web analysis. Matomo uses “cookies”, which are text files placed on your computer, to help the website analyze how users use the site. For this purpose, the usage information collected in the cookie (including your shortened IP address) is transmitted to our server and stored for usage analysis purposes. With Matomo, no data is transmitted to servers that are outside our control. You may refuse the use of cookies by selecting the appropriate settings on your browser, however please note that if you do this you may not be able to use the full functionality of this website. The legal basis for data processing using Matomo is Art. 6 para. 1 lit. f GDPR. The data is further processed to analyze user behavior and to evaluate the use of individual components of the website. The aim is to continuously optimize the website and its user-friendliness. These purposes constitute the legitimate interest pursuant to Art. 6 para. 1 lit. f GDPR is justified. By anonymizing the IP address, the user’s interest in the protection of personal data is taken into account. The data is never used to personally identify the user of the website and is not merged with other data. The data will be deleted when it is no longer required for our purposes.

Possibility of objection

If you do not agree to the storage and analysis of this data from your visit in the manner described above, you can object to this. By clicking below, you can create a so-called opt-out cookie that is valid for two years. Please note that you must repeat the opt-out procedure if you delete your cookies, delete the opt-out cookie or if you change your computer or web browser.

Web analysis with Google Analytics

If you have given your consent, Google Analytics, a web analysis service of Google LLC, is used on this website. The controller for users in the EU/EEA and Switzerland is Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”).

Scope of processing

Google Analytics uses cookies to help the website analyze how users use the site. The information collected by the cookies about your use of this website is usually transferred to a Google server in the USA and stored there. We use the technical extension “Google Signals”, which enables cross-device tracking. This allows an individual website visitor to be associated with different end devices. However, this only happens if the visitor has logged into a Google service when visiting the website and has also activated the “personalized advertising” option in their Google account settings. The anonymization of IP addresses is activated. Due to IP anonymization, your IP address will be shortened by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and truncated there. According to Google, the IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data.

Purposes and legal basis of processing

On behalf of the operator of this website, Google will use this information to evaluate your use of the website and to compile reports on website activity. The reports provided by Google Analytics are used to analyze the performance of our website and the success of our marketing campaigns. The legal basis for this data processing is your consent pursuant to Art.6 Para.1 S.1 lit. a GDPR.

Storage duration

The data sent by us and linked to cookies is automatically deleted after 14 months. Data that has reached the end of its retention period is automatically deleted once a month.

Receiver

Recipients of the data are/may be

Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (as processor pursuant to Art. 28 GDPR)
Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA
Alphabet Inc., 1600 Amphitheatre Parkway Mountain View, CA 94043, USA

It cannot be ruled out that US authorities will access the data stored by Google.

Third country transfer

The parent company of Google Ireland, Google LLC, is based in California, USA. A transfer of data to the USA and access by US authorities to the data stored by Google cannot be ruled out. With the European Commission’s adequacy decision of July 10, 2023, the USA is considered a safe third country under data protection law. To ensure an appropriate level of data protection, we have also concluded EU standard contractual clauses with the service provider.

Revocation

You can withdraw your consent at any time with effect for the future by accessing the data protection settings and changing your selection there. The legality of the processing carried out on the basis of the consent until the revocation remains unaffected. You can also prevent the storage of cookies from the outset by setting your browser software accordingly. However, if you configure your browser to reject all cookies, this may limit the functionality of this and other websites. You can also prevent Google from collecting the data generated by the cookie and relating to your use of the website (including your IP address) and from processing this data by Google by selecting

do not give your consent to the setting of the cookie or
download and install the browser add-on to deactivate Google Analytics HERE .

You can find more information on the terms of use of Google Analytics and on data protection at Google at https://marketingplatform.google.com/about/analytics/terms/de/ and at https://policies.google.com/?hl=de.

Google Ads conversion and remarketing

If you have given your consent, conversion measurement and remarketing using Google Ads will be used on this website. The controller for users in the EU/EEA and Switzerland is Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”).

Scope of processing

Google Ads enables us to display advertisements in the Google search engine or on third-party websites when the user enters certain search terms on Google. Furthermore, targeted advertisements can be displayed based on the user data available at Google (e.g. location data and interests) (target group targeting). Google Remarketing analyzes your user behavior on our website in order to classify you into certain advertising target groups and then to display suitable advertising messages to you when you visit other online offers (remarketing or retargeting). Furthermore, the advertising target groups created with Google Remarketing can be linked to Google’s cross-device functions. For this purpose, Google stores cookies on users’ end devices. These cookies are used to record the visits of these users. If you are registered with a Google service, Google can assign the visit to your account. Even if you are not registered with Google or have not logged in, there is a possibility that the provider will find out your IP address and store it.

Purposes and legal basis of processing

We use Google Ads to promote our services through advertisements on external websites and to measure the effectiveness of individual advertising campaigns. The legal basis for this data processing is your consent pursuant to Art.6 Para.1 S.1 lit. a GDPR.

Storage duration

In most cases, conversion cookies expire after 30 days. Cookies in connection with Google Analytics and Google Ads have an expiration date of 3 months.

Receiver

Recipients of the data are/may be

Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (as processor pursuant to Art. 28 GDPR)
Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA
Alphabet Inc., 1600 Amphitheatre Parkway Mountain View, CA 94043, USA

It cannot be ruled out that US authorities will access the data stored by Google.

Third country transfer

Revocation

do not give your consent to the setting of the cookie or
by installing the plug-in provided by Google under the following link: https://www.google.com/settings/ads/plugin
by deactivating the interest-based ads of providers that are part of the “About Ads” self-regulation campaign via the link https://optout.aboutads.info/?c=2&lang=EN

You can find more information about Google Conversion Tracking in Google’s privacy policy: https://policies.google.com/privacy?hl=de

Meta Tracking Pixel

If you have given your consent, a tracking pixel from Meta (Meta Platforms Ltd., 4 Grand Canal Square, Dublin 2, Ireland) is used on this website.

Scope of processing

The pixel reports to Meta which actions you have performed on our website and possibly identifying data (including information on the app/browser, language setting, time, IP address, advertising ID). With the data, Meta can recognize that you have visited our website, what you have clicked on and if you have clicked on a link on Facebook or Instagram that connects you to our website. The data collected is anonymous for us as the operator of this website; we cannot draw any conclusions about the identity of the user. However, the data is stored and processed by Meta, which allows it to link the data to the respective user profile and use it for its own advertising purposes, in accordance with its Data Use Policy. This enables Meta to place advertisements on sites such as Facebook and Instagram. This use of the data cannot be influenced by us as the website operator.

Purposes and legal basis of processing

We do not receive any data about you or other Meta users, but only statistics that show us in aggregated form for all users in a certain period of time how they have used our offers and ads on other Meta platforms (Facebook, Instagram). This allows the effectiveness of the advertisements to be evaluated for statistical and market research purposes and future advertising measures to be optimized. When transferring the data collected by the pixel, we act with Meta Platforms Ireland as so-called “joint controllers” in accordance with Art. 26 GDPR. We have concluded a separate agreement for this purpose (see here: https://www.facebook.com/legal/controller_addendum). Meta is solely responsible for further processing. If you exercise your rights of access, erasure, etc., Meta Platforms Ireland is responsible for the implementation of your rights within the framework of joint responsibility. The legal basis for this data processing is your consent pursuant to Art.6 Para.1 S.1 lit. a GDPR.

Storage duration:

The data will be deleted by DEKRA when it is no longer required for our purposes. According to Meta, the information sent to Meta by the Meta Pixel is currently stored for 180 days and then encrypted and anonymized. DEKRA has no influence on this procedure.

Third country transfer

Meta is based in California, USA. The transfer of data to the USA and access by US authorities to the data stored by Meta cannot be ruled out. With the European Commission’s adequacy decision of July 10, 2023, the USA is considered a safe third country under data protection law. In order to establish an appropriate level of data protection, data transfer to the USA is also based on standard contractual clauses of the EU Commission. You can find details here: https://www.facebook.com/legal/terms/dataprocessing

Revocation

You can withdraw your consent at any time with effect for the future by accessing the data protection settings and changing your selection there. The legality of the processing carried out on the basis of the consent until the revocation remains unaffected. You can also prevent the storage of cookies from the outset by setting your browser software accordingly. However, if you configure your browser to reject all cookies, this may limit the functionality of this and other websites. You can find more information about Meta Pixel in Meta’s privacy policy: https://www.facebook.com/privacy/center/

LinkedIn (Insight tag) If you have given your consent, a tracking tag from LinkedIn (LinkedIn Ireland, Wilton Plaza, Wilton Place, Dublin 2, Ireland) is used on this website.

Scope and purpose of processing

With the help of the LinkedIn Insight Tag, we receive information about visitors to our website. If a website visitor is registered with LinkedIn, we can, among other things, analyze the key professional data (e.g. career level, company size, country, location, industry and job title) of our website visitors and thus better tailor our site to the respective target groups. We can also use LinkedIn Insight Tags to measure whether visitors to our websites make a purchase or take another action (conversion measurement). Conversion measurement can also be carried out across devices (e.g. from PC to tablet). LinkedIn Insight Tag also offers a retargeting function that we can use to display targeted advertising to visitors to our website outside the website, whereby, according to LinkedIn, no identification of the advertising addressee takes place. LinkedIn itself also collects log files (URL, referrer URL, IP address, device and browser properties and time of access). The IP addresses are shortened or (if they are used to reach LinkedIn members across devices) hashed (pseudonymized). The legal basis for this data processing is your consent pursuant to Art.6 Para.1 S.1 lit. a GDPR.

Storage duration

The direct identifiers of LinkedIn members are deleted by LinkedIn after seven days. The remaining pseudonymized data will then be deleted within 180 days.

Third country transfer

The operator of LinkedIn, Microsoft, is based in Washington, USA. The transfer of data to the USA and access by US authorities to the data stored by Meta cannot be ruled out. With the European Commission’s adequacy decision of July 10, 2023, the USA is considered a safe third country under data protection law. In order to establish an appropriate level of data protection, data transfer to the USA is also based on standard contractual clauses of the EU Commission. Details can be found here: https://www.linkedin.com/legal/l/dpa and https://www.linkedin.com/legal/l/eu-sccs You can revoke your consent at any time with effect for the future by accessing the data protection settings and changing your selection there. The legality of the processing carried out on the basis of the consent until the revocation remains unaffected. You can also object to the analysis of usage behavior and targeted advertising by LinkedIn at the following link: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out. Furthermore, LinkedIn members can control the use of their personal data for advertising purposes in the account settings.

Microsoft Clarity

If you have given your consent, Microsoft Clarity will set a tracking tag. The controller for users in the EU/EEA and Switzerland is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland.

Scope and purpose of processing

Microsoft Clarity uses cookies and similar technologies to analyze how you use our website. This includes the collection of information about user behavior and their end devices, such as IP addresses (anonymized), screen sizes, device types, browser information, locations (country only), preferred languages and mouse events (movement, position, clicks). Texts that you enter are not recorded by us. This data helps us to create heatmaps and visitor recordings that show scrolls, cursor movements and clicks/taps in order to visualize website usage patterns and improve the design and functionality of our website. The legal basis for this data processing is your consent pursuant to Art.6 Para.1 S.1 lit. a GDPR.

Storage duration

The recording data is stored for 30 days. Labelled or favorite recordings are stored for 13 months. Heatmaps data is stored for 13 months.

Third country transfer

Microsoft Corporation, the operator of Microsoft Clarity, is headquartered in Washington, USA. Data transfer to the USA and access by US authorities to the data stored by Microsoft cannot be ruled out. The European Commission’s adequacy decision of July 10, 2023 classifies the USA as a safe third country under data protection law. Data is also transferred to the USA on the basis of the EU Commission’s standard contractual clauses. Details can be found here.

Revocation

You can revoke your consent at any time with effect for the future by changing the data protection settings. The lawfulness of the processing carried out on the basis of the consent until revocation remains unaffected by this. You can also prevent the storage of cookies by changing your browser settings. Blocking all cookies can lead to functional restrictions on this and other websites. Further information can be found in the Microsoft Clarity terms of use and in Microsoft’s privacy policy.

Integration of social network plug-ins

Our website uses buttons for the social networks:

Facebook

Facebook Inc. 1601 S. California Ave Palo Alto CA 94304, USA

Instagram

Meta Platforms Ireland Limited 1601 S. Colifornia Ave Palo Alto CA 94304, USA

LinkedIn Corporation 2029 Stierlin Court Mountain View CA 94043, USA

Twitter

Twitter Inc. 1355 Market St, Suite 900 San Francisco CA 94103, USA

XING

XING AG Gänsemarkt 43 20354 Hamburg Germany

YouTube

YouTube, LLC 901 Cherry Ave. San Bruno CA 94066, USA The buttons are marked with the logo of the respective social network. However, these are not the usual social plugins, but buttons with links. The buttons must be activated (clicked) separately by you. As long as these buttons are not clicked, no data is transmitted to the social networks. Only when you click on the buttons and thereby declare your consent to communication with the servers of the social network will the buttons become active and the connection be established. Once clicked, the button corresponds to a so-called share plugin. The social network is provided with information about the page you have visited, which you can share with your contacts in your social network. If you want to “share” the information, you must be logged in. If you are not logged in, you will land on the login page of the social network you clicked on and you will no longer be on the DEKRA website. If you are logged in, the information that you would like to recommend the respective article will be transmitted. By activating the button, the social network then receives, among other things, the information that and when you have accessed the corresponding page of our website, as well as, for example, your IP address, information on the browser used and the language settings. If you click on the button, your click will be transmitted to the social network and used in accordance with its data usage guidelines. When the button is activated, we have no influence on the data collected and data processing operations and are not responsible for this data processing and in this respect are not the controller within the meaning of the GDPR. We are also not aware of the full extent of the data collection, its legal basis, the purposes and the storage periods. Therefore, the information provided here is not necessarily complete. The data is transmitted regardless of whether you actually have an account with the provider or are logged in there. If you are logged in with the provider, your data will be assigned directly to your account. The providers may also use cookies on your computer to track you. To our knowledge, the provider stores this data in user profiles, which it uses for the purposes of advertising, market research and/or the needs-based design of its website. Such an evaluation is carried out in particular (even for users who are not logged in) to display needs-based advertising and to inform other users of the social network about your activities on our website. You have the right to object to the creation of these user profiles. To exercise this right of objection, please contact the respective provider. The purpose and scope of the data collection and the further processing and use of the data by the respective social network as well as your rights in this regard and setting options to protect your privacy can be found in the information:

If you do not want the social network to receive data about you, you must not click on the button.

Deletion of data

Standard deadlines for the deletion of data

The legislator has issued various retention periods and obligations. After these periods have expired, the corresponding data is routinely deleted. If data is not affected by this, it will be deleted or anonymized if the purposes stated in this privacy policy no longer apply. Unless this privacy policy contains other, deviating provisions regarding the storage of data, the data collected by us will be stored by us for as long as it is required for the aforementioned purposes for which it was collected.

Other data uses and data deletion

Further processing or use of your personal data will generally only take place if this is permitted by law or if you have consented to the data processing or use. In the event of further processing for purposes other than those for which the data was originally collected, we will inform you of these other purposes prior to further processing and provide you with further relevant information.

Data Processing in Connection with Your Stay

Scope and purpose of processing

As part of your hotel stay, we process your personal data for the purpose of properly fulfilling the contract. This includes, in particular, the processing of your personal data to provide the contractually agreed hotel accommodations and services (including billing etc.), to be able to provide booked activities, events, etc., and to make their stay as pleasant and hassle-free as possible (welcome email, special requests, etc.), as well as to improve our quality (post-processing quality checks, etc.). We receive the data required for this purpose from you or a third party (e.g., an employer, event organizer, etc.) and process it only for the specified purpose. We treat all information with the discretion customary in the luxury hospitality industry.

Legal Basis for Processing

We process the data based on the underlying hospitality agreement with you or the third-party organizer, as well as our legitimate interest in making your stay a hassle-free and special experience. The legal basis is therefore the performance of the contract pursuant to Art. 6(1)(b) of the GDPR, the aforementioned legitimate interest pursuant to Art. 6(1)(f) of the GDPR and, in certain cases, their consent pursuant to Art. 6(1)(a) of the GDPR.

Receiver

Your data will only be shared in certain cases. If a third party makes the reservation, the information necessary to organize the stay will be shared. When booking events, etc., the necessary information is forwarded to the respective organizer. Otherwise, no data is shared.

Storage duration

Your data will be stored only as long as it is needed. These periods are 6 and 10 years, respectively, for billing data, etc. Otherwise, 3 full calendar years. There will be no transfer to a third country. If your data is processed based on your consent, you may withdraw that consent at any time, effective for the future.

Rights regarding the processing of personal data

Right to information

You have the right to receive information from us at any time upon request about the personal data processed by us concerning you within the scope of Art. 15 GDPR.

Right to rectification of inaccurate data

You have the right to obtain from us without undue delay the rectification of inaccurate personal data concerning you (Art. 16 GDPR). To do so, please use the contact addresses below.

Right to erasure

You have the right to immediate erasure (“right to be forgotten”) of personal data concerning you if the legal grounds pursuant to Art. 17 GDPR apply. These exist, for example, if the personal data are no longer necessary for the purposes for which they were originally processed or if you have withdrawn your consent and if there is no other legal basis for the processing; the data subject objects to the processing (and there are no overriding reasons for processing – this does not apply to objections to direct marketing). To exercise your above right, please contact us at the addresses below.

Right to restriction of processing

You have a right to restriction of processing if the conditions are met and in accordance with Art. 18 GDPR. According to this, the restriction of processing may be required in particular if the processing is unlawful and the data subject refuses to delete the personal data and instead requests the restriction of the use of the personal data or the data subject has objected to the processing pursuant to Art. 21 para. 1 GDPR, as long as it is not yet clear whether our legitimate reasons outweigh theirs. To assert your aforementioned right, please contact us at the addresses given below.

Right to data portability

You have a right to data portability in accordance with Art. 20 GDPR. You have the right to receive the data concerning you, which you have provided to us, in a commonly used, structured and machine-readable format and to transmit those data to another controller, such as another service provider. The prerequisite for this is that the processing is based on consent or on a contract and is carried out using automated procedures. To exercise the above right, please contact us at the addresses given below.

Right of objection

You have the right, for reasons arising from your particular situation, to object at any time to the processing of personal data concerning you that is based, among other things, on Article 6(1) 1 lit. under Article 5(e) or (f) of the GDPR, to object pursuant to Article 21 of the GDPR. We will cease processing your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defense of legal claims. To exercise the right described above, please contact us at the addresses listed below. There are no costs associated with exercising the right to object other than the transmission costs charged at the base rate. DEKRA data protection portal

Right to lodge a complaint with a supervisory authority

If you believe that the processing of personal data concerning you by us is unlawful, you have the right to lodge a complaint with the supervisory authority responsible for us, which you can contact as follows: The State Commissioner for Data Protection and Freedom of Information House address: 35 Heilbronner Street 70191 Stuttgart Postal address: P.O. Box 10 29 32 70025 Stuttgart Phone: 0711/6115541-0 E-Mail: poststelle@lfdi.bwl.de

Changes to this privacy policy

We reserve the right to make additions or changes to this Privacy Policy. This statement is current as of January 1. 06. 2026.

Data protection officer

If you have any questions or suggestions regarding data protection at DEKRA, you can contact the data protection officer responsible for you directly.

DEKRA Automobil GmbH

DEKRA Automobil GmbH Handwerkstraße 15 70565 Stuttgart E-Mail: datenschutz.automobil@dekra.com Data protection information