1.1 AutoScout24 Germany

This privacy notice describes how AutoScout24 Germany, as a data controller within the meaning of applicable data protection law, processes your personal data when you access an AutoScout24-Group website, app, or social media channel and, in doing so, your behavior on one of these websites is evaluated for statistical or online marketing purposes or used to tailor the website to your needs.

1.2 National companies of the AutoScout24-Group

In addition, the respective national companies of the AutoScout24-Group in individual European countries are each independent controller within the meaning of the applicable data protection law if you

• subscribe to the newsletter of a national company of the AutoScout24-Group;
• contact the customer support of a national company of the AutoScout24-Group;
• in particular, create and manage your customer data and generally your account with a national company of the AutoScout24-Group;
• participate in events hosted by a national company of the AutoScout24-Group;
• visit or use their websites, apps or social media channels, provided that this does not involve the evaluation of your behavior in connection with the visit or use.

(hereinafter: our "Services").

The controllership in between the respective national companies of the AutoSout24-Group is divided as follows:

Explanations:

• When you select the AutoScout24 website for Belgium, the term "AutoScout24" refers to AutoScout24 Belgium mentioned above in the table for Belgium. This means that for some of the processing described in this Privacy Notice, AutoScout24 Belgium is the data controller and for other processing, this is AutoScout24 Germany (see Section 1.1).
• If you select the AutoScout24 website for Germany, it follows from the above table and the explanations in section 1.1 that AutoScout24 Germany is always the data controller.
• If you use a country-specific AutoScout24 website that is not listed in the above table, AutoScout24 Germany is always the sole data controller.

1.3 If you have a business relationship with us as a commercial customer, partner, supplier or contractor, as well as for applicants or employees, special data protection information will apply that be provided to you as part of your contract documents.

1.4 If you use the Auto-Subscription service, AutoScout24 Germany processes your personal data as a joint controller with Autoscout24 Subscription GmbH, Bothestraße 11-15, 81675 Munich, Germany ("AS24 Subscription"), Casi AS,Nøstegaten 58, 5011 Bergen, Norwegen (“Casi”) and the car providers listed within the service. For more information on joint controllership, please see Section 10.

1.5 If you order or have ordered a vehicle through smyle, smyle is an independent controller in regard to the processing your data that is necessary for the execution of your order and the provision of the requested services. However, as a subsidiary of AutoScout24 Germany, smyle is supported, for example, in implementing data subject rights and responding to customer inquiries; to this extent, AutoScout24 Germany and smyle process your personal data in part as joint controllers. For more information on the data processing activities of smyle, please refer to Section 11.

In principle, you can visit our website without registering and actively providing us with personal data. In this case, AutoScout24 only collects data to a limited extent about the end device you are using and your usage behavior on our services.

This includes the following data when you call up a website:

2.1 Registration with AutoScout24

If you decide to actively trade on our marketplace, registration is required, during which we collect the following data from you:

As a provider: Email address and password, first name, last name, street and house number, postal code and city, area code and telephone number.

As a commercial provider: Title, first and last name, address, email address and telephone number, company name, VAT number, user name, mobile phone number (optional) and fax (optional). As well as contact person for contractual questions, different billing address, different business address, if entered.

As a customer: email address and password, title, last name, first name, postal code, current vehicle ownership, customer type (private/commercial).

2.1.1 Facebook Login

For registration with AutoScout24 we also offer the option of using the Single Sign On procedure of Meta Platforms Ireland Limited (4 Grand Canal Square, Grand Canal Habour, Dublin D02X525, Ireland, "Facebook"). If you decide to use the single sign-on procedure, you will be redirected to the Facebook website for registration, where you can log in with your account data (email address and password). After your registration, your Facebook profile and your user account with AutoScout24 will be linked if you confirm this accordingly after logging in. By linking, AutoScout24 processes your email address.

We process the aforementioned data in order to provide you with the option of Facebook login (single sign on procedure). This processing is carried out based on legal regulations that allow us to process personal data insofar as it is necessary for the use of a service or the performance of a contract (Art. 6 Para. 1 b) GDPR), or because AutoScout24 has an overriding legitimate interest in making the use of the platform as easy and efficient as possible (Art. 6 Para. 1 f) GDPR). Our legitimate interest is to simplify the registration of your account, if requested.

For more information on the login and privacy settings, please refer to the privacy policy and the terms of use of Facebook.

Legal basis: Performance of a contract and execution of steps necessary prior entering into a contract (Art. 6 Para. 1 b) GDPR); legitimate interest (Art. 6 Para. 1 f) GDPR).

2.2 Data you enter on AutoScout24

Depending on the capacity in which you use which function of the platform, we collect further data that you enter in our platform. You are not obligated to provide the respective data. However, without the requested information you may not be able to use a specific function. We inform you about data that we collect in connection with your use of the platform here.

As a user of the vehicle search function: Information about the type of vehicle you are looking for (make, model, price, first registration, mileage, performance, vehicle condition and comparable data).

As a user of the Sell / advertise function: Information about the type of vehicle offered (vehicle type, make, model, price, first registration, mileage, performance, vehicle condition, vehicle identification number (VIN), photos and comparable data) and about the advertisement (running time).

As a user of the express sale function: information about the type of vehicle offered (vehicle type, manufacturer, type, model, price, first registration, mileage, performance, vehicle condition, vehicle identification number (VIN), photos and comparable data, about the advertisement (term) and your telephone number.

As a user of the direct sale function: information about the type of vehicle offered (vehicle type, manufacturer, type, model, price, first registration, mileage, performance, vehicle condition) as well as the full name, email address and telephone number. This data is transmitted to the selected seller and temporarily stored at AutoScout24.

As a user of the car loan, car insurance, leasing functions: user name and password (only if you register as an enquirer), title, first and last name, address and email address; date of birth, nationality, data on loan calculation and financing inquiries or applications or on creditworthiness. Depending on which functions you use, the scope of the data collected by us differs, as it becomes visible to you in the individual case when you enter the data for the inquiry. These are transmitted to the financial service providers and temporarily stored for billing purposes.

As a user of contact forms: Title, first and last name, address, email address and telephone number and other information regarding the contact.

As users of contact forms in financial calculator integrations: Title, first and last name, address, email address and telephone number and further details regarding the contact.

As a subscriber of newsletters and mailings: email address and, if specified by registration as a provider, first and last name for title, further data such as zip code for the playout of local services, as well as further personalization based on consumer behavior (e.g. search history, ad content). In order to be able to design our newsletter optimally according to your interests and wishes, the clicks on the links in the email newsletter are registered and stored.

As participants of raffles in the context of online surveys: title, first and last name and email address for the purpose of the raffle and contacting the winners.

As participants in test drives as part of vehicle market launches (AutoScout24 TestDriver Wanted): Title, first and last name, email address and telephone number for the purpose of contacting the manufacturer and their contract trade. The data is stored at AutoScout24 and the commissioning manufacturer.

As participants in user tests, recruited through online surveys: title, first and last name and email address for the purpose of establishing contact.

As a user of AutoScout360: first and last name, email address.

As a user of the online seller registration: Title, first and last name, address, email address and telephone number, company name, VAT number, user name, mobile phone number (optional), fax (optional). As well as contact person for contractual questions, different billing address, different business address, if entered.

As a user of the seller exclusive offer: offer text, end date of the offer.

As a seller email management user: Title, position, first name, last name, email address, notification type.

As a participant in online surveys as a seller:

• The analysis of our surveys is generally pseudonymized.
• However, for quality assurance purposes or for special analyses of specific customer groups (e.g., comparing customers who have booked different products), in individual cases the answers from a survey are assigned to personal information such as contract data or product usage data. However, even in these cases, your information from the surveys will be aggregated, i.e. evaluated only together with the responses of other participants from a customer group.

2.3 Data we collect through your use of our services

In the course of your use of our services, we collect various data on how you use our services.

2.3.1 Seller response rate

If you, as a seller, receive messages forwarded by us from interested parties and use the input mask provided by us to respond: the number of times you respond and do not respond to inquiries, and the response time required for the response.

2.4 Data processing when using our social media features

As a user of our social media features, data that is required to use the respective function (e.g., contracting, commenting, sharing, rating) are processed. In addition, the provider of the respective social media platform collects, among other things, your IP address as well as other information that is collected directly via your end device, among other things, via cookies and other technologies. In principle, the respective provider of the social media platform is responsible for the collection of personal user data on the platform.

2.5 Data we collect from third parties

Occasionally, we collect data from publicly available sources, such as mobile.de, pkw.de, gelbeseiten.de, ebay-kleinanzeigen.de, etc. This is exclusively freely accessible data, which is displayed on the respective page. These can be descriptions of the car model given on the third party site (make, model, sales price), or information about the respective seller, such as the company address and also contact details, such as the telephone number. We also use this data exclusively in accordance with the provisions of the current data protection laws.

We process your data primarily to provide you with our services and the associated services and functions. In addition, processing takes place for other purposes, which we present below together with the respective legal basis. Among other things, AutoScout24 Germany uses various procedures on the platform for usage analysis and for the provision of online advertising (both also using cookies). We also process data for the purposes of direct advertising by email and for security and legal tracking purposes.

3.1 Provision of our services

We process your data in order to provide you with the respective service and the associated functions. As part of the use of the contact form within the advertisements on our platform, the contact information entered by interested parties is transmitted to the advertisers.

We store and process the vehicle data you provide us with (vehicle type, manufacturer, type, model, price, first registration, mileage, performance, vehicle condition, VIN) for the purpose of statistical evaluations and their publication beyond the duration of the advertisement.

In order to ensure that your services/advertisements are noted by as many interested parties as possible, we sometimes also disseminate advertisements via cooperating car exchanges/websites. This means that we pass on your data, as publicly displayed in the advertisement, to the cooperating car exchange/website. We also send your listings via notification email to interested parties who have subscribed to a search request and share your listings on social media (such as Facebook). After a completed (sales) purchase, we also contact you via email to ask you about your (sales) purchase experience.

In some areas, we allow you to rate partner and third-party services found through our platform as a guide for other users. For this purpose, we will send you an email asking you to submit such an evaluation.

In addition, we process your data insofar as this is necessary for the implementation and processing of contractual relationships entered into, such as for the sending of invoices or for contacting you in the event of problems arising.

This processing is carried out on the basis of statutory provisions that allow us to process personal data insofar as it is necessary for the use of a service or the performance of a contract (Art. 6 Para. 1 b) GDPR), or because AutoScout24 has an overriding legitimate interest in making the use of the platform as easy and efficient as possible (Art. 6 Para. 1 f) GDPR). In some cases, we also obtain your consent to data processing (Art. 6 Para. 1 a) GDPR).

For the login to your user account at AutoScout24, we also offer the option of using the single sign on procedure of Meta Platforms Ireland Limited (4 Grand Canal Square, Grand Canal Habour, Dublin D02X525, Ireland, "Facebook"). If you decide to use the single sign on procedure, you will be redirected to the Facebook website for registration, where you can log in with your account data (email address and password). After you have logged in, your Facebook profile and your user account with AutoScout24 will be linked if you confirm this accordingly after logging in. By linking, AutoScout24 processes your email address.

We process the aforementioned data in order to provide you with the option of Facebook login (single sign on procedure). This processing is carried out on the basis of legal regulations that allow us to process personal data insofar as it is necessary for the use of a service or the performance of a contract (Art. 6 Para. 1 b) GDPR), or because AutoScout24 has an overriding legitimate interest in making the use of the platform as easy and efficient as possible (Art. 6 Para. 1 f) GDPR). Our legitimate interest is that you can carry out the registration process even more easily at your own request. Our legitimate interest is that you can log in to your AutoScout24 user account even more easily at your own request.

For more information on the Facebook login and privacy settings, please refer to the privacy policy (https://facebook.com/about/privacy/) and the terms of use (https://www.facebook.com/legal/terms) of Facebook.

Legal basis: Performance of a contract and execution of steps necessary prior entering into a contract (Art. 6 Para. 1 b) GDPR); legitimate interest (Art. 6 Para. 1 f) GDPR).

3.2 For the creation of individual product recommendations including email advertising.

If you have consented to this in accordance with Art. 6 Para. 1 a) GDPR or we are otherwise entitled to do so, we will also process your data to inform you about our products, services, events and promotions. We may deliver this information to you through various channels such as email, telephone, SMS, postal mail and third party social networks. In order to be able to design our services optimally according to your interests and wishes, these communications can be tailored to your preferences (e.g. if you tell us your preferences or we can infer these from your usage behavior on our services, or if you click on links in our emails).

3.3 For statistical analysis and optimization (AutoScout24 Germany)

When you use our offer, AutoScout24 Germany creates usage profiles using pseudonyms for the purposes of statistical analysis and user-oriented design of our services. This processing is carried out on the basis of your consent (Art. 6 Para. 1 a) GDPR) or because AutoScout24 Germany has an overriding legitimate interest in a user-oriented design geared to user habits and the statistical evaluation of our offer (Art. 6 Para. 1 f) GDPR).

For the aforementioned purposes, AutoScout24 Germany uses so-called cookies for our websites, i.e. its own alphanumeric identification characters and those of third-party providers, which AutoScout24 transmits to your computer by means of your web browser. You thus enable AutoScout24 Germany's systems to distinguish your browser from others. On the one hand, AutoScout24 Germany sends you so-called persistent cookies, which AutoScout24 Germany uses to record the search criteria you enter in our car database and store them for AutoScout24 Germany's internal evaluations.

On the other hand, AutoScout24 Germany uses so-called session cookies, with the help of which you receive a session ID for the duration of a visit to our pages, which enables AutoScout24 Germany to distinguish you from other visitors to the website. This enables AutoScout24 Germany to create continuity for you during your visit and to prevent you from being shown the same advertisements over and over again. The session cookie and your session ID are deleted at the end of your visit to our website.

In addition, AutoScout24 collects personal data via its own analysis tool in order to evaluate the functionality of our offers and to optimize the offers provided to you on our website (improvement of product performance). For this purpose, we evaluate the use of certain functions on our website in order to optimize the website with regard to efficiency, usability and user-friendliness (e.g. improvement of search results). No data is passed on to third parties in this context.

For our apps, AutoScout24 Germany uses appropriate technical services that enable AutoScout24 Germany to distinguish your terminal device from those of other users. Again, only pseudonymous data will be processed.

You can prevent cookies from being set by deactivating them in your web browser. In addition, you can decide in the AutoScout24 Privacy Manager for our websites and, when used within the apps for the app in question, whether and to what extent cookies may be used by AutoScout24 Germany when using our websites or corresponding technical services when using our apps. Unfortunately, you can only use all functionalities of our services with an activated cookie acceptance or acceptance of the technical services within the app.

We work with the following partners in this regard:

3.4 Online advertising

The advertising on our services is optimized for you by processing your usage behavior based on predicted interests. Cookies and function-similar technologies are used for this purpose, which are stored in the memory of your Internet browser or (mobile) end device and enable recognition.

Data is collected about your activities on our services (e.g., advertising banners clicked, sub-pages visited, search queries made, etc.). This data is used by means of pseudonymous data by third parties for the purpose of displaying content and advertising that matches your interests.

When you enter your email address on our website or app to sign up or make electronic contact with an advertiser, we may share personal or other data we collect from you, such as your email address (in hashed, pseudonymized form), your IP address, or information about your browser or operating system with our online ID partners. Our partners use this information to create an online ID with which you can be recognized on the devices you use.

These processing operations are carried out based on your consent pursuant to Art. 6 Para. 1 a) GDPR towards AutoScout24 Germany. Your consent is obtained through the AutoScout24 Privacy Manager, which AutoScout24 Germany displays when you visit our services and by means of which you can set your preferences for the use of your personal data. As part of these processing operations, AutoScout24 Germany also carries out the transaction data on the websites and in the mobile apps from AutoScout24 (pages viewed, content clicked on, etc.) and data from other services used on these websites / in these apps together with your registration data in order to be able to show you interesting advertising services on these websites / in these mobile apps.

For the delivery of usage-based online advertising, we use different operators of advertising networks under these conditions.

We work with the following partners in this regard:

3.5 Share Buttons

Our website uses so-called "share buttons", which are plugins of various social networks, namely Facebook, Google+, LinkedIn, Tumblr and Twitter. No information about your visit to our website is passed on to the respective operator of the social network via these share buttons. Only when you click on the respective share button will you be directed to the page of the network operator. The associated data processing is the responsibility of the operator of the respective social network under data protection law. Please consult the privacy policy of the respective network operator for details.

3.6 Direct advertising via email

In order to provide you with the most comprehensive service possible, we also use your data to send you suitable additional information of our own or of third parties in connection with all services, e.g. an intended purchase, financing or leasing, furthermore also the sale or leasing and the services of AutoScout24.

These processing operations are carried out on the basis of statutory provisions that permit personal data to be processed for direct advertising purposes because AutoScout24 has an overriding legitimate interest in doing so and, exceptionally, an unreasonable nuisance cannot be assumed (including Art. 6 Para. 1 f) GDPR).

If you do not wish to receive such emails, you can unsubscribe at any time, either on the main page of your personal area or by sending an email to widerspruch@autoscout24.de

Provided that you have given us consent, AutoScout24 will process your email address for advertising in connection with cars, car buying and selling, car financing and leasing, workshop services and for products for prospective car buyers. Based on the corresponding consent, AutoScout24 combines your registration data with the transaction data on the websites and in the mobile apps of AutoScout24 (pages accessed, content clicked on, etc.) and data from other services used on these websites/ in these apps in order to align the email advertising with your interests (Art. 6 Para. 1 f) GDPR).

3.7 Security and protection against misuse

Ultimately, we use the data of all users in order to effectively counteract possible acts of abuse within the scope of our car marketplace in the interest of honest users and to protect our customers from harm in such cases.

This processing is carried out on the basis of legal regulations that allow us to process personal data to protect against misuse and for legal prosecution and because AutoScout24 has an overriding legitimate interest in processing to ensure the functionality and security of the offer (including Art. 6 Para. 1 f) GDPR; Art. 6 Para 1 c) GDPR in conjunction with Art. 32 Para. 1 GDPR).

3.8 Customer service

AutoScout24 customer service answers service inquiries from commercial dealer customers, private customers and interested parties in day-to-day business. In the process, personal data of the customers is collected and processed. Personal data is collected by customers submitting it to us in a contact form provided for this purpose on the website or by contacting us by email, telephone or chat. We collect the provided data for the purpose of unambiguous customer verification and for fast processing of customer inquiries. Since we are constantly striving to improve our services for our customers, the data may be analyzed anonymously. All data will be used exclusively for the intended purpose and will not be passed on to third parties.

You have the following contact options:

3.9 Car subscription

In order to record whether we have successfully referred you to a vehicle provider when you use Auto Abo, we use a cookie to record whether you have clicked on an advertisement. The processing is based on your consent in accordance with Art. 6 Para. 1 a) GDPR, Sec. 25 Para. 1 TTDSG.

3.10 Data exchange with shareholding companies

We share data with companies in which AutoScout has a shareholding (this includes, for example, LeasingMarkt.de GmbH and AUTOproff Deutschland GmbH) for administrative purposes, for customer acquisition and management of the customer relationship, and as part of marketing measures. This data processing is carried out based on our legitimate interests pursuant to Art. 6 Para. 1 f) GDPR in the exchange of data for the aforementioned purposes with companies in which AutoScout has a shareholding.

It may happen that we also pass on your data to other recipients within the scope of the above-mentioned purposes. For example, as part of the provision of the offer and the associated functions and services, we pass on your data to providers and interested parties of cars and their financing, provided that you make use of the respective service.

Exceptionally, there may also be situations in which we are required by law to disclose your personal data to third parties, for example in the context of government law enforcement measures. In the event of an objectionable misuse of the AutoScout24 platform, the prerequisite for passing on data to other users is that there are justified and documented indications of the misuse.

In addition, your personal data may be passed on within the AutoScout24 group of companies, to service companies (possibly also third countries), to government authorities and to persons affected by a violation of the law and possibly to other companies as part of a corporate transaction, as explained in detail below.

4.1 Disclosure within the AutoScout24 group of companies

AutoScout24 operates internationally and is part of the AutoScout24 group of companies. Certain personal data, such as data provided by the user during registration, may be passed on within the group of companies for internal administrative purposes, including joint customer support, to the extent necessary.

4.2 Transfer to service providers bound by instructions

In some cases, we use service providers bound by instructions (both companies of the AutoScout24 group of companies and external service providers) for certain data processing activities. These are, without exception, service companies bound by instructions, which process the data on our behalf and according to our instructions.

4.3 Transfer to independent service providers

We offer some of our services in cooperation with independent service providers. These service providers are not bound by our instructions but are in turn independent controllers for processing the data they receive from us. This is the case, for example, if you choose the car loan, car insurance or leasing functions. In such cases, AutoSout24 acts only as an intermediary and for this purpose passes on data to an independent service provider who in turn provides a service to you. We will inform you about the passing on of personal data to independent service providers in the context of entering data to be passed on.

4.4 Disclosure to government agencies, to injured parties and for legal prosecution

If it is necessary to clarify illegal or abusive use of AutoScout24 or for legal prosecution, personal data will be forwarded to the law enforcement authorities and, if necessary, to injured third parties. However, this only happens if there are indications of unlawful or abusive behavior. A transfer may also take place if it serves the enforcement of terms of use or other agreements. We are also legally obligated to provide information to certain public authorities upon request. These are law enforcement agencies, authorities that prosecute administrative offenses subject to fines and the tax authorities.

4.5 Disclosure in the context of corporate transactions

As our business evolves, we may change the structure of our company by changing its legal form, establishing, buying or selling subsidiaries, divisions or components. In such transactions, customer information may be transferred to the acquirer or legal successor along with the part of the company being transferred. In any transfer of personal information to third parties to the extent described above, we will ensure that this is done in accordance with this Privacy Notice and applicable data protection law.

Any disclosure of personal data will be made on the basis of the statutory provisions. Accordingly, this data processing is justified by the fact that (1) the processing is necessary for the performance of the contract for the use of AutoScout24, or (2) AutoScout24 has a legitimate interest in disclosing the data for administrative purposes or the processing is necessary for compliance with a legal obligation to which AutoScout24 is subject.

5.1 Protection of your data in the third country

Due to the aforementioned transfers, the service providers bound by instructions may process the data in countries outside the EU ("third countries").

Insofar as AutoScout24 Germany or AutoScout24 transfers your personal data to a third country, appropriate guarantees are provided in accordance with Art. 44 ff. GDPR. With recipients in third countries for which there is no Commission adequacy decision, we have concluded the EU standard contractual clauses (or standard data protection clauses) in accordance with Art. 46 Para. 2 c) GDPR. A copy of the clauses can be found here (2010/87 Commission Decision of 5 February 2010) and here (2021/914 Commission Implementing Decision of 4 June 2021).

5.2 Consent to the transfer to third countries when using cookies

Personal data that we collect through the use of cookies on our website or app is transferred to several third countries where we cannot adequately protect your data even by entering into standard contractual clauses. We therefore only transfer the data collected via cookies to third countries if you consent to the transfer (Art. 49 Para. 1 a) GDPR). In order for you to understand the risks involved, we ask that you review the following information in advance.

We cannot effectively protect your personal data from access by intelligence agencies or investigative authorities in the third country. Rights and protections that apply to the processing of your data in Europe are not available or are limited in third countries. This could mean that you have no recourse against measures taken by authorities in third countries. It is possible that there are no special requirements for the protection of your personal data in the third country. Accordingly, in most third countries there are also no data protection supervisory authorities to supervise whether the data is processed in accordance with data protection principles by the recipient within the third country or to ensure that you can exercise your data subject rights.

Especially in respect to the transfer of personal data to the U.S., the Court of Justice of the European Union has declared that your data will be insufficiently without additional measures that protect your data within the third country. Thus, U.S. intelligence agencies may be entitled to challenge your data with one of the third-party providers or intercept it during transmission. If this occurs, U.S. law does not provide you with any legal recourse against the intelligence agencies authority. According to the U.S. government, such actions should only occur in exceptional circumstances.

Within the provider list in the AutoScout Privacy Manager, you can see in detail to which providers in third countries we transfer your personal data.

We delete or anonymize your personal data as soon as it is no longer necessary for the purposes for which we process it according to the above paragraphs. The specific storage period depends on how you use our offer.

If you have not registered with us, we store your personal data for the duration of the use of our offer plus a period of up to 14 days, during which we keep backup copies after deletion, unless this data is needed longer for criminal prosecution or to secure, assert or enforce legal claims.

If you have registered with us, we store your personal data for the duration of your registration and delete it as soon as you delete your user account. However, we still keep backup copies of your data for a period of up to 14 days before these are also permanently deleted.

In the event that you have given us consent to process your data (e.g. for the purpose of advertising use including the associated profiling), we will store your data until you withdraw your consent.

Insofar as we must retain data for legal reasons, a restriction on the further processing of the data concerned will take the place of deletion.

As a data subject of the processing of personal data, you have a right of access to the processed data, a right to rectification of your personal data, a right to erasure of your personal data, a right to restrict the processing of your personal data and a right to the portability of your personal data. Furthermore, you have the right to lodge a complaint with a supervisory authority.

In cases where the data processing is based on Art. 6 Para. 1 e) or f) GDPR or is carried out for the purpose of direct marketing, you have the right to object the processing.

If you have given us consent, you can withdraw this at any time with effect for the future.

7.1 Right to object

You have the right to object to the processing of your data at any time for reasons arising from your particular situation, you have the right to object to the processing of your data at any time for reasons arising from your particular situation, Without prejudice to the above right to object, you may also object at any time to the collection and processing of information on the use of the email newsletter.

Please note that with an objection, the sending of the newsletter will be terminated. Please send your objection to newsletters and mailings to: widerspruch@autoscout24.de.

You can also send your objection to newsletters and mailings to the postal address AutoScout24 GmbH, Tölzer Straße 16, 82031 Grünwald, or to the telephone number +49 89 444 56 1666.

7.2 Withdrawal of consent

You may withdraw any consent you may have given us at any time with effect for the future without affecting the lawfulness of the processing carried out on the basis of the consent up to the withdrawal. You can address your withdrawal to AutoScout24 GmbH, Tölzer Straße 16, 82031 Grünwald, or by email to widerspruch@autoscout24.de.

For the consent(s) given by you by means of the AutoScout24 Privacy Manager, you can withdraw them by calling up the AutoScout24 Privacy Manager.

7.3 Right to rectification and complete data

You have the right to demand that we immediately correct the personal data concerning you if it is incorrect. Furthermore, you have the right, within the scope of Art. 16 Para. 2 GDPR, to demand that we complete your data - also by means of a supplementary declaration - if it should be incomplete.

7.4 Right to erasure ("right to be forgotten")

You have the right to request that we delete personal data relating to you under the conditions described in Article 17 GDPR. These conditions provide in particular for a right to erasure if the personal data is no longer necessary for the purposes for which it was collected or otherwise processed, as well as in cases of unlawful processing, the existence of an objection or withdrawal of consent, the existence of an obligation to erasure under Union law or the law of the Member States to which AutoScout24 is subject, or the collection of data in relation to information society services offered in accordance with Art. 8 Para. 1 GDPR.

7.5 Right to restriction of processing

You have the right to demand that we restrict processing in accordance with Art. 18 GDPR. This right exists in particular if the accuracy of the personal data is disputed between the user and AutoScout24, for the period of time required to verify the accuracy, as well as in the event that the user requests restricted processing instead of deletion in the case of an existing right to deletion; furthermore, in the event that the data is no longer required for the purposes pursued by AutoScout24, but the user requires it for the assertion, exercise or defense of legal claims, as well as if the successful exercise of an objection is still disputed between AutoScout24 and the user.

7.6 Right of access and right to lodge a complaint

You have the right to receive access from us at any time upon request to the personal data processed by AutoScout24 that concerns you within the scope of Art. 15 GDPR.

You also have the right to lodge a complaint to the supervisory authority responsible for us or to another supervisory authority.

7.7 Right to data portability

Insofar as we process data that you have provided to us, you have the right to receive the personal data concerning you in a structured, common and machine-readable format or to transfer this data to another controller.

In order to facilitate business transactions between members of the AutoScout24 community, our service allows you to access certain contact information of other users (see section 3 above). By agreeing to our GTC (general terms and conditions), you agree to use this personal data exclusively for the following purposes:

• Communications related to content posted on AutoScout24, but not unsolicited promotional content,
• Other purposes for which the user concerned has given his or her express consent.

AutoScout24 and its members do not tolerate harassment through the sending of unsolicited advertising emails (spam). Therefore, you are not permitted to include a user's email address in your email distribution list or in any other address list without the express consent of the user concerned.

Note: Do not use the AutoScout24 "send page" service or other forwarding services to send unsolicited emails (spam).

Our Group Data Protection Officer will be happy to provide you with information and answer any questions you may have on the subject of data protection:

AutoScout24 Group (including smyle)
Data Protection Officer
Tölzer Str. 16
82031 Grünwald
as24-datenschutz@autoscout24.com

10. Joint controllership Auto Abo AutoScout24 Germany arranges services via our Auto Abo service for you together with AS24 Subscription, Casi and the vehicle providers (see section 1.3). We therefore also jointly guarantee the protection of your personal data.

10.1 When does joint controllership exist?

When you use our "Auto Subscription" service, for example by accessing the corresponding subpage of our website, the data that AutoScout24 Germany collects as part of the tracking process is also passed on to AS24 Subscription, Casi and, in some cases, to the vehicle providers.

Casi and AS24 Subscription support AutoScout24 Germany in providing the technical infrastructure needed to offer you car subscriptions. For the operation and optimization of the platform set up for this purpose, the companies involved exchange your personal data.

In addition, the car providers receive anonymous overviews of the use of the platform from AutoScout24 Germany. Data is further exchanged with the providers in order to determine whether we were able to place you successfully.

10.2 What does this mean for me?

As part of their joint controllership under data protection law, all participating companies have agreed on who fulfills which obligations of the GDPR. This relates in particular to the exercise of the rights of the data subjects and compliance with the information obligations pursuant to Articles 13 and 14 GDPR.

It was agreed that AutoScout24 Germany will inform you about the processing of your data and ensure that you can assert your data subject rights at any time. You can simply contact AutoScout24 Germany directly regarding your rights. Irrespective of this, however, you are free to assert your rights with one of the other companies involved via their respective business address.

If you wish to purchase or have purchased a car through smyle, smyle is the independent controller for processing your personal data (see section 1.5). In the context of providing services, smyle also cooperates with Autoscout24 Germany. In part, the processing of your personal data is therefore the joint controllership of smyle and AutoScout24 Germany.

In the following, we would like to inform you in detail about which data processing is carried out by smyle as an independent controller and to what extent the processing of your data is carried out within the scope of joint controllership with AutoScout24 Germany.

11.1 For what purposes and on what legal basis does smyle process your data as an independent controller?

11.2 For what purposes and on what legal basis does smyle process your data together with AutoScout24 Germany?

11.3. Recipients to whom the personal data are enclosed

smyle or AutoScout24 Germany will pass on your personal data to the following recipients to the extent necessary:

• Motor vehicle insurance: AXA Insurance (information on data protection at AXA: https://www.axa.de/datenschutz);
• Registration of the vehicle by service provider with the registration authority: DAD (further information on data protection at DAD: https://www.dad.de/datenschutz/);
• Warranty insurance: Allianz (further information on data protection at Allianz: https://https://www.allianz-warranty.com/de/info/datenschutz.html);
• Delivery of the vehicle: Kroschke (further information on data protection at Kroschke: https://www.kroschke.de/datenschutz/);
• Financing purchase: Santander Bank (further information on data protection at Santander Bank: https://www.santander.de/privatkunden/service-kontakt/datenschutz/);
• Insofar as Smyle acts as an independent controller (see Section 11.1), AutoScout24 Germany is used as a processor with respect to individual processing operations. This applies in particular with regard to processing operations that take place in connection with the provision of the technical infrastructure and the guarantee of IT security.

In addition, in the cases described in Section 11.1.2, it may be necessary to pass on your personal data to public authorities, such as the public prosecutor's office. In addition, smyle or AutoScout24 Germany cooperates with lawyers and consultants who provide support as needed in the implementation of legal obligations.

11.4. How long do we store your data?

smyle deletes or anonymizes your personal data as soon as it is no longer required for the above-mentioned purposes for which smyle processes it. The specific storage period depends on the particular smyle service used. If you use smyle services without an AutoScout24 account, smlye will store your personal data for the duration of your use of smyle services plus a period of up to 7 days, unless this data is needed longer for criminal prosecution or to secure, assert or enforce legal claims.

If you use smyle services with an AutoScout24 account, smyle will store your personal data for the duration of your registration and delete it as soon as you delete your account. smyle will, however, retain backup copies of your data for a period of up to 14 days before these are also permanently deleted. In the event that you have given your consent to the processing of your personal data (e.g. for the purpose of advertising, including the associated profiling), smyle or AutoScout24 Germany will store your personal data until you withdraw your consent. If smyle is required to retain data for legal reasons, the deletion will be replaced by a restriction on the further processing of the data concerned. This applies in particular to the retention of personal data about you for reasons of tax law in accordance with Sec. 147 AO for a period of six or ten years from the end of the calendar year in which you purchased a vehicle as part of our "smyle" offer. In parallel, smyle is obligated to store your personal data after the purchase of a vehicle within the scope of our "smyle" offer until the limitation of your warranty rights (Sec. 438 Para. 1 No. 3 and Para. 2 BGB) from the delivery of the vehicle to you.

11.5. What rights do you have as a data subject?

As a data subject, you have the rights listed in section 7. All data subject inquiries are processed and managed centrally. You can therefore assert your rights with regard to processing by smyle directly against smyle or alternatively contact AutoScout24 Germany.

Withdrawal of consent and objections to processing can also be addressed centrally to widerspruch@autoscout24.de

11.6. What does joint controllership mean for me as a data subject?

As described in detail in Section 11.2, smyle and AutoScout24 Germany carry out some processing as joint controllers. For this purpose, a contract was concluded that primarily specifies who fulfills which obligations under the GDPR.

Therefore, it was agreed that AutoScout24 Germany will inform you about the processing of your data and ensure that your data subject requests are processed and fulfilled in accordance with the legal requirements.

AutoScout24's services are constantly being developed, in particular to further improve the services and functionalities of the platform. Such changes may also affect the use of your personal data. We will therefore adapt this data protection information accordingly from time to time. The latest version is available on our website under the heading "Data Protection Information". Please inform yourself regularly about the current status of the data protection information in this way.