Privacy Policy
Last updated: [DATE]
1. Controller
Controller pursuant to Art. 4(7) GDPR: Coceu [ENTITY], [FULL LEGAL ADDRESS], Germany. Email: [email protected]. [If applicable: Data Protection Officer / DPO: [NAME/EMAIL] — a DPO is generally not mandatory for a small team, confirm with counsel.]
2. Data we process
- Identity & contact: name, billing/shipping address, email, phone.
- Vehicle data: Vehicle Identification Number (VIN) and related vehicle details you submit.
- Order & payment data: order history, amount, VAT status, payment method. Card data is processed directly by Stripe; we do not store full card numbers.
- Business customer data (B2B): company name, VAT ID (for reverse-charge verification).
- Technical data: IP address, browser type, timestamps, cookie identifiers.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Performing the CoC procurement contract (incl. transmitting VIN/name to the manufacturer's official channel) | Art. 6(1)(b) GDPR — contract performance |
| Payment processing | Art. 6(1)(b) GDPR + Art. 6(1)(f) fraud prevention |
| Invoicing, tax and commercial retention | Art. 6(1)(c) GDPR — legal obligation (§147 AO, §257 HGB) |
| Customer support & communication | Art. 6(1)(b)/(f) GDPR |
| Essential cookies / site security | Art. 6(1)(f) GDPR |
| Non-essential cookies / analytics | Art. 6(1)(a) GDPR — consent (§25 TDDDG) |
4. Recipients / third parties
We share data only as needed to perform the service:
- Vehicle manufacturer / its official CoC channel — receives VIN and required holder details to issue the CoC. This is essential to the service you order.
- Stripe (payment) — Stripe Payments Europe, Ltd.
- UPS (physical delivery of the original CoC) — receives name and shipping address.
- Hosting / email / IT processors — [PROVIDERS, e.g. hosting provider, email service].
We conclude data processing agreements (Art. 28 GDPR) with all processors.
5. International transfers
Where a recipient is outside the EU/EEA, transfers rely on an adequacy decision or EU Standard Contractual Clauses (Art. 46 GDPR). [SPECIFY any non-EEA processors, e.g. if Stripe/hosting routes data to the US, note SCCs / EU-US Data Privacy Framework.]
6. Retention
- Contract/order data: retained for the statutory commercial and tax retention periods (up to 10 years, §147 AO, §257 HGB).
- VIN/vehicle data: deleted once no longer needed for the contract and no retention obligation applies.
- Consent-based data: until consent is withdrawn.
7. Your rights (Art. 15–21 GDPR)
You have the right to access, rectification, erasure, restriction, data portability, and objection. Where processing is based on consent, you may withdraw it at any time with effect for the future. Contact: [email protected].
You also have the right to lodge a complaint with a supervisory authority, e.g. the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit).
8. Provision requirement
Providing identity, address, payment and VIN data is necessary to conclude and perform the contract. Without it we cannot procure your CoC.
9. Automated decision-making
We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.
10. Cookies
See our Cookie Policy [LINK] for details and consent management.