Privacy Policy

Provider: Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA

Purpose:

• Fast and secure delivery of the website worldwide
• Protection against DDoS attacks, bot traffic and misuse
• Load balancing and performance optimisation
• Caching of static content
• Error analysis and stability monitoring

Data processed:

• IP address (shortened/anonymised)
• Timestamp of access
• Requested URL and HTTP referrer
• User agent (browser/operating system information)
• Security/firewall events (e.g. blocked attacks)

Legal basis: Art. 6(1)(f) GDPR (legitimate interest)

Storage period: server logs max. 30 days

Transfer to third countries: Data may be processed on edge servers worldwide (including the USA). Cloudflare is certified under the EU-US Data Privacy Framework (DPF) and offers the European Commission’s standard contractual clauses (SCCs). In addition, Cloudflare participates in the EU Code of Conduct.

Privacy: cloudflare.com/privacypolicy
DPA: cloudflare.com/cloudflare-customer-dpa

Provider: Supabase, Inc., USA (operated in the EU region Frankfurt)

Purpose:

• Storage of booking and customer data
• Authentication and user management
• Database operations and API access
• Encrypted backups

Data processed:

• Master data (name, email, telephone)
• Booking information (rental period, location, trailer type)
• Payment references (no card data)
• Communication history

Legal basis: Art. 6(1)(b) GDPR (performance of a contract)

EU region: All data are stored exclusively in the EU region (eu-central-1, Frankfurt/Germany) and processed there in regular operation. For exceptions (support access from the USA), see the following note.

Note on transfers to third countries: The data are stored in the EU and are not moved to third countries in regular operation. Supabase, Inc. has its registered office in the USA; access from the USA (e.g. in technical support) is possible. As an appropriate safeguard under Art. 46(2)(c) GDPR, the European Commission’s standard contractual clauses (SCCs) (Implementing Decision (EU) 2021/914, Module 2: controller to processor) are in place, supplemented by technical and organisational measures (TOMs) under Art. 32 GDPR.

Data protection measures:

• Row Level Security (RLS): database access is protected at row level
• Encryption: TLS 1.3 in transit, AES-256 at rest
• Access control: role-based access with 2FA
• Backups: encrypted daily backups with 30-day retention
• Monitoring: logging of all admin access

Storage period: see section 7 (retention periods)

Privacy: supabase.com/privacy
DPA: Supabase DPA

Technology provider: Giesecke & Devrient GmbH (G+D Mobile Security), Germany

Purpose:

• Prevention of theft and misuse
• Contract processing (start/end location, distance travelled)
• Investigation of damage in the event of accidents or violations
• Technical error analysis and maintenance
• Safety alert where the maximum permissible speed is considerably exceeded (see below)

Data recorded:

• GPS position data (longitude/latitude)
• Timestamps of the positions
• Speed of movement
• Trailer ID and booking assignment

Recording interval: At most once per minute while driving. When stationary, there is no continuous recording of the position (only when movement is detected or on request).

Legal basis:

• Art. 6(1)(b) GDPR (performance of a contract)
• Art. 6(1)(f) GDPR (legitimate interest in theft prevention and the investigation of damage)

Storage period:

• Regular journey data: 30 days after the end of the rental (under GTC § 17)
• Event-related data: until damage cases/disputes have been resolved (max. 3 years)
• Suspected theft: until clarified by the police

Access: only authorised staff where there is a legitimate reason (customer request, suspicion, damage case). Access is logged.

Customer rights: GPS data can be inspected on request (right of access, Art. 15 GDPR)

Automatic safety alert for excessive speed

The telematics system automatically reports if a trailer is moved at more than 120 km/h during an ongoing rental. This threshold is well above the maximum speed permitted for vehicle-and-trailer combinations (usually 80 km/h; 100 km/h on motorways if the combination has a German “Tempo 100” approval). Below this threshold, speed is not evaluated.

Processing: An alert is assigned to the ongoing booking. We store the time of the alert, the number of alerts and – where transmitted by the telematics system – the speed measured. With the first alert of a rental, you receive a one-off notification email; further alerts during the same rental do not trigger any further email.

Alert log: Each alert received is also recorded in a technical log (the telematics provider’s alert ID, the trailer’s registration number, timestamp, raw text of the report). It prevents the same alert from being processed twice and ensures traceability. When the associated booking is deleted, the reference to the booking is removed there; the remaining entry can then no longer be attributed to any person.

Purpose: road safety, protection of the rented trailer against damage and informing you that the contractual limitation of liability (damage protection) does not apply if the maximum permissible speed is exceeded (GTC § 13).

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in road safety, in the protection of the rental item and in the avoidance of damage). A documented balancing of interests is in place.

No legal consequence: The notification is purely informative. It does not in itself trigger any fee, contractual penalty or report to authorities or third parties (see also section 10).

Storage period: The alert metadata are stored with the associated booking data and deleted at the latest together with them. For the underlying position data, the period of 30 days after the end of the rental stated above applies.

Right to object: You may object to this processing under Art. 21 GDPR. We will then examine whether our legitimate grounds override your interests.

Provider: Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland

Data processed:

• Credit card data (stored only by Stripe, not by us)
• PayPal data (if selected; PayPal is integrated via Stripe)
• Billing address
• Transaction ID and payment status

Note on PayPal: PayPal payments are processed via the Stripe platform. Stripe acts as a technical intermediary; the payment data are forwarded to PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg).

Purpose: secure payment processing, fraud prevention

Legal basis: Art. 6(1)(b) GDPR (performance of a contract)

Role: Stripe processes payment data on its own responsibility as an independent controller (not as a processor)

Merchant-initiated transactions (MIT): By booking, you agree that additional costs (e.g. damages, late return, cleaning) may be collected after the end of the rental via the stored payment method. The authorisation ends 90 days after the end of the rental (under GTC § 6 paras. 2–3).

Transfer to third countries: Data may be transferred to the USA. Stripe is certified under the EU-US Data Privacy Framework and uses standard contractual clauses (SCCs).

Privacy: stripe.com/de/privacy

Cancellation of the PayPal billing agreement: If you cancel the PayPal billing agreement given when booking, our payment service provider Stripe informs us. Our backend server (see sections 2.12 and 4.1) assigns this notice to your booking via the payment method stored with your booking. The notice also contains the IP address and browser identifier that Stripe recorded when you gave your consent during payment; we neither evaluate nor store this information. Depending on the case, we send you an email (sent via Postmark) with a link to Stripe, through which you can store PayPal as a payment method again, or a member of staff reviews the case. The notification that PayPal also sends us by email is not evaluated automatically.

Purpose: assigning the cancellation to your booking and storing a payment method again so that any additional costs under GTC § 6 can continue to be settled.

Legal basis:

• Art. 6(1)(b) GDPR (performance of a contract) — processing of the rental agreement including the payment authorisation for additional costs
• Art. 6(1)(f) GDPR (legitimate interest) — securing possible claims under the rental agreement

Data processed:

• Email address
• First name
• Key booking details (location, period, price)
• Reservation number

Purpose: completion of the booking process initiated by you

Legal basis: Art. 6(1)(b) GDPR (taking steps prior to entering into a contract at your request); alternatively Art. 6(1)(f) GDPR (legitimate interest in the resumption of processes started by you)

Sending: The email is sent via our processor Postmark (see section 5). The time of sending is stored with the booking to avoid multiple sending.

Objection: You may object to this processing at any time using the contact details given above.

Required information:

• Name
• Email address
• Message text

Email provider: Strato AG, Germany (Strato Webmail)

Legal basis: Art. 6(1)(a) GDPR (consent) or Art. 6(1)(f) GDPR (legitimate interest)

Storage period: 24 months after the communication has been completed (support purposes)

Encryption: TLS-encrypted email transport

Data processed:

• Email address
• IP address and user agent (for the audit trail)
• Time and version of the consent
• Source of the sign-up (footer, exit modal, etc.)

Voluntary nature: Providing your email address is voluntary; without it, we cannot send you the newsletter.

Recipients & places of processing: Supabase (storage in the EU region Frankfurt) and Postmark (email sending, USA – see section 5: transfer to third countries).

Sign-up procedure: Double opt-in – after entering your email address, you receive a confirmation email. Your subscription only becomes active after you click the confirmation link. This link is valid for 24 hours.

Email sending: Postmark (processor under Art. 28 GDPR, USA) – for sending confirmation and newsletter emails. EU standard contractual clauses (SCCs) and a data processing agreement (DPA) apply. Postmark EU privacy

No tracking: We do not use open or click tracking in our newsletter emails.

Legal basis: Art. 6(1)(a) GDPR (consent)

Withdrawal: You can withdraw your consent at any time by clicking the unsubscribe link in any newsletter email or by contacting us directly. The withdrawal takes effect for the future; the lawfulness of the processing carried out until the withdrawal remains unaffected.

Storage period: Your data are stored for as long as you are subscribed to the newsletter. After you unsubscribe, your data are anonymised after 6 months (email address replaced by a placeholder, IP and user agent deleted).

Consent log: To fulfil our accountability obligations under Art. 7(1) GDPR, we keep a log of your consent (time, version, action). IP address and user agent are removed from the log no later than 6 months after you unsubscribe; a log limited to what is strictly necessary (without IP/user agent) is kept for up to 3 years to fulfil statutory accountability obligations.

Data processed:

• Email address (already collected in connection with the booking)
• Time and version of the consent
• for consent given on the confirmation page: the internal identifier of the booking through which you gave the consent (for evidence purposes only)
• in the event of a withdrawal: its time

Voluntary nature: Consent is voluntary and has no effect on the conclusion or the terms of your booking.

Sign-up procedure: Simple consent with logging. As consent is given in connection with a verified, paid booking with a confirmed email address, we do not use an additional double opt-in procedure here – unlike for the newsletter alone.

Recipients & places of processing: Supabase (storage in the EU region Frankfurt) and Postmark (processor under Art. 28 GDPR, email sending, USA). For the transfer to the USA, a data processing agreement and EU standard contractual clauses (SCCs) or – where applicable – the EU-US Data Privacy Framework are in place; details in section 5 (transfer to third countries).

Legal basis: Art. 6(1)(a) GDPR (consent). Under unfair competition law, emails are sent exclusively on the basis of your express consent (§ 7 para. 2 no. 2 UWG).

Withdrawal: You can withdraw your consent at any time with effect for the future by clicking the unsubscribe link in any promotional email, deactivating the switch in the customer portal or contacting us directly. After a withdrawal, we stop sending promotional emails. We record the withdrawal with its time so that you are not contacted again afterwards without a new consent given by you yourself. The lawfulness of the processing carried out until the withdrawal remains unaffected.

Storage period: We store your marketing consent (opt-in status, time and version) for as long as it exists. After a withdrawal, we deactivate the marketing flag. If both your consent and your last booking with us are more than 36 months in the past, we no longer send you advertising unless you book with us again. We keep a log limited to the information stated above (time, version, where applicable booking identifier and time of withdrawal) for up to 3 years after the end of the consent (withdrawal or expiry of the 36 months) to fulfil statutory accountability obligations, and delete it automatically afterwards. After this deletion, consent that has ended in this way does not revive through a new booking either, but requires new consent.

Consent log: To fulfil our accountability obligations under Art. 7(1) GDPR, we store the time and version of the consent together with your customer record; the stored version also identifies at which of the places mentioned above the consent was given. For consent given on the confirmation page, we additionally store the internal identifier of the booking through which you gave the consent. Name, IP address or device data are not stored for this purpose.

Data processed:

• Telephone number (stored as a SHA-256 hash with a secret server-side salt — never in plain text on the server; it cannot be traced back to the original number with reasonable effort)
• Chat messages (text of the conversation)
• Media you send us (photos, videos, voice messages) — see the following paragraph “Media”
• Booking data (name, period — looked up by telephone number, not stored permanently in the chatbot system)

Media (photos, videos, voice messages): Media are not persisted on our server. Photos are transmitted to Anthropic so that the chatbot can understand the request. Voice messages are transmitted to ElevenLabs for automatic transcription; the transcript is deleted from the service provider immediately after retrieval, after which only the transcription text is processed further. All media are additionally forwarded to a Slack channel for internal quality assurance (see section 4.1, Slack).

Photos for pick-up or return: By way of derogation, we store photos and videos that you send us after our automatic request for photos of the pick-up or return (see section 2.15) as handover documentation for your booking: they are filed in the booking folder in Google Drive, together with the photos from the pick-up or return form (Google Workspace, see sections 4.1 and 5). This applies to photos and videos that arrive up to 24 hours after the form has been submitted; we do not file voice messages there. The legal basis is Art. 6(1)(b) GDPR (performance of the rental agreement) and Art. 6(1)(f) GDPR (legitimate interest in evidencing the condition of the trailer at handover and in asserting or defending claims). We store them for 3 years from the return of the trailer (see section 2.15).

AI processing: Your messages and photos are transmitted to Anthropic (Claude API) in order to generate automated replies. Anthropic processes the data as a processor; use of the data for model training purposes is contractually excluded.

Internal mirroring: Messages are mirrored in an internal Slack channel to ensure service quality and to allow a human to take over where necessary. Access is restricted to authorised staff.

Legal basis:

• Art. 6(1)(b) GDPR (performance of a contract) — for booking-related enquiries
• Art. 6(1)(f) GDPR (legitimate interest) — for general enquiries without reference to a contract (e.g. pre-sales questions)

Storage period: Chat histories are deleted automatically 72 hours after the last message. If there is a booking relating to the enquiry, storage is extended until 7 days after the end of the rental so that queries about the rental can be answered. Telephone number hashes are deleted together with the chat session.

Transfer to third countries: Meta WhatsApp Cloud API (USA/EU), Anthropic Claude API (USA), ElevenLabs (USA), Slack (Salesforce) (USA), Google Workspace (EU/USA, only for photos and videos of the pick-up or return) — see section 5.

Alternative ways of contacting us: You can also contact us at any time by email or telephone if you do not wish to use the WhatsApp channel (see contact details in section 1).

Data transmitted:

• Google Click ID (gclid) — a pseudonymous click identifier from the Google ad
• Booking value and timestamp
• Consent status (ad_user_data, ad_personalization)

Not transmitted: Names, email addresses, telephone numbers or other directly personal customer data are not transmitted to Google.

Consent check: Conversion data that can be related to a person are uploaded only if the customer gave consent to advertising tracking when visiting the website (Consent Mode v2: ad_user_data: granted).

Frequency: regularly and automatically via our backend server.

Legal basis: Art. 6(1)(a) GDPR (consent via the cookie banner, “Marketing” category)

Storage period: The storage period of the transmitted data at Google is Google’s responsibility (see Google privacy policy).

Transfer to third countries: Google Ads API (USA) — Google is certified under the EU-US Data Privacy Framework. See section 5.

GPS location monitoring (theft protection)

It is checked automatically at regular intervals whether our trailers are at their assigned home location. This check concerns exclusively vehicle telemetry (GPS coordinates of the trailers) — a link to booking or customer data is not technically implemented. GPS data are only processed in memory and are not persisted on the server.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest: theft prevention)

Parking duration monitoring (legal obligation)

It is checked daily whether trailers exceed the statutory 14-day parking limit for vehicles without a towing vehicle. This processing concerns only vehicle data (registration number, location, parking duration).

Legal basis: Art. 6(1)(f) GDPR (legitimate interest: avoidance of regulatory offences)

Server logs (nginx)

The backend server logs incoming requests in nginx access logs. Personal data (IP addresses), URLs accessed, timestamps and user agents are recorded.

Storage period: 90 days (automatic deletion via logrotate). The storage period of 90 days is necessary in order to be able to analyse security incidents and attempted attacks afterwards (incident response).

Legal basis: Art. 6(1)(f) GDPR (legitimate interest: IT security, detection and defence against attacks)

Data flow:

1. The prospective customer writes to us via the Kleinanzeigen platform. eBay Kleinanzeigen sends a notification email to our address hello@trailer-swarm.de.
2. Our email provider Strato forwards this notification email via filtered forwarding to an inbound webhook of Postmark.
3. Our backend server (Hetzner, Germany) processes the message, stores it in the database (Supabase, EU region Frankfurt) and mirrors it into a private internal Slack channel for team approval.
4. An AI language model (Anthropic Claude, USA) creates a draft reply.
5. An authorised team member approves the draft in Slack by reaction.
6. The approved reply is sent via Postmark (USA) to the Kleinanzeigen forwarding address; eBay Kleinanzeigen forwards the reply to the prospective customer.

Data processed:

• Email address: exclusively the anonymised forwarding address assigned by eBay Kleinanzeigen (e.g. abc123-…-ek-ek@mail.kleinanzeigen.de). We do not know the prospective customer’s actual email address.
• Name: if supplied by Kleinanzeigen in the email header or message text (best-effort extraction, usually first name only). The platform only transmits what the prospective customer has stored in their Kleinanzeigen profile.
• Content of the message: plain text of the prospective customer’s enquiry and our reply.
• Context information: ad ID and ad title of the Kleinanzeigen listing concerned.
• Timestamps.

Not collected: In this processing operation we collect no real-name email address and no telephone number. The Kleinanzeigen terms of use prohibit off-platform contact before a contract is concluded; communication therefore remains in the email conversation brokered by Kleinanzeigen.

Purpose:

• Answering rental enquiries (pre-contractual measure at the prospective customer’s request)
• Internal team approval and quality assurance of the reply (private Slack channel with a restricted group of people)

Legal basis: Art. 6(1)(b) GDPR (taking steps prior to entering into a contract at the request of the data subject)

Storage location: backend server at Hetzner Online GmbH (Germany) and Supabase database in the EU region Frankfurt (eu-central-1). The conversation is stored in separate tables, kept apart from the booking database (Row Level Security, service-role access only).

Pseudonymised lookup: In addition to the forwarding address, we store a SHA-256 hash with a secret server-side salt as a secondary search index so that the forwarding address does not appear in plain text in search or error logs. The plain text of the forwarding address must remain in the table because we have to send the reply to this address.

Recipients:

• Postmark (Wildbit LLC / ActiveCampaign, USA) – inbound and outbound email processing (see sections 4.1 and 5)
• Supabase (EU region Frankfurt) – storage of the conversation (see section 2.3)
• Hetzner Online GmbH (Germany) – server hosting (see section 2.12)
• Anthropic PBC (USA) – AI language model Claude for creating the draft reply (see sections 4.1 and 5; no use of the data for AI training)
• Slack (Salesforce) (USA) – internal mirroring for team approval (see sections 4.1 and 5)

Storage period: The entire conversation (thread and all associated messages) is stored for 90 days after the last activity (“sliding window” on last_activity_at). A nightly clean-up job deletes expired conversations completely (cascade delete). If a booking results, the necessary customer data are transferred to the regular booking flow; from that point the applicable storage period from section 7 applies to the booking data.

Data processed:

• Your information on the condition of the trailer (including cleanliness, lighting, tyres, jockey wheel, coupling lock, plug, wheel chocks), reported damage and your comments
• Photos of the trailer that you take in the form with your device’s camera
• Time of pick-up or return and the location and odometer reading of the trailer at that time (from the telematics, see section 2.5)
• Photos and videos that you send afterwards via WhatsApp at our request (see below)

Handover report: From your information, we create a handover report as a PDF with name, address, booking number, rental period, registration number, condition and location of the trailer and your comments. You receive the report by email, where applicable together with the photos (sent via Postmark, see section 4.1); a copy goes to our booking mailbox.

Access code by SMS: After the pick-up form has been submitted, we additionally send you the code for the lock by SMS to the telephone number given when booking. The SMS is sent via Twilio (see sections 4.1 and 5); your telephone number and the text of the SMS with the access code are transmitted. We delete the log of the SMS at Twilio after 30 days (see section 2.16).

Storage location: We file photos, videos and handover reports in your booking’s folder in Google Drive (Google Workspace, see sections 4.1 and 5). Until they are processed, the form photos are briefly held in non-public storage at our database provider (Supabase) and are deleted there afterwards. We store your condition information with your booking; our team additionally receives your comments in an internal Slack channel (see section 4.1).

Sending photos later via WhatsApp: If you submit the form without all the photos or report damage in it, we automatically ask you for photos via WhatsApp. We also file in the booking folder photos and videos that you send to our WhatsApp service number up to 24 hours after submitting the form (see also section 2.10).

Purpose: evidence of the condition of the trailer at pick-up and return (e.g. in the event of damage, missing accessories or soiling) and the cleanliness check (see section 10).

Legal basis:

• Art. 6(1)(b) GDPR (performance of a contract) — performance of the rental agreement including the contact-free handover
• Art. 6(1)(f) GDPR (legitimate interest) — evidence of the condition of the trailer at handover and the assertion or defence of claims

Storage period: 3 years from the return of the trailer. The period is based on the regular limitation period (§§ 195, 199 BGB), for example in the event of a dispute about damage or subsequent charges. After that, the photos, videos and handover reports in the booking folder are deleted; your contract data remain stored until the end of the statutory retention period (see section 7).

Data processed:

• Your telephone number (if transmitted), time and duration of the call and the path through the voice menu
• Your voice message, if you leave a voicemail message

Notification to our team: Our team receives information about the call, including your telephone number, in an internal Slack channel. If your telephone number belongs to a booking, we add first name, booking number, status, rental period, location and registration number to the notification. If you leave a voicemail message, the recording is also transferred there as an audio file so that we can call you back. The transfer runs via our backend server (see section 2.12).

WhatsApp after the call: If you request a WhatsApp message in the voice menu by pressing a key, we send it to the number from which you called, for example with the link to online booking. Without this request, we do not send any WhatsApp message. It is sent by our backend server via the WhatsApp Business API; if you reply to the message, section 2.10 applies.

Damage report by SMS: If you select the damage option in the voice menu, we send you a link by SMS (via Twilio) through which you can send us photos via WhatsApp.

Purpose: handling your request and calling you back.

Legal basis:

• Art. 6(1)(b) GDPR (performance of a contract or pre-contractual measures) — for enquiries about a booking or a planned rental and for the WhatsApp message you requested
• Art. 6(1)(f) GDPR (legitimate interest) — efficient handling of telephone enquiries, including those without reference to a contract

Storage period: We delete voicemail recordings at Twilio as soon as they have been transferred to our team. At Twilio, we delete call and SMS logs, and recordings whose transfer fails, 30 days after creation. Twilio itself removes deleted message texts from its backups within up to 30 days and keeps information on deleted recordings (without audio) for a further 40 days. Twilio no longer provides logs from the period up to September 2025 via its interface; we are clarifying their deletion with Twilio. Call information and recordings in Slack are deleted automatically after 90 days.

Transfer to third countries: Twilio (EU/USA), Slack (Salesforce) (USA), Meta WhatsApp Cloud API (USA/EU) — see section 5.

Storage of consent (ts-consent)

Your consent decision is stored in the cookie ts-consent. This cookie contains:

• Version of the consent structure
• Timestamp of the consent
• Your preferences per category (Analytics, Marketing, External content)
• Do Not Track status of your browser

Lifetime: 1 year | Storage location: only in your browser (first-party cookie)

We technically record whether and which consents you give or refuse via our cookie banner in order to ensure and analyse that our consent management works. No personal data are collected in the process — only the categories selected (e.g. “Analytics: yes/no”). Legal basis: Art. 6(1)(f) GDPR (legitimate interest).

Automatic speed safety alert:

During an ongoing rental, our telematics system automatically checks whether a fixed speed threshold is exceeded (see section 2.5). This is a pure threshold comparison without any assessment of driving behaviour and without any forecast. It only results in an informative notification email and makes no decision about your booking. Any consequences — for example in the event of damage — are always examined by staff on a case-by-case basis.

AI-supported preliminary assessment of the loading area photo (cleanliness check):

At pick-up, you photograph the loading area of the trailer in the pick-up form. An AI language model (Anthropic Claude, see section 4.1) assesses from this photo whether the loading area is dirty. The assessment decides exclusively whether a member of staff additionally checks the photo: if the loading area appears dirty or the photo cannot be assessed clearly, a member of staff checks it and decides whether we offer you a refund for the cleaning. If the loading area appears clearly clean, the photo is filed in the booking folder without further checking (see section 2.15); we spot-check some of these photos. The assessment has no influence on your booking, does not lead to any charge and is not a damage assessment — damage cases continue to be handled by staff. Only the photo is transmitted to Anthropic, no names, contact or booking data. We store the result (clean, light traces, dirty or cannot be assessed), a short descriptive sentence about the loading area, a confidence value of the assessment and information on the course of the check (AI model used, whether and when the photo was filed without checking).

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in an efficient check of the vehicle’s condition in the contact-free handover).

Storage period: The AI assessment and the information on the course of the check are deleted automatically 30 days after the pick-up.