Personvernerklæring
This is a translation of our German privacy policy. In case of any discrepancy, the German version shall prevail.
The protection of personal data is an important concern for us. Below, we inform you about which personal data we process when you use our website www.original-carparts.com and in the course of our business relationships, for what purposes this is done, on what legal basis the processing takes place and what rights you have.
1. Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) is:
R.O.N.A.X GmbH
Universitätsstraße 60
44789 Bochum
Germany
Managing Director: Mihails Esterkins
Phone: +49 (0) 234 - 917 89 990
E-mail: info@original-carparts.com
Website: www.original-carparts.com
You can contact us at any time with data protection enquiries using the contact details above.
2. Data Protection Officer
No data protection officer has been appointed for our company. You can address all concerns and enquiries regarding data protection directly to the controller named above.
3. General Information on Data Processing
We process personal data only to the extent permitted under the applicable data protection laws. Personal data means any information relating to an identified or identifiable natural person. This may include, in particular, name, contact details, IP address, login data, content of communications, order data or data of contact persons at business customers, suppliers and service providers.
Our website and our services are generally aimed at business customers. Personal data may also be processed in the B2B sector, in particular where contact persons, employees, managing directors, purchasers, logistics managers or other natural persons act on behalf of a company.
Processing is based in particular on the following legal bases:
- Art. 6(1)(a) GDPR – consent, for example for optional cookies, analytics services or certain marketing measures.
- Art. 6(1)(b) GDPR – performance of a contract or pre-contractual measures, for example for enquiries, quotations, registrations, customer accounts, orders, deliveries and payment processing.
- Art. 6(1)(c) GDPR – compliance with legal obligations, for example obligations under commercial, tax, customs, export control or sanctions law.
- Art. 6(1)(f) GDPR – legitimate interest, for example in the secure provision of the website, IT security, prevention of misuse, customer service, direct marketing to existing customers, documentation of business processes and the establishment, exercise or defence of legal claims.
4. Access to Our Website and Server Log Files
When you visit our website, technical access data is automatically processed by the web server. This may include in particular:
- IP address of the accessing device,
- date and time of access,
- page or file accessed,
- amount of data transferred,
- referrer URL,
- browser type and browser version,
- operating system,
- host name of the accessing computer,
- status messages and error codes.
The processing takes place in order to provide the website technically, to ensure system security, to detect attacks or misuse and to ensure the stability of the website.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure, functional and uninterrupted provision of our website.
Server log files are generally stored only for as long as is necessary for the stated purposes. Longer storage may take place if this is necessary to investigate security incidents, misuse or legal claims.
5. Hosting and Technical Service Providers
Our website is hosted by:
IONOS SE
Elgendorfer Straße 57
56410 Montabaur
Germany
When you visit our website, IONOS, as hosting provider, processes personal data, in particular technical access data and server log files, in the course of providing, maintaining and securing our website.
Insofar as IONOS processes personal data on our behalf, this is done on the basis of a data processing agreement pursuant to Art. 28 GDPR.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure, stable and efficient provision of our online offering.
6. Encryption
For security reasons, our website uses transport encryption, in particular TLS/SSL. You can recognise an encrypted connection by the fact that the address bar of your browser begins with “https://”. This is intended to protect data you transmit to us from unauthorised access by third parties.
7. Cookies and Similar Technologies
Our website uses cookies and similar technologies. Cookies are small text files that are stored on your device. Comparable technologies may include, for example, local storage, session storage, pixels or similar identifiers.
We distinguish between technically necessary and optional technologies.
7.1 Technically Necessary Cookies
Technically necessary cookies are required for the website to function properly. They may be required, for example, for login functions, shopping cart or enquiry functions, language settings, security functions or storing your privacy preferences.
The legal basis for the processing of personal data is Art. 6(1)(f) GDPR. Our legitimate interest lies in the technically secure and functional provision of the website. Insofar as access to information on your device is required, this is done on the basis of § 25 (2) TDDDG.
7.2 Optional Cookies, Analytics and Marketing Services
We use optional cookies and comparable technologies, in particular for analytics, statistics, marketing, remarketing or external media, only if you have given your prior consent.
The legal basis is Art. 6(1)(a) GDPR and § 25 (1) TDDDG. You can withdraw any consent you have given at any time with effect for the future.
The specific services we use are described in sections 8 to 9 below.
8. Cookie Consent Management
Insofar as we use a consent or cookie consent tool, it processes your privacy preferences, in particular:
- consent status,
- date and time of your selection,
- technical information about the device and browser used,
- where applicable, a pseudonymous consent ID.
The processing takes place in order to document your consents in a legally compliant manner and to implement your privacy settings.
The legal basis is Art. 6(1)(c) GDPR, insofar as we are legally obliged to provide evidence of consent, and Art. 6(1)(f) GDPR on the basis of our legitimate interest in the proper and verifiable implementation of data protection requirements.
9. Google Services
On our website we use various services of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). The provider for users outside the European Economic Area is Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
When these services are used, personal data, in particular your IP address, may be transferred to Google servers, including in the USA. For data transfers to the USA, Google relies on the EU-US Data Privacy Framework and, additionally, on EU Standard Contractual Clauses. Further information can be found in Google's privacy policy at https://policies.google.com/privacy.
9.1 Google Fonts
We use Google Fonts for the uniform display of fonts. When you open a page, your browser loads the required fonts. If the fonts are loaded from Google servers, your IP address is transmitted to Google.
Insofar as the fonts are loaded dynamically from Google servers, this requires your consent. In that case, the legal basis is Art. 6(1)(a) GDPR and § 25 (1) TDDDG. If the fonts are delivered locally from our own server, no data is transmitted to Google; in this respect, the legal basis is Art. 6(1)(f) GDPR (legitimate interest in a uniform presentation of our online offering).
9.2 Google Maps
We use Google Maps to display maps and directions. When you open a page with an embedded map, information about your use, in particular your IP address and location data, is transmitted to Google and processed there.
The map is only embedded if you have given your prior consent. The legal basis is Art. 6(1)(a) GDPR and § 25 (1) TDDDG. You can withdraw your consent at any time with effect for the future.
9.3 Google Analytics and Google Tag Manager
We use Google Analytics, a web analytics service provided by Google, to evaluate the use of our website and to improve our offering. Google Analytics uses cookies and similar technologies that enable an analysis of the use of the website. The information generated about your use, in particular IP address, device and browser information, pages visited, time spent and interactions, is transmitted to Google and stored there. Where available, we use IP anonymisation, so that your IP address is first truncated by Google within the EU/EEA.
We also use Google Tag Manager to manage and embed tags and scripts. Tag Manager itself generally does not store any personal data, but serves to trigger other services (such as Google Analytics), which in turn may process personal data.
Google Analytics and the services embedded through it are used exclusively on the basis of your consent. The legal basis is Art. 6(1)(a) GDPR and § 25 (1) TDDDG. You can withdraw your consent at any time with effect for the future by adjusting your selection in the consent banner.
10. Contact by E-mail, Telephone or Contact Form
If you contact us by e-mail, telephone, contact form or by other means, we process the data you provide. This may include in particular:
- name,
- company,
- address,
- telephone number,
- e-mail address,
- customer number,
- content of the enquiry,
- communication history,
- technical metadata.
The processing takes place in order to handle your enquiry, to communicate with you and, where applicable, to carry out pre-contractual measures or existing contractual relationships.
The legal basis is Art. 6(1)(b) GDPR, insofar as the enquiry is related to a contract or pre-contractual measures. In all other cases, the processing is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in the proper handling and documentation of enquiries.
10.1 Chat assistant in the customer account
On www.original-carparts.com we offer logged-in customers a chat assistant (“Elmi AI”). Its answers are generated automatically, including by means of AI language models. The chat is shown only after you have logged in to your customer account, and it is used only when you write a message yourself.
In doing so we process: the content of your messages and of the answers, a pseudonymous identifier of your customer account (hash value, no name and no e-mail address), a chat session identifier, your IP address as well as the time and technical information about your browser and device. Please do not enter sensitive data (e.g. passwords, bank or health data) in the chat.
The chat is operated via the automation platform n8n, which our service provider Genum (genum.ai) hosts for us; the messages are transmitted to and processed on its servers. Your browser loads the chat window (program code of the n8n project) from the jsDelivr network (cdn.jsdelivr.net); in doing so your IP address is transmitted to jsDelivr. The chat window stores the session identifier in your browser’s local storage so that the conversation is kept when you change pages; this is strictly necessary for the service you have requested (Section 25(2) no. 2 TDDDG). Data processing agreements pursuant to Art. 28 GDPR have been concluded with the service providers; Section 19 applies to transfers to third countries.
The legal basis is Art. 6(1)(b) GDPR insofar as your enquiry relates to a contract or pre-contractual measures, otherwise Art. 6(1)(f) GDPR. Our legitimate interest lies in answering customer enquiries quickly around the clock. Chat histories are deleted as soon as they are no longer required for handling your enquiry, unless statutory retention obligations apply (Section 20). Use of the chat is voluntary; you can also reach us by e-mail or telephone at any time. The chat does not make any automated decisions within the meaning of Art. 22 GDPR.
11. Registration and Customer Account
Registration or a customer account may be required for certain functions of our website, in particular in the B2B area. In this context, we process in particular:
- name and contact details of the contact person,
- company data,
- billing and delivery address,
- telephone number and e-mail address,
- login data,
- customer number,
- roles and permissions,
- order, quotation and communication history.
The processing takes place in order to set up and manage the customer account, to identify the user, to process enquiries and orders and to conduct the business relationship.
The legal basis is Art. 6(1)(b) GDPR. Insofar as the processing is necessary for the security of the customer account, the prevention of misuse or documentation, it is additionally based on Art. 6(1)(f) GDPR.
12. Quotations, Orders and Contract Processing
If you request or order goods from us or conclude contracts with us, we process personal data that is necessary for preparing quotations, performing the contract, delivery, invoicing, payment processing and customer service.
This may include in particular:
- name and contact details of contact persons,
- company data,
- billing and delivery addresses,
- order data,
- vehicle and parts information, insofar as necessary for processing,
- payment data,
- communication data,
- documents and records in connection with export, shipping, customs or tax matters.
The legal basis is Art. 6(1)(b) GDPR. Insofar as statutory retention, tax, commercial, customs or export control obligations exist, the legal basis is Art. 6(1)(c) GDPR. Insofar as data is processed to enforce or defend against claims, this is done on the basis of Art. 6(1)(f) GDPR.
13. B2B Business, Suppliers, Manufacturers, Freight Forwarders, Customs and Authorities
In the course of our business activities as a supplier of original, OEM and replacement parts, personal data may be transferred to third parties insofar as this is necessary for contract processing, delivery, payment processing or compliance with legal obligations.
Recipients may include in particular:
- manufacturers and suppliers,
- freight forwarders, shipping service providers and logistics companies,
- customs agents and customs authorities,
- tax advisors, auditors and lawyers,
- banks and payment service providers,
- IT and software service providers,
- authorities, insofar as there is a legal obligation.
Data is only transferred insofar as there is a legal basis for doing so. This may in particular be Art. 6(1)(b) GDPR, Art. 6(1)(c) GDPR or Art. 6(1)(f) GDPR.
14. Export Control, Sanctions List Screening and Compliance
As we operate in international trade, we may process personal data in order to meet legal and contractual compliance requirements. This may relate in particular to checks in connection with export control, customs, sanctions lists, embargoes, end-use certificates, delivery restrictions, fraud prevention and anti-money laundering.
The following data in particular may be processed in this context:
- name and contact details of contact persons,
- company data,
- register data,
- beneficial owners, where necessary,
- delivery and destination countries,
- contract and order data,
- communication and supporting documents.
The legal basis is Art. 6(1)(c) GDPR, insofar as we are legally obliged to carry out such checks. Insofar as the checks serve to protect our company against legal violations, economic damage or breaches of contractual obligations, the processing is based on Art. 6(1)(f) GDPR.
15. Payment Processing and Receivables Management
For payments, we process the data required for payment processing, in particular payment amount, payment date, bank details, payment reference, invoice number and customer data.
The legal basis is Art. 6(1)(b) GDPR. Insofar as retention obligations under tax or commercial law exist, the processing is based on Art. 6(1)(c) GDPR. In the case of enforcement of claims, dunning or legal proceedings, the processing is based on Art. 6(1)(f) GDPR.
16. Direct Marketing to Existing Customers
We may use contact details of existing customers to inform them about our own similar goods or services, insofar as this is legally permissible.
The legal basis may be Art. 6(1)(f) GDPR. Our legitimate interest lies in maintaining existing customer relationships and in direct marketing of our own goods and services.
You may object to the processing of your data for direct marketing purposes at any time. In this case, we will no longer use your data for direct marketing.
17. Job Applications
If you apply for a position with us, we process the application data you provide. This may include in particular:
- name and contact details,
- CV,
- certificates and references,
- qualifications,
- professional background,
- communication data,
- other information provided by you.
The processing takes place in order to carry out the application procedure. The legal basis is Art. 6(1)(b) GDPR in conjunction with § 26 BDSG, insofar as this is necessary for the decision on establishing an employment relationship.
Application documents are generally deleted as soon as they are no longer required for the application procedure and no statutory retention obligations or legitimate interests preclude deletion. In the event of rejection, deletion generally takes place after expiry of appropriate periods for defending against possible claims, unless you have consented to longer storage.
18. Data from Other Sources
In the course of our business activities, we may receive personal data not only directly from you but also from other sources. This may be the case in particular with business contacts, contact persons of customers, suppliers and service providers, publicly accessible company and commercial registers, sanctions lists, credit agencies or other publicly accessible sources.
In particular, names, business contact details, position in the company, company affiliation, register data and business-related communication data may be processed in this context.
The processing takes place in order to conduct and initiate business relationships, to screen business partners, to comply with legal obligations and to safeguard legitimate interests in proper, secure and lawful business operations.
The legal bases are Art. 6(1)(b) GDPR, Art. 6(1)(c) GDPR and Art. 6(1)(f) GDPR.
19. Data Transfers to Third Countries
Personal data is only transferred to countries outside the European Union or the European Economic Area insofar as this is legally permissible.
This may be the case in particular if:
- the transfer is necessary for the performance of a contract,
- an adequacy decision of the European Commission exists,
- appropriate safeguards, in particular EU Standard Contractual Clauses, have been agreed,
- you have given your consent,
- or a statutory exception applies.
In connection with the Google services we use (see section 9), personal data may be transferred to the USA. Google is certified under the EU-US Data Privacy Framework; EU Standard Contractual Clauses apply additionally.
In the international spare parts trade, it may also be necessary to transfer business-related contact details to recipients in third countries, insofar as this is necessary for handling an enquiry, delivery, customs clearance, export processing or performance of a contract.
20. Storage Period
We store personal data only for as long as is necessary for the respective purposes or as long as statutory retention obligations exist.
Business letters, invoices, tax-relevant documents and documents relevant under commercial law may generally be retained for six to ten years in accordance with statutory provisions. Data required for the establishment, exercise or defence of legal claims may be stored for the duration of the statutory limitation periods.
Insofar as data is processed exclusively on the basis of consent, we generally store it only until the consent is withdrawn, unless there is another legal basis for further storage.
21. Recipients of Personal Data
We only disclose personal data if this is permitted by law or if you have given your consent.
Recipients may include in particular:
- responsible internal departments,
- IT service providers and hosting providers,
- payment service providers and banks,
- tax advisors, auditors, lawyers,
- shipping and logistics service providers,
- suppliers and manufacturers,
- customs and export service providers,
- authorities, courts and public bodies,
- debt collection service providers, where necessary.
Insofar as service providers process personal data on our behalf, we conclude data processing agreements with them pursuant to Art. 28 GDPR.
22. No Automated Decision-Making
As a rule, we do not make decisions based solely on automated processing, including profiling, which produce legal effects concerning you or similarly significantly affect you.
Should we use such procedures in the future, we will inform you separately.
23. Obligation to Provide Personal Data
The provision of personal data is in some cases required by law or contract. We need certain data for an enquiry, registration, preparation of a quotation, order, delivery, invoicing or payment processing. Without this data, we may be unable to provide the respective service, or able to provide it only to a limited extent.
There is no obligation to provide voluntary information or consent.
24. Your Rights
Subject to the statutory provisions, you have the following rights:
- right of access to the personal data processed by us,
- right to rectification of inaccurate data,
- right to erasure,
- right to restriction of processing,
- right to data portability,
- right to object to certain processing,
- right to withdraw consent given, with effect for the future,
- right to lodge a complaint with a data protection supervisory authority.
You can contact us at any time to exercise your rights.
25. Withdrawal of Consent
If processing is based on your consent, you can withdraw this consent at any time with effect for the future. The lawfulness of the processing carried out until the withdrawal remains unaffected.
26. Right to Object under Art. 21 GDPR
If we process personal data on the basis of Art. 6(1)(f) GDPR, you have the right to object to this processing at any time on grounds relating to your particular situation.
If personal data is processed for direct marketing purposes, you have the right to object at any time to processing for the purpose of such marketing. Following an objection, we will no longer use your personal data for direct marketing.
27. Right to Lodge a Complaint with the Supervisory Authority
You have the right to lodge a complaint with a data protection supervisory authority if you consider that the processing of your personal data infringes data protection law.
The competent authority for North Rhine-Westphalia is in particular:
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia)
Kavalleriestraße 2–4
40213 Düsseldorf
Germany
Phone: +49 (0)211 / 38424-0
E-mail: poststelle@ldi.nrw.de
Website: www.ldi.nrw.de
28. Updates to this Privacy Policy
We reserve the right to amend this privacy policy if our website, our business processes, the services used or the legal requirements change. The current version published on our website applies in each case.
Display of country-specific contact details
To show you the contact details responsible for your country, we determine the country you are accessing our website from based on your IP address. The lookup takes place exclusively on our own server using a locally stored country list; your IP address is not transmitted to third parties for this purpose. Only the determined country is stored, together with the IP address, in your session, which ends when you close your browser or when the session expires. The determined country is not stored in log files and no profiling takes place. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is to show you the appropriate contact persons.
The country list is based on "IP to Country Lite" (extract, limited to individual countries) by DB-IP (https://db-ip.com), licensed under Creative Commons Attribution 4.0 International (CC BY 4.0). IP Geolocation by DB-IP.
