1. Controller
Who processes your data?
[Bitte ergänzen: vollständiger Betreiber-/Firmenname] [Bitte ergänzen: Rechtsform][Bitte ergänzen: Straße und Hausnummer]
[Bitte ergänzen: PLZ] [Bitte ergänzen: Ort]
Germany
Email: mobi24@amopers.de
2. Basics
Legal bases for processing
We process personal data only where a legal basis exists. Depending on the processing, these include:
- Article 6(1)(b) GDPR for performing a user agreement and taking pre-contractual steps;
- Article 6(1)(c) GDPR for complying with legal obligations;
- Article 6(1)(f) GDPR for legitimate interests, particularly secure, functional and abuse-free operation of the platform;
- Article 6(1)(a) GDPR where we expressly request your consent.
3. Visiting the website
Hosting and server logs
When you visit Mobi24, the web server processes connection data that is technically necessary. This may include your IP address, date and time, requested file, transferred data volume, referrer URL, browser, operating system and HTTP status. The processing serves website delivery, system security, error analysis and protection against misuse.
The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of the platform.
Hosting provider: STRATO AG, Otto-Ostrowski-Straße 7, 10249 Berlin, Deutschland. Where the service provider processes personal data on our behalf, this takes place under a data processing agreement.
Language selection and automatic translations
We store the selected language in the session and in the ‘mobi_language’ cookie for up to twelve months. For signed-in users, the selected language is also associated with their account so that confirmation emails can be sent in the appropriate language.
When automatic translation is enabled, published vehicle descriptions, public dealer descriptions and newly added search attributes are sent to Microsoft Translator. We store the results in our database and reuse them on subsequent page visits. Changes to the original text trigger a new translation. The translation function does not access private messages, login credentials or dealer verification documents.
5. Registration
User account and email confirmation
On registration, we process the master, contact, address, company and login details you enter. Required fields depend on the registration form and the chosen account type. Passwords are stored exclusively as cryptographic hashes.
We send a time-limited confirmation link to verify your email address. Unconfirmed registrations are automatically deleted after three days. The legal basis is Article 6(1)(b) GDPR; protection against spam and fraudulent registrations is additionally based on Article 6(1)(f) GDPR.
Dealer verification
Dealers submit additional company information and verification documents. These are processed solely to check identity and plausibility, approve accounts and prevent misuse. Only authorised administrators have access. The legal basis is Article 6(1)(b) and (f) GDPR.
6. Platform features
Listings, dealer profiles and vehicle images
When a listing is created, we process vehicle details, descriptions, prices, uploaded images and the link to the dealer account. Active listings are displayed with the intended public dealer information. Please do not publish unnecessary personal data, documents, number plates or identifiable people in free text or images.
The legal basis is Article 6(1)(b) GDPR. Reviewing, blocking and documenting unlawful or abusive listings is based on Article 6(1)(c) and (f) GDPR.
Favourites
Signed-in buyers can save vehicles as favourites. We process account and vehicle identifiers for this purpose. The link is visible only in the protected user area. The legal basis is Article 6(1)(b) GDPR.
Internal messages
When you use messaging, we process sender, recipient, vehicle reference, timestamps and message content to provide, track and protect communication against misuse. Authorised administrators may access conversations for platform support and abuse checks. The legal basis is Article 6(1)(b) and (f) GDPR.
7. Direct enquiries
Contact form and email
When you contact us, we process your name, email address, optional phone number and page reference, subject and message. Required fields are marked in the form. We use these details to handle and answer your enquiry.
The legal basis is Article 6(1)(b) GDPR for contractual or pre-contractual enquiries, and otherwise Article 6(1)(f) GDPR. Our legitimate interest is orderly, traceable communication. Legal reports may also be processed to comply with obligations under Article 6(1)(c) GDPR.
8. Transactional emails
Email delivery
Registration, activation and contact emails are sent through the configured SMTP service. Recipient address, subject, message content and technical delivery data are processed. The legal basis is Article 6(1)(b), (c) or (f) GDPR, depending on the purpose of the message.
9. External content
Google Maps
Vehicle detail pages may embed a Google Maps map of the dealer’s location. Loading it may allow Google to process your IP address, device and browser information and the page visited. The EEA provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data may be transferred to Google LLC in the USA.
The map may load only after your active choice. The legal basis is your consent under Article 6(1)(a) GDPR and section 25(1) TDDDG. You can withdraw consent for the future by reloading the page and not activating the map again. The external directions link opens only when you click it.
Boxicons via jsDelivr
Protected user and administration areas load Boxicons icons through the jsDelivr content delivery network. The CDN provider receives technically necessary connection data, particularly your IP address. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is a stable, consistent display of protected interfaces. Processing outside the EU or EEA cannot be ruled out.
10. Recipients
Service providers and transfers
We disclose personal data only where necessary for the stated purposes, legally permitted or consented to by you. Recipients may include hosting, email, IT and security providers, competent authorities, and legal and tax advisers. Processors are contractually bound under Article 28 GDPR.
For services that may process data in third countries, transfers are based where necessary on an adequacy decision, appropriate safeguards such as EU standard contractual clauses, or a statutory exception. Despite these measures, third countries may have a level of data protection different from the EU.
11. Deletion
Retention periods
We retain personal data only for as long as necessary for its purpose. It is then deleted or anonymised unless statutory retention obligations, legitimate evidence-preservation interests or ongoing legal proceedings require otherwise.
- Unconfirmed registrations: deletion after three days.
- Newsletter: periods and cleanup as described under “Newsletter and consent”.
- Account data: generally until account deletion; thereafter only as required by statutory obligations or legitimate claims.
- Dealer documents: generally until verification is complete, and longer only if needed for ongoing verification, abuse prevention or legal obligations.
- Contact enquiries: until final handling, and thereafter as necessary for evidence and retention purposes.
- Server logs: only as long as needed for operation, error analysis and security.
12. Data subject rights
Your data protection rights
Subject to statutory requirements, you have rights of access, rectification, erasure, restriction of processing and data portability. You may withdraw consent at any time with effect for the future.
Objection: Where we process data under Article 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation. You may object to direct marketing at any time without giving reasons.
To exercise your rights, simply send a message to mobi24@amopers.de. We may request suitable proof of identity where there are reasonable doubts about your identity.
13. Supervision
Right to complain
You have the right to complain to a data protection supervisory authority, particularly the authority at the controller’s registered office or your place of residence. The German Data Protection Conference provides a list of German supervisory authorities.
14. Further information
Security and automated decisions
We take appropriate technical and organisational measures to protect personal data against loss, manipulation and unauthorised access. Please use a unique, secure password and do not share login credentials.
This version of the website does not carry out exclusively automated decision-making, including profiling, under Article 22 GDPR.
We update this privacy policy when required by features, service providers or legal changes. The version published on this page applies.