Privacy policy

FindeWerkstatt.de is a directory of car workshops and auto services in Germany. This policy explains which data we process when you visit the website, submit enquiries and maintain business profiles.

1. Controller and contact details

The controller responsible for the processing described in this policy is:

Kocasinan
Kayseri
Türkei
E-Mail: admin@findewerkstatt.de

For data protection questions and requests to correct or remove listings, you can contact us by email or through the contact form . For questions about a business profile, please identify the business and the relevant profile address.

2. Website access and hosting

When you access the website, technical access data is processed, in particular your IP address, the requested page or file and the time of access. The hosting service used may record this information in server logs. Processing enables delivery of the website, troubleshooting and protection against abusive access. It is based on our legitimate interest in providing an accessible and secure directory under Article 6(1)(f) GDPR.

During a workshop search, your search terms and selected filters are processed to display suitable businesses. This information may also be included in technical access logs as part of the requested address.

Hosting and location of data processing:
Güzel Hosting

Server logs are needed for as long as they are required for troubleshooting, secure operation or investigation of a specific security incident. Backups enable restoration of the website; their retention depends on the backup cycle used. Hosting providers and, where applicable, email providers may process data to the extent necessary to operate the website and send messages.

3. Contact form and email

The contact form requires your name, email address and message; the subject is optional. We also store the time when you acknowledge the privacy notice. This information is used to handle your enquiry. For a contract-related enquiry or pre-contractual measure requested by you, the legal basis is Article 6(1)(b) GDPR; for other matters, it is our legitimate interest in responding to and documenting enquiries under Article 6(1)(f) GDPR.

The message is stored in a protected website inbox accessible only to appropriately authorised administrators. An attempt is also made to send a notification to our stored contact address. This email contains your name, email address, subject and the full message text. The email service used to send it also processes this information. If sending fails, the enquiry remains in the protected inbox.

Contact enquiries older than 180 days are removed from the inbox by a regularly scheduled cleanup. If the trash function is enabled, they are moved there first; permanent deletion depends on its settings. Execution may be delayed depending on the operation of the website. Email copies and backups are not automatically deleted by this cleanup. Email retention depends on the need to handle the enquiry, any statutory retention obligations and the necessity to establish or defend legal claims; backup retention depends on the restoration purpose and backup cycle.

If you email us directly, we process the content you provide, your sender address and the technical details of the message to handle your request. These emails are retained in the email service used and are not deleted by cleanup of the website inbox.

4. Workshop listing submissions and publication

For a listing submission, we process the business name, email address, phone number and specified location with its federal state. Depending on the information you provide, this may also include the contact person's name, a WhatsApp number, website, street and building number, postcode, business description, services, car brands and information about master workshop status or emergency service. We store your acknowledgement of the privacy notice and an identifier used to detect duplicate submissions.

The information is initially stored for review. The business profile appears publicly only after approval. The contact person's name remains internal. We use your email address for communication and publish it only if you select the separate option for a public contact address. After approval, details such as the business name, business address, phone number, website, description and services may be accessed by website visitors and search engines.

Processing your requested listing submission and providing the listing are based on Article 6(1)(b) GDPR to the extent necessary for the listing arrangement agreed with you. If you act as a business contact person, we process your contact details based on our legitimate interest in coordinating and maintaining the listing under Article 6(1)(f) GDPR. Voluntary publication of a personal email address is based on your consent under Article 6(1)(a) GDPR. You may withdraw this consent for the future using the contact options in section 1; this does not affect prior processing.

Information marked with * is required to process the listing submission. Further information and authorisation to publish the email address are voluntary. There is no uniform automatic deletion period for submissions and business profiles. Retention depends on review and maintenance of the listing and handling requests for changes or removal. Submissions not yet approved remain stored in the review area until handled. Please contact us if you wish to withdraw a submission or have a published listing changed.

5. Business data from Google Maps – origin and deletion

The imported business data originally comes from publicly accessible business listings on Google Maps. It was recorded in the previous workshop directory on FindeWerkstatt.de and transferred to the current directory using the supplied export. In particular, this includes business names, business addresses, locations, phone numbers and the types of services specified there. This information about the source supplements the notices required under Article 14 GDPR. Where details relate to a natural person, such as the owner of a sole proprietorship, they constitute personal data.

We use this information to continue, organise and maintain the publicly accessible workshop directory. Our interest and the interest of visitors are to be able to find businesses by their location and contact details. The legal basis for this processing of personal data is Article 6(1)(f) GDPR. Publicly available business information is not exempt from data protection rights.

After publication, website visitors and search engines may access the profile information. Incomplete or inconsistent listings may remain stored internally for review. Source identifiers, records of assignments and review notes are documented internally to trace the origin, corrections and duplicate listings; these records do not appear in the public profile.

There is no fixed automatic deletion period for imported profiles and their internal source records. The determining factor is whether the information is still needed for a current directory listing, its maintenance or evidence of a correction. You may ask us about the origin of a particular listing, report inaccurate information, request removal or object as described in section 9.

Deletion on request: As a business owner or authorised person, you may request removal of your listing and deletion of the associated business data from our active database. Write to admin@findewerkstatt.de or use the contact form. Please provide the business name, location and, if possible, the profile page address. After verifying your authority, we remove the listing and delete the data unless statutory retention obligations prevent us from doing so. Any information that must be retained by law is stored only for that purpose.

Deletion concerns the data stored by FindeWerkstatt.de; it does not change the original listing on Google Maps. Data may remain in backups until the end of the relevant backup cycle. The statutory data protection rights of data subjects apply regardless of whether they are authorised to represent the business.

6. Cookies and form protection

The workshop search and the contact and listing forms do not use analytics or advertising cookies and do not load external fonts. When you log in to your workshop account or the administration area, WordPress uses technically necessary cookies for authentication and session protection. Without “Remember me”, login normally expires after two days; with that option, after 14 days. Logging out ends the login in this browser. Where storage on or access to your device is strictly necessary for a service explicitly requested by you, the applicable provision is § 25 Abs. 2 TDDDG. Processing of personal data is also governed by the GDPR.

To protect against automated or repeated submissions, we use form checks and time-limited identifiers on the server. To limit submissions, an identifier is derived from your IP address using a secret key. The limit operates within a time window of no more than one hour; the unchanged IP address is not stored as part of this form protection. This processing serves our legitimate interest in protecting the forms under Article 6(1)(f) GDPR.

On the account page, a random protection identifier is stored as a technically necessary cookie for 30 minutes before login. It binds the registration and login forms to your browser and protects against unwanted logins initiated by other websites.

If a form error occurs, the information you entered may be cached on the server for up to 15 minutes so that you can correct it. This temporary information is removed on first access. An additional form submission identifier remains valid for up to two hours. A lock identifier against processing the same submission more than once is scheduled for cleanup after one day; actual cleanup depends on execution of scheduled tasks. These periods do not replace the retention periods for received enquiries and listings described in sections 3 to 5.

7. Google Maps, WhatsApp and external links

Workshop profiles provide links to Google Maps, WhatsApp and, where applicable, the business website. Maps and chats are not embedded in the page. If you open one of these links, you leave our website and the respective provider may process your IP address and technical access data, among other information. The external links used on profiles suppress transmission of the originating page as an HTTP referrer; information in the destination address is nevertheless transmitted to the provider.

Google Maps: The link contains a search query with the business name and stored address and location details. The applicable policy is the Google privacy policy (opens in a new tab).

WhatsApp: The link uses a valid separate WhatsApp number or, as a fallback, the stored business phone number. Please confirm directly with the business whether it uses that number on WhatsApp. The link contains the destination number and a prepared message text with the business name. The message is sent only after you confirm this in WhatsApp. The applicable policy is the WhatsApp privacy policy (opens in a new tab).

The respective provider is responsible for further use of these services and for processing on linked business websites. Information about recipients, retention periods and possible processing outside the EU or EEA is available in that provider's privacy notices.

8. Your data protection rights

Subject to the statutory requirements, you may request access to your data, its rectification or erasure, and restriction of processing. You may also have the right to data portability and to withdraw consent you have given. Withdrawal concerns future use and does not affect processing that was lawful up to that point. Please contact us using section 1.

You may also lodge a complaint with a data protection supervisory authority, in particular in the EU Member State of your habitual residence, place of work or the alleged infringement. The listing submissions described above are reviewed before publication; we do not make decisions about data subjects based solely on automated processing that have legal or similarly significant effects.

9. Right to object under Article 21 GDPR

You may object at any time to processing based on legitimate interests on grounds relating to your particular personal situation. This applies in particular to personal information in imported business profiles.

Following such an objection, we continue the relevant processing only if overriding compelling grounds can be demonstrated or if it is necessary to establish or defend legal claims. Otherwise, we stop the processing. If data is used for direct marketing, you may object to that use at any time; use for that purpose will then cease.

Send your objection to admin@findewerkstatt.de or through the contact form. Please describe which data or profile is affected so that we can identify your request.

10. Workshop accounts and plan requests

A workshop account requires your name, email address and a password. We do not ask for a plan or create a plan request when you create an account. The plan is selected when you add a business. WordPress stores the password as a hash. We also store acknowledgement of the terms of use and privacy notices with a timestamp and version, the active plan, any later plan request and its review status, and the assignment of your business listings. Your account name and account email address do not automatically appear in the public business profile.

When you claim an existing listing, we store the information you provide about your authority to represent the business. When you request a change, we store the requested business details and, after approval, the previous values as an internal review record. These requests are accessible only to your account and authorised administrators. Review is manual; a matching email address alone does not result in assignment. Plan changes also take effect only after approval and currently do not trigger any payment.

Processing serves to provide your account and handle the listing and plan requests you have made on the basis of Art. 6 Abs. 1 Buchst. b DSGVO. Verifying authority to represent the business and documenting changes also serve our legitimate interest in preventing unauthorised changes and maintaining traceable listings under Article 6(1)(f) GDPR.

Account data and open requests are stored for the duration of the account and their processing. There is currently no automatic deletion period for completed review records; the determining factors are ongoing maintenance needs, statutory retention obligations and the necessity to clarify specific claims. You may request account closure and deletion of information no longer needed using section 1. The public business profile is not automatically removed as a result; you may request its removal at the same time. The public email address is subject to the separate information in section 4.

Support messages in the workshop account

For chat we store the message text, linked workshop account, sender, timestamp and read status. Only the member concerned and authorised administrators have access. Chat updates regularly while the account is open. Messages are retained during account use and removed when the linked workshop account is deleted. You can request access or deletion through our contact address.

Business listing statistics

After your analytics consent we count profile views and clicks on phone and WhatsApp links as daily totals per business. This statistic contains no permanent IP addresses or visitor profiles. A check value generated with a secret key is cached for ten seconds to limit repeated requests. The statistic counts events, not unique people. Daily totals are removed after 400 days through regular cleanup, whose execution depends on website operation. Business owners see only the statistics of their linked listings.