DATA PROTECTION

for the Manheim Express platform

With this data protection declaration we would like to inform you about how we process personal data and inform you about your rights. We are aware of the importance of the processing of personal data for you as a user concerned and accordingly observe all relevant legal requirements. The protection of your privacy is of the utmost importance to us. The processing of your personal data by us takes place in compliance with the General Data Protection Regulation and the national data protection regulations.

RESPONSIBLE FOR DATA PROCESSING

Cox Automotive Remarketing GmbH

Bubenheimer Bann 11

56070 Koblenz

Phone: 0261 9836900

Commercial register number: HRB 23172

Commercial register and register court: Koblenz District Court

Sales tax identification number (according to §27a sales tax law): DE253831477

Authorized representatives: Martin Forbes, Ryan Carson, Sebastian Fuchs

E-mail: info@manheim-express.de

Contact details of the data protection officer: dataprotection@coxauto.co.uk .

DEFINITIONS

This data protection declaration uses the terminology of the General Data Protection Regulation (GDPR).

“Personal data” is all information that relates to an identified or identifiable natural person (hereinafter “data subject”); A natural person is regarded as identifiable who can be identified directly or indirectly, in particular by means of assignment to an identifier such as a name, an identification number, location data, an online identifier or one or more special features that express the physical , physiological, genetic, psychological, economic, cultural or social identity of this natural person.

“Processing” is any process carried out with or without the help of automated processes or any such series of processes in connection with personal data such as the collection, recording, organization, ordering, storage, adaptation or modification, reading, querying, use, the Disclosure by transmission, distribution or any other form of provision, comparison or linking, restriction, deletion or destruction.

“Restriction of processing” is the marking of stored personal data with the aim of restricting their future processing.

“Profiling” is any type of automated processing of personal data that consists of using this personal data to evaluate certain personal aspects relating to a natural person, in particular aspects relating to work performance, economic situation, health, personal preferences, To analyze or predict the interests, reliability, behavior, whereabouts or relocation of this natural person.

“Pseudonymization” is the processing of personal data in such a way that the personal data can no longer be assigned to a specific data subject without the use of additional information, provided that this additional information is stored separately and is subject to technical and organizational measures that ensure that the personal data is not a identified or identifiable natural person.

“File system” is any structured collection of personal data that is accessible according to certain criteria, regardless of whether this collection is managed centrally, decentrally or according to functional or geographical criteria;

“Responsible person” is the natural or legal person, authority, institution or other body that alone or jointly with others decides on the purposes and means of processing personal data; If the purposes and means of this processing are specified by Union law or the law of the member states, the person responsible or the specific criteria for his appointment can be provided for in accordance with Union law or the law of the member states.

“Processor” is a natural or legal person, authority, institution or other body that processes personal data on behalf of the person responsible.

“Recipient” is a natural or legal person, authority, institution or other body to which personal data is disclosed, regardless of whether it is a third party or not. Authorities that may receive personal data as part of a specific investigation according to Union law or the law of the member states are not considered recipients; The processing of this data by the named authorities is carried out in accordance with the applicable data protection regulations in accordance with the purposes of the processing.

“Third” is a natural or legal person, authority, institution or other body, apart from the data subject, the person responsible, the processor and the persons who are authorized to process the personal data under the direct responsibility of the person responsible or the processor.

“Consent” is the voluntary declaration of intent given to the data subject in an informed manner and unambiguously in the form of a declaration or other unequivocal affirmative action with which the data subject indicates that he or she agrees to the processing of the personal data concerning them .

PROCESSING OPERATIONS

We collect and process the following personal data about you:

• Contact, address and sales information, provided you have provided us with your contact information or registered on our site,
• Online identifiers (e.g. your IP address, browser type and browser version, the operating system used, the referrer URL, the IP address, the file name, the access status, the amount of data transferred, the date and time of the server request),
• The chassis numbers of the traded vehicles, if you have logged in.
• Social media identifiers.
• We collect copies of ID cards and other identification documents as part of our reviews when you register.

DATA PROCESSING PURPOSES

We process your data for the following purposes:

• for the contact you want,
• for information about our offer
• for contract processing, esp. for the provision and processing of the Manheim Express platform.
• for advertising purposes,
• to send the e-mail newsletter, provided you have registered for this,
• for quality assurance and
• for our statistics.

LEGAL BASIS FOR DATA PROCESSING

The processing of your data takes place on the following legal bases:

• Your consent according to Art. 6 Para. 1 lit. a) GDPR,
• to execute a contract with you in accordance with Art. 6 Para. 1 lit. b) GDPR,
• to fulfill legal obligations according to Art. 6 Para. 1 lit. c) GDPR or
• from a legitimate interest according to Art. 6 Para. 1 lit. f) GDPR.

Unless we are processing your personal data legitimate interests with the meaning of. Art. 6 para. 1 lit. f) GDPR based, are such

• the improvement of our offer,
• protection against abuse and
• keeping our statistics.

DATA SOURCES

We receive the data from you (including about the devices you use). If we do not collect the personal data directly from you, we will also inform you from which source the personal data originate and, if applicable, whether they originate from publicly accessible sources. We also receive data about you from Herpolsheimer, who carry out checks on our behalf.

The personal data that is collected from you during the registration process is necessary so that we can enter into a contract with you and provide you with services. If you do not provide us with this data, we will not be able to process your application.

TRANSMISSION / DATA RECEIVER

When processing your data, we work with the following service providers who have access to your data:

• Providers of web analysis tools,
• Web hosting provider,
• Payment service provider, in particular, if this option is used, to Ingenico e-Commerce Solutions SPRL / BVBA, Da Vincilaan 3, 1930 Zaventem, Belgium.
• Transport service provider,
• Schufa.
• Herpolsheimer

Data is transferred to third countries outside the European Union. This is done on the basis of statutory contractual provisions that are intended to ensure adequate protection of your data and which you can view on request.

We also transmit your data to the parties involved in the sales campaign, in particular the dealers.

DURATION OF PROCESSING

We only store your personal data for as long as it is necessary to achieve the processing purpose or the storage is subject to a statutory retention period.
We save your data

• if you have consented to the processing, at most until you revoke your consent,
• if we need the data for the execution of a contract at most as long as the contractual relationship with you exists or statutory retention periods run,
• if we use the data on the basis of a legitimate interest, at most as long as your interest in deletion or anonymization does not prevail.

YOUR RIGHTS

You have – in some cases under certain conditions – the right

• free of charge information desk to request the processing of your data, as well as the receipt of a Copy Of your personal data. You can request information about the purposes of the processing, the categories of personal data being processed, the recipient of the data (if it is passed on), the duration of storage or the criteria for determining the duration;
• Your data to If your personal data is incomplete, you have the right to complete the data, taking into account the processing purposes;
• your data Clear or lock allow. Reasons for the existence of a right to erasure / blocking can include the revocation of the consent on which the processing is based, the person concerned objects to the processing, the personal data has been processed unlawfully;
• the processing to be restricted ;
• the processing of your data contradict ;
• Your consent to the processing of your data for the future withdraw although any processing that took place before the consent was withdrawn remains lawful; and
• If you are of the opinion that we have not processed your personal data properly, you can contact the competent supervisory authority to complain.

FURTHER INFORMATION ON DATA PROTECTION

CONTACT FORM

The contact form on our website is an easy way to get in touch with us quickly. Some fields are marked as mandatory so that you can contact us. If you fill out the fields and choose “Send”, you agree that your data will be sent to us by email with the message. The data is not saved on the web server.

EMAIL NEWSLETTER

If you register for our newsletter, we will use the data required for this or separately provided by you in order to regularly send you our e-mail newsletter. Unsubscribing from the newsletter is possible at any time and can be done either by sending a message to the contact option described above or via the unsubscribe link provided in the newsletter.

DATA BACKUP

We have taken extensive technical and organizational measures to protect your data against possible dangers such as unauthorized access, unauthorized knowledge, modification or distribution, as well as against loss, destruction or misuse.

In order to protect your personal data from unauthorized access by third parties during transmission, we secure the data transmissions using SSL encryption, if necessary. It is a standardized encryption method for online services, especially for the web.

LOGFILES

Every time our website is accessed, usage data is transmitted through the respective internet browser and stored in log files, the so-called server log files. The data records stored in this process contain the following data: Domain from which the user accesses the website, date and time of retrieval, IP address of the accessing computer, website (s) that the user visits as part of the offer, amount of data transferred, Browser type and version, operating system used, name of the Internet service provider, notification of whether the access was successful. These log file data sets are evaluated in anonymized form in order to improve the offer and make it more user-friendly, to find and correct errors and to control the load on servers.

PROVENEXPERT

Our website uses plugins from the provenexpert.com website operated by Expert Systems AG. The operator of the website is Expert Systems AG, Quedlinburger Straße 1, 10589 Berlin. If you visit one of our pages equipped with a ProvenExpert plug-in, a connection to the servers of Expert Systems AG will be established. The ProvenExpert server is informed which of our pages you have visited. ProvenExpert is used in the interest of an appealing presentation of our online offers. This represents a legitimate interest within the meaning of Art. 6 Para. 1 lit. f GDPR. Further information on the handling of user data can be found in ProvenExpert AG’s data protection declaration at: https://www.provenexpert.com/de-de/datenschutzbestektiven/ .

COOKIES

This website uses so-called cookies. A cookie is a text file with an identification number that is transmitted to and stored on the user’s computer when the website is used, together with the other data that is actually requested. The file is kept there for later access and is used to authenticate the user. Since cookies are just simple files and not executable programs, they do not pose any danger to the computer. Depending on the Internet browser setting selected by the user, this automatically accepts cookies. However, this setting can be changed and the storage of cookies can be deactivated or set in such a way that the user is notified as soon as a cookie is set. If the use of cookies is deactivated, however, some functions of the website may not be available or only to a limited extent. You can prevent the setting of cookies by our website at any time by means of a corresponding setting in the Internet browser used and thus permanently object to the setting of cookies. Cookies that are already active can be deleted at any time using an Internet browser or other software programs. We may work with advertising partners who help us to make our website more interesting for you. For this purpose, cookies from partner companies are also stored on your hard drive when you visit our website (third-party cookies). If we work with the aforementioned advertising partners, you will be informed individually and separately about the use of such cookies and the scope of the information collected within the following paragraphs.

The following Types of cookies are distinguished:

First party cookies: First party cookies are transmitted from the platform you are currently visiting.

Third party cookies (so-called third party cookies): Third-party cookies are cookies that are transmitted by a provider other than that of the platform visited by the user. When a user calls up a platform and another entity transmits a cookie through that platform, it is a third-party cookie.

Absolutely necessary cookies: These cookies are necessary so that you can navigate through the platform and use its functions, such as: B. can use access to secure areas of the platform. Without this, certain services cannot be provided, such as B. the display of customized content for your computer or device.

Performance cookies: These cookies collect information about how visitors use the platform, e.g. B. Which pages are accessed most frequently and whether you receive error messages from websites. However, these cookies do not collect any information on the identity of the visitor. All information these cookies collect is aggregated and therefore anonymous. They are only used to optimize the platform.

Functionality cookies: These cookies enable the platform to save decisions you have made (e.g. language settings and your region) and to offer you improved, more personal functions. They can also be used to save your settings for the text size, font and other customizable parts of the website. They can also be used to provide services that you have requested, such as B. the display of a video or the comment function within a blog. The information these cookies collect can be anonymized. Your surfing activities cannot be tracked on other platforms.

Social media cookies: These cookies are used when you click a button on the platform to share information on social media. The social network records this action and can use it for marketing or advertising purposes.

Marketing / advertising cookies: These cookies are used to show you advertisements that may be relevant to you based on your interests. They are also used to limit the number of times a particular advertisement is shown to you. We also use cookies to measure how effective an advertising campaign is. They are usually placed by advertising networks with our permission and record your visit on a platform. This information is shared with other organizations such as B. Distributed by advertisers. Marketing and advertising cookies are often linked to platform functions. Our advertising cookies also enable you to take part in customer surveys and give us your feedback so that we can improve your user experience with us.

COOKIEBOT

A web service from Cybot A / S, Havnegade 39, 1058 Copenhagen (hereinafter: cookiebot.com ) reloaded. We use this data to ensure the full functionality of our website. In this context, your browser may transmit personal data to cookiebot.com. The legal basis for data processing is Article 6 (1) lit. f GDPR. The legitimate interest consists in the correct functioning of the website. The data will be deleted as soon as the purpose for which it was collected has been fulfilled. Further information on the handling of the transferred data can be found in the privacy policy of cookiebot.com: https://www.cookiebot.com/de/privacy-policy/ . You can prevent the collection and processing of your data by cookiebot.com by deactivating the execution of script code in your browser or installing a script blocker in your browser (you can find this under, for example www.noscript.net or www.ghostery.com ).

The following information is stored in our Cookiebot account:

• The IP address of the user in anonymized form (the last three digits are set to “0”).
• Date and time of consent.
• User’s browser.
• The URL from which consent was sent.
• An anonymous, random, and encrypted key value.
• The consent status of the user, which serves as evidence of consent.

The key and the consent status are also stored in the user’s browser in the cookie “CookieConsent”, so that the website can automatically read and respect the user’s consent for all subsequent page requests and future user sessions for up to 12 months. You can view and change your level of consent at any time. You can find this further down on this page.

GOOGLE ANALYTICS

We use the Google Analytics service from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). This service enables an analysis of the use of our website and uses cookies for this. For this purpose, the information generated by the cookie, such as your anonymized IP address, is sent to a Google Inc. server on our behalf. transmitted in the USA, stored and evaluated there. Because on this website, Google Analytics has been expanded to include the code “gat._anonymizeIp ();”. This ensures that IP addresses are recorded anonymously. Your IP address is usually anonymized by shortening your IP address by Google Inc. within the European Union or in other contracting states of the European Economic Area (EEA). In exceptional cases, your IP address will be sent to a Google Inc. transmitted in the USA and only anonymized there. Your IP address transmitted here will not be combined with other data from Google Inc. merged. As part of the Google Analytics advertising function, remarketing and performance reports are used based on demographic characteristics and interests. The purpose of these procedures is to use the information on user behavior to align the advertising measures more closely with the interests of the respective user. As part of remarketing, personalized advertising measures can be placed on other websites on the basis of the user’s surfing behavior on this website. The advertising material can contain products that the user has previously viewed on the website. If you have agreed that your web and app browser history will be linked to your Google account by Google and that information from your Google account will be used to personalize ads, Google will use this data for cross-device remarketing. You can object to the collection of your data by Google Analytics at any time. The following options are available to you for this:

Most browsers accept cookies automatically. However, you can prevent the use of cookies by setting your browser; in this case, however, not all functions of the website can be used. You have to make the settings separately for each browser you use.
You can also have this data collected and processed by Google Inc. by downloading and installing the browser ad-on available under the following link: https://tools.google.com/dlpage/gaoptout?hl=de
Alternatively, or within browsers on mobile devices, please click on the following link: Deactivate Google Analytics An opt-out cookie will be stored on your device for our website with effect for the browser you are currently using. If you delete your cookies in this browser, you will have to click on this link again.

For more information on terms of use and data protection, see http://www.google.com/analytics/terms/de.html or under https://policies.google.com/?hl=de .

GOOGLE REMARKETING

Using remarketing technology from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). users who have already visited our website are addressed again through interest-based advertising on the pages of the Google partner network. The advertisements can contain the products that the user previously viewed on our website (remarketing). For this purpose, the Google Remarketing tracking pixels are integrated on this page, which the user behavior on the website (e.g. respected consultants), the technical characteristics of the website visit (e.g. the browser used, the IP Address) and purchasing behavior (e.g. last consultant visited) are recorded without personal reference and transmitted to Google. Google uses cookies for the purpose of recognizing and assigning users. If users have agreed that their web and app browser history will be linked to their Google account by Google and that information from the Google account will be used by us to personalize ads that they see on the web, Google will use the data of these registered users together with our own collected data in order to create and define target group lists for cross-device remarketing. To support this function, authenticated IDs of these users are recorded by Google Analytics. This personal data from Google is temporarily linked to Google Analytics data from us in order to form target groups.

More information and options for deactivating this advertisement can be found at http://www.google.com/settings/u/0/ads/anonymous?hl=de .

GOOGLE FONTS

We use Google Fonts, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). These web fonts are integrated through a server call, usually a Google server in the USA. This transmits to the server which of our websites you have visited. The IP address of the browser of the end device of the visitor to this website is also saved by Google. You can find more information in Google’s data protection information, which you can access here: www.google.com/fonts#AboutPlace:about www.google.com/policies/privacy/ .

GOOGLE TAG MANAGER

This website uses the Google Tag Manager of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Tag Manager is a solution that enables marketers to manage website tags from one interface. The Tag Manager tool itself (which implements the tags) is a cookie-free domain and does not collect any personal data. The tool triggers other tags, which in turn may collect data. Google Tag Manager does not access this data. If a deactivation has been made at the domain or cookie level, this remains in effect for all tracking tags that are implemented with Google Tag Manager.

GOOGLE MAPS

We use Google Maps (API) from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”) on our website. Google Maps is a web service for displaying interactive (land) maps in order to visually display geographic information. When you use this service, you will be shown our location and any journey will be made easier. When you call up those sub-pages in which the Google Maps map is integrated, information about your use of our website (such as your IP address) is transmitted to and stored by Google on servers in the United States. This happens regardless of whether Google provides a user account that you are logged in to or whether there is no user account. If you are logged in to Google, your data will be assigned directly to your account. If you do not wish to be assigned to your profile on Google, you must log out before activating the button. Google saves your data (even for users who are not logged in) as usage profiles and evaluates them. Such an evaluation is carried out in particular in accordance with Art. 6 Para. 1 letter f GDPR on the basis of Google’s legitimate interests in displaying personalized advertising, market research and / or needs-based design of its website. You have the right to object to the creation of these user profiles, although you must contact Google to exercise this right. You can find detailed information on data protection in connection with the use of Google Maps on the Google website (“Google Privacy Policy”): http://www.google.de/intl/de/policies/privacy/

FACEBOOK

Plugins of the social network Facebook, provider Facebook Inc., 1 Hacker Way, Menlo Park, California 94025, USA, are integrated on our pages. You can recognize the Facebook plugins by the Facebook logo or the “Like” button on our website. You can find an overview of the Facebook plugins here: http://developers.facebook.com/docs/plugins/ . When you visit our website, the plug-in establishes a direct connection between your browser and the Facebook server. Facebook receives the information that you have visited our site with your IP address. If you click the Facebook “Like” button while you are logged into your Facebook account, you can link the content of our pages to your Facebook profile. This enables Facebook to assign your visit to our website to your user account. We would like to point out that, as the provider of the website, we have no knowledge of the content of the data transmitted or of how it is used by Facebook. You can find more information on this in Facebook’s privacy policy at http://de-de.facebook.com/policy.php .

TWITTER

Plugins of the short message network of Twitter Inc. are on our website. (Twitter) integrated. You can recognize the Twitter plugins (tweet button) by the Twitter logo on our website. You can find an overview of tweet buttons here (https://about.twitter.com/resources/buttons). When you visit a page on our website that contains such a plugin, a direct connection is established between your browser and the Twitter server. As a result, Twitter receives the information that you have visited our site with your IP address. If you click the Twitter “tweet button” while you are logged into your Twitter account, you can link the content of our website to your Twitter profile. This enables Twitter to assign your visit to our website to your user account. We would like to point out that, as the provider of the website, we have no knowledge of the content of the data transmitted or how it is used by Twitter. If you do not want Twitter to be able to assign your visit to our website, please log out of your Twitter user account. Further information can be found in Twitter’s data protection declaration (https://twitter.com/privacy) .

LINKEDIN

Plugins from LinkedIn Corporation, 2029 Stierlin Court, Mountain View, CA 94043, USA (hereinafter “LinkedIn”) are integrated on this website. You can recognize the LinkedIn plugins by the LinkedIn logo or the “Share button” (“Recommend”) on this website. When you visit this website, the plug-in establishes a direct connection between your browser and the LinkedIn server. LinkedIn receives the information that you have visited this website with your IP address. If you click the LinkedIn “Share button” while you are logged into your LinkedIn account, you can link the content of this website to your LinkedIn profile. This enables LinkedIn to assign your visit to this website to your user account. We would like to point out that, as the website operator, we have no knowledge of the content of the data transmitted or how it is used by LinkedIn. Details on data collection (purpose, scope, further processing, use) as well as your rights and setting options can be found in LinkedIn’s data protection information. LinkedIn maintains these notices www.linkedin.com/legal/privacy-policy ready.

XING

Our website also uses the “share function” of the XING network. The provider is XING AG, Dammtorstrasse 29-32, 20354 Hamburg, Germany. If you click the XING “Share-Button” (plug-in), you will be redirected to your user account in a separate browser window – provided you are logged into your XING user account – and can view the electronic publication stored on our website with the addition of a comment share. A direct connection between your browser and the XING server is established via the plug-in. As a result, XING receives the information that you have visited our website with your IP address. We would like to point out that we have no knowledge of the content of the transmitted (personal) data or their use by XING. Further information can be found in XING’s data protection declaration at: https://privacy.xing.com/de/datenschutzerklaerung .

INSTAGRAM

As the operator of this site, we are jointly responsible with the operator of the social network Instagram (Facebook Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland) within the meaning of Art. 4 No. 7 of the General Data Protection Regulation (GDPR). When you visit our site, gfls. personal data processed by those responsible. As the person responsible for this page, we have made agreements with Facebook which, among other things, regulate the conditions for using the Instagram page. They are decisive Instagram Terms of Use as well as the other conditions and guidelines listed there at the end ( https://help.instagram.com/581066165581870 ).

The processing of the information should, among other things, enable Facebook to improve its system of advertising, which it distributes via its network. On the other hand, it should enable us, as the operator of our site, to receive statistics that Facebook creates based on visits to our Instagram page. The purpose of this is to control the marketing of our activities. For example, this enables us to gain knowledge of the profiles of visitors who value our Instagram page or use applications on the page in order to provide them with more relevant content and to develop functions that could be of greater interest to them. The visitor statistics created are only transmitted to us in anonymised form. We do not have access to the respective underlying data.

Instagram users can use the “ Settings for advertising preferences “Influence the extent to which your user behavior may be recorded when you visit our Instagram page. The Facebook and Instagram settings :

• under the Facebook ad preferences
• in the Instagram privacy & security area
• with the Right of objection form .

The processing of information by means of the cookies used by Facebook can also be prevented by not allowing cookies from third-party providers or those from Facebook in your own browser settings.

The agreements with Facebook also on joint responsibility essentially mean that requests for information and the assertion of further rights of data subjects are sensibly asserted directly on Facebook. Because as the provider of the social network and the possibility of integrating Facebook pages there, Facebook alone has direct access to the necessary information and can also take any necessary measures and provide information immediately. However, if our support is required, we can be contacted at any time.

Information on how Facebook handles personal data on Instagram can be found in their Privacy Policy under https://help.instagram.com/ 519522125107875 .

Status of this data protection declaration

July 2022

We reserve the right to change this data protection declaration at any time with effect for the future.