Privacy Policy

Last updated: 26 October 2026

This privacy policy informs you, in accordance with Articles 13 and 14 GDPR, about which personal data we process on auto-china.com, in our customer portals and in our apps, for which purposes, on which legal basis, for how long, with whom we share it and which rights you have.1. ControllerAuto China GmbH
Karlsplatz 3
80335 Munich
Germany

Represented by the managing director: Marcel Florian
Phone: +49 89 628 288 64
Email: Show email address

Please send data-protection requests to: Show email address

Auto China GmbH is also the contracting party and controller for subscriptions to Auto China Magazine™; we process the data required to handle and bill the subscription (name, address, email address, chosen plan, payment status) ourselves.2. Hosting and server log filesOur website is hosted on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, in its Falkenstein data centre (Germany). On every request our server automatically processes: IP address, date and time, requested URL, referrer URL, browser type and version, operating system, transferred data volume and HTTP status code. These logs serve to deliver the website, to keep it secure (defence against attacks and abuse) and to analyse errors; the legal basis is our legitimate interest in a secure and stable operation (Art. 6(1)(f) GDPR). Log files are deleted after six weeks at the latest unless they are needed longer to investigate a security incident. A data processing agreement under Art. 28 GDPR is in place with Hetzner.3. Cookies, consent and your settingsOn your first visit we show a consent banner. Strictly necessary storage takes place without consent (§ 25(2) no. 2 TDDDG): the ac_consent cookie stores your decision (12 months); i18next stores your language; after you sign in, access_token, refresh_token and logged_in keep your session. All non-essential services (section 4) are loaded only after you click "Accept all" (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). If you choose "Reject non-essential", they are not loaded and no corresponding cookies are set. You can change or withdraw your decision at any time with effect for the future: click "Cookie settings" in the footer of every page. A referral code from an invitation link (ac_ref, 90 days) is stored only with your consent.4. Services used only with your consentGoogle Tag Manager, Google Analytics 4 and Google Ads (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland): audience measurement, analysis of usage behaviour (page views, dwell time, origin, device) as well as conversion measurement and remarketing for our advertising. Cookies include _ga, _ga_* (up to 2 years) and _gcl_au (90 days). Google Analytics 4 does not store full IP addresses. Data may be transferred to Google LLC in the USA; Google LLC is certified under the EU-US Data Privacy Framework. Retention of analytics data at Google: up to 14 months.

Google AdSense (Google Ireland Limited): display of personalised advertising on our content pages; advertising cookies are set and data is transferred to Google and its advertising partners. More information: policies.google.com/technologies/partner-sites.

Contentsquare (Contentsquare SAS, 7 rue de Madrid, 75008 Paris, France): analysis of usage behaviour by recording mouse movements, scrolling and clicks (session replay) to improve our website. Input into form fields is masked. Cookies _cs_id, _cs_s, _cs_c (up to 13 months). Processing within the EU.

Bird (MessageBird B.V., Trompenburgstraat 2C, 1079 TX Amsterdam, Netherlands): chat widget for customer enquiries and management of our newsletter recipient list. Cookie _bird_ident_* to recognise your conversation.

Metricool (Metricool Software S.L., Calle Paseo de Recoletos 5, 28004 Madrid, Spain): measurement of the reach of our social-media campaigns on our website.

Google Fonts (Google Ireland Limited): for Chinese characters we load the Noto Sans SC and Noto Serif SC typefaces from Google servers, which transmits your IP address to Google. Without your consent we use the fonts installed on your device. Our Latin typeface (Inter) is served from our own servers.

The legal basis for all services in this section is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG); you can withdraw it at any time via "Cookie settings".5. Services based on legitimate interestsGoogle reCAPTCHA Enterprise (Google Ireland Limited): protection of our forms (contact, registration, newsletter, bookings) against spam and automated abuse. reCAPTCHA analyses your behaviour on the page (IP address, mouse movements, dwell time, browser information) and transmits the result to Google; a transfer to the USA is possible (EU-US Data Privacy Framework). Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in protection against abuse. Google's privacy policy and terms of service apply.

Sentry (Functional Software, Inc., 45 Fremont Street, San Francisco, CA 94105, USA; data processed in the EU region Frankfurt): capture of technical errors in the website and apps (error message, browser/device, time, truncated IP address) for troubleshooting. Legal basis: Art. 6(1)(f) GDPR. Sentry is certified under the EU-US Data Privacy Framework.

Google Maps (Google Ireland Limited): on the "Service network" page we show a map of our service partners. The map is loaded only after you click "Load map" (Art. 6(1)(a) GDPR); your IP address is then transmitted to Google.6. Contact, enquiries, configurations and test drivesWhen you contact us via forms, email, phone, chat or WhatsApp, configure a vehicle or request a brochure, a quotation or a test drive, we process the data you provide (name, email address, phone number, address, vehicle of interest, message, configuration) to handle your enquiry and to prepare a contract (Art. 6(1)(b) GDPR) or on the basis of our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). Enquiries are managed in our CRM system Close (Elastic Inc., 350 N. Glendale Ave, Glendale, CA 91206, USA; transfer based on EU standard contractual clauses). Our sales staff are notified of new enquiries internally via Telegram (Telegram FZ-LLC, Dubai, UAE); this notification contains your name, your contact details and the subject of the enquiry. At your request we communicate with you via WhatsApp Business (Meta Platforms Ireland Limited, Dublin); WhatsApp's own privacy notices apply in addition. We keep enquiry data until the enquiry has been dealt with and no follow-up questions are to be expected, for a maximum of three years; if a contract is concluded, the periods in section 9 apply.7. AI-assisted handling of incoming messagesTo pre-sort incoming emails and enquiries and to prepare draft replies we use language models provided by xAI Corp. (USA) and, as a fallback, Anthropic PBC (USA). The content of the message and the details needed to assign it are transmitted for this purpose. The providers are contractually bound not to use the data to train their models; the transfer is based on EU standard contractual clauses. Decisions about your request are always taken by a member of staff; no automated decision within the meaning of Art. 22 GDPR takes place. Legal basis: Art. 6(1)(f) GDPR (efficient and prompt handling of enquiries). You may object to this processing at any time (section 13).8. Customer account, sign-in and customer portalFor orders, saved configurations, documents and order status you can create a customer account. For this we process your email address, name, address, phone number and your password (stored as a hash) (Art. 6(1)(b) GDPR). We send a verification email to confirm your email address. Optionally you can sign in with Apple, Google, WeChat or Telegram; we then receive your identifier, name and email address from the respective provider. One-time codes to secure your account are sent by SMS via Twilio Inc. (USA, EU-US Data Privacy Framework) or, for Chinese numbers, via Alibaba Cloud (Aliyun). Your account remains until you delete it; we then delete your data unless statutory retention obligations apply. See Delete account.9. Orders, contracts and paymentsFor vehicle purchases, reservations, accessory orders in our shop, rental contracts, registration and homologation services and magazine subscriptions we process contract, invoicing and delivery data and, for vehicles, the vehicle identification number, registration and identity-document data to the extent required for registration, customs and handover (Art. 6(1)(b) and (c) GDPR). Contracts can be signed electronically via Zoho Sign (Zoho Corporation B.V., Utrecht, Netherlands).

Payments are processed, depending on the chosen method, by the following payment service providers, which process your payment data as independent controllers: Mollie B.V. (Keizersgracht 126, 1015 CW Amsterdam, Netherlands), Stripe Payments Europe, Ltd. (1 Grand Canal Street Lower, Dublin 2, Ireland), Alipay and WeChat Pay (for buyers from China) and Bitcoin payments via a BTCPay Server operated by us. We receive only the payment confirmation from the provider, never your full card or account data. We reconcile incoming payments on our business account via our bank's interface (Qonto / Olinda SAS, Paris). Invoicing and accounting data are retained for ten years under § 147 AO and § 257 HGB, commercial correspondence for six years.10. Emails, newsletter and notificationsTransactional emails (confirmations, invoices, status updates) are sent via SendGrid (Twilio Inc., 1801 California Street, Denver, CO 80202, USA; EU-US Data Privacy Framework). You receive our newsletter only if you have signed up for it (Art. 6(1)(a) GDPR); you can unsubscribe at any time via the link in every issue or by emailing Show email address. It is sent via Bird (MessageBird B.V.) or our own mailing system; we may evaluate whether and when an issue was opened and which links were clicked in order to improve our content. Users of our apps and the customer portal may receive push notifications via OneSignal (OneSignal, Inc., USA); these can be disabled in your device settings at any time.11. Apps (iOS, Android, HarmonyOS)This policy applies accordingly to our apps. In addition, the app stores (Apple, Google, Huawei) process data under their own privacy policies. The apps access your location (dealer and service search), camera (document upload) and notifications only with your permission.12. Recipients and transfers to third countriesWe share data only as described in this policy, where necessary to perform a contract (e.g. carriers, registration services, workshops, manufacturers for warranty handling, tax advisers, banks) or where we are legally obliged to. Service providers acting on our behalf are bound by data processing agreements under Art. 28 GDPR. Where data is transferred to the USA, we rely on the recipient's certification under the EU-US Data Privacy Framework or on EU standard contractual clauses (Art. 46(2)(c) GDPR) with supplementary measures; transfers to China (Alipay, WeChat, Alibaba Cloud) are based on EU standard contractual clauses. A copy of the respective safeguards is available on request.13. Your rightsYou have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to withdraw any consent given at any time with effect for the future (Art. 7(3)).

Right to object (Art. 21 GDPR): where we process data on the basis of legitimate interests, you may object at any time on grounds relating to your particular situation; you may object to direct marketing at any time without giving reasons.

An email to Show email address is sufficient to exercise your rights. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR); the authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.14. Obligation to provide data, automated decisions, minorsYou are neither legally nor contractually obliged to provide your data; without the fields marked as mandatory, however, we cannot process your enquiry or order. No decision-making based solely on automated processing, including profiling, within the meaning of Art. 22 GDPR takes place. Our offers are directed at persons aged 16 and over.15. Data security and changesTransmission is encrypted (TLS). We protect our systems against loss, misuse and unauthorised access through technical and organisational measures. We update this privacy policy when our processing or the legal situation changes; the version published here with the date stated above applies.