Privacy policy

Last updated: 06/09/2026

1. Controller

The controller responsible for processing personal data on this website is N&H Automobile GmbH, Lecker Chaussee 133, 24941 Flensburg, Germany, email info@nh-automobile.de, phone +49 151 50995001. Managing director: Ali Alkahachi.

2. Hosting and server logs

This website is operated on Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA (Cloudflare Workers). When you open a page, Cloudflare processes technically necessary data: IP address, date and time, page requested, browser and operating system, referrer. This data is needed to deliver the site, fend off attacks and analyse errors. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in secure and stable operation).

A data processing agreement is in place with Cloudflare. Transfers to the USA are based on the EU standard contractual clauses and the EU-US Data Privacy Framework, to which Cloudflare is certified. We do not store server logs permanently; Cloudflare retains logs for a short period for security analysis.

3. Cloudflare Turnstile (spam protection)

Our forms are protected by Cloudflare Turnstile. Turnstile checks, without puzzles, whether a request comes from a human. Browser data and the IP address are transmitted to Cloudflare and processed there briefly. The legal basis is Art. 6 (1) (f) GDPR (protection against abuse and spam). Turnstile does not set cookies for recognition.

4. Contact and enquiry forms

When you contact us via a form (general enquiry, vehicle enquiry, financing request, selling your car, car sourcing service, borrowing against your car), we store your details: name, email address or phone number, preferred contact method, message, the vehicle selected, the calculator values for financing requests and, for car sales, the vehicle data and uploaded photos. We also store the time, language, a truncated hash of your IP address and the browser type in order to trace abuse.

Processing takes place to handle your enquiry and to prepare a contract (Art. 6 (1) (b) GDPR) and on the basis of your consent given when sending (Art. 6 (1) (a) GDPR). You can withdraw your consent at any time with effect for the future.

For financing requests we pass your details on to our partner bank so that it can prepare an offer. This only happens if you submit a financing request, not for other enquiries.

For the car sourcing service we additionally store the link to the listing or the vehicle details, the services you want and your preferred down payment. For display in our processing, our server fetches the title and preview image of the linked page once; no data about you is transmitted to the target site.

For borrowing against your car we store vehicle details, the amount requested, employment status, income band and your statement of residence, plus a photo of the registration certificate if provided. On the basis of your separate consent (Art. 6 (1) (a) GDPR) we pass these details on to our partner bank or a licensed brokerage partner so that an offer can be assessed there. An internal preliminary check serves only our processing and is not a credit decision.

For vehicle purchase you can upload an existing offer from another buyer as a file. Uploaded files (photos, registration certificate, offers) are stored in an object store at Cloudflare; they are accessible only to our staff in the internal area and not publicly reachable.

Uploaded files are deleted automatically 90 days after the enquiry is closed, the remaining details according to the periods stated above.

Enquiries are deleted once they have been dealt with and no statutory retention obligations apply, at the latest after twelve months. If a contract is concluded, the commercial and tax retention periods of six and ten years apply.

5. Internal notification and email delivery

New enquiries are reported to us internally via a notification channel at Slack Technologies Limited, Dublin, Ireland (name, type of enquiry, vehicle, message). This serves fast processing (Art. 6 (1) (f) GDPR). Confirmation and notification emails as well as our replies to your enquiry are sent and received via the email service of Cloudflare, Inc. (Email Sending and Email Routing) on the basis of a data processing agreement with EU standard contractual clauses. If you reply to one of our emails, your message is assigned to your enquiry and stored with it.

6. WhatsApp

Our pages contain links that open a chat with us in WhatsApp. Data is only transmitted to WhatsApp Ireland Limited, Dublin, Ireland, a company of the Meta group, once you click such a link. WhatsApp's privacy policy applies. We use WhatsApp solely to communicate with you and do not upload any address books.

7. Cookies and local storage

The public website does not set cookies and does not use analytics or advertising services. A technically necessary session cookie is only set in the internal administration area for logged-in staff. A cookie banner is therefore not required. Should we use audience measurement or advertising tools in future, we will ask for your consent first.

8. Fonts and images

Fonts and images are delivered from our own server. No Google Fonts or other external font services are loaded.

9. External links

Links to Google Maps (directions) and to our dealer profile on mobile.de lead to external sites. When you click them, the privacy policy of the respective provider applies. We do not embed maps or content from these providers directly.

10. Notes for applicants

If you apply via our careers page, we process your details (name, contact details, start date, links, message) and your CV to carry out the application process. The legal basis is Section 26 (1) BDSG in conjunction with Art. 6 (1) (b) GDPR and your consent when submitting. We do not require a cover letter; please do not send special categories of personal data (for example health data) unless required for the position.

Applications are reported internally via Slack and email to the responsible persons. The CV is stored in the object store at Cloudflare and is accessible only to our staff in the internal area.

If you are hired, the documents become part of the personnel file. Otherwise we delete the application including all attachments automatically six months after the process is completed, unless you have agreed to a longer retention for future positions. Your rights under section 11 also apply to applications.

11. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). Please use the contact details above.

You also have the right to lodge a complaint with a supervisory authority. The competent authority is the Independent Centre for Data Protection Schleswig-Holstein (ULD), Holstenstraße 98, 24103 Kiel, Germany.

12. Changes

We adapt this policy when the website or the legal situation changes. The version published here applies.