Privacy notice
Last updated: 6 October 2026. Please cover personal details on vehicle documents before uploading. Photo analysis is optional; a personal enquiry is possible without photo analysis.
1. Controller
Kean Noah Schrötter, trading as ProTech Schrötter, Am Landwehrgraben 1, 30519 Hannover, Germany. Email: protech-schroetter@web.de, telephone: +49 155 63718621.
2. Vehicle checks and personal enquiries
The vehicle check processes, in particular, manufacturer, model, model year, requested service and provision method, software version, device identifiers visible in photos where applicable, and details about navigation, sound system, smartphone use and USB port. The purpose is technical classification and preventing incorrect orders. Processing in the check form, including an optionally triggered photo analysis, is based on your consent under Article 6(1)(a) GDPR. No photo analysis takes place without consent. You may withdraw consent with future effect using the contact address above. The lawfulness of previous processing remains unaffected. Personal enquiries and pre-contractual checks may be based on Article 6(1)(b) GDPR.
On a vehicle registration certificate, only the make (D.1), trade name (D.3) and optionally the first registration (B) may be visible. Names, address, number plate, vehicle identification number and document number must be covered beforehand. The year of first registration is used only as an editable suggestion and does not establish the production year. Other photos should show only technical vehicle features, software information, the USB port or a technical iPhone test message.
Recognised technical details are stored with a random reference as evidence of the check and are valid for 15 minutes. Expired entries are deleted at the next successful photo analysis. To allow you to continue the check in the same browser, we store its progress, including your details and the result, for no more than 24 hours (up to seven days for eBay checks). A technically necessary cookie associates this progress with your browser.
For a personal eBay check link, the specified username is associated with the check. Authorized staff can view the steps, information, result and technical photos in the protected admin area for support for up to seven days from the start. The username is not a verified identity. The link alone does not give third parties access. Checks already started with a shorter period retain their original deadline. The periods below apply to carts saved in a customer account.
3. Photo analysis through the OpenAI API
If you select the option to read photos and prepare fields, our server sends the selected technical photos to the OpenAI API. The analysis extracts only the details intended for the technical preliminary check and decides neither prices nor final compatibility nor a contract.
The API request uses store=false and no tools. According to official OpenAI documentation, API data is not used for training unless the account holder expressly enables this. However, default abuse monitoring logs may contain customer content, inputs, images and outputs and may generally be retained for up to 30 days. Shorter retention requires separate approval for Zero Data Retention or Modified Abuse Monitoring; this project has no such approval. Image and file inputs are also checked for child sexual abuse material; a match may lead to longer manual review. An executed data processing agreement is in place with OpenAI. The API project used has the data residency setting “Global”; exclusive processing in the EU is therefore not promised. The agreement governs possible transfers outside the EEA through standard contractual clauses or adequacy decisions. Details are described in the official OpenAI documentation on API data.
The application also stores uploaded photos in non-public image storage. Without an order, they are intended to remain available for the ongoing check for no more than 24 hours (up to seven days for eBay checks). When an order process is prepared, original photos and subsequent checks are associated with the order. Technical order photos are intended to be retained for up to 30 days after documented completion of order processing. Completion is recorded as confirmed shipment, confirmed manual delivery of a download, or a confirmed full refund. A justified, logged exception for an ongoing complaint may suspend deletion. Once lifted, the original deadline applies again. For multiple associated orders, a shared image is deleted only when all deadlines have expired and no exception remains. Ongoing orders and old orders without evidenced completion are not automatically treated as completed. Access is restricted to authorised staff and the protected shipping manager and is logged. Expired photos are blocked for the respective order. An automatic deletion job checks expired deadlines every minute and removes deletable photos from image storage and the database, including their associations with subsequent checks. Technical deletion occurs at the next successful run after expiry; following an operational failure, it is carried out once the failure is resolved. The time and result of the latest run and latest deletion are stored as operational evidence without image content. Statutory rights concerning defects and separate retention of invoice and contract data remain unaffected by the photo period.
4. Orders and contract processing
The order process handles your name, email address, billing and, where applicable, delivery address, service and vehicle details, price, order number, declarations made, and processing, shipping and communication status. The legal basis is Article 6(1)(b) GDPR for pre-contractual measures and contract processing. Legally required retention is based on Article 6(1)(c) GDPR. Security and evidence logs may be based on Article 6(1)(f) GDPR. No general automatic deletion is enabled for order and payment evidence or business correspondence; they are reviewed according to their respective statutory and contractual necessity. The periods and cleanup procedures described apply to short-lived technical data.
For order status, we store a random access key in a technically necessary cookie that JavaScript cannot read, for 180 days. The equivalent cart cookie lasts up to 400 days and is renewed when the cart is opened. Your vehicle selection and confirmed technical assessment remain stored until payment is confirmed or you explicitly remove them. Closing the page or starting an unpaid checkout does not remove them. We check current rules and prices when you return. Original photos remain subject to the deletion periods described above. If you delete cookies or your browser removes them early, the anonymous cart can no longer be identified. A cart voluntarily saved in your account can be restored after signing in.
5. Payment through Mollie
We use Mollie B.V., Keizersgracht 126, 1015 CW Amsterdam, Netherlands, to process payments. At checkout, Mollie receives in particular your name, email address, billing address and, for shipping, delivery address, country, order reference, product description and amount. You enter payment details directly on Mollie’s payment page. Our website receives and stores in particular the payment reference, status and, where applicable, selected payment method. Transmission is for payment processing under Article 6(1)(b) GDPR.
According to its current privacy notice, Mollie acts as an independent controller in payment processing and also processes data for fraud prevention and financial legal obligations. Other payment providers and financial institutions may be involved. Details, retention obligations and possible transfers to third countries are described in the Mollie privacy notice.
6. Transactional emails through Resend
We send order, shipping and withdrawal confirmations through Resend, a service of Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA. Depending on the message, this involves transmitting your email address, name, order or contract reference, service and price information, shipping status and the content you entered in a withdrawal declaration. The purpose and legal basis are contract processing under Article 6(1)(b) GDPR and fulfilling statutory evidence and confirmation obligations under Article 6(1)(c) GDPR.
According to Resend’s contract information, its data processing agreement takes effect upon acceptance of the terms of service. Resend processes messages mainly in the USA, incorporates standard contractual clauses into the agreement and also relies on its EU-US Data Privacy Framework certification. Resend lists further subprocessors, including providers for delivery, hosting, databases, monitoring and support. The agreement provides for deletion of customer and recipient data within 90 days after the Resend account ends; during the contract, processing is governed by the delivery purpose. Open and link tracking are not configured for our transactional emails. Further information is available in the Resend data processing agreement and the List of subprocessors.
Optional customer account and saved basket
If you wish, you can create a customer account with an email address and password. We store the email address, a password hash computed with an individual random value, and the confirmed vehicle and check details you expressly save. Your saved basket remains until you delete the basket or account. When reopened, we check the details against the rules and prices then applicable. Original photos are not permanently stored as a result; the periods above still apply to them.
At your request, we send an email through Resend to confirm your address or reset your password. Confirmation links are valid for 24 hours, password links for one hour, and can be used once. A technically necessary protected login cookie keeps you signed in for no more than 30 days. You may sign out at any time, delete the saved basket, or delete the account after confirming your password. Order data that must be retained by law remains unaffected.
Processing is for providing the account and saved basket you requested under Article 6(1)(b) GDPR. To limit abusive login attempts, we store pseudonymised attempt counters for 15 minutes based on our legitimate interest in access protection under Article 6(1)(f) GDPR. Passwords are not stored in plain text.
Orders, profile and code sign-in
You can sign in with a one-time email code. After your email address is confirmed, an account is created if needed. The code is valid for ten minutes, is stored only as a cryptographic verification value and is deleted after use. After five incorrect entries, a new code is required. We limit sign-in attempts to protect against misuse. As with password sign-in, the session remains valid for up to 30 days.
Your account displays website orders under the same confirmed email address. Optionally saved profile and address details are retained until the account is deleted. Changes to your profile do not change existing orders. Accounts and profiles can be deleted; order documents are retained in accordance with statutory retention periods. Processing for the account and order overview is necessary for performance of the contract or provision of the requested account under Article 6(1)(b) GDPR; security measures serve our legitimate interest under Article 6(1)(f) GDPR.
Optional map of the delivery address
The delivery map is embedded only after you click Load map with Google Maps. The street and house number, postal code, town and country of your delivery address and technical connection data including your IP address are then transmitted to Google Ireland Limited. Your name, email address and order number are not transmitted in the map request. The legal basis is your consent under Article 6(1)(a) GDPR. Google may also process data in the USA. The order remains fully usable without opening the map. Embedding ends when you leave the view; you can withdraw your consent for the future by reopening it without loading the map. Further details are available in Google’s privacy policy, linked in the Contact and external links section.
7. Hosting and technical logs
The website is delivered through Cloudflare Workers. The Cloudflare D1 order and check database and non-public Cloudflare R2 image storage are configured with EU jurisdiction. This restriction concerns the database and stored images. Workers process page requests on Cloudflare’s global network, so that processing is not restricted to the EU. Connection data such as IP address, time, requested URL and security events may be processed for delivery, access protection and technical security. Application logs and traces are currently disabled for the website Worker; Cloudflare system and security logs may still arise. Further information: Cloudflare data processing agreement, D1 data location and R2 data location.
8. WhatsApp, email and external links
The help button opens WhatsApp with a prefilled message. The vehicle and check details it contains are passed to the external service when opened; you initiate sending yourself. Opening an email link launches your email program. Google, Instagram and other external links are opened only when you click them. The respective provider’s information applies to processing there.
Google reviews on the contact page
The contact page shows a dated review snapshot manually checked by us. The display loads no Google scripts and fetches no Google reviews in the browser. Only clicking the Google profile link opens Google Maps, at which point Google receives technical connection data. Further information is available in the Google privacy notice.
The coding request form only creates a message in the browser from the information entered. It does not send an enquiry itself. When moving from the compatibility check, the manufacturer, model and model year may appear in the page address and therefore in browser history or hosting logs. Please do not use these fields for confidential information.
9. Cookies and visitor statistics
We save your chosen language in the pt_language cookie for no more than one year and additionally in local browser storage until you clear it. This serves your language selection and is not used for advertising or visitor statistics. If storage is blocked, you can still choose your language and use language links.
Privacy information about visitor statistics
With your optional statistics consent, ProTech Schrötter measures visits, check stages and purchases by source. The first recorded contact and last recognisable external source are attributed within a fixed 30-day window. No data is sent to Meta. Reject or withdraw in Analytics settings; checking and buying also work without consent.
Only random identifiers hashed on the server, public page paths, timestamps, approved source, medium, campaign and ad values, and reached stages are stored. No full referrer URLs, search text, IP addresses, photos or vehicle details. Real orders are linked after consent; only confirmed payments count and refunds reduce value. Direct visits and payment services do not replace an external source. Missing data, other browsers or deleted identifiers remain unattributed. Before consent, source values stay only in memory and may be lost during navigation. The protected pt_origin_v1 cookie expires 30 days after capture, without renewal. pt_analytics_session_v2 expires after 30 minutes of inactivity, pt_analytics_visitor_v1 after 30 days without measurement; pt_analytics_consent_v6 remembers your choice for 365 days. Source data including order links is removed on withdrawal or, 90 days after capture, at the next measurement/report. Other anonymous daily counters remain up to 25 months; server operation counters use no identifier. These are not reliable person or ad-click counts. Optional measurement: § 25(1) TDDDG and GDPR Art. 6(1)(a); preference storage: § 25(2)(2) TDDDG. Google measurement requires separate consent.
Google Ads visit and purchase measurement
With your separate consent, we link paid orders to a Google ad click within 30 days. Google receives the click identifier, paid amount in EUR, payment time and a random purchase identifier; for visits, also the public page address and technical connection data. Names, contact details, vehicle data and private page addresses are not sent. No personalised advertising.
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data is transmitted only with consent (Article 6(1)(a) GDPR). Processing in the USA is possible. Google may process connection data including IP address and browser information. Measurement runs in an isolated area without access to customer forms or private pages. Enhanced conversions and remarketing are disabled. No consent signals are sent to Google without consent.
Your choice is stored locally for 180 days. Only with consent, we set our own cookie for up to 30 days and securely store the click identifier on our server; it is then deleted. The visit identifier lasts up to 30 minutes without a measured page change. No Google advertising cookies. Legal basis: consent, GDPR Art. 6(1)(a) and TDDDG §25. Revoking consent in Analytics settings stops future attribution and transmission. Previously sent data is not deleted retrospectively.
Meta: visit and purchase measurement
Only with your separate optional consent does ProTech Schrötter send visits, reached results, cart and checkout starts, and confirmed purchases with EUR value and a random event ID to Meta. Meta receives technical connection data such as IP address and browser information and, if present, an ad click ID. This supports ad measurement and optimisation. You may refuse; checking and buying remain available.
Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; processing in the USA is possible. Basis: GDPR Art. 6(1)(a) and § 25(1) TDDDG. The isolated pixel cannot access customer forms or vehicle data. No names, email addresses, photos, order numbers or private page URLs are sent; automatic customer matching and automatic events are disabled. Currently browser pixel, no own Conversions API. Purchases require Meta consent recorded at checkout, confirmed payment within 30 days and reopening the order page within 48 hours of payment. Browser blocking may prevent delivery. Clicking Buy is not a purchase event. pt_meta_consent_v1 remembers your choice for 365 days; pt_meta_grant_v1 lasts 30 days. Meta may set _fbp and _fbc cookies for up to 90 days. Retained links are cleared within 90 days. Withdrawal in Analytics settings stops new transmissions and removes retained click links and accessible pixel cookies; it does not retroactively delete data sent to Meta. Refunds are accounted for internally, not sent as another purchase. Statistics and Google consent do not apply to this purpose.
10. Your rights
Subject to statutory conditions, you may request access, rectification, erasure, restriction and data portability. You may object to processing based on legitimate interests for reasons arising from your particular situation. You may withdraw consent at any time with future effect. You may lodge a complaint with a data protection supervisory authority, in particular the State Commissioner for Data Protection of Lower Saxony.
The compatibility check processes the technical details you confirm to identify a suitable solution we offer. Unclear combinations do not receive automatic access to purchase. You may request a personal review at any time. The technical preliminary check does not decide whether a contract is concluded.
Legal basis and information scope: General Data Protection Regulation.