Privacy
policy

This is a translation of our Datenschutzerklärung (privacy policy) to help you understand it. The German version is the binding one, and if the two ever differ, the German text applies.

The controller within the meaning of the GDPR is:

Fahrschule S.U.V. GmbH
Attaouil Abdelhafid
Mindenerstraße 106 · 40227 Düsseldorf
Phone: 0211 21098911
Email: info@fahrschulesuv.de

We take the protection of your personal data seriously. We treat it confidentially and in line with the data protection laws (GDPR, BDSG and TDDDG, formerly TTDSG) and this privacy policy.

This website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. To deliver the website, Vercel processes server log files (IP address, date and time, the page requested and the user agent). We do this to perform the contract and because we have a legitimate interest in delivering the website securely (Art. 6 (1) (b) and (f) GDPR). Where data is transferred to the USA, the transfer is based on standard contractual clauses and the EU-US Data Privacy Framework.

We store data from pre-registrations, enquiries and bookings in a database run by Supabase Inc. in its EU region (Frankfurt, Germany). We process this data to perform the contract, under Art. 6 (1) (b) GDPR. We have a data processing agreement with Supabase.

Some image files (for example the cover images on our blog) are delivered through Supabase’s storage service. When one of these images loads, Supabase receives your IP address and user agent, because that is technically necessary. Legal basis: Art. 6 (1) (f) GDPR (our legitimate interest in delivering our content efficiently). The data processing agreement mentioned above also covers this.

We send transactional emails (for example confirmations and callbacks) through Resend Inc., in its EU region. We do this to prepare and perform the contract, under Art. 6 (1) (b) GDPR. We have a data processing agreement with Resend.

Our mailbox (where incoming and outgoing emails are received and kept) is run by Hostinger (Hostinger International Ltd., with servers in the EU). Emails you send us are stored there and also copied into our database (section 4) so that we can deal with your request. Legal basis: Art. 6 (1) (b) and (f) GDPR.

Incoming emails in this mailbox are automatically pre-sorted so that we can file them (for example as a general enquiry, a pre-registration, advertising or a request from an authority). To do this, the subject line, the sender’s address and the text of the email are sent to the Google Gemini API. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Depending on how the data is technically processed, it may be transferred to Google LLC in the USA (on the basis of standard contractual clauses and the EU-US Data Privacy Framework). If the service is not available, the email is instead sorted locally using keywords, and no data is transferred. The legal basis is Art. 6 (1) (f) GDPR: our legitimate interest in handling our inbox in an orderly way.

If you send us a non-binding enquiry using our pre-registration form, we process the details you give us to deal with your enquiry and to prepare your training contract. In particular, we collect: your title, first name and surname, date of birth, postcode and town, email address, phone number, the licence class or course you want, and any optional details (for example special requests, a licence you already hold, or your previous driving school). Through the contact form we process your name, email address, your phone number if you give it, the subject and your message. For both forms, the internal notification email to our team also contains your IP address and your browser identifier (user agent), so that we can prevent misuse.

The legal basis is Art. 6 (1) (b) GDPR (steps taken before entering into a contract) and, for your consent to the processing, which we must be able to prove, Art. 6 (1) (a) GDPR. We record your consent with a timestamp, because we have a duty to be able to prove it (Art. 7 (1) GDPR). Required fields are marked. Without them we cannot deal with your enquiry. For how long we keep the data, see section 22.

You can book an appointment through our booking page (/termin). The booking link in our confirmation email is signed, valid for seven days and already linked to your registration, so you do not need to enter your name again if you use it. Without the link, you enter your name, email address and the time you would like yourself, and our team then confirms the time you suggested. We store your name, email address and the booked time in our database (section 4). The booking link itself is not stored. Instead, it is checked again every time it is opened. The legal basis is Art. 6 (1) (b) GDPR (steps taken before entering into a contract, and performance of the contract).

If you apply for a job through our careers page, we process the details you give us only to carry out the application process. We collect: your title, first name and surname, date of birth, postcode and town, email address, phone number, school qualifications, the earliest date you could start, how you heard about us, an optional message, and the application documents you upload (for example your CV, certificates and covering letter). The internal notification email to our team also contains your IP address and your browser identifier (user agent), so that we can prevent misuse.

The legal basis is § 26 (1) sentence 1 BDSG in conjunction with Art. 88 GDPR (setting up an employment relationship) and Art. 6 (1) (b) GDPR. If you have also given your consent, the legal basis is Art. 6 (1) (a) GDPR. We record that consent with a timestamp (Art. 7 (1) GDPR), and you can withdraw it at any time with effect for the future.

The documents you upload are kept in a non-public storage area. They can only be accessed internally, and only through links that expire after a set time. We do not pass your application data on to third parties and do not use it for advertising. For how long we keep the data, see section 22.

If you agree to receive our newsletter, we use your email address to send you information about the driving school and our offers. Signing up uses the double opt-in method: after you agree, we first send you a confirmation email, and your address is only added to the mailing list once you click the confirmation link in it. This is how we make sure that it really was you who signed up. We log the time you signed up and the time you confirmed.

The legal basis is your consent under Art. 6 (1) (a) GDPR. You can unsubscribe at any time using the link at the end of every newsletter email, or by writing to info@fahrschulesuv.de. Withdrawing your consent does not affect the lawfulness of the processing before you withdrew it. When you unsubscribe, we remove your address from the mailing list and add it to a block list, so that we do not send you the newsletter again.

We use cookies that are technically necessary (for example for the session, your cookie consent and your language setting) without asking for consent, under § 25 (2) TDDDG (formerly TTDSG). Any other cookies and browser-based tracking services (analytics and marketing), in particular Google Tag Manager and the Meta Pixel, are only loaded if you expressly agree to them in the cookie banner, under § 25 (1) TDDDG and Art. 6 (1) (a) GDPR. Until you have given your consent, the scripts are not run and are not even included by our server. You can withdraw your consent at any time using the cookie settings button in the footer. Processing that has already taken place remains lawful. Separately from cookies, when you send a pre-registration, our server reports the conversion to Meta directly, without accessing your device. You will find the details and the legal basis in section 13.

We also use functional first-party storage in your browser (localStorage and sessionStorage). It is used only for the feature you asked for and does not send any data to third parties. It keeps what you have typed into the pre-registration form, your chat history in the chat window and the campaign parameters for your current session (section 11). Legal basis: § 25 (2) TDDDG, because this storage is needed for the feature you are using.

Until 10 October 2026 the pre-registration form used Photon, a geocoding service based on OpenStreetMap (run by komoot), so that you could enter your address more quickly. The form no longer asks for an address, only for your postcode and town. The service is no longer used and no data is processed through it.

If you have agreed to statistics or marketing cookies, we load Google Tag Manager (GTM), a tag management service from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Container ID: GTM-M9TFFHX5. GTM is a container that can load further tags (for example conversion pixels) in your browser. The tags inside GTM are also held back by our Consent Mode v2 signal (set to “denied” by default), so they cannot fire early. Each one only becomes active once you have agreed to the type of cookie it belongs to.

Data processed: your IP address (shortened, where Google processes it that way), user agent, referrer and the URL you opened. Legal basis: Art. 6 (1) (a) GDPR in conjunction with § 25 (1) TDDDG. Data may be transferred to countries outside the EU. Safeguards under Art. 46 GDPR (standard contractual clauses) and the EU-US Data Privacy Framework are in place.

Only if you have agreed to marketing cookies, the tag manager can report a conversion to Google Adswhen you complete a pre-registration. To match conversions more accurately (“enhanced conversions”), your email address and phone number may be sent to Google in a form already hashed with SHA-256. Google does not receive them in plain text. To see which campaign you came from, we also record the parameters passed when you open a page (utm_source, utm_medium, utm_campaign, utm_term, utm_content and click IDs such as gclid/fbclid). These are stored first-party and only for your current session (in session storage, which is cleared when you close the tab), so that we can link your pre-registration to the right source. They are only passed to Google through the lead event, which needs your consent. For the server-to-server transfer to Meta, see section 13. Legal basis: Art. 6 (1) (a) GDPR in conjunction with § 25 (1) TDDDG.

If you agree to statistics cookies, the tag manager also loads Google Analytics 4 from Google Ireland Limited (measurement ID G-GMXL7C9JF6). We use it to see how the website is used: which pages are opened, for how long, on what kind of device and from roughly which region. Google Analytics sets the cookies _ga and _ga_GMXL7C9JF6for this, which last up to two years. When you tap a phone, WhatsApp or email link, that tap is also reported, again only with your consent: to Google Analytics (statistics) or to Google Ads (marketing). All that is sent is the type of link, the link itself (our own number or address) and the page you tapped it on. It doesn’t record whether a call, chat or email follows, or what is said in it. Legal basis: Art. 6 (1) (a) GDPR in conjunction with § 25 (1) TDDDG.

This data does not go straight from your browser to Google. It goes first to our own tagging server at data.fahrschulesuv.de, which runs on Google Cloud (Google Ireland Limited) as our processor, in a data centre in Belgium (region europe-west1). The server is only contacted if you have agreed to statistics or marketing cookies. It removes your IP address before anything is passed on to Google Analytics, and it only forwards the data we have explicitly set up there. Google Cloud logs technical access data for the server (including the IP address) for troubleshooting and deletes it after 30 days. The legal basis is the same as above; the processing on our behalf is based on Art. 28 GDPR.

If you have agreed to it, we use the Meta Pixel from Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. The pixel lets us show targeted ads on Facebook and Instagram, measure conversions and build custom audiences. Pixel ID: 1393209932293551. Events recorded:PageView (pages viewed). The “Lead” event (a completed pre-registration) is not sent through the pixel. It is only sent from our server (section 13). Data processed: your IP address, user agent, shortened referrer and URL data, cookies (_fbp, _fbc), a browser fingerprint and the click ID cookie created by Meta. Legal basis: Art. 6 (1) (a) GDPR in conjunction with § 25 (1) TDDDG. You can withdraw your consent at any time in the cookie settings.

Alongside the Meta Pixel we use the Meta Conversions API from Meta Platforms Ireland Limited. When you complete a pre-registration through our form, we send the “Lead” conversion event to Meta from our server(Vercel, EU region). This happens from server to server: no cookies are set or read for it and your device is not accessed (so § 25 TDDDG does not apply to it). That is why it does not depend on your cookie consent. This does not change anything about the Meta Pixel in your browser: it is still only loaded after you consent (section 12), and it does not send a lead event itself. The “Lead” event is sent only by this server route and with a unique event ID, so each pre-registration is counted only once.

To help Meta match the event more accurately (“event match quality”), we send additional matching data that is hashed with SHA-256 on our server, irreversibly, before it is sent. Meta only receives these hash values and never the data in plain text. Data sent: your hashed (SHA-256) email address, phone number, first name and surname, town, postcode and country, plus a hashed reference ID. In addition we send your IP address, user agent, the URL where the event happened and the timestamp. The Meta cookies _fbp and _fbc are only included if they already exist in your browser, which requires that you have given marketing consent earlier. A click ID passed when you opened the page (fbclid) may also be sent. If they exist, the campaign parameters (utm_source, utm_medium, utm_campaign, utm_term, utm_content and click IDs) are sent as custom_data.

The legal basis for sending this data from our server is Art. 6 (1) (f) GDPR: our legitimate interest in measuring how well our own advertising campaigns work and in managing them economically. Hashing everything with SHA-256 (pseudonymisation) keeps the data to a minimum. You can object to this processing at any time with effect for the future (Art. 21 GDPR), for example by emailing info@fahrschulesuv.de. Transfers to the USA are based on the standard contractual clauses and the EU-US Data Privacy Framework.

We use the product analytics software PostHog from PostHog Inc., 965 Mission St #425, San Francisco, CA 94103, USA. The data is processed on PostHog’s EU hosting cluster (eu.i.posthog.com) within the European Union. We run PostHog at two levels.

Without your consent (cookieless mode): as long as you have not agreed to statistics cookies, we only use PostHog in its cookieless mode. Nothing is stored on or read from your device: no cookies are set, and nothing is written to or read from local storage or session storage. Instead, PostHog assigns your visit using a privacy-friendly hash that it calculates on its own servers, and no personal profile is created. We record page views, clicks on buttons and links on our website and, if you came to us through a link or QR code we handed out, the label it carries (the srcparameter, for example “bio-instagram”). There is no session recording in this mode. Data processed: your IP address (shortened by the EU server), user agent, the URL you opened and event parameters. The legal basis is Art. 6 (1) (f) GDPR: our legitimate interest in understanding which pages and services are used and which of our links bring visitors to us. You can object to this processing at any time with effect for the future (Art. 21 GDPR), for example by emailing info@fahrschulesuv.de.

With your consent to statistics cookies:PostHog then uses a pseudonymous visitor ID, stored in your browser’s local storage and in a cookie, so that a returning visit can be recognised. If you withdraw your consent, the local visitor ID is reset and PostHog goes back to cookieless mode. Data processed: a pseudonymous visitor ID, your IP address (shortened by the EU server), user agent, the URL you opened and event parameters. Legal basis: Art. 6 (1) (a) GDPR in conjunction with § 25 (1) TDDDG. You can withdraw your consent at any time in the cookie settings in the footer.

As part of this analysis we also use the following PostHog features, again only if you have agreed to statistics cookies: session recording (a pseudonymous replay of how the page was built up and of your mouse and scroll movements), heatmaps and scroll maps (click and scroll positions added up across many visits) and the detection of dead clicks (clicks on elements that do not do anything). The only purpose is to find and fix problems with using our website. Every input field is technically masked: what you type into a form (name, date of birth, address, phone number, email address) is not sent and cannot be seen in any recording. There is no session recording and there are no heatmaps in our internal admin area. Legal basis: Art. 6 (1) (a) GDPR in conjunction with § 25 (1) TDDDG. You can withdraw your consent at any time in the cookie settings in the footer.

PostHog Inc. is a US provider. We have a data processing agreement with PostHog that includes standard contractual clauses. If data is transferred to the USA in an individual case, the transfer is based on the standard contractual clauses and the EU-US Data Privacy Framework.

To keep the website running securely and without faults, our server logs events that matter for operation (for example logins to our internal admin area, new pre-registrations and contact enquiries coming in, and technical errors). These logs are stored in our database at Supabase (EU region, Frankfurt) and also sent to the logging service PostHog through its EU cluster (eu.i.posthog.com). When someone logs into the admin area, we record the IP address and browser identifier (user agent) to prevent unauthorised access. This logging happens on the server, independently of cookies and without consent, on the basis of our legitimate interest in IT security and in running the website properly (Art. 6 (1) (f) GDPR). We keep the logs only as long as these purposes require and then delete them.

If you have agreed to statistics cookies, we test different wordings on our website against each other (A/B tests) and adjust some content for returning visitors. For this we store two values only on your own device, in your browser’s local storage (localStorage). The first is a randomly generated pseudonymous identifier (suv_x), so that you see the same version on every visit and a test is not distorted by you seeing different versions. The second is a counter (suv_p) that records whether you have already sent a pre-registration and how often you have opened the theory timetable. These values contain no name, no contact details and nothing from any form, and they are not sent to us or to anyone else. The only thing sent to PostHog is the name of the version you were shown (for example “A” or “B”), so that we can work out which wording is easier to understand.

The purpose is to make our website fit what visitors need, in particular so that learners who have already pre-registered are no longer asked to pre-register. Without your consent to statistics cookies, you are not assigned to a test version and nothing is personalised. In that case you always see the standard version of the page. Legal basis: Art. 6 (1) (a) GDPR in conjunction with § 25 (1) TDDDG. You can withdraw your consent at any time in the cookie settings in the footer, and you can also delete the two values at any time in your browser’s storage settings.

On our location page and our contact page we offer the map service Google Maps from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The map is only loaded when you press the “Load the map” button on that page. Since 14 September 2026, agreeing in the cookie banner is no longerenough for this, and your choice only applies to the page you are viewing at that moment. Until you press the button, no iframe and no script from Google is loaded. Instead of the map you see a placeholder with our address, which makes no request to Google at all. The “Get directions” button next to it is an ordinary link: it only sends anything once you follow it. When the map loads, your IP address, user agent, cookies and a timestamp, among other things, are sent to Google. Data may be transferred to the USA. Legal basis: Art. 6 (1) (a) GDPR in conjunction with § 25 (1) TDDDG. Safeguards under Art. 46 GDPR (standard contractual clauses) and the EU-US Data Privacy Framework are in place.

If you use our AI chat, what you type is sent to the Google Gemini API so that an answer can be generated. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Depending on how the data is technically processed, it may be transferred to Google LLC in the USA (on the basis of standard contractual clauses and the EU-US Data Privacy Framework). Under the terms for the paid Gemini API, the content is not used to train the models. Please do not enter sensitive data in the chat. If you expressly ask in the chat for our team to contact you, we send the contact details you gave there and the chat history by email to our front desk. To prevent misuse, this internal notification also contains your IP address and your browser identifier (user agent). The conversation itself is also stored in our database (section 4) so that our team can continue it in our internal reception area, which only staff can access. For this, your browser receives an access token. We only store an irreversible hash of that token (SHA-256), never the token itself. In all other respects we treat your request like a contact enquiry (section 6). Legal basis: Art. 6 (1) (b) and (f) GDPR.

Our website is available in four languages: German, English, Turkish and Arabic. The texts of these language versions are written by hand and stored in the website’s source code. Nothing is translated live when you open a page. No connection is made to a translation service for that purpose, and neither your IP address nor any other personal data is sent to such a service.

For individual passages that have not yet been written by hand, we use a translation table. It is created once, before publication, with the help of a translation interface from Google (Google Ireland Limited or Google LLC, USA), and then stored in the source code. Only the page texts to be displayed are sent in the process, never any visitor data, and it happens on our own computers, not when you open a page. Legal basis: Art. 6 (1) (f) GDPR (our legitimate interest in offering our content in several languages). Any transfer to the USA is based on the standard contractual clauses and the EU-US Data Privacy Framework.

The fonts used on this website are hosted locally on our own server. When you open the website, no connection is made to Google’s servers (Google Fonts) or those of any other font provider, so your IP address is not sent to third parties for this.

The links to our social media profiles (Instagram, TikTok) and the WhatsApp buttons are plain links. No content from these providers is embedded on our website. Data only goes to the provider once you actively click one of these links and open their service.

Our forms (contact, pre-registration, appointment request and job application) are protected against automated mass submissions. At the end of August 2026, 174 automated advertising and scam messages came in through the contact form within a few days, compared with 14 genuine enquiries. This protection is our direct response to that.

For this, each of these forms includes Cloudflare Turnstile, a service from Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. The script is only loaded when a form is shown on the page. Your IP address, information about your browser and device, and signals about how you interact with the page are sent to Cloudflare to check whether the request comes from a human. In the mode we use, Turnstile does not set any cookies for advertising or analytics and does not build a profile across devices. Our server then checks the result with Cloudflare, and your request is processed as normal.

The legal basis is Art. 6 (1) (f) GDPR: our legitimate interest in keeping our forms and our mailbox working and in preventing misuse. The transfer to the USA is based on the standard contractual clauses (Art. 46 GDPR). Cloudflare is also certified under the EU-US Data Privacy Framework. More information: Cloudflare’s privacy policy.

We only keep personal data for as long as we need it for the purpose concerned, or for as long as the law requires us to keep it:

• Pre-registrations that lead to a training contract: for as long as your training lasts, and after that for the statutory retention periods (in particular § 257 HGB: 6 years, and § 147 AO: 10 years for records relevant for tax).
• Pre-registrations that do not lead to a contract: until we have finished dealing with them and they are deleted, at the latest once the purpose of processing no longer applies.
• Contact enquiries: until we have dealt with your request in full, and after that only for as long as a legitimate interest (for example follow-up questions) or a legal obligation requires.
• Job applications: if you are not offered the job, your application data and uploaded documents are deleted no later than six months after the process ends (the period for protecting possible claims under the AGG, the German General Equal Treatment Act). If you are hired, your data is moved into your personnel file. If you ask us to, we keep your documents longer for future vacancies.
• Newsletter: until you unsubscribe. The block list that stops us sending you the newsletter again is kept permanently.
• Server logs and security data: only for a short time, then deleted (see section 15).

When the relevant period ends, the data is deleted or anonymised, unless a legal obligation prevents this.

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to object (Art. 21). To use these rights, just write to us at info@fahrschulesuv.de. No particular form is needed.

Where processing is based on your consent, you can withdraw it at any time with effect for the future (Art. 7 (3) GDPR), for example in the cookie settings in the footer or by a simple email. This does not affect the lawfulness of the processing carried out before you withdrew your consent.

You also have the right to complain to a supervisory authority. The authority responsible is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (the data protection and freedom of information commissioner for North Rhine-Westphalia).

We may update this privacy policy so that it always meets current legal requirements, or to reflect changes to our services. Last revised: 10 October 2026.