Data protection
explanation

The person responsible within the meaning of the GDPR is:

Fahrschule S.U.V. GmbH
Attaouil Abdelhafid
Mindenerstrasse 106 · 40227 Dusseldorf
Telephone: 0211 21098911
Email: info@fahrschulesuv.de

We take the protection of your personal data seriously and treat it confidentially in accordance with the statutory data protection regulations (GDPR, BDSG, TDDDG — formerly TTDSG) and this data protection declaration.

This website is hosted at Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. To provide the website, Vercel processes server log files (IP address, date/time, page accessed, user agent). Data processing is carried out to fulfill the contract and in the legitimate interest of technically secure provision (Art. 6 Para. 1 lit. b and f GDPR). If data is transferred to the USA, the transfer is based on standard contractual clauses and the EU-US Data Privacy Framework.

We store data on pre-registrations, inquiries and bookings in a database Supabase Inc., operated in the EU region (Frankfurt, Germany). Processing to fulfill the contract in accordance with Article 6 Paragraph 1 Letter b GDPR. Order processing contract exists.

Individual image files (e.g. cover images of our blog) are delivered via Supabase's storage service; When loading such images, Supabase receives your IP address and your user agent for technical reasons. Legal basis: Art. 6 Para. 1 lit. f GDPR (legitimate interest in the efficient delivery of our content); the order processing contract mentioned also includes this processing.

We send transactional emails (e.g. confirmations, callbacks) via Resend Inc., EU region. Processing for contract initiation/fulfillment in accordance with Article 6 Paragraph 1 Letter b GDPR. Order processing contract exists.

Our email inbox (reception and storage of incoming and outgoing emails) is at Hostinger (Hostinger International Ltd., EU server location). E-mails that you send to us are stored there and also mirrored in our database (section 4) to process your request. Legal basis: Article 6 Paragraph 1 Letters b and f GDPR.

If you make a non-binding request using our pre-registration form, we will process the data you provide to process your request and initiate the training contract. In particular, the following is collected: salutation, first and last name, birth name if applicable, date and place of birth, address, email address, telephone number, nationality, desired driver's license class/course as well as voluntary information (e.g. special requests, visual aid, existing driver's license, previous driving school). We use the contact form to process your name, email address, if applicable, telephone number, subject and message.

The legal basis is Article 6 Paragraph 1 Letter b GDPR (contract initiation) and - for verifiable consent to data processing – Article 6 Paragraph 1 Letter a GDPR. The data protection consent granted is documented with a time stamp (obligation to provide proof in accordance with Art. 7 Para. 1 GDPR). Required fields are marked as such; Without this information we cannot process the request. For the storage period, see section 20.

If you apply via our careers page, we will process the data you provide exclusively to carry out the application process. The following are collected: salutation, first and last name, date of birth, postal code and city, email address, telephone number, school qualification, earliest possible starting date, information about how you became aware of us, a voluntary message and the application documents you uploaded (e.g. CV, certificates, cover letter).

The legal basis is Section 26 Paragraph 1 Sentence 1 BDSG in conjunction with Article 88 GDPR (justification of an employment relationship) and Article 6 Paragraph 1 Letter b GDPR. If you have additionally consented, the legal basis is Art. 6 Para. 1 lit. a GDPR; The consent is documented with a time stamp (Art. 7 Para. 1 GDPR) and can be revoked at any time with future effect.

Your uploaded documents will be in one non-public storage area filed; Access is only possible internally and via temporary links. Your application data will not be passed on to third parties and will not be used for advertising. For the storage period, see section 20.

If you agree to receive our newsletter, we will use your email address to send you information about the driving school and promotions. Registration takes place in Double opt-in procedure: After your consent, we will first send you a confirmation email; Only after clicking on the confirmation link contained therein will your address be included in the newsletter distribution list. This is how we ensure that the registration actually came from you. The time of registration and confirmation are recorded.

The legal basis is your consent in accordance with Article 6 Paragraph 1 Letter a GDPR. You can unsubscribe from the newsletter at any time using the unsubscribe link at the end of every newsletter email or by sending a message to info@fahrschulesuv.de unsubscribe; The revocation does not affect the lawfulness of the processing that has taken place up to that point. After you unsubscribe, your address will be removed from the mailing list and placed on a blacklist to avoid being sent again.

We use technically necessary cookies (e.g. session, cookie consent, language preference) without consent in accordance with Section 25 Paragraph 2 TDDDG (formerly TTDSG). Other cookies and browser-side tracking services (analysis, marketing) - in particular Google Tag Manager and Meta-Pixel - will only be loaded with your express consent in the cookie banner in accordance with Section 25 Paragraph 1 TDDDG and Article 6 Paragraph 1 Letter a GDPR. As long as you have not given your consent, neither the scripts will be executed nor the associated scripts will be integrated by the server. You can revoke your consent at any time using the cookie settings button in the footer; Any data processing that has already taken place remains lawful. Regardless of cookies, when you send a pre-registration, a purely server-side conversion message is sent to Meta (without access to your device) - details and legal basis in section 13.

We also use functional first-party storage Your browser (localStorage/sessionStorage), which exclusively serves the function you requested and does not transmit any data to third parties: Caching your form entries in the pre-registration form, your chat history in the chat window and session-related campaign parameters (section 11). Legal basis: Section 25 Paragraph 2 TDDDG; storage is necessary for the function you use.

In the pre-registration form we use the OSM-based geocoding service Photon (komoot, hosted in the EU) to speed up entering your address. The query is running exclusively via our own server: your browser does not connect to photon.komoot.io, so your IP address not transferred there will. Our server only forwards the search text you entered and returns the suggestions to you. No cookies are set, the requests are not saved and are not cached. Legal basis: Art. 6 Para. 1 lit. b GDPR (contract initiation) and Art. 6 Para. 1 lit. f GDPR (legitimate interest in efficient registration).

If you have consented to statistical or marketing cookies, we load the tag management service Google Tag Manager (GTM) the Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Container ID: GTM-M9TFFHX5. GTM itself is a tag container that can integrate additional tags (e.g. conversion pixels) in the browser; The respective tags within GTM are also secured against premature triggering by our Consent Mode v2 signal (default "denied") and only become active once the respective category has been consented to.

Processed data: IP address (shortened if processed by Google), user agent, referrer, URL accessed. Legal basis: Art. 6 Para. 1 lit. a GDPR in conjunction with V. m. § 25 paragraph 1 TDDDG. A transfer to third countries can take place; Guarantees in accordance with Art. 46 GDPR (standard contractual clauses) and the EU-US Data Privacy Framework exist.

A conversion can be carried out via the Tag Manager - only after consenting to marketing cookies Google Ads be reported when you complete a pre-registration. For improved conversion attribution (“enhanced conversions”), your email address and telephone number can be included already hashed with SHA-256 form be transmitted to Google; Google does not receive any plain text data. For campaign assignment, we also record the parameters passed when the page is accessed (utm_source, utm_medium, utm_campaign, utm_term, utm_content as well as click IDs such as gclid/fbclid). These are cached first-party and exclusively per session (session storage, deleted when the tab is closed) in order to assign your pre-registration to the correct source. They are only passed on to Google via the lead event that requires consent; For server-side transmission to Meta, see section 13. Legal basis: Art. 6 Para. 1 lit. a GDPR in conjunction with V. m. § 25 paragraph 1 TDDDG.

If you have consented to this, we will use the meta pixel Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. The pixel allows us to deliver targeted ads on Facebook/Instagram, measure conversions and create custom audiences. Pixel ID: 1393209932293551. Events captured: PageView (page views). The “Lead” event (successful pre-registration) is not transmitted via the pixel, but only on the server side (point 13). Processed data: IP address, user agent, shortened referrer/URL data, cookies (_fbp, _fbc), browser fingerprint and the click ID cookie generated by Meta. Legal basis: Art. 6 Para. 1 lit. a GDPR in conjunction with V. m. § 25 paragraph 1 TDDDG. You can revoke your consent at any time via the cookie settings.

In addition to the meta pixel, we use the Meta Conversions API the Meta Platforms Ireland Limited. If you complete a pre-registration using our form, we will transfer the “Lead” conversion event. server side from our server (Vercel, EU region) to Meta. This transmission takes place server-to-server: no cookies are set or read and there is no access to your device (§ 25 TDDDG is not affected by this process); It is therefore not dependent on cookie consent. The browser-side meta pixel remains unaffected by this, is only loaded after consent (section 12) and does not itself transmit a lead event; The “Lead” event is transmitted exclusively via this server-side route and with a unique event ID, so that each pre-registration is only counted once.

In order to improve the assignment quality (“Event Match Quality”), we transmit extended matching parameters irrevocably hashed on the server side with SHA-256 before transmission - Meta only receives these hash values, never the plain text data. Data submitted: hashed (SHA-256) email address, telephone number, first and last name, city, zip code and country as well as a hashed reference ID; additionally IP address, user agent, the event source URL and the timestamp. The meta cookies _fbp and _fbc are only sent if they are available in your browser - this requires prior marketing consent; a click ID passed when the page is accessed (fbclid) can also be transmitted. If available, the campaign parameters (utm_source, utm_medium, utm_campaign, utm_term, utm_content and click IDs) are displayed as custom_data sent along.

The legal basis for the server-side transmission is Art. 6 Para. 1 lit. f GDPR - our legitimate interest in measuring the success and economic management of our own advertising campaigns; The consistent pseudonymization (SHA-256 hashing) serves to minimize data. You can object to this processing at any time with future effect (Art. 21 GDPR), e.g. B. by email info@fahrschulesuv.de. The transfer to the USA takes place on the basis of the standard contractual clauses and the EU-US Data Privacy Framework.

Unless you are in Statistics cookies If you have consented, we will use the product analysis software PostHog the PostHog Inc., 965 Mission St #425, San Francisco, CA 94103, USA. Data processing takes place via the EU hosting cluster (eu.i.posthog.com) within the European Union. PostHog collects aggregated usage statistics (e.g. page views, button clicks, time spent, anonymized device information) so that we can continually improve the usability of the website. Unless you have given consent, the script is loaded but is in opt-out mode and does not transmit events; after consent, it switches to opt-in mode. If revoked, the visitor will immediately be set to opt-out and the local visitor ID will be reset. Processed data: pseudonymous visitor ID, IP address (processed shortened by the EU server), user agent, URL accessed, event parameters. Legal basis: Art. 6 Para. 1 lit. a GDPR in conjunction with V. m. § 25 paragraph 1 TDDDG. You can revoke your consent at any time via the cookie settings in the footer.

As part of this analysis, we also use the following PostHog functions - also only with your consent to statistics cookies: Session recording (a pseudonymous representation of the page structure as well as your mouse and scroll movements), Heatmaps and scrollmaps (aggregated click and scroll positions across many visits) and recognition ineffective clicks (Clicks on elements that do not trigger a function). The sole purpose is to identify and resolve operating problems on our website. All input fields are technically masked: what you type into forms (name, date of birth, address, telephone number, email address) is not transferred and is not visible in any recordings. There are no session recordings or heatmaps in the internal administration area. Legal basis: Art. 6 Para. 1 lit. a GDPR in conjunction with V. m. § 25 paragraph 1 TDDDG; You can revoke your consent at any time via the cookie settings in the footer.

PostHog Inc. is a US provider; An order processing contract with standard contractual clauses exists. If, in individual cases, data is transferred to the USA, it is based on the standard contractual clauses and the EU-US Data Privacy Framework.

To ensure secure and trouble-free operation, we log operationally relevant events on the server (e.g. registrations in the internal administration area, receipt of new pre-registrations and contact requests, technical errors). These logs are included in our database Supabase (EU region, Frankfurt) and also sent to the logging service PostHog via its EU cluster (eu.i.posthog.com) transmitted. When you log into the administration area, your IP address and browser identifier (user agent) are recorded to prevent unauthorized access. This server-side logging takes place independently of cookies and without consent based on our legitimate interest in IT security and proper operation (Art. 6 Para. 1 lit. f GDPR). The logs are only retained for as long as necessary for these purposes and then deleted.

Unless you are in Statistics cookies If you have given your consent, we test individual formulations on our website against each other (so-called A/B tests) and adapt individual content to returning visitors. To do this we save exclusively on your device in the local storage (localStorage) two values: a randomly generated, pseudonymous identifier (suv_x), so that you are shown the same variant every time you visit and a test is not distorted by changing views, as well as a counter (suv_p) about whether you have already submitted a pre-registration and how often you have opened the theory plan. These values contain no name, no contact details and no information from forms; they will not be transferred to us or third parties. Only the name of the variant displayed (e.g. “A” or “B”) is transmitted to PostHog so that we can evaluate which wording is more understandable.

The purpose is to design our website according to needs - in particular, to no longer show returning learner drivers a request to pre-register. Without consent to statistics cookies, neither assignment to a test variant nor personalization takes place; in this case you will always see the standard version of the page. Legal basis: Art. 6 Para. 1 lit. a GDPR in conjunction with V. m. § 25 paragraph 1 TDDDG. You can revoke your consent at any time using the cookie settings in the footer; You can also delete the values ​​mentioned at any time using your browser's memory management.

On our location page we integrate the map services of Google Maps the Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The card will only after active consentloaded — either by confirming in the cookie banner (statistics or marketing) or by clicking on the explicit “Activate map” button on the location page. Unless you have given your consent, no iframe or script will be loaded by Google; Instead of the map you will see a static placeholder with an address. When activated, among other things: Transfer IP address, user agent, cookies and timestamp to Google; a transfer to the USA can take place. Legal basis: Art. 6 Para. 1 lit. a GDPR in conjunction with V. m. § 25 paragraph 1 TDDDG. Guarantees in accordance with Art. 46 GDPR (standard contractual clauses) and the EU-US Data Privacy Framework exist. You can revoke your consent at any time via the cookie settings in the footer.

If you use our AI chat, your chat entries will be sent to Google Gemini API transmitted to generate a response. provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Depending on the technical processing, a transmission may be possible Google LLC in the USA (Standard Contractual Clauses and EU-US Data Privacy Framework). Under the terms of the Gemini paid API, the content will not be used to train the models. Please do not enter sensitive data in the chat. If you expressly request contact from our team in the chat, we will send the contact details you provided there as well as the chat history by email to our reception and process them like a contact request (Section 6). Legal basis: Article 6 Paragraph 1 Letters b and f GDPR.

Our website can be viewed in multiple languages. The page content is translated on the server side via a translation interface Google (Google Ireland Limited or Google LLC, USA). Only the page texts to be displayed are transmitted from our server to Google and the result is temporarily stored; Your IP address will not be transmitted to Google, because the request comes from our server (not your browser). No personal data from visitors is transmitted to Google. Legal basis: Art. 6 Para. 1 lit. f GDPR (legitimate interest in barrier-free, multilingual provision of content). Any transfer to the USA takes place on the basis of the standard contractual clauses and the EU-US Data Privacy Framework.

The fonts used on this website (Blunt, Inter, Cairo) are hosted locally on our server. When you access the website, no connection is established to Google servers (Google Fonts) or other font providers; Your IP address will not be transferred to third parties for this purpose.

References to our social media profiles (Instagram, TikTok) and WhatsApp buttons are purely links - no content from these providers is embedded on our website. Data only flows to the respective provider when you actively click on such a link and open their offer.

Our forms (contact, pre-registration, appointment request, application) are protected against automated mass inquiries. At the end of August 2026, 174 automated advertising and fraud messages were received via the contact form within a few days compared to 14 real inquiries; protection is the immediate response to this.

The protection takes effect only for inquiries from abroad. To do this, our server evaluates the country code that our hosting provider sends us for the incoming connection and stores it in a technically necessary cookie suv_cc (only the two-digit country code, e.g. “DE”, valid for the duration of the browser session). If the request comes from Germany, nothing else happens: it will no external script loaded and no exam is displayed.

We only bind if the request comes from another country Cloudflare gymnastics styles a, a service of Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. Your IP address, browser and device information, and interaction signals are transmitted to Cloudflare to check whether the request comes from a human. In the operating mode we use, Turnstile does not set cookies for advertising or analysis purposes and does not create a cross-device profile. The result of the check is verified by our server at Cloudflare; Your request will then be processed normally.

is the legal basis Art. 6 Paragraph 1 Letter f GDPR — our legitimate interest in keeping our forms and our mailbox functional and preventing misuse. For the cookie suv_ccapplies § 25 Para. 2 No. 2 TDDDG: it is absolutely necessary for the service you want and therefore does not require consent. The transfer to the USA is based on the standard contractual clauses (Article 46 GDPR); Cloudflare is also certified according to the EU-US Data Privacy Framework. Further information: Cloudflare privacy policy.

We only store personal data for as long as it is necessary for the respective purposes or as long as there are legal retention requirements:

• Pre-registrations that lead to a training contract: for the duration of the training relationship and subsequently within the framework of the statutory retention periods (in particular Section 257 HGB: 6 years, Section 147 AO: 10 years for tax-relevant documents).
• Pre-registrations without conclusion of contract: until the processing and deletion are completed, at the latest after the purpose of the processing no longer applies.
• Contact inquiries: until your request has been fully processed and then only for as long as a legitimate interest (e.g. queries) or legal obligations require this.
• Applications: In the event of rejection, application data and uploaded documents will be deleted no later than six months after completion of the procedure (deadline for safeguarding possible claims under the AGG). If the application leads to a position, the data will be transferred to the personnel file. At your request, we will keep your documents longer for future jobs.
• Newsletter: until you unsubscribe; The blocking list to avoid re-sending is maintained permanently.
• Server logs & security data: only for a short time, then deletion (see section 15).

After the respective deadline has expired, the data will be deleted or anonymized, provided there are no legal obligations to the contrary.

You have the right to information (Article 15), rectification (Article 16), deletion (Article 17), restriction of processing (Article 18), data portability (Article 20) and objection (Article 21). Please contact us informally info@fahrschulesuv.de.

If processing is based on your consent, you can revoke this at any time with future effect (Art. 7 Para. 3 GDPR) - for example via the cookie settings in the footer or informally by email. The lawfulness of the processing carried out until the revocation remains unaffected.

You also have the right to complain to a supervisory authority - the state commissioner for data protection and freedom of information for North Rhine-Westphalia is responsible.

We reserve the right to adapt this statement so that it always complies with current legal requirements or to implement changes to our services. Status: September 2, 2026.