Privacy Policy

Muster Handels- und Dienstleistungs GmbH
Beispielstraße 42
12345 Musterstadt

Phone: +49 0000 000000
Email: info@kunde0001.grimply.de

We process personal data only where a legal basis exists. Depending on the process, the following bases may in particular apply:

• Art. 6(1)(b) GDPR for pre-contractual measures and for the performance and handling of rental and other contracts,
• Art. 6(1)(c) GDPR for compliance with legal obligations, in particular obligations under commercial, tax and evidence law,
• Art. 6(1)(f) GDPR for legitimate interests in secure and stable operation, prevention of misuse, handling of general enquiries, documentation of handover and return, and the establishment, exercise or defence of legal claims, provided that the interests of the data subject do not override,
• Art. 6(1)(a) GDPR where consent is expressly obtained, for example for optional map or analytics functions.

Where information is stored on or read from a terminal device, we also observe Section 25 TDDDG (German Telecommunications Digital Services Data Protection Act). Storage or access that is strictly necessary may take place without consent under the conditions of Section 25(2) TDDDG; optional access takes place after consent.

When you visit this website, technically necessary connection and log data are processed. This may include in particular the IP address, date and time, the URL/resource requested, referrer, browser and operating system information, host name, and HTTP status and error data.

Purposes: delivery of the website, ensuring availability, stability and IT security, error analysis, and defence against abusive access. Legal basis: Art. 6(1)(f) GDPR.

Storage period: regular server log data are, in accordance with the operating rule on file, generally deleted or anonymised after 14 days at the latest. In the case of security-relevant events, the logs concerned may be kept longer until the matter has been finally clarified and, where applicable, for the purpose of legal enforcement.

To store your privacy choice, the confirmed SCAEVA rental-park front end uses the first-party cookie ars_privacy_consent_v2. It stores your selection for necessary functions and for the categories booking, maps and analytics for 180 days. Storing this selection serves the privacy control you requested and, where technically necessary, takes place under Section 25(2) no. 2 TDDDG.

External content that requires consent is, where technically configured accordingly, loaded only after your selection. You can change your selection via “Privacy settings”. Withdrawal takes effect for the future.

If you use the contact form or contact us by email or telephone, we process in particular your name, contact details, the content of your enquiry and any information you provide voluntarily. The purpose is to handle your enquiry and, where applicable, to prepare a contract. The legal basis is Art. 6(1)(b) GDPR for pre-contractual or contractual communication, and otherwise Art. 6(1)(f) GDPR.

General enquiries with no continuing contractual or legal connection are, in accordance with the rule on file, generally deleted no later than 6 months after they are closed, unless longer retention is required.

The separate module Grimply RentalFlow is used for rental enquiries, reservations, bookings, price and deposit parameters, contract status and operational rental handling. RentalAssets merely provides asset master data for this purpose. Depending on the process, RentalFlow processes in particular name/company, contact details, customer references, selected asset types and quantities, rental period, pick-up and return details, price and deposit information, and status, communication and evidence data.

Legal bases: Art. 6(1)(b) GDPR for contract initiation and performance; Art. 6(1)(c) GDPR for statutory evidence and retention obligations; Art. 6(1)(f) GDPR for prevention of misuse, secure operational organisation, and the establishment and defence of legal claims.

In the protected customer portal, the respective user/customer may in particular be shown current and past bookings, documents, invoice and payment references, deposit status, handover and return records, damage cases and communication. For this purpose, the WordPress/customer account, the RentalCore customer reference and the respective transactions are linked. Access is restricted to authorised users.

At handover and return, checklists, times, condition information, completeness information, pre-existing damage, new damage and photo/media documentation may be processed. The processing serves proper contract handling, securing of evidence, clarification of damage and the safeguarding of legal claims.

Photos/media are assigned to the specific transaction and the asset instances concerned and are not intended as public images.

Electronic customer signatures and, where applicable, staff signatures may be stored as signature data together with the respective handover or return transaction, in order to assign documented declarations and conditions in a traceable way.

Identity, driving licence, age or qualification data are processed only to the extent necessary for the safe, lawful and contractually compliant provision of a specific asset. The scope and form of proof depend on the asset, the customer status and the specific purpose. Copies of identity documents are not generally required; a copy or storage takes place only if a sound legal basis and necessity exist in the individual case.

Where legally relevant declarations or evidence in the rental process, for example cancellations, declarations of withdrawal, contract releases or comparable transactions, are recorded electronically, the transaction/contract reference, the content of the declaration, the time, technical evidence data and the dispatch/confirmation status may be stored. This serves contract handling, statutory obligations and the provision of legal evidence.

Purpose: If you booked without a customer account, our emails contain a personal link. It allows you to view your booking, pay for it and request a cancellation without logging in.

Data: The link contains a random identifier. We do not store this identifier in plain text but only as a hash (checksum), together with the reference to your booking and your customer record, the expiry time and the time of last use. No additional information about you is collected for this purpose.

Cookie arf_guest_access: When you open the link, we set a cookie with this name. It is technically necessary to assign your session to the booking you opened. It applies only to the area /meine-buchung/, cannot be read by scripts (HttpOnly), is not sent to other websites (SameSite Lax), is transmitted only in encrypted form under HTTPS, and expires after 4 hours at the latest. It is set only after you have opened the link. Consent is not required for this because access to your terminal device is strictly necessary for the service you have expressly requested (Section 25(2) no. 2 TDDDG).

Legal basis: Art. 6(1)(b) GDPR (performance of your rental contract: access to the booking, payment, cancellation request) and, for the cookie, Section 25(2) no. 2 TDDDG.

Storage period: The link is valid until 30 days after the end of the rental period, and 7 days for a booking that has already been completed. If the booking is cancelled, declined or called off, the link remains valid for read-only access for another 7 days from that point: you can see the final state of your booking but can no longer change anything. It becomes invalid earlier if you create a customer account with the same email address.

Recipients: none. The data are held in the database of our hosting provider; no additional service providers are engaged.

Purpose: When you register a customer account, we send you a confirmation link. This ensures that the address belongs to you and protects your account against misuse.

Data: Your email address, a random confirmation token (stored only as a hash) and the time of confirmation.

Legal basis: Art. 6(1)(b) GDPR (setting up the account) and Art. 6(1)(f) GDPR (account security, prevention of misuse).

Storage period: The confirmation link is valid for 72 hours. The time of confirmation remains stored with the account for as long as the account exists.

Recipients: none.

Purpose: If you previously booked without an account using the same email address and you confirm that address, we assign those earlier bookings to your customer account so that you can see all your bookings in one place. Without a confirmed email address, no assignment takes place.

Data: No new data about you are created; existing customer records of private customers from online checkout without an account that carry the same confirmed email address are assigned to the account. We log the process (identifiers and number, no content) and send a notification with the booking numbers concerned to the confirmed address. If an assignment is not wanted, you can contact us; we will review the case and can reverse the assignment.

Legal basis: Art. 6(1)(b) GDPR (contract handling) and Art. 6(1)(f) GDPR (clear customer service).

Storage period: as for the associated booking and contract records; the log in accordance with the general retention of event logs.

Recipients: none.

Purpose: When rental items are handed over, our staff check an official identity document in the original and compare name and photograph with your details. For vehicles for which this is required, the driving licence is additionally checked in the original. This serves protection against misuse and theft and the clarification of disputes.

Data: We store only a record: the type of document, the confirmation “name and photograph match”, who carried out the check (staff identifier), the time of the check and, if recorded, the last four characters of the document number. The complete number is not stored, nor is a photo, scan or copy of the identity document. Only the document type, the confirmation and the time enter the unalterable handover record.

Legal basis: Art. 6(1)(b) GDPR (proper handover under the rental contract) and Art. 6(1)(f) GDPR (protection against misuse and theft, evidence in the event of a dispute).

Storage period: 90 days after the return of the booking. After that, the last four characters of the number and the indication of who carried out the check are removed automatically; only the proof that a check took place remains (type of document and time). In the event of an open damage, loss or dispute case relating to your booking, the record is kept for as long as the case remains open.

Recipients: no external recipients.

Your rights: The rights of access, rectification, erasure, restriction, data portability and the right to object to processing under Art. 6(1)(f) GDPR apply, as well as the right to lodge a complaint with a supervisory authority, as described in the other sections of this notice.

Maps from Google Maps may be embedded on location pages. Unless the service is strictly necessary, a map is loaded only after consent or targeted activation. In this process, in particular the IP address, browser/device information and technical usage data may be transmitted to Google. The legal basis is your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG.

Privacy information of Google

Internally, personal data are received only by the units that need them for the respective purpose. Depending on the process actually used, external recipients may in particular be hosting/infrastructure providers, payment service providers, communication/map providers, external booking/integration services, IT service providers, tax advisers/auditors, banks, insurers, legal advisers, and authorities or courts where legally required or for legal enforcement.

Service providers that process personal data exclusively on our behalf are, where legally required, engaged on the basis of Art. 28 GDPR.

Data are transferred to countries outside the European Economic Area only if this is necessary for a service actually used and the requirements of Art. 44 et seq. GDPR are met. Depending on the provider, in particular an adequacy decision of the European Commission (including the EU-U.S. Data Privacy Framework for certified recipients), EU standard contractual clauses or other safeguards provided for by law may be relied on. Details can be found in the privacy information of the respective provider.

We do not store personal data longer than necessary for the respective purpose. In addition, the following operating rules on file apply:

• Server logs: generally no longer than 14 days, subject to security-relevant events.
• General enquiries without a contractual connection: generally no longer than 6 months after closure.
• Operational rental/transaction documentation, including handover, return and damage records: generally up to 36 months, unless longer retention is necessary.
• Legal/evidence transactions: generally up to 36 months or as long as necessary for contract and legal evidence.
• Contract, invoice and booking records: in accordance with the statutory retention periods applicable in each case.
• Claim and damage documentation: until the relevant limitation periods have expired and, where necessary, until proceedings have been finally concluded.

Once the purpose has ceased and the relevant periods have expired, data are deleted or, where possible, anonymised.

Mandatory fields in contact, booking, contract, handover/return or other legal processes are marked as such. Contract-related mandatory information is required to initiate or perform the contract. Without this information, a transaction may not be processed or an asset may not be provided. Optional information and consents are voluntary.

Through RentalAssets, RentalCore or RentalFlow, we do not take decisions producing legal effects or similarly significantly affecting you based solely on automated processing within the meaning of Art. 22 GDPR. Automatic availability, blocking or plausibility checks do not replace such a decision. Profiling for advertising or creditworthiness purposes is not intended by these modules. External payment/fraud-prevention services may use their own automated checks; their information applies to these.

In accordance with Art. 32 GDPR, we take appropriate technical and organisational measures to ensure a level of protection appropriate to the risk. These include in particular HTTPS/TLS in production operation, role-based back-end/portal access, authorisation checks, input validation, CSRF protection/nonces, non-public transaction media, and regular updating and review of the systems. Absolute protection against all risks cannot be guaranteed for internet-based data processing.

Subject to the statutory requirements, you have in particular the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on Art. 6(1)(e) or (f) GDPR (Art. 21). You may withdraw consent at any time with effect for the future (Art. 7(3) GDPR).

To exercise your rights, a message to info@kunde0001.grimply.de is sufficient. To prevent unauthorised disclosure, reasonable proof of identity may be requested.

You also have the right to lodge a complaint with a data protection supervisory authority under Art. 77 GDPR. For a registered office in Hamburg, the following authority is regularly competent:

Zuständige Datenschutzaufsichtsbehörde (Muster)
Beispielstraße 1
12345 Musterstadt
Phone: +49 0000 000000
Email: datenschutz@kunde0001.grimply.de
Website of the supervisory authority

You may also contact another supervisory authority competent under Art. 77 GDPR.

We receive most data directly from you. In the case of business customers, data may also be provided by an employer, contact person, authorised representative or invoice recipient. Where a booking, payment or communication takes place via an activated payment, communication or external integration service, the contact, item/booking, transaction status and technical transaction data required for contract handling may also originate from that service. The respective source follows from the process used.

The version that has been approved in each case is authoritative; its status is shown with the version reference of this document. The notice is adapted if the services actually used, processing operations, statutory requirements or the system configuration change.