'%20d='m0%200%2016%2011h61%2061%2061%2061%2060L47%2037h61%2061%2060%2061L16%2063h61%2061%2061%2061%2060L47%2089h61%2061%2060%2061L16%20115h61%2061%2061%2061%2060L47%20141h61%2061%2060%2061L16%20166h61%2061%2061%2061%2060L47%20192h61%2061%2060%2061L16%20218h61%2061%2061%2061%2060z'/%3e%3c/svg%3e){kind=small}
1. Controller
The controller responsible for data processing on this website is:
WAW Nutzfahrzeuge e.K.
Owner: Abdul Waseh Abdul
Registered office: Langer Hagen 10, 20539 Hamburg, Germany
Operating site in Talkau: Hegesahl 2, 21493 Talkau
Telephone: +49 4156 8203739
Email: info@waw-nutzfahrzeuge.de
You may contact us using these details with questions about data protection and to exercise your rights.
2. General information and types of data
Personal data means any information relating to an identified or identifiable natural person. As a general rule, we process data only insofar as necessary to operate the website, handle your inquiry, initiate or complete a purchase, or fulfil statutory obligations.
Depending on use, the following data in particular may be processed: name, telephone number, email address, company details, vehicle information, message content, technical access data, IP address, date and time of access, and information used for spam prevention.
3. Contact form and inquiry handling
If you send us an inquiry via the contact form, we process the data you enter to handle your inquiry. This may include your name, telephone number, email address, company, vehicle type, vehicle location, year of manufacture, mileage, details of condition or damage, and your message.
Your name and telephone number are required to handle an inquiry submitted through the form; the other fields are optional. You cannot submit the form without the required contact details. Alternatively, you may contact us by telephone or email.
The legal basis is Article 6(1)(b) GDPR insofar as you personally initiate or perform a contract with us. If you act as a company's contact person or submit a general inquiry, the legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in handling inquiries and communicating with business partners. Insofar as processing is necessary to secure the form, prevent spam or ensure technical traceability, it is based on Article 6(1)(f) GDPR. Our legitimate interest lies in the secure, reliable handling of website inquiries with minimal abuse.
The form uses technical protection mechanisms such as server-side validation, timing checks, a honeypot field, content checks and rate limiting. These safeguards are used solely to prevent spam, abuse and automated bulk submissions. In particular, the IP address, the time the form was opened and the submitted content are checked for this purpose. No external CAPTCHA service is integrated into the form.
4. Email delivery and Resend
The email service provider Resend is used for the technical delivery of website inquiries and optional acknowledgements of receipt. This involves processing the communication data required for sending, in particular the recipient address, sender details, message content, subject and technical delivery information.
The provider is Plus Five Five, Inc. (Resend), USA. If you provide an email address, an acknowledgement of receipt may be sent to that address. Depending on the reason for contact, the legal basis for handling inquiries is Article 6(1)(b) or (f) GDPR, as described above. Technically reliable email delivery is in our legitimate interest under Article 6(1)(f) GDPR.
Resend describes processing data in the USA. The data processing agreement provided by the provider contains provisions on international data transfers, including EU standard contractual clauses. Whether the agreement has actually been incorporated into the contractual relationship and the settings of the account used must be checked before production use. Further information: Resend privacy policy and Data processing agreement.
5. Hosting, delivery and server log files
The current technical configuration of this website is set up for deployment through Vercel Inc., USA. The hosting provider actually used in production, any upstream services and the contractual arrangements still need to be confirmed before this policy is published.
When the website is accessed, the IP address, date and time of access, requested URL, referrer, browser type, operating system, status codes and comparable technical data may in particular be processed. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in the secure and efficient operation of the website, error analysis and defence against attacks.
Vercel may also process data outside the EU or the EEA. The provider makes available a data processing agreement containing provisions on transfers to third countries. This alone does not mean that it has been validly agreed for the account used. Information on the conditions and safeguards: Vercel privacy policy and Data processing agreement.
6. Cookies, tracking and analytics
The website code does not integrate any analytics or remarketing tools of our own, such as Google Analytics, or advertising tracking cookies. The font files used are loaded locally from the website; no request is made to Google Fonts for this purpose. The respective additional notices apply to external services such as the map feature described below.
7. Map feature and external links
A map from www.openstreetmap.org is embedded on the contact page. The provider is the OpenStreetMap Foundation, United Kingdom. As soon as your browser loads the embedded map, your IP address and technical access data in particular are transmitted to the map services involved. No click on an activation button is required for this. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in a user-friendly display of our location and route planning. Information about processing by the map provider can be found in the OpenStreetMap Foundation privacy policy.
Links to external services, such as Google Maps for route planning or WhatsApp for direct contact, lead to third-party services. Google Maps is included as a link, not as an embedded Google map. The corresponding connection is only established when the link is opened. The respective providers are responsible for processing on those services.
8. WhatsApp, telephone and direct communication
If you contact us by telephone, WhatsApp or email, we process your communication data to handle your inquiry. This includes, for example, your name, telephone number, email address, the content of your message and any vehicle images or documents you send. WhatsApp is provided to users in the European Economic Area by WhatsApp Ireland Limited, Ireland. When used, telephone numbers, communication data and technical usage data in particular are also processed by WhatsApp. This may involve processing outside the EU or the EEA.
The legal bases explained in section 3 apply to our handling of inquiries. Use of WhatsApp is voluntary; telephone, email and the contact form are available as alternatives. Processing by WhatsApp is governed by its privacy policy.
9. Retention period
We retain personal data only for as long as necessary to handle your inquiry, initiate or complete a purchase, fulfil statutory retention obligations, or defend or assert legal claims. For inquiries that do not result in a contract, completion of handling is decisive unless there is another legal basis for retention. Contractual and business documents are subject to the applicable commercial and tax-law obligations, in particular under the German Commercial Code (HGB) and Fiscal Code (AO). Insofar as retention is necessary to fulfil such obligations, the legal basis is Article 6(1)(c) GDPR. For retention for legal enforcement, the legal basis is Article 6(1)(f) GDPR; the applicable limitation periods are decisive.
10. Data recipients
Access to personal data is granted only to parties that need it to handle your inquiry or operate the website. These may include technical service providers such as hosting, email and IT providers. Data is disclosed to third parties only if necessary, permitted by law, covered by consent or required by law.
11. Your rights
Subject to the statutory conditions, you have the right of access, rectification, erasure, restriction of processing, data portability and objection to certain processing. Insofar as processing is based on your consent, you may withdraw that consent at any time with effect for the future. This does not affect the lawfulness of processing before withdrawal.
Right to object under Article 21 GDPR: Insofar as we process data on the basis of Article 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds overriding your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.
To exercise your rights, you may reach us using the contact details above.
12. Right to lodge a complaint with a supervisory authority
You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU Member State of your habitual residence, place of work or the place of the alleged infringement.
Contact details for the data protection supervisory authorities in our federal states:
Hamburg: Hamburg Commissioner for Data Protection and Freedom of Information (HmbBfDI) – datenschutz-hamburg.de
Schleswig-Holstein: Independent Centre for Data Protection Schleswig-Holstein (ULD), Holstenstrasse 98, 24103 Kiel – datenschutzzentrum.de
13. Updates to this privacy policy
Last updated: 31 October 2026. We update this privacy policy when technical, legal or organisational processing operations change.