Privacy Policy

1. Data Controller

AM Autoschilder Express
Cerry-Eller-Weg 4
65468 Trebur
Deutschland

Registration Court: Amtsgericht Darmstadt
Registration Number: HRB-108398
VAT ID: DE458120585

Represented by: Andre Muders

Email: support@zulassung.app
Phone: 015209430014

2. Data Protection Officer

A Data Protection Officer is not legally required for our company (Art. 37 GDPR). Fewer than 20 persons are regularly involved in automated processing of personal data.

For privacy questions, please contact the controller directly at: support@zulassung.app

3. Purposes and Legal Bases for Processing

• Digital Vehicle Registration (iKFZ) – Collection, validation, and transmission of application data via the KBA High-Volume Interface (GKS) to the responsible registration authority.
  Legal basis: Art. 6(1)(b) GDPR (contract performance) and Art. 6(1)(c) GDPR (legal obligations).
• Communication & Support – Logs, status tracking, customer correspondence.
  Legal bases: Art. 6(1)(b) and Art. 6(1)(f) GDPR (legitimate interest).
• Payment Processing – Collection of official fees and service charges, accounting.
  Legal bases: Art. 6(1)(b) and Art. 6(1)(c) GDPR.
• IT Security & Fraud Prevention – Log files and access management.
  Legal basis: Art. 6(1)(f) GDPR.
• Consent-based Technologies – Optional analytics cookies.
  Legal basis: Art. 6(1)(a) GDPR.

4. Processed Data Categories

• Master & Contact Data: Name, address, email, phone number
• Vehicle Application Data: VIN, owner details, eVB insurance number, ZB I and ZB II document security codes
• Payment Data: Transaction IDs, tokenized payment data (no raw credit card data stored)
• Usage & Meta Data: IP address, timestamp, device/browser info
• Communication Data: Support messages, official authority responses
• Signature Data: Digital signature metadata for power of attorney and SEPA mandates

5. Data Sources

We obtain data directly from you via our forms on zulassung.app, as well as status updates from the Federal Motor Transport Authority (KBA) and registration offices.

6. Recipients of Data

• Federal Motor Transport Authority (KBA) & responsible registration offices
• Payment service providers (Stripe)
• IT & Hosting providers (Vercel, Supabase)
  • Vercel Inc. (Hosting)
  • Supabase (Database & Backend)
• Shipping providers (DHL Group)

7. Third Country Transfers

Data transfers to third countries (e.g. USA) take place based on the EU-US Data Privacy Framework (DPF) or Standard Contractual Clauses (SCC).

Providers with third-country transfers: Stripe, Vercel, Supabase, Resend.

• Stripe (USA)
• Vercel (USA)
• Supabase (USA/EU)
• Resend (USA)

8. Retention Period

• Contract & transaction documents: Retained according to statutory commercial and tax laws (up to 10 years).
• GKS application documents: Retained for at least 2 years as required by KBA, then automatically deleted.
• KBA XML logs: Saved for the statutory retention period.
• Server logs: Up to 30 days.
• Support logs: Up to 24 months.
• Tax documents: Up to 10 years.

9. Cookies & Technologies

We use strictly necessary technical cookies essential for operating the site and application process.

You can manage cookie settings in your browser at any time.

10. Web Analytics (Vercel Analytics)

We use Vercel Analytics for privacy-preserving, cookieless usage metrics.

Legal basis: Art. 6(1)(f) GDPR.

10b. Analytics & E-Commerce (Google Analytics 4)

Google Analytics 4 is only activated after explicit consent via the cookie banner (Consent Mode v2).

11. Maps (OpenStreetMap / Carto)

Interactive maps are displayed via Leaflet and Carto tile servers without user profiling.

12. Server Log Files

Server log files are automatically processed for IT security and stability (Art. 6(1)(f) GDPR).

13. Contact & Support

Support requests are processed to fulfill customer inquiries.

14. User Account

Account data is processed for authentication and order management.

15. Payment Processing

Payments are processed securely via Stripe Inc.

16. Digital Signatures

Digital signatures for authorization documents are handled via Yousign SAS.

17. Data Transfer to Authorities / KBA

Application data is transmitted to local registration authorities and the KBA for vehicle registration.

KBA Privacy Policy for GKS

18. Web Hosting

Web hosting and cloud services are provided by Vercel Inc. and Supabase Inc.

19. Email Dispatch

Transactional emails are dispatched via Resend Inc.

20. Shipping Services

Physical documents and license plates are delivered via Deutsche Post DHL Group.

21. Affiliate Program (Tarifcheck)

Insurance comparison calculations are embedded via TARIF CHECK24 GmbH.

22. Minors & Special Data Categories

We do not process special categories of personal data (Art. 9 GDPR). Services are intended for users aged 16+.

23. Automated Decision-Making

No automated decision-making or profiling with legal effect takes place.

24. Obligation to Provide Data

Providing mandatory registration data is required to process vehicle registration.

25. Your Rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), and objection (Art. 21 GDPR).

To exercise your rights, please contact us at: support@zulassung.app

26. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority.

Der Hessische Beauftragte für Datenschutz und Informationsfreiheit
Gustav-Stresemann-Ring 1, 65189 Wiesbaden
Tel: +49 611 1408-0
E-Mail: poststelle@datenschutz.hessen.de
Website: https://datenschutz.hessen.de

27. Data Security

We maintain appropriate technical and organizational measures (HTTPS/TLS encryption).

28. Changes to Privacy Policy

We update this privacy policy when legal requirements or processing activities change.