Talk to our expert

Info@checkmeinauto.com

Effective date: 10.11.2025

Last updated: 10.11.2025

This Policy explains how we process personal data when you use our services or visit our website.

1) Identity and contact of the controller

The controller responsible for processing is the entity indicated in the Impressum, operating under the trade name “CMA Group | Auto Trade & Consulting” and the brand “Check mein Auto”, with a registered address reachable in Germany.

Privacy contact: info@checkmeinauto.com

We have not currently appointed a Data Protection Officer (DPO).

2) Scope and legal bases

We process personal data in accordance with Regulation (EU) 2016/679 (GDPR/DSGVO) and applicable German law. Our main legal bases are:

  • Performance of a contract / pre-contractual measures (art. 6.1.b GDPR): management of assignments (contact with seller, inspection, Report, coordination with third parties).
  • Compliance with legal obligations (art. 6.1.c GDPR): taxation, accounting and document retention.
  • Legitimate interests (art. 6.1.f GDPR): security, fraud prevention, traceability of appointments and travel, defence of claims, operational organisation, marketing with anonymised material.
  • Consent (art. 6.1.a GDPR): commercial communications (opt in) and non necessary cookies/technologies (as per the Cookie Policy).

We do not make automated decisions with legal effects, nor do we create profiles with significant impact.

3) Categories of data processed

  • Identification and contact: full name/company name, tax ID (NIF/NIE/CIF), email, phone/WhatsApp, tax address.
  • Vehicle/assignment data: listing URL, vehicle characteristics, observed condition, photos and videos generated by us during the inspection, OBD diagnostic results (with the technical limitations set out in the T&C).
  • Operational communications: summaries of calls and messages with the seller and third parties; appointment confirmations; incidents.
  • Billing and payments: data required for quotes, invoices and payments (we do not store card data; payment is made by SEPA transfer).
  • Browsing/cookie data: only those described in the Cookie Policy.
  • Special categories of data (art. 9 GDPR): we do not intentionally request or process this type of data.

4) Purposes of processing

  • Management of the assignment and provision of the service: coordination with the seller, technical inspection on site, preparation and delivery of the Report (text, photos, videos and OBD readings), negotiation at the client’s request, coordination of transport Germany to Spain, processing of temporary plates, coordination of registration in Spain.
  • Customer service and post service support: handling of enquiries, re delivery of files (according to deadlines), incidents and complaints.
  • Traceability, security and defence of legitimate interests: retention of reasonable evidence of performance (for example, appointment confirmations, itineraries, timestamps, OBD logs, anonymisable visual material).
  • Billing, accounting and compliance with legal obligations.
  • Commercial communications: only with prior consent (opt in) or pursuant to § 7 UWG for previous clients (information similar to that initially contracted, with an option to object with each communication).
  • Corporate use of anonymised material: photographs and videos generated before the vehicle becomes the client’s property, with strict anonymisation, with no association to the client unless consent is given, and respecting any prohibitions from the seller; there is a right to object (see T&C).

5) Source of the data

  • The client (information provided directly).
  • Third parties necessary for the assignment: seller/dealership, transport company, registration agency, workshops/experts, authorities.
  • Public sources related to the vehicle listing (for example, car sales portals) when the client sends us the link.

6) Recipients and categories of third parties

We share data only when necessary to provide the service or comply with the law:

  • Sellers and dealerships: appointment coordination, road test, vehicle documentation.
  • Transport companies: request for quotation and coordination; the contract and payment are made directly with the transport company.
  • Registration agencies and authorities: registration, fees and taxes in Spain; registration offices in Germany for Kurzzeit/Export.
  • Service providers (data processors): hosting, email, cloud storage, document management.
  • Messaging platforms: WhatsApp may be used as an operational channel (see section 10).
  • Tax/accounting advisors, where applicable.

In all cases we apply the principle of minimisation: we only share the data necessary for each purpose.

7) International transfers

Some providers (for example, messaging or cloud services) may operate outside the European Economic Area. In those cases, we apply appropriate safeguards (for example, Standard Contractual Clauses of the European Commission or other admissible mechanisms) and reasonable transfer risk assessments. You can request more information at info@checkmeinauto.com.

8) Retention periods

  • Assignment files / Report and associated files: 6 months from delivery (for traceability and support), in accordance with the T&C. The first re delivery is free of charge; from the second onwards, the published fee applies. After that period, we may securely delete the files.
  • Tax and accounting documentation: according to applicable German law (for example, up to 10 years).
  • Operational communications and evidence: for the period necessary for the defence of claims and the statute of limitations.
  • Commercial communications: until you withdraw consent or object.
  • Cookies and analytics: according to the Cookie Policy and user preferences.

When data is no longer necessary, it will be securely deleted or anonymised.

9) Rights of data subjects

You may exercise, under the terms of the GDPR, the following rights:

  • Access, rectification, erasure (“right to be forgotten”), objection, restriction of processing and portability.
  • Withdrawal of consent (without retroactive effect) in processing based on art. 6.1.a GDPR.
  • Objection to processing based on legitimate interest (art. 6.1.f GDPR), including objection to commercial communications.

How to exercise them: Write to info@checkmeinauto.com proving your identity and the right you wish to exercise.

Complaint to the supervisory authority: you may contact the competent German authority (for example, LfDI Baden Württemberg), without prejudice to your right to contact any other data protection authority in the EU.

10) Use of WhatsApp and other channels

We may communicate via WhatsApp as an operational channel to coordinate appointments, confirm assignments or send delivery links, in accordance with our legitimate interests (art. 6.1.f) and/or to perform the contract (art. 6.1.b). Please note that WhatsApp applies its own terms and policies and may process certain communication metadata as an independent controller.

If you prefer not to use WhatsApp, let us know and we will use email as the preferred means.

11) Information security

We apply reasonable technical and organisational measures commensurate with the risk (access control, minimisation, need to know, encryption in transit where appropriate, backups and secure deletion) to protect data against unauthorised access, accidental loss or unlawful destruction.

12) Minors

Our services are not directed at persons under 18 years of age. We do not knowingly collect data from minors. If you believe a minor has provided us with data, please contact us so we can proceed with its deletion.

13) Social media and generated content

Material (photos and videos) generated by CMA before the vehicle becomes the client’s property may be used for corporate and marketing purposes only under strict anonymisation and without association to the client unless consent is given (see T&C). The client may object in writing; from receipt of that objection, we will not use material in which the vehicle of the assignment could reasonably be identified.

Social media interactions are also governed by the policies of each platform.

14) Cookie Policy

The use of cookies and similar technologies is described in the Cookie Policy, where you can accept, reject or configure your preferences at any time. Non necessary cookies are based on your consent.

15) Updates to this policy

We may modify this Policy to reflect regulatory, technical or operational changes. We will publish the updated version with its effective date. If the changes significantly affect your rights or the way we process your data, we will notify you by reasonable means (for example, a notice on the website or by email).