Privacy Policy

1. Controller

The controller responsible for data processing on this website is:

Fahrschule Aschmann
Owner: Wolfgang Aschmann
Hauptstraße 41a
85614 Kirchseeon
Telephone: +49 8091 567833
Email: info@fahrschule-aschmann.de

Personal data is processed only to the extent necessary for the operation of the website, the handling of an enquiry, pre-contractual measures, the performance of a contract, the fulfilment of legal obligations, or on the basis of valid consent. The relevant legal bases are, in particular, Art. 6(1)(a), (b), (c) and (f) GDPR.

2. Website access, hosting and server logs

When the website is accessed, the web server processes technically necessary connection data. This may include the IP address, date and time, requested address, amount of data transferred, referrer, browser, operating system, as well as status and error data. The processing serves the secure and uninterrupted provision of the website and the prevention of misuse. The legal basis is Art. 6(1)(f) GDPR.

The website is hosted by ALL-INKL.COM – Neue Medien Münnich, Friedersdorf (Germany). The hosting service provider processes the data solely within the scope of the technical provision as a processor.

Cookies and local storage

No cookies are set for visitors to the website. Only when logging into the driving school's protected administrative area is a technically necessary session cookie used, which ends when you log out or close the browser.

The online registration and the chatbot temporarily store your entries in your browser's session storage so that they are not lost when switching between steps and pages. This storage exists only on your device, is not used for recognition, and is cleared when you close the browser window or submit the registration. The legal basis for the session cookie and session storage is § 25 Abs. 2 Nr. 2 TDDDG in conjunction with Art. 6 Abs. 1 Buchst. f DSGVO.

Visitor statistics without cookies

On our own server, we count how often the pages of the website are accessed and how many visitors there are per day. For this purpose, a short value is generated from your IP address and your browser identifier using a random key that is valid for only one day and is then deleted. The IP address itself is not stored, no cookie is set, and a visit cannot be recognised again the next day.

In addition, our own script transmits once a day whether you use a desktop device, a tablet or a mobile phone. For this purpose, information from your browser is evaluated; nothing is stored on your device, and only the device class is transmitted.

Only numbers with no personal reference are stored: daily values for 24 months, then only monthly totals. The legal basis is Art. 6(1)(f) DSGVO; our legitimate interest is the needs-based design of the website.

No external analytics, tracking or advertising services are used, and no advertising profiles are created.

3. Contact form and contact by email, telephone or WhatsApp

When using the contact form, we process your name, email address, telephone number provided voluntarily, information on how you found out about us, your message, and the time and reference number of the enquiry. The information is stored on our server and transmitted to the driving school by email. The purpose is to process your enquiry. The legal basis is Art. 6(1)(b) GDPR insofar as the enquiry relates to a contract; otherwise, Art. 6(1)(f) GDPR.

After submitting, you will receive an automatic confirmation of receipt at the email address provided. It contains only the reference number, the selected subject and our contact details, not the content of your message.

To protect against automated spam submissions, the IP address is not stored in plain text, but only as a non-reversible verification value in order to limit repeated submissions within a short period of time. This verification value is no longer used after one day at the latest and is then deleted. The legal basis is Art. 6(1)(f) GDPR.

Enquiries are deleted once processing has been completed, but automatically after 6 months at the latest, unless statutory retention obligations prevent this or the enquiry results in a contractual relationship.

If you contact us by email or telephone, we will also process your details solely for the purpose of handling your request.

We also count the voluntary information on how you found out about us (for example, a Google search or a recommendation) in our statistics without linking it to any personal data, in order to identify the channels through which interested individuals find us. The legal basis is Art. 6(1)(f) GDPR. Providing this information is voluntary; your enquiry or registration will be processed in the same way without it.

Contact via WhatsApp

On our website, you will find a link that allows you to write to us via WhatsApp. A connection to WhatsApp is only established when you deliberately click this link. If you contact us via WhatsApp, we process your telephone number, profile name and the content of your messages in order to handle your request. The legal basis is Art. 6(1)(b) GDPR insofar as it concerns your training or a contract; otherwise, Art. 6(1)(f) GDPR.

Driving students contact our driving instructors via WhatsApp when an appointment needs to be changed at short notice on the same day; at the Landsberg branch, this also applies to other appointment changes. If you do not wish to be contacted via WhatsApp, please let us know; we will then contact you by phone.

WhatsApp is provided by WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. WhatsApp also processes its own data, in particular communication metadata; transmission to its parent company Meta Platforms Inc. in the USA is possible. Meta is certified under the EU-US Data Privacy Framework, on the basis of which the European Commission has determined that an adequate level of data protection is ensured. According to WhatsApp, message content is end-to-end encrypted. If you do not want this, you can also contact us at any time by phone, email or contact form.

Appointment app for driving lessons

We use an appointment app to schedule driving lessons, which driving students are granted access to in our office (not at the Landsberg branch). The app processes your name, contact details, booked, changed and cancelled appointments, as well as the selected meeting point. You will receive a notification from the app when appointments are changed. The purpose is to organise your training; the legal basis is Art. 6 Abs. 1 Buchst. b DSGVO.

The app is provided by “Fahren Lernen” (fahrenlernen.de) from Verlag Heinrich Vogel, which processes the data as a processor on our instructions. The privacy notices within the app also apply. The data will be deleted as soon as it is no longer needed for training, unless there are statutory retention obligations.

Online withdrawal

If you withdraw from a contract via the “Withdraw from contract” function, we process your name, your email address, the details you provide about the contract, a voluntary message, as well as the date, time and reference number of receipt. The declaration is stored on our server and transmitted to the driving school by email; you will receive a confirmation of receipt containing the content of your declaration. The purpose is to process and provide evidence of the withdrawal. The legal basis is Art. 6(1)(c) DSGVO in conjunction with § 356a BGB as well as Art. 6(1)(b) DSGVO. To protect against misuse, as with the contact form, only a non-reversible verification value of the IP address is stored. Withdrawal declarations are not deleted automatically, but retained for the duration of the statutory retention periods.

Online registration

During online registration, we process your selection (training pathway, driving licence categories, branch, assumed driving lessons, calculated price and, where applicable, a voucher code) as well as the information you provide in the form: first and last name, birth name, date and place of birth, nationality, address, mobile number, email address, information about an existing driving licence, accompanied driving, the desired start date, a voluntary message and, voluntarily, how you heard about us. For minors, we also process the name, relationship and contact details of a person with parental responsibility. We use the postcode to determine on our server the responsible driving licence authority, the test location and the nearest branch; no data is transmitted to third parties for this purpose.

The purpose is to process your registration, prepare and conclude the training contract, and plan the training. The legal basis is Art. 6 (1) (b) GDPR. The information marked with an asterisk is required for registration; without it, we cannot process the registration.

Information about visual aids and health restrictions constitutes health data. We process it only with your explicit consent (Art. 9 (2) (a) GDPR) in order to plan the training safely. You may withdraw your consent at any time with effect for the future. The health information is not sent in the notification email to the driving school.

The registration is stored on our server. The driving school receives a notification by email; you receive a confirmation by email containing your registration, this privacy policy, the Terms and Conditions, the Information on the right of withdrawal and the Model withdrawal form as a PDF. To protect against abusive submissions, as with the contact form, only a non-reversible verification value of the IP address is stored.

Online registrations are automatically deleted from the website server after 12 months. If a training contract is concluded, the data required for this purpose is transferred to the training records and retained in accordance with the periods specified under number 8.

Course booking

When you book a course online, for example a first aid course, we process the selected course and date, your first and last name, your mobile number and email address, your date of birth and address where provided, a voluntary message, as well as the time and reference number of the booking. In the case of minors, we also process the name and mobile number of a person with parental responsibility. If a date is fully booked, the booking is placed on a waiting list.

The purpose is to process your booking and conduct the course. The legal basis is Art. 6(1)(b) DSGVO. The booking is stored on our server; the driving school receives a notification by email, and you receive a confirmation by email with a calendar file and, in the case of a binding booking, additionally with the GTC, the Information on the right of withdrawal, the Model withdrawal form and this privacy policy as a PDF. To protect against abusive submissions, as with the contact form, only a non-reversible verification value of the IP address is stored.

Course bookings are automatically deleted from the website server 12 months after the course date, unless statutory retention obligations prevent this.

Consultation and simulator appointments

When you book a consultation appointment or an appointment on the driving simulator online, we process the selected type of appointment, the appointment and the branch, your name, mobile number and email address, for simulator appointments your specification of branch or driving instructor, a voluntary message, as well as the time and reference number of the booking. The purpose is to arrange and conduct the appointment. The legal basis is Art. 6(1)(b) DSGVO.

The appointment is stored on our server; the driving school receives a notification by email. You receive a confirmation by email with a calendar file and a link through which you can cancel the appointment. To protect against abusive submissions, only a non-reversible verification value of the IP address is stored.

Appointments are automatically deleted from the website server 12 months after the appointment.

Chatbot

A chatbot may be activated on the website to answer questions, calculate prices and help with completing the online registration. The responses are generated by an AI system; this is indicated in the chat window. Your entries and the conversation history to date are transmitted to our service provider OpenAI in order to answer your questions. If you use the chatbot for registration, this also includes the information you provide to it for this purpose, for example your name, address and date of birth.

No conversation content is stored on our server. The chat history is kept only in your browser's session storage and is deleted when you close the browser window. Only content-free counters and a non-reversible verification value of the IP address are stored in order to limit the number of requests.

The legal basis is Art. 6(1)(b) GDPR insofar as you are seeking information about or registering for training; otherwise, Art. 6(1)(f) GDPR applies. The chatbot only accepts health information if you have expressly consented to this in the chat (Art. 9(2)(a) GDPR); alternatively, you can enter this information yourself in the form. Use of the chatbot is voluntary – you can also provide all information directly in the form.

OpenAI processes the data on our behalf. Processing may take place in the USA; it occurs only under the data protection requirements applicable for this purpose (Art. 44 et seq. GDPR).

Gift voucher and online payment

When you order a gift voucher, we process your name, your email address, the selected amount, the name of the recipient if requested, the sender information (“From”) and your greeting message, the dates and times of the order and your consent to the voucher terms and conditions, the order number, the generated voucher code, and any subsequent redemptions. The purpose is to process the purchase, deliver the voucher as a PDF by email, and redeem it. The legal basis is Art. 6 (1) point (b) GDPR; the retention of accounting documents is based on Art. 6 (1) point (c) GDPR in conjunction with commercial and tax retention obligations.

Payment is made via the payment service provider SumUp. You will be redirected to SumUp's payment page and enter your payment details there; we do not receive these payment details, only confirmation of whether payment has been made and a transaction number. We transmit the amount, order number, and description of the order to SumUp. SumUp is responsible for processing on the payment page in accordance with its own privacy notices. Orders that have never been paid for are automatically deleted after 30 days. Paid orders are not automatically deleted but retained for the duration of the statutory retention periods. To protect against abusive orders, as with the contact form, only a non-reversible verification value of the IP address is stored.

For some voucher designs, you can voluntarily upload your own photo for the photo frame. The photo is resized, stripped of metadata (for example, location data), and used only for your voucher: it appears in the voucher PDF that you and the driving school receive by email and is not displayed publicly anywhere. When uploading, you confirm that you are permitted to use the photo. The legal basis is Art. 6 (1) point (b) GDPR. The photo is automatically deleted 90 days after payment, or after 30 days together with the order for orders that are never paid.

Payment into the student account

When you pay money into a learner driver's student account via our website, we process the learner driver's student number, name and date of birth, the selected branch, the purpose and amount of the payment, as well as your name and email address, the dates and times of the payment and confirmation of the notices, the payment number, and the note regarding the credit. The purpose is to process the payment, assign it to the correct student account, send the receipt as a PDF by email, and offset it against our services. The legal basis is Art. 6 (1) point (b) GDPR; if you make a payment for another learner driver, the processing of the learner driver's details is based on our legitimate interest in correctly assigning the payment (Art. 6 (1) point (f) GDPR). The retention of accounting documents is based on Art. 6 (1) point (c) GDPR in conjunction with commercial and tax retention obligations.

As with the gift voucher, payment is processed via SumUp; we transmit the amount, payment number, and a description containing the student number to SumUp. Payments that are never paid are automatically deleted after 30 days. Paid payments are retained for the duration of the statutory retention periods.

Map from Google Maps

On the branch pages, a Google Maps map is loaded only when you click “Show map”. Before that, no connection to Google is established. By clicking, you consent to the map being loaded by the provider Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. In particular, your IP address and information about your browser are transmitted to Google; Google may set cookies and also process data in the USA. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TDDDG. Consent applies only to the respective page view; after reloading the page, the map will no longer be displayed. The “Plan route” button is a regular link to Google Maps.

4. Email delivery

Website emails, for example the forwarding of a contact request or an online registration to the driving school and the confirmations sent to you, are sent via the mail server of our email provider. The information required for sending and delivery is transmitted to the mail server.

5. Automatic translations

The website can be displayed in additional languages. To translate the website's fixed texts, we use a server-side AI translation service (depending on the settings, OpenAI or Anthropic). Only the German source texts of the website itself are transmitted, insofar as no stored translation is yet available. Completed translations are stored on our server.

Entries made by visitors, in particular names, contact details, messages from the contact form and information from the online registration, are not transmitted to the translation service. Where use of the service involves a transfer to a third country, this takes place only under the data protection requirements applicable for this purpose.

Foreign-language versions of the legal texts are provided as a reading aid. The German version is binding.

6. External links

Links to external services, for example to legal texts, route planning or our social media profiles, are regular links. A connection to the respective provider is established only when you deliberately open the link. The respective provider is responsible for subsequent processing.

7. Recipients

Recipients may include employees and contracted persons of the driving school, the hosting service provider, the email provider, the payment service provider SumUp for voucher purchases, the service used to translate the website texts, OpenAI when using the chatbot, Google when displaying the map, WhatsApp Ireland Limited when contacting us via WhatsApp, the provider of the appointment app (Verlag Heinrich Vogel, “Fahren Lernen”) as a processor, as well as – where necessary for training, applications or examinations and legally permissible – the competent authorities and examination organisations. Any further disclosure will only take place where legally permitted, with effective consent or where there is a legal obligation.

8. Storage period

Personal data are deleted as soon as the purpose of processing no longer applies and no statutory retention obligations prevent this. The periods stated under number 3 apply to contact enquiries, online registrations, course bookings, as well as consultation and simulator appointments.

Driving school training records are retained for five years after the end of the year in which the instruction was completed, in accordance with § 31 Abs. 3 FahrlG, and are then deleted or destroyed, unless another legal obligation requires further retention. Contract, invoice and accounting documents are stored in accordance with commercial and tax-law retention obligations.

Technical log data is stored only for as long as necessary for security, misuse prevention and error analysis.

9. Rights of data subjects

In accordance with the statutory requirements, you have the right to access, rectification, erasure, restriction of processing and data portability. You may withdraw from the contract with regard to consents at any time with effect for the future. You may object to processing based on legitimate interests on grounds relating to your particular situation.

No automated decision-making, including profiling, takes place. The price calculator and the chatbot provide non-binding information only; the driving school always decides whether to enter into a contract.

To exercise your rights, simply send a message to info@fahrschule-aschmann.de.

You also have the right to lodge a complaint with a data protection supervisory authority. For non-public bodies in Bavaria, the Bavarian Data Protection Authority (BayLDA), Promenade 18, 91522 Ansbach, is responsible.

10. Security and up-to-dateness

The website uses TLS encryption. Access to the administration area and to data and storage directories is technically restricted. This privacy policy will be updated if functions, service providers or the legal situation change.