Privacy Policy

1. Overview and controller

This policy describes what personal data is processed when you visit this website, for what purposes and on what legal basis. It is deliberately short, because this website deliberately does very little: it embeds no third-party content, uses no tracking or advertising services, and runs no database. Visits are counted only by our host, anonymously and without cookies (see "Reach measurement (Vercel Web Analytics)"). The enquiry form is submitted to our own server; no third-party form service is involved.

The German version of this policy is the legally binding one; this English text is a courtesy translation of the same sections.

Controller within the meaning of the GDPR: Speedy Trading GmbH, Neefestraße 40, 09119 Chemnitz, Germany. Amtsgericht Chemnitz, HRB 37148. VAT ID: DE454204980.

Telephone: +49 151 22637207, e-mail: contact@speedy-trading.com

We have not appointed a data protection officer, as the statutory conditions for doing so are not met. Please use the contact details above for any data protection matter.

2. No third-party content, no cookie banner

When you open this website your browser connects to our own domain and nothing else. No content is loaded from any external server. Specifically:

All fonts are stored on our own server. There is no connection to Google Fonts or any other font service, so your IP address is not transmitted to anyone for this purpose.

No map is embedded, and no map picture is shown in the contact section at present. Loading this page contacts no tile server and no map server, neither OpenStreetMap nor anyone else. No data about you is transmitted in the process. What you find there is our address and ordinary links you may choose to click. Only when you click one do you leave this website, at which point the privacy policy of that provider applies.

No third-party analytics, tracking, advertising or social media services are used, no tag manager, no tracking pixel and no chat widget. The only measurement is the anonymous reach measurement of our host Vercel: it runs through our own domain, sets no cookies and stores nothing on your device (see "Reach measurement (Vercel Web Analytics)").

Because nothing requiring consent is loaded, this website needs no cookie banner and asks for no consent. There is nothing for you to accept or decline.

3. Hosting and server log files

This website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA ("Vercel"). Its server-side functions run in the Frankfurt am Main region (fra1); static content and the routing layer in front of them are delivered through Vercel's edge network, usually from the location nearest to you. When you visit the site, Vercel automatically processes technically necessary server log data on our behalf, in particular your device IP address, the date and time of access, the page requested, browser type, operating system and referrer URL.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is the secure, stable and efficient delivery of this website and the prevention of attacks. Where data is transferred to the USA, the transfer relies on the EU Commission standard contractual clauses; Vercel is also certified under the EU-US Data Privacy Framework. Log data is retained only briefly for operational and security purposes and is not combined with other data.

4. Reach measurement (Vercel Web Analytics)

To learn which pages are visited and through which channels visitors find us, for example Instagram, TikTok, Facebook, YouTube or WhatsApp, this website uses the reach measurement of our host Vercel (Vercel Web Analytics). The measurement script is loaded from our own domain and the measurement data is sent to our own domain; your browser opens no connection to any external server for it.

The measurement is anonymous and uses no cookies. Nothing is stored on your device and nothing is read from it, so Section 25 TDDDG does not apply and no consent is required. Your IP address is not stored, only a hash value that Vercel derives from the request and discards after 24 hours. You therefore cannot be recognised beyond that period.

What is recorded is the page viewed and the time of the visit, the website you came from (referrer), the campaign details of a link you followed (UTM parameters, such as the source "instagram"), your approximate location at the level of country, region and city, your device type, and your browser and operating system with their versions. We also count how often a WhatsApp or call button is clicked and how often an enquiry is successfully sent through the form, each time only with the page or the identifier of the vehicle concerned. All other parameters of the address are removed before sending, and nothing you type into the enquiry form is recorded. We see the results only as aggregated statistics.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is knowing which pages and which channels work for our business. Vercel is the processor named in the section "Hosting and server log files" and processes this data solely on our behalf; the processing takes place under the EU-US Data Privacy Framework, under which Vercel is certified.

5. Vehicle data and photos (mobile.de)

The vehicle data and photos shown here come from our own listings on the mobile.de marketplace (mobile.de GmbH, Albert-Einstein-Ring 26, 14532 Kleinmachnow, Germany).

That data is retrieved server-side only: our server fetches it from mobile.de in our own name and caches it. The vehicle photos are likewise delivered by our own server and are not loaded from mobile.de by your browser. Visiting this website therefore transmits no personal data of yours to mobile.de; mobile.de learns neither your IP address nor that or when you visited this site.

The legal basis for the server-side processing is Art. 6(1)(f) GDPR; our legitimate interest is an accurate, up-to-date presentation of our stock.

6. Getting in touch: the enquiry form and the other routes

This website offers you two routes. First, the enquiry form: when you submit it to be sent by e-mail, your entries are transmitted to our own server (the /api/enquiry endpoint). We process your name and exactly one contact detail, which is either a WhatsApp number or an e-mail address (one of the two is required). Optional are your vehicle wish (car or watercraft, brand, model, trim and packages, colour and upholstery, destination country), whether you are enquiring as a private individual or as a business, the company name for a business enquiry, and your message. If you send the form from a vehicle page, the identifier of that listing is transmitted as well, so that we know which vehicle you mean. No third-party form service is involved; the submission goes to us alone.

Every submission is noted in the server log without its content and without contact details: the log holds only technical data such as the outcome, the time, the language, the reference number and a short checksum, never your name, your contact detail or your message. An enquiry whose delivery fails therefore cannot be recovered from that log; if that happens, the form tells you that your enquiry was not sent and offers WhatsApp as another route.

Second, the WhatsApp route: if you choose to send via WhatsApp in the form, nothing is transmitted to our server. Your entries are merely turned into a ready-made message that opens in your WhatsApp application. When you click, the prepared text is handed to WhatsApp, and the WhatsApp section applies. Whether and when you send the message is entirely your decision, and until you do we receive nothing.

If you do send us a message by e-mail, WhatsApp or telephone, we process the data you provide in order to answer your enquiry and, where applicable, to take pre-contractual steps. Typically that is your name, your contact details and the content of your message.

The legal basis is Art. 6(1)(b) GDPR where your enquiry concerns the conclusion or performance of a contract, and otherwise Art. 6(1)(f) GDPR, our legitimate interest in handling enquiries efficiently.

Retention: enquiries that do not lead to a contract are deleted no later than six months after the last contact on that matter. If your enquiry does lead to a contract, the resulting records are subject to the statutory commercial and tax retention periods of six and eight years respectively (Section 257 HGB, Section 147 AO), after which they are deleted. You may object to storage or request erasure at any time, unless a retention obligation prevents it.

7. E-mail mailbox and outgoing mail

Our mailbox for contact@speedy-trading.com is operated by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Deutschland. The e-mails triggered by the enquiry form are dispatched through the sending service Resend (Resend, Inc., San Francisco, USA).

When you submit the enquiry form we send up to two e-mails: a notification to our own mailbox containing what you entered and, only if you gave an e-mail address, an automatic acknowledgement to that address. If you gave only a WhatsApp number, no acknowledgement is sent. The acknowledgement contains no advertising. It confirms receipt, quotes your reference number and carries our company's statutory particulars; it does not repeat the text of your message.

IONOS is therefore a recipient of your data within the meaning of Art. 13(1)(e) GDPR: in delivering your enquiry and storing it in the mailbox, IONOS processes the personal data it contains, including your contact detail (e-mail address or WhatsApp number) and the content of your message. IONOS acts solely for us and on our instructions, and is not a third party to whom we pass your data on. Under the IONOS contract terms, that processing takes place in a member state of the European Union or a contracting state of the European Economic Area.

In dispatching these e-mails, Resend processes the data they contain, in particular your contact detail and the content of your enquiry, solely on our behalf and on our instructions. As Resend is based in the USA, this may involve a transfer to the USA; it is safeguarded by the EU Commission standard contractual clauses.

In addition, a copy of every enquiry notification goes, as a backup, to a second mailbox held with a separate e-mail provider. That provider is therefore also a recipient of your data: it receives the same notification, with what you entered in the enquiry form, as our mailbox at IONOS. The copy serves only to reduce the risk of an enquiry being lost if one mailbox fails or a message does not arrive there. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the reliable handling of enquiries. The copy is subject to the same retention period as the enquiry itself.

The legal basis is Art. 6(1)(b) GDPR where your enquiry is directed at entering into or performing a contract; the automatic acknowledgement forms part of the pre-contractual steps you asked for. Otherwise the basis is Art. 6(1)(f) GDPR, our legitimate interest being the proper, traceable and complete handling of enquiries and confirming receipt to you. Retention is as described in the previous section.

8. WhatsApp

This website contains links that open a conversation with us in WhatsApp. They are ordinary links: no WhatsApp script or content is embedded in this website, and no data whatsoever is transmitted to WhatsApp before you click.

If you use WhatsApp, WhatsApp Ireland Limited, Merrion Road, Dublin 4, Ireland processes, under its own responsibility, in particular your telephone number, your message content and metadata such as the time of communication; this may involve transfers to servers in the USA. We have no influence over that processing. If you would rather avoid it, e-mail and telephone reach us just as well.

The legal basis for communicating over this channel is Art. 6(1)(b) or Art. 6(1)(f) GDPR. Retention is as described in the previous section.

9. Social media presences

We run profiles on Instagram and Facebook (both operated by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland), on TikTok (TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland) and on YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). You will find us there as @speedytradinggmbh (Instagram), "Speedy Trading" (Facebook), @speedy_trading (TikTok) and @speedy_trading (YouTube).

This website itself embeds no content from these networks: no plugins, no embedded posts or videos and no like buttons. Visiting this website therefore transmits no data to the operators of these networks. What follows concerns only our profiles on the platforms themselves.

When you visit our profiles or interact with us there, for example by liking, commenting or sending a message, the provider concerned processes your data under its own privacy policy; this may involve transfers to third countries such as the USA. We have no influence over that processing.

For the page statistics (Insights) of our Facebook Page and our Instagram profile, we and Meta are joint controllers (Art. 26 GDPR). Under the agreement made for this purpose, Meta takes primary responsibility for processing the Insights data. The agreement is available at https://www.facebook.com/legal/terms/page_controller_addendum.

The legal basis for running our profiles is our legitimate interest in presenting our company and communicating with prospective buyers (Art. 6(1)(f) GDPR). Messages you send us through these platforms are used only to answer your enquiry; where it concerns a purchase, the legal basis is Art. 6(1)(b) GDPR. Retention of those messages on our side follows the section "Getting in touch: the enquiry form and the other routes".

You can exercise the rights listed in the section "Your rights" both against us and against the provider concerned. The providers explain how they process data in their own privacy policies: Meta at https://www.facebook.com/privacy/policy, TikTok at https://www.tiktok.com/legal/privacy-policy-eea, Google and YouTube at https://policies.google.com/privacy.

10. Cookies

This website sets no tracking, analytics or advertising cookies and stores nothing in your browser's local storage. It uses a single strictly necessary cookie, which is exempt from consent under Section 25(2)(2) TDDDG; the legal basis for the associated processing is Art. 6(1)(f) GDPR:

Cookie "st_form": set only when you open the contact page with the enquiry form (/en/enquiry), it holds a signed timestamp of that visit. It exists solely as spam protection for the enquiry form, letting us tell whether a form was filled in over a human amount of time. It is httpOnly, contains no personal data, is valid for at most six hours and is renewed after three hours.

This cookie does not allow you to be identified as a person and is not transmitted to any third party. Your choice of language is not stored; the language follows solely from the address you open. You can delete the cookie at any time in your browser settings.

11. TLS encryption

This website uses TLS encryption for security. You can recognise an encrypted connection by the https prefix and the padlock symbol in your browser address bar. While encryption is active, the data you send us cannot readily be read by third parties.

12. Your rights

You have the right at any time to obtain information about the data stored about you (Art. 15 GDPR), to have inaccurate data corrected (Art. 16 GDPR), to erasure (Art. 17 GDPR), to restriction of processing (Art. 18 GDPR) and to data portability (Art. 20 GDPR).

Where we process data on the basis of legitimate interests under Art. 6(1)(f) GDPR, you have the right to object at any time on grounds relating to your particular situation (Art. 21 GDPR).

You also have the right to lodge a complaint with a data protection supervisory authority. The authority competent for us is the Saxon Commissioner for Data Protection and Transparency, Devrientstraße 5, 01067 Dresden, Germany. You may equally complain to any other supervisory authority, in particular in the country of your residence or workplace.

An informal message to contact@speedy-trading.com is enough to exercise any of these rights.

13. No automated decision-making

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

14. Changes to this policy

We update this policy whenever the actual data processing on this website changes, for example because a new service is introduced. The version published here is the one that applies.