Privacy policy

This is a courtesy translation. The German version is the legally binding one.

1. Controller and contact

The controller for the processing of personal data on this website within the meaning of Article 4(7) GDPR is:

You can reach us at these contact details for questions about data protection and to exercise your rights. Some locations are run by separate companies; section 9 explains who remains responsible for your data in that case. Full details of the locations are set out in the legal notice.

nextparty24
Thomas Kästner
In den Wiesen 11
38112 Braunschweig
Phone: 0160 6551365
Email: info@nextparty24.de

2. Data protection officer

We are not required to appoint a data protection officer and have not appointed one. Please address your data protection concerns directly to the contact details given in section 1.

3. General information and legal bases

We process personal data only to the extent necessary for providing this website, for answering your requests and for our services, or where you have consented. Personal data is any information relating to an identified or identifiable natural person (Article 4(1) GDPR).

Article 6(1)(a) GDPR: consent. You have given us your consent for a specific purpose, for example for the newsletter. You can withdraw consent at any time with effect for the future (Article 7(3) GDPR), see section 22.

Article 6(1)(b) GDPR: contract and pre-contractual steps. Processing is necessary to perform a contract with you or to take steps at your request before entering into a contract. This covers in particular handling your hire request and performing a hire contract.

Article 6(1)(c) GDPR: legal obligation. Processing is necessary to comply with a legal obligation to which we are subject, for example commercial and tax retention obligations.

Article 6(1)(f) GDPR: legitimate interests. Processing is necessary for the purposes of our legitimate interests, unless your interests or fundamental rights override them. We name our legitimate interests specifically for each processing activity.

Where we store information on your device or access information stored there, permissibility is additionally governed by section 25 of the German Telecommunications Digital Services Data Protection Act. Details are set out in section 6.

You can use this website without providing personal data. For individual functions (request, contact, newsletter) we need the details marked in each case.

4. Hosting and server log files

This website is hosted by an external service provider: Alfahosting GmbH, Ankerstrasse 3b, 06108 Halle (Saale), Germany. The host processes the data arising from the use of this website on our behalf; a data processing agreement under Article 28 GDPR is in place with it. The servers are located in Germany.

When the pages are accessed, the server automatically stores information transmitted by your browser: the IP address of the requesting computer, the date and time of access, the name and address of the file retrieved, the amount of data transferred, the message about successful retrieval, the page visited previously and the browser used including its version and the operating system.

We do not combine this data with other sources and do not use it to draw conclusions about you. The purpose is technical operation, delivery of the pages, system security and investigating misuse and attacks. The legal basis is Article 6(1)(f) GDPR; our legitimate interest lies in providing this website reliably and securely.

The log files are deleted automatically after seven days. If there are specific indications of an attack or unlawful use, we keep the log data concerned until the incident has been fully clarified.

5. Encryption

This website uses SSL or TLS encryption so that the information you send through our forms is protected in transit. You can recognise an encrypted connection by your browser’s address bar starting with “https://” and showing a padlock symbol. When encryption is active, third parties cannot read the transmitted data.

6. Cookies

This site only sets cookies it needs in order to work. Without them, no request could be put together and no language remembered. Technically necessary cookies need no consent under section 25(2) of the German TDDDG. We set no analytics or advertising cookies.

The map on the contact page is not a third-party service either: its images are stored on our own server. Nothing is loaded from outside when the page opens. Where the map material comes from is explained in the section "Map on the contact page". YouTube videos on item pages first show only a preview image from our server; only your click on "Play video" loads YouTube, and only then can YouTube set its own cookies (section "Embedded content and third-party services").

Cookies can also be deleted or blocked in your browser. Your saved items and your request basket will be lost if you do.

7. Contact form

If you write to us using the contact form, we store the details you provide: name, email address, telephone number, event location, preferred date and your message, together with the location you chose and the time of sending. Mandatory fields are marked in the form; without them we cannot deal with your request.

To protect against automatically sent messages (spam), the form asks you to enter a security code shown in an image. We generate this image ourselves on our server; no third-party service is involved. The code is stored only in your session (session cookie, see section 6) and discarded once you send the form or after 30 minutes at the latest. The legal basis is Article 6(1)(f) GDPR; our legitimate interest lies in protecting the form against misuse.

If your message aims at concluding or performing a contract, the legal basis is Article 6(1)(b) GDPR. In all other cases it is Article 6(1)(f) GDPR; our legitimate interest lies in answering the requests addressed to us.

We do not pass this data on without your consent. If your request concerns a particular location, section 9 applies.

We store the data until your request has been dealt with and no follow-up questions are to be expected, but at most six months after the last message. If your request leads to a contract, the periods in sections 12 and 16 apply. Mandatory statutory retention obligations remain unaffected.

8. Request basket and hire request

On our website you can add items and packages to a request basket and send us a non-binding hire request from it. No hire contract is concluded via the website; your request is an invitation to us to send you a quote.

While you are collecting items, they are assigned to your session and recognised through the session cookie (see section 6). As long as you do not send the request, no personal data is stored permanently with us. The same applies to your saved items.

When you send the request we store: the location chosen, your name and (if provided) the company, email address and telephone number, your address (street and house number, postcode and town), the postcode and town of the event location and (if provided) its name and its street and house number, the date of your event, your choices regarding delivery, setup, collection and teardown, the resulting distance in kilometres and the delivery costs, your message, the items and packages requested with quantities and prices, the calculated total, and the IP address and time of sending.

We process this data in order to check your request, compare availability for your date, prepare a quote and discuss it with you. The legal basis is Article 6(1)(b) GDPR (steps taken at your request before entering into a contract).

We base the storage of the IP address and the time of sending on Article 6(1)(f) GDPR. Our legitimate interest is to detect and prevent abusive and automated requests and, in the event of a dispute, to establish when a request was sent. We do not use the IP address to analyse your behaviour on the website.

We ask for two addresses: your own and that of the event location. Your own is required because the quote and invoice are addressed to it. We only need the event address if a journey is involved. We calculate the travel from its postcode, and we need the street and house number or the name of the venue to deliver there and collect from there; both are optional. The event address indirectly reveals a place that may belong to someone else, for example a private address. We use both only to handle your request and any hire contract resulting from it.

Your request is assigned to the location you chose and sent to its mailbox. If that location is run by a separate company, section 9 applies.

If you do not contact us through the form but, for example, via Kleinanzeigen, by email or by phone, we enter your request in our system ourselves with the details you give us and note where it came from. The same purposes, legal bases and deletion periods apply as for a request via the website. The operator of the respective platform is responsible for the processing on that platform itself.

Right after sending, we send an acknowledgement of receipt to the email address you gave. It summarises your request with all your details and the items requested. The item photos in it are loaded from our web server when your email program displays images; this produces the same access data as a visit to our website (section 4). The legal basis is Article 6(1)(b) GDPR.

If we cannot accept your request, for example because items are already booked for your date or we cannot deliver, we let you know by email. We note on the request when and for what reason we declined it. This may include that we do not wish to conclude a hire contract with you, for example after problems with an earlier hire; we do not state this reason in the rejection. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is being able to trace why a request did not lead to a contract. The same deletion period applies to this note as to the request.

In response to your request we email you a quote. The quote and our terms and conditions are attached as PDF files. For this we use your name, your email address and, if provided, company and address, or for a customer account with a separate billing address that address. If you accept the quote using the link in the email, we store the time and IP address of the acceptance and send you the acceptance by email. If you accept by email, we record the acceptance with its time and send you the same confirmation; any details still missing for the contract are then taken from your message. If we still need details for the contract, for example because you made your request by phone, you add them on the same page before accepting: your full name, your address, optionally your company and telephone number and, if we deliver or collect, the address of the event location. We store them with your request and the quote, record the time and send them to the location handling your quote. After acceptance, you choose via a link in the confirmation or on the quote page whether to pay in cash on handover or by bank transfer. We store your choice with the time and pass it on to the location. For a bank transfer we show you our bank details there, together with QR codes for the bank transfer (GiroCode). We generate the codes on our own server, and no data is passed to third parties. On the order we record whether and when the advance payment and the total amount have arrived, and any amount you transferred beyond what was due. We add it to the deposit and refund it with the deposit. The legal basis is Article 6(1)(b) GDPR, and for the time and IP address additionally Article 6(1)(f) GDPR; our legitimate interest is being able to prove that the contract was concluded.

We store the emails we send you about your request (acknowledgement of receipt, quotes, messages, confirmations and rejections, with the names of the attachments) together with the request so that we can trace the history. The same periods apply to them as to the request; if they relate to a contract, the retention periods for business letters apply (section 16).

If your request does not lead to a contract, we delete it together with all its items twelve months after the event date, or, if no date was given, twelve months after receipt. If it leads to a contract, the periods in sections 12 and 16 apply.

9. Transfer to the location you choose

Our services are provided at several locations. Some of these locations are run by legally independent companies, listed with their own details in the legal notice.

If you choose such a location for your request, we transfer to it the data listed in section 8 so that it can handle your request and send you a quote. In doing so the locations handle your request for us and on our instructions: they are our processors within the meaning of Article 28 GDPR, and we have concluded a corresponding agreement with each of them. We remain the controller, and under section 2 of our terms and conditions you also conclude the contract with us.

The legal basis for the transfer is Article 6(1)(b) GDPR: it is necessary to take the pre-contractual steps you requested. You chose the location precisely because you want a quote from there.

We transfer only the data required to handle your request. No transfer takes place to locations other than the one you chose. You can exercise your rights under section 18 against us.

10. Requests by email, telephone and WhatsApp

Email. If you write to us, we process your email address, your name, the content of your message and everything you tell us in it in order to deal with your request. Our mailboxes are operated by our host (section 4). An unencrypted email can be read in transit; for particularly sensitive information please use another channel.

Telephone. If you call us, we process your number and the information you give us during the call, to the extent we need it for your request. We may keep a short note relating to a request or an ongoing hire. We do not record telephone calls.

WhatsApp. On our website you will find a link that lets you message us via WhatsApp. This is a plain link: no WhatsApp content is loaded on our website and no data is transferred to WhatsApp unless you click the link. If you message us via WhatsApp, we process your mobile number, the profile name stored there and the content of your messages. In addition the operator of the service, WhatsApp Ireland Limited, processes your data as its own controller under its own terms; we have no influence over this. If you would rather avoid that, please use one of our other contact channels.

If your request concerns an existing or prospective contract, the legal basis is Article 6(1)(b) GDPR, otherwise Article 6(1)(f) GDPR (answering requests). For WhatsApp, there is also your decision to use that channel; the legal basis in that respect is Article 6(1)(a) GDPR. The storage period corresponds to section 7; messages relating to a contract are subject to the retention periods in section 16.

11. Newsletter

If you sign up for our newsletter, we store your email address, the time of sign-up and your IP address. If you sign up using the newsletter form, you first receive an email with a confirmation link; only after clicking it will you receive newsletters (double opt-in). The legal basis is your consent (Article 6(1)(a) GDPR). You can withdraw it at any time. Use the unsubscribe link at the bottom of every email, or contact us. After unsubscribing you will not receive any more newsletters; on request we delete the address completely. Sending is handled by our own server. No external provider is involved.

You can also sign up when sending a hire request, using a separate, unticked box in the request form. The request does not depend on it. In that case we add your email address to the mailing list directly, without a confirmation email; your consent is the ticked box. For this we store your email address and the time and IP address of the request as evidence. We only use the email address from the request for this, not your other details. The legal basis, withdrawal and unsubscribing are the same as above.

If you do not confirm the sign-up, we delete the pending registration after 30 days. We do not measure whether or when you open the newsletter and do not analyse your clicks in it. We keep the evidence of your sign-up (times and IP address) for three years after you unsubscribe so that we can show, in the event of a dispute, that valid consent existed; the period is based on the standard limitation period. In addition we may keep your address on a suppression list so that you are not contacted again after unsubscribing.

12. Performing the hire contract

If a hire contract comes about, we process the data required for it. The contract is not concluded via this website but following your request or by signing a written hire contract. We keep a written hire contract on paper and as a PDF; the PDF contains the version at the time of signing and cannot be changed afterwards. The retention periods for contract data in section 16 apply.

Contract and customer data. We process your master data (name, where applicable company and authorised representative, address), your contact details (email address, telephone number), the contract data (items hired, hire period, location, prices, agreed services such as delivery, setup, collection and teardown) as well as the address of the event location and the time of the event. The legal basis is Article 6(1)(b) GDPR.

Invoice, payment and accounting. For invoicing and payment we additionally process the billing address, the invoice number, the amount, the payment method chosen and the payments received. If you pay by bank transfer, our bank provides us with your name, your IBAN and the payment reference. The legal basis is Article 6(1)(b) GDPR for the handling and Article 6(1)(c) GDPR for the recording and retention required by tax and commercial law. We pass invoices and accounting documents to our tax adviser to the extent necessary for bookkeeping. We send you the invoice as a PDF by email; we keep an issued invoice unchanged as a PDF and correct it only by means of a cancellation invoice.

Deposit. We charge a deposit for certain items. For this we process the amount of the deposit, the time and manner in which it was lodged, your bank details for repayment where it is not paid in cash, and, where applicable, any set-off against outstanding claims or claims for damages. The legal basis is Article 6(1)(b) GDPR, and additionally Article 6(1)(f) GDPR for the set-off and for documenting the repayment. Our legitimate interest lies in securing and enforcing our claims and in evidencing proper repayment.

Handover and return record. We draw up a record at handover and at return. It documents the items handed over with serial or inventory numbers, the date and time of handover and return, the condition of the items, any defects or damage found, the name of the person collecting or returning them and their signature. The legal basis is Article 6(1)(b) GDPR for performing the hire contract and Article 6(1)(f) GDPR for securing evidence. Our legitimate interest is to be able to show the condition of the items at handover and return.

Checking identity at handover. When handing over high-value items we ask to be shown an official photo ID in order to check that the person collecting them is the one with whom the hire contract was concluded. We carry out a visual comparison only. We do not make a copy or a photograph of your ID; we only record that identity was checked. The legal basis is Article 6(1)(b) GDPR (handover to the right contracting party) and Article 6(1)(f) GDPR. Our legitimate interest is protecting our property against misappropriation and fraud. There is no obligation to show ID; however, without the check we cannot hand over the items. If another person collects on your behalf, we process the name you give us in advance and check their ID at handover in the same way, by visual comparison and without a copy. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is to hand over the items only to a person authorised by the hirer.

Photographic documentation of damage. If we find damage, soiling or missing parts on return, we document them with photographs. The photographs show the hired items. We take care not to capture people or details of the surroundings beyond the damage; where this cannot be avoided in an individual case, we obscure the areas concerned as far as possible without destroying their evidential value. The legal basis is Article 6(1)(b) GDPR for handling the return and Article 6(1)(f) GDPR for securing and enforcing claims for damages.

We keep photographs of damage until the matter is closed: the deposit settled, any damage resolved and no claims outstanding. If claims are disputed or asserted, we keep the photographs until the limitation period expires; for the lessor’s claims for changes to or deterioration of the hired items this is six months from their return under section 548(1) of the German Civil Code. Where the photographs become part of an accounting document, the periods in section 16 apply.

Delivery and event location. If we deliver, we process the delivery address and an on-site contact person with a telephone number. If the delivery address is not your own but that of a third party (for example a venue or a private individual), we also process that person’s data. Please inform the person concerned that you have given us their details. If we engage a haulage company for the delivery, it receives the information required for the delivery. The legal basis is Article 6(1)(b) GDPR and, as regards third-party data, Article 6(1)(f) GDPR (performing the agreed delivery).

13. Customer account, loyalty levels and hire history

Customer account. You can voluntarily create a customer account with us. The account gives you the benefits for regular customers (loyalty level and contactless handover, see below), and your contact details are already filled in on every request. For the account we store your email address, your first and last name and your address (street and house number, postcode and town), optionally your company and telephone number and, if the invoice should go to a different address, a billing address (company or name, street, postcode, town), your preferred language and your password. We do not store the password in plain text, only as a non-reversible hash. If you send a request while logged in, we link it to your account and pass a stored separate billing address on to the location you chose together with the request (section 9). If you create the account via the link on a quote page, the details from the quote are already filled in, and we link this request with its quotes and invoices to your account. Quotes and orders for these requests are shown in your account under “Quotes” and “Orders”, where you can download them as PDF, as well as the invoices and any cancellation invoices for your orders.

To protect your account we process, for every login attempt, the IP address, the email address entered and whether the login succeeded. After several failed attempts we temporarily block logins. We delete these records after 30 days. For your account we also record the time and IP address of your last login. For every active login we store a random session identifier (only as a hash), the IP address and your browser identifier (user agent). We delete this data when you log out or when the login expires. We also end all other logins as soon as you change your password. If you forget your password, we send you a reset link to the email address of your account on request. For this we store the time, the IP address of the request and a random identifier, but only as a hash. The link is valid for 60 minutes and can be used once; we delete expired and used identifiers with the next request. The cookie that keeps you logged in is listed in section 6.

The legal basis for the account is Article 6(1)(b) GDPR: you use it voluntarily to handle requests and hire contracts with us more easily. For the login records and the session data it is Article 6(1)(f) GDPR. Our legitimate interest is protecting your account against unauthorised access.

You can change your details in your customer account yourself at any time. We keep the account until you ask us to delete it. Just send us a short message and we will delete it together with its login data. Requests and contract documents that we are required by law to retain are not affected (section 16).

Anyone who hires from us repeatedly receives a tiered discount on the hire price and the deposit (section 11 of our terms and conditions). To do that we have to record how often you have already hired from us. For this we record, for each order in your account, when it was completed (everything returned and paid) and, if it comes to that, whether and for what reason we raised a complaint about it under section 11(7). From this we calculate your loyalty level; it is shown in your customer account and in every quote. From level 1, that is from your second hire, you can collect and return contactless (section 9(6) and section 19(8) of our terms and conditions). We send you the place and time window by email. When you arrive you call us, and we open the gate remotely. The area in front of and behind the gate is monitored by a camera so that we can see who is standing there before we open it and that nobody unauthorised gets in. We only see the live image; no recordings are stored. Camera and gate control run on our own equipment, without any other provider's servers. Anyone standing in front of the gate can be seen, not only customers. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is protecting the depot and the hire items against unauthorised access. A sign at the gate points out the camera.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in customer loyalty and in aligning the need for security with an actual risk: for someone with many hires without complaint the risk of loss is lower than for an unknown person, and the deposit may reflect that.

The level is an assessment with a concrete legal consequence, namely price and deposit. However, it results from a simple, disclosed rule (level equals the number of completed hires, up to 15, with one per cent off the price and two per cent off the deposit per level) and a human decides on every contract. This does not amount to an automated decision in an individual case within the meaning of Article 22 GDPR; see also section 20.

You can object to a loyalty account being kept at any time (section 19) or request its deletion (section 18). Both have the same effect: the level lapses and future hires are again charged at the full price and with the full deposit. We point this out to you before we delete anything.

If no hire has taken place for three years, the level lapses: earlier hires no longer count. We keep contract and invoice data only as long as the law requires (section 16).

14. Embedded content and third-party services

We embed no third-party services on this website that transfer data by themselves when a page opens. In particular there is no web analytics or reach measurement, not even anonymised, no tag manager, no advertising, remarketing or conversion tracking services, no social plugins and no sharing buttons, no map services, no audio content, no captcha service, no chat or chatbot tools and no review widgets. The only exception is YouTube videos on some item pages, and even they only load once you start them yourself (see below).

YouTube videos: on some item pages we show up to three videos from YouTube, for example a product video, a review or a tutorial. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. At first you only see a preview image with a title; we fetched the image from YouTube once and it is stored on our own server. When the item page opens, nothing is therefore loaded from YouTube and no data is transmitted to Google.

Only when you click “Play video” does your browser load the YouTube player, via the address youtube-nocookie.com (privacy-enhanced mode). At least your IP address, the address of the item page and technical details about your browser are then transmitted to Google. From that moment Google may use cookies or similar technologies on your device and associate the playback with your Google account if you are signed in there. Without JavaScript the tile is an ordinary link that opens the video on youtube.com.

The click is your consent (section 25(1) of the German TDDDG, Article 6(1)(a) GDPR). It applies only to that one video and only to this page view; we do not store it, and on your next visit only the preview image is shown again. From the click onwards Google processes the data as its own controller; we have no influence over this. Details are in Google’s privacy policy at policies.google.com/privacy. You can delete cookies set by YouTube in your browser. On transfers to the USA see section 17.

The fonts used are stored on our own server and delivered from there. No connection is made to other providers’ font servers. Our pages retrieve no content from outside our own servers unless you start a video. Links pointing to third-party offerings (for example to WhatsApp) are plain links and only transfer data once you click them.

Sharing: on item pages, with the packages and in the request basket you can pass on a link via WhatsApp, by email, through your device’s share menu or by copying it. These are also plain links: unless you tap one, nothing is loaded from WhatsApp and nothing is transferred. The link contains only the address of the item or package, or for a shared request basket the items and quantities. It contains nothing about you, and we do not store shared lists. If you share via WhatsApp, WhatsApp opens with the prepared text. Whatever you send there is processed by WhatsApp Ireland Limited as its own controller (see section 10). For email and the share menu, the app you choose takes over. When you copy the link, it only goes to your own device’s clipboard.

Should we embed third-party content or services in future, we will amend this policy beforehand and (where required) obtain your consent before the embedding transfers any data to the provider.

15. Recipients of your data

We pass your data on only where this is necessary and a legal basis exists. The recipients are:

We have concluded agreements under Article 28 GDPR with all service providers that process data on our behalf. They process your data solely on our instructions and may not use it for their own purposes. No data is passed to third parties for advertising purposes. We do not sell data.

16. How long we store your data

We delete personal data as soon as the purpose of processing has ceased and no statutory retention obligation stands in the way. Data we process on the basis of your consent is stored until you withdraw it. Data for performing a contract is stored for the duration of the contractual relationship and beyond that for as long as claims can be asserted or statutory retention periods are running. Data processed on the basis of a legitimate interest is stored until our interest ceases or you effectively object.

Statutory periods are in particular ten years for commercial books, inventories, annual accounts and accounting documents (section 257(1) nos. 1 and 4, (4) of the German Commercial Code; section 147(1) nos. 1 and 4, (3) of the German Fiscal Code), ten years for invoices (section 14b(1) of the German VAT Act) and six years for commercial and business letters received and sent (section 257(1) nos. 2 and 3, (4) of the German Commercial Code; section 147(1) nos. 2 and 3, (3) of the German Fiscal Code). The periods begin at the end of the calendar year in which the document was created. During the retention period we restrict processing to storage; the data is then no longer used for other purposes.

An overview of the periods we have set ourselves:

17. Transfers to countries outside the EU

We process your data exclusively on servers within the European Union. We do not transfer data to countries outside the European Union or the European Economic Area.

An exception may arise if you message us via WhatsApp. In that case the provider processes your data as its own controller and may transfer it to the USA. We have no influence over this. If you wish to avoid that, please use one of our other contact channels.

The same applies if you start a YouTube video on an item page (section 14). Google may also process the data transmitted in the process in the USA. Google LLC is certified under the EU-US Data Privacy Framework; the European Commission has adopted an adequacy decision for transfers to companies certified in this way (Article 45 GDPR).

18. Your rights

Access (Article 15 GDPR). You can ask whether and what data we process about you, for what purposes, to which recipients we pass it on, how long we store it and where it comes from. You can request a copy of the data.

Rectification (Article 16 GDPR). You can request the correction of inaccurate data and the completion of incomplete data.

Erasure (Article 17 GDPR). You can request the deletion of your data, in particular where it is no longer necessary for the purposes, where you have withdrawn consent or where the processing was unlawful. The right does not apply where we are legally required to retain the data or need it to assert or defend legal claims.

Restriction of processing (Article 18 GDPR). You can ask us to restrict processing, for example while we check the accuracy of disputed data or if you need the data for legal claims instead of having it deleted.

Data portability (Article 20 GDPR). Where we process data automatically on the basis of your consent or to perform a contract, you can request to receive it in a structured, commonly used and machine-readable format or to have it transmitted to another controller, where technically feasible.

Objection (Article 21 GDPR) see section 19; withdrawal of consent (Article 7(3) GDPR) see section 22; complaint to a supervisory authority (Article 77 GDPR) see section 21.

An informal message to the contact details in section 1 is enough to exercise your rights. We reply without undue delay, at the latest within one month. If the deadline cannot be met because of complexity, we will tell you and give the reason. Access is free of charge. Where there are reasonable doubts about your identity, we may request additional information to identify you; we use it solely for that purpose.

19. Right to object under Article 21 GDPR

Where we process data on the basis of Article 6(1)(f) GDPR, you have the right to object at any time, on grounds relating to your particular situation, to that processing; this also applies to profiling based on that provision.

If you object, we will no longer process your data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.

If we process your data for direct marketing, you have the right to object to that processing at any time; this also applies to profiling connected with it. If you object, we will no longer use your data for direct marketing. You do not have to give reasons for this objection.

You can send your objection informally to the contact details given in section 1.

20. No automated decision-making

We do not use automated decision-making within the meaning of Article 22 GDPR. We do not take decisions producing legal effects concerning you or similarly significantly affecting you based solely on automated processing.

The total shown on our website is calculated automatically from the items selected, the hire period and the distance, and the loyalty level under section 13 is also arrived at by calculation. Both are non-binding, however, and do not replace a decision on your request: every request is checked and answered by a person, and the contract only comes about through that person’s quote.

21. Right to complain to a supervisory authority

Without prejudice to any other remedy, under Article 77 GDPR you have the right to complain to a data protection supervisory authority if you consider that the processing of your data infringes the GDPR. You may contact the authority of your habitual residence, your place of work or the place of the alleged infringement. The authority responsible for us is:

We would be glad if you contacted us first. Many concerns can be resolved directly.

Die Landesbeauftragte für den Datenschutz Niedersachsen
Prinzenstraße 5
30159 Hannover
Phone: 0511 120-4500
Email: poststelle@lfd.niedersachsen.de
https://www.lfd.niedersachsen.de (opens in a new tab)

22. Withdrawing consent

Some processing is only possible with your express consent. You can withdraw consent already given at any time. No particular form is required; an informal message to the contact details in section 1 is enough. The lawfulness of processing carried out before the withdrawal is unaffected.

Withdrawal is as easy as giving consent. For the newsletter, a click on the unsubscribe link at the end of each message is enough.

23. Map on the contact page

On our contact page we show the chosen location on a map. The map material comes from OpenStreetMap, an open mapping project run by the OpenStreetMap Foundation, St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom.

The map images are stored on our own server. We downloaded them once; when the contact page opens, nothing is loaded from OpenStreetMap or any other third-party server. Your IP address is therefore not transmitted to anyone, no cookie is set, and we do not need your consent for this.

Below the map there are two links, “Plan a route” and “Open in Google Maps”. Both are ordinary links and load nothing by themselves. Only if you click one of them do you open Google Maps, in your browser, or in the app if it is installed on your device. From that click onwards Google’s privacy terms apply (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland); see policies.google.com/privacy. We transmit nothing about you in the process. The link contains only the location you want to be guided to.

Our address is also always shown in the text on the contact page, independently of the map.

24. Changes to this privacy policy

We adapt this privacy policy when our services, the technology we use or the legal situation change. The version published on this page applies in each case. If processing based on your consent changes, we will obtain your consent again.

Last updated: 10 November 2026