Privacy Policy of Choice AG
Last updated: October 2026
Introduction
The protection of your personal data is very important to us. This privacy policy explains how Choice AG collects, uses and protects your personal data. We inform you about the nature, scope and purpose of the data processing. Our aim is to provide you with transparency regarding the data processing operations we carry out.
Key information at a glance
- Controller responsible for data processing: Choice AG, Thomas-Mann-Straße 16 – 20, 90471 Nürnberg.
- Purpose of processing: contract performance, communication, marketing.
- Your rights: You have the right to access, rectification, erasure, objection and data portability.
- Contact data protection officer: datenschutzbeauftragter@proliance.ai
1. Controller and Data Protection Officer
Controller responsible for data processing:
Choice AG
Thomas-Mann-Straße 16 – 20
90471 Nürnberg
Germany
Contact:
Telephone: +49 911 480499-0
E-mail: info@choice.de
Website: www.choice.de
Authorised representatives (Management Board): Antonio Pardo (Chairman), Bego Jasenac, Hannes Beyer
Commercial register:
Amtsgericht Nürnberg (Local Court of Nuremberg), HRB 41407
External data protection officer:
Mr Dominik Fünkner
Proliance GmbH
Leopoldstraße 21
80802 München
Germany
Contact: datenschutzbeauftragter@proliance.ai
You may contact our data protection officer directly at any time with questions about data protection or to exercise your rights.
2. Scope of this Privacy Policy
This privacy policy informs you about how Choice AG (hereinafter "we" or "Choice") processes personal data. It applies to:
- Visitors to our website: www.choice.de
- Business partners and customers (companies and their employees)
- Users of the Fleetshop
- Users of Choice Connect
- Prospective customers (e.g. for marketing communication)
- Applicants for open positions
- Visitors to our office locations
- Newsletter recipients
- Social media users (followers, interaction partners)
This privacy policy explains which data we collect, for which purposes we process it, on which legal basis this takes place and which rights you have.
3. Legal Bases for Data Processing
Your personal data is processed on the basis of the following legal bases of the General Data Protection Regulation (GDPR) and the TDDDG (German Telecommunications Digital Services Data Protection Act):
- Consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG): Where you have given us your express consent, for example to receive newsletters, to have your data stored in the talent pool or for the use of cookies for analytics or marketing purposes.
- Contract performance or pre-contractual measures (Art. 6(1)(b) GDPR): Where processing is necessary to perform a contract with you or to carry out pre-contractual measures, for example when handling enquiries submitted via the contact form, in the course of application procedures or in the provision of services.
- Legal obligation (Art. 6(1)(c) GDPR): Where we are legally obliged to process your data, for example to comply with tax retention obligations or to meet security requirements at our office locations (e.g. ArbSchG (German Occupational Health and Safety Act): to ensure the safety of employees and visitors; StGB (German Criminal Code): to support law enforcement measures in the event of security-related incidents; BGB (German Civil Code): to defend against or assert legal claims).
- Legitimate interest (Art. 6(1)(f) GDPR): Where processing is necessary to safeguard our legitimate interests, for example: to improve our services through the analysis and optimisation of processes, to ensure IT security and prevent misuse (e.g. protection against cyberattacks and detection of fraud attempts), to assert legal claims (e.g. enforcement of claims or defence against unjustified claims) or to document access to our office locations in order to protect employees and visitors and to ensure building security.
- Purposes of the employment relationship (Art. 88 GDPR in conjunction with Section 26 BDSG (German Federal Data Protection Act)): Where processing is necessary to establish, carry out or terminate an employment relationship, for example in the course of application procedures.
- Technically necessary services (Section 25(2) TDDDG): Where processing is necessary to provide technically necessary services, for example for session management, consent management or IT security.
4. General Information on Data Transfers to Third Countries
In the course of our business activities and to provide our services, we sometimes use service providers that are based outside the European Union (EU) or the European Economic Area (EEA). This applies in particular to service providers in the USA.
Legal bases for third-country transfers:
We only transfer personal data to third countries where this is legally permissible and an adequate level of data protection is ensured. In doing so, we rely on the following safeguards:
4.1 Adequacy Decision of the EU Commission (Art. 45 GDPR)
For certain countries, the EU Commission has determined that an adequate level of data protection exists there. In this case, no further authorisation is required.
Examples:
- USA: EU-U.S. Data Privacy Framework (DPF) – applies to certified US companies
- United Kingdom (UK): adequacy decision since 2021
- Switzerland, Canada, Japan, Israel and others
Important: We only transfer data on the basis of an adequacy decision (DPF, where certified) or appropriate safeguards (SCC including, where applicable, supplementary measures).
We only work with US companies that are certified. A list of companies certified under the EU-U.S. Data Privacy Framework can be found at: https://www.dataprivacyframework.gov
4.2 Standard Contractual Clauses (Art. 46(2)(c) GDPR)
Where no adequacy decision exists or additional security is desired, we conclude the Standard Contractual Clauses (SCC) approved by the EU Commission with our service providers. These oblige the recipient to ensure a level of data protection equivalent to that of the GDPR.
4.3 Data Processing Agreements (Art. 28 GDPR)
We have concluded data processing agreements (DPA) with all service providers that process personal data on our behalf. These govern:
- The nature and scope of the data processing
- Technical and organisational measures for data protection
- The duty of confidentiality
- The rights and obligations of both parties
- The erasure of data upon completion of the engagement
Examples of third-country transfers:
Service provider | Country | Safeguard |
OpenAI | USA | Standard Contractual Clauses |
Google (Gemini) | USA | EU-U.S. Data Privacy Framework + Standard Contractual Clauses |
Anthropic (Claude) | USA | Standard Contractual Clauses |
Microsoft (Power Automate, Copilot) | USA | EU-U.S. Data Privacy Framework + Standard Contractual Clauses |
Superpowered Labs (VAPI AI) | USA | Standard Contractual Clauses |
5. General Information on the Use of Artificial Intelligence (AI)
We use artificial intelligence (AI) to improve our services, automate processes and offer you better service. In doing so, we attach great importance to transparency and data protection.
5.1 Overview: Where and how do we use AI?
Area of use | AI provider | Purpose | Legal basis | Retention period | Third-country transfer |
Website chatbot | DentroInnovation OÜ, Estonia / OpenAI LLC, USA / Anthropic, USA | Answering customer enquiries | Legitimate interest (Art. 6(1)(f) GDPR) | 30 days | USA (SCC) |
E-mail processing | Microsoft Power Automate, EU region / OpenAI LLC, USA | Automated processing of enquiries | Contract performance (Art. 6(1)(b) GDPR), legitimate interest (Art. 6(1)(f) GDPR) | 30 days (OpenAI), temporary (Power Automate) | USA (SCC; Data Privacy Framework) |
Internal process automation | Microsoft 365 (Copilot), EU region / OpenAI LLC, USA | Support with administrative tasks | Legitimate interest (Art. 6(1)(f) GDPR) | In accordance with internal policies (Microsoft 365) | USA (Data Privacy Framework; SCC) |
Processing of business transactions | Anthropic Ireland Ltd. (EU); onward transfer to the USA | Support with work-related tasks | Legitimate interest (Art. 6(1)(f) GDPR) | In accordance with internal policies | USA (SCC) |
AI-supported telephony | Superpowered Labs Inc. (VAPI AI), USA / OpenAI LLC, USA / Assembly, USA / Deepgram, USA / ElevenLabs, USA | Transcription and analysis of telephone calls, automated call handling | Consent (Art. 6(1)(a) GDPR), contract performance (Art. 6(1)(b) GDPR) | 30 days |
|
5.2 Automated Decision-Making (Art. 22 GDPR)
We do not use AI to make automated individual decisions that produce legal effects concerning you or similarly significantly affect you (e.g. automatic rejection of contract requests or credit checks carried out solely by AI).
How AI systems support us:
Our AI systems support employees in handling enquiries by:
- Pre-structuring and categorising enquiries
- Generating suggested responses
- Extracting information from documents
- Automating routine tasks
However, the final decision on business-critical matters (e.g. contract conclusions, rejections, credit decisions) is always made by an employee.
Note: Further information on your rights in relation to the processing of your data by AI can be found in Section 14. Rights of Data Subjects.
6. Privacy Information for Website Visitors
6.1 General Information on Data Processing on Our Website
When you visit our website www.choice.de information is automatically processed that is technically necessary to display the website to you and to provide its functions. In addition, we use services that help us to improve and analyse the website and to show you relevant content.
6.2 Cookies and Similar Technologies
What are cookies and similar technologies?
Cookies are small text files that are stored on your device when you visit our website. Similar technologies include methods such as local storage, session storage or pixel tags, which can also store data on or read data from your device. These technologies make it possible to recognise you on a return visit, to save certain settings or to analyse your user behaviour.
Which types of cookies and similar technologies do we use?
Category | Description | Consent required |
Necessary | Required to provide the basic functions of the website (e.g. session management, consent management, IT security). | No |
Functional | Enable extended functions and more convenient use (e.g. fonts, CDN, chatbot). | Yes |
Analytics | Help us to understand how users behave on our website and to improve the website. | Yes |
Marketing | Enable personalised advertising and the measurement of advertising campaign performance. | Yes |
How can you manage the use of these technologies?
Our consent banner allows you to decide individually which categories of cookies and similar technologies you wish to allow. The banner controls all content requiring consent, including technologies for analytics, marketing and functionality. Your consent is logged and can be withdrawn at any time via the 'Cookie settings' link at the bottom of every page. Please note that technically necessary cookies do not require consent pursuant to Section 25(2) TDDDG.
6.3 Services and Tools Used
6.3.1 Category: Necessary
These services are technically required to provide the website. They do not require consent.
Service | Provider | Purpose | Data processed | Third-country transfer | Retention period |
Web hosting & server log files | Hetzner Online GmbH, Germany | Technical provision of the website, IT security, detection and prevention of attacks | IP address, date and time, page accessed, referrer URL, browser type, operating system | No | 7 days (then anonymised) |
Usercentrics | Usercentrics GmbH, Germany | Management of cookie consents | Timestamp, IP address (encrypted), consent status | No | 12 months |
AI-supported chatbot | DentroInnovation OÜ, Estonia / OpenAI LLC, USA | Supporting users by answering enquiries and assisting with navigation | Chat content, IP address, timestamp, browser information | USA (SCC) | 30 days (OpenAI) |
6.3.2 Category: Functional
These services improve the user experience but are not strictly necessary.
Service | Provider | Purpose | Data processed | Third-country transfer | Retention period |
jsDelivr | Volentio JSD Limited, United Kingdom | Content Delivery Network (CDN) for optimising loading times | IP address, requested resource, timestamp | United Kingdom (adequacy decision) | Temporarily during the session |
Google reCAPTCHA | Google LLC, USA | Protection against spam and automated requests | IP address, browser fingerprint, mouse movements, timestamp | USA (Data Privacy Framework) | Temporarily during the session |
Google Photos | Google LLC, USA | Provision of images via the platform | IP address, device information | USA (Data Privacy Framework) | No permanent storage |
Withgoogle Websites | Google LLC, USA | Provision of resources via Google services | IP address, device information | USA (Data Privacy Framework) | Temporarily during the session |
Google Scripts | Google LLC, USA | Various Google scripts for providing website functions | IP address, device information | USA (Data Privacy Framework) | Temporarily during the session |
6.3.3 Category: Analytics
These services help us understand how visitors use our website. They require consent.
Service | Provider | Purpose | Data processed | Third-country transfer | Retention period |
Usercentrics Analytics | Usercentrics GmbH, Germany | Analysis of consent rates and user interactions with the consent banner | IP address, consent status, timestamp | No | 12 months |
6.3.4 Category: Marketing
These services enable personalised advertising and the measurement of advertising campaign performance. They require consent.
Service | Provider | Purpose | Data processed | Third-country transfer | Retention period |
Google Analytics (GA4) | Google LLC, USA | Analysis of user behaviour, classified as a marketing tool | IP address (anonymised), cookie ID, device information, click paths | USA (Data Privacy Framework) | Cookies: 14 months, data: 26 months |
Google Tag Manager | Google LLC, USA | Management and integration of tags to improve marketing and tracking functions | IP address, browser information | USA (Data Privacy Framework) | No permanent storage |
Google Ads Conversion Tracking | Google LLC, USA | Measurement of advertising campaign performance | IP address, cookie ID, click ID (GCLID), pages visited, conversion events, timestamp | USA (Data Privacy Framework) | Cookies: 90 days; data: 540 days |
Google Ads Remarketing | Google LLC, USA | Personalised advertising on other websites | IP address, cookie ID, pages visited, interactions with content | USA (Data Privacy Framework) | Cookies: 540 days |
Google DoubleClick | Google LLC, USA | Programmatic advertising, display advertising | IP address, cookie ID, pages visited, interactions with advertisements, timestamp | USA (Data Privacy Framework) | Cookies: 540 days |
LinkedIn Insight Tag | LinkedIn Corporation, USA | Analysis of interactions on LinkedIn | IP address, cookie ID, click paths | USA (Data Privacy Framework) | Cookies: 180 days |
Google Adsense for YouTube | Google LLC, USA | Personalised advertising on YouTube | IP address, cookie ID, videos viewed | USA (Data Privacy Framework) | Cookies: 540 days |
YouTube Images | Google LLC, USA | Display of thumbnail images for embedded videos | IP address, cookie ID | USA (Data Privacy Framework) | Cookies: 540 days |
Google Photos | Google LLC, USA | Display of embedded image galleries and albums | IP address, browser information, cookie ID (if signed in to Google) | USA (Data Privacy Framework) | Cookies: up to 180 days |
Important note:
Where consent has been given, we may create pseudonymous usage profiles for remarketing. You can withdraw this consent at any time and object to the profiling.
6.4 Contact form
Description:
If you contact us via the contact form, your data will be processed in order to handle your enquiry.
System | Purpose | Data processed | Third-country transfer | Retention period |
HubSpot | Provision of the contact form | Salutation (optional), first name, surname, company (optional), e-mail address, telephone number (optional), organisation (optional), message content, IP address | USA (Data Privacy Framework) | For as long as we send marketing e-mails |
Salesforce CRM | Storage and management of enquiries | Name, e-mail address, telephone number, company, message content, time, IP address | USA (Data Privacy Framework) | 3 years (if no contract is concluded) |
Google reCAPTCHA | Protection against spam and automated requests | IP address, browser fingerprint, mouse movements, click behaviour, timestamp | USA (Data Privacy Framework) | Temporarily (during the session) |
AI-assisted e-mail processing | Automated processing and answering of enquiries | E-mail content, name, e-mail address, timestamp | USA (SCC) | 30 days (OpenAI), temporarily (Power Automate) |
Important notes:
- The AI systems do not use your data for training AI models. This is excluded by contract.
- Please do not enter any sensitive data in the contact form (e.g. health data, bank details, passwords).
- If you contact us via the contact form, the data you provide will be processed in order to handle your enquiry and – if you so wish – to send you information about our products and services. Your data will be processed solely for handling your enquiry and for the related communication. In addition, we may use the data to improve our customer service by analysing frequent enquiries and optimising our processes. The processing is based on your consent pursuant to Art. 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future.
7. Privacy information for business partners, customers and other groups of persons
7.1 General information on data processing in business dealings
We process personal data of business partners and customers (in particular companies and their employees) in order to initiate, perform and conclude business relationships. This includes all measures required for the performance of the contract.
7.2 Data processed and purposes
In the course of our business relationships, we process various categories of personal data. The following table gives you an overview of the most important data categories, the purposes for which they are used and the respective retention periods:
Data category | Examples | Purpose | Retention period |
Master data | Surname, first name, company, position, address | Identification, communication, contract processing | Duration of the business relationship + 3-10 years |
Contact data | E-mail address, telephone number, mobile number | Communication, contract processing | Duration of the business relationship + 3-10 years |
Contract data | Contract type, contract number, term, conditions, order data, delivery data | Contract performance, documentation | 6-10 years (HGB, AO) |
Payment data | Bank details, billing address, payment method, payment history | Payment processing, accounting | 10 years (statutory tax retention obligations) |
Communication data | E-mails, telephone calls, letters, chat histories, notes | Customer support, documentation, quality assurance | At least 3 years (statutory limitation period) |
CRM data | Correspondence history, interest profiles, customer satisfaction | Customer relationship management, service optimisation | Duration of the business relationship + 3 years |
Vehicle-related data | Vehicle identification number (VIN), registration number, vehicle type, condition reports, mileage | Vehicle management, contract processing, claims management | 6-10 years |
Insurance data | Insurance company, policy number, insurance confirmation | Handling of insurance cases, claims settlement | Until settlement + 3 years |
Claims data | Accident reports, damage photos, expert reports, administrative offences, traffic violations | Claims handling, assertion of claims | Until settlement + 3 years |
Creditworthiness data | Credit reports, scoring values, payment behaviour | Assessment of solvency, risk minimisation | Until end of contract + 3 years |
Connected car data | Telemetry data, location data, usage data (where technically available and contractually agreed) | Vehicle management, maintenance planning, damage prevention | In accordance with the contractual agreement |
7.3 Recipients and categories of recipients
Within our company, your data is only passed on to persons who need it to perform their duties. In addition, we pass on data to the following external recipients:
Recipient category | Examples | Purpose | Third-country transfer |
Affiliated companies | KMS Mobility Solutions GmbH, Fuhrwerk Plus GmbH, insert effect GmbH | Contract processing, customer support | No (Germany) |
IT service providers | Hetzner (hosting), Microsoft 365, Salesforce (CRM) | Technical provision, data management | USA (Microsoft, Salesforce – Data Privacy Framework) |
Payment service providers | Banks, credit card companies | Payment processing | No (EU) |
Logistics and vehicle registration services | PS-Team Deutschland GmbH, TÜV Süd, Fuhrwerk Plus GmbH | Vehicle registration, deregistration, logistics | No (Germany) |
Credit reference agencies | CRIF GmbH, SCHUFA Holding AG, Creditreform | Credit check | No (Germany) |
Assessors and experts | TÜV SÜD, intertaxexpert / myschaden24 | Vehicle valuation, damage assessment | No (Germany) |
Debt collection and legal service providers | Debt collection agencies, lawyers | Receivables management, legal enforcement | No (Germany) |
Tax advisers and auditors | Tax advisers | Statutory obligations, annual financial statements | No (Germany) |
Authorities and public bodies | Tax offices, police, public prosecutor's office, regulatory offices, municipalities | Statutory obligations, law enforcement | No (Germany) |
7.4 Special processing operations
7.4.1 Credit check and scoring
Before concluding a contract or where we have a legitimate interest, we check your creditworthiness by obtaining information from credit reference agencies. In doing so, we receive information on your previous payment behaviour and creditworthiness values (score). This serves to minimise the risk of payment default.
Credit reference agencies used:
- SCHUFA Holding AG, Kormoranweg 5, 65201 Wiesbaden – https://www.schufa.de/datenschutz
- CRIF GmbH, Victor-Gollancz-Straße 5, 76137 Karlsruhe – https://www.crifbuergel.de/de/datenschutz
- Creditreform, Hammfelddamm 13, 41460 Neuss – https://www.creditreform.de/datenschutz
Right to object: You may object to this processing. In this case, however, we may be unable to conclude the contract or may only be able to offer it against advance payment.
7.4.2 Receivables management and debt collection
In the event of late payment, we may pass on your data to debt collection agencies or lawyers in order to enforce outstanding claims.
7.4.3 Administrative offences and traffic violations
In connection with the use of our vehicles, it may be necessary to process personal data for the handling of administrative offences or traffic violations. This applies in particular when authorities request us to provide information about the driver of the vehicle.
7.4.4 Connected car and telematics
For vehicles with connected car functions, technical data (e.g. location, mileage, vehicle condition, usage behaviour) may be collected. This data processing takes place only where it has been contractually agreed or where you have given your consent.
Note: With connected car services, we generally have no influence over which data the vehicle manufacturers and importers record and process via the systems installed in the vehicle. The vehicle manufacturers are independently responsible for this data processing.
7.5 Advertising to existing customers
We use your e-mail address to send you information on similar products or services. This direct marketing is based on our legitimate interest pursuant to Art. 6(1)(f) GDPR in conjunction with Section 7(3) UWG.
Right to object: You may object to this use at any time – e.g. via the unsubscribe link in the e-mail.
8. Privacy information for Fleetshop users
8.1 What is the Fleetshop?
The Fleetshop is our digital B2B platform through which business customers can rent vehicles. The platform enables the booking, administration and processing of rental contracts.
8.2 Additional data processed
In addition to the general business data mentioned in Section 7.2, we process the following specific data in connection with the Fleetshop:
Data category | Examples | Purpose | Legal basis | Retention period |
User account data | User name, password (encrypted), permissions | Access to the platform, authentication | Performance of a contract (Art. 6(1)(b) GDPR) | Until the account is deleted |
Booking data | Rental period, vehicle type, booking number, pick-up location, return location | Contract processing, vehicle administration | Performance of a contract (Art. 6(1)(b) GDPR) | 6-10 years |
Technical access data | IP address (anonymised), browser type, endpoints used and request parameters | System operation, IT security, error diagnosis | Legitimate interest (Art. 6(1)(f) GDPR) | Approx. 7 days |
Form entries | Contact forms, enquiries, feedback | Customer service, contract initiation | Performance of a contract (Art. 6(1)(b) GDPR) | 3 years |
8.3 Systems and service providers used
Fleetshop front end and back end | KMS Mobility Solutions GmbH, Germany | Rental management software, booking processing | Performance of a contract (Art. 6(1)(b) GDPR) | No |
Hosting | Hetzner Online GmbH, Germany | Technical provision of the platform | Performance of a contract (Art. 6(1)(b) GDPR) | No |
CRM (Salesforce) | Salesforce Inc., USA / Salesforce.com Germany GmbH, Germany | Customer data administration, contract management | Performance of a contract (Art. 6(1)(b) GDPR) | USA (Data Privacy Framework) |
Google Maps | Google LLC, USA | Location display, route planning | Performance of a contract (Art. 6(1)(b) GDPR) | USA (Data Privacy Framework) |
Microsoft Services (Azure) | Microsoft Ireland Operations Ltd., Ireland | Hosting of application and data components, cloud infrastructure | Performance of a contract (Art. 6(1)(b) GDPR) | USA (Data Privacy Framework) |
Sentry | Functional Software, Inc., USA | Error and performance monitoring to ensure stability | Legitimate interest (Art. 6(1)(f) GDPR) | USA (Data Privacy Framework) |
Google Fonts | Google LLC, USA | Consistent display of fonts | Legitimate interest (Art. 6(1)(f) GDPR) | USA (Data Privacy Framework) |
Important note: Driving licence information is not stored in our system landscape.
9. Privacy information for Choice Connect users
9.1 What is Choice Connect?
Choice Connect is our digital B2B customer platform, which offers business customers functions for booking, managing and planning vehicles as well as for viewing contract-related information.
9.2 Additional data processed
In addition to the general business data mentioned in Section 7.2, we process the following specific data in connection with Choice Connect:
Data category | Examples | Purpose | Legal basis | Retention period |
User account data | User name, password (encrypted), permissions, roles | Access to the platform, authentication, rights management | Performance of a contract (Art. 6(1)(b) GDPR) | Until the account is deleted |
Planning data | Vehicle bookings, usage periods, planning calendar | Fleet management, resource planning | Performance of a contract (Art. 6(1)(b) GDPR) | 6-10 years |
Reporting data | Usage statistics, cost overviews, utilisation reports | Transparency, controlling, optimisation | Performance of a contract (Art. 6(1)(b) GDPR) | 6-10 years |
Technical access data | IP address, timestamp, browser data | System operation, IT security | Legitimate interest (Art. 6(1)(f) GDPR) | A few weeks |
9.3 Systems and service providers used
System/service | Provider | Purpose | Legal basis | Third-country transfer |
Salesforce CRM | Salesforce Inc., USA / Salesforce.com Germany GmbH, Germany | Administration of customer data | Legitimate interest (Art. 6(1)(f) GDPR) | USA (Data Privacy Framework) |
HubSpot | HubSpot Inc., USA | E-mail dispatch, marketing automation, tracking, management of unsubscriptions | Consent (Art. 6(1)(a) GDPR) | USA (Data Privacy Framework) |
Hosting | IONOS SE, Germany | Technical provision of the platform | Performance of a contract (Art. 6(1)(b) GDPR) | No |
Single Sign-On (SSO) | Keycloak (open-source software, CNCF); self-hosted | Central authentication and access management | Performance of a contract (Art. 6(1)(b) GDPR) | No |
Front end/back end | insert effect GmbH, Germany | Development and operation of software components of the platform | Performance of a contract (Art. 6(1)(b) GDPR) | No |
Front end/back end | KMS Mobility Solutions GmbH, Germany | Development and operation of software solutions for rental management and booking processing | Performance of a contract (Art. 6(1)(b) GDPR) | No |
10. Advertising and marketing
10.1 E-mail marketing
Description
We use the e-mail addresses of business customers and prospective customers to inform them about products, services, offers and events. Marketing e-mails are sent both to active customers and to prospective customers who have given their consent.
Data category | Examples | Purpose | Legal basis | Retention period |
Contact data | Surname, first name, company, position, e-mail address | Dispatch of marketing e-mails to existing customers and prospective customers | Consent (Art. 6(1)(a) GDPR), legitimate interest (Art. 6(1)(f) GDPR) in conjunction with Section 7(3) UWG | Until consent is withdrawn or an objection is raised |
Interaction data | Open and click rates, timestamps | Analysis and optimisation of marketing campaigns | Consent (Art. 6(1)(a) GDPR) | Until consent is withdrawn or an objection is raised |
10.1.1 Service providers used
System/service | Provider | Purpose | Third-country transfer | Safeguard |
Salesforce CRM | Salesforce Inc., USA / Salesforce.com Germany GmbH | Administration of customer data | USA (Data Privacy Framework) | Data Privacy Framework + Standard Contractual Clauses |
HubSpot | HubSpot Inc., USA | E-mail dispatch, marketing automation, tracking, management of unsubscriptions | USA (Data Privacy Framework) | Data Privacy Framework + Standard Contractual Clauses |
10.2 Unsubscribing from marketing e-mails
How can you unsubscribe?
- Via the unsubscribe link in every marketing e-mail
After you unsubscribe, your e-mail address is marked as unsubscribed in our marketing tools and stored in a system-side suppression list. This ensures that you receive no further marketing e-mails.
Legal basis for the suppression list: Legitimate interest (Art. 6(1)(f) GDPR).
Retention period of the suppression list: For as long as we send marketing e-mails.
10.3 General information on business activities
Description:
Irrespective of marketing status, we send general information on business activities to all business contacts:
- Critical incidents (e.g. IT security incidents, personal data breaches pursuant to Art. 34 GDPR)
- Important notices concerning the business relationship (e.g. changes to the general terms and conditions or the privacy policy)
- Information on system maintenance or outages
Legal basis:
- Performance of a contract (Art. 6(1)(b) GDPR)
- Legitimate interest (Art. 6(1)(f) GDPR)
- Legal obligation (Art. 6(1)(c) GDPR)
Right to object: An objection is possible, but may result in you not receiving important information.
10.4 Postal advertising
We may send advertising material by post to our business customers and prospective customers.
Legal basis: Legitimate interest (Art. 6(1)(f) GDPR).
Right to object: An objection is possible at any time.
10.5 Data protection compliance in advertising
Processing operation | Purpose | Legal basis | Recipients | Retention period |
Documentation of consents | Proof of consent pursuant to Art. 5(2) GDPR (accountability) | Art. 6(1)(c), (f) GDPR | Proliance GmbH (data protection officer), data protection supervisory authorities, IT service providers, marketing tools | 3 years from the end of the year in which the consent was last used |
Documentation of data subject rights | Proof of the proper handling of access, erasure and objection requests | Art. 6(1)(c), (f) GDPR | Proliance GmbH, data protection supervisory authorities, IT service providers | 3 years from the end of the year in which the right was exercised |
Advertising suppression list (system-side in HubSpot) | Permanent implementation of objections to advertising | Art. 6(1)(f) GDPR | HubSpot | For as long as we send marketing e-mails |
11. Privacy information for applicants
11.1 General information on data processing
We process personal data of applicants in order to conduct application procedures, to make decisions on the establishment of an employment relationship and – where an application is successful – to prepare the employment relationship.
Legal bases for the processing:
The processing is based on the general legal bases described in the section “Legal bases for data processing”.
11.2 Data processed
Data category | Examples | Purpose | Legal basis | Retention period |
Master data | Surname, first name, address, date of birth | Identification, communication | Art. 88 GDPR in conjunction with Section 26 BDSG (German Federal Data Protection Act) | 6 months after conclusion of the procedure |
Contact data | E-mail address, telephone number, mobile number | Communication during the application process | Art. 88 GDPR in conjunction with Section 26 BDSG | 6 months after conclusion of the procedure |
Application documents | Cover letter, CV, references, certificates | Assessment of qualifications, selection decision | Art. 88 GDPR in conjunction with Section 26 BDSG | 6 months after conclusion of the procedure |
Internal assessments | Notes on the application, internal assessments, documentation of decisions | Selection decision | Art. 88 GDPR in conjunction with Section 26 BDSG | 6 months after conclusion of the procedure |
Communication data | Correspondence, appointment arrangements | Organisation of the application process | Art. 6(1)(b) GDPR | 6 months after conclusion of the procedure |
Talent pool data | Name, contact details, qualifications | Inclusion in the talent pool (only with consent) | Art. 6(1)(a) GDPR | In accordance with the consent |
11.3 Recipients
Recipient category | Examples | Purpose | Third-country transfer |
Internal departments | Personnel department / HR team, specialist department | Selection decision | No |
Affiliated companies | Personnel department/HR team, specialist department | Talent pool | No |
External service providers | rexx systems GmbH (applicant management system) | Administration and storage of application data | No |
Authorities | Tax offices, courts | Legal obligations | No |
11.4 Retention period
Scenario | Retention period | Justification |
Successful application | Transfer to the personnel file | Art. 88 GDPR in conjunction with Section 26 BDSG (German Federal Data Protection Act) |
Rejection | 6 months after conclusion of the procedure | Art. 88 GDPR in conjunction with Section 26 BDSG |
Consent (talent pool) | In accordance with the consent | Art. 6(1)(a) GDPR |
11.5 Information on the use of our application form
The data you enter in the application form and the files you upload are automatically transferred to our applicant management system and processed there. In this process, master data from your CV is automatically assigned to the corresponding form fields in order to reduce the input effort. The data is processed exclusively for the purpose of conducting the application procedure and, if you have given your consent, for forwarding your application to subsidiaries of Choice AG. Please note that no sensitive data (e.g. health data, political opinions) should be uploaded.
11.6 Automated decision-making
Automated decision-making pursuant to Art. 22 GDPR (e.g. automatic rejection by AI systems) does not take place. All decisions in the application procedure are made by humans. AI systems may only be used for support purposes (e.g. for the pre-selection of applications); however, the final decision is always made by a human.
12. Privacy information for office visitors
12.1 General information on data processing
We process personal data of visitors to our office locations for the purposes of access documentation, security checks and visit coordination. This serves to ensure the safety of our employees, customers and premises.
Legal bases of the processing:
The processing is carried out on the basis of the general legal bases described in the section “Legal bases of data processing”.
12.2 Data processed
Data category | Examples | Purpose | Legal basis | Retention period |
Master data | Surname, first name, company/institution | Identification and documentation of the visit | Legal obligations (Art. 6(1)(c) GDPR in conjunction with ArbSchG, 15 SGB VII in conjunction with DGUV Regulation 1, StGB, BGB, police laws of the federal states); legitimate interest (Art. 6(1)(f) GDPR) | Up to 3 years |
Contact data | E-mail address, telephone number | Contacting, visit coordination | Legal obligations (Art. 6(1)(c) GDPR in conjunction with ArbSchG, 15 SGB VII in conjunction with DGUV Regulation 1, StGB, BGB, police laws of the federal states); legitimate interest (Art. 6(1)(f) GDPR) | Up to 3 years |
Visit details | Time of visit, purpose of the visit, contact person visited | Documentation and visit coordination | Legal obligations (Art. 6(1)(c) GDPR in conjunction with ArbSchG, 15 SGB VII in conjunction with DGUV Regulation 1, StGB, BGB, police laws of the federal states); legitimate interest (Art. 6(1)(f) GDPR) | Up to 3 years |
12.3 Recipients and categories of recipients
Recipient category | Examples | Purpose | Third-country transfer |
Internal departments | Reception, specialist departments visited | Visit coordination, reception | No |
Landlords | Ali Selmi Grundstücksgesellschaft bR, Eschersheimer Landstraße 60/62, 60322 Frankfurt am Main (Berlin location); noris network AG, Thomas-Mann-Straße 16-20, 90471 Nürnberg (Nuremberg location) | Building management, access control, security (in the case of shared systems) | No |
IT service providers | Hosting of visitor management systems, meeting tools | Technical provision, data management | No |
Authorities | Police, tax offices, public prosecutor's office | Legal obligations | No |
12.4 Retention period
Scenario | Retention period | Justification |
Regular visit | 3 years after conclusion of the visit | Legitimate interest |
Security incidents | Until full clarification + limitation period (3-30 years) | Legal claims |
12.5 Automated decision-making
Automated decision-making pursuant to Art. 22 GDPR does not take place.
13. Privacy information for social media
13.1 General information on data processing
We operate company pages on various social media platforms in order to get in touch with you and to provide information about our company, our products and services. In doing so, your personal data is processed when you interact with our content (e.g. through comments, likes or messages).
Legal bases of the processing:
The processing is carried out on the basis of the general legal bases described in the section “Legal bases of data processing”.
13.2 Data processed
Data category | Examples | Purpose | Legal basis | Retention period |
Interaction data | Likes, comments, messages, shared content | Interaction with users, public relations | Legitimate interest (Art. 6(1)(f) GDPR) | In accordance with the policies of the platform operators |
Profile information | Public name, profile picture, follower information | Communication, analysis of interactions | Legitimate interest (Art. 6(1)(f) GDPR) | In accordance with the policies of the platform operators |
13.3 Joint controllership
When using social media platforms (e.g. Facebook, LinkedIn), we may be jointly responsible with the platform operators for certain data processing operations. This applies in particular to the use of analytics functions and the creation of statistics on the use of our company pages.
Essential contents of the agreement pursuant to Art. 26 GDPR:
- Responsibilities:
- The platform operators (e.g. Meta, LinkedIn) are primarily responsible for the processing of personal data within their platforms, including the analysis of user behaviour and the creation of statistics.
- We are responsible for the content we publish on our company pages as well as for the interaction with users (e.g. answering messages, moderating comments).
- Exercising rights:
- Data subjects may exercise their rights (e.g. access, erasure) both against us and against the platform operators.
- Further information on data processing by the platform operators can be found in their privacy policies:
- YouTube (Google): https://policies.google.com/privacy
- LinkedIn: https://www.linkedin.com/legal/privacy-policy
- Instagram (Meta): https://www.instagram.com/legal/privacy/
- Facebook (Meta): https://www.facebook.com/privacy/policy
Legal basis:
Legitimate interest (Art. 6(1)(f) GDPR).
13.4 Data transfer to third countries
The platform operators may transfer data to third countries (e.g. the USA). These transfers are carried out on the basis of EU Standard Contractual Clauses or adequacy decisions of the EU Commission (e.g. EU-U.S. Data Privacy Framework).
13.5 Retention period
The retention period is governed by the internal policies of the respective platform operators. Data that you transmit to us directly (e.g. by direct message) is stored only for as long as is necessary to process your enquiry.
14. Rights of data subjects
14.1 Your rights
As a data subject, you have the following rights under the General Data Protection Regulation (GDPR) with regard to the processing of your personal data:
Right | Description |
Right of access (Art. 15 GDPR) | You have the right to request information as to whether and which personal data we process about you. |
Right to rectification (Art. 16 GDPR) | You may request the rectification of inaccurate or incomplete data. |
Right to erasure (Art. 17 GDPR) | You may request the erasure of your data if it is no longer necessary for the purposes or has been processed unlawfully. |
Right to restriction of processing (Art. 18 GDPR) | You may request that the processing be restricted, e.g. if you contest the accuracy of the data. |
Right to object (Art. 21 GDPR) | You may object to the processing if it is carried out on the basis of Art. 6(1)(f) GDPR (legitimate interest). |
Right to data portability (Art. 20 GDPR) | You have the right to receive your personal data in a structured, commonly used and machine-readable format. |
Withdrawal of consent (Art. 7(3) GDPR) | You may withdraw your consent at any time. The lawfulness of the processing carried out up to the time of withdrawal remains unaffected. |
14.2 Contact for exercising your rights
If you wish to exercise any of your rights or have questions about the processing of your personal data, you can contact us as follows:
Contact channel | Details |
Post | Choice AG, Data Protection Officer, Thomas-Mann-Straße 16-20, 90471 Nürnberg |
We will respond to your request without undue delay, but at the latest within one month. In complex cases, this period may be extended by a further two months; in this case, you will be informed of the delay and the reasons for it.
14.3 Right to lodge a complaint with a supervisory authority
You have the right to lodge a complaint with a data protection supervisory authority about the processing of your personal data (Art. 77 GDPR).
Competent supervisory authority for Bavaria:
Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18
91522 Ansbach
Germany
Telephone: +49 981 180093-0
E-mail: poststelle@lda.bayern.de
Website: https://www.lda.bayern.de
You may also contact the data protection supervisory authority of your place of residence or work or of the place of the alleged infringement.
15. Other data processing operations
15.1 Overview
In certain cases, we process personal data in order to fulfil legal obligations or to safeguard our legitimate interests. This processing is carried out only where it is necessary and legally permissible.
15.2 Purposes of processing
Processing operation | Purpose | Legal basis | Recipients | Retention period |
Fulfilment of legal obligations | Retention obligations under tax and commercial law, reporting obligations to authorities | Art. 6(1)(c) GDPR | Tax advisers, auditors, authorities, courts | 6-10 years (statutory periods) |
Exercise or defence of legal claims | Assertion/defence of legal claims (e.g. receivables, liability) | Art. 6(1)(f) GDPR | Lawyers, courts, experts, debt collection agencies | Until clarification + limitation periods (3-30 years) |
Documentation of consents | Proof of consent pursuant to Art. 5(2) GDPR (accountability) | Art. 6(1)(c), (f) GDPR | Proliance GmbH (Data Protection Officer), data protection supervisory authorities, IT service providers | 3 years from the end of the year in which the consent was last used |
Documentation of data subject rights | Proof of the proper handling of access, erasure and objection requests | Art. 6(1)(c), (f) GDPR | Proliance GmbH, data protection supervisory authorities, IT service providers | 3 years from the end of the year in which the right was exercised |
15.3 Data transfer to third countries
In certain cases, personal data may be transferred to third countries outside the European Economic Area. These transfers take place only if:
- an adequacy decision of the EU Commission exists (e.g. EU-U.S. Data Privacy Framework) or
- appropriate safeguards such as EU Standard Contractual Clauses have been concluded.
For further information, see section 4. General information on data transfer to third countries.