Privacy policy
This policy explains how we process personal data when you visit our website, contact us or do business with our car dealership. Last updated: 12 September 2026.
1. Data controller and contact
Dipl.-Ing. Sergey Khripunov, trading as Red Baron Automobile
Glienicker Str. 101, 12557 Berlin, Germany
Email: info@redbaronautomobile.de
Phone: +49 176 32728310
Please use these contact details for questions about our processing of personal data and to exercise your data protection rights.
2. Hosting, logs and backups
Our website and email hosting provider is STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. We have a data processing agreement with STRATO under Article 28 GDPR.
When you open a page, STRATO processes technical connection data, including your IP address, time of access, requested address, browser information and, where applicable, the referring page. This supports delivery of the website, troubleshooting and the detection and prevention of attacks. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is secure and reliable operation.
STRATO states that visitors’ IP addresses are stored in logs for no more than seven days to detect and prevent attacks. Further information: STRATO: data protection and processing agreements.
STRATO creates daily backups of our webspace. According to the service description for our hosting platform, backups from the last 14 days are available for restoration after data loss or technical problems. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is the availability and recoverability of the website. This period concerns webspace backups and is not a general retention period for emails or business records.
3. Contact and vehicle enquiries
When you contact us by form, email, phone or WhatsApp, we process your contact details and the content of your enquiry. All displayed input fields in the vehicle form are required. These include your name, email address, phone number and vehicle location, plus make, model, first registration, mileage, fuel, transmission, VIN / chassis number, power, condition, accident and previous damage, repainted panels, drivability, known faults and repairs, equipment, number of keepers, inspection status, service history, last service, number of keys, import status, finance / lease status, the location of the registration document (Teil II) and asking price. If the inspection expiry date is known, its month and year are required. Unknown history or damage information can be marked “Unknown”. The form requires at least six vehicle photos; up to ten can be submitted.
We use the information to answer your enquiry, assess a vehicle, discuss an offer and, where appropriate, prepare or perform a contract. The legal basis is Article 6(1)(b) GDPR. We handle other enquiries under Article 6(1)(f) GDPR; our legitimate interest is answering your message.
Your entries and selected photos are transferred to our server only when you submit the form, and are then sent to ankauf@redbaronautomobile.de. Larger photos are first resized on your device. We process the enquiry in our business email account and business files. Access is limited to people who need the information for their duties. The form does not create a separate customer database; uploaded files are processed temporarily for sending.
You are not required to use the form. Without the necessary information, we may be unable to handle the enquiry. You can contact us by phone or email instead. Please do not send identity document copies, financial documents or other unnecessary data through the general form. Vehicle photos should not show uninvolved people or unnecessary personal documents.
When we sell our vehicles, email and WhatsApp are used for advice and appointments; the purchase contract is concluded in person at our dealership. When we buy your vehicle, we may also agree offers and conclude contracts through these channels. Submitting the enquiry form does not itself conclude a purchase contract.
4. Retention and deletion
We delete completed enquiries that did not lead to a contract, including their photos, one week after the enquiry is closed from our active mailbox, business files and WhatsApp chats, unless statutory retention requirements or necessary grounds for establishing, exercising or defending legal claims require otherwise. This also covers copies and trash entries under our control that are no longer needed.
Records subject to legal retention requirements are handled separately: invoices and accounting vouchers are generally retained for eight years; business correspondence subject to retention requirements for six years; and accounting books, inventories and annual accounts for ten years (section 147 of the German Fiscal Code, section 14b of the German VAT Act and, where applicable, section 257 of the German Commercial Code). The periods generally start at the end of the relevant calendar year. Tax or legal requirements may extend them. The legal basis is Article 6(1)(c) GDPR.
Where records are necessary for legal claims, we retain the necessary information for the applicable limitation period and, where relevant, for ongoing proceedings. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is protecting our rights. Data is deleted afterwards unless another retention ground applies. Statutory identification records under the German Money Laundering Act are subject to the specific periods in section 8 of that Act, generally five years, subject to overriding legal obligations.
5. Recipients in business transactions
In addition to the people handling your enquiry, technical providers such as STRATO receive data as part of their duties. Where necessary to meet legal obligations, required information is provided to competent authorities and, where applicable, appointed tax advisers (Article 6(1)(c) GDPR). We do not pass your enquiry data to others for their advertising purposes.
Financing
If you request vehicle financing through us, we provide the necessary identity, contact, vehicle, purchase price and financial information, together with documents you supply, to Openbank Deutschland AG, Santander-Platz 1, 41061 Mönchengladbach, Germany. The legal basis is Article 6(1)(b) GDPR. The bank acts as an independent controller and provides its own information about processing and any credit checks during the financing process. Our general vehicle form does not make automated lending decisions.
Registration, deregistration and payments
For registration or deregistration services you commission, we provide the necessary keeper, identity and vehicle data and documents to the competent registration authority. Banks involved in transfers process the necessary payment information. The legal basis is Article 6(1)(b) GDPR and, where applicable, Article 6(1)(c) GDPR.
Where we are legally required to identify contracting parties, their representatives or beneficial owners, we process the information and evidence required under the German Money Laundering Act. Legally required reports are made to the competent bodies. The legal basis is Article 6(1)(c) GDPR together with that Act. We do not routinely request these documents through the general enquiry form.
6. WhatsApp Business
We use WhatsApp Business to communicate with prospective and existing customers. Its provider in the European Economic Area is WhatsApp Ireland Limited, Ireland. If you contact us there, we process your phone number, displayed profile details, messages and files you send to handle your request. Depending on the purpose, Article 6(1)(b) or (f) GDPR applies; for other enquiries, our legitimate interest is communication. You can switch to phone or email at any time.
No contacts are stored in the address book on the phone used for this purpose. The app has permission to access the address book. WhatsApp chat backups to Google Drive or iCloud are not enabled. WhatsApp nevertheless processes connection, usage and account data as an independent controller.
Data may also be processed outside the European Economic Area, particularly in the United States. According to its published terms, WhatsApp relies on the EU–US Data Privacy Framework adequacy decision for certain transfers to WhatsApp LLC and Meta Platforms, Inc. Other transfers use mechanisms including EU standard contractual clauses. Information about their scope, recipients and available copies of safeguards is provided in the WhatsApp privacy policy and the WhatsApp Business Data Transfer Addendum. Where WhatsApp acts as a processor, the WhatsApp Business Data Processing Terms apply.
7. External links, vehicle stock and review link
Links provide access to Google Maps, Google reviews, mobile.de and WhatsApp. We do not load external map, review or chat widgets. The relevant service is contacted only when you open a link, at which point it receives your IP address and technical connection information. Its own privacy information applies: Google and mobile.de.
Our current vehicle stock is available through the link to mobile.de. Automatic loading of external vehicle images is not currently active.
The review QR code is stored locally on our website. Scanning it or selecting the review button opens a Rebrandly short link which redirects to the review destination. Rebrandly receives technical click data, including your IP address; according to its policy, it extracts the country of origin and then hashes the IP address. Details are available in the Rebrandly privacy policy. We provide these links for convenient access to the external information you choose (Article 6(1)(f) GDPR). You can also visit the platforms independently of our links.
8. Reviews displayed on this website
We display an expressly labelled selection of positive reviews from Google and mobile.de. The information includes publicly displayed names, ratings, dates or relative ages, and excerpts or labelled translations or summaries. Sources are the publicly accessible review profiles and screenshots taken from them. The information is stored locally on our website and is available to all visitors; reading it does not load an external review widget.
The purpose is to provide information about customer experiences and advertise our car dealership. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is a traceable presentation of publicly expressed experiences, taking account of the authors’ rights. The selection is not an overall rating. We do not independently check whether authors actually bought from us or used our services.
We retain this information for as long as it is needed for that purpose and no overriding rights of the individual prevent its use. Authors can contact info@redbaronautomobile.de to report changes or exercise their rights to rectification, erasure or objection. If an author objects to the use of their information for advertising, we stop that use. This does not change the original review on the relevant platform.
9. Cookies, local content and form protection
This website uses no Google Analytics, Google Ads conversion tracking or advertising pixels. Fonts, the logo, images and the video are hosted with the website. The video loads only when playback is requested. No external video player is embedded. Language selection uses ordinary page links.
When form submission starts, the technically necessary session cookie rb_enquiry is set. It contains a random session identifier and supports protection against forged or repeated submissions. It is limited to the form endpoint and has no fixed expiry beyond the browser session; browser session restoration may preserve it. The submission security token is valid for 30 minutes, while timestamps from the last 15 minutes are used to limit repeated attempts. These functional periods are not deletion deadlines for server-side session files, which are cleaned up according to the hosting server’s settings.
Necessary access to your device is based on section 25(2), point 2 of the German TDDDG. Personal data processing for abuse prevention is based on Article 6(1)(f) GDPR. Our legitimate interest is secure operation of the form you have requested. We do not set unnecessary analytics or advertising cookies.
10. Your rights
Where the legal conditions are met, you have rights of access, rectification, erasure, restriction of processing and data portability (Articles 15–20 GDPR). You may withdraw any consent at any time with effect for the future; this does not affect the lawfulness of processing before withdrawal.
Right to object: Where processing is based on Article 6(1)(f) GDPR, you may object on grounds relating to your particular situation. You may object to processing for direct marketing at any time without giving such grounds (Article 21 GDPR).
You may complain to a data protection supervisory authority, particularly in the place where you habitually reside or work, or where you believe an infringement occurred. For Berlin, this is the Berlin Commissioner for Data Protection and Freedom of Information.
In connection with this website, we do not make decisions based solely on automated processing that have legal or similarly significant effects, or carry out corresponding profiling.