Privacy Policy of Evoparts24 GmbH

We are pleased that you are interested in the website of Evoparts24 GmbH (hereinafter: "Evoparts24"). Protecting your personal data during its collection, processing, and use when you visit our website is very important to us. We comply with the provisions of the EU General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG), the German Digital Services Act (DDG), and any other applicable data protection regulations.

The Evoparts24 website (www.evoparts24.com) can generally be used without providing personal data (e.g., name, address, email address, or telephone number). However, if you wish to use special services via our website—such as registration, ordering, or contacting us—the processing of personal data may be necessary. In these cases, we will obtain your consent beforehand, unless there is a legal basis for doing so.

This privacy policy informs you about the type, scope and purpose of the collection, processing and use of personal data by Evoparts24, as well as about your rights under applicable data protection regulations.

We have implemented extensive technical and organizational measures to ensure the most comprehensive possible protection of personal data processed via this website. However, absolute protection cannot be guaranteed for internet-based data transmissions, so a certain residual risk of technical security vulnerabilities remains. Therefore, you always have the option of transmitting your personal data to us via alternative means, such as by telephone or mail.

1. Terminology

In this privacy policy, we use the terms that are also used in the GDPR. These include, among others, the following terms:

• Personal data
  Personal data means any information relating to an identified or identifiable natural person (hereinafter referred to as "data subject"). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
• Affected person
  "Data subject" means any identified or identifiable natural person whose personal data is processed by the controller.
• Processing
  "Processing" means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
• Restriction of processing
  "Restriction of processing" refers to the marking of stored personal data with the aim of limiting its future processing.
• Profiling
  "Profiling" means any type of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location or movements.
• Pseudonymization
  Pseudonymization refers to the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organizational measures to ensure that the personal data is not attributed to an identified or identifiable natural person.
• File system
  "Filing system" means any structured collection of personal data which is accessible according to specific criteria, regardless of whether this collection is maintained centrally, decentrally or according to functional or geographical considerations.
• Responsible
  The "controller" is the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. Where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its designation may be provided for by Union or Member State law.
• Data processors
  The term "processor" refers to a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
• Recipient
  "Recipient" means a natural or legal person, public authority, agency or other body to whom personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients.
• Third
  "Third party" means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data.
• Consent
  "Consent" means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

2. Name and address of the data controller

The controller responsible for processing the data collected via the website www.evoparts24.com is:
Evoparts24 GmbH
At Hans Teich 12
51674 Wiehl
Phone: 015754272024
Email: info@evoparts24.com
Website: www.evoparts24.com
Represented by the management:
Daniel Brauer, Eugen Brauer, Friedrich Brauer

3. Name and address of the data protection officer

Evoparts24 has not appointed a legally required data protection officer, as the requirements of Art. 37 GDPR in conjunction with § 38 BDSG are not met.

If you have any questions about data protection, you can contact the data controller named in section 2 of this privacy policy at any time.

4. Legal basis for processing

According to Article 6(1) GDPR, our processing of personal data is lawful if at least one of the following conditions is met:

1. The data subject has given consent to the processing of their personal data for one or more specific purposes (Art. 6 para. 1 lit. a GDPR);
2. The processing is necessary for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract (e.g. product inquiries) (Art. 6 para. 1 lit. b GDPR);
3. The processing is necessary for compliance with a legal obligation to which the controller is subject (e.g. tax obligations) (Art. 6 para. 1 lit. c GDPR);
4. The processing is necessary to protect the vital interests of the data subject or another natural person (e.g., health insurance data of a visitor in the event of an accident on our premises) (Art. 6 para. 1 lit. d GDPR);
5. The processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller (Art. 6 para. 1 lit. e GDPR);
6. The processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child (Art. 6 para. 1 lit. f GDPR).

5. Access data / Server log files

When you access our website, the web server automatically collects and stores information in so-called log files:

• IP address of the requesting device
• Date and time of access
• Name and URL of the retrieved file
• Referrer URL
• Browser type and version
• operating system

The processing is carried out to ensure technical operation, system security, and error analysis (Art. 6 para. 1 lit. f GDPR). This data will not be combined with other sources.

6. Duration for which the personal data will be stored

We generally process and store personal data only for as long as it is necessary to achieve the respective processing purpose. As soon as the purpose ceases to apply, the data is routinely deleted, unless its (temporary) further processing is required for legal or organizational reasons.

After the respective processing purpose ceases to exist or the statutory periods expire, the corresponding data are routinely deleted or blocked, unless they are still required for contract fulfillment, contract initiation or to safeguard legitimate interests.

The duration of the statutory retention periods depends in particular on:

• Section 257 of the German Commercial Code (HGB): 6 years for commercially relevant documents (e.g. commercial letters, accounting documents),
• Section 147 of the German Fiscal Code (AO): 10 years for tax-relevant documents (e.g. invoices, accounting records).

Furthermore, if legal claims exist against Evoparts24 or third parties, the data may be stored until the expiry of the regular limitation period pursuant to Sections 195 et seq. of the German Civil Code (generally three years from the end of the calendar year), insofar as it is necessary for the assertion, exercise or defense of such claims.

Data processed on the basis of consent (e.g. newsletter data ) will be stored until this consent is revoked, unless a legal obligation or a legitimate interest justifies longer storage.

Anonymized or aggregated data that no longer contain any personal information can be stored permanently for statistical or technical evaluation.

7. SSL encryption

We use SSL encryption to protect your transmitted data as effectively as possible. You can recognize such encrypted connections by the "https://" prefix in your browser's address bar. Unencrypted pages are indicated by the "http://" prefix. Data transmitted to us with SSL encryption enabled cannot be read by third parties. We recommend that you only send confidential information with SSL encryption enabled and contact us if you have any questions.

Server log files and other technical usage data are regularly stored for up to 30 days for security and stability reasons and then deleted or anonymized, unless longer storage is required for evidentiary purposes.

8. Hosting provider

Our website is hosted by the service provider Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen ("Hetzner"). The hosting provider supplies us with infrastructure and platform services, computing capacity, storage space, and technical maintenance services that we need to operate this website.

The processing of personal data is based on Article 6(1) (f) GDPR due to our legitimate interest in the secure and efficient provision of our online services. Where consent is required, processing is based on Article 6(1) (a) GDPR.

We exclusively use Hetzner server locations within the European Union or the European Economic Area for this website.

A data processing agreement pursuant to Art. 28 GDPR was concluded with Hetzner, which guarantees the security and protection of the data.

9. Your rights as a data subject

As a data subject, you have the following rights under the General Data Protection Regulation (GDPR), which we will inform you about below:

(1) Right of access (Art. 15 GDPR)
You have the right to request information from us as to whether we process personal data concerning you. If this is the case, you can request, in particular, information about the categories of data processed, the purposes of the processing, the recipients (including recipients in third countries), the planned storage period or the criteria for determining it, the existence of your other data subject rights, the origin of the data (if not collected from you), and the existence of automated decision-making, including profiling , and – where applicable – meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing. You will also receive a copy of the personal data processed (further copies may be subject to a fee).

(2) Right to rectification (Art. 16 GDPR)
You can request the immediate correction of inaccurate personal data concerning you.
Request data. Taking into account the purposes of the processing, you have the right to request the completion of incomplete data – also by means of a supplementary statement.

(3) Right to erasure – "right to be forgotten" (Art. 17 GDPR)
You can request the deletion of your personal data if one of the following reasons applies:

1. The data is no longer necessary for the purposes for which it was collected/processed.
2. You withdraw your consent and there is no other legal basis;
3. You object pursuant to Article 21 GDPR and there are no overriding legitimate grounds for the processing;
4. The data was processed unlawfully;
5. The deletion is necessary to fulfill a legal obligation;
6. The data was collected in relation to information society services for children (Art. 8 GDPR).

Exceptions: The right to erasure does not apply in particular where processing is necessary for exercising the right to freedom of expression and information, for compliance with legal obligations (e.g. commercial and tax law retention periods), for reasons of public interest or for the establishment, exercise or defense of legal claims.

(4) Right to restriction of processing (Art. 18 GDPR)
You can request the restriction of processing if:

1. If you dispute the accuracy of the data (for the duration of the audit),
2. the processing is unlawful and you request restriction instead of erasure,
3. we no longer need the data for the purposes of processing, but you require it for the establishment, exercise or defense of legal claims, or
4. You have objected pursuant to Article 21(1) GDPR, pending verification of whether our legitimate grounds override your interests.

In the event of a restriction, the data – apart from being stored – will only be processed with your consent, or for the establishment, exercise or defense of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest. You will be informed before the restriction is lifted.

(5) Right to data portability (Art. 20 GDPR)
receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and to transmit this data to another controller or – where technically feasible – to have it transmitted directly from us to another controller, provided that the processing is based on consent (Art. 6 para. 1 lit. a or Art. 9 para. 2 lit. a GDPR) or a contract (Art. 6 para. 1 lit. b GDPR) and is carried out by automated means. The rights and freedoms of other persons must not be adversely affected by this.

(6) Right to object (Art. 21 GDPR)
You have the right to object, on grounds relating to your particular situation, at any time to the processing of personal data concerning you which is based on point ( e) or ( f) of Article 6(1) of the GDPR (performance of a task carried out in the public interest/legitimate interests). We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the purpose of establishing, exercising or defending legal claims.
Objection to direct marketing: If we process personal data for direct marketing purposes, you have the right to object at any time to the processing of your data for such marketing; this also applies to profiling insofar as it is related to direct marketing. In the event of an objection, the personal data will no longer be processed for these purposes.

(7) Right to withdraw consent (Art. 7 para. 3 GDPR)
You have the right to withdraw your consent at any time with effect for the future, without affecting the lawfulness of the processing carried out before the withdrawal. This will not result in any disadvantages for you; however, certain services/functions may no longer be available without your consent.

(8) Right not to be subject to a decision based solely on automated processing (Art. 22 GDPR)
You have the right not to be subject to a decision based solely on automated processing, including profiling , which produces legal effects concerning you or similarly significantly affects you, unless such a decision is necessary for entering into, or performing, a contract, is based on EU/Member State law (with appropriate safeguards in place), or is based on your explicit consent. In these cases, you have at least the right to human intervention, to express your point of view, and to contest the decision.

(9) Identity verification, form and time limits (Art. 12 GDPR)
To exercise your rights, a simple notification (e.g., by email) is sufficient. For security reasons, we may request additional information to verify your identity and prevent unauthorized access to or deletion of your data. We will respond promptly, but no later than one month after receiving your request. This period may be extended by a further two months if necessary, taking into account the complexity and number of requests; in this case, you will be informed of the extension and the reasons within one month. Exercising your rights is generally free of charge. However, for manifestly unfounded or excessive requests – particularly in cases of frequent repetition – we may charge a reasonable fee or refuse to process them.

(10) Contact for exercising rights
To assert your rights, simply send an email to info@evoparts24.com. Alternatively, you can contact us by mail: Evoparts24 GmbH, Am Hans Teich 12, 51674 Wiehl, Germany. If a data protection officer has been appointed, this will be stated separately in the privacy policy; inquiries can also be addressed directly to them.

10. Supervisory Authority

For questions regarding data protection or the exercise of your rights, you can contact the data protection supervisory authority responsible for us at any time:
State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia,
Kavalleriestraße 2-4
40102 Düsseldorf
PO Box 20 04 44
40102 Düsseldorf
Telephone: +49 211 38424-0
Fax: +49 211 38424-10
Email: poststelle@ldi.nrw.de
Internet: www.ldi.nrw.de
You also have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data violates data protection laws.

11. Registration and use of the platform

To use certain features of our platform (e.g., ordering, managing delivery and billing addresses, viewing order histories, or using API functions), prior registration is required. During registration, we collect and process the following personal data:

• Company name and legal form,
• Name of contact person,
• business contact details (email address, telephone number),
• Billing and delivery addresses,
• chosen access data (username and password)

The processing of this data is carried out in accordance with Article 6 Paragraph 1 Letter b GDPR for the performance of pre-contractual measures and for the fulfillment and execution of the contractual relationship, in particular for the creation, maintenance, and administration of your customer account. Registration and use of the restricted areas of our platform are not possible without this data. Access data must be treated confidentially by the user and may not be disclosed to third parties.

Furthermore, the processing of individual data may be based on our legitimate interest in accordance with Art. 6 para. 1 lit. f GDPR, in ensuring the secure and technically sound operation of the platform, preventing unauthorized access and avoiding the misuse of user accounts.

For the technical provision and administration of user accounts, service providers may be used within the framework of commissioned data processing in accordance with Article 28 GDPR. These providers are contractually obligated to comply with all data protection regulations and to process the data exclusively according to the instructions of Evoparts24.

12. Order processing and payment data

For processing payments, we use the payment service provider Stripe Payments Europe, Limited 3 Dublin Landings , North Wall Quay, Dublin 1, D01 C4E0, Ireland ("Stripe").

Stripe enables us to process payments securely and efficiently. Depending on the payer's country, Stripe offers various payment methods (e.g., credit card, SEPA direct debit, Apple Pay, Google Pay, Sofort , Klarna payment methods).

As part of the payment process, the following personal data is transmitted to and processed by Stripe:

• Name
• Billing and delivery address
• E-mail address
• Payment information (e.g. credit card details, IBAN)
• Transaction data (e.g., amount, date, payment method)
• Further technical data on fraud prevention

Data processing is carried out for the purpose of fulfilling the contract in accordance with Art. 6 para. 1 lit. b GDPR and for fraud prevention in accordance with Art. 6 para. 1 lit. f GDPR (legitimate interest in secure payment processing).

Stripe processes certain data independently as a separate controller within the meaning of the GDPR (e.g. for payment processing, risk assessment and compliance with legal obligations).

Stripe may transfer data to the USA. This is done on the basis of the EU Standard Contractual Clauses and further safeguards pursuant to Article 46 GDPR.

We have concluded a data processing agreement with Stripe in accordance with Article 28 GDPR, insofar as Stripe processes data on our behalf.

Further information on data processing by Stripe can be found in Stripe's privacy policy at https://stripe.com/privacy.

13. Use of cookies and tracking technologies

To ensure optimal functionality, security, and user-friendliness of our website, as well as for statistical analysis and improvement of our online services, Evoparts24 uses cookies and similar tracking technologies. These can serve both technical provision and analysis, reach measurement, and marketing purposes.

a. Cookies
On the website www.evoparts24.com we use cookies in connection with the login area for registered users. Cookies are text files that are placed and stored on a computer system via an internet browser.

Many websites and servers use cookies. Many cookies contain a so-called cookie ID. A cookie ID is a unique identifier for the cookie, consisting of a string of characters that allows websites and servers to associate the cookie with the specific web browser in which it was stored. This enables visited websites and servers to distinguish a user's browser from other web browsers that contain different cookies. The unique cookie ID makes it possible to recognize and identify a specific web browser.

By using cookies, we can provide website visitors with more user-friendly services that would otherwise be impossible. Cookies allow us to optimize our website for the user. For example, we can recognize returning users, making it easier for them to navigate the site. With cookies, visitors don't have to re-enter their login details every time they visit the website. This information is automatically stored by the website and the cookie placed on the visitor's computer. Furthermore, an online shop can use cookies to remember the items a customer has placed in their virtual shopping cart.

In addition to technically necessary cookies, which are required for the functionality and secure use of our website, cookies may also be used for analysis, marketing or tracking purposes.

We only set such cookies after receiving your prior explicit consent, which you can give via our cookie banner on your first visit. You can, of course, withdraw your consent at any time.

Information about the specific cookies and their purpose can be found in the cookie banner and browser settings. You can delete stored cookies at any time via your internet browser settings or prevent them from being stored. This function is offered by all common browsers.

Without consent, only cookies that are technically necessary and do not transmit personal data will be set.

Information about which cookies are used, their purpose, and their storage duration can be found in the cookie banner and in your browser settings. You can adjust your cookie settings and delete previously stored cookies at any time.

If the user, as the data subject, prevents the setting of cookies in his internet browser, he may no longer be able to fully use all the functions of the Evoparts24 website.

b. Tracking and marketing measures
We use the online advertising service Google Ads on our website , a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Google Ads allows us to advertise our website in Google search results and on websites within the Google advertising network. User data is processed to display and optimize advertisements and to measure the success of advertising campaigns ( conversion tracking).

The purposes of processing are the display of advertisements, the statistical measurement of the success of our campaigns ( conversion tracking), the optimization of our advertising offer, and the prevention of misuse and fraud.

The processing is based on your consent pursuant to Art. 6 para. 1 lit. a GDPR, provided you have given this consent via our cookie consent banner. You can withdraw your consent at any time via the settings in the cookie banner.

Depending on usage, the following data, among others, will be processed:

• IP address (shortened/anonymized)
• Online identifiers (cookies, ad ID, client ID)
• Usage behavior (e.g., clicks, pages visited, duration)
• Technical information (browser, device, location at a high level)
• Conversion data (e.g., whether a purchase, contact, or form completion has occurred)

Google uses cookies or similar technologies (e.g., Local Storage) for this purpose.

The analysis is conducted using pseudonyms; direct identification of individuals is impossible due to anonymized IP addresses and the absence of personal data (e.g., name, address, contact information). Google links this data to a randomly generated user ID using cookies, allowing for statistical tracking of recurring visits. These cookies may be stored for up to two years unless you delete them prematurely.

We use Google Ads exclusively with IP anonymization enabled. This means your IP address is shortened within the EU or EEA before being transmitted to Google. Only in exceptional cases will the full IP address be transmitted to Google servers in the USA and shortened there.

Google also processes data in the USA. Google participates in the EU-US Data Privacy Framework, which ensures an adequate level of data protection for data transfers. Further information can be found at : https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae60-be03fcb0fddf_en

In addition, Google uses the standard contractual clauses adopted by the EU Commission pursuant to Article 46(2) and (3) GDPR to ensure a level of protection comparable to EU data protection law. These can be found at: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de.

The Google Ads Data Processing Terms can be found at: https://business.safety.google/intl/de/adsprocessorterms/

You can withdraw your consent at any time via our cookie settings dialog. Furthermore, you can opt out of personalized advertising from Google in the Google Ads settings at https://adssettings.google.com/.

To deactivate. You can also prevent the storage of cookies by adjusting your browser settings or delete cookies that have already been stored. Further general options for objecting to personalized online advertising can be found at https://youradchoices.com/.

Available in Google's privacy policy at https://policies.google.com/privacy.

14. Transfer of data to suppliers and shipping service providers

For the purpose of processing orders, delivering goods, and, if applicable, handling returns or complaints, Evoparts24 transmits personal data to carefully selected logistics, shipping, and delivery partners . These partners are involved solely for the purpose of carrying out the respective delivery or fulfilling the contractually owed service.

The data transmitted is limited to the minimum required for delivery and regularly includes:

• Name and, if applicable, company of the recipient,
• Delivery address
• If applicable, telephone number or email address of the contact person for delivery notification , delivery announcement or coordination of the delivery time,
• For deliveries by freight carrier, additional information regarding the nature of the goods, dimensions or weight may be required (if necessary for delivery).

Data is transferred on the basis of Article 6 Paragraph 1 Letter b GDPR for the performance of the purchase or delivery contract between Evoparts24 and the customer. In cases where separate notification regarding delivery status or delivery dates is provided by the shipping service provider, the transfer of contact details (e.g., email address, telephone number) is based on the customer's consent pursuant to Article 6 Paragraph 1 Letter a GDPR , which can be revoked at any time with effect for the future.

Our shipping and logistics partners process the transmitted data exclusively under their own responsibility or on the basis of contractual agreements for proper delivery. If external service providers (e.g., IT or logistics companies) act on behalf of Evoparts24, processing takes place on the basis of a data processing agreement in accordance with Article 28 GDPR.

If, within the framework of the so-called " dropshipping " or "direct shipping" process, the shipment is handled directly by one of our suppliers, we also transmit the data necessary for the fulfillment of the contract (name, delivery address, and, if applicable, telephone number or email address) to the respective supplier. This transmission is also based on Article 6 Paragraph 1 Letter b GDPR. The suppliers are obligated to use the data exclusively for the execution of the delivery and to delete it after completion of the process.

not be passed on to third parties beyond this – for example for advertising, analysis or other purposes – unless there is a legal obligation to do so or you have expressly consented.

If, in exceptional cases, delivery by a shipping service provider located outside the European Union or the European Economic Area is necessary, personal data will only be transferred in compliance with the data protection guarantees pursuant to Art. 44 et seq. GDPR , for example on the basis of an adequacy decision of the EU Commission or using the EU standard contractual clauses .

15. Contact forms and support requests

Our website offers various contact and input forms through which you can send us inquiries or register (e.g. contact form, registration form, service requests).

When you use these forms or contact us by email, we process the data you provide, in particular your name, email address, company affiliation (if applicable), and the content of your request.

The processing is carried out to handle your request, to carry out pre-contractual or contractual measures, and to manage your user account or registration.

The data is transmitted using encryption to protect your data from unauthorized access. Required fields in the form are marked accordingly to ensure that only absolutely necessary data is collected.

The legal basis is Article 6(1) ( b) GDPR , insofar as the processing is necessary for the performance of a contract or for handling your request. Otherwise, processing is based on our legitimate interest pursuant to Article 6(1 ) (f) GDPR , for example, in the efficient handling of support requests and the provision of customer-oriented communication channels.

Data submitted via forms or email is securely stored in our internal database and processed within our internal back office system to manage requests and support user accounts.

The data will be deleted after the request has been completed, unless there are legal retention obligations or the data is required to carry out further contractual steps.

16. Newsletter / information emails

For sending our system and service emails (e.g. order confirmations, account and shipping information, password reset , technical notifications) we use the Amazon Simple Email Service (AWS SES), provided by Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, 1855 Luxembourg ("AWS").

Your data is processed solely for sending and technically providing system-relevant emails necessary for fulfilling the contractual relationship or administering your user account. Your data will not be used for marketing, tracking, or analysis purposes.

The legal basis for the processing is Art. 6 para. 1 lit. b GDPR, insofar as the emails are necessary for the fulfillment of contractual obligations or pre-contractual measures (e.g. registration, order processing).

Furthermore, processing is based on our legitimate interest pursuant to Art. 6 para. 1 lit. f GDPR in a secure and reliable communication infrastructure.

For sending via AWS SES, only data necessary for the respective message is processed, in particular:

• Recipient's email address
• Name (if available for personal address)
• Shipping information (e.g., time, delivery status, technical shipping errors)

AWS does not have access to content beyond what is necessary for delivery.

AWS acts as a data processor in accordance with Article 28 GDPR.

A data processing agreement compliant with the GDPR was concluded with AWS, guaranteeing compliance with an appropriate level of data protection.

AWS stores and processes data in highly secure data centers. Processing generally takes place within the European Union. However, data may be transferred to third countries – particularly the USA – as part of technical operations.

AWS is a certified participant in the EU-US Data Privacy Framework (DPF).

Furthermore, AWS uses the Standard Contractual Clauses (SCCs) adopted by the EU Commission pursuant to Art. 46 GDPR to ensure a high level of protection for personal data even in the event of a transfer to the USA.

For more information, see the AWS EU-US Data Privacy Framework guidance at https://aws.amazon.com/compliance/eu-us-data-privacy-framework/ and the information about the standard contractual clauses used by AWS at https://aws.amazon.com/blogs/security/aws-gdpr-data-processing-addendum/.

Shipping-related log data is stored only as long as necessary for technical provision, error analysis, and ensuring email operation, or as required by law. Afterwards, the data is deleted or anonymized.

will not share your data for advertising, analytics, or profiling purposes .

The data will be used exclusively for the technical delivery of emails in accordance with our documented instructions.

17. Use of API and AI functions (" Evobrain ")

For certain AI-powered functions within " Evobrain, " we use the OpenAI API from OpenAI, LLC, San Francisco, USA. Only data necessary for the technical processing of the respective request is transmitted via the API. No personal customer information, such as name, address, email address, or other direct identifiers, is transmitted to OpenAI.

Only anonymized or pseudonymized technical input data, such as article numbers, product and spare part information, price parameters or technical text content that does not allow any conclusions to be drawn about natural persons, are transmitted.

The processing is carried out exclusively for:

• AI-supported analysis of technical product and spare parts information,
• Automated creation of offers, texts or technical proposals,
• Improving the user experience through intelligent system responses,
• Stabilization and functionality of the Evobrain system

The technical data transmitted via the API is not merged with personal master data or customer profiles.

The data will not be used for profiling , marketing, or advertising purposes. Automated decision-making as defined in Article 22 of the GDPR will also not take place.

The legal basis for the processing is our legitimate interest pursuant to Art. 6 para. 1 lit. f GDPR in providing efficient, modern and user-friendly AI functions.

Insofar as the function is part of contractual services, the processing is additionally based on Art. 6 para. 1 lit. b GDPR.

OpenAI does not use the transmitted data to train its own models, but processes it exclusively within the framework of the API service.

This is explicitly stated in the OpenAI data processing guidelines.

No personal data is analyzed.

Since OpenAI is based in the USA, the technical provision of the API service may involve the transfer of personal data to a third country. This transfer takes place exclusively on the basis of appropriate safeguards pursuant to Articles 44 et seq. of the GDPR, in particular the Standard Contractual Clauses (SCCs) approved by the EU Commission, which OpenAI uses to ensure a level of data protection comparable to that of the EU. Further information can be found here. https://openai.com/enterprise-privacy/.

In addition, OpenAI employs technical and organizational safeguards, in particular encryption and strict access restrictions. OpenAI is not currently a participant in the EU-US Data Privacy Framework; therefore, the transfer of data to third countries is secured entirely through Standard Contractual Clauses (SCCs) in conjunction with supplementary safeguards. These guarantees ensure that transferred content is adequately protected even when processed in the USA.

Evoparts24 logs API requests only in pseudonymized form, such as timestamps, status codes, or technical session IDs, to ensure stability and troubleshooting.

No content is stored or the API inputs are permanently analyzed.

OpenAI does not permanently store submitted API content, but automatically deletes it after a short time in accordance with the API guidelines.

18. Changes to this Privacy Policy

We reserve the right to amend this privacy policy if legal or technical changes occur. The current version can be accessed at any time at https://www.evoparts24.com/datenschutz.

As of December 4, 2025