Privacy Policy.

1. Controller

The controller within the meaning of the GDPR is:

CITO GmbH
Jungfrauenthal 8
20149 Hamburg
Germany
Email: info@diavag.com

DIAVAG is a brand of CITO GmbH, represented by its managing director Sebastian Johnston.

2. Collection and Storage of Personal Data

2.1 Accessing the Website (Server Log Files)

When you access our website purely for informational purposes, we automatically collect the data that your browser transmits to our server. This includes:

• your IP address in shortened, anonymized form,
• the date and time of access,
• the page accessed and the HTTP status code,
• the volume of data transferred,
• the browser and operating system used,
• the referrer URL.

We process this data on the basis of our legitimate interest in the security, stability and correct delivery of our website pursuant to Art. 6(1)(f) GDPR. The data is deleted after 30 days at the latest, unless security incidents require longer storage.

2.2 Hosting with Vercel

Our website is hosted by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA. Delivery takes place primarily via the Frankfurt region (fra1) within the European Union. On our behalf, Vercel processes technical data required to provide the website, in particular IP addresses and request data.

We have concluded a data processing agreement with Vercel in accordance with Art. 28 GDPR. Data transfers to the USA are governed by the European Commission's Standard Contractual Clauses and the EU-US Data Privacy Framework, to which Vercel Inc. has adhered. Further information can be found in Vercel's privacy policy at vercel.com/legal/privacy-policy.

2.3 Contacting Us and Enquiries

If you contact us by email at info@diavag.com or submit an enquiry via the form on our website, we process the data you provide, usually:

• your name or company name,
• your email address,
• the content of your enquiry and any further information you provide.

We process this data exclusively to respond to your enquiry and to provide information about DIAVAG's services. The legal basis is Art. 6(1)(b) GDPR for pre-contractual enquiries and Art. 6(1)(f) GDPR based on our legitimate interest in efficient communication. Where processing is based on your consent, Art. 6(1)(a) GDPR applies.

We store your enquiry for as long as is necessary to process it and as required by any retention obligations under tax or commercial law.

2.4 Cookies

We currently use only technically necessary cookies and comparable technologies that are required for the operation of the website. We do not currently use tracking, analytics or marketing cookies. For details, please see our Cookie Notice.

The legal basis for the use of technically necessary cookies is Section 25(2) TDDDG in conjunction with Art. 6(1)(f) GDPR.

2.5 Third-Party Seller and Location Data Processed on Instruction

If DIAVAG is commissioned to carry out an appraisal in connection with a planned purchase, the item to be appraised is often still located at the seller's premises. In this case, the order contains third-party data, in particular the name, contact details and location of the seller, so that our appraiser can carry out the on-site appointment.

As a rule, we receive this data from the commissioning buyer, for example by telephone or via the order form. It is stored exclusively in our EU object storage. The legal basis is Art. 6(1)(b) GDPR for the performance of the contract concluded with the client, as well as our legitimate interest pursuant to Art. 6(1)(f) GDPR in carrying out the commissioned appraisal.

The use of this data is strictly limited to the purpose of carrying out the appraisal. The result of the appraisal is made available to the client on the buyer's side. No further use of the seller and location data takes place. The principles set out in this policy apply to the storage period: we store the data only for as long as is necessary to carry out the appraisal and as required by any statutory retention obligations.

3. Data Recipients and Processors

We only disclose your personal data to third parties where this is necessary to fulfil our contractual obligations, where we are legally obliged to do so, or where you have given your prior consent. The following categories of recipients may be involved:

• IT service providers and hosting providers, in particular Vercel Inc. for the hosting of our website.
• Email providers for sending and receiving messages.
• Tax advisors, auditors and legal advisors within the scope of statutory obligations.
• Payment service providers, in particular Stripe, for the processing of payment transactions.
• Independent appraisers who carry out on-site appointments on behalf of DIAVAG, insofar as this is necessary to perform the contract.

We have concluded the agreements required under Art. 28 GDPR with all processors.

4. Transfer to Third Countries

Where personal data is transferred to recipients outside the European Economic Area, this takes place exclusively on the basis of an adequacy decision by the European Commission, the Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR, or a comparable protective mechanism. When using Vercel, we rely on the Standard Contractual Clauses and on the EU-US Data Privacy Framework.

5. Rights of Data Subjects

You have the following rights with regard to the personal data we process about you:

• the right of access pursuant to Art. 15 GDPR,
• the right to rectification pursuant to Art. 16 GDPR,
• the right to erasure pursuant to Art. 17 GDPR,
• the right to restriction of processing pursuant to Art. 18 GDPR,
• the right to data portability pursuant to Art. 20 GDPR,
• the right to object to processing based on Art. 6(1)(f) GDPR pursuant to Art. 21 GDPR,
• the right to withdraw consent given, with effect for the future, pursuant to Art. 7(3) GDPR.

To exercise your rights, an informal message to info@diavag.com is sufficient. We will address your request without undue delay.

6. Right to Lodge a Complaint with a Supervisory Authority

Pursuant to Art. 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority regarding the processing of your personal data. The authority responsible for us is:

The Hamburg Commissioner for Data Protection and Freedom of Information
Ludwig-Erhard-Straße 22, 7th floor
20459 Hamburg
Germany

7. Data Security

We take appropriate technical and organizational measures to protect your personal data against accidental or intentional manipulation, loss, destruction or against access by unauthorized persons. Transmission takes place exclusively via encrypted connections (TLS).

8. Changes to this Privacy Policy

We reserve the right to amend this privacy policy where this becomes necessary due to new functions, services or a change in the legal situation. The current version can be viewed on this page at any time.