Privacy Policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

AAA BW GmbH
Robert-Koch-Weg 3
72555 Metzingen
Deutschland
Email: [email protected]

2. Hosting & Server Log Files

This website is operated on our own server. Each time the website is accessed, the server automatically collects technical data transmitted by your browser: IP address, date and time of the request, the page accessed, browser type and version, the operating system used, and the referrer URL. These server log files serve solely to keep our website running stably and securely, in particular to detect faults and prevent misuse.

The legal basis for this processing is Art. 6(1)(f) GDPR (legitimate interest in the secure and functional operation of our website). The log files are stored for a short period and then automatically deleted, unless a security-relevant incident requires longer retention for evidentiary purposes.

3. Cloudflare (Content Delivery Network)

We use the Cloudflare service provided by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA (represented in the EU by Cloudflare Germany GmbH, Rosental 7, 80331 Munich) as a content delivery network and for protection against attacks (e.g. DDoS). For technical reasons, all requests to our website are routed through Cloudflare's servers; in doing so, Cloudflare processes in particular your IP address and technical connection data.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure, stable and high-performing website operation). We have a data processing agreement in place with Cloudflare; insofar as data is transferred to the USA, this is done on the basis of the EU-U.S. Data Privacy Framework, under which Cloudflare is certified. Further information: cloudflare.com/privacypolicy

4. Contact Form & Email Contact

If you contact us via the contact form or by email, we process the details you provide — such as company name, contact person, email address, message and, where applicable, your estimated annual volume — in order to handle your enquiry and prepare a quote for you.

The legal basis is Art. 6(1)(b) GDPR (steps taken at your request prior to entering into a contract) or, where no contract is being initiated, Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries). We need the fields marked as mandatory on the form (company, contact person, email address) to be able to process your enquiry at all; without this information we cannot respond to it.

We store this data for as long as necessary to handle your enquiry and any resulting business relationship, and delete it thereafter unless statutory retention obligations require otherwise.

To guard against misuse and automated spam submissions, we additionally store the IP address and browser identifier (user agent) of the sending device with every enquiry received through the contact form. The legal basis for this is Art. 6(1)(f) GDPR (legitimate interest in the security of our systems and the prevention of misuse). This technical information is stored together with the enquiry and deleted together with it.

After you submit the form, you will receive an automatic confirmation of receipt at the email address you provided.

5. Cookies & Consent

This website uses, on the one hand, technically necessary cookies and comparable storage technologies required for the site to operate — such as CSRF-protection cookies in the product configurator, a login cookie set exclusively for internal staff sign-in, and local storage of your cookie choices. No consent is required for these technically necessary technologies under § 25(2) TDDDG (German Telecommunications Digital Services Data Protection Act).

On the other hand — solely after your explicit consent given via the cookie banner — we use audience-measurement services (category "Statistics": Google Analytics 4, Microsoft Clarity) . The legal basis is Art. 6(1)(a) GDPR and § 25(1) TDDDG. Without your consent, these services are not loaded and no corresponding cookies are set.

You can withdraw or change your consent at any time with effect for the future — via the "Cookie Settings" link in the footer.

6. Google Analytics 4

Following your consent (category "Statistics"), we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Google Analytics uses cookies (including "_ga") that allow analysis of your use of the website. Google Analytics 4 does not store IP addresses but processes them only in truncated form. We also use Google Consent Mode v2: without your consent, no data is transmitted to Google.

The legal basis is Art. 6(1)(a) GDPR (consent). Data may be transferred to Google LLC in the USA; this takes place on the basis of the EU-U.S. Data Privacy Framework. Analytics data is retained for 14 months. You can withdraw your consent at any time via the Cookie Settings link. Further information: policies.google.com/privacy

7. Microsoft Clarity

Following your consent (category "Statistics"), we use Microsoft Clarity, a service provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Clarity creates heatmaps and session recordings (capturing, for example, mouse and scroll movements as well as clicks) to help us understand and improve use of the website. Form input content is masked by default. Clarity sets cookies (including "_clck", "_clsk").

The legal basis is Art. 6(1)(a) GDPR (consent). Data may be transferred to the USA; this takes place on the basis of the EU-U.S. Data Privacy Framework, under which Microsoft is certified. You can withdraw your consent at any time via the Cookie Settings link. Further information: privacy.microsoft.com

8. Product Configurator

The product configurator stores your current configuration selection locally in your browser's storage so that your entries are retained while you use it. This storage is technically necessary for the configurator to function and takes place exclusively on your own device — no data is transmitted to us or to third parties until you submit an enquiry via the contact form.

9. AI product advisor (chat)

Our website offers an optional AI chat for product advice. When you actively use the chat, the messages you enter are transmitted to OpenRouter Inc., San Francisco, USA, and processed there by the AI model in use in order to generate a response. Before transmission, we automatically remove email addresses, phone numbers and bank details from your messages. Please do not enter sensitive personal data in the chat; such information is not required for your product enquiry.

Only when you send a chat message is a technically necessary session cookie set (validity: 3 hours), used exclusively for abuse prevention and rate limiting (Sec. 25 (2) German TDDDG). Chat histories are not permanently stored on our servers. For each response we store, for up to 90 days: a pseudonymised session identifier, the language, a shortened form of your question, references to the product data consulted, and your voluntary rating of the answer. We use this data to assure the quality of the advisor. Beyond that, we only keep aggregated usage statistics containing no personal data.

The legal basis for this processing is Art. 6 (1) (f) GDPR (legitimate interest in efficient product advice); use of the chat is voluntary. Where data is transferred to the USA, this takes place on the basis of appropriate safeguards pursuant to Art. 46 GDPR. We configure the processing so that model providers may neither use your input for training nor retain it.

Chat responses are generated automatically by an AI system and may contain errors. Please verify technical specifications before ordering, or contact us via the contact form.

10. Your Rights as a Data Subject

Under the GDPR, you have in particular the following rights:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing (Art. 21 GDPR)

To exercise these rights, an informal message to the contact address given above under "1. Controller" is sufficient.

11. Right to Lodge a Complaint with a Supervisory Authority

You also have the right to lodge a complaint with a data protection supervisory authority about our processing of your personal data. The competent authority is the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (LfDI Baden-Württemberg, the data protection authority for the State of Baden-Württemberg).

12. Currency and Amendment of this Privacy Policy

Last updated: July 2026. We reserve the right to amend this privacy policy to reflect changes in the legal situation or in our offering and our processing of personal data.