Privacy Policy
Last updated on 02.17.2026
The protection of your privacy when using our website is particularly important to us. In the following, we, therefore, inform you about the collection of anonymous and personal data.
1. Provider / Person responsible within the meaning of data protection
Cardino GmbH
Torstraße 105
10119 Berlin, Germany
Email: sales@cardino.de
Web: www.cardino.de
Entry in the register court: Berlin-Charlottenburg
Register number: HRB 251256 B
2. Data Protection Officer
Lukasz Pajak,
Cardino GmbH
Torstraße 105
10119 Berlin, Germany
4. Basics
Your personal data (e.g., title, name, address, e-mail address, telephone number, bank details, credit card number) will be processed in compliance with the relevant statutory data protection regulations, in particular Regulation (EU) 2016/679 of the European Parliament and the Council of 27 April 2016 on the protection of natural persons when processing personal data, on the free movement of data and on the repeal of Directive 95/46/EC (the General Data Protection Regulation – GDPR), the Federal Data Protection Act (BDSG) and other data-related laws (e.g. the Telemedia Act, TMG) is stored and processed by us.
According to the GDPR and other regulations, data processing and use is only permitted if the GDPR or another legal regulation expressly permits this or if the person concerned consents (prohibition with reservation of permission). According to these legal bases, data processing and use is only permitted if the data subject has given their consent to the processing of the personal data concerning them for one or more specific purposes; the processing is necessary for the performance of a contract to which the data subject is a party or for the implementation of pre-contractual measures which are required at the request of the data subject; the processing is necessary to fulfill a legal obligation to which the person responsible is subject; the processing is necessary to protect the vital interests of the data subject or another natural person; the processing is necessary for the performance of a task that is in the public interest or in the exercise of public authority that has been transferred to the person responsible; processing is necessary to safeguard the legitimate interests of the person responsible or a third party, unless the interests or fundamental rights and freedoms of the person concerned, which require the protection of personal data, prevail, especially when the data subject is a child.
Accordingly, we use and process your personal data only within the permissible framework of contract processing or if you have given your informed consent.
In principle, we do not pass on your personal data, including your address and your e-mail address, to third parties. Excluded from this are our service partners who need the transmission of data to process the contractual relationship or if we have expressly pointed this out. In these cases, however, the scope of the transmitted data is always limited to the necessary minimum.
5. Anonymous Data Collection
In principle, you can visit our website without telling us who you are. We only experience the name of your internet service provider, the website from which you are visiting us (referrer URL), the pages of our website that you are visiting, the date and time of retrieval and the amount of data transferred, notification of successful retrieval, browser type and version of the requesting computer/device, the operating system of the requesting computer/device, IP addresses of the requesting computer/device.
This information is only evaluated for statistical purposes. As an individual user, you remain anonymous, of course, and your personal data will not be merged unless you have expressly consented to this or one of the cases listed below applies.
6. Collection of personal data when visiting our website and using our services in general
We only collect personal data if you provide it to us voluntarily and of your own accord. This can be done, for example, when placing an order or to carry out a contract, a survey or when registering for services that require registration with personal data (e.g. to create a user account, etc.). In such cases, we charge in principle only the data to which we are legally authorised and which is absolutely necessary for the fulfilment of the services you require (this would be, for example, a registration for the newsletter, where only your email address is required). If we collect personal data from you, you only have to provide the necessary data. The data fields that are mandatory in each case are marked with an "asterisk". Any additional data you provide is purely voluntary and you do not have to disclose it. If you do provide this anyway, then with your disclosure you give us your consent that we may also store and process this data from you for the purpose stated in each case; in some cases, we also request your express consent for data protection purposes that require express consent, which you can of course give voluntarily, is not bound by any further conditions and can be revoked at any time for the future.
For the highest possible security of your data, they are transmitted in encrypted form using SSL/TLS encryption. This is to prevent misuse of the data by third parties. Your data will only be stored and processed by us on servers within the European Union. A transfer to third countries does not take place unless we are entitled and/or obliged to do so on the basis of a statutory provision or you have expressly consented to this in advance. These cases are then also clearly marked.
7. Data processing to fulfil the contract
7.1 Purpose of processing
If you would like to advertise and sell your car with us, you provide your personal data as part of the registration process. The mandatory information marked with an "asterisk" in this context is personal data that is required for the conclusion of a contract with us. Of course, you are not obliged to provide your personal data. However, we cannot provide the service you require without your providing us with the necessary data. For some services (e.g. the creation of an advertisement by an appraiser), we have to pass on your data to service providers commissioned by us in order to be able to provide the service you have requested. The data you enter is always processed for the purpose of fulfilling the contract.
7.2 Legal Basis
The legal basis for this processing is Art. 6 Para. 1 b) GDPR.
7.3 Recipient Categories
In principle, we do not pass on your personal data to third parties. Depending on the desired service, your personal data may be passed on to the following recipients: buyer of your vehicle, transport service provider for picking up your vehicle if necessary, payment service provider if necessary, partners you may have commissioned (e.g. experts).
Your personal data will not be transmitted to third parties for purposes other than those listed below. In particular, it will not be passed on to third parties, e.g. for advertising purposes, without your express consent.
We only pass on your personal data to third parties if:
You have given your express consent in accordance with Article 6 Paragraph 1 Clause 1 Letter a) GDPR; this is required for the processing of contractual relationships with you in accordance with Article 6 Paragraph 1 Clause 1 Letter b) GDPR, e.g. to banks for processing the contractually agreed payments or, in the event of non-performance of contractually agreed payments, to lawyers and legal service providers for the purpose of legal enforcement; in the event that for the transfer pursuant to Article 6 (1) sentence 1 lit. c) GDPR there is a legal obligation; or the disclosure is required in accordance with Article 6 Paragraph 1 Sentence 1 Letter f) GDPR to assert, exercise or defend legal claims and there is no reason to assume that you have an overriding legitimate interest in not disclosing your data.
7.4 Who we may share your information with
We may give your information to:
- Any member of the Cardino GmbH, which means our shareholders, investors, employees. If any of these parties use your information for direct marketing, we will only transfer it to them for that purpose with your prior consent.
- Our partner and support businesses, including support services, finance lenders, advertising networks, automotive partners such as Finn or Aviloo, prize draw or competition partners, and analytics providers, as well as car dealers and depots.
7.5 Duration of Storage
We store the data required to process the contract until the statutory warranty and, if applicable, contractual warranty periods have expired.
We store the data required under commercial and tax law for the legally stipulated periods, usually ten years (cf. Section 257 HGB, Section 147 AO).
We delete e-mail addresses that we only receive for sending the newsletter as soon as you unsubscribe from the newsletter.
8. Processing of Applicant Data
The personal data you provide voluntarily as part of a job advertisement will be processed by us exclusively for the advertised position for which you have applied. For carrying out the application process and the associated assessment of an applicant, in principle, we only process the personal data that is necessary for this. In addition to the name and address, this also regularly applies to contact details and information that you provide us with in your application documents (cover letter, CV, certificates, etc.). We only process special categories of data (e.g. religious affiliation or health data) if you provide them to us voluntarily or if we have special legal permission or even an obligation to do so. If you are hired, we will only include the data required for the appointment in our personnel file. The legal basis for this is Art. 88 GDPR in conjunction with Section 26 BDSG (new) and, if applicable, Article 6 Paragraph 1 Letter b) GDPR (initiation or implementation of contractual relationships).
If the application process does not lead to employment, your data will be deleted after six months (from the end of the application process) unless you have given us your express consent to store your application documents for later consideration. In such a case, your data will be deleted after 24 months at the latest. The legal basis for this is Art. 6 (1) (a) GDPR (consent). Should processing of your personal data be necessary to fulfill a legal obligation, the legal basis is Article 6 (1) (c) GDPR. Furthermore, it may be necessary to process your personal data to defend against legal claims asserted against us. The legal basis is then Article 6 Paragraph 1 Letter f) GDPR.
You can revoke your consent at any time with effect for the future by sending an email to sales@cardino.de. In such a case, we will delete your data immediately after receiving the revocation. Accordingly, it will not be considered for future job advertisements.
9. Contact Form
If you send us inquiries via the contact form, your details from the inquiry form, including the contact details you provided there, will be stored by us for the purpose of processing the inquiry and in the event of follow-up questions. We do not pass on this data without your consent, unless it is necessary to provide the service you have requested. The data you enter in the contact form will remain with us until you ask us to delete it, revoke your consent to storage or the purpose for data storage no longer applies (e.g. after your request has been processed). Mandatory legal provisions - in particular retention periods - remain unaffected. You can revoke your consent given in this context at any time with effect for the future. Please address the revocation to sales@cardino.de.
12. Google Tag Manager
We use the "Google Tag Manager" on our website, a service provided by Google Ireland Limited. The Google Tag Manager is a tag management system. It allows the user to update measurement codes and associated code snippets, collectively referred to as "tags", on the user's website or mobile app. The Google Tag Manager tool itself is a cookie-free domain and does not collect any personal data. The Google Tag Manager triggers other tags, which in turn may collect data. The legal basis for this processing is Art. 6 (1) (a) GDPR.
13. Google Web Fonts
We use fonts provided by Google on our website for uniform presentation. "Google Fonts" is a service provided by Google Ireland Limited. If you agree to the use of Google Fonts, a connection to the Google servers will be established and the corresponding font will be loaded into your browser cache. The legal basis for this processing is Art. 6 (1) (a) GDPR.
14. Usercentrics Consent Management Platform
We use the Usercentrics Consent Management Platform from Usercentrics GmbH, Rosental 4, 80331 Munich. Usercentrics collects log file data and consent data using JavaScript. This enables us to inform, obtain, manage and document the user's consent to certain cookies and other technologies on our website. The legal basis is Article 6 (1) (c) GDPR. Consent data is kept for 6 years in accordance with § 257 HGB.
15. TrustPilot
We use the TrustPilot review portal operated by TrustPilot A/S, Pilestraede 58, 5th floor, 1112 Copenhagen, Denmark. In order to constantly improve our service, we offer our customers the opportunity to submit independent ratings. We do not pass on your data to TrustPilot. The legal basis is Article 6 (1) (a) GDPR.
17. Microsoft Clarity
We use "Microsoft Clarity" on our website, a web analytics service provided by Microsoft Ireland Operations Limited. Microsoft Clarity uses cookies and a tracking code that enable an analysis of your use of our website. The legal basis for this processing is Art. 6 (1) (a) GDPR. Microsoft Clarity uses this information to evaluate your use of our website, create reports on the use, and provide other services in connection with the evaluation of our website.
18. Google Analytics
This website uses Google Analytics, a web analytics service provided by Google Ireland Limited. Google Analytics uses "cookies" stored on your computer to enable an analysis of your use of the website. The information generated by the cookie about your use of this website is usually transmitted to a Google server in the USA and stored there. The legal basis for this processing is Art. 6 (1) (a) GDPR. If you are logged into your Google account, you enable Google to assign your surfing behavior directly to your personal profile. You can prevent this by logging out of your Google account.
19. Mailchimp
Mailchimp acts as a data processor on our behalf and is contractually obligated to use your email address only for the purposes of providing the email automation services to us. Mailchimp is also required to maintain the confidentiality and security of your information.
20. Zendesk
We may collect the following types of personal information in our CRM system:
- Contact Information: such as your name, email address, phone number.
- Communication History: including records of your interactions with our customer support team, such as emails.
We use the personal information collected through Zendesk for the following purposes:
- Providing Support: to provide customer support and respond to your inquiries, requests, and tickets.
- Improving Services: to improve our products, services, and customer support processes.
- Communication: to send you important notifications, updates, and promotional communications related to our products and services, provided you have opted in.
21. Airtable
We utilize Airtable as our data platform to manage certain aspects of our business operations, including storing information related to deal history. This may include details such as customer names, contact information and other relevant data necessary for managing our business relationships. We take appropriate measures to ensure the security and confidentiality of the information stored in Airtable, including implementing access controls and encryption protocols.
22. Withdrawing Your Consent
If you have given us your consent under data protection law for certain data uses and/or services, you can revoke this at any time with effect for the future. A simple message to:
Cardino GmbH
Torstraße 105
10119 Berlin, Germany
Email: sales@cardino.de
23. Your rights as a data subject
As the data subject, you have various rights with regard to your personal data. We have taken appropriate measures to provide you with all information pursuant to Articles 13 and 14 of the GDPR and all communications pursuant to Articles 15 to 22 and Article 34 GDPR.
23.1 Right to Confirmation and Information
You can request confirmation as to whether personal data relating to you is being processed by us, including the purposes of processing, categories of data, recipients, planned duration of storage, and rights to correction, deletion, restriction, or objection.
23.2 Right to Rectification
You have a right to correction and/or completion if the processed personal data concerning you is incorrect or incomplete.
23.3 Right to restriction of processing
You can request the restriction of the processing of your personal data under specific conditions, including when you dispute the accuracy of the data or object to processing.
23.4 Right to Erasure
You can demand that the personal data concerning you be deleted immediately when one of the legal reasons applies (e.g., the data is no longer necessary, you revoke consent, or the data was processed unlawfully). Exceptions apply where processing is necessary for freedom of expression, legal obligations, public interest, or legal claims.
23.5 Right to Information
If you assert the right to correction, deletion or restriction of processing, we are obliged to inform all recipients to whom your personal data has been disclosed.
23.6 Right to data portability
You have the right to receive the personal data that you have provided to us in a structured, common and machine-readable format, and to transmit this data to another controller without hindrance.
23.7 Right to Object
You have the right, for reasons arising from your particular situation, to object at any time to the processing of your personal data based on Article 6 (1)(e) or (f) GDPR. If your personal data is processed for direct advertising, you have the right to object at any time.
23.8 Right to revoke the declaration of consent
You have the right to revoke your declaration of consent under data protection law at any time. The revocation does not affect the legality of processing carried out up to the point of revocation.
23.9 Automated individual decision-making including profiling
You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you, except where necessary for a contract, permitted by law, or with your express consent.
23.10 Right to lodge a complaint with a supervisory authority
You have the right to lodge a complaint with a supervisory authority, in particular in the member state of your place of residence, place of work, or place of the alleged infringement, if you believe processing of your personal data violates the GDPR.
24. Further information
If you have any further questions or suggestions on the subject of "data protection" or would like information about your data or its correction or deletion, please write to:
Cardino GmbH
Torstraße 105
10119 Berlin, Germany
Email: sales@cardino.de