Ermler

Privacy Policy

Protecting your personal data matters to us. This privacy policy explains which personal data we process when you visit ermler.at, for what purpose, on what legal basis and for how long – and which rights you have under the General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG).

1. Controller

Ing. E. Ermler GmbH
Obere Hauptstraße 92
7121 Weiden am See
Austria

Phone: +43 2167 2863
E-mail: office@ermler.at

Please use these contact details for any questions about data protection and to exercise your rights.

2. Summary

  • You can use our website without providing any personal information.
  • Tracking and marketing services (Google Analytics, Meta Pixel) and YouTube videos are loaded only with your consent. Without consent we only set one technically necessary cookie that stores your choice.
  • Fonts, images and scripts are delivered from our own server. Visiting a page does not transfer any data to Google Fonts, content delivery networks or similar services.
  • We use data from our forms solely to handle your request. We do not sell data or pass it on for advertising purposes.
  • You can change or withdraw your consent at any time on the Cookie notice page.

3. Hosting and server log files

Our website is hosted by ALL-INKL.COM – Neue Medien Münnich, owner René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. The servers are located in Germany. We have concluded a data processing agreement with ALL-INKL pursuant to Art. 28 GDPR; ALL-INKL processes the data only on our instructions.

Each time a page is requested, your browser technically transmits data to the server, which is stored in server log files:

  • IP address of the requesting device
  • date and time of access
  • requested address (URL) and amount of data transferred
  • address of the previously visited page (referrer), if your browser sends it
  • browser type and version, operating system

This data is required to deliver the website, ensure its stability and security and ward off attacks. The legal basis is our legitimate interest in a secure and functioning website (Art. 6(1)(f) GDPR). The log files are kept only for a short time and then deleted automatically; they are not combined with other data.

The connection to our website is encrypted with TLS (recognisable by "https://" and the padlock symbol in your browser).

4. Cookies and consent management

Cookies are small text files that your browser stores on your device. We use cookies and similar technologies that are not technically necessary only with your consent, in accordance with Section 165(3) of the Austrian Telecommunications Act 2021 (TKG 2021) and Art. 6(1)(a) GDPR.

On your first visit, our cookie banner asks which categories you want to allow. We store your choice in the cookie ermler_consent on your device (storage period 12 months). So that we can prove that consent was given (Art. 7(1) GDPR), we log the time and your choice together with a shortened, non-reversible hash of your IP address. This log is deleted after 13 months. The legal basis for this is our legal obligation (Art. 6(1)(c) GDPR).

An overview of all cookies used and the option to change or reset your choice can be found on the Cookie notice page.

5. Inquiry forms

On our website you can request a test drive, a workshop appointment or a consultation, contact us about a vehicle or register for events. We process the information you enter in the form – depending on the form: name, e-mail address, phone number, brand and model, licence plate, preferred date, the vehicle concerned and your message – as well as the language of the page and the time of the request.

Purpose: handling your request, arranging appointments and getting in touch with you. After submitting, you receive a confirmation e-mail with your details. Inquiries about a specific vehicle are forwarded to the responsible sales consultant.

Legal basis: steps prior to entering into a contract or performance of a contract (Art. 6(1)(b) GDPR) and our legitimate interest in answering inquiries (Art. 6(1)(f) GDPR).

Transfer and storage: Your details are transmitted to our server in encrypted form and delivered to our team by e-mail via our mail server at ALL-INKL (see section 3). We do not store inquiries permanently on the web server; only if sending the e-mail fails, a copy is kept for no more than 30 days so that no request is lost. We keep your inquiry for as long as necessary to handle it. If a contract is concluded, the statutory retention periods apply (generally seven years under Section 132 of the Austrian Federal Fiscal Code).

Spam protection: To protect against automated submissions we only use our own mechanisms, without third-party providers: an invisible check field, a time check, a small calculation your browser solves in the background, and a limit on requests per device. For this limit we store a non-reversible hash of the IP address, which is deleted after one day (Art. 6(1)(f) GDPR).

Mandatory fields are marked. Without this information we unfortunately cannot process your request.

6. Newsletter

If you subscribe to our newsletter, we use your e-mail address and – if provided – your first name to send you information about new models, promotions, workshop offers and events. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 174 TKG 2021).

We use the double opt-in procedure: after signing up you receive an e-mail with a confirmation link. Only when you click it are you added to the mailing list. To prove your consent we store the time of the sign-up and of the confirmation as well as the IP address used.

For sending we use Brevo (Sendinblue SAS, 17 rue de Salneuve, 75017 Paris, France; German branch: Brevo GmbH, Köpenicker Straße 126, 10179 Berlin). The data is stored on servers in the EU; we have concluded a data processing agreement with Brevo pursuant to Art. 28 GDPR. Brevo measures whether a newsletter was opened and which links were clicked so that we can improve the content; this is also covered by your consent.

You can unsubscribe at any time via the link in every issue or by e-mail to office@ermler.at. Your data will then be removed from the mailing list. To make sure we do not send you anything after you unsubscribe, your e-mail address is kept on a block list (Art. 6(1)(f) GDPR). As with all our forms, the address entered is checked for typos and an existing domain; only the part after the @ is looked up.

7. Contact by e-mail, phone and WhatsApp

If you contact us by e-mail or phone, we process your details to handle your request (Art. 6(1)(b) or (f) GDPR) and delete them as soon as they are no longer needed and no statutory retention obligations apply.

Our website links to WhatsApp. WhatsApp only opens when you tap the link; simply visiting our website does not transfer any data to WhatsApp. If you write to us via WhatsApp, the provider WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, also processes your data under its own terms. Please do not send us sensitive data via WhatsApp.

8. Google Analytics (only with consent)

If you consent to the "Statistics" category, we use Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Google Analytics helps us understand how visitors use our website – for example which pages are viewed, for how long and how people find us – so that we can improve our offer.

Cookies are set (_ga, _ga_<ID>, storage period up to 2 years) and usage data such as pages viewed, clicks, approximate location (country, region), device, browser and operating system as well as a random identifier of your browser are processed. Google Analytics 4 does not store IP addresses; they are only used briefly within the EU to determine the location and are then discarded. We only use advertising features – such as passing enquiries to Google Ads to measure the success of ads – if you have also consented to the "Marketing" category (Google Consent Mode). Google Signals (linking with Google accounts) is deactivated.

We also record certain actions as events to see which pages and vehicles lead to enquiries: the successful submission of a form (only the type of form and, where applicable, the vehicle number), clicks on phone numbers, e-mail addresses, WhatsApp and route planning, clicks on the manufacturers' offer and test-drive pages, as well as vehicles viewed, search terms and filter settings. What you enter in our forms – such as your name, e-mail address, phone number or message – is not transmitted to Google.

Google also processes data in the USA. Google LLC is certified under the EU-US Data Privacy Framework, for which the EU Commission adopted an adequacy decision on 10 July 2023 (Art. 45 GDPR); the EU Commission's standard contractual clauses apply in addition. We have concluded a data processing agreement with Google. Analytics data is deleted automatically after 14 months.

Legal basis is your consent (Art. 6(1)(a) GDPR, Section 165(3) TKG 2021), which you can withdraw at any time on the Cookie notice page. More information: policies.google.com/privacy.

9. Meta Pixel (only with consent)

If you consent to the "Marketing" category, we use the Meta Pixel of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland ("Meta"). It allows us to measure the effectiveness of our advertising on Facebook and Instagram and to show relevant ads there to people who have visited our website (remarketing).

The pixel sets the cookie _fbp and – if you come to us via an ad – the cookie _fbc (storage period 3 months each) and transmits information about your visit (e.g. pages viewed, time, browser and device information, IP address) to Meta. In addition, we transmit which vehicles you have viewed (vehicle number), what you searched for and whether you submitted a form or clicked on a phone number, e-mail address, WhatsApp, route planning or a manufacturer's offer or test-drive page. This allows us to show you ads on Facebook and Instagram for vehicles you have viewed on our website. What you enter in our forms is not transmitted to Meta. If you are logged in to Facebook or Instagram, Meta can link the visit to your account. We are jointly responsible with Meta for collecting and transmitting the data to Meta (Art. 26 GDPR); the agreement can be found at facebook.com/legal/controller_addendum. Meta alone is responsible for any further processing.

Meta also processes data in the USA. Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework (adequacy decision of 10 July 2023).

Legal basis is your consent (Art. 6(1)(a) GDPR, Section 165(3) TKG 2021), which you can withdraw at any time. More information: facebook.com/privacy/policy.

10. YouTube videos (two-click solution)

Videos on our website come from YouTube, a service of Google Ireland Limited (address see section 8). Instead of the video we first only show a preview image from our own server – no connection to YouTube is established. Only when you click on the video do you consent to loading YouTube videos (this consent applies to YouTube only, not to other marketing services), and the video is loaded in privacy-enhanced mode (youtube-nocookie.com). If you have accepted the "Marketing" category in the cookie banner, videos are loaded directly. Among other things, your IP address and the page viewed are transmitted to Google; when playing, YouTube may use cookies and similar technologies. Google also processes data in the USA (EU-US Data Privacy Framework, see section 8).

Legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.

11. Links to social networks, maps and manufacturers

We refer to Facebook, Instagram, YouTube and TikTok, to Google Maps or Apple Maps (route planning) and to the websites of Mercedes-Benz, BYD and Mitsubishi with simple links only. No plugins or maps are embedded; data is only transferred when you click a link. The privacy policies of the respective providers apply to the linked services.

12. Storage period

We store personal data only for as long as is necessary for the respective purpose or as statutory retention obligations (in particular under commercial and tax law) require. The specific periods are listed in the individual sections above. The data is deleted afterwards.

13. Recipients of your data

Within our company, only the employees who handle your request have access. External recipients are our hosting provider ALL-INKL and – if you subscribe to the newsletter – Brevo (both processors) and – only with your consent – Google and Meta as described above. Where necessary to fulfil your request (e.g. financing, warranty or manufacturer service), we pass on data to manufacturers, importers or financing partners; we will inform you about this in each individual case.

14. Your rights

Under the GDPR you have the right to:

  • access the data stored about you (Art. 15 GDPR)
  • rectification of inaccurate data (Art. 16 GDPR)
  • erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR)
  • data portability (Art. 20 GDPR)
  • object to processing based on our legitimate interest (Art. 21 GDPR)
  • withdraw any consent given, with effect for the future (Art. 7(3) GDPR) – for cookies simply on the Cookie notice page

Simply write to us at office@ermler.at or by post to the address above.

If you believe that the processing of your data violates data protection law, you can lodge a complaint with the supervisory authority. In Austria this is the Datenschutzbehörde (Data Protection Authority), Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at, e-mail: dsb@dsb.gv.at.

15. No automated decision-making

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

16. Changes

We update this privacy policy when our website or the legal requirements change. The version published here applies.

Last updated: November 2026

This is a translation. In case of doubt, the German version applies.