Privacy Policy

Status: 29.09.2026. This privacy policy informs you in accordance with Articles 13 and 14 of the General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG) about which personal data we process when you visit auto-bauer.at and when you contact us.

1. Data Controller

Gerd Bauer Motor-Center Gesellschaft m.b.H. (“Autohaus Bauer”)
Industriegelände West 12, 2460 Bruck an der Leitha, Austria
Phone: +43 2162 67976 · Email: kontakt@auto-bauer.at

For any questions regarding data protection and exercising your rights, you can reach us at kontakt@auto-bauer.at (subject: “Privacy”). A data protection officer is not legally required and has not been appointed.

2. Key Points at a Glance

Without your consent, we do not load any third-party content, fonts, or scripts. Fonts, images, and code are hosted on our own server.
Google Analytics and the Meta Pixel are only loaded if you allow “Statistics” or “Marketing” in the cookie banner. You can change your choices at any time (Section 13).
Our forms and AI chat are protected against abuse without using external captcha services.
We do not sell data and only share it when necessary for the respective purpose.

3. Hosting, Server Logs, and Security

The website is hosted by ALL-INKL.COM – Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany (data processor pursuant to Art. 28 GDPR, servers located in Germany). With every visit, the server processes technically necessary data: IP address, date and time, accessed URL, transferred data volume, referrer, as well as browser and operating system. The connection is TLS-encrypted (HTTPS).

To protect against abuse (spam, attacks, excessive requests), our server logs do not store IP addresses in plain text, but only a daily changing, irreversible hash value. These logs are deleted after 13 months at the latest; request-limiting counters are deleted after 24 hours.

Legal basis: legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR).

4. Contact and Forms

When you contact us by phone, email, or via a form (e.g. test drive, workshop appointment, tyre change, consultation, vehicle purchase/trade-in, claims handling, brochure request, vehicle enquiry), we process the details you provide: usually salutation, name, email address, phone number, your message, and – depending on the form – vehicle data (make, model, registration number, mileage, first registration date), preferred dates, and uploaded files (photos, vehicle registration document).

Purpose: Processing your enquiry, scheduling appointments, preparing offers; you will receive a confirmation receipt by email.
Legal basis: pre-contractual measures or contract performance (Art. 6(1)(b) GDPR); for general enquiries, our legitimate interest in replying to you (Art. 6(1)(f) GDPR).
Transmission: Form data is sent via encrypted email through our host's mail server to our office and is not stored in a database on the website. Uploaded files are cached solely for transmission; images are re-encoded (metadata such as GPS location is removed) and deleted immediately afterwards. Only if transmission fails technically is a copy retained for a maximum of 30 days so that your enquiry is not lost.
Storage period: Enquiries that do not lead to a contract are deleted after a maximum of three years (limitation period for potential claims). If a contract is concluded, we retain records for seven years in compliance with statutory corporate and tax obligations (§ 132 BAO, § 212 UGB).
Protection against abuse: A hidden field, a time check, and a small calculation solved by your browser in the background identify automated spam submissions. We check the domain of your email address for valid mail servers. No data is shared with third parties for this purpose.

5. Vehicle Purchase, Workshop, and Customer Care

If you purchase a vehicle or commission our workshop, we process your contact, contract, vehicle, and payment details for contract performance (Art. 6(1)(b) GDPR) and to fulfill statutory obligations such as registration, warranty, and accounting (Art. 6(1)(c) GDPR). Where necessary, we transmit data to manufacturers/importers (warranty claims, recalls), insurance companies, financing and leasing partners (only if you request financing), vehicle registration authorities, and our tax advisors. Retention period is seven years, or until warranty/guarantee matters are fully concluded.

6. AI Chat “KI-Günter & KI-Klaus”

Our chat answers questions about vehicles, the workshop, and the dealership using artificial intelligence. Nothing is transmitted before you first click “Start Chat”.

AI Provider: Your messages and previous chat context are sent to Google's Gemini API to generate replies (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; data processing also by Google LLC, USA). We use the commercial API service: according to Google, content is not used to train AI models and is stored for up to 55 days solely for abuse detection (Google Policy). Your IP address and name are not transmitted to Google by us.
On our end: The chat conversation is retained for context for up to 24 hours under a random identifier; in the browser, it is stored in your session storage and is deleted once you close the tab or click “New Chat”. To improve our service, we log conversations pseudonymously (without IP address; email addresses and phone numbers are redacted) and delete these logs after six months at the latest.
Forwarding to us: Upon your explicit request, the chat can forward your enquiry by email to Günter Bauer, Klaus Bauer, or our office. For this purpose, it asks for your name and email address (phone optional), presents a summary, and only sends after your confirmation. You will receive an email confirmation. Details from Section 4 apply.
Legal basis: Your consent by starting the chat (Art. 6(1)(a) GDPR); for forwarded enquiries, Art. 6(1)(b) GDPR. Data transfers to the USA are based on the EU-US Data Privacy Framework, under which Google LLC is certified, as well as standard contractual clauses.
Please do not enter any sensitive data into the chat. AI answers are provided without guarantee; no automated decision-making pursuant to Art. 22 GDPR takes place.

For our newsletter, we use Brevo (Sendinblue SAS, 17 rue de Salneuve, 75017 Paris, France; data processor pursuant to Art. 28 GDPR, data processing within the EU).

Subscription: The only mandatory field is your email address; first and last names are voluntary. We also record language, timestamp, and source of subscription. After signing up, you will receive an email with a confirmation link (double opt-in); you are only subscribed once clicked. Brevo logs subscription and confirmation as proof of consent.
Content: Promotions, special offers, new vehicle arrivals, workshop tips, and events from Autohaus Bauer.
Analytics: Brevo measures whether a newsletter was opened and which links were clicked to optimize delivery. This is covered by your consent.
Legal basis: Your consent (Art. 6(1)(a) GDPR, § 174 TKG 2021). You can revoke it at any time via the unsubscribe link in any newsletter or by sending us an email; your details will then be removed from the mailing list. The address is only kept on a suppression list for as long as necessary to prevent further mailings.

8. Google Analytics 4 (Statistics)

Only with your consent to the “Statistics” category do we use Google Analytics 4 from Google Ireland Limited (address see Section 6) to understand how our website is used and to improve it.

Collected data: pages visited, time spent on site, approximate region, device and browser, source of visit, and events such as form submissions (only form name and type of enquiry, no contents), clicks on phone numbers and email addresses, viewed vehicles (vehicle ID), use of the vehicle filter and the chat (number of messages, no contents). Names, email addresses, or phone numbers are never transmitted to Google Analytics.
Cookies: _ga, _ga_<ID> (up to 2 years). Google Analytics 4 does not store full IP addresses. Data is automatically deleted after 14 months.
Advertising features from Google (Google Signals, personalized advertising) are only activated with your consent to “Marketing” (Google Consent Mode).
Legal basis: Consent (Art. 6(1)(a) GDPR, § 165(3) TKG 2021). Transfers to Google LLC in the USA are based on the EU-US Data Privacy Framework and standard contractual clauses. More information: Google Privacy Policy.

9. Meta Pixel (Marketing)

Only with your consent to the “Marketing” category do we use the Meta Pixel from Meta Platforms Ireland Limited (Merrion Road, Dublin 4, D04 X2K5, Ireland). This allows us to measure the effectiveness of our advertising on Facebook and Instagram and show relevant vehicles and offers to users who have visited our website.

Collected data: page views, viewed vehicles (vehicle ID), submitted enquiries (type of enquiry), contact clicks, and vehicle filter usage, together with browser and device details. We do not transmit email addresses or phone numbers to Meta.
Cookies: _fbp, _fbc (90 days); if a Meta account is logged in via the browser, Meta may associate the visit with that account.
Joint controllership: For the collection and transmission of data to Meta, we are joint controllers with Meta (Art. 26 GDPR, Meta Controller Addendum). Meta is solely responsible for subsequent data processing; you can also assert your data subject rights directly against Meta.
Legal basis: Consent (Art. 6(1)(a) GDPR, § 165(3) TKG 2021). Transfers to Meta Platforms Inc. in the USA are based on the EU-US Data Privacy Framework and standard contractual clauses. More information: Meta Privacy Policy.

10. YouTube Videos

Videos are initially integrated solely as a preview image hosted on our server. Only when you click on a video is it loaded using YouTube’s privacy-enhanced mode (youtube-nocookie.com, Google Ireland Limited); your IP address and device details are transmitted to Google, and Google may set its own cookies or storage. Legal basis is your consent via the click (Art. 6(1)(a) GDPR).

We link to our Facebook and Instagram profiles using simple outbound links. Data is only transferred once you click a link and visit the respective platform; Meta’s privacy policies apply there.

12. Recipients and Transfers to Third Countries

Recipients of your data are – depending on the purpose – our host ALL-INKL.COM, Google (AI chat, and upon consent Google Analytics and YouTube), Meta (upon consent), Brevo (newsletter), and the partners mentioned in Section 5. Data processing agreements pursuant to Art. 28 GDPR are in place with our processors. Transfers to the USA occur only to companies certified under the EU-US Data Privacy Framework (adequacy decision of the EU Commission of 10.07.2023), supplemented by standard contractual clauses.

13. Cookies and Your Consent

Which cookies and storage technologies we use is detailed in our Cookie Policy. Your choice in the cookie banner is stored for 12 months in the bauer_consent cookie; as proof of consent, we log your decision with a timestamp, a random identifier, and a truncated, irreversible hash of your IP address (retention 13 months, Art. 6(1)(c) and (f) GDPR). You can change or revoke your consent at any time with effect for the future:

14. Your Rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection to processing based on legitimate interests (Art. 21). You can revoke any granted consent at any time without affecting the lawfulness of processing carried out prior to revocation. Please contact kontakt@auto-bauer.at; we will respond within one month.

If you believe that the processing of your data violates data protection regulations, you can lodge a complaint with the supervisory authority: Österreichische Datenschutzbehörde (Austrian Data Protection Authority), Barichgasse 40–42, 1030 Vienna, dsb@dsb.gv.at, www.dsb.gv.at.

15. Obligation to Provide Data and Automated Decision-Making

You are under no legal obligation to provide us with data. However, without the mandatory fields marked in the form, we cannot process your enquiry. Fully automated decision-making, including profiling within the meaning of Art. 22 GDPR, does not take place.

16. Changes

We update this privacy policy when our website, our services, or the legal situation changes. The version published here applies in each case.