Privacy policy

Email: kontakt@auto-mieten-ohne-kreditkarte.de

The controller has no establishment in the European Union. The following has been designated as representative under Article 27 GDPR:

Data subjects and supervisory authorities can contact this representative in addition to the controller.

Without your consent, Auto mieten ohne Kreditkarte sets no statistics or advertising cookies and loads nothing from third-party statistics or advertising services; we do not embed third-party font services at all. Only if you consent in the banner do we use Google Analytics and Google Ads (more under “Google Analytics and Google Ads”) and store your IP address ourselves (“Our own analysis with IP address”); we store your choice itself in a cookie. Only when you move on to an offer from CHECK24 does our interstitial page load a counting image from CHECK24 (more under “Car hire search”). We count visits ourselves, without an identifier in your browser. If you click on an offer, you go to the provider; from then on, their privacy policy applies.

As with every visit to a website, your browser transmits technical details that arise during operation: IP address, date and time, the address requested, the amount of data transferred, and browser and operating system details. They are used to deliver the site and to detect faults and attacks.

The legal basis is our legitimate interest in secure operation (Art. 6(1)(f) GDPR). These logs are not combined with other data; with your consent to “Our own analysis with IP address” we additionally store some of these details ourselves (see there). They are created as logs at our host and are deleted there automatically, after 30 days at the latest.

We count how often our pages are viewed. Nothing is stored on your device for this and nothing is read from it — no cookie, no browser storage, no counting script. That is why we do not ask for your consent for it: § 25(1) TDDDG concerns precisely the storing of information on, and the reading of it from, end devices, and neither happens here.

Only what your browser sends anyway when you visit is evaluated: the address requested, the page you came from (only its domain, never the full address), the browser identifier, the preferred language and your IP address. From the IP address, our host Vercel determines country, region and city before the request reaches us; we adopt these details but do not query a location service of our own. If you arrive via a tagged link (for example from an ad), we store the campaign details from the address (utm parameters) and the name of the ad network whose click identifier was in it — but not the click identifier itself.

Without your consent, we do not store the IP address. (If you have consented to “Our own analysis with IP address”, see there.) Together with the browser identifier and a random value that changes daily, it is converted into an identifier. This makes it possible to recognise that two visits on the same day belong together — nothing more. After two days, we delete the random value and the identifier and cut the time down to the full hour; after 180 days, the rows are deleted completely. We count location only as a daily total (day, country, city, number), separately from all other details. This applies to the count without consent; what we additionally store with your consent to “Our own analysis with IP address” is described there — during that period your visits can also be linked to each other via the IP address.

The legal basis is our legitimate interest in knowing whether and from where visitors come (Art. 6(1)(f) GDPR). We do not use any third-party tool for this, and the figures are kept in our database in Frankfurt am Main.

If you consent in the banner, we use Google Analytics 4 (statistics) and Google Ads conversion tracking (advertising). You choose each one separately. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Before you consent, nothing loads from Google and nothing is stored on your device for it. Auto mieten ohne Kreditkarte is measured in its own Analytics property, separate from other websites.

Why: With “Statistics” we see which pages are visited, for how long, where visitors come from (search engine, ad, link) and from which region. With “Advertising”, Google Ads measures whether a click on one of our ads led to a visit and to a click through to one of our partners. We do not use personalised advertising (remarketing), and Google Signals — the link to Google accounts — is switched off.

Which data: a random identifier in a cookie, pages viewed and the times of viewing, and the page you came from (in each case only the path of the address, without search details such as destination, travel dates, number of guests or search terms — we remove these before the measurement leaves your device), campaign details and the click identifier of an ad, clicks through to partners (only the partner’s name and domain, not the address of the offer), device, browser, language and the approximate location that Google derives from the IP address. According to Google, Google Analytics 4 does not store IP addresses.

Cookies: _ga and _ga_… (statistics, up to two years), _gcl_… (advertising, up to 90 days). We store your choice itself for six months in the cookie einwilligung; after that, we ask again.

The legal basis is your consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). You can withdraw it at any time with effect for the future: Cookie settings, also at the bottom of every page. When you withdraw it, we delete the Google cookies in your browser.

USA: Google may transfer data to Google LLC in the USA. Google is certified under the EU-US Data Privacy Framework, for which the European Commission determined an adequate level of protection on 10 July 2023 (Art. 45 GDPR). For Google Analytics, Google processes the data as a processor under the Google Ads Data Processing Terms. For Google Ads conversion tracking, Google is itself a controller (Google Ads Controller-Controller Data Protection Terms); Google’s privacy policy also applies to this.

Retention at Google: Google Analytics deletes event data after 14 months at the latest. More from Google: policies.google.com/privacy.

If you have consented to our own analysis with IP address in the banner (a separate question, independent of “Statistics”; “Accept all” includes it), we ourselves — not Google — store, on every page view and when you move on to a partner via our interstitial page: your IP address, the time, the country, region and city that our host Vercel derives from it, device, browser and operating system (from the browser identifier), the page visited (only the path of the address) and the route of your visit (channel, campaign, ad group or link content). When you move on to a partner, the partner’s name and the check value of our identifier for that move are added, not the identifier itself (see “Referral to partners”). Names and email addresses are not part of it. We set no additional cookie for this; whether you have consented we read from the cookie holding your choice.

Why: to detect programs and automated access (bots) and fraud, to check bookings reported to us by partner networks and their cancellations, and to see which routes (ads, search engines, AI services, links) lead to bookings. Via the IP address, your visits during this period can be linked to each other; via the check value, a reported booking can be matched to your visit.

The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time with effect for the future: Cookie settings. After that we store nothing new and immediately delete all entries with the IP address from which you withdraw. Entries stored under a different IP address are deleted at your request (see “Your rights”). Without consent, only the audience measurement above applies, without an IP address.

Storage period: 90 days. If an entry belongs to a reported booking via the check value, it is kept while the booking is open and then for three months from the last change to its report (usually its final settlement: confirmed, cancelled or rejected) — at most twelve months after the visit. It is stored in our database in Frankfurt (Neon); for the transfer to Georgia, see “Transfer to a third country”.

If you search for a hire car — using the search on the home page or the search form — your browser sends the pick-up location, the drop-off location if different, the dates, times and the driver’s age to our server; they are part of the page address. Our server uses them to ask the car hire portals QEEQ, DiscoverCars, CHECK24 and Sunny Cars for current offers. Our server makes these requests under its own address: the portals see neither your IP address nor your browser identifier nor anything else about you. We keep the answers only briefly (at most 20 minutes in memory, so that further pages of the list load quickly); which search is already running at a portal we note for five minutes — neither is linked to you. We deliver car pictures and logos from our server at our host Vercel, and the suggestions for the pick-up location come from our own directory — your browser loads nothing from the portals before you tap an offer.

To stop anyone from triggering the search en masse, our server counts how often searches come from the same IP address and recognises programs and search engines from the browser identifier (for them it does not query the portals). The counters are held only in the server’s memory, count for at most ten minutes and disappear at the latest when it restarts; they are not stored anywhere.

If you tap an offer, an interstitial page shows where you are going; your browser then opens the portal’s page. For Sunny Cars the route goes through the partner network Awin (awin1.com), for QEEQ through Travelpayouts (tp.media); the click is counted there, under their own rules also with a cookie, and an identifier for this move is passed on — nothing about you. If you move on to an offer from CHECK24, the interstitial page loads an invisible counting image from a.check24.net when it opens, shortly before your browser moves on to CHECK24 (even if you cancel before that): your IP address, your browser identifier, our site’s address (domain only) and the identifier of our partner account go there. Your browser sends no cookies with it, and the response sets none. From then on, what is set out under “Referral to partners” applies.

The legal basis is our legitimate interest in showing you current car hire prices and in settling our referrals in a traceable way (Art. 6(1)(f) GDPR).

If you click on an offer, you leave Auto mieten ohne Kreditkarte and arrive at the provider concerned — often first at a partner network that counts the click and forwards you. In the process, an identifier is passed on with which the provider can attribute a booking to our recommendation; this is how our commission arises. Depending on the offer, this is an identifier of this switch made up of the pick-up location, the pick-up date, the time at which the link was created and a random part, or just a word for the place on our site; it contains no name and no contact details. This only happens when you click yourself; before that, this site loads nothing from providers or networks.

From the click onwards, the network and the provider are responsible for the processing; their privacy policies apply. They decide for themselves which data they collect and whether they set cookies. We count the click itself (day, page, provider). If you have consented in the banner, the click also goes to Google Analytics, only with the partner’s name (see “Google Analytics and Google Ads”).

If you open an offer via our interstitial page, we also store a check value calculated from our identifier for that move — not the identifier itself — together with the partner, the full hour and the route by which you arrived (channel, campaign, ad group), for 90 days. For this we set no cookie and read nothing additional from your device except the cookie holding your banner choice. With your consent to “Our own analysis with IP address”, we also store your IP address in the process, and the check value is kept with that entry for as long as the entry (see there).

If a partner network reports a booking for our identifier (the networks and partner programmes through which we are paid by the providers, for example Travelpayouts, CJ, Awin, Expedia and Trip.com), we store the network, partner, status, time of booking, booking value and our commission, the network’s reference for the booking, our identifier and, where the network provides them, the customer’s country and city (only the place name), device type, operating system, start of travel and destination and the page from which you switched — no names, contact details or IP addresses. This shows us which advertising and which of our pages lead to bookings and lets us check our commissions. We delete our identifier and the city 180 days after the booking, the whole row 400 days after the booking. The legal basis is our legitimate interest in measuring the success of our advertising and our pages and in checking commissions (Art. 6(1)(f) GDPR); you can object to this (see “Your rights”).

If you write to us using the contact form or by email, your name, your email address, the subject and your text go to our inbox. We use them only to reply to you and do not pass them on to anyone. The basis is our legitimate interest in being reachable (Art. 6(1)(f) GDPR).

So that the form is not flooded by machines, our server briefly checks, when you send it, how often messages have been sent from the same origin. For this, your IP address is immediately converted into a hash value; the plain text is not stored, and the hash value is kept only in working memory and is gone after one hour at the latest. We keep the message itself until the matter has been dealt with, for three years at most.

With the switch at the top of every page, you choose a light or a dark appearance. We do not store this choice — neither as a cookie nor in your browser’s storage, and it is not transmitted to us either. It applies until you reload the page; after that, the appearance follows your device’s setting again.

The fonts of this site — for the logo, headings and text — are delivered with the site by our host Vercel (see “Who works for us”). Your browser does not load them from Google Fonts or any other font service.

We do not run the site on our own computers. These service providers process data exclusively on our behalf and according to our instructions:

• Vercel — operation of the website. The pages and interfaces run in the Frankfurt am Main region.
• Neon — the database that holds the visit counts and the reported bookings as well as the IP addresses stored with your consent (“Our own analysis with IP address”). Location: Frankfurt am Main.
• united-domains — our email inbox, that is, everything you write to us.

Vercel and Neon are companies based in the USA; access from there cannot be technically ruled out. The basis for this is the European Commission’s adequacy decision on the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses.

The controller is based in Georgia. There is no adequacy decision of the European Commission for Georgia. The operation of the site and the database, on the other hand, are located in the European Union (Frankfurt am Main). We access them from Georgia only to operate the site and to answer your enquiries and — with your consent — to evaluate the entries under “Our own analysis with IP address”. What goes to Google, and possibly to the USA, with your consent is set out under “Google Analytics and Google Ads”.

You have the right of access, rectification, erasure, restriction of processing and data portability, and the right to object to processing based on a legitimate interest. An informal message to the address given above is enough; we reply within one month.

Right to object: you can object at any time, on grounds relating to your particular situation, to processing based on our legitimate interest (Art. 6(1)(f) GDPR) — for example the audience measurement, the car hire search including CHECK24’s counting image and the evaluation of reported bookings (Art. 21(1) GDPR). An informal message to the address above is enough.

You can also complain to a data protection supervisory authority — as a rule, the authority where you live or the authority at the seat of our EU representative.