Copart Deutschland GmbH Privacy Policy

Copart uses cookies to personalize content, ads and to analyze our traffic. We also share information about your use of our site with our advertising and analytics partners who may combine it with other information that you’ve provided to them or that they’ve collected from your use of their services. We do not sell your personal information.

To know how Google will use their personal data when consent is given. Follow link Google’s Privacy & Terms

Privacy Statement

Copart respects your privacy and is committed to protecting your Personal Data, which is any information that can be used to identify or potentially identify a particular person.

The scope of this Privacy Policy relates to any Personal Data that Copart processes under applicable data privacy laws. This Privacy Policy applies to your use of this website and all Copart services, regardless of how you access or use the services, including access via mobile devices and applications.

This version of the Privacy Notice was last updated on February 26th, 2024. As changes to the law, or changes to our corporate processes occur, we may adapt this privacy policy accordingly. As such, we ask that you read this privacy policy regularly during your relationship with Copart. This privacy policy can be accessed any time by visiting the Copart website and selecting the Privacy Policy link at the bottom of the page. Additionally, this page may be saved and printed for your convenience.

Important Information

This website is not intended for children, and we do not knowingly collect data relating to children. When you register with Copart as a member, you acknowledge that you are of legal age to make bids on vehicles and further agree to our terms and conditions.

It is important that you read this privacy policy together with any other notice we may provide on specific occasions when we are collecting or processing Personal Data about you. This privacy policy supplements other notices and is not intended to override them.

Data Controller

The Copart Group of Companies, including Copart Deutschland GmbH, consists of various legal entities with Copart, Inc. as the ultimate parent company. This privacy policy is issued on behalf Copart Deutschland GmbH (referred to as “Copart”, “we”, “us” or “our”).

Jurisdiction	Entity	Address
United States of America	Copart, Inc.	14185 Dallas Parkway Suite 300 Dallas, TX 75254
Germany	Copart Deutschland GmbH	Copart Deutschland GmbH Am Seestern 24 40547 Düsseldorf Germany

Personal Data We Collect

Depending on the context of your relationship with us, we may collect different categories of data. The tables below detail the categories of data subjects and categories of personal data that we process.

Personal Data Categories	Contact Data
Description of Category	Identifiers, including your postal address, street address for vehicle pickup, email address and phone number and also your business license information.
How We Collect Your Personal Data	Directly from an individual who corresponds with us Directly from our vendors Directly from our members Directly from an individual who sells us a vehicle Directly from an individual who applies for a position, or who we recruit
GDPR Lawful Basis	Performance of a contract with you, Art. 6(1)(b) GDPR. Our legitimate interests, Art. 6(1)(f) GDPR, such as facilitating a communication channel with you, except where such interests are overridden by your interests or fundamental rights and freedoms
Retention Period	Contact Data will be retained as long as we have a business relationship with you.

Personal Data Categories	Financial Data
Description of Category	Identifiers and financial information, including credit card or debit card, mobile pay information such as PayPal and Apple Pay, and bank account/sort code details.
How We Collect Your Personal Data:	Directly from our members Directly from an individual who sells us a vehicle Directly from an individual who picks up a vehicle at one of our yards.
GDPR Lawful Basis	Performance of a contract with you, Art. 6(1)(b) GDPR.
Retention Period	Financial Data will be retained as long as required by relevant statutory time periods. Generally, Financial Data may be stored for 10 years before deletion.

Personal Data Categories	Identity Data
Description of Category	Identifiers and characteristics of a protected class, including first name, last name, member number, username or similar identifier, password, title, date of birth, gender, social security number, tax ID, photo ID, driving license and passport information.
How We Collect Your Personal Data:	Directly from an individual who corresponds with us Directly from our vendors Directly from our members Directly from an individual who sells us a vehicle Directly from an individual who pick up vehicles at one of our yards Directly from an individual who applies for a position, or who we recruit
GDPR Lawful Basis	Performance of a contract with you, Art. 6(1)(b) GDPR. Necessary to comply with a legal obligation, Art. 6(1)(c) GDPR.
Retention Period	Identity Data will be retained as long as we have a business relationship with you.

Personal Data Categories	Marketing and Communications Data
Description of Category	Includes your preferences in receiving marketing from us and our contracted third parties and your communication preferences. This also includes information you provide to us through one of our communication channels.
How We Collect Your Personal Data:	Directly from our members Directly from an individual who corresponds with us.
GDPR Lawful Basis	Your consent, Art. 6(1)(a) GDPR. Our legitimate interests, Art. 6(1)(f) GDPR, such as facilitating a social media platform where you may connect with us, except where such interests are overridden by your interests or fundamental rights and freedoms.
Retention Period	Marketing and Communications Data will be retained as long as we have a business relationship with you, unless you opt-out from receiving marketing related content from us.

Personal Data Categories	Professional and Recruitment Related Data
Description of Category	Previous work experience information, including years employed, prior place of employment, title, and roles within a previous company.
How We Collect Your Personal Data:	Directly from an individual who applies for a position, or who we recruit.
GDPR Lawful Basis	Art.88, §26(1) BDSG (Federal Data Protection Act)
Retention Period	Professional and Recruitment Data will be retained for as long as required to complete the job applicant procedure and to comply with relevant statutory requirements. Generally, this data is retained for 3 to 8 months

Personal Data Categories	Sensory Data
Description of Category	Information processing such as recorded calls or CCTV recordings.
How We Collect Your Personal Data:	Directly from an individual who corresponds with us. Indirectly from an individual who picks up a vehicle from one of our yards. Directly and indirectly from our employees.
GDPR Lawful Basis	Your consent, Art. 6(1)(a) GDPR. Our legitimate interests, Art. 6(1)(f) GDPR, such as establishing CCTV cameras within our facilities, except where such interests are overridden by your interests or fundamental rights and freedoms.
Retention Period	Sensory Data will be retained as long as required to achieve the purpose of collection. For example, to protect our facilities and equipment, CCTV recordings may be stored for approximately one month before deletion.

Personal Data Categories	Technical Data
Description of Category	Internet or other electronic network activity information, including internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, server logs, operating system and platform and other technology on the devices you use to access this website.
How We Collect Your Personal Data:	Directly and indirectly from individuals who visit our website (www.copart.de).
GDPR Lawful Basis	Your consent, Art. 6(1)(a) GDPR. Our legitimate interests, Art. 6(1)(f) GDPR, such as improving and securing our website, except where such interests are overridden by your interests or fundamental rights and freedoms.
Retention Period	Technical Data will be retained as long as required to secure the integrity of our website.

Personal Data Categories	Transaction Data
Description of Category	Commercial information, consisting of information about your transactions with us, including information about items on which you place bids.
How We Collect Your Personal Data:	Indirectly from our members and other individuals who may trade with us.
GDPR Lawful Basis	Performance of a contract with you, Art. 6(1)(b) GDPR. Our legitimate interests, Art. 6(1)(f) GDPR, such as improving our sites and services, except where such interests are overridden by your interests or fundamental rights and freedoms.
Retention Period	Transaction Data will be retained as long as required by applicable law. Generally, Transaction Data may be retained for up to 10 years to meet relevant statutory requirements.

Personal Data Categories	Usage Data
Description of Category	Internet or other electronic network activity information, including information about how you use our website, products, and services.
How We Collect Your Personal Data:	Indirectly from our members. Indirectly from individuals who visit our website and use our services.
GDPR Lawful Basis	Your consent, Art. 6(1)(a) GDPR. Our legitimate interests, Art. 6(1)(f) GDPR, such as improving and securing our website, except where such interests are overridden by your interests or fundamental rights and freedoms.
Retention Period	Usage Data will be retained as long as we have a business relationship with you. After our relationship has expired, we may further retain certain Usage Data only after anonymization has occurred.

Personal Data Categories	Vehicle Data
Description of Category	Includes the make, model, condition of the vehicle, and vehicle identification number (VIN), which some jurisdictions classify as Personal Data.
How We Collect Your Personal Data:	Directly from an individual who sells us a vehicle.
GDPR Lawful Basis	Your consent, Art. 6(1)(a) GDPR. Performance of a contract with you, Art. 6(1)(b) GDPR.
Retention Period	Vehicle Data will be retained as long as required by applicable law. Generally, Vehicle Data may be retained for up to 10 years to meet relevant statutory requirements.

Personal Data Categories	Description of Category	How We Collect Your Personal Data	GDPR Lawful Basis	Retention Period
Contact Data	Identifiers, including your postal address, street address for vehicle pickup, email address and phone number and also your business license information.	Directly from an individual who corresponds with us Directly from our vendors Directly from our members Directly from an individual who sells us a vehicle Directly from an individual who applies for a position, or who we recruit	Performance of a contract with you, Art. 6(1)(b) GDPR. Our legitimate interests, Art. 6(1)(f) GDPR, such as facilitating a communication channel with you, except where such interests are overridden by your interests or fundamental rights and freedoms	Contact Data will be retained as long as we have a business relationship with you.
Financial Data	Identifiers and financial information, including credit card or debit card, mobile pay information such as PayPal and Apple Pay, and bank account/sort code details.	Directly from our members Directly from an individual who sells us a vehicle Directly from an individual who picks up a vehicle at one of our yards.	Performance of a contract with you, Art. 6(1)(b) GDPR.	Financial Data will be retained as long as required by relevant statutory time periods. Generally, Financial Data may be stored for 10 years before deletion.
Identity Data	Identifiers and characteristics of a protected class, including first name, last name, member number, username or similar identifier, password, title, date of birth, gender, social security number, tax ID, photo ID, driving license and passport information.	Directly from an individual who corresponds with us Directly from our vendors Directly from our members Directly from an individual who sells us a vehicle Directly from an individual who pick up vehicles at one of our yards Directly from an individual who applies for a position, or who we recruit	Performance of a contract with you, Art. 6(1)(b) GDPR. Necessary to comply with a legal obligation, Art. 6(1)(c) GDPR.	Identity Data will be retained as long as we have a business relationship with you.
Marketing and Communications Data	Includes your preferences in receiving marketing from us and our contracted third parties and your communication preferences. This also includes information you provide to us through one of our communication channels.	Directly from our members Directly from an individual who corresponds with us.	Your consent, Art. 6(1)(a) GDPR. Our legitimate interests, Art. 6(1)(f) GDPR, such as facilitating a social media platform where you may connect with us, except where such interests are overridden by your interests or fundamental rights and freedoms.	Marketing and Communications Data will be retained as long as we have a business relationship with you, unless you opt-out from receiving marketing related content from us.
Professional and Recruitment Related Data	Previous work experience information, including years employed, prior place of employment, title, and roles within a previous company.	Directly from an individual who applies for a position, or who we recruit.	Art.88, §26(1) BDSG (Federal Data Protection Act)	Professional and Recruitment Data will be retained for as long as required to complete the job applicant procedure and to comply with relevant statutory requirements. Generally, this data is retained for 3 to 8 months
Sensory Data	Information processing such as recorded calls or CCTV recordings.	Directly from an individual who corresponds with us. Indirectly from an individual who picks up a vehicle from one of our yards. Directly and indirectly from our employees.	Your consent, Art. 6(1)(a) GDPR. Our legitimate interests, Art. 6(1)(f) GDPR, such as establishing CCTV cameras within our facilities, except where such interests are overridden by your interests or fundamental rights and freedoms.	Sensory Data will be retained as long as required to achieve the purpose of collection. For example, to protect our facilities and equipment, CCTV recordings may be stored for approximately one month before deletion.
Technical Data	Internet or other electronic network activity information, including internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, server logs, operating system and platform and other technology on the devices you use to access this website.	Directly and indirectly from individuals who visit our website (www.copart.de).	Your consent, Art. 6(1)(a) GDPR. Our legitimate interests, Art. 6(1)(f) GDPR, such as improving and securing our website, except where such interests are overridden by your interests or fundamental rights and freedoms.	Technical Data will be retained as long as required to secure the integrity of our website.
Transaction Data	Commercial information, consisting of information about your transactions with us, including information about items on which you place bids.	Indirectly from our members and other individuals who may trade with us.	Performance of a contract with you, Art. 6(1)(b) GDPR. Our legitimate interests, Art. 6(1)(f) GDPR, such as improving our sites and services, except where such interests are overridden by your interests or fundamental rights and freedoms.	Transaction Data will be retained as long as required by applicable law. Generally, Transaction Data may be retained for up to 10 years to meet relevant statutory requirements.
Usage Data	Internet or other electronic network activity information, including information about how you use our website, products, and services.	Indirectly from our members. Indirectly from individuals who visit our website and use our services.	Your consent, Art. 6(1)(a) GDPR. Our legitimate interests, Art. 6(1)(f) GDPR, such as improving and securing our website, except where such interests are overridden by your interests or fundamental rights and freedoms.	Usage Data will be retained as long as we have a business relationship with you. After our relationship has expired, we may further retain certain Usage Data only after anonymization has occurred.
Vehicle Data	Includes the make, model, condition of the vehicle, and vehicle identification number (VIN), which some jurisdictions classify as Personal Data.	Directly from an individual who sells us a vehicle.	Your consent, Art. 6(1)(a) GDPR. Performance of a contract with you, Art. 6(1)(b) GDPR.	Vehicle Data will be retained as long as required by applicable law. Generally, Vehicle Data may be retained for up to 10 years to meet relevant statutory requirements.

We collect Personal Data for the following reasons:

Since the processing of your personal data is based on your consent, you have the right to revoke this consent at any time in accordance with Art. 7 (3) DSGVO. You can declare the revocation by e-mail to (privacy@copart.de) or by sending a message to the contact details given in the imprint. The revocation does not affect the legality of the processing carried out on the basis of the consent until the revocation.

Possibility of revocation:

To provide you with information, products, or services that you request from us, Art. 6(1)(b) GDPR. To provide you with email alerts, event registrations and other notices concerning our products or services, or events or news, that may be of interest to you Art. 6(1)(b) and Art. 6 (1)(a) GDPR. As necessary or appropriate to protect the rights, property or safety of us, our members, our customers, or others, Art. 6(1)(f) GDPR. To respond to law enforcement requests and as required by applicable law, court order, or governmental regulations, Art. 6(1)(c) GDPR.

Special Categories

Except in the context of an employment relationship, we do not collect Sensitive Data, which is information regarding criminal convictions or offenses, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, genetics and biometric data. However, because some of our communication channels, such as e-mail, social media, and telephony systems allow end users to provide us with unstructured data, it is possible for Copart to receive unsolicited Personal Data provided by the message sender. We request that you refrain from sharing Sensitive Data through any of these channels.

Sharing Personal Data

In addition to sharing your Personal Data within the Copart Group, we may disclose your Personal Data to external third parties in order to provide you with certain of the services you have requested from us. When we disclose Personal Data to an external third party vendor for a business purpose, we enter into a contract or data processing agreement according to Art. 28 GDPR with the vendor that describes the purpose of the processing and requires the recipient to both keep that Personal Data confidential and not use it for any purpose except performing the contract.

We have disclosed the following categories of Personal Data for a business purpose to the corresponding categories of third parties indicated below:

Data Category	Contact Data
Third Party Category	Communications Service Providers Marketing Service Providers Vehicle Subhaulers Customer Relationship Management Service Providers Regulatory Compliance Service Provider Vendor Management Service Provider Callback service
Business Purpose	To facilitate communications channels between us and you. To provide you with information regarding our products and services in which we think you may be interested. To perform a vehicle pickup as part of our service offering. To manage our relationship with you. To comply with the regulatory obligations applicable to our business operations. To manage the vendors who help us provide our service offerings. To improve accessibility, we use the VirtualQ callback service and use the following to contact you your telephone number (call and/or SMS) and IP address, which is transmitted for the duration of the processing.

Data Category	Financial Data
Third Party Category	Financial Service Providers Regulatory Compliance Service Provider
Business Purpose	To facilitate payment for the goods or services you purchase from us or sell to us.

Data Category	Identity Data
Third Party Category	Regulatory Compliance Service Provider Vehicle Subhaulers Marketing Service Providers Data Analytics Service Providers Data Analytics Service Providers Identification Verification Service Providers Customer Relationship Management Service Providers Vendor Management Service Provider
Business Purpose	To comply with the regulatory obligations applicable to our business operations. To perform a vehicle pickup as part of our service offering. To provide you with information regarding our products and services in which we think you may be interested. To analyze trends and performance of our website and electronic services. To ensure the appropriate individual is collecting a vehicle from us. To manage our relationship with you. To manage the vendors who help us provide our service offerings.

Data Category	Marketing and Communications Data
Third Party Category	Marketing Service Providers Social Media Platforms WhatsApp LLC
Business Purpose	To provide you with information regarding our products and services in which we think you may be interested. To share content with you via our social media platforms. We use the instant messenger service Whatsapp to send messages. This may result in the transmission of personal data that you have provided to us or within the app to WhatsApp Ireland Limited and possibly to the USA. There may currently be no suitable guarantees for data transfer to the USA. Regarding the processing of your data by WhatsApp Ireland Limited, we refer to the privacy policy in its current version.

Data Category	Professional and Recruitment Related Data
Third Party Category	Background Verification Service Provider
Business Purpose	To perform a background check that may be performed during the recruitment process.

Data Category	Sensory Data
Third Party Category	Video Surveillance Service Provider Telephony and Call-Recording Service Provider
Business Purpose	To review calls with customer representatives for quality assurance. To effectively operate and protect our physical facilities.

Data Category	Technical Data
Third Party Category	Information Technology Service Providers Data Analytics Service Providers
Business Purpose	To effectively operate and protect our website and electronic services. To analyze trends and performance of our website and electronic services.

Data Category	Transaction Data
Third Party Category	Data Analytics Service Provider
Business Purpose	To analyze trends and performance of our website and electronic services.

Data Category	Usage Data
Third Party Category	Data Analytics Service Provider
Business Purpose	To analyze trends and performance of our website and electronic services.

Data Category	Vehicle Data
Third Party Category	VIN Scanning Service Provider
Business Purpose	To analyze a vehicle for a potential purchase.

Data Category	Third Party Category	Business Purpose
Contact Data	Communications Service Providers Marketing Service Providers Vehicle Subhaulers Customer Relationship Management Service Providers Regulatory Compliance Service Provider Vendor Management Service Provider Callback service	To facilitate communications channels between us and you. To provide you with information regarding our products and services in which we think you may be interested. To perform a vehicle pickup as part of our service offering. To manage our relationship with you. To comply with the regulatory obligations applicable to our business operations. To manage the vendors who help us provide our service offerings. To improve accessibility, we use the VirtualQ callback service and use the following to contact you your telephone number (call and/or SMS) and IP address, which is transmitted for the duration of the processing.
Financial Data	Financial Service Providers Regulatory Compliance Service Provider	To facilitate payment for the goods or services you purchase from us or sell to us.
Identity Data	Regulatory Compliance Service Provider Vehicle Subhaulers Marketing Service Providers Data Analytics Service Providers Data Analytics Service Providers Identification Verification Service Providers Customer Relationship Management Service Providers Vendor Management Service Provider	To comply with the regulatory obligations applicable to our business operations. To perform a vehicle pickup as part of our service offering. To provide you with information regarding our products and services in which we think you may be interested. To analyze trends and performance of our website and electronic services. To ensure the appropriate individual is collecting a vehicle from us. To manage our relationship with you. To manage the vendors who help us provide our service offerings.
Marketing and Communications Data	Marketing Service Providers Social Media Platforms WhatsApp LLC	To provide you with information regarding our products and services in which we think you may be interested. To share content with you via our social media platforms. We use the instant messenger service Whatsapp to send messages. This may result in the transmission of personal data that you have provided to us or within the app to WhatsApp Ireland Limited and possibly to the USA. There may currently be no suitable guarantees for data transfer to the USA. Regarding the processing of your data by WhatsApp Ireland Limited, we refer to the privacy policy in its current version.
Professional and Recruitment Related Data	Background Verification Service Provider	To perform a background check that may be performed during the recruitment process.
Sensory Data	Video Surveillance Service Provider Telephony and Call-Recording Service Provider	To review calls with customer representatives for quality assurance. To effectively operate and protect our physical facilities.
Technical Data	Information Technology Service Providers Data Analytics Service Providers	To effectively operate and protect our website and electronic services. To analyze trends and performance of our website and electronic services.
Transaction Data	Data Analytics Service Provider	To analyze trends and performance of our website and electronic services.
Usage Data	Data Analytics Service Provider	To analyze trends and performance of our website and electronic services.
Vehicle Data	VIN Scanning Service Provider	To analyze a vehicle for a potential purchase.

In addition, we may also disclose your Personal Data in the following circumstances:

In connection with the sale of a business (including merger, acquisition, or sale of all or a material portion of the business’s assets, change in corporate control, or insolvency or bankruptcy proceedings),
To enforce our terms of service or rules; to ensure the safety and security of our users and third parties; to protect our rights and property and the rights and property of our users and third parties; and to comply with legal process, including pursuant to a judicial warrant, rule, order or subpoena, or in other cases if we believe in good faith that disclosure is required by law or regulation, in each case, without obligation to contest such legal process.

Discount promotions

Before we send you an email with information about our discount promotion or other products, we ask by telephone whether there is an interest in a membership and participation in the discount promotion and whether you agree to a processing of your identity, contact, technical, usage and transaction data and the receipt of email advertising. The legal basis for the processing is Art. 6 para. 1 sentence 1 lit. a DSGVO.

Withdrawing Consent for discount campaigns

Copart members who had previously opted in to participate in the discount promotions can revoke their consent to receive emails with information about our offers at any time and object to the processing of your personal data. You can revoke your consent by clicking on the link provided in each email or by sending an email to privacy@copart.de.

Promotional Marketing

Depending on whether you provide your affirmative consent, we may use your identity, contact, technical, usage and transaction data to form a view on what products or services we think you may want or need, or what may be of interest to you. This is how we decide which products, services and offers may be relevant to you.

Withdrawing Consent for Promotional Marketing

Copart members who have previously opted-in to promotional marketing may also opt-out of promotional marketing by submitting a verified request to privacy@copart.de. Additionally, all recipients of marketing and promotional communications may opt-out of future marketing communications by clicking on the link we include at the bottom of all of our email communications.

Customer Surveys

We carry out customer surveys to assess the satisfaction level of our products, services, and personnel. We may process our customer’s, or customer representative’s, email address for this purpose in accordance with our legitimate interests Art. 6 (1)(f) GDPR. Customer surveys will be delivered via an email that contains a link to the survey, and all responses will be anonymous.

International Transfers

Most commonly, the Personal Data we process will remain in the European Union. However, in a very limited instance, we may transfer your personal data to recipients that are located outside of the European Union, including Copart, Inc., which is located in the United States. The primary reason for this access is to provide Copart Deutschland GmbH with troubleshooting support if technical issues arise. In any event, we will provide appropriate safeguards for your Personal Data in accordance with Article 46 GDPR to facilitate these transfers.

The transmission of Personal Data between and among certain members of the Copart Group, which consists of Copart, Inc. and its direct and indirect wholly-owned subsidiaries, is based on our worldwide data protection principles contained in our Intra-Group Processing Agreement, which incorporate both controller to controller and controller to processor model clauses. Through our Intra-Group Processing Agreement, the Copart Group undertakes to protect your Personal Data and to comply with applicable data protection laws and regulations.

Your Rights and Choices

Subject to possible restrictions under national law, as a data subject under the GDPR, you may have certain rights regarding the Personal Data that we collect on you. These rights are described in the below table.

Data Subject Rights	Access (Art. 15 GDPR)
Description	In certain circumstances, you may request information on the processing purposes, the categories of personal data, the categories of recipients to whom your personal data has been or will be disclosed, the planned retention period, the existence of a right to rectification, deletion, restriction of processing or opposition, the existence of a right of appeal, the origin of their data, if not collected by us, transmission to third countries or to international organizations, and the existence of automated decision-making, including, where appropriate, information on the existence of automated decision-making, including profiling.

Data Subject Rights

Access (Art. 15 GDPR)

Description

In certain circumstances, you may request information on the processing purposes, the categories of personal data, the categories of recipients to whom your personal data has been or will be disclosed, the planned retention period, the existence of a right to rectification, deletion, restriction of processing or opposition, the existence of a right of appeal, the origin of their data, if not collected by us, transmission to third countries or to international organizations, and the existence of automated decision-making, including, where appropriate, information on the existence of automated decision-making, including profiling.

Data Subject Rights	Rectification (Art. 16 GDPR)
Description	In certain circumstances, you may request that inaccurate personal data be corrected or rectified.

Data Subject Rights	Deletion (Art. 17 GDPR)
Description	In certain circumstances, you have the right to request that a business delete any personal data about the data subject that the business has collected from the data subject.

Data Subject Rights	Restrict Processing (Art. 18 GDPR)
Description	In certain circumstances, you have the right to ask us to restrict (stop any active) processing of your personal data: where you believe the personal data we hold about you is inaccurate and while we verify accuracy; where we want to erase your personal data as the processing is unlawful but you want us to continue to store it; where we no longer need your personal data for the purposes of our processing but you require us to retain the data for the establishment, exercise or defense of legal claims; or where you have objected to us processing your personal data based on our legitimate interests and we are considering your objection.

Data Subject Rights

Restrict Processing (Art. 18 GDPR)

Description

In certain circumstances, you have the right to ask us to restrict (stop any active) processing of your personal data: where you believe the personal data we hold about you is inaccurate and while we verify accuracy; where we want to erase your personal data as the processing is unlawful but you want us to continue to store it; where we no longer need your personal data for the purposes of our processing but you require us to retain the data for the establishment, exercise or defense of legal claims; or where you have objected to us processing your personal data based on our legitimate interests and we are considering your objection.

Data Subject Rights	Data Portability (Art. 20 GDPR)
Description	In certain circumstances, you shall have the right to receive the personal data concerning you, in a structured, commonly used, and machine-readable format and have the right to transmit such data to another controller.

Data Subject Rights	Object to Processing (Art. 21 GDPR)
Description	In certain circumstances, you can object to our processing of your personal data based on our legitimate interests and we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.

Data Subject Rights	Object to Automated Decision-Making (Art. 22 GDPR)
Description	In certain circumstances, you have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you. However, Copart does not utilize solely automated decision-making in the processing of your Personal Data.

Data Subject Rights	Description
Access (Art. 15 GDPR)	In certain circumstances, you may request information on the processing purposes, the categories of personal data, the categories of recipients to whom your personal data has been or will be disclosed, the planned retention period, the existence of a right to rectification, deletion, restriction of processing or opposition, the existence of a right of appeal, the origin of their data, if not collected by us, transmission to third countries or to international organizations, and the existence of automated decision-making, including, where appropriate, information on the existence of automated decision-making, including profiling.
Rectification (Art. 16 GDPR)	In certain circumstances, you may request that inaccurate personal data be corrected or rectified.
Deletion (Art. 17 GDPR)	In certain circumstances, you have the right to request that a business delete any personal data about the data subject that the business has collected from the data subject.
Restrict Processing (Art. 18 GDPR)	In certain circumstances, you have the right to ask us to restrict (stop any active) processing of your personal data: where you believe the personal data we hold about you is inaccurate and while we verify accuracy; where we want to erase your personal data as the processing is unlawful but you want us to continue to store it; where we no longer need your personal data for the purposes of our processing but you require us to retain the data for the establishment, exercise or defense of legal claims; or where you have objected to us processing your personal data based on our legitimate interests and we are considering your objection.
Data Portability (Art. 20 GDPR)	In certain circumstances, you shall have the right to receive the personal data concerning you, in a structured, commonly used, and machine-readable format and have the right to transmit such data to another controller.
Object to Processing (Art. 21 GDPR)	In certain circumstances, you can object to our processing of your personal data based on our legitimate interests and we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.
Object to Automated Decision-Making (Art. 22 GDPR)	In certain circumstances, you have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you. However, Copart does not utilize solely automated decision-making in the processing of your Personal Data.

Exercising Your Rights

You may generally exercise one or more of your rights described above free of charge. When requests are manifestly unfounded or excessive, in particular because of their repetitive character, we may charge an appropriate fee in accordance with the applicable regulations or refuse to process the application.

To exercise your rights as a data subject under the GDPR, please submit a verifiable request to:

privacy@copart.de.

Additionally, as a data subject under the GDPR, you have the right to lodge a complaint with your applicable supervisory authority. However, we would appreciate the chance to deal with your concern before you approach a supervisory authority so please contact us in the first instance.

Cookies and Similar Technologies

When you use our services, we and selected third parties may use cookies and similar technologies to provide you with a better, faster, and safer user experience or to show you personalized advertising. Cookies are small text files that are automatically created by your browser and stored on your device when you use the services.

Our cookies and similar technologies have different functions:

They may be technically necessary for the provision of our services;
They help us optimize our services technically (e.g. monitoring load times and errors);
They help us improve your user experience;
They allow us to show you more relevant advertisements.

Please visit our Cookie Policy if you wish to review our cookies further detail.

Data Security and Data Retention

We implement and maintain reasonable security measures to prevent your Personal Data from being used, accessed, altered, or disclosed in an unauthorized way. Please note that any information you send to us electronically may not be secure when it is transmitted to us. We recommend that you do not use unsecure channels to communicate sensitive or confidential information to us. Please be aware that despite our best efforts, no security measures are perfect or impenetrable.

Data Retention

We will only retain your Personal Data for as long as necessary to fulfill the purpose we collected it for, including for the purpose of satisfying any legal, accounting, or reporting requirements.

To determine the appropriate retention period for Personal Data, we consider the amount, nature, and sensitivity of the Personal Data, the potential risk of harm from unauthorized use or disclosure of your Personal Data, the purposes for which we process your Personal Data and whether we can achieve those purposes through other means, and the applicable legal requirements.

Third-Party Links

This website may include links to third-party websites, plug-ins, and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy policy of every website you visit.

If You Fail to Provide Personal Data

When we need to collect Personal Data by law, or under the terms of the contract we have with you and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you. For example, if you do not provide us with required Personal Data, we may be unable to provide you with the services you have requested. In this case, we may have to cancel a contract you have with us, but we will notify you if this is the case.

Non-Discrimination

We will not discriminate against you for exercising any of your Personal Data rights. Unless permitted under applicable law, we will not:

Deny you goods or services.
Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.
Provide you a different level or quality of goods or services.
Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

However, we may offer you certain financial incentives permitted by applicable law that can result in different prices, rates, or quality levels. Any legally permitted financial incentive we offer will reasonably relate to your personal data’s value and contain written terms that describe the program’s material aspects. Participation in a financial incentive program requires your prior opt in consent, which you may revoke at any time.

Change of Purpose

We will only use your Personal Data for the purposes for which we collected it. If we need to use your Personal Data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your Personal Data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

Changes to this Privacy policy

Changes to our Privacy Notice

We reserve the right to amend this privacy policy at our discretion and at any time. When we make changes to this privacy policy, we will notify you by email or through another appropriate communication method.

Contact Information

Contact Information

We have appointed an external data protection officer (“DPO”) who is responsible for overseeing questions regarding this privacy policy, including any requests to exercise your legal rights. If you have any questions or comments about this policy, the ways in which we collect and use your Personal Data, your choices and rights regarding such use, or wish to exercise your rights under the GDPR, please do not hesitate to contact the DPO at:

Dr. Karsten Kinast, LL.M.
KINAST Rechtsanwaltsgesellschaft mbH
Nordstraße 17a
D-50733 Cologne

Phone: +49 (0)221 – 222 183 – 0
Fax: +49 (0)221 – 222 183 – 10
Email: mail@kinast.eu Website: https://www.kinast.eu/